Merge remote-tracking branch 'remotes/rk3399/next-dev' into rk3399-pie-gms-express-baseline

185 files changed, 14138 insertions, 9273 deletions

diff --git a/Makefile b/Makefile
index efedc288d4..e121dbd4d9 100644
--- a/Makefile
+++ b/Makefile
@@ -654,6 +654,7 @@ libs-y += fs/
 libs-y += net/
 libs-y += disk/
 libs-y += drivers/
+libs-y += drivers/cpu/
 libs-y += drivers/dma/
 libs-y += drivers/gpio/
 libs-y += drivers/i2c/
@@ -923,7 +924,11 @@ endif
 quiet_cmd_copy = COPY    $@
       cmd_copy = cp $< $@
 
-u-boot.dtb: dts/dt.dtb
+ifeq ($(CONFIG_USING_KERNEL_DTB),y)
+u-boot.dtb: dts/dt-spl.dtb FORCE
+else
+u-boot.dtb: dts/dt.dtb FORCE
+endif
 	$(call cmd,copy)
 
 OBJCOPYFLAGS_u-boot.hex := -O ihex
diff --git a/arch/arm/dts/px30-evb.dts b/arch/arm/dts/px30-evb.dts
index 43ef6ee50e..906c1f1f72 100644
--- a/arch/arm/dts/px30-evb.dts
+++ b/arch/arm/dts/px30-evb.dts
@@ -90,8 +90,23 @@
 			248 249 250 251 252 253 254 255>;
 		default-brightness-level = <200>;
 	};
+
+	vcc_phy: vcc-phy-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc_phy";
+		regulator-always-on;
+		regulator-boot-on;
+	};
 };
 
+&gmac {
+	phy-supply = <&vcc_phy>;
+	clock_in_out = "output";
+	snps,reset-gpio = <&gpio2 13 GPIO_ACTIVE_LOW>;
+	snps,reset-active-low;
+	snps,reset-delays-us = <0 50000 50000>;
+	status = "okay";
+};
 
 &i2c0 {
 	status = "okay";
diff --git a/arch/arm/dts/px30.dtsi b/arch/arm/dts/px30.dtsi
index 668eb51257..55cd85cc80 100644
--- a/arch/arm/dts/px30.dtsi
+++ b/arch/arm/dts/px30.dtsi
@@ -87,6 +87,13 @@
 		};
 	};
 
+	gmac_clkin: external-gmac-clock {
+		compatible = "fixed-clock";
+		clock-frequency = <50000000>;
+		clock-output-names = "gmac_clkin";
+		#clock-cells = <0>;
+	};
+
 	psci {
 		compatible = "arm,psci-1.0";
 		method = "smc";
@@ -792,7 +799,7 @@
 			      "pclk_mac", "clk_mac_speed";
 		phy-mode = "rmii";
 		pinctrl-names = "default";
-		pinctrl-0 = <&rmii_pins>;
+		pinctrl-0 = <&rmii_pins &mac_refclk_12ma>;
 		resets = <&cru SRST_GMAC_A>;
 		reset-names = "stmmaceth";
 		power-domains = <&power PX30_PD_GMAC>;
@@ -807,6 +814,7 @@
 			 <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
 		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
 		fifo-depth = <0x100>;
+		cd-gpios = <&gpio0 RK_PA3 GPIO_ACTIVE_HIGH>;
 		interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_det &sdmmc_bus4>;
@@ -2176,8 +2184,16 @@
 					/* mac_mdio */
 					<2 RK_PA7 RK_FUNC_2 &pcfg_pull_none>,
 					/* mac_mdc */
-					<2 RK_PB1 RK_FUNC_2 &pcfg_pull_none>,
-					/* mac_clk */
+					<2 RK_PB1 RK_FUNC_2 &pcfg_pull_none>;
+			};
+
+			mac_refclk_12ma: mac-refclk-12ma {
+				rockchip,pins =
+					<2 RK_PB2 RK_FUNC_2 &pcfg_pull_none_12ma>;
+			};
+
+			mac_refclk: mac-refclk {
+				rockchip,pins =
 					<2 RK_PB2 RK_FUNC_2 &pcfg_pull_none>;
 			};
 		};
diff --git a/arch/arm/dts/rk1808-evb.dts b/arch/arm/dts/rk1808-evb.dts
index 728ca1c73b..d857a0b5f2 100644
--- a/arch/arm/dts/rk1808-evb.dts
+++ b/arch/arm/dts/rk1808-evb.dts
@@ -7,6 +7,7 @@
 /dts-v1/;
 #include "rk1808.dtsi"
 #include "rk1808-u-boot.dtsi"
+#include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <linux/media-bus-format.h>
 
@@ -30,6 +31,13 @@
 			press-threshold-microvolt = <10000>;
 		};
 	};
+
+	vcc_phy: vcc-phy-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc_phy";
+		regulator-always-on;
+		regulator-boot-on;
+	};
 };
 
 &emmc {
@@ -44,6 +52,21 @@
 	status = "okay";
 };
 
+&gmac {
+	phy-supply = <&vcc_phy>;
+	phy-mode = "rgmii";
+	clock_in_out = "input";
+	snps,reset-gpio = <&gpio0 10 GPIO_ACTIVE_LOW>;
+	snps,reset-active-low;
+	/* Reset time is 20ms, 100ms for rtl8211f */
+	snps,reset-delays-us = <0 20000 100000>;
+	assigned-clocks = <&cru SCLK_GMAC>;
+	assigned-clock-parents = <&gmac_clkin>;
+	tx_delay = <0x50>;
+	rx_delay = <0x3a>;
+	status = "disabled";
+};
+
 &uart2 {
 	clock-frequency = <24000000>;
 	status = "okay";
diff --git a/arch/arm/dts/rk1808.dtsi b/arch/arm/dts/rk1808.dtsi
index 13ff2b5516..47e1975660 100644
--- a/arch/arm/dts/rk1808.dtsi
+++ b/arch/arm/dts/rk1808.dtsi
@@ -1302,11 +1302,11 @@
 			rgmii_pins: rgmii-pins {
 				rockchip,pins =
 					/* rgmii_txen */
-					<2 RK_PA1 2 &pcfg_pull_none_12ma>,
+					<2 RK_PA1 2 &pcfg_pull_none_4ma>,
 					/* rgmii_txd1 */
-					<2 RK_PA2 2 &pcfg_pull_none_12ma>,
+					<2 RK_PA2 2 &pcfg_pull_none_4ma>,
 					/* rgmii_txd0 */
-					<2 RK_PA3 2 &pcfg_pull_none_12ma>,
+					<2 RK_PA3 2 &pcfg_pull_none_4ma>,
 					/* rgmii_rxd0 */
 					<2 RK_PA4 2 &pcfg_pull_none>,
 					/* rgmii_rxd1 */
@@ -1314,13 +1314,13 @@
 					/* rgmii_rxdv */
 					<2 RK_PA7 2 &pcfg_pull_none>,
 					/* rgmii_mdio */
-					<2 RK_PB0 2 &pcfg_pull_none>,
+					<2 RK_PB0 2 &pcfg_pull_none_2ma>,
 					/* rgmii_mdc */
-					<2 RK_PB2 2 &pcfg_pull_none>,
+					<2 RK_PB2 2 &pcfg_pull_none_2ma>,
 					/* rgmii_txd3 */
-					<2 RK_PB3 2 &pcfg_pull_none_12ma>,
+					<2 RK_PB3 2 &pcfg_pull_none_4ma>,
 					/* rgmii_txd2 */
-					<2 RK_PB4 2 &pcfg_pull_none_12ma>,
+					<2 RK_PB4 2 &pcfg_pull_none_4ma>,
 					/* rgmii_rxd2 */
 					<2 RK_PB5 2 &pcfg_pull_none>,
 					/* rgmii_rxd3 */
@@ -1328,7 +1328,7 @@
 					/* rgmii_clk */
 					<2 RK_PB7 2 &pcfg_pull_none>,
 					/* rgmii_txclk */
-					<2 RK_PC1 2 &pcfg_pull_none_12ma>,
+					<2 RK_PC1 2 &pcfg_pull_none_4ma>,
 					/* rgmii_rxclk */
 					<2 RK_PC2 2 &pcfg_pull_none>;
 			};
@@ -1336,11 +1336,11 @@
 			rmii_pins: rmii-pins {
 				rockchip,pins =
 					/* rmii_txen */
-					<2 RK_PA1 2 &pcfg_pull_none_12ma>,
+					<2 RK_PA1 2 &pcfg_pull_none_4ma>,
 					/* rmii_txd1 */
-					<2 RK_PA2 2 &pcfg_pull_none_12ma>,
+					<2 RK_PA2 2 &pcfg_pull_none_4ma>,
 					/* rmii_txd0 */
-					<2 RK_PA3 2 &pcfg_pull_none_12ma>,
+					<2 RK_PA3 2 &pcfg_pull_none_4ma>,
 					/* rmii_rxd0 */
 					<2 RK_PA4 2 &pcfg_pull_none>,
 					/* rmii_rxd1 */
@@ -1350,9 +1350,9 @@
 					/* rmii_rxdv */
 					<2 RK_PA7 2 &pcfg_pull_none>,
 					/* rmii_mdio */
-					<2 RK_PB0 2 &pcfg_pull_none>,
+					<2 RK_PB0 2 &pcfg_pull_none_2ma>,
 					/* rmii_mdc */
-					<2 RK_PB2 2 &pcfg_pull_none>,
+					<2 RK_PB2 2 &pcfg_pull_none_2ma>,
 					/* rmii_clk */
 					<2 RK_PB7 2 &pcfg_pull_none>;
 			};
diff --git a/arch/arm/dts/rk3229-evb.dts b/arch/arm/dts/rk3229-evb.dts
index 376d1e7d22..5b4c97befc 100644
--- a/arch/arm/dts/rk3229-evb.dts
+++ b/arch/arm/dts/rk3229-evb.dts
@@ -34,6 +34,19 @@
 		regulator-always-on;
 		regulator-boot-on;
 	};
+
+	gpio-keys {
+		u-boot,dm-pre-reloc;
+		compatible = "gpio-keys";
+		status = "okay";
+
+		volume-up {
+			u-boot,dm-pre-reloc;
+			linux,code = <KEY_VOLUMEUP>;
+			label = "Volume Up";
+			gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
+		};
+	};
 };
 
 &dmc {
diff --git a/arch/arm/dts/rk322x-u-boot.dtsi b/arch/arm/dts/rk322x-u-boot.dtsi
index 432af90b7c..3d73382141 100644
--- a/arch/arm/dts/rk322x-u-boot.dtsi
+++ b/arch/arm/dts/rk322x-u-boot.dtsi
@@ -61,3 +61,17 @@
 	u-boot,dm-pre-reloc;
 	status = "okay";
 };
+
+&pinctrl {
+	u-boot,dm-pre-reloc;
+	status = "okay";
+};
+
+&gpio1 {
+	u-boot,dm-pre-reloc;
+};
+
+&gpio3 {
+	u-boot,dm-pre-reloc;
+	status = "okay";
+};
diff --git a/arch/arm/dts/rk322x.dtsi b/arch/arm/dts/rk322x.dtsi
index d022b025f3..e9ee5a2933 100644
--- a/arch/arm/dts/rk322x.dtsi
+++ b/arch/arm/dts/rk322x.dtsi
@@ -459,6 +459,7 @@
 			 <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
 		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
 		fifo-depth = <0x100>;
+		cd-gpios = <&gpio1 RK_PC1 GPIO_ACTIVE_HIGH>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_bus4>;
 		status = "disabled";
diff --git a/arch/arm/dts/rk3288-u-boot.dtsi b/arch/arm/dts/rk3288-u-boot.dtsi
index 42e2b025ea..e51e5e0373 100644
--- a/arch/arm/dts/rk3288-u-boot.dtsi
+++ b/arch/arm/dts/rk3288-u-boot.dtsi
@@ -65,6 +65,10 @@
 	u-boot,dm-pre-reloc;
 };
 
+&gpio6 {
+	u-boot,dm-pre-reloc;
+};
+
 &usbphy0 {
 	u-boot,dm-pre-reloc;
 	status = "okay";
diff --git a/arch/arm/dts/rk3288.dtsi b/arch/arm/dts/rk3288.dtsi
index 6e7418378e..10249bcbc9 100644
--- a/arch/arm/dts/rk3288.dtsi
+++ b/arch/arm/dts/rk3288.dtsi
@@ -211,6 +211,7 @@
 			 <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
 		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
 		fifo-depth = <0x100>;
+		cd-gpios = <&gpio6 RK_PC6 GPIO_ACTIVE_HIGH>;
 		interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
 		reg = <0xff0c0000 0x4000>;
 		status = "disabled";
diff --git a/arch/arm/dts/rk3308-evb.dts b/arch/arm/dts/rk3308-evb.dts
index dfcd3f2916..7ddcae479f 100644
--- a/arch/arm/dts/rk3308-evb.dts
+++ b/arch/arm/dts/rk3308-evb.dts
@@ -269,6 +269,12 @@
 		status = "okay";
 	};
 
+	vcc_phy: vcc-phy-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "vcc_phy";
+		regulator-always-on;
+		regulator-boot-on;
+	};
 };
 
 &display_subsystem {
@@ -283,6 +289,19 @@
 	status = "okay";
 };
 
+&mac {
+	phy-supply = <&vcc_phy>;
+	assigned-clocks = <&cru SCLK_MAC>;
+	assigned-clock-parents = <&mac_clkin>;
+	clock_in_out = "input";
+	pinctrl-names = "default";
+	pinctrl-0 = <&rmii_pins &mac_refclk>;
+	snps,reset-gpio = <&gpio4 RK_PC0 GPIO_ACTIVE_LOW>;
+	snps,reset-active-low;
+	snps,reset-delays-us = <0 50000 50000>;
+	status = "disabled";
+};
+
 &pwm0 {
 	status = "okay";
 };
diff --git a/arch/arm/dts/rk3308.dtsi b/arch/arm/dts/rk3308.dtsi
index 1e9ec023e6..d51c69a49f 100644
--- a/arch/arm/dts/rk3308.dtsi
+++ b/arch/arm/dts/rk3308.dtsi
@@ -67,6 +67,13 @@
 		interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
 	};
 
+	mac_clkin: external-mac-clock {
+		compatible = "fixed-clock";
+		clock-frequency = <50000000>;
+		clock-output-names = "mac_clkin";
+		#clock-cells = <0>;
+	};
+
 	display_subsystem: display-subsystem {
 		compatible = "rockchip,display-subsystem";
 		ports = <&vop_out>;
@@ -446,6 +453,28 @@
 		status = "disabled";
 	};
 
+	mac: ethernet@ff4e0000 {
+		compatible = "rockchip,rk3308-mac";
+		reg = <0x0 0xff4e0000 0x0 0x10000>;
+		rockchip,grf = <&grf>;
+		interrupts = <GIC_SPI 64 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "macirq";
+		clocks = <&cru SCLK_MAC>, <&cru SCLK_MAC_RX_TX>,
+			 <&cru SCLK_MAC_RX_TX>, <&cru SCLK_MAC_REF>,
+			 <&cru SCLK_MAC>, <&cru ACLK_MAC>,
+			 <&cru PCLK_MAC>, <&cru SCLK_MAC_RMII>;
+		clock-names = "stmmaceth", "mac_clk_rx",
+			      "mac_clk_tx", "clk_mac_ref",
+			      "clk_mac_refout", "aclk_mac",
+			      "pclk_mac", "clk_mac_speed";
+		phy-mode = "rmii";
+		pinctrl-names = "default";
+		pinctrl-0 = <&rmii_pins &mac_refclk_12ma>;
+		resets = <&cru SRST_MAC_A>;
+		reset-names = "stmmaceth";
+		status = "disabled";
+	};
+
 	cru: clock-controller@ff500000 {
 		compatible = "rockchip,rk3308-cru";
 		reg = <0x0 0xff500000 0x0 0x1000>;
@@ -1046,10 +1075,19 @@
 					/* mac_mdio */
 					<1 RK_PB6 3 &pcfg_pull_none>,
 					/* mac_mdc */
-					<1 RK_PB5 3 &pcfg_pull_none>,
-					/* mac_clk */
+					<1 RK_PB5 3 &pcfg_pull_none>;
+			};
+
+			mac_refclk_12ma: mac-refclk-12ma {
+				rockchip,pins =
+					<1 RK_PB4 3 &pcfg_pull_none_12ma>;
+			};
+
+			mac_refclk: mac-refclk {
+				rockchip,pins =
 					<1 RK_PB4 3 &pcfg_pull_none>;
 			};
+
 		};
 
 		lcdc {
diff --git a/arch/arm/dts/rk3328-u-boot.dtsi b/arch/arm/dts/rk3328-u-boot.dtsi
index 7a07362a95..dc5dc68bf5 100644
--- a/arch/arm/dts/rk3328-u-boot.dtsi
+++ b/arch/arm/dts/rk3328-u-boot.dtsi
@@ -11,6 +11,7 @@
 	};
 
 	chosen {
+		u-boot,spl-boot-order = &sdmmc, &emmc;
 		stdout-path = &uart2;
 	};
 
diff --git a/arch/arm/dts/rk3368-px5-evb-u-boot.dtsi b/arch/arm/dts/rk3368-px5-evb-u-boot.dtsi
index 3a5e30ea55..ce515853d0 100644
--- a/arch/arm/dts/rk3368-px5-evb-u-boot.dtsi
+++ b/arch/arm/dts/rk3368-px5-evb-u-boot.dtsi
@@ -3,6 +3,27 @@
  *
  * SPDX-License-Identifier:     GPL-2.0+	X11
  */
+/ {
+	chosen {
+		u-boot,spl-boot-order = &emmc;
+	};
+};
+
+&dmc {
+	u-boot,dm-pre-reloc;
+
+	/*
+	 * PX5-evb(2GB) need to use CBRD mode, or else the dram is not correct
+	 * See doc/device-tree-bindings/clock/rockchip,rk3368-dmc.txt for
+	 * details on the 'rockchip,memory-schedule' property and how it
+	 * affects the physical-address to device-address mapping.
+	 */
+	rockchip,memory-schedule = <DMC_MSCH_CBRD>;
+	rockchip,ddr-frequency = <800000000>;
+	rockchip,ddr-speed-bin = <DDR3_1600K>;
+
+	status = "okay";
+};
 
 &pinctrl {
 	u-boot,dm-pre-reloc;
@@ -21,6 +42,10 @@
 	u-boot,dm-pre-reloc;
 };
 
+&sgrf {
+        u-boot,dm-pre-reloc;
+};
+
 &cru {
 	u-boot,dm-pre-reloc;
 };
@@ -32,3 +57,7 @@
 &uart4 {
 	u-boot,dm-pre-reloc;
 };
+
+&emmc {
+	u-boot,dm-pre-reloc;
+};
diff --git a/arch/arm/dts/rk3399-evb.dts b/arch/arm/dts/rk3399-evb.dts
index bbc1c0f4a1..e8e240898c 100644
--- a/arch/arm/dts/rk3399-evb.dts
+++ b/arch/arm/dts/rk3399-evb.dts
@@ -25,7 +25,7 @@
 		status = "okay";
 		io-channels = <&saradc 1>;
 
-		vol-up-key {
+		vol-up-key0 {
 			u-boot,dm-pre-reloc;
 			linux,code = <KEY_VOLUMEUP>;
 			label = "volume up";
@@ -40,7 +40,7 @@
 		status = "okay";
 		io-channels = <&saradc 2>;
 
-		vol-up-key {
+		vol-up-key1 {
 			u-boot,dm-pre-reloc;
 			linux,code = <KEY_VOLUMEUP>;
 			label = "volume up";
diff --git a/arch/arm/dts/rk3399pro-npu-evb.dts b/arch/arm/dts/rk3399pro-npu-evb.dts
index 752ed00a85..00e521c36b 100644
--- a/arch/arm/dts/rk3399pro-npu-evb.dts
+++ b/arch/arm/dts/rk3399pro-npu-evb.dts
@@ -17,9 +17,9 @@
 		stdout-path = &uart2;
 	};
 
-	ramdisk-readonly {
+	ramdisk-ro {
 		u-boot,dm-pre-reloc;
-		compatible = "ramdisk-readonly";
+		compatible = "ramdisk-ro";
 		status = "okay";
 	};
 };
diff --git a/arch/arm/dts/rv1108-evb.dts b/arch/arm/dts/rv1108-evb.dts
index d63e0cf1df..db5aebb6d5 100644
--- a/arch/arm/dts/rv1108-evb.dts
+++ b/arch/arm/dts/rv1108-evb.dts
@@ -7,6 +7,7 @@
 /dts-v1/;
 
 #include "rv1108.dtsi"
+#include "rv1108-u-boot.dtsi"
 #include "rv1108-sdram-ddr3-400.dtsi"
 #include <dt-bindings/input/input.h>
 
@@ -182,7 +183,6 @@
 };
 
 &emmc {
-	u-boot,dm-pre-reloc;
 	bus-width = <8>;
 	cap-mmc-highspeed;
 	supports-emmc;
diff --git a/arch/arm/dts/rv1108-u-boot.dtsi b/arch/arm/dts/rv1108-u-boot.dtsi
new file mode 100644
index 0000000000..f065afd9d0
--- /dev/null
+++ b/arch/arm/dts/rv1108-u-boot.dtsi
@@ -0,0 +1,27 @@
+/*
+ * (C) Copyright 2019 Rockchip Electronics Co., Ltd
+ *
+ * SPDX-License-Identifier:     GPL-2.0+
+ */
+
+&emmc {
+	u-boot,dm-pre-reloc;
+};
+
+&dmc {
+	u-boot,dm-pre-reloc;
+};
+
+&grf {
+	u-boot,dm-pre-reloc;
+};
+
+&uart2 {
+	u-boot,dm-pre-reloc;
+};
+&uart1 {
+	u-boot,dm-pre-reloc;
+};
+&uart0 {
+	u-boot,dm-pre-reloc;
+};
diff --git a/arch/arm/dts/rv1108.dtsi b/arch/arm/dts/rv1108.dtsi
index 349e72a987..5354ac3b1e 100644
--- a/arch/arm/dts/rv1108.dtsi
+++ b/arch/arm/dts/rv1108.dtsi
@@ -682,7 +682,6 @@
 	};
 
 	dmc: dmc@202b0000 {
-                u-boot,dm-pre-reloc;
                 compatible = "rockchip,rv1108-dmc";
                 reg = <0x202b0000 0x400
 		       0x20210000 0x400
diff --git a/arch/arm/include/asm/arch-rockchip/cru_rk1808.h b/arch/arm/include/asm/arch-rockchip/cru_rk1808.h
index ad97d41332..c6515a391c 100644
--- a/arch/arm/include/asm/arch-rockchip/cru_rk1808.h
+++ b/arch/arm/include/asm/arch-rockchip/cru_rk1808.h
@@ -181,6 +181,19 @@ enum {
 	EMMC_DIV50_SHIFT		= 0,
 	EMMC_DIV50_MASK			= 0xff << EMMC_DIV_SHIFT,
 
+	/* CRU_CLKSEL26_CON */
+	GMAC_PLL_SEL_SHIFT		= 14,
+	GMAC_PLL_SEL_MASK		= 3 << GMAC_PLL_SEL_SHIFT,
+	GMAC_PLL_SEL_CPLL		= 0,
+	GMAC_PLL_SEL_NPLL,
+	GMAC_PLL_SEL_PPLL,
+	CLK_GMAC_DIV_SHIFT		= 8,
+	CLK_GMAC_DIV_MASK		= 0x1f << CLK_GMAC_DIV_SHIFT,
+	SFC_PLL_SEL_SHIFT		= 7,
+	SFC_PLL_SEL_MASK		= 1 << SFC_PLL_SEL_SHIFT,
+	SFC_DIV_CON_SHIFT		= 0,
+	SFC_DIV_CON_MASK		= 0x7f,
+
 	/* CRU_CLK_SEL27_CON */
 	CLK_BUS_PLL_SEL_GPLL		= 0,
 	CLK_BUS_PLL_SEL_CPLL		= 1,
@@ -188,6 +201,17 @@ enum {
 	CLK_BUS_PLL_SEL_MASK		= 1 << CLK_BUS_PLL_SEL_SHIFT,
 	HSCLK_BUS_DIV_CON_SHIFT		= 8,
 	HSCLK_BUS_DIV_CON_MASK		= 0x1f << HSCLK_BUS_DIV_CON_SHIFT,
+	RGMII_CLK_SEL_SHIFT		= 2,
+	RGMII_CLK_SEL_MASK		= 3 << RGMII_CLK_SEL_SHIFT,
+	RGMII_CLK_SEL_125M		= 0,
+	RGMII_CLK_SEL_2M		= 2,
+	RGMIIC_CLK_SEL_25M		= 3,
+	RMII_CLK_SEL_SHIFT		= 1,
+	RMII_CLK_SEL_MASK		= 1 << RMII_CLK_SEL_SHIFT,
+	RMII_EXTCLK_SEL_SHIFT		= 0,
+	RMII_EXTCLK_SEL_MASK		= 1 << RMII_EXTCLK_SEL_SHIFT,
+	RMII_EXTCLK_SEL_INT		= 0,
+	RMII_EXTCLK_SEL_EXT,
 
 	/* CRU_CLK_SEL28_CON */
 	MSCLK_BUS_DIV_CON_SHIFT		= 8,
diff --git a/arch/arm/include/asm/arch-rockchip/cru_rk3308.h b/arch/arm/include/asm/arch-rockchip/cru_rk3308.h
index 0f0b5e43bb..8ebd6e1903 100644
--- a/arch/arm/include/asm/arch-rockchip/cru_rk3308.h
+++ b/arch/arm/include/asm/arch-rockchip/cru_rk3308.h
@@ -261,6 +261,23 @@ enum {
 	EMMC_DIV_SHIFT		= 0,
 	EMMC_DIV_MASK		= 0xff << EMMC_DIV_SHIFT,
 
+	/* CRU_CLKSEL43_CON */
+	MAC_CLK_SPEED_SEL_SHIFT = 15,
+	MAC_CLK_SPEED_SEL_MASK = 1 << MAC_CLK_SPEED_SEL_SHIFT,
+	MAC_CLK_SPEED_SEL_10M = 0,
+	MAC_CLK_SPEED_SEL_100M,
+	MAC_CLK_SOURCE_SEL_SHIFT = 14,
+	MAC_CLK_SOURCE_SEL_MASK = 1 << MAC_CLK_SOURCE_SEL_SHIFT,
+	MAC_CLK_SOURCE_SEL_INTERNAL	= 0,
+	MAC_CLK_SOURCE_SEL_EXTERNAL,
+	MAC_PLL_SHIFT		= 6,
+	MAC_PLL_MASK		= 0x3 << MAC_PLL_SHIFT,
+	MAC_SEL_DPLL		= 0,
+	MAC_SEL_VPLL0,
+	MAC_SEL_VPLL1,
+	MAC_DIV_SHIFT		= 0,
+	MAC_DIV_MASK		= 0x1f << MAC_DIV_SHIFT,
+
 	/* CRU_CLK_SEL45_CON */
 	AUDIO_PCLK_DIV_SHIFT	= 8,
 	AUDIO_PCLK_DIV_MASK	= 0x1f << AUDIO_PCLK_DIV_SHIFT,
diff --git a/arch/arm/include/asm/arch-rockchip/cru_rk3368.h b/arch/arm/include/asm/arch-rockchip/cru_rk3368.h
index a965129703..db2d777bde 100644
--- a/arch/arm/include/asm/arch-rockchip/cru_rk3368.h
+++ b/arch/arm/include/asm/arch-rockchip/cru_rk3368.h
@@ -130,6 +130,10 @@ enum {
 	ACLK_PERI_DIV_CON_SHIFT		= 0,
 	ACLK_PERI_DIV_CON_MASK		= 0x1f,
 
+	/* CLKSEL10CON */
+	PCLK_ALIVE_DIV_CON_SHIFT	= 8,
+	PCLK_ALIVE_DIV_CON_MASK		= 0x1f << PCLK_ALIVE_DIV_CON_SHIFT,
+
 	/* CLKSEL12_CON */
 	MCU_STCLK_DIV_SHIFT		= 8,
 	MCU_STCLK_DIV_MASK		= GENMASK(10, 8),
diff --git a/arch/arm/include/asm/arch-rockchip/param.h b/arch/arm/include/asm/arch-rockchip/param.h
index 66ba2ac22e..dbfb1fb27f 100644
--- a/arch/arm/include/asm/arch-rockchip/param.h
+++ b/arch/arm/include/asm/arch-rockchip/param.h
@@ -7,28 +7,36 @@
 #ifndef __ROCKCHIP_PARAM_H_
 #define __ROCKCHIP_PARAM_H_
 
-#include <sysmem.h>
+#include <memblk.h>
+
+/**
+ * param_parse_ddr_mem() - Parse ddr memory region
+ *
+ * @out_count: valid count of memblock for memblock list.
+ * @return memblock structure list which contains base and size info.
+ */
+struct memblock *param_parse_ddr_mem(int *out_count);
 
 /**
  * param_parse_atf_mem() - Parse atf memory region
  *
- * @return sysmem_property structure which contains base and size info.
+ * @return memblock structure which contains base and size info.
  */
-struct sysmem_property param_parse_atf_mem(void);
+struct memblock param_parse_atf_mem(void);
 
 /**
  * param_parse_atf_mem() - Parse op-tee memory region
  *
- * @return sysmem_property structure which contains base and size info.
+ * @return memblock structure which contains base and size info.
  */
-struct sysmem_property param_parse_optee_mem(void);
+struct memblock param_parse_optee_mem(void);
 
 /**
  * param_parse_atf_mem() - Parse platform common reserved memory region
  *
- * @return sysmem_property structure which contains base and size info.
+ * @return memblock structure which contains base and size info.
  */
-struct sysmem_property param_parse_common_resv_mem(void);
+struct memblock param_parse_common_resv_mem(void);
 
 /**
  * param_parse_bootdev() - Parse boot device info.
diff --git a/arch/arm/include/asm/arch-rockchip/rk_atags.h b/arch/arm/include/asm/arch-rockchip/rk_atags.h
index 78c0039b1e..b9028b35d2 100644
--- a/arch/arm/include/asm/arch-rockchip/rk_atags.h
+++ b/arch/arm/include/asm/arch-rockchip/rk_atags.h
@@ -17,6 +17,8 @@
 #define ATAG_TOS_MEM		0x54410053
 #define ATAG_RAM_PARTITION	0x54410054
 #define ATAG_ATF_MEM		0x54410055
+#define ATAG_PUB_KEY		0x54410056
+#define ATAG_SOC_INFO		0x54410057
 #define ATAG_MAX		0x544100ff
 
 /* Tag size and offset */
@@ -44,6 +46,11 @@
 #define SERIAL_M_MODE_M1	0x1
 #define SERIAL_M_MODE_M2	0x2
 
+/* tag_soc_info.flags */
+#define SOC_FLAGS_ET00		0x45543030
+#define SOC_FLAGS_ET01		0x45543031
+#define SOC_FLAGS_ET02		0x45543032
+
 struct tag_serial {
 	u32 version;
 	u32 enable;
@@ -51,7 +58,8 @@ struct tag_serial {
 	u32 baudrate;
 	u32 m_mode;
 	u32 id;
-	u32 reserved[3];
+	u32 reserved[2];
+	u32 hash;
 } __packed;
 
 struct tag_bootdev {
@@ -59,14 +67,16 @@ struct tag_bootdev {
 	u32 devtype;
 	u32 devnum;
 	u32 mode;
-	u32 reserved[8];
+	u32 reserved[7];
+	u32 hash;
 } __packed;
 
 struct tag_ddr_mem {
 	u32 count;
 	u32 version;
 	u64 bank[20];
-	u32 reserved[4];
+	u32 reserved[3];
+	u32 hash;
 } __packed;
 
 struct tag_tos_mem {
@@ -85,7 +95,9 @@ struct tag_tos_mem {
 		u32 flags;
 	} drm_mem;
 
-	u64 reserved[8];
+	u64 reserved[7];
+	u32 reserved1;
+	u32 hash;
 } __packed;
 
 struct tag_atf_mem {
@@ -93,7 +105,16 @@ struct tag_atf_mem {
 	u64 phy_addr;
 	u32 size;
 	u32 flags;
-	u32 reserved[3];
+	u32 reserved[2];
+	u32 hash;
+} __packed;
+
+struct tag_pub_key {
+	u32 version;
+	u32 len;
+	u8  data[768];
+	u32 reserved[6];
+	u32 hash;
 } __packed;
 
 struct tag_ram_partition {
@@ -105,7 +126,18 @@ struct tag_ram_partition {
 		char name[16];
 		u64 start;
 		u64 size;
-	} part[16];
+	} part[6];
+
+	u32 reserved1[3];
+	u32 hash;
+} __packed;
+
+struct tag_soc_info {
+	u32 version;
+	u32 name;	/* Hex: 0x3288, 0x3399... */
+	u32 flags;
+	u32 reserved[6];
+	u32 hash;
 } __packed;
 
 struct tag_core {
@@ -130,6 +162,8 @@ struct tag {
 		struct tag_tos_mem	tos_mem;
 		struct tag_ram_partition ram_part;
 		struct tag_atf_mem	atf_mem;
+		struct tag_pub_key	pub_key;
+		struct tag_soc_info	soc;
 	} u;
 } __aligned(4);
 
diff --git a/arch/arm/lib/crt0_64.S b/arch/arm/lib/crt0_64.S
index d34e49cc8a..fad7f518c6 100644
--- a/arch/arm/lib/crt0_64.S
+++ b/arch/arm/lib/crt0_64.S
@@ -65,8 +65,26 @@
  */
 
 ENTRY(_main)
+#if defined(CONFIG_SPL_BUILD) && defined(DEBUG)
+	.equ SCTLR_A_BIT,		(1 << 1)
+	.equ SCTLR_SA_BIT,		(1 << 3)
+	.equ SCTLR_I_BIT,		(1 << 12)
 
 /*
+ * Enable the instruction cache, stack pointer
+ * and data access alignment checks
+ */
+	mov	x1, #(SCTLR_I_BIT | SCTLR_A_BIT | SCTLR_SA_BIT)
+	mrs	x0, sctlr_el3
+	orr	x0, x0, x1
+	msr	sctlr_el3, x0
+	isb
+/*
+ * Enable External Abort and SError
+ */
+	msr	daifclr, #4
+#endif
+/*
  * Set up initial C runtime environment and call board_init_f(0).
  */
 #if defined(CONFIG_TPL_BUILD) && defined(CONFIG_TPL_NEEDS_SEPARATE_STACK)
diff --git a/arch/arm/lib/stacktrace.c b/arch/arm/lib/stacktrace.c
index 266aeb2265..1520098219 100644
--- a/arch/arm/lib/stacktrace.c
+++ b/arch/arm/lib/stacktrace.c
@@ -503,7 +503,9 @@ void print_stack_arm32(struct unwind_state_arm32 *state,
 	} while (unwind_stack_arm32(state, exidx, exidx_sz,
 				    kernel_stack, stack, stack_size));
 
-	printf("\nNOTE: Please use ./scripts/stacktrace.sh to parse trace info\n");
+	printf("\nCopy above stack info to a file(eg. dump.txt), and\n"
+	       "execute command in your U-Boot project: "
+	       "./scripts/stacktrace.sh dump.txt\n\n");
 }
 
 void dump_core_stack(struct pt_regs *regs)
diff --git a/arch/arm/lib/stacktrace_64.c b/arch/arm/lib/stacktrace_64.c
index 2494684a84..5637926175 100644
--- a/arch/arm/lib/stacktrace_64.c
+++ b/arch/arm/lib/stacktrace_64.c
@@ -90,7 +90,9 @@ void dump_core_stack(struct pt_regs *regs)
 		printf("	[< %08lx >]\n", pc);
 	} while (walk_stackframe(&frame));
 
-	printf("\nNOTE: Please use ./scripts/stacktrace.sh to parse trace info\n");
+	printf("\nCopy above stack info to a file(eg. dump.txt), and\n"
+	       "execute command in your U-Boot project: "
+	       "./scripts/stacktrace.sh dump.txt\n\n");
 }
 
 void dump_stack(void)
diff --git a/arch/arm/mach-rockchip/Kconfig b/arch/arm/mach-rockchip/Kconfig
index 11402c8b42..040a117dec 100644
--- a/arch/arm/mach-rockchip/Kconfig
+++ b/arch/arm/mach-rockchip/Kconfig
@@ -283,6 +283,12 @@ config ROCKCHIP_RK3368
 
 if ROCKCHIP_RK3368
 
+config ROCKCHIP_PX5
+	bool "Support Rockchip PX5"
+	help
+	  PX5 is a variant of RK3368, it shares codes with RK3368, but we still
+	  need this macro to distinguish PX5 and RK3368.
+
 config TPL_LDSCRIPT
 	default "arch/arm/mach-rockchip/rk3368/u-boot-tpl.lds"
 
@@ -537,6 +543,14 @@ config RKIMG_BOOTLOADER
 	  with dtb and uboot/kernel logo bmp, vendor storage for custom info
 	  like SN and MAC address.
 
+config RKIMG_ANDROID_BOOTMODE_LEGACY
+	bool "Support set androidboot.mode with legacy rule"
+	depends on RKIMG_BOOTLOADER
+	default n
+	help
+	  Rockchip set "androidboot.mode=" as "charger" or boot media for android,
+	  which is a rockchip private solution(SDK < 8.1) and deprecated.
+
 config ROCKCHIP_RESOURCE_IMAGE
 	bool "Enable support for rockchip resource image"
 	depends on RKIMG_BOOTLOADER
@@ -545,6 +559,22 @@ config ROCKCHIP_RESOURCE_IMAGE
 	  This enables support to get dtb or logo files from
 	  rockchip resource image format partition.
 
+config ROCKCHIP_EARLY_DISTRO_DTB
+	bool "Enable support for distro dtb early"
+	depends on DISTRO_DEFAULTS && USING_KERNEL_DTB
+	default n
+	help
+	  This enables loading dtb from distro bootable partition when there
+	  is no valid dtb in android boot.img and rockchip resource.img.
+
+if ROCKCHIP_EARLY_DISTRO_DTB
+
+config ROCKCHIP_EARLY_DISTRO_DTB_PATH
+	string "/rk-kernel.dtb"
+	help
+	  "DTB file path in the bootable partition image"
+endif
+
 config ROCKCHIP_VENDOR_PARTITION
 	bool "Rockchip vendor storage partition support"
 	depends on RKIMG_BOOTLOADER
diff --git a/arch/arm/mach-rockchip/Makefile b/arch/arm/mach-rockchip/Makefile
index 33618ae6ca..00132884a3 100644
--- a/arch/arm/mach-rockchip/Makefile
+++ b/arch/arm/mach-rockchip/Makefile
@@ -24,6 +24,7 @@ obj-y += boot_mode.o
 obj-y += board.o
 obj-y += chip_info.o
 obj-y += iomem.o
+obj-y += memblk.o
 
 obj-$(CONFIG_ROCKCHIP_CRC) += rockchip_crc.o
 obj-$(CONFIG_ROCKCHIP_SMCCC) += rockchip_smccc.o
diff --git a/arch/arm/mach-rockchip/board.c b/arch/arm/mach-rockchip/board.c
index 2244eaffef..16136442df 100644
--- a/arch/arm/mach-rockchip/board.c
+++ b/arch/arm/mach-rockchip/board.c
@@ -5,8 +5,10 @@
  */
 #include <common.h>
 #include <clk.h>
+#include <bidram.h>
 #include <dm.h>
 #include <debug_uart.h>
+#include <memblk.h>
 #include <ram.h>
 #include <syscon.h>
 #include <sysmem.h>
@@ -282,27 +284,142 @@ int interrupt_debugger_init(void)
 	return ret;
 }
 
+#if defined(CONFIG_ROCKCHIP_RK1808) && !defined(CONFIG_COPROCESSOR_RK1808)
+#define PINCTRL_EMMC_BUS8_PATH		"/pinctrl/emmc/emmc-bus8"
+#define PINCTRL_EMMC_CMD_PATH		"/pinctrl/emmc/emmc-cmd"
+#define PINCTRL_EMMC_CLK_PATH		"/pinctrl/emmc/emmc-clk"
+#define PINCTRL_PCFG_PU_2MA_PATH	"/pinctrl/pcfg-pull-up-2ma"
+#define MAX_ROCKCHIP_PINS_ENTRIES	12
+
+static int rockchip_pinctrl_cfg_fdt_fixup(const char *path, u32 new_phandle)
+{
+	u32 cells[MAX_ROCKCHIP_PINS_ENTRIES * 4];
+	const u32 *data;
+	int i, count;
+	int node;
+
+	node = fdt_path_offset(gd->fdt_blob, path);
+	if (node < 0) {
+		debug("%s: can't find: %s\n", __func__, path);
+		return node;
+	}
+
+	data = fdt_getprop(gd->fdt_blob, node, "rockchip,pins", &count);
+	if (!data) {
+		debug("%s: can't find prop \"rockchip,pins\"\n", __func__);
+		return -ENODATA;
+	}
+
+	count /= sizeof(u32);
+	if (count > MAX_ROCKCHIP_PINS_ENTRIES * 4) {
+		debug("%s: %d is over max count\n", __func__, count);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < count; i++)
+		cells[i] = data[i];
+
+	for (i = 0; i < (count >> 2); i++)
+		cells[4 * i + 3] = cpu_to_fdt32(new_phandle);
+
+	fdt_setprop((void *)gd->fdt_blob, node, "rockchip,pins",
+		    &cells, count * sizeof(u32));
+
+	return 0;
+}
+#endif
+
 int board_fdt_fixup(void *blob)
 {
-	__maybe_unused int ret = 0;
+	int ret = 0;
 
+	/*
+	 * Common fixup for DRM
+	 */
 #ifdef CONFIG_DRM_ROCKCHIP
 	rockchip_display_fixup(blob);
 #endif
 
+	/*
+	 * Platform fixup:
+	 *
+	 * - RK3288: Recognize RK3288W by HDMI Revision ID is 0x1A;
+	 * - RK1808: MMC strength 2mA;
+	 */
 #ifdef CONFIG_ROCKCHIP_RK3288
-	/* RK3288W HDMI Revision ID is 0x1A */
 	if (readl(0xff980004) == 0x1A) {
 		ret = fdt_setprop_string(blob, 0,
 					 "compatible", "rockchip,rk3288w");
 		if (ret)
 			printf("fdt set compatible failed: %d\n", ret);
 	}
+#elif defined(CONFIG_ROCKCHIP_RK1808) && !defined(CONFIG_COPROCESSOR_RK1808)
+	struct tag *t;
+	u32 ph_pu_2ma;
+
+	t = atags_get_tag(ATAG_SOC_INFO);
+	if (!t)
+		return 0;
+
+	debug("soc=0x%x, flags=0x%x\n", t->u.soc.name, t->u.soc.flags);
+
+	if (t->u.soc.flags != SOC_FLAGS_ET00)
+		return 0;
+
+	ph_pu_2ma = fdt_get_phandle(gd->fdt_blob,
+		    fdt_path_offset(gd->fdt_blob, PINCTRL_PCFG_PU_2MA_PATH));
+	if (!ph_pu_2ma) {
+		debug("Can't find: %s\n", PINCTRL_PCFG_PU_2MA_PATH);
+		return -EINVAL;
+	}
+
+	ret |= rockchip_pinctrl_cfg_fdt_fixup(PINCTRL_EMMC_BUS8_PATH, ph_pu_2ma);
+	ret |= rockchip_pinctrl_cfg_fdt_fixup(PINCTRL_EMMC_CMD_PATH, ph_pu_2ma);
+	ret |= rockchip_pinctrl_cfg_fdt_fixup(PINCTRL_EMMC_CLK_PATH, ph_pu_2ma);
 #endif
 
 	return ret;
 }
 
+#ifdef CONFIG_ARM64_BOOT_AARCH32
+/*
+ * Fixup MMU region attr for OP-TEE on ARMv8 CPU:
+ *
+ * What ever U-Boot is 64-bit or 32-bit mode, the OP-TEE is always 64-bit mode.
+ *
+ * Command for OP-TEE:
+ *	64-bit mode: dcache is always enabled;
+ *	32-bit mode: dcache is always disabled(Due to some unknown issue);
+ *
+ * Command for U-Boot:
+ *	64-bit mode: MMU table is static defined in rkxxx.c file, all memory
+ *		     regions are mapped. That's good to match OP-TEE MMU policy.
+ *
+ *	32-bit mode: MMU table is setup according to gd->bd->bi_dram[..] where
+ *		     the OP-TEE region has been reserved, so it can not be
+ *		     mapped(i.e. dcache is disabled). That's also good to match
+ *		     OP-TEE MMU policy.
+ *
+ * For the data coherence when communication between U-Boot and OP-TEE, U-Boot
+ * should follow OP-TEE MMU policy.
+ *
+ * Here is the special:
+ *	When CONFIG_ARM64_BOOT_AARCH32 is enabled, U-Boot is 32-bit mode while
+ *	OP-TEE is still 64-bit mode. U-Boot would not map MMU table for OP-TEE
+ *	region(but OP-TEE requires it cacheable) so we fixup here.
+ */
+int board_initr_caches_fixup(void)
+{
+	struct memblock mem;
+
+	mem = param_parse_optee_mem();
+	if (mem.size)
+		mmu_set_region_dcache_behaviour(mem.base, mem.size,
+						DCACHE_WRITEBACK);
+	return 0;
+}
+#endif
+
 void board_quiesce_devices(void)
 {
 #ifdef CONFIG_ROCKCHIP_PRELOADER_ATAGS
@@ -366,32 +483,37 @@ void board_lmb_reserve(struct lmb *lmb)
 }
 #endif
 
-#ifdef CONFIG_SYSMEM
-int board_sysmem_reserve(struct sysmem *sysmem)
+#ifdef CONFIG_BIDRAM
+int board_bidram_reserve(struct bidram *bidram)
 {
-	struct sysmem_property prop;
+	struct memblock mem;
 	int ret;
 
 	/* ATF */
-	prop = param_parse_atf_mem();
-	ret = sysmem_reserve(prop.name, prop.base, prop.size);
+	mem = param_parse_atf_mem();
+	ret = bidram_reserve(MEMBLK_ID_ATF, mem.base, mem.size);
 	if (ret)
 		return ret;
 
 	/* PSTORE/ATAGS/SHM */
-	prop = param_parse_common_resv_mem();
-	ret = sysmem_reserve(prop.name, prop.base, prop.size);
+	mem = param_parse_common_resv_mem();
+	ret = bidram_reserve(MEMBLK_ID_SHM, mem.base, mem.size);
 	if (ret)
 		return ret;
 
 	/* OP-TEE */
-	prop = param_parse_optee_mem();
-	ret = sysmem_reserve(prop.name, prop.base, prop.size);
+	mem = param_parse_optee_mem();
+	ret = bidram_reserve(MEMBLK_ID_OPTEE, mem.base, mem.size);
 	if (ret)
 		return ret;
 
 	return 0;
 }
+
+parse_fn_t board_bidram_parse_fn(void)
+{
+	return param_parse_ddr_mem;
+}
 #endif
 
 #if defined(CONFIG_ROCKCHIP_PRELOADER_SERIAL) && \
diff --git a/arch/arm/mach-rockchip/boot_mode.c b/arch/arm/mach-rockchip/boot_mode.c
index a738bfd79c..f271c5b945 100644
--- a/arch/arm/mach-rockchip/boot_mode.c
+++ b/arch/arm/mach-rockchip/boot_mode.c
@@ -164,6 +164,8 @@ void rockchip_dnl_mode_check(void)
 			printf("recovery key pressed, entering recovery mode!\n");
 			env_set("reboot_mode", "recovery");
 		}
+	} else if (gd->console_evt == CONSOLE_EVT_CTRL_F) {
+		env_set("reboot_mode", "fastboot");
 	}
 }
 
diff --git a/arch/arm/mach-rockchip/memblk.c b/arch/arm/mach-rockchip/memblk.c
new file mode 100644
index 0000000000..7d288ab080
--- /dev/null
+++ b/arch/arm/mach-rockchip/memblk.c
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Fuzhou Rockchip Electronics Co., Ltd
+ */
+
+#include <common.h>
+#include <memblk.h>
+
+const static struct memblk_attr plat_mem_attr[MEMBLK_ID_MAX] = {
+	[MEMBLK_ID_DEMO]     =	{
+		.name = "DEMO",
+		.flags = M_ATTR_NONE,
+	},
+	[MEMBLK_ID_ATF]      =	{
+		.name = "ATF",
+		.flags = M_ATTR_NONE,
+	},
+	[MEMBLK_ID_OPTEE]    =	{
+		.name = "OP-TEE",
+		.flags = M_ATTR_NONE,
+	},
+	[MEMBLK_ID_SHM]      =	{
+		.name = "SHM",
+		.flags = M_ATTR_NONE,
+	},
+	[MEMBLK_ID_UBOOT]    =	{
+		.name = "U-Boot",
+		.flags = M_ATTR_OVERLAP,
+	},
+	[MEMBLK_ID_FASTBOOT] =	{
+		.name = "FASTBOOT",
+		.flags = M_ATTR_OVERLAP,
+	},
+	[MEMBLK_ID_STACK]    =	{
+		.name = "STACK",
+		.flags = M_ATTR_HOFC | M_ATTR_OVERLAP,
+	},
+	[MEMBLK_ID_FDT]      =	{
+		.name = "FDT",
+		.flags = M_ATTR_OFC,
+	},
+	[MEMBLK_ID_FDT_DTBO] =	{
+		.name = "FDT_DTBO",
+		.flags = M_ATTR_OFC,
+	},
+	[MEMBLK_ID_FDT_AOSP] =	{
+		.name = "FDT_AOSP",
+		.flags = M_ATTR_OFC,
+	},
+	[MEMBLK_ID_RAMDISK]  =	{
+		.name = "RAMDISK",
+		.alias[0] = "BOOT",
+		.alias[1] = "RECOVERY",
+		.flags = M_ATTR_OFC,
+	},
+	[MEMBLK_ID_KERNEL]   =	{
+		.name = "KERNEL",
+		.flags = M_ATTR_OFC,
+	},
+	[MEMBLK_ID_ANDROID]  =	{
+		.name = "ANDROID",
+		.flags = M_ATTR_OFC,
+	},
+};
+
+const struct memblk_attr *mem_attr = plat_mem_attr;
diff --git a/arch/arm/mach-rockchip/param.c b/arch/arm/mach-rockchip/param.c
index c5c28d4955..6cf867686e 100644
--- a/arch/arm/mach-rockchip/param.c
+++ b/arch/arm/mach-rockchip/param.c
@@ -4,12 +4,15 @@
  */
 
 #include <common.h>
+#include <dm.h>
+#include <ram.h>
 #include <asm/io.h>
 #include <asm/arch/rk_atags.h>
 #include <asm/arch/param.h>
 
 DECLARE_GLOBAL_DATA_PTR;
 
+#if !defined(CONFIG_SPL_BUILD) && !defined(CONFIG_TPL_BUILD)
 #define SDRAM_OFFSET(offset)		(CONFIG_SYS_SDRAM_BASE + (offset))
 #define PARAM_DRAM_INFO_OFFSET		(SZ_32M)
 #define PARAM_OPTEE_INFO_OFFSET		(SZ_32M + SZ_2M)
@@ -47,13 +50,12 @@ static uint16_t trust_checksum(const uint8_t *buf, uint16_t len)
 	return checksum;
 }
 
-struct sysmem_property param_parse_atf_mem(void)
+struct memblock param_parse_atf_mem(void)
 {
-	struct sysmem_property prop;
+	struct memblock mem;
 
-	prop.name = "ATF";
-	prop.base = 0;
-	prop.size = 0;
+	mem.base = 0;
+	mem.size = 0;
 
 #ifdef CONFIG_ROCKCHIP_PRELOADER_ATAGS
 	struct tag *t = NULL;
@@ -66,41 +68,40 @@ struct sysmem_property param_parse_atf_mem(void)
 	 */
 	t = atags_get_tag(ATAG_ATF_MEM);
 	if (t && t->u.atf_mem.size) {
-		prop.base = t->u.atf_mem.phy_addr;
-		prop.size = t->u.atf_mem.size;
+		mem.base = t->u.atf_mem.phy_addr;
+		mem.size = t->u.atf_mem.size;
 		/* Sanity */
-		if (prop.base + prop.size > SDRAM_OFFSET(SZ_1M)) {
+		if (mem.base + mem.size > SDRAM_OFFSET(SZ_1M)) {
 			printf("%s: ATF reserved region is not within 0-1MB "
 			       "offset(0x%08llx-0x%08llx)!\n",
-			       __func__, (u64)prop.base, (u64)prop.base + prop.size);
-			return prop;
+			       __func__, (u64)mem.base, (u64)mem.base + mem.size);
+			return mem;
 		}
 	}
 #endif
 
 	/* Legacy */
-	if (!prop.size) {
+	if (!mem.size) {
 		if (IS_ENABLED(CONFIG_ARM64) ||
 		    IS_ENABLED(CONFIG_ARM64_BOOT_AARCH32)) {
-			prop.base = SDRAM_OFFSET(0);
-			prop.size = SZ_1M;
+			mem.base = SDRAM_OFFSET(0);
+			mem.size = SZ_1M;
 		}
 	}
 
-	debug("ATF: 0x%llx - 0x%llx\n", (u64)prop.base, (u64)prop.base + prop.size);
+	debug("ATF: 0x%llx - 0x%llx\n", (u64)mem.base, (u64)mem.base + mem.size);
 
-	return prop;
+	return mem;
 }
 
-struct sysmem_property param_parse_optee_mem(void)
+struct memblock param_parse_optee_mem(void)
 {
 	struct tos_param_t *tos_parameter;
-	struct sysmem_property prop;
+	struct memblock mem;
 	u32 checksum;
 
-	prop.name = "OP-TEE";
-	prop.base = 0;
-	prop.size = 0;
+	mem.base = 0;
+	mem.size = 0;
 
 #ifdef CONFIG_ROCKCHIP_PRELOADER_ATAGS
 	struct tag *t = NULL;
@@ -113,13 +114,13 @@ struct sysmem_property param_parse_optee_mem(void)
 	 */
 	t = atags_get_tag(ATAG_TOS_MEM);
 	if (t && (t->u.tos_mem.tee_mem.flags == 1)) {
-		prop.base = t->u.tos_mem.tee_mem.phy_addr;
-		prop.size = t->u.tos_mem.tee_mem.size;
+		mem.base = t->u.tos_mem.tee_mem.phy_addr;
+		mem.size = t->u.tos_mem.tee_mem.size;
 	}
 #endif
 
 	/* Legacy */
-	if (!prop.size) {
+	if (!mem.size) {
 		tos_parameter =
 		(struct tos_param_t *)(SDRAM_OFFSET(PARAM_OPTEE_INFO_OFFSET));
 		checksum =
@@ -127,28 +128,30 @@ struct sysmem_property param_parse_optee_mem(void)
 			       sizeof(struct tos_param_t) - 8);
 		if ((checksum == tos_parameter->checksum) &&
 		    (tos_parameter->tee_mem.flags == 1)) {
-			prop.base = tos_parameter->tee_mem.phy_addr;
-			prop.size = tos_parameter->tee_mem.size;
+			mem.base = tos_parameter->tee_mem.phy_addr;
+			mem.size = tos_parameter->tee_mem.size;
 		}
 	}
 
-	if (prop.size)
+	if (mem.size)
 		gd->flags |= GD_FLG_BL32_ENABLED;
 
-	debug("TOS: 0x%llx - 0x%llx\n", (u64)prop.base, (u64)prop.base + prop.size);
+	debug("TOS: 0x%llx - 0x%llx\n", (u64)mem.base, (u64)mem.base + mem.size);
 
-	return prop;
+	return mem;
 }
 
-struct sysmem_property param_parse_common_resv_mem(void)
+struct memblock param_parse_common_resv_mem(void)
 {
-	struct sysmem_property prop;
+	struct memblock mem;
 
-	prop.name = "PSTORE/ATAGS/SHM";
-	prop.base = SDRAM_OFFSET(SZ_1M);
-	prop.size = SZ_1M;
-
-	return prop;
+#ifdef CONFIG_ARM64
+	mem.base = SDRAM_OFFSET(SZ_1M);
+	mem.size = SZ_1M;
+#else
+	mem.size = 0;
+#endif
+	return mem;
 }
 
 int param_parse_bootdev(char **devtype, char **devnum)
@@ -196,3 +199,70 @@ int param_parse_bootdev(char **devtype, char **devnum)
 
 	return -ENOSYS;
 }
+#endif
+
+struct memblock *param_parse_ddr_mem(int *out_count)
+{
+	struct udevice *dev;
+	struct memblock *mem;
+	struct ram_info ram;
+	int i, ret, count;
+
+	/*
+	 * Get memory region of DDR
+	 *
+	 * 1. New: atags info;
+	 * 2. Leagcy: os register;
+	 */
+#ifdef CONFIG_ROCKCHIP_PRELOADER_ATAGS
+	struct tag *t;
+
+	t = atags_get_tag(ATAG_DDR_MEM);
+	if (t && t->u.ddr_mem.count) {
+		count = t->u.ddr_mem.count;
+		mem = calloc(count, sizeof(*mem));
+		if (!mem) {
+			printf("Calloc ddr memory failed\n");
+			return 0;
+		}
+
+		for (i = 0; i < count; i++) {
+			mem[i].base = t->u.ddr_mem.bank[i];
+			mem[i].size = t->u.ddr_mem.bank[i + count];
+		}
+
+		*out_count = count;
+		return mem;
+	}
+#endif
+
+	/* Leagcy */
+	ret = uclass_get_device(UCLASS_RAM, 0, &dev);
+	if (ret) {
+		debug("DRAM init failed: %d\n", ret);
+		return NULL;
+	}
+	ret = ram_get_info(dev, &ram);
+	if (ret) {
+		debug("Cannot get DRAM size: %d\n", ret);
+		return NULL;
+	}
+
+	debug("SDRAM base=%lx, size=%lx\n",
+	      (unsigned long)ram.base, (unsigned long)ram.size);
+
+	count = 1;
+	mem = calloc(1, sizeof(*mem));
+	if (!mem) {
+		printf("Calloc ddr memory failed\n");
+		return 0;
+	}
+
+	for (i = 0; i < count; i++) {
+		mem[i].base = CONFIG_SYS_SDRAM_BASE;
+		mem[i].size = ram.size;
+	}
+
+	*out_count = count;
+	return mem;
+}
diff --git a/arch/arm/mach-rockchip/resource_img.c b/arch/arm/mach-rockchip/resource_img.c
index 477aae70b2..50598d89fd 100755
--- a/arch/arm/mach-rockchip/resource_img.c
+++ b/arch/arm/mach-rockchip/resource_img.c
@@ -6,6 +6,7 @@
 #include <common.h>
 #include <adc.h>
 #include <asm/io.h>
+#include <fs.h>
 #include <malloc.h>
 #include <sysmem.h>
 #include <linux/list.h>
@@ -212,11 +213,16 @@ static int init_resource_list(struct resource_img_hdr *hdr)
 #ifdef CONFIG_ANDROID_AB
 	char slot_suffix[3] = {0};
 
-	if (rk_avb_get_current_slot(slot_suffix))
+	if (rk_avb_get_current_slot(slot_suffix)) {
+		ret = -ENODEV;
 		goto out;
+	}
+
 	boot_partname = android_str_append(boot_partname, slot_suffix);
-	if (boot_partname == NULL)
+	if (!boot_partname) {
+		ret = -EINVAL;
 		goto out;
+	}
 #endif
 	ret = part_get_info_by_name(dev_desc, boot_partname, &part_info);
 	if (ret < 0) {
@@ -235,6 +241,7 @@ static int init_resource_list(struct resource_img_hdr *hdr)
 	if (ret != 1) {
 		printf("%s: failed to read %s hdr, ret=%d\n",
 		       __func__, part_info.name, ret);
+		ret = -EIO;
 		goto out;
 	}
 	ret = android_image_check_header(andr_hdr);
@@ -274,17 +281,21 @@ next:
 	if (ret != 1) {
 		printf("%s: failed to read resource hdr, ret=%d\n",
 		       __func__, ret);
+		ret = -EIO;
 		goto out;
 	}
 
 	ret = resource_image_check_header(hdr);
-	if (ret < 0)
+	if (ret < 0) {
+		ret = -EINVAL;
 		goto out;
+	}
 
 	content = memalign(ARCH_DMA_MINALIGN,
 			   hdr->e_blks * hdr->e_nums * RK_BLK_SIZE);
 	if (!content) {
 		printf("%s: failed to alloc memory for content\n", __func__);
+		ret = -ENOMEM;
 		goto out;
 	}
 
@@ -294,6 +305,7 @@ next:
 	if (ret != (hdr->e_blks * hdr->e_nums)) {
 		printf("%s: failed to read resource entries, ret=%d\n",
 		       __func__, ret);
+		ret = -EIO;
 		goto err;
 	}
 
@@ -303,13 +315,14 @@ next:
 		add_file_to_list(entry, offset);
 	}
 
+	ret = 0;
 	printf("Load FDT from %s part\n", boot_partname);
 err:
 	free(content);
 out:
 	free(hdr);
 
-	return 0;
+	return ret;
 }
 
 static struct resource_file *get_file_info(struct resource_img_hdr *hdr,
@@ -318,8 +331,10 @@ static struct resource_file *get_file_info(struct resource_img_hdr *hdr,
 	struct resource_file *file;
 	struct list_head *node;
 
-	if (list_empty(&entrys_head))
-		init_resource_list(hdr);
+	if (list_empty(&entrys_head)) {
+		if (init_resource_list(hdr))
+			return NULL;
+	}
 
 	list_for_each(node, &entrys_head) {
 		file = list_entry(node, struct resource_file, link);
@@ -614,15 +629,73 @@ static int rockchip_read_dtb_by_gpio(const char *file_name)
 	return found ? 0 : -ENOENT;
 }
 
+#ifdef CONFIG_ROCKCHIP_EARLY_DISTRO_DTB
+static int rockchip_read_distro_dtb_file(char *fdt_addr)
+{
+	const char *cmd = "part list ${devtype} ${devnum} -bootable devplist";
+	char *devnum, *devtype, *devplist;
+	char devnum_part[12];
+	char fdt_hex_str[19];
+	char *fs_argv[5];
+	int ret;
+
+	if (!rockchip_get_bootdev() || !fdt_addr)
+		return -ENODEV;
+
+	ret = run_command_list(cmd, -1, 0);
+	if (ret)
+		return ret;
+
+	devplist = env_get("devplist");
+	if (!devplist)
+		return -ENODEV;
+
+	devtype = env_get("devtype");
+	devnum = env_get("devnum");
+	sprintf(devnum_part, "%s:%s", devnum, devplist);
+	sprintf(fdt_hex_str, "0x%lx", (ulong)fdt_addr);
+
+#ifdef CONFIG_CMD_FS_GENERIC
+	fs_argv[0] = "load";
+	fs_argv[1] = devtype,
+	fs_argv[2] = devnum_part;
+	fs_argv[3] = fdt_hex_str;
+	fs_argv[4] = CONFIG_ROCKCHIP_EARLY_DISTRO_DTB_PATH;
+
+	if (do_load(NULL, 0, 5, fs_argv, FS_TYPE_ANY))
+		return -EIO;
+#endif
+	if (fdt_check_header(fdt_addr))
+		return -EIO;
+
+	return fdt_totalsize(fdt_addr);
+}
+#endif
+
 int rockchip_read_dtb_file(void *fdt_addr)
 {
 	struct resource_file *file;
 	struct list_head *node;
 	char *dtb_name = DTB_FILE;
-	int ret, size;
-
-	if (list_empty(&entrys_head))
-		init_resource_list(NULL);
+	int size = -ENODEV;
+
+	if (list_empty(&entrys_head)) {
+		if (init_resource_list(NULL)) {
+#ifdef CONFIG_ROCKCHIP_EARLY_DISTRO_DTB
+			/* Maybe a distro boot.img with dtb ? */
+			printf("Distro DTB: %s\n",
+			       CONFIG_ROCKCHIP_EARLY_DISTRO_DTB_PATH);
+			size = rockchip_read_distro_dtb_file(fdt_addr);
+			if (size < 0)
+				return size;
+			if (!sysmem_alloc_base(MEMBLK_ID_FDT,
+				(phys_addr_t)fdt_addr,
+				ALIGN(size, RK_BLK_SIZE) + CONFIG_SYS_FDT_PAD))
+				return -ENOMEM;
+#endif
+			return size;
+		}
+	}
 
 	list_for_each(node, &entrys_head) {
 		file = list_entry(node, struct resource_file, link);
@@ -647,17 +720,17 @@ int rockchip_read_dtb_file(void *fdt_addr)
 	if (size < 0)
 		return size;
 
-	if (!sysmem_alloc_base("fdt", (phys_addr_t)fdt_addr,
+	if (!sysmem_alloc_base(MEMBLK_ID_FDT, (phys_addr_t)fdt_addr,
 			       ALIGN(size, RK_BLK_SIZE) + CONFIG_SYS_FDT_PAD))
 		return -ENOMEM;
 
-	ret = rockchip_read_resource_file((void *)fdt_addr, dtb_name, 0, 0);
-	if (ret < 0)
-		return ret;
+	size = rockchip_read_resource_file((void *)fdt_addr, dtb_name, 0, 0);
+	if (size < 0)
+		return size;
 
 #if defined(CONFIG_CMD_DTIMG) && defined(CONFIG_OF_LIBFDT_OVERLAY)
 	android_fdt_overlay_apply((void *)fdt_addr);
 #endif
 
-	return ret;
+	return size;
 }
diff --git a/arch/arm/mach-rockchip/rk3308/rk3308.c b/arch/arm/mach-rockchip/rk3308/rk3308.c
index c864b31c2e..0d11073ddf 100644
--- a/arch/arm/mach-rockchip/rk3308/rk3308.c
+++ b/arch/arm/mach-rockchip/rk3308/rk3308.c
@@ -10,6 +10,8 @@
 #include <asm/gpio.h>
 #include <debug_uart.h>
 
+DECLARE_GLOBAL_DATA_PTR;
+
 #ifdef CONFIG_ARM64
 #include <asm/armv8/mmu.h>
 static struct mm_region rk3308_mem_map[] = {
@@ -125,6 +127,9 @@ void board_debug_uart_init(void)
 {
 	static struct rk3308_grf * const grf = (void *)GRF_BASE;
 
+	if (gd && gd->serial.using_pre_serial)
+		return;
+
 	/* Enable early UART2 channel m1 on the rk3308 */
 	rk_clrsetreg(&grf->soc_con5, UART2_IO_SEL_MASK,
 		     UART2_IO_SEL_M1 << UART2_IO_SEL_SHIFT);
diff --git a/arch/arm/mach-rockchip/rk3368/rk3368.c b/arch/arm/mach-rockchip/rk3368/rk3368.c
index e82b631138..46e63c9d7f 100644
--- a/arch/arm/mach-rockchip/rk3368/rk3368.c
+++ b/arch/arm/mach-rockchip/rk3368/rk3368.c
@@ -66,13 +66,13 @@ static struct mm_region rk3368_mem_map[] = {
 	{
 		.virt = 0x0UL,
 		.phys = 0x0UL,
-		.size = 0x80000000UL,
+		.size = 0xfe000000UL,
 		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) |
 			 PTE_BLOCK_INNER_SHARE
 	}, {
-		.virt = 0xf0000000UL,
-		.phys = 0xf0000000UL,
-		.size = 0x10000000UL,
+		.virt = 0xfe000000UL,
+		.phys = 0xfe000000UL,
+		.size = 0x02000000UL,
 		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
 			 PTE_BLOCK_NON_SHARE |
 			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
@@ -242,10 +242,12 @@ void board_debug_uart_init(void)
 		GPIO2A6_MASK		= GENMASK(13, 12),
 		GPIO2A6_GPIO		= 0,
 		GPIO2A6_UART0_SIN      = (1 << 13),
+		GPIO2A6_UART2_SIN	= (2 << 12),
 
 		GPIO2A5_MASK		= GENMASK(11, 10),
 		GPIO2A5_GPIO		= 0,
 		GPIO2A5_UART0_SOUT	 = (1 << 11),
+		GPIO2A5_UART2_SOUT      = (2 << 10),
 	};
 
 #if defined(CONFIG_DEBUG_UART_BASE) && (CONFIG_DEBUG_UART_BASE == 0xff180000)
@@ -254,12 +256,31 @@ void board_debug_uart_init(void)
 		     GPIO2D0_MASK, GPIO2D0_UART0_SIN);
 	rk_clrsetreg(&grf->gpio2d_iomux,
 		     GPIO2D1_MASK, GPIO2D1_UART0_SOUT);
+#elif defined(CONFIG_DEBUG_UART_BASE) && (CONFIG_DEBUG_UART_BASE == 0xff1c0000)
+	struct rk3368_pmu_grf * const pmugrf __maybe_unused =
+		(struct rk3368_pmu_grf * const)0xff738000;
+
+	enum {
+		/* UART4 */
+		GPIO0D2_MASK		= GENMASK(5, 4),
+		GPIO0D2_GPIO		= 0,
+		GPIO0D2_UART4_SOUT	= (3 << 4),
+
+		GPIO0D3_MASK		= GENMASK(7, 6),
+		GPIO0D3_GPIO		= 0,
+		GPIO0D3_UART4_SIN	= (3 << 6),
+	};
+
+	/* Enable early UART4 on the PX5 */
+	rk_clrsetreg(&pmugrf->gpio0d_iomux,
+		     GPIO0D2_MASK | GPIO0D3_MASK,
+		     GPIO0D2_UART4_SOUT | GPIO0D3_UART4_SIN);
 #elif defined(CONFIG_DEBUG_UART_BASE) && (CONFIG_DEBUG_UART_BASE == 0xff690000)
 	/* Enable early UART2 on the RK3368 */
 	rk_clrsetreg(&grf->gpio2a_iomux,
-		     GPIO2A6_MASK, GPIO2A6_UART0_SIN);
+		     GPIO2A6_MASK, GPIO2A6_UART2_SIN);
 	rk_clrsetreg(&grf->gpio2a_iomux,
-		     GPIO2A5_MASK, GPIO2A5_UART0_SOUT);
+		     GPIO2A5_MASK, GPIO2A5_UART2_SOUT);
 #endif
 }
 
diff --git a/arch/arm/mach-rockchip/rk_atags.c b/arch/arm/mach-rockchip/rk_atags.c
index cde2f23a3e..be5dfecad7 100644
--- a/arch/arm/mach-rockchip/rk_atags.c
+++ b/arch/arm/mach-rockchip/rk_atags.c
@@ -10,6 +10,7 @@
 #include <debug_uart.h>
 #endif
 
+#define HASH_LEN	sizeof(u32)
 #define tag_next(t)	((struct tag *)((u32 *)(t) + (t)->hdr.size))
 #define tag_size(type)	((sizeof(struct tag_header) + sizeof(struct type)) >> 2)
 #define for_each_tag(t, base)		\
@@ -72,11 +73,36 @@ void *memcpy(void *dest, const void *src, size_t count)
 }
 #endif
 
-static int inline bad_magic(u32 magic)
+static u32 js_hash(void *buf, u32 len)
 {
-	return ((magic != ATAG_CORE) &&
-		(magic != ATAG_NONE) &&
-		(magic < ATAG_SERIAL || magic > ATAG_MAX));
+	u32 i, hash = 0x47C6A7E6;
+	char *data = buf;
+
+	if (!buf || !len)
+		return hash;
+
+	for (i = 0; i < len; i++)
+		hash ^= ((hash << 5) + data[i] + (hash >> 2));
+
+	return hash;
+}
+
+static int bad_magic(u32 magic)
+{
+	bool bad;
+
+	bad = ((magic != ATAG_CORE) &&
+	       (magic != ATAG_NONE) &&
+	       (magic < ATAG_SERIAL || magic > ATAG_MAX));
+	if (bad) {
+#if !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
+		printf("Magic(%x) is not support\n", magic);
+#else
+		printascii("Magic is not support\n");
+#endif
+	}
+
+	return bad;
 }
 
 static int inline atags_size_overflow(struct tag *t, u32 tag_size)
@@ -84,6 +110,23 @@ static int inline atags_size_overflow(struct tag *t, u32 tag_size)
 	return (unsigned long)t + (tag_size << 2) - ATAGS_PHYS_BASE > ATAGS_SIZE;
 }
 
+static int atags_overflow(struct tag *t)
+{
+	bool overflow;
+
+	overflow = atags_size_overflow(t, 0) ||
+		   atags_size_overflow(t, t->hdr.size);
+	if (overflow) {
+#if !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
+		printf("Tag is overflow\n");
+#else
+		printascii("Tag is overflow\n");
+#endif
+	}
+
+	return overflow;
+}
+
 int atags_is_available(void)
 {
 	struct tag *t = (struct tag *)ATAGS_PHYS_BASE;
@@ -93,21 +136,14 @@ int atags_is_available(void)
 
 int atags_set_tag(u32 magic, void *tagdata)
 {
-	u32 length, size = 0;
+	u32 length, size = 0, hash;
 	struct tag *t = (struct tag *)ATAGS_PHYS_BASE;
 
 	if (!tagdata)
 		return -ENODATA;
 
-	if (bad_magic(magic)) {
-#if !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
-		printf("%s: magic(%x) is not support\n", __func__, magic);
-#else
-		printascii("magic is not support\n");
-#endif
-
+	if (bad_magic(magic))
 		return -EINVAL;
-	}
 
 	/* Not allowed to be set by user directly, so do nothing */
 	if ((magic == ATAG_CORE) || (magic == ATAG_NONE))
@@ -125,21 +161,15 @@ int atags_set_tag(u32 magic, void *tagdata)
 	} else {
 		/* Find the end, and use it as a new tag */
 		for_each_tag(t, (struct tag *)ATAGS_PHYS_BASE) {
-			/*
-			 * We had better check magic to avoid traversing an
-			 * unknown tag, in case of atags has been damaged by
-			 * some unknown reason.
-			 */
-			if (bad_magic(t->hdr.magic)) {
-#if !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
-				printf("%s: find unknown magic(%x)\n",
-				       __func__, t->hdr.magic);
-#else
-				printascii("find unknown magic\n");
-#endif
+			if (atags_overflow(t))
+				return -EINVAL;
 
+			if (bad_magic(t->hdr.magic))
 				return -EINVAL;
-			}
+
+			/* This is an old tag, override it */
+			if (t->hdr.magic == magic)
+				break;
 
 			if (t->hdr.magic == ATAG_NONE)
 				break;
@@ -166,24 +196,27 @@ int atags_set_tag(u32 magic, void *tagdata)
 	case ATAG_ATF_MEM:
 		size = tag_size(tag_atf_mem);
 		break;
+	case ATAG_PUB_KEY:
+		size = tag_size(tag_pub_key);
+		break;
+	case ATAG_SOC_INFO:
+		size = tag_size(tag_soc_info);
+		break;
 	};
 
-	if (atags_size_overflow(t, size)) {
-#if !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
-		printf("%s: failed! no memory to setup magic(%x), max_mem=0x%x\n",
-		       __func__, magic, ATAGS_SIZE);
-#else
-		printascii("no memory to setup magic\n");
-#endif
+	if (!size)
+		return -EINVAL;
 
+	if (atags_size_overflow(t, size))
 		return -ENOMEM;
-	}
 
 	/* It's okay to setup a new tag */
 	t->hdr.magic = magic;
 	t->hdr.size = size;
-	length = (t->hdr.size << 2) - sizeof(struct tag_header);
+	length = (t->hdr.size << 2) - sizeof(struct tag_header) - HASH_LEN;
 	memcpy(&t->u, (char *)tagdata, length);
+	hash = js_hash(t, (size << 2) - HASH_LEN);
+	memcpy((char *)&t->u + length, &hash, HASH_LEN);
 
 	/* Next tag */
 	t = tag_next(t);
@@ -197,24 +230,38 @@ int atags_set_tag(u32 magic, void *tagdata)
 
 struct tag *atags_get_tag(u32 magic)
 {
+	u32 *hash, calc_hash, size;
 	struct tag *t;
 
 	if (!atags_is_available())
 		return NULL;
 
 	for_each_tag(t, (struct tag *)ATAGS_PHYS_BASE) {
-		if (bad_magic(t->hdr.magic)) {
-#if !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
-			printf("%s: find unknown magic(%x)\n",
-			       __func__, t->hdr.magic);
-#else
-			printascii("find unknown magic\n");
-#endif
+		if (atags_overflow(t))
 			return NULL;
-		}
 
-		if (t->hdr.magic == magic)
+		if (bad_magic(t->hdr.magic))
+			return NULL;
+
+		if (t->hdr.magic != magic)
+			continue;
+
+		size = t->hdr.size;
+		hash = (u32 *)((ulong)t + (size << 2) - HASH_LEN);
+		if (!*hash) {
+			debug("No hash, magic(%x)\n", magic);
 			return t;
+		} else {
+			calc_hash = js_hash(t, (size << 2) - HASH_LEN);
+			if (calc_hash == *hash) {
+				debug("Hash okay, magic(%x)\n", magic);
+				return t;
+			} else {
+				debug("Hash bad, magic(%x), orgHash=%x, nowHash=%x\n",
+				      magic, *hash, calc_hash);
+				return NULL;
+			}
+		}
 	}
 
 	return NULL;
@@ -234,12 +281,15 @@ void atags_stat(void)
 	u32 start = ATAGS_PHYS_BASE, end = ATAGS_PHYS_BASE + ATAGS_SIZE;
 	struct tag *t;
 
+	if (!atags_is_available())
+		return;
+
 	for_each_tag(t, (struct tag *)ATAGS_PHYS_BASE) {
-		if (bad_magic(t->hdr.magic)) {
-			printf("%s: find unknown magic(%x)\n",
-			       __func__, t->hdr.magic);
+		if (atags_overflow(t))
+			return;
+
+		if (bad_magic(t->hdr.magic))
 			return;
-		}
 
 		in_use += (t->hdr.size << 2);
 	}
@@ -273,6 +323,7 @@ void atags_print_tag(struct tag *t)
 		printf("        id = 0x%x\n", t->u.serial.id);
 		for (i = 0; i < ARRAY_SIZE(t->u.serial.reserved); i++)
 			printf("    res[%d] = 0x%x\n", i, t->u.serial.reserved[i]);
+		printf("      hash = 0x%x\n", t->u.serial.hash);
 		break;
 	case ATAG_BOOTDEV:
 		printf("[bootdev]:\n");
@@ -285,6 +336,7 @@ void atags_print_tag(struct tag *t)
 		for (i = 0; i < ARRAY_SIZE(t->u.bootdev.reserved); i++)
 			printf("    res[%d] = 0x%x\n",
 			       i, t->u.bootdev.reserved[i]);
+		printf("      hash = 0x%x\n", t->u.bootdev.hash);
 		break;
 	case ATAG_TOS_MEM:
 		printf("[tos_mem]:\n");
@@ -303,6 +355,8 @@ void atags_print_tag(struct tag *t)
 		printf("           flags = 0x%x\n", t->u.tos_mem.drm_mem.flags);
 		for (i = 0; i < ARRAY_SIZE(t->u.tos_mem.reserved); i++)
 			printf("   res[%d] = 0x%llx\n", i, t->u.tos_mem.reserved[i]);
+		printf("     res1 = 0x%x\n", t->u.tos_mem.reserved1);
+		printf("     hash = 0x%x\n", t->u.tos_mem.hash);
 		break;
 	case ATAG_DDR_MEM:
 		printf("[ddr_mem]:\n");
@@ -314,6 +368,7 @@ void atags_print_tag(struct tag *t)
 			printf("  bank[%d] = 0x%llx\n", i, t->u.ddr_mem.bank[i]);
 		for (i = 0; i < ARRAY_SIZE(t->u.ddr_mem.reserved); i++)
 			printf("    res[%d] = 0x%x\n", i, t->u.ddr_mem.reserved[i]);
+		printf("      hash = 0x%x\n", t->u.ddr_mem.hash);
 		break;
 	case ATAG_RAM_PARTITION:
 		printf("[ram_partition]:\n");
@@ -324,11 +379,14 @@ void atags_print_tag(struct tag *t)
 			printf("    res[%d] = 0x%x\n", i, t->u.ram_part.reserved[i]);
 
 		printf("    Part:  Name       Start Addr      Size\t\n");
-		for (i = 0; i < t->u.ram_part.count; i++)
+		for (i = 0; i < ARRAY_SIZE(t->u.ram_part.part); i++)
 			printf("%16s      0x%08llx      0x%08llx\n",
 			       t->u.ram_part.part[i].name,
 			       t->u.ram_part.part[i].start,
 			       t->u.ram_part.part[i].size);
+		for (i = 0; i < ARRAY_SIZE(t->u.ram_part.reserved1); i++)
+			printf("   res1[%d] = 0x%x\n", i, t->u.ram_part.reserved1[i]);
+		printf("      hash = 0x%x\n", t->u.ram_part.hash);
 		break;
 	case ATAG_ATF_MEM:
 		printf("[atf_mem]:\n");
@@ -339,6 +397,25 @@ void atags_print_tag(struct tag *t)
 		printf("      size = 0x%x\n", t->u.atf_mem.size);
 		for (i = 0; i < ARRAY_SIZE(t->u.atf_mem.reserved); i++)
 			printf("    res[%d] = 0x%x\n", i, t->u.atf_mem.reserved[i]);
+		printf("      hash = 0x%x\n", t->u.atf_mem.hash);
+		break;
+	case ATAG_PUB_KEY:
+		printf("[pub_key_mem]:\n");
+		printf("     magic = 0x%x\n", t->hdr.magic);
+		printf("      size = 0x%x\n\n", t->hdr.size << 2);
+		printf("   version = 0x%x\n", t->u.pub_key.version);
+		printf("      hash = 0x%x\n", t->u.pub_key.hash);
+		break;
+	case ATAG_SOC_INFO:
+		printf("[soc_info]:\n");
+		printf("     magic = 0x%x\n", t->hdr.magic);
+		printf("      size = 0x%x\n\n", t->hdr.size << 2);
+		printf("   version = 0x%x\n", t->u.soc.version);
+		printf("      name = 0x%x\n", t->u.soc.name);
+		printf("     flags = 0x%x\n", t->u.soc.flags);
+		for (i = 0; i < ARRAY_SIZE(t->u.soc.reserved); i++)
+			printf("    res[%d] = 0x%x\n", i, t->u.soc.reserved[i]);
+		printf("      hash = 0x%x\n", t->u.soc.hash);
 		break;
 	case ATAG_CORE:
 		printf("[core]:\n");
@@ -359,12 +436,15 @@ void atags_print_all_tags(void)
 {
 	struct tag *t;
 
+	if (!atags_is_available())
+		return;
+
 	for_each_tag(t, (struct tag *)ATAGS_PHYS_BASE) {
-		if (bad_magic(t->hdr.magic)) {
-			printf("%s: find unknown magic(%x)\n",
-			       __func__, t->hdr.magic);
+		if (atags_overflow(t))
+			return;
+
+		if (bad_magic(t->hdr.magic))
 			return;
-		}
 
 		atags_print_tag(t);
 	}
@@ -378,6 +458,8 @@ void atags_test(void)
 	struct tag_tos_mem t_tos_mem;
 	struct tag_ram_partition t_ram_param;
 	struct tag_atf_mem t_atf_mem;
+	struct tag_pub_key t_pub_key;
+	struct tag_soc_info t_soc;
 
 	memset(&t_serial,  0x1, sizeof(t_serial));
 	memset(&t_bootdev, 0x2, sizeof(t_bootdev));
@@ -385,6 +467,8 @@ void atags_test(void)
 	memset(&t_tos_mem, 0x4, sizeof(t_tos_mem));
 	memset(&t_ram_param, 0x0, sizeof(t_ram_param));
 	memset(&t_atf_mem, 0x5, sizeof(t_atf_mem));
+	memset(&t_pub_key, 0x6, sizeof(t_pub_key));
+	memset(&t_soc, 0x7, sizeof(t_soc));
 
 	memcpy(&t_tos_mem.tee_mem.name, "tee_mem", 8);
 	memcpy(&t_tos_mem.drm_mem.name, "drm_mem", 8);
@@ -415,6 +499,8 @@ void atags_test(void)
 	atags_set_tag(ATAG_TOS_MEM, &t_tos_mem);
 	atags_set_tag(ATAG_RAM_PARTITION, &t_ram_param);
 	atags_set_tag(ATAG_ATF_MEM, &t_atf_mem);
+	atags_set_tag(ATAG_PUB_KEY, &t_pub_key);
+	atags_set_tag(ATAG_SOC_INFO, &t_soc);
 
 	atags_print_all_tags();
 	atags_stat();
diff --git a/arch/arm/mach-rockchip/rv1108/rv1108.c b/arch/arm/mach-rockchip/rv1108/rv1108.c
index 86bfdea237..e88f27f5d9 100644
--- a/arch/arm/mach-rockchip/rv1108/rv1108.c
+++ b/arch/arm/mach-rockchip/rv1108/rv1108.c
@@ -57,24 +57,3 @@ void board_debug_uart_init(void)
 #endif
 #endif /*CONFIG_SPL_BUILD*/
 }
-
-int dram_init(void)
-{
-	struct rv1108_grf *grf = (void *)GRF_BASE;
-
-	gd->ram_size = rockchip_sdram_size((phys_addr_t)&grf->os_reg2);
-
-	return 0;
-}
-
-int dram_init_banksize(void)
-{
-	size_t max_size = min((unsigned long)(gd->ram_size +
-			      CONFIG_SYS_SDRAM_BASE), gd->ram_top);
-
-	gd->bd->bi_dram[0].start = CONFIG_SYS_SDRAM_BASE;
-	gd->bd->bi_dram[0].size = max_size - gd->bd->bi_dram[0].start;
-
-	return 0;
-}
-
diff --git a/arch/arm/mach-rockchip/sdram_common.c b/arch/arm/mach-rockchip/sdram_common.c
index b0e1e4cf6e..f71aacc9cd 100644
--- a/arch/arm/mach-rockchip/sdram_common.c
+++ b/arch/arm/mach-rockchip/sdram_common.c
@@ -5,6 +5,7 @@
  */
 
 #include <common.h>
+#include <bidram.h>
 #include <dm.h>
 #include <ram.h>
 #include <asm/io.h>
@@ -17,185 +18,6 @@ DECLARE_GLOBAL_DATA_PTR;
 #define PARAM_DRAM_INFO_OFFSET 0x2000000
 #define TRUST_PARAMETER_OFFSET    (34 * 1024 * 1024)
 
-#if defined(CONFIG_SPL_FRAMEWORK) || !defined(CONFIG_SPL_OF_PLATDATA)
-
-#define SDRAM_OFFSET(offset)	(CONFIG_SYS_SDRAM_BASE + (offset))
-#define NOT_INITIAL		-1
-static int __dram_init_banksize(int resv_tee)
-{
-	struct sysmem_property prop;
-	size_t top = min((unsigned long)(gd->ram_size + CONFIG_SYS_SDRAM_BASE),
-			 gd->ram_top);
-	u64 start[CONFIG_NR_DRAM_BANKS], size[CONFIG_NR_DRAM_BANKS];
-	u64 tos_addr, atf_addr;
-	u64 tos_size, atf_size;
-	int i, idx = NOT_INITIAL;
-
-	prop = param_parse_atf_mem();
-	atf_addr = prop.base;
-	atf_size = prop.size;
-	prop = param_parse_optee_mem();
-	tos_addr = prop.base;
-	tos_size = prop.size;
-
-	/*
-	 * Reserve region for ATF bl31
-	 *
-	 * What ever U-Boot runs on AArch64 or AArch32 mode, the bl31 is always
-	 * present and AArch64 mode, let's reserve it.
-	 *
-	 * Maybe:
-	 *	1. ATF region is from 0x0 offset and 1MB size(legacy);
-	 *	2. ATF region is from 0x0 offset but not 1MB size;
-	 *	3. ATF region is not from 0x0 offset but within 1MB;
-	 *
-	 * 1. The "*****" means visible region to kernel.
-	 * 2. 1M~2M is always reserved in ARM64 for pstore, shmem, etc.
-	 *
-	 *
-	 * Possible memory layout:
-	 *
-	 * Leagcy:
-	 *	 |------------o-------o------------------------|
-	 *	 |     ATF    | RES   |************************|
-	 *	 |------------o-------o------------------------|
-	 *	 0x0          1M      2M                      .....
-	 *
-	 *
-	 * New:
-	 *	 |-----|------o-------o------------------------|
-	 *	 | ATF |******| RES   |************************|
-	 *	 |-----|------o-------o------------------------|
-	 *	 0x0          1M      2M                      .....
-	 *
-	 *
-	 *	 |----|---|---o-------o------------------------|
-	 *	 |****|ATF|***| RES   |************************|
-	 *	 |----|---|---o-------o------------------------|
-	 *	 0x0  64K     1M      2M                      .....
-	 *
-	 * Note: these are only initilized once from dram_init_banksize(),
-	 *       which is before relocation.
-	 */
-	if (atf_size && !(gd->flags & GD_FLG_RELOC)) {
-		idx = 0;
-		memset(size, 0, sizeof(size));
-
-		start[0] = SDRAM_OFFSET(0);
-		 size[0] = atf_addr - start[0];
-		start[1] = atf_addr + atf_size;
-		 size[1] = SDRAM_OFFSET(SZ_1M) - start[1];
-		start[2] = SDRAM_OFFSET(SZ_2M);
-		 size[2] = top - start[2];
-
-		for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
-			if (!size[i])
-				continue;
-
-			gd->bd->bi_dram[idx].start = start[i];
-			gd->bd->bi_dram[idx].size = size[i];
-			idx++;
-		}
-	/* There is no bl31, fill whole ram size */
-	} else if (!(gd->flags & GD_FLG_RELOC)) {
-		gd->bd->bi_dram[0].start = SDRAM_OFFSET(0);
-		gd->bd->bi_dram[0].size = top - gd->bd->bi_dram[0].start;
-	} else {
-		/*
-		 * Do nothing for bl31 when called from dram_initr_banksize(),
-		 * which is after relocation.
-		 */
-	}
-
-	/*
-	 * Reserve region for OP-TEE
-	 *
-	 * What ever U-Boot runs on AArch64 or AArch32 mode, the OP-TEE is
-	 * AArch64 mode.
-	 *
-	 * For OP-TEE:
-	 *	AArch64: dcache is enabled;
-	 *	AArch32: dcache is disabled(due to some unknown issues);
-	 *
-	 * For the data coherence, U-Boot has to follow the OP-TEE dcache
-	 * policy to map MMU attributes of OP-TEE region.
-	 *
-	 * For AArch64: MMU translate table is created manual by rkxxx.c file
-	 * and all memory region is mapped, that's good to match OP-TEE policy.
-	 * For AArch32: MMU translate table is setup according to bi_dram[..]
-	 * that OP-TEE region has been reserved and would not be mapped,
-	 * i.e. dcache is disabled, that's also good to match OP-TEE policy.
-	 *
-	 * When CONFIG_ARM64_BOOT_AARCH32 is enabled, U-Boot runs on AArch32
-	 * while OP-TEE runs on AArch64. U-Boot shouldn't reserved OP-TEE region
-	 * too early and should map MMU translate table of it(in intir_cache()).
-	 * So we reserve the region in dram_initr_banksize() after MMU setup.
-	 *
-	 *
-	 *	The are two kinds of OP-TEE memory layout
-	 *
-	 * legacy:
-	 * 	|----|-------o---------------------------------|
-	 * 	|....| OPTEE |*********************************|
-	 * 	|----|-------o---------------------------------|
-	 * 	0x0 2M      6M(or more)                 .....
-	 *
-	 * new:
-	 * 	|----|-------------------o-------o-------------|
-	 * 	|....|*******************| OPTEE |*************|
-	 * 	|----|-------------------o-------o-------------|
-	 * 	0x0  2M                132M     164M(or less) .....
-	 */
-
-	if (resv_tee && tos_size) {
-		/* If idx is not initialized, calculate idx */
-		if (idx == NOT_INITIAL) {
-			for (idx = 0; idx < CONFIG_NR_DRAM_BANKS; idx++) {
-				if (!gd->bd->bi_dram[idx].size)
-					break;
-			}
-		}
-
-		if (tos_addr == SZ_2M) {
-			gd->bd->bi_dram[idx - 1].start = tos_addr + tos_size;
-			gd->bd->bi_dram[idx - 1].size =
-					top - gd->bd->bi_dram[idx - 1].start;
-		} else {
-			gd->bd->bi_dram[idx - 1].size = tos_addr -
-					gd->bd->bi_dram[idx - 1].start;
-			gd->bd->bi_dram[idx].start = tos_addr + tos_size;
-			gd->bd->bi_dram[idx].size =
-					top - gd->bd->bi_dram[idx].start;
-		}
-#ifdef DEBUG
-		for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
-			debug("%s: bank[%d]=0x%llx-0x%llx\n",
-			      __func__, i, (u64)gd->bd->bi_dram[i].start,
-			      (u64)gd->bd->bi_dram[i].start +
-			      gd->bd->bi_dram[i].size);
-		}
-#endif
-	}
-
-	return 0;
-}
-
-/*
- * !defined(CONFIG_ARM64_BOOT_AARCH32) means: U-Boot and OP-TEE both run
- * on AArch32 or AArch64, they are same mode. Otherwise OP-TEE is AArch64
- * while U-Boot is AArch32. There is data cache coherence issue to fix.
- */
-int dram_init_banksize(void)
-{
-	return __dram_init_banksize(!IS_ENABLED(CONFIG_ARM64_BOOT_AARCH32));
-}
-
-int dram_initr_banksize(void)
-{
-	return __dram_init_banksize(IS_ENABLED(CONFIG_ARM64_BOOT_AARCH32));
-}
-#endif
-
 size_t rockchip_sdram_size(phys_addr_t reg)
 {
 	u32 rank, cs0_col, bk, cs0_row, cs1_row, bw, row_3_4;
@@ -347,47 +169,18 @@ unsigned int get_ddr_bw(void)
 }
 
 #if defined(CONFIG_SPL_FRAMEWORK) || !defined(CONFIG_SPL_OF_PLATDATA)
-int dram_init(void)
+int dram_init_banksize(void)
 {
-	struct ram_info ram;
-	struct udevice *dev;
-	int ret;
-
-	/* New way: atags info */
-#ifdef CONFIG_ROCKCHIP_PRELOADER_ATAGS
-	struct tag *t = NULL;
-	int i, count;
-
-	t = atags_get_tag(ATAG_DDR_MEM);
-	if (t && t->u.ddr_mem.count) {
-		gd->ram_size = 0;
-		count = t->u.ddr_mem.count;
+	bidram_gen_gd_bi_dram();
 
-		for (i = 0; i < count; i++) {
-			gd->ram_size += t->u.ddr_mem.bank[i + count];
-			debug("%s: ram[%d] start=0x%08llx, size=0x%08llx, sum=0x%08llx\n",
-			      __func__, i, (u64)gd->bd->bi_dram[i].start,
-			      (u64)gd->bd->bi_dram[i].size, (u64)gd->ram_size);
-		}
-
-		return 0;
-	}
-#endif
+	return 0;
+}
 
-	/* Legacy way: os registers */
-	ret = uclass_get_device(UCLASS_RAM, 0, &dev);
-	if (ret) {
-		debug("DRAM init failed: %d\n", ret);
-		return ret;
-	}
-	ret = ram_get_info(dev, &ram);
-	if (ret) {
-		debug("Cannot get DRAM size: %d\n", ret);
-		return ret;
-	}
-	gd->ram_size = ram.size;
-	debug("SDRAM base=%lx, size=%lx\n",
-	      (unsigned long)ram.base, (unsigned long)ram.size);
+int dram_init(void)
+{
+	gd->ram_size = bidram_get_ram_size();
+	if (!gd->ram_size)
+		return -ENOMEM;
 
 	return 0;
 }
diff --git a/arch/arm/mach-rockchip/spl.c b/arch/arm/mach-rockchip/spl.c
index 2c1ffe5ab0..1db0e2626c 100644
--- a/arch/arm/mach-rockchip/spl.c
+++ b/arch/arm/mach-rockchip/spl.c
@@ -64,7 +64,10 @@ u32 spl_boot_mode(const u32 boot_device)
 
 __weak void rockchip_stimer_init(void)
 {
-#ifdef CONFIG_SYS_ARCH_TIMER
+	/* If Timer already enabled, don't re-init it */
+	u32 reg = readl(CONFIG_ROCKCHIP_STIMER_BASE + 0x10);
+	if ( reg & 0x1 )
+		return;
 #ifndef CONFIG_ARM64
 	asm volatile("mcr p15, 0, %0, c14, c0, 0"
 		     : : "r"(COUNTER_FREQUENCY));
@@ -73,7 +76,6 @@ __weak void rockchip_stimer_init(void)
 	writel(0xffffffff, CONFIG_ROCKCHIP_STIMER_BASE);
 	writel(0xffffffff, CONFIG_ROCKCHIP_STIMER_BASE + 4);
 	writel(1, CONFIG_ROCKCHIP_STIMER_BASE + 0x10);
-#endif
 }
 
 __weak int arch_cpu_init(void)
@@ -145,10 +147,7 @@ void board_init_f(ulong dummy)
 #endif
 #endif
 
-#if !defined(CONFIG_SUPPORT_TPL)
 	rockchip_stimer_init();
-	arch_cpu_init();
-#endif
 #define EARLY_UART
 #if defined(EARLY_UART) && defined(CONFIG_DEBUG_UART)
 	/*
@@ -183,6 +182,7 @@ void board_init_f(ulong dummy)
 	sdram_init();
 #endif
 
+	arch_cpu_init();
 	rk_board_init_f();
 #if CONFIG_IS_ENABLED(ROCKCHIP_BACK_TO_BROM) && !defined(CONFIG_SPL_BOARD_INIT)
 	back_to_bootrom(BROM_BOOT_NEXTSTAGE);
diff --git a/arch/arm/mach-rockchip/tpl.c b/arch/arm/mach-rockchip/tpl.c
index 73e4ed386c..a6676e483a 100644
--- a/arch/arm/mach-rockchip/tpl.c
+++ b/arch/arm/mach-rockchip/tpl.c
@@ -114,11 +114,6 @@ __weak void rockchip_stimer_init(void)
 	writel(1, CONFIG_ROCKCHIP_STIMER_BASE + 0x10);
 }
 
-__weak int arch_cpu_init(void)
-{
-	return 0;
-}
-
 void board_init_f(ulong dummy)
 {
 #if defined(CONFIG_SPL_FRAMEWORK) && !CONFIG_IS_ENABLED(TINY_FRAMEWORK)
@@ -127,7 +122,6 @@ void board_init_f(ulong dummy)
 #endif
 
 	rockchip_stimer_init();
-	arch_cpu_init();
 #define EARLY_DEBUG
 #ifdef EARLY_DEBUG
 	/*
diff --git a/cmd/bootrkp.c b/cmd/bootrkp.c
index f2671045a5..e57cc28a63 100755
--- a/cmd/bootrkp.c
+++ b/cmd/bootrkp.c
@@ -26,7 +26,7 @@ static int do_boot_rockchip(cmd_tbl_t *cmdtp, int flag, int argc,
 	dev_desc = rockchip_get_bootdev();
 	if (!dev_desc) {
 		printf("%s: dev_desc is NULL!\n", __func__);
-		return -ENODEV;
+		return CMD_RET_FAILURE;
 	}
 
 #ifdef CONFIG_ANDROID_KEYMASTER_CA
diff --git a/cmd/dvfs.c b/cmd/dvfs.c
index 73a6f06a1e..ac51077b7e 100644
--- a/cmd/dvfs.c
+++ b/cmd/dvfs.c
@@ -15,7 +15,8 @@ static int do_dvfs(cmd_tbl_t *cmdtp, int flag,
 
 	ret = uclass_get_device(UCLASS_DVFS, 0, &dev);
 	if (ret) {
-		printf("DVFS: Get dvfs device failed, ret=%d\n", ret);
+		if (ret != -ENODEV)
+			printf("DVFS: Get dvfs device failed, ret=%d\n", ret);
 		return ret;
 	}
 
diff --git a/cmd/fastboot.c b/cmd/fastboot.c
index 67aa7b8d7b..c9ef71da45 100644
--- a/cmd/fastboot.c
+++ b/cmd/fastboot.c
@@ -13,6 +13,7 @@
 #include <g_dnl.h>
 #include <net.h>
 #include <usb.h>
+#include <sysmem.h>
 
 static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
@@ -21,7 +22,6 @@ static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 	char *usb_controller;
 	int ret;
 #endif
-
 	if (argc < 2)
 		return CMD_RET_USAGE;
 
@@ -65,6 +65,13 @@ static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 		goto exit;
 	}
 
+	if (!sysmem_alloc_base(MEMBLK_ID_FASTBOOT,
+			       CONFIG_FASTBOOT_BUF_ADDR,
+			       CONFIG_FASTBOOT_BUF_SIZE)) {
+		printf("The fastboot memory space is unusable!\n");
+		return CMD_RET_FAILURE;
+	}
+
 	printf("OK\n");
 
 	while (1) {
@@ -78,6 +85,7 @@ static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 	ret = CMD_RET_SUCCESS;
 
 exit:
+	sysmem_free(CONFIG_FASTBOOT_BUF_ADDR);
 	g_dnl_unregister();
 	g_dnl_clear_detach();
 	board_usb_cleanup(controller_index, USB_INIT_DEVICE);
diff --git a/cmd/optee.c b/cmd/optee.c
index f1140176b6..705ac87433 100644
--- a/cmd/optee.c
+++ b/cmd/optee.c
@@ -30,9 +30,13 @@ int test_secure_storage_default(void)
 	}
 
 	debug("%s start\n", __func__);
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return -1;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return -1;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						    TEEC_NONE,
@@ -164,9 +168,13 @@ int test_secure_storage_security_partition(void)
 	}
 
 	debug("%s start\n", __func__);
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return -1;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return -1;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						    TEEC_NONE,
diff --git a/cmd/rockusb.c b/cmd/rockusb.c
index 4062f368cf..c25df454a9 100644
--- a/cmd/rockusb.c
+++ b/cmd/rockusb.c
@@ -24,7 +24,7 @@ static int rkusb_read_sector(struct ums *ums_dev,
 	struct blk_desc *block_dev = &ums_dev->block_dev;
 	lbaint_t blkstart = start + ums_dev->start_sector;
 
-	if (blkstart > RKUSB_READ_LIMIT_ADDR) {
+	if ((blkstart + blkcnt) > RKUSB_READ_LIMIT_ADDR) {
 		memset(buf, 0xcc, blkcnt * SECTOR_SIZE);
 		return blkcnt;
 	} else {
diff --git a/common/Kconfig b/common/Kconfig
index c4ef08fb82..f7a7dd952f 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -249,6 +249,11 @@ config CONSOLE_RECORD_IN_SIZE
 	  The buffer is allocated immediately after the malloc() region is
 	  ready.
 
+config CONSOLE_DISABLE_CTRLC
+	bool "disable ctrlc"
+	help
+	  This disable ctrl+c when CONFIG_BOOTDELAY is 0.
+
 config IDENT_STRING
 	string "Board specific string to be added to uboot version string"
 	help
diff --git a/common/android_bootloader.c b/common/android_bootloader.c
index af912f98de..e6da05a098 100644
--- a/common/android_bootloader.c
+++ b/common/android_bootloader.c
@@ -22,8 +22,12 @@
 #include <keymaster.h>
 #include <linux/libfdt_env.h>
 #include <optee_include/OpteeClientInterface.h>
+#include <bidram.h>
+#include <console.h>
 #include <sysmem.h>
 
+DECLARE_GLOBAL_DATA_PTR;
+
 #define ANDROID_PARTITION_BOOT "boot"
 #define ANDROID_PARTITION_MISC "misc"
 #define ANDROID_PARTITION_OEM  "oem"
@@ -304,14 +308,14 @@ static int android_bootloader_get_fdt(const char *part_name,
 
 int android_bootloader_boot_kernel(unsigned long kernel_address)
 {
-	ulong comp;
-	char kernel_addr_str[12];
-	char *fdt_addr = env_get("fdt_addr");
 	char *kernel_addr_r = env_get("kernel_addr_r");
 	char *kernel_addr_c = env_get("kernel_addr_c");
-
+	char *fdt_addr = env_get("fdt_addr");
+	char kernel_addr_str[12];
+	char comp_str[32] = {0};
+	ulong comp_type;
 	const char *comp_name[] = {
-		[IH_COMP_NONE]  = "",
+		[IH_COMP_NONE]  = "IMAGE",
 		[IH_COMP_GZIP]  = "GZIP",
 		[IH_COMP_BZIP2] = "BZIP2",
 		[IH_COMP_LZMA]  = "LZMA",
@@ -322,17 +326,28 @@ int android_bootloader_boot_kernel(unsigned long kernel_address)
 	char *bootm_args[] = {
 		"bootm", kernel_addr_str, kernel_addr_str, fdt_addr, NULL };
 
-	comp = android_image_get_comp((struct andr_img_hdr *)kernel_address);
+	comp_type = env_get_ulong("os_comp", 10, 0);
 	sprintf(kernel_addr_str, "0x%lx", kernel_address);
 
-	if (comp != IH_COMP_NONE)
-		printf("Booting %s kernel at %s(Uncompress to %s) with fdt at %s...\n\n\n",
-		       comp_name[comp], kernel_addr_c, kernel_addr_r, fdt_addr);
-	else
-		printf("Booting kernel at %s with fdt at %s...\n\n\n",
-		       kernel_addr_r, fdt_addr);
+	if (comp_type != IH_COMP_NONE) {
+		if (comp_type == IH_COMP_ZIMAGE &&
+		    kernel_addr_r && !kernel_addr_c) {
+			kernel_addr_c = kernel_addr_r;
+			kernel_addr_r = __stringify(CONFIG_SYS_SDRAM_BASE);
+		}
+		snprintf(comp_str, 32, "%s%s%s",
+			 "(Uncompress to ", kernel_addr_r, ")");
+	}
+
+	printf("Booting %s kernel at %s%s with fdt at %s...\n\n\n",
+	       comp_name[comp_type],
+	       comp_type != IH_COMP_NONE ? kernel_addr_c : kernel_addr_r,
+	       comp_str, fdt_addr);
 
-	sysmem_dump_check();
+	if (gd->console_evt == CONSOLE_EVT_CTRL_M) {
+		bidram_dump();
+		sysmem_dump();
+	}
 
 	do_bootm(NULL, 0, 4, bootm_args);
 
@@ -574,17 +589,18 @@ static AvbSlotVerifyResult android_slot_verify(char *boot_partname,
 		memcpy((uint8_t *)load_address,
 		       slot_data[0]->loaded_partitions->data,
 		       slot_data[0]->loaded_partitions->data_size);
-
-		/* ... and decrement tries remaining, if applicable. */
-		if (!ab_data.slots[slot_index_to_boot].successful_boot &&
-		    ab_data.slots[slot_index_to_boot].tries_remaining > 0) {
-			ab_data.slots[slot_index_to_boot].tries_remaining -= 1;
-		}
 	} else {
 		slot_set_unbootable(&ab_data.slots[slot_index_to_boot]);
 	}
 
 out:
+#ifdef CONFIG_ANDROID_AB
+	/* ... and decrement tries remaining, if applicable. */
+	if (!ab_data.slots[slot_index_to_boot].successful_boot &&
+	    ab_data.slots[slot_index_to_boot].tries_remaining > 0) {
+		ab_data.slots[slot_index_to_boot].tries_remaining -= 1;
+	}
+#endif
 	env_update("bootargs", verify_state);
 	if (save_metadata_if_changed(ops->ab_ops, &ab_data, &ab_data_orig)) {
 		printf("Can not save metadata\n");
@@ -791,10 +807,8 @@ int android_fdt_overlay_apply(void *fdt_addr)
 	android_print_contents(hdr);
 #endif
 
-	if (android_image_check_header(hdr)) {
-		printf("%s: Invalid Android header %s\n", __func__, hdr->magic);
+	if (android_image_check_header(hdr))
 		return -EINVAL;
-	}
 
 	/* Check header version */
 	if (!hdr->header_version) {
@@ -812,7 +826,7 @@ int android_fdt_overlay_apply(void *fdt_addr)
 		if (sysmem_free((phys_addr_t)fdt_addr))
 			goto out;
 
-		if (!sysmem_alloc_base("fdt(dtbo)",
+		if (!sysmem_alloc_base(MEMBLK_ID_FDT_DTBO,
 				       (phys_addr_t)fdt_addr,
 					fdt_size + CONFIG_SYS_FDT_PAD))
 			goto out;
@@ -878,7 +892,7 @@ bool android_avb_is_enabled(void)
 int android_bootloader_boot_flow(struct blk_desc *dev_desc,
 				 unsigned long load_address)
 {
-	enum android_boot_mode mode;
+	enum android_boot_mode mode = ANDROID_BOOT_MODE_NORMAL;
 	disk_partition_t misc_part_info;
 	int part_num;
 	int ret;
@@ -895,22 +909,23 @@ int android_bootloader_boot_flow(struct blk_desc *dev_desc,
 	part_num = part_get_info_by_name(dev_desc, ANDROID_PARTITION_MISC,
 					 &misc_part_info);
 	if (part_num < 0) {
-		printf("%s Could not find misc partition\n", __func__);
-		return -ENODEV;
-	}
-
+		printf("Could not find misc partition\n");
+	} else {
 #ifdef CONFIG_ANDROID_KEYMASTER_CA
-	/* load attestation key from misc partition. */
-	load_attestation_key(dev_desc, &misc_part_info);
+		/* load attestation key from misc partition. */
+		load_attestation_key(dev_desc, &misc_part_info);
 #endif
 
-	mode = android_bootloader_load_and_clear_mode(dev_desc, &misc_part_info);
+		mode = android_bootloader_load_and_clear_mode(dev_desc,
+							      &misc_part_info);
 #ifdef CONFIG_RKIMG_BOOTLOADER
-	if (mode == ANDROID_BOOT_MODE_NORMAL) {
-		if (rockchip_get_boot_mode() == BOOT_MODE_RECOVERY)
-			mode = ANDROID_BOOT_MODE_RECOVERY;
-	}
+		if (mode == ANDROID_BOOT_MODE_NORMAL) {
+			if (rockchip_get_boot_mode() == BOOT_MODE_RECOVERY)
+				mode = ANDROID_BOOT_MODE_RECOVERY;
+		}
 #endif
+	}
+
 	printf("ANDROID: reboot reason: \"%s\"\n", android_boot_mode_str(mode));
 
 #ifdef CONFIG_ANDROID_AB
@@ -918,10 +933,48 @@ int android_bootloader_boot_flow(struct blk_desc *dev_desc,
 	if (rk_avb_get_current_slot(slot_suffix))
 		return -1;
 
-	if (slot_suffix[0] != '_') {
-		printf("There is no bootable slot!\n");
+	AvbOps *ops;
+	AvbABData ab_data;
+	AvbABData ab_data_orig;
+	size_t slot_index_to_boot = 0;
+
+	if (!strncmp(slot_suffix, "_a", 2))
+		slot_index_to_boot = 0;
+	else if (!strncmp(slot_suffix, "_b", 2))
+		slot_index_to_boot = 1;
+	else
+		slot_index_to_boot = 0;
+	ops = avb_ops_user_new();
+	if (ops == NULL) {
+		printf("avb_ops_user_new() failed!\n");
+		return -1;
+	}
+
+	if(load_metadata(ops->ab_ops, &ab_data, &ab_data_orig)) {
+		printf("Can not load metadata\n");
 		return -1;
 	}
+
+	/* ... and decrement tries remaining, if applicable. */
+	if (!ab_data.slots[slot_index_to_boot].successful_boot &&
+		ab_data.slots[slot_index_to_boot].tries_remaining > 0) {
+		ab_data.slots[slot_index_to_boot].tries_remaining -= 1;
+	}
+
+	if (save_metadata_if_changed(ops->ab_ops, &ab_data, &ab_data_orig)) {
+		printf("Can not save metadata\n");
+		return -1;
+	}
+
+	if (slot_suffix[0] != '_') {
+		printf("###There is no bootable slot, bring up lastboot!###\n");
+		if (rk_get_lastboot() == 1)
+			memcpy(slot_suffix, "_b", 2);
+		else if(rk_get_lastboot() == 0)
+			memcpy(slot_suffix, "_a", 2);
+		else
+			return -1;
+	}
 #endif
 
 	switch (mode) {
@@ -930,7 +983,8 @@ int android_bootloader_boot_flow(struct blk_desc *dev_desc,
 		 * "skip_initramfs" to the cmdline to make it ignore the
 		 * recovery initramfs in the boot partition.
 		 */
-#if defined(CONFIG_ANDROID_AB) && !defined(CONFIG_ANDROID_AVB)
+#if (defined(CONFIG_ANDROID_AB) && !defined(CONFIG_ANDROID_AVB))
+	{
 		char root_partition[20] = {0};
 		char guid_buf[UUID_SIZE] = {0};
 		char root_partuuid[70] = "root=PARTUUID=";
@@ -940,6 +994,7 @@ int android_bootloader_boot_flow(struct blk_desc *dev_desc,
 		get_partition_unique_uuid(root_partition, guid_buf, UUID_SIZE);
 		strcat(root_partuuid, guid_buf);
 		env_update("bootargs", root_partuuid);
+	}
 #endif
 
 #ifdef CONFIG_ANDROID_AB
diff --git a/common/attestation_key.c b/common/attestation_key.c
index 0cfe2ef12e..3e3ecb64c9 100644
--- a/common/attestation_key.c
+++ b/common/attestation_key.c
@@ -199,12 +199,13 @@ static bool validate_ca_header(const uint8_t *buf, uint32_t buf_size)
 
 /* write key to security storage. */
 static uint32_t write_key(keymaster_algorithm_t key_type,
-				const uint8_t *key, uint32_t key_size)
+			  unsigned char *key_name,
+			  const uint8_t *key, uint32_t key_size)
 {
 	char key_file[STORAGE_ID_LENGTH_MAX] = {0};
 
-	snprintf(key_file, STORAGE_ID_LENGTH_MAX, "%s.%s", ATTESTATION_KEY_FILE,
-		get_keyslot_str(key_type));
+	snprintf(key_file, STORAGE_ID_LENGTH_MAX, "%s.%s", key_name,
+		 get_keyslot_str(key_type));
 	write_to_keymaster((uint8_t *)key_file, strlen(key_file),
 				(uint8_t *)key, key_size);
 	return 0;
@@ -243,6 +244,7 @@ atap_result load_attestation_key(struct blk_desc *dev_desc,
 				disk_partition_t *misc_partition)
 {
 	int ret;
+	unsigned char key_name[STORAGE_ID_LENGTH_MAX] = {0};
 
 	if (!dev_desc) {
 		printf("%s: Could not find device\n", __func__);
@@ -325,7 +327,9 @@ atap_result load_attestation_key(struct blk_desc *dev_desc,
 		return ATAP_RESULT_ERROR_BUF_COPY;
 	}
 	/* write rsa private key to security storage*/
-	write_key(KM_ALGORITHM_RSA, key.data, key.data_length);
+	memcpy(key_name, ATTESTATION_KEY_PREFIX,
+	       sizeof(ATTESTATION_KEY_PREFIX));
+	write_key(KM_ALGORITHM_RSA, key_name, key.data, key.data_length);
 
 	/* read rsa cert chain */
 	atap_certchain certchain;
@@ -359,7 +363,7 @@ atap_result load_attestation_key(struct blk_desc *dev_desc,
 	}
 
 	/* write ec private key to security storage*/
-	write_key(KM_ALGORITHM_EC, key.data, key.data_length);
+	write_key(KM_ALGORITHM_EC, key_name, key.data, key.data_length);
 
 	/* read ec cert chain */
 	free_cert_chain(certchain);
@@ -430,12 +434,14 @@ atap_result write_attestation_key_to_secure_storage(uint8_t *received_data,
 						    uint32_t len)
 {
 	unsigned char keybuf[ATTESTATION_DATA_OFFSET] = {0};
+	unsigned char key_name[STORAGE_ID_LENGTH_MAX] = {0};
 	uint32_t device_id_size = 0;
 	uint8_t device_id[32] = {0};
 	uint8_t *key_buf = NULL;
 	uint32_t algorithm;
 	uint8_t *key_data;
 	uint32_t key_data_length = 0;
+
 	/* skip the tag(4 byte) and the size of key(4 byte) */
 	memcpy(keybuf, received_data + 8, ATTESTATION_DATA_OFFSET);
 	key_data = malloc(ATTESTATION_DATA_OFFSET);
@@ -445,11 +451,11 @@ atap_result write_attestation_key_to_secure_storage(uint8_t *received_data,
 		printf("invalidate device_id_size:%d\n", device_id_size);
 		return ATAP_RESULT_ERROR_INVALID_DEVICE_ID;
 	}
-
 	memcpy(device_id, keybuf + CA_HEADER_LEN + sizeof(uint32_t),
 	       device_id_size);
 	printf("device_id:%s\n", device_id);
 
+	memcpy(key_name, ATTESTATION_KEY_FILE, sizeof(ATTESTATION_KEY_FILE));
 	/* read algorithm(RSA) from keybuf */
 	key_buf = keybuf + CA_HEADER_LEN + sizeof(uint32_t) + device_id_size;
 	copy_uint32_from_buf(&key_buf, &algorithm);
@@ -457,7 +463,7 @@ atap_result write_attestation_key_to_secure_storage(uint8_t *received_data,
 	/* read rsa key and certchain */
 	read_key_data(&key_buf, key_data, &key_data_length);
 	printf("write attestation key: RSA\n");
-	write_key(KM_ALGORITHM_RSA, key_data, key_data_length);
+	write_key(KM_ALGORITHM_RSA, key_name, key_data, key_data_length);
 
 	/* read algorithm(EC) from keybuf */
 	copy_uint32_from_buf(&key_buf, &algorithm);
@@ -465,7 +471,7 @@ atap_result write_attestation_key_to_secure_storage(uint8_t *received_data,
 	/* read ec key and certchain */
 	read_key_data(&key_buf, key_data, &key_data_length);
 	printf("write attestation key: EC\n");
-	write_key(KM_ALGORITHM_EC, key_data, key_data_length);
+	write_key(KM_ALGORITHM_EC, key_name, key_data, key_data_length);
 
 	memset(keybuf, 0, sizeof(keybuf));
 	free(key_data);
diff --git a/common/board_f.c b/common/board_f.c
index 888dc367ae..f898e42edd 100644
--- a/common/board_f.c
+++ b/common/board_f.c
@@ -40,6 +40,7 @@
 #include <asm/sections.h>
 #include <dm/root.h>
 #include <linux/errno.h>
+#include <sysmem.h>
 
 /*
  * Pointer to initial global data area
@@ -874,6 +875,9 @@ static const init_fnc_t init_sequence_f[] = {
 	reserve_stacks,
 	dram_init_banksize,
 	show_dram_config,
+#ifdef CONFIG_SYSMEM
+	sysmem_init,		/* Validate above reserve memory */
+#endif
 #if defined(CONFIG_M68K) || defined(CONFIG_MIPS) || defined(CONFIG_PPC) || \
 	defined(CONFIG_SH)
 	setup_board_part1,
diff --git a/common/board_r.c b/common/board_r.c
index f8db94c9af..e49e30c8c2 100644
--- a/common/board_r.c
+++ b/common/board_r.c
@@ -56,6 +56,7 @@
 #include <linux/err.h>
 #include <efi_loader.h>
 #include <sysmem.h>
+#include <bidram.h>
 
 DECLARE_GLOBAL_DATA_PTR;
 
@@ -711,7 +712,7 @@ __weak int interrupt_debugger_init(void)
 	return 0;
 }
 
-__weak int dram_initr_banksize(void)
+__weak int board_initr_caches_fixup(void)
 {
 	return 0;
 }
@@ -760,15 +761,18 @@ static init_fnc_t init_sequence_r[] = {
 	 * like other regions, otherwise there would be dcache coherence issue
 	 * between firmware and U-Boot.
 	 */
-	dram_initr_banksize,
+	board_initr_caches_fixup,
 
 #if defined(CONFIG_SYS_INIT_RAM_LOCK) && defined(CONFIG_E500)
 	initr_unlock_ram_in_cache,
 #endif
 	initr_barrier,
 	initr_malloc,
+#ifdef CONFIG_BIDRAM
+	bidram_initr,
+#endif
 #ifdef CONFIG_SYSMEM
-	sysmem_init,		/* After malloc setup */
+	sysmem_initr,
 #endif
 	log_init,
 	initr_bootstage,	/* Needs malloc() but has its own timer */
diff --git a/common/boot_rkimg.c b/common/boot_rkimg.c
index 0d48232e3e..49bc241f69 100644
--- a/common/boot_rkimg.c
+++ b/common/boot_rkimg.c
@@ -15,6 +15,8 @@
 #include <asm/arch/boot_mode.h>
 #include <asm/io.h>
 #include <part.h>
+#include <bidram.h>
+#include <console.h>
 #include <sysmem.h>
 
 #define TAG_KERNEL			0x4C4E524B
@@ -88,12 +90,10 @@ static void boot_lmb_init(bootm_headers_t *images)
  * return the image size on success, and a
  * negative value on error.
  */
-static int read_rockchip_image(struct blk_desc *dev_desc,
-			       disk_partition_t *part_info,
-			       void *dst)
+int read_rockchip_image(struct blk_desc *dev_desc,
+			disk_partition_t *part_info, void *dst)
 {
 	struct rockchip_image *img;
-	const char *name;
 	int header_len = 8;
 	int cnt;
 	int ret;
@@ -101,14 +101,6 @@ static int read_rockchip_image(struct blk_desc *dev_desc,
 	u32 crc32;
 #endif
 
-	if (!strcmp((char *)part_info->name, "kernel"))
-		name = "kernel";
-	else if (!strcmp((char *)part_info->name, "boot") ||
-		 !strcmp((char *)part_info->name, "recovery"))
-		name = "ramdisk";
-	else
-		name = NULL;
-
 	img = memalign(ARCH_DMA_MINALIGN, RK_BLK_SIZE);
 	if (!img) {
 		printf("out of memory\n");
@@ -133,7 +125,9 @@ static int read_rockchip_image(struct blk_desc *dev_desc,
 	 * total size  = image size + 8 bytes header + 4 bytes crc32
 	 */
 	cnt = DIV_ROUND_UP(img->size + 8 + 4, RK_BLK_SIZE);
-	if (!sysmem_alloc_base(name, (phys_addr_t)dst, cnt * dev_desc->blksz)) {
+	if (!sysmem_alloc_base_by_name((const char *)part_info->name,
+				       (phys_addr_t)dst,
+				       cnt * dev_desc->blksz)) {
 		ret = -ENXIO;
 		goto err;
 	}
@@ -208,10 +202,21 @@ int get_bootdev_type(void)
 
 	if (!appended && boot_media) {
 		appended = 1;
-		/*
-		 * 1. androidboot.mode=charger has higher priority, not override;
-		 * 2. rknand doesn't need "androidboot.mode=";
-		 */
+
+	/*
+	 * The legacy rockchip Android (SDK < 8.1) requires "androidboot.mode="
+	 * to be "charger" or boot media which is a rockchip private solution.
+	 *
+	 * The official Android rule (SDK >= 8.1) is:
+	 * "androidboot.mode=normal" or "androidboot.mode=charger".
+	 *
+	 * Now that this U-Boot is usually working with higher version
+	 * Android (SDK >= 8.1), we follow the official rules.
+	 *
+	 * Common: androidboot.mode=charger has higher priority, don't override;
+	 */
+#ifdef CONFIG_RKIMG_ANDROID_BOOTMODE_LEGACY
+		/* rknand doesn't need "androidboot.mode="; */
 		if (env_exist("bootargs", "androidboot.mode=charger") ||
 		    (type == IF_TYPE_RKNAND) ||
 		    (type == IF_TYPE_SPINAND) ||
@@ -222,6 +227,15 @@ int get_bootdev_type(void)
 			snprintf(boot_options, sizeof(boot_options),
 				 "storagemedia=%s androidboot.mode=%s",
 				 boot_media, boot_media);
+#else
+		if (env_exist("bootargs", "androidboot.mode=charger"))
+			snprintf(boot_options, sizeof(boot_options),
+				 "storagemedia=%s", boot_media);
+		else
+			snprintf(boot_options, sizeof(boot_options),
+				 "storagemedia=%s androidboot.mode=normal",
+				 boot_media);
+#endif
 		env_update("bootargs", boot_options);
 	}
 
@@ -352,9 +366,14 @@ int rockchip_get_boot_mode(void)
 	 * USB attach will do env_set("reboot_mode", "recovery");
 	 */
 	env_reboot_mode = env_get("reboot_mode");
-	if (env_reboot_mode && !strcmp(env_reboot_mode, "recovery")) {
-		boot_mode = BOOT_MODE_RECOVERY;
-		printf("boot mode: recovery\n");
+	if (env_reboot_mode) {
+		if (!strcmp(env_reboot_mode, "recovery")) {
+			boot_mode = BOOT_MODE_RECOVERY;
+			printf("boot mode: recovery\n");
+		} else if (!strcmp(env_reboot_mode, "fastboot")) {
+			boot_mode = BOOT_MODE_BOOTLOADER;
+			printf("boot mode: fastboot\n");
+		}
 	}
 
 	if (boot_mode != -1)
@@ -389,7 +408,6 @@ fallback:
 	} else {
 		/* Mode from boot mode register */
 		reg_boot_mode = readl((void *)CONFIG_ROCKCHIP_BOOT_MODE_REG);
-		writel(BOOT_NORMAL, (void *)CONFIG_ROCKCHIP_BOOT_MODE_REG);
 
 		switch (reg_boot_mode) {
 		case BOOT_NORMAL:
@@ -505,7 +523,11 @@ int boot_rockchip_image(struct blk_desc *dev_desc, disk_partition_t *boot_part)
 	printf("ramdisk  @ 0x%08lx (0x%08x)\n", ramdisk_addr_r, ramdisk_size);
 
 	fdt_ramdisk_skip_relocation();
-	sysmem_dump_check();
+
+	if (gd->console_evt == CONSOLE_EVT_CTRL_M) {
+		bidram_dump();
+		sysmem_dump();
+	}
 
 #if defined(CONFIG_ARM64)
 	char cmdbuf[64];
diff --git a/common/console.c b/common/console.c
index 399f001f27..4990fdd69a 100644
--- a/common/console.c
+++ b/common/console.c
@@ -412,13 +412,6 @@ int getc(void)
 
 int tstc(void)
 {
-/* Don't allow drivers call tstc() to do some "exit" event(maybe enter hush) */
-#if defined(CONFIG_ARCH_ROCKCHIP) && \
-    defined(CONFIG_AVB_VBMETA_PUBLIC_KEY_VALIDATE) && \
-    defined(CONFIG_BOOTDELAY) && (CONFIG_BOOTDELAY <= 0)
-	return 0;
-#endif
-
 #ifdef CONFIG_DISABLE_CONSOLE
 	if (gd->flags & GD_FLG_DISABLE_CONSOLE)
 		return 0;
@@ -601,9 +594,8 @@ static int ctrlc_disabled = 0;	/* see disable_ctrl() */
 static int ctrlc_was_pressed = 0;
 int ctrlc(void)
 {
-/* Don't allow drivers call ctrlc() to do some "exit" event(maybe enter hush) */
-#if defined(CONFIG_ARCH_ROCKCHIP) && \
-    defined(CONFIG_AVB_VBMETA_PUBLIC_KEY_VALIDATE)
+#if defined(CONFIG_CONSOLE_DISABLE_CTRLC) && \
+    defined(CONFIG_BOOTDELAY) && (CONFIG_BOOTDELAY <= 0)
 	return 0;
 #endif
 
diff --git a/common/fdt_support.c b/common/fdt_support.c
index b096762b1b..28caaf0d51 100644
--- a/common/fdt_support.c
+++ b/common/fdt_support.c
@@ -315,12 +315,13 @@ int fdt_chosen(void *fdt)
 #ifdef CONFIG_ANDROID_AB
 				env_update_filter("bootargs", bootargs, "root=");
 #else
+				env_update("bootargs", bootargs);
+#endif
 				/*
 				 * Initrd fixup: remove unused "initrd=0x...,0x...",
 				 * this for compatible with legacy parameter.txt
 				 */
-				env_update_filter("bootargs", bootargs, "initrd=");
-#endif
+				env_delete("bootargs", "initrd=", 0);
 			}
 #endif
 		}
diff --git a/common/image-android.c b/common/image-android.c
index f37123efaa..048de0f7ea 100644
--- a/common/image-android.c
+++ b/common/image-android.c
@@ -290,7 +290,7 @@ static int android_image_load_separate(struct blk_desc *dev_desc,
 		size = hdr->kernel_size + hdr->page_size;
 		blk_start = part->start;
 		blk_cnt = DIV_ROUND_UP(size, dev_desc->blksz);
-		if (!sysmem_alloc_base("kernel",
+		if (!sysmem_alloc_base(MEMBLK_ID_KERNEL,
 				       (phys_addr_t)android_load_address,
 				       blk_cnt * dev_desc->blksz))
 			return -ENXIO;
@@ -311,7 +311,7 @@ static int android_image_load_separate(struct blk_desc *dev_desc,
 		size = hdr->page_size + ALIGN(hdr->kernel_size, hdr->page_size);
 		blk_start = part->start + DIV_ROUND_UP(size, dev_desc->blksz);
 		blk_cnt = DIV_ROUND_UP(hdr->ramdisk_size, dev_desc->blksz);
-		if (!sysmem_alloc_base("ramdisk",
+		if (!sysmem_alloc_base(MEMBLK_ID_RAMDISK,
 				       ramdisk_addr_r,
 				       blk_cnt * dev_desc->blksz))
 			return -ENXIO;
@@ -347,7 +347,7 @@ static int android_image_load_separate(struct blk_desc *dev_desc,
 		       ALIGN(hdr->ramdisk_size, hdr->page_size);
 		blk_start = part->start + DIV_ROUND_UP(size, dev_desc->blksz);
 		blk_cnt = DIV_ROUND_UP(hdr->second_size, dev_desc->blksz);
-		if (!sysmem_alloc_base("fdt(AOSP)",
+		if (!sysmem_alloc_base(MEMBLK_ID_FDT_AOSP,
 				       fdt_addr_r,
 				       blk_cnt * dev_desc->blksz +
 				       CONFIG_SYS_FDT_PAD))
@@ -413,15 +413,32 @@ long android_image_load(struct blk_desc *dev_desc,
 			   part_info->blksz - 1) / part_info->blksz;
 		comp = android_image_parse_kernel_comp(hdr);
 		/*
-		 * We should load a compressed kernel Image
-		 * to high memory
+		 * We should load compressed kernel Image to high memory at
+		 * address "kernel_addr_c".
 		 */
 		if (comp != IH_COMP_NONE) {
-			load_address += android_image_get_ksize(hdr) * 3;
-			load_address = env_get_ulong("kernel_addr_c", 16, load_address);
-			load_address -= hdr->page_size;
-			unmap_sysmem(buf);
-			buf = map_sysmem(load_address, 0 /* size */);
+			ulong kernel_addr_c;
+
+			env_set_ulong("os_comp", comp);
+			kernel_addr_c = env_get_ulong("kernel_addr_c", 16, 0);
+			if (kernel_addr_c) {
+				load_address = kernel_addr_c - hdr->page_size;
+				unmap_sysmem(buf);
+				buf = map_sysmem(load_address, 0 /* size */);
+			}
+#ifdef CONFIG_ARM64
+			else {
+				printf("Warn: \"kernel_addr_c\" is not defined "
+				       "for compressed kernel Image!\n");
+				load_address += android_image_get_ksize(hdr) * 3;
+				load_address = ALIGN(load_address, ARCH_DMA_MINALIGN);
+				env_set_ulong("kernel_addr_c", load_address);
+
+				load_address -= hdr->page_size;
+				unmap_sysmem(buf);
+				buf = map_sysmem(load_address, 0 /* size */);
+			}
+#endif
 		}
 
 		if (blk_cnt * part_info->blksz > max_size) {
@@ -456,7 +473,7 @@ long android_image_load(struct blk_desc *dev_desc,
 			} else
 #endif
 			{
-				if (!sysmem_alloc_base("android",
+				if (!sysmem_alloc_base(MEMBLK_ID_ANDROID,
 						       (phys_addr_t)buf,
 							blk_cnt * part_info->blksz))
 					return -ENXIO;
diff --git a/common/image-fdt.c b/common/image-fdt.c
index 6bdbe6c902..6cabd2eeff 100644
--- a/common/image-fdt.c
+++ b/common/image-fdt.c
@@ -88,6 +88,7 @@ void boot_fdt_add_mem_rsv_regions(struct lmb *lmb, void *fdt_blob)
 	fdt_addr_t rsv_addr;
 	/* we needn't repeat do reserve, do_bootm_linux would call this again */
 	static int rsv_done;
+	const void *prop;
 
 	if (fdt_check_header(fdt_blob) != 0 || rsv_done)
 		return;
@@ -110,6 +111,10 @@ void boot_fdt_add_mem_rsv_regions(struct lmb *lmb, void *fdt_blob)
 	for (offset = fdt_first_subnode(fdt_blob, rsv_offset);
 	     offset >= 0;
 	     offset = fdt_next_subnode(fdt_blob, offset)) {
+		prop = fdt_getprop(fdt_blob, offset, "status", NULL);
+		if (prop && !strcmp(prop, "disabled"))
+			continue;
+
 		rsv_addr = fdtdec_get_addr_size_auto_noparent(fdt_blob, offset,
 							      "reg", 0,
 							      &rsv_size, false);
@@ -137,7 +142,7 @@ int boot_fdt_add_sysmem_rsv_regions(void *fdt_blob)
 	fdt_addr_t rsv_addr;
 	static int rsv_done;
 	char resvname[32];
-	int ret;
+	const void *prop;
 
 	if (fdt_check_header(fdt_blob) != 0 || rsv_done)
 		return -EINVAL;
@@ -151,9 +156,8 @@ int boot_fdt_add_sysmem_rsv_regions(void *fdt_blob)
 		debug("   sysmem: reserving fdt memory region: addr=%llx size=%llx\n",
 		      (unsigned long long)addr, (unsigned long long)size);
 		sprintf(resvname, "fdt-memory-reserved%d", i);
-		ret = sysmem_reserve(resvname, addr, size);
-		if (ret)
-			return ret;
+		if (!sysmem_fdt_reserve_alloc_base(resvname, addr, size))
+			return -ENOMEM;
 	}
 
 	rsv_offset = fdt_subnode_offset(fdt_blob, 0, "reserved-memory");
@@ -163,6 +167,10 @@ int boot_fdt_add_sysmem_rsv_regions(void *fdt_blob)
 	for (offset = fdt_first_subnode(fdt_blob, rsv_offset);
 	     offset >= 0;
 	     offset = fdt_next_subnode(fdt_blob, offset)) {
+		prop = fdt_getprop(fdt_blob, offset, "status", NULL);
+		if (prop && !strcmp(prop, "disabled"))
+			continue;
+
 		rsv_addr = fdtdec_get_addr_size_auto_noparent(fdt_blob, offset,
 							      "reg", 0,
 							      &rsv_size, false);
@@ -171,10 +179,9 @@ int boot_fdt_add_sysmem_rsv_regions(void *fdt_blob)
 		debug("  sysmem: 'reserved-memory' %s: addr=%llx size=%llx\n",
 		      fdt_get_name(fdt_blob, offset, NULL),
 		      (unsigned long long)rsv_addr, (unsigned long long)rsv_size);
-		ret = sysmem_reserve(fdt_get_name(fdt_blob, offset, NULL),
-				     rsv_addr, rsv_size);
-		if (ret)
-			return ret;
+		if (!sysmem_fdt_reserve_alloc_base(fdt_get_name(fdt_blob, offset, NULL),
+					           rsv_addr, rsv_size))
+			return -ENOMEM;
 	}
 
 	return 0;
diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index f97fa03800..d65cbb1ae6 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -197,7 +197,7 @@ static int spl_load_fit_image(struct spl_load_info *info, ulong sector,
 			return -ENOENT;
 
 		load_ptr = (load_addr + align_len) & ~align_len;
-#ifdef CONFIG_ROCKCHIP_RK3399
+#if  defined(CONFIG_ROCKCHIP_RK3399) || defined(CONFIG_ROCKCHIP_RK3368)
 		if ((load_ptr & 0xffff0000) == CONFIG_ROCKCHIP_IRAM_START_ADDR)
 			load_ptr = (ulong)memalign(ARCH_DMA_MINALIGN, len);
 #endif
diff --git a/configs/evb-aarch32-rk3308_defconfig b/configs/evb-aarch32-rk3308_defconfig
index f8510b1e49..1937284b35 100644
--- a/configs/evb-aarch32-rk3308_defconfig
+++ b/configs/evb-aarch32-rk3308_defconfig
@@ -51,6 +51,9 @@ CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
 CONFIG_REGULATOR_PWM=y
diff --git a/configs/evb-px30_defconfig b/configs/evb-px30_defconfig
index 81f1884d78..f69bf0d290 100644
--- a/configs/evb-px30_defconfig
+++ b/configs/evb-px30_defconfig
@@ -47,9 +47,8 @@ CONFIG_CMD_USB=y
 CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
-# CONFIG_CMD_NET is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -69,8 +68,10 @@ CONFIG_RK8XX_PWRKEY=y
 CONFIG_ADC_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
 CONFIG_DM_PMIC=y
@@ -128,6 +129,8 @@ CONFIG_VIDEO_BRIDGE_ANALOGIX_ANX6345=y
 CONFIG_LCD=y
 CONFIG_USE_TINY_PRINTF=y
 CONFIG_SPL_TINY_MEMSET=y
+CONFIG_LZ4=y
+CONFIG_LZO=y
 CONFIG_ERRNO_STR=y
 # CONFIG_EFI_LOADER is not set
 CONFIG_OPTEE_CLIENT=y
diff --git a/configs/evb-px5_defconfig b/configs/evb-px5_defconfig
index e9f2c05265..68fbce641d 100644
--- a/configs/evb-px5_defconfig
+++ b/configs/evb-px5_defconfig
@@ -1,28 +1,76 @@
 CONFIG_ARM=y
 CONFIG_ARCH_ROCKCHIP=y
-CONFIG_SYS_MALLOC_F_LEN=0x1000
+CONFIG_SPL_LIBCOMMON_SUPPORT=y
+CONFIG_SPL_LIBGENERIC_SUPPORT=y
+CONFIG_SYS_MALLOC_F_LEN=0x2000
+CONFIG_TPL_MAX_SIZE=32768
 CONFIG_ROCKCHIP_RK3368=y
+CONFIG_ROCKCHIP_PX5=y
 CONFIG_TARGET_EVB_PX5=y
+CONFIG_ROCKCHIP_SPL_RESERVE_IRAM=0x40000
+CONFIG_TPL_LIBCOMMON_SUPPORT=y
+CONFIG_TPL_LIBGENERIC_SUPPORT=y
+CONFIG_SPL_DRIVERS_MISC_SUPPORT=y
+CONFIG_PANIC_HANG=y
+CONFIG_SPL_SPI_FLASH_SUPPORT=y
+CONFIG_SPL_SPI_SUPPORT=y
+CONFIG_SPL_STACK_R_ADDR=0x600000
 CONFIG_DEFAULT_DEVICE_TREE="rk3368-px5-evb"
 CONFIG_DEBUG_UART=y
 CONFIG_ANDROID_BOOT_IMAGE=y
+CONFIG_FIT=y
+CONFIG_FIT_VERBOSE=y
+CONFIG_SPL_LOAD_FIT=y
+CONFIG_SPL_FIT_GENERATOR="arch/arm/mach-rockchip/make_fit_atf.py"
+CONFIG_BOOTSTAGE=y
+CONFIG_SPL_BOOTSTAGE=y
+CONFIG_BOOTSTAGE_REPORT=y
+CONFIG_BOOTSTAGE_FDT=y
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_ARCH_EARLY_INIT_R=y
+CONFIG_SPL=y
+CONFIG_SPL_BOOTROM_SUPPORT=y
+# CONFIG_SPL_LEGACY_IMAGE_SUPPORT is not set
+CONFIG_TPL_SYS_MALLOC_SIMPLE=y
+CONFIG_SPL_STACK_R=y
+CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_SECTOR=0x4000
+CONFIG_SPL_ATF=y
+CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
+CONFIG_TPL=y
+CONFIG_TPL_BOOTROM_SUPPORT=y
 # CONFIG_CMD_IMLS is not set
 CONFIG_CMD_MMC=y
-CONFIG_CMD_CACHE=y
+CONFIG_SPL_OF_CONTROL=y
+CONFIG_TPL_OF_CONTROL=y
+CONFIG_OF_LIVE=y
+CONFIG_OF_SPL_REMOVE_PROPS="pinctrl-0 pinctrl-names interrupt-parent"
+CONFIG_TPL_OF_PLATDATA=y
+CONFIG_ENV_IS_IN_MMC=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_TPL_DM=y
 CONFIG_REGMAP=y
+CONFIG_SPL_REGMAP=y
+CONFIG_TPL_REGMAP=y
 CONFIG_SYSCON=y
+CONFIG_SPL_SYSCON=y
+CONFIG_TPL_SYSCON=y
 CONFIG_CLK=y
+CONFIG_SPL_CLK=y
+CONFIG_TPL_CLK=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_PINCTRL=y
+CONFIG_SPL_PINCTRL=y
 CONFIG_RAM=y
+CONFIG_SPL_RAM=y
+CONFIG_TPL_RAM=y
 CONFIG_DM_RESET=y
 CONFIG_DEBUG_UART_BASE=0xFF1c0000
 CONFIG_DEBUG_UART_CLOCK=24000000
 CONFIG_DEBUG_UART_SHIFT=2
-CONFIG_DEBUG_UART_ANNOUNCE=y
 CONFIG_DEBUG_UART_SKIP_INIT=y
 CONFIG_SYSRESET=y
+CONFIG_USE_TINY_PRINTF=y
+CONFIG_TPL_TINY_MEMSET=y
+CONFIG_SPL_TINY_MEMSET=y
 CONFIG_ERRNO_STR=y
diff --git a/configs/evb-rk3036_defconfig b/configs/evb-rk3036_defconfig
index 2e8fcf21ad..9166b2725f 100644
--- a/configs/evb-rk3036_defconfig
+++ b/configs/evb-rk3036_defconfig
@@ -30,6 +30,7 @@ CONFIG_SPL_OPTEE_SUPPORT=y
 CONFIG_SPL_OPTEE=y
 CONFIG_TPL_TINY_FRAMEWORK=y
 CONFIG_TPL_SERIAL_SUPPORT=y
+CONFIG_FASTBOOT_BUF_ADDR=0x60800800
 CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
diff --git a/configs/evb-rk3229_defconfig b/configs/evb-rk3229_defconfig
index a6c05c99da..99a232f563 100644
--- a/configs/evb-rk3229_defconfig
+++ b/configs/evb-rk3229_defconfig
@@ -30,6 +30,7 @@ CONFIG_ANDROID_BOOTLOADER=y
 CONFIG_SPL_STACK_R=y
 CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000
 CONFIG_SPL_OPTEE=y
+CONFIG_FASTBOOT_BUF_ADDR=0x60800800
 CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
diff --git a/configs/evb-rk3288-rk1608_defconfig b/configs/evb-rk3288-rk1608_defconfig
index 4c65113ff0..2dfa1e8c40 100644
--- a/configs/evb-rk3288-rk1608_defconfig
+++ b/configs/evb-rk3288-rk1608_defconfig
@@ -14,6 +14,8 @@ CONFIG_SPL_STACK_R=y
 CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
+CONFIG_FASTBOOT_BUF_ADDR=0x800800
+CONFIG_FASTBOOT_BUF_SIZE=0x4000000
 # CONFIG_CMD_IMLS is not set
 CONFIG_CMD_GPIO=y
 CONFIG_CMD_GPT=y
diff --git a/configs/evb-rk3308_defconfig b/configs/evb-rk3308_defconfig
index 48af622e47..979823ec75 100644
--- a/configs/evb-rk3308_defconfig
+++ b/configs/evb-rk3308_defconfig
@@ -49,6 +49,9 @@ CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
 CONFIG_REGULATOR_PWM=y
diff --git a/configs/evb-rk3326_defconfig b/configs/evb-rk3326_defconfig
index e9a9db9e24..27a9790679 100644
--- a/configs/evb-rk3326_defconfig
+++ b/configs/evb-rk3326_defconfig
@@ -49,7 +49,7 @@ CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -69,7 +69,6 @@ CONFIG_RK8XX_PWRKEY=y
 CONFIG_ADC_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
diff --git a/configs/evb-rk3328_defconfig b/configs/evb-rk3328_defconfig
index 7bc65c73e5..77d757afae 100644
--- a/configs/evb-rk3328_defconfig
+++ b/configs/evb-rk3328_defconfig
@@ -3,8 +3,9 @@ CONFIG_ARCH_ROCKCHIP=y
 CONFIG_SPL_LIBCOMMON_SUPPORT=y
 CONFIG_SPL_LIBGENERIC_SUPPORT=y
 CONFIG_SYS_MALLOC_F_LEN=0x2000
+CONFIG_SPL_FIT_GENERATOR="arch/arm/mach-rockchip/make_fit_atf.py"
 CONFIG_ROCKCHIP_RK3328=y
-CONFIG_ROCKCHIP_SPL_RESERVE_IRAM=0x0
+CONFIG_ROCKCHIP_SPL_RESERVE_IRAM=0x40000
 CONFIG_TPL_LIBCOMMON_SUPPORT=y
 CONFIG_TPL_LIBGENERIC_SUPPORT=y
 CONFIG_SPL_DRIVERS_MISC_SUPPORT=y
@@ -16,7 +17,6 @@ CONFIG_TPL_SYS_MALLOC_F_LEN=0x600
 CONFIG_FIT=y
 CONFIG_FIT_VERBOSE=y
 CONFIG_SPL_LOAD_FIT=y
-CONFIG_SPL_FIT_GENERATOR="arch/arm/mach-rockchip/make_fit_atf.py"
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_TPL_SYS_MALLOC_SIMPLE=y
 CONFIG_SPL_STACK_R=y
@@ -25,6 +25,7 @@ CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
 CONFIG_TPL_BOOTROM_SUPPORT=y
 CONFIG_TPL_DRIVERS_MISC_SUPPORT=y
 CONFIG_FASTBOOT_BUF_ADDR=0x800800
+CONFIG_FASTBOOT_BUF_SIZE=0x4000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=1
 CONFIG_CMD_BOOTZ=y
@@ -39,8 +40,8 @@ CONFIG_TPL_OF_CONTROL=y
 CONFIG_OF_SPL_REMOVE_PROPS="pinctrl-0 pinctrl-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents"
 CONFIG_TPL_OF_PLATDATA=y
 CONFIG_ENV_IS_IN_MMC=y
-CONFIG_TPL_DM=y
 CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_TPL_DM=y
 CONFIG_REGMAP=y
 CONFIG_SPL_REGMAP=y
 CONFIG_TPL_REGMAP=y
@@ -54,12 +55,11 @@ CONFIG_SYS_I2C_ROCKCHIP=y
 CONFIG_DM_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
-CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_DM_ETH=y
 CONFIG_ETH_DESIGNWARE=y
 CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PHY=y
+CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_PMIC=y
 CONFIG_PMIC_RK8XX=y
diff --git a/configs/evb-rk3399_defconfig b/configs/evb-rk3399_defconfig
index 2d3df130a2..c431b34bf8 100644
--- a/configs/evb-rk3399_defconfig
+++ b/configs/evb-rk3399_defconfig
@@ -20,7 +20,7 @@ CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x10000
 CONFIG_SPL_ATF=y
 CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
 CONFIG_FASTBOOT_BUF_ADDR=0x00800800
-CONFIG_FASTBOOT_BUF_SIZE=0x08000000
+CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
 CONFIG_CMD_BOOTZ=y
diff --git a/configs/evb-rv1108_defconfig b/configs/evb-rv1108_defconfig
index 4afae952d0..c605c33a13 100644
--- a/configs/evb-rv1108_defconfig
+++ b/configs/evb-rv1108_defconfig
@@ -2,6 +2,9 @@ CONFIG_ARM=y
 # CONFIG_SPL_USE_ARCH_MEMCPY is not set
 # CONFIG_SPL_USE_ARCH_MEMSET is not set
 CONFIG_ARCH_ROCKCHIP=y
+CONFIG_SPL_LIBCOMMON_SUPPORT=y
+CONFIG_SPL_LIBGENERIC_SUPPORT=y
+CONFIG_SYS_MALLOC_F_LEN=0x2000
 CONFIG_ROCKCHIP_RV1108=y
 CONFIG_SPL_ROCKCHIP_BACK_TO_BROM=y
 CONFIG_RKIMG_BOOTLOADER=y
@@ -15,10 +18,11 @@ CONFIG_DEBUG_UART=y
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_ANDROID_BOOTLOADER=y
 CONFIG_SPL_STACK_R=y
+CONFIG_PANIC_HANG=y
 CONFIG_TPL_TINY_FRAMEWORK=y
 CONFIG_TPL_SERIAL_SUPPORT=y
 CONFIG_FASTBOOT_BUF_ADDR=0x62000000
-CONFIG_FASTBOOT_BUF_SIZE=0x08000000
+CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=1
 # CONFIG_CMD_IMLS is not set
@@ -34,11 +38,12 @@ CONFIG_CMD_TIME=y
 CONFIG_SPL_OF_CONTROL=y
 CONFIG_TPL_OF_CONTROL=y
 CONFIG_OF_LIVE=y
-CONFIG_SPL_OF_PLATDATA=y
 CONFIG_TPL_OF_PLATDATA=y
 CONFIG_NET_RANDOM_ETHADDR=y
 CONFIG_REGMAP=y
+CONFIG_SPL_REGMAP=y
 CONFIG_SYSCON=y
+CONFIG_SPL_SYSCON=y
 CONFIG_CLK=y
 CONFIG_ROCKCHIP_GPIO=y
 CONFIG_SYS_I2C_ROCKCHIP=y
diff --git a/configs/px30_defconfig b/configs/px30_defconfig
index 70f39c138d..43449a49b3 100644
--- a/configs/px30_defconfig
+++ b/configs/px30_defconfig
@@ -49,9 +49,8 @@ CONFIG_CMD_USB=y
 CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
-# CONFIG_CMD_NET is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -71,6 +70,9 @@ CONFIG_RK8XX_PWRKEY=y
 CONFIG_ADC_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
@@ -129,6 +131,8 @@ CONFIG_VIDEO_BRIDGE_ANALOGIX_ANX6345=y
 CONFIG_LCD=y
 CONFIG_USE_TINY_PRINTF=y
 CONFIG_SPL_TINY_MEMSET=y
+CONFIG_LZ4=y
+CONFIG_LZO=y
 CONFIG_ERRNO_STR=y
 CONFIG_OF_LIBFDT_OVERLAY=y
 # CONFIG_EFI_LOADER is not set
diff --git a/configs/rk1808_defconfig b/configs/rk1808_defconfig
index 8ffec5633e..834776a53d 100644
--- a/configs/rk1808_defconfig
+++ b/configs/rk1808_defconfig
@@ -16,6 +16,7 @@ CONFIG_SYS_CONSOLE_INFO_QUIET=y
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_ANDROID_BOOTLOADER=y
 CONFIG_FASTBOOT_BUF_ADDR=0x00800800
+CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
 # CONFIG_CMD_BOOTD is not set
@@ -37,14 +38,12 @@ CONFIG_CMD_USB=y
 CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
-# CONFIG_CMD_NET is not set
 # CONFIG_CMD_MISC is not set
 # CONFIG_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_RKPARM_PARTITION=y
 CONFIG_OF_LIVE=y
 CONFIG_OF_SPL_REMOVE_PROPS="pinctrl-0 pinctrl-names clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents"
-CONFIG_NET=y
 CONFIG_REGMAP=y
 CONFIG_SYSCON=y
 CONFIG_CLK=y
@@ -56,6 +55,9 @@ CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
 CONFIG_DM_PMIC=y
diff --git a/configs/rk3036_defconfig b/configs/rk3036_defconfig
index 62e45aa81b..acb901c273 100644
--- a/configs/rk3036_defconfig
+++ b/configs/rk3036_defconfig
@@ -32,6 +32,7 @@ CONFIG_SPL_OPTEE_SUPPORT=y
 CONFIG_SPL_OPTEE=y
 CONFIG_TPL_TINY_FRAMEWORK=y
 CONFIG_TPL_SERIAL_SUPPORT=y
+CONFIG_FASTBOOT_BUF_ADDR=0x60800800
 CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
diff --git a/configs/rk3126_defconfig b/configs/rk3126_defconfig
index 447b70876f..669761bf7a 100644
--- a/configs/rk3126_defconfig
+++ b/configs/rk3126_defconfig
@@ -36,7 +36,6 @@ CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_BMP=y
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -54,7 +53,6 @@ CONFIG_GPIO_KEY=y
 CONFIG_RK_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
diff --git a/configs/rk3128x_defconfig b/configs/rk3128x_defconfig
index 46c4f5da7b..511babf891 100644
--- a/configs/rk3128x_defconfig
+++ b/configs/rk3128x_defconfig
@@ -32,6 +32,7 @@ CONFIG_SPL_STACK_R=y
 CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000
 CONFIG_SPL_OPTEE=y
 CONFIG_TPL_DRIVERS_MISC_SUPPORT=y
+CONFIG_FASTBOOT_BUF_ADDR=0x60800800
 CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
diff --git a/configs/rk322x_defconfig b/configs/rk322x_defconfig
index cc18398c46..fd3f6306e0 100644
--- a/configs/rk322x_defconfig
+++ b/configs/rk322x_defconfig
@@ -31,6 +31,7 @@ CONFIG_SPL_STACK_R=y
 CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000
 CONFIG_SPL_OPTEE=y
 CONFIG_TPL_DRIVERS_MISC_SUPPORT=y
+CONFIG_FASTBOOT_BUF_ADDR=0x60800800
 CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
@@ -52,7 +53,7 @@ CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -82,7 +83,6 @@ CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_DM_ETH=y
 CONFIG_ETH_DESIGNWARE=y
 CONFIG_GMAC_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_PMIC=y
diff --git a/configs/rk3288_defconfig b/configs/rk3288_defconfig
index e9e178100b..34c0705cfc 100644
--- a/configs/rk3288_defconfig
+++ b/configs/rk3288_defconfig
@@ -13,11 +13,15 @@ CONFIG_BOOTDELAY=0
 CONFIG_SYS_CONSOLE_INFO_QUIET=y
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_ANDROID_BOOTLOADER=y
+CONFIG_ANDROID_AVB=y
 CONFIG_SPL_STACK_R=y
 CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
+CONFIG_FASTBOOT_BUF_ADDR=0x800800
+CONFIG_FASTBOOT_BUF_SIZE=0x4000000
 # CONFIG_CMD_BOOTD is not set
+CONFIG_CMD_DTIMG=y
 # CONFIG_CMD_ELF is not set
 # CONFIG_CMD_IMI is not set
 # CONFIG_CMD_IMLS is not set
@@ -36,7 +40,7 @@ CONFIG_CMD_USB=y
 # CONFIG_CMD_MISC is not set
 CONFIG_CMD_PMIC=y
 CONFIG_CMD_REGULATOR=y
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 # CONFIG_SPL_EFI_PARTITION is not set
@@ -102,15 +106,14 @@ CONFIG_LCD=y
 CONFIG_USE_TINY_PRINTF=y
 CONFIG_CMD_DHRYSTONE=y
 CONFIG_ERRNO_STR=y
+CONFIG_OF_LIBFDT_OVERLAY=y
 # CONFIG_EFI_LOADER is not set
-CONFIG_TEST_ROCKCHIP=y
-CONFIG_OPTEE_ALWAYS_USE_SECURITY_PARTITION=y
-CONFIG_OPTEE_CLIENT=y
-CONFIG_OPTEE_V1=y
-CONFIG_CMD_MMC=y
-CONFIG_ANDROID_AVB=y
 CONFIG_AVB_LIBAVB=y
 CONFIG_AVB_LIBAVB_AB=y
 CONFIG_AVB_LIBAVB_ATX=y
 CONFIG_AVB_LIBAVB_USER=y
 CONFIG_RK_AVB_LIBAVB_USER=y
+CONFIG_OPTEE_CLIENT=y
+CONFIG_OPTEE_V1=y
+CONFIG_OPTEE_ALWAYS_USE_SECURITY_PARTITION=y
+CONFIG_TEST_ROCKCHIP=y
diff --git a/configs/rk3308-aarch32_defconfig b/configs/rk3308-aarch32_defconfig
index c1a2d8def6..ffa565e3d6 100644
--- a/configs/rk3308-aarch32_defconfig
+++ b/configs/rk3308-aarch32_defconfig
@@ -37,7 +37,6 @@ CONFIG_CMD_MMC=y
 # CONFIG_CMD_LED is not set
 # CONFIG_CMD_MISC is not set
 CONFIG_CMD_PMIC=y
-# CONFIG_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_OF_LIVE=y
@@ -56,6 +55,9 @@ CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
 CONFIG_POWER_FG_RK816=y
diff --git a/configs/rk3308_defconfig b/configs/rk3308_defconfig
index 5be3f455a3..84b02619d3 100644
--- a/configs/rk3308_defconfig
+++ b/configs/rk3308_defconfig
@@ -36,7 +36,6 @@ CONFIG_CMD_MMC=y
 # CONFIG_CMD_LED is not set
 # CONFIG_CMD_MISC is not set
 CONFIG_CMD_PMIC=y
-# CONFIG_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_OF_LIVE=y
@@ -55,6 +54,9 @@ CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
+CONFIG_DM_ETH=y
+CONFIG_ETH_DESIGNWARE=y
+CONFIG_GMAC_ROCKCHIP=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
 CONFIG_POWER_FG_RK816=y
diff --git a/configs/rk3326_defconfig b/configs/rk3326_defconfig
index ab40b9e0e4..698f4e50a5 100644
--- a/configs/rk3326_defconfig
+++ b/configs/rk3326_defconfig
@@ -52,7 +52,7 @@ CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -72,7 +72,6 @@ CONFIG_RK8XX_PWRKEY=y
 CONFIG_ADC_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
@@ -122,6 +121,8 @@ CONFIG_DRM_ROCKCHIP_RGB=y
 CONFIG_LCD=y
 CONFIG_USE_TINY_PRINTF=y
 CONFIG_SPL_TINY_MEMSET=y
+CONFIG_LZ4=y
+CONFIG_LZO=y
 CONFIG_ERRNO_STR=y
 CONFIG_OF_LIBFDT_OVERLAY=y
 # CONFIG_EFI_LOADER is not set
diff --git a/configs/rk3328_defconfig b/configs/rk3328_defconfig
index 998e53f9f9..8b01c1f96b 100644
--- a/configs/rk3328_defconfig
+++ b/configs/rk3328_defconfig
@@ -5,7 +5,7 @@ CONFIG_SPL_LIBGENERIC_SUPPORT=y
 CONFIG_SYS_MALLOC_F_LEN=0x2000
 CONFIG_SPL_FIT_GENERATOR="arch/arm/mach-rockchip/make_fit_atf.py"
 CONFIG_ROCKCHIP_RK3328=y
-CONFIG_ROCKCHIP_SPL_RESERVE_IRAM=0x0
+CONFIG_ROCKCHIP_SPL_RESERVE_IRAM=0x40000
 CONFIG_RKIMG_BOOTLOADER=y
 CONFIG_ROCKCHIP_VENDOR_PARTITION=y
 CONFIG_TPL_LIBCOMMON_SUPPORT=y
@@ -28,12 +28,11 @@ CONFIG_SPL_STACK_R=y
 CONFIG_SPL_ATF=y
 CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
 CONFIG_TPL_BOOTROM_SUPPORT=y
-CONFIG_TPL_DRIVERS_MISC_SUPPORT=y
 CONFIG_FASTBOOT_BUF_ADDR=0x800800
+CONFIG_FASTBOOT_BUF_SIZE=0x4000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
 # CONFIG_CMD_BDI is not set
-CONFIG_CMD_CONSOLE=y
 # CONFIG_CMD_BOOTD is not set
 CONFIG_CMD_BOOTZ=y
 # CONFIG_CMD_ELF is not set
@@ -81,7 +80,6 @@ CONFIG_MISC=y
 CONFIG_ROCKCHIP_EFUSE=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_PMIC=y
@@ -118,7 +116,9 @@ CONFIG_ROCKCHIP_DRM_TVE=y
 CONFIG_LCD=y
 # CONFIG_IRQ is not set
 CONFIG_USE_TINY_PRINTF=y
+CONFIG_PANIC_HANG=y
 CONFIG_SPL_TINY_MEMSET=y
+CONFIG_TPL_TINY_MEMSET=y
 CONFIG_ERRNO_STR=y
 # CONFIG_EFI_LOADER is not set
 CONFIG_AVB_LIBAVB=y
diff --git a/configs/rk3368_defconfig b/configs/rk3368_defconfig
index 67b7d03ae7..9dcdda9185 100644
--- a/configs/rk3368_defconfig
+++ b/configs/rk3368_defconfig
@@ -12,6 +12,7 @@ CONFIG_SYS_CONSOLE_INFO_QUIET=y
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_ARCH_EARLY_INIT_R=y
 CONFIG_ANDROID_BOOTLOADER=y
+CONFIG_ANDROID_AVB=y
 CONFIG_FASTBOOT_BUF_ADDR=0x800800
 CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
@@ -38,7 +39,6 @@ CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_SETEXPR is not set
 # CONFIG_CMD_NET is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_RKPARM_PARTITION=y
 CONFIG_OF_LIVE=y
@@ -55,7 +55,6 @@ CONFIG_GPIO_KEY=y
 CONFIG_RK_KEY=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_DM_FUEL_GAUGE=y
@@ -100,13 +99,12 @@ CONFIG_USE_TINY_PRINTF=y
 CONFIG_ERRNO_STR=y
 CONFIG_OF_LIBFDT_OVERLAY=y
 # CONFIG_EFI_LOADER is not set
-CONFIG_OPTEE_CLIENT=y
-CONFIG_OPTEE_V1=y
-CONFIG_OPTEE_ALWAYS_USE_SECURITY_PARTITION=y
-CONFIG_ANDROID_AVB=y
 CONFIG_AVB_LIBAVB=y
 CONFIG_AVB_LIBAVB_AB=y
 CONFIG_AVB_LIBAVB_ATX=y
 CONFIG_AVB_LIBAVB_USER=y
 CONFIG_RK_AVB_LIBAVB_USER=y
+CONFIG_OPTEE_CLIENT=y
+CONFIG_OPTEE_V1=y
+CONFIG_OPTEE_ALWAYS_USE_SECURITY_PARTITION=y
 CONFIG_TEST_ROCKCHIP=y
diff --git a/configs/rk3399_defconfig b/configs/rk3399_defconfig
index af958d7861..ae4d35572b 100755
--- a/configs/rk3399_defconfig
+++ b/configs/rk3399_defconfig
@@ -23,7 +23,7 @@ CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x10000
 CONFIG_SPL_ATF=y
 CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
 CONFIG_FASTBOOT_BUF_ADDR=0x00800800
-CONFIG_FASTBOOT_BUF_SIZE=0x08000000
+CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
 # CONFIG_CMD_BOOTD is not set
@@ -47,7 +47,7 @@ CONFIG_CMD_USB=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
@@ -76,7 +76,6 @@ CONFIG_MMC_SDHCI_ROCKCHIP=y
 CONFIG_DM_ETH=y
 CONFIG_ETH_DESIGNWARE=y
 CONFIG_GMAC_ROCKCHIP=y
-CONFIG_PHY=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_SPL_PINCTRL=y
diff --git a/configs/rk3399pro-npu_defconfig b/configs/rk3399pro-npu_defconfig
index 7b59efdf56..bcc3cd3703 100644
--- a/configs/rk3399pro-npu_defconfig
+++ b/configs/rk3399pro-npu_defconfig
@@ -53,10 +53,11 @@ CONFIG_ROCKCHIP_GPIO=y
 CONFIG_SYS_I2C_ROCKCHIP=y
 # CONFIG_MMC is not set
 CONFIG_PINCTRL=y
+CONFIG_REGULATOR_FAN53555=y
 CONFIG_REGULATOR_PWM=y
 CONFIG_RAM=y
 CONFIG_DM_RAMDISK=y
-CONFIG_RAMDISK_READONLY=y
+CONFIG_RAMDISK_RO=y
 CONFIG_DM_RESET=y
 CONFIG_BAUDRATE=1500000
 CONFIG_DEBUG_UART_BASE=0xff550000
diff --git a/configs/rk3399pro_defconfig b/configs/rk3399pro_defconfig
index 778f0964b5..95a3dc9559 100644
--- a/configs/rk3399pro_defconfig
+++ b/configs/rk3399pro_defconfig
@@ -23,7 +23,7 @@ CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x10000
 CONFIG_SPL_ATF=y
 CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y
 CONFIG_FASTBOOT_BUF_ADDR=0x00800800
-CONFIG_FASTBOOT_BUF_SIZE=0x08000000
+CONFIG_FASTBOOT_BUF_SIZE=0x04000000
 CONFIG_FASTBOOT_FLASH=y
 CONFIG_FASTBOOT_FLASH_MMC_DEV=0
 # CONFIG_CMD_BOOTD is not set
@@ -48,7 +48,7 @@ CONFIG_CMD_USB_MASS_STORAGE=y
 # CONFIG_CMD_ITEST is not set
 # CONFIG_CMD_SETEXPR is not set
 # CONFIG_CMD_MISC is not set
-# CONFIG_DOS_PARTITION is not set
+# CONFIG_SPL_DOS_PARTITION is not set
 # CONFIG_ISO_PARTITION is not set
 CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=64
 CONFIG_RKPARM_PARTITION=y
diff --git a/disk/part_rkparm.c b/disk/part_rkparm.c
index 156608cf8b..6d9221f6b6 100644
--- a/disk/part_rkparm.c
+++ b/disk/part_rkparm.c
@@ -277,7 +277,7 @@ static int part_get_info_rkparm(struct blk_desc *dev_desc, int idx,
 	}
 
 	info->start = p->start;
-	info->size = p->size << 9;
+	info->size = p->size;
 	info->blksz = dev_desc->blksz;
 
 	sprintf((char *)info->name, "%s", p->name);
diff --git a/drivers/clk/rockchip/clk_px30.c b/drivers/clk/rockchip/clk_px30.c
index b36f16bc3e..e3c73932f5 100644
--- a/drivers/clk/rockchip/clk_px30.c
+++ b/drivers/clk/rockchip/clk_px30.c
@@ -855,6 +855,7 @@ static ulong px30_bus_get_clk(struct px30_clk_priv *priv, ulong clk_id)
 		parent = priv->gpll_hz;
 		break;
 	case PCLK_BUS_PRE:
+	case PCLK_WDT_NS:
 		parent = px30_bus_get_clk(priv, ACLK_BUS_PRE);
 		con = readl(&cru->clksel_con[24]);
 		div = (con & BUS_PCLK_DIV_MASK) >> BUS_PCLK_DIV_SHIFT;
@@ -1054,6 +1055,50 @@ static ulong px30_i2s1_mclk_set_clk(struct px30_clk_priv *priv, ulong clk_id,
 
 	return px30_i2s1_mclk_get_clk(priv, clk_id);
 }
+
+static ulong px30_mac_set_clk(struct clk *clk, uint hz)
+{
+	struct px30_clk_priv *priv = dev_get_priv(clk->dev);
+	struct px30_cru *cru = priv->cru;
+	u32 con = readl(&cru->clksel_con[22]);
+	ulong pll_rate;
+	u8 div;
+
+	if ((con >> GMAC_PLL_SEL_SHIFT) & GMAC_PLL_SEL_CPLL)
+		pll_rate = px30_clk_get_pll_rate(priv, CPLL);
+	else if ((con >> GMAC_PLL_SEL_SHIFT) & GMAC_PLL_SEL_NPLL)
+		pll_rate = px30_clk_get_pll_rate(priv, NPLL);
+	else
+		pll_rate = priv->gpll_hz;
+
+	/*default set 50MHZ for gmac*/
+	if (!hz)
+		hz = 50000000;
+
+	div = DIV_ROUND_UP(pll_rate, hz) - 1;
+	assert(div < 32);
+	rk_clrsetreg(&cru->clksel_con[22], CLK_GMAC_DIV_MASK,
+		     div << CLK_GMAC_DIV_SHIFT);
+
+	return DIV_TO_RATE(pll_rate, div);
+}
+
+static int px30_mac_set_speed_clk(struct clk *clk, uint hz)
+{
+	struct px30_clk_priv *priv = dev_get_priv(clk->dev);
+	struct px30_cru *cru = priv->cru;
+
+	if (hz != 2500000 && hz != 25000000) {
+		debug("Unsupported mac speed:%d\n", hz);
+		return -EINVAL;
+	}
+
+	rk_clrsetreg(&cru->clksel_con[23], RMII_CLK_SEL_MASK,
+		     ((hz == 2500000) ? 0 : 1) << RMII_CLK_SEL_SHIFT);
+
+	return 0;
+}
+
 #endif
 
 static int px30_clk_get_gpll_rate(ulong *rate)
@@ -1202,6 +1247,7 @@ static ulong px30_clk_get_rate(struct clk *clk)
 	case ACLK_BUS_PRE:
 	case HCLK_BUS_PRE:
 	case PCLK_BUS_PRE:
+	case PCLK_WDT_NS:
 		rate = px30_bus_get_clk(priv, clk->id);
 		break;
 	case ACLK_PERI_PRE:
@@ -1293,6 +1339,13 @@ static ulong px30_clk_set_rate(struct clk *clk, ulong rate)
 	case SCLK_I2S1_OUT:
 		ret = px30_i2s1_mclk_set_clk(priv, clk->id, rate);
 		break;
+	case SCLK_GMAC:
+	case SCLK_GMAC_SRC:
+		ret = px30_mac_set_clk(clk, rate);
+		break;
+	case SCLK_GMAC_RMII:
+		ret = px30_mac_set_speed_clk(clk, rate);
+		break;
 #endif
 	default:
 		return -ENOENT;
@@ -1424,11 +1477,43 @@ static int px30_clk_set_phase(struct clk *clk, int degrees)
 	return ret;
 }
 
+#if CONFIG_IS_ENABLED(OF_CONTROL) && !CONFIG_IS_ENABLED(OF_PLATDATA)
+static int px30_gmac_set_parent(struct clk *clk, struct clk *parent)
+{
+	struct px30_clk_priv *priv = dev_get_priv(clk->dev);
+	struct px30_cru *cru = priv->cru;
+
+	if (parent->id == SCLK_GMAC_SRC) {
+		debug("%s: switching GAMC to SCLK_GMAC_SRC\n", __func__);
+		rk_clrsetreg(&cru->clksel_con[23], RMII_EXTCLK_SEL_MASK,
+			     RMII_EXTCLK_SEL_INT << RMII_EXTCLK_SEL_SHIFT);
+	} else {
+		debug("%s: switching GMAC to external clock\n", __func__);
+		rk_clrsetreg(&cru->clksel_con[23], RMII_EXTCLK_SEL_MASK,
+			     RMII_EXTCLK_SEL_EXT << RMII_EXTCLK_SEL_SHIFT);
+	}
+	return 0;
+}
+
+static int px30_clk_set_parent(struct clk *clk, struct clk *parent)
+{
+	switch (clk->id) {
+	case SCLK_GMAC:
+		return px30_gmac_set_parent(clk, parent);
+	default:
+		return -ENOENT;
+	}
+}
+#endif
+
 static struct clk_ops px30_clk_ops = {
 	.get_rate = px30_clk_get_rate,
 	.set_rate = px30_clk_set_rate,
 	.get_phase	= px30_clk_get_phase,
 	.set_phase	= px30_clk_set_phase,
+#if CONFIG_IS_ENABLED(OF_CONTROL) && !CONFIG_IS_ENABLED(OF_PLATDATA)
+	.set_parent	= px30_clk_set_parent,
+#endif
 };
 
 static int px30_clk_probe(struct udevice *dev)
diff --git a/drivers/clk/rockchip/clk_rk1808.c b/drivers/clk/rockchip/clk_rk1808.c
index 9639065fc4..10ff010438 100644
--- a/drivers/clk/rockchip/clk_rk1808.c
+++ b/drivers/clk/rockchip/clk_rk1808.c
@@ -564,6 +564,67 @@ static ulong rk1808_vop_set_clk(struct rk1808_clk_priv *priv,
 
 	return rk1808_vop_get_clk(priv, clk_id);
 }
+
+static ulong rk1808_mac_set_clk(struct clk *clk, uint hz)
+{
+	struct rk1808_clk_priv *priv = dev_get_priv(clk->dev);
+	struct rk1808_cru *cru = priv->cru;
+	u32 con = readl(&cru->clksel_con[26]);
+	ulong pll_rate;
+	u8 div;
+
+	if ((con >> GMAC_PLL_SEL_SHIFT) & GMAC_PLL_SEL_NPLL)
+		pll_rate = rockchip_pll_get_rate(&rk1808_pll_clks[NPLL],
+						 priv->cru, NPLL);
+	else if ((con >> GMAC_PLL_SEL_SHIFT) & GMAC_PLL_SEL_PPLL)
+		pll_rate = rockchip_pll_get_rate(&rk1808_pll_clks[PPLL],
+						 priv->cru, PPLL);
+	else
+		pll_rate = rockchip_pll_get_rate(&rk1808_pll_clks[CPLL],
+						 priv->cru, CPLL);
+
+	/*default set 50MHZ for gmac*/
+	if (!hz)
+		hz = 50000000;
+
+	div = DIV_ROUND_UP(pll_rate, hz) - 1;
+	assert(div < 32);
+	rk_clrsetreg(&cru->clksel_con[26], CLK_GMAC_DIV_MASK,
+		     div << CLK_GMAC_DIV_SHIFT);
+
+	return DIV_TO_RATE(pll_rate, div);
+}
+
+static int rk1808_mac_set_speed_clk(struct clk *clk, ulong clk_id, uint hz)
+{
+	struct rk1808_clk_priv *priv = dev_get_priv(clk->dev);
+	struct rk1808_cru *cru = priv->cru;
+	u32 sel;
+
+	switch (clk_id) {
+	case SCLK_GMAC_RGMII_SPEED:
+		if (hz == 125000000)
+			sel = 0;
+		else if (hz == 2500000)
+			sel = 2;
+		else
+			sel = 3;
+		rk_clrsetreg(&cru->clksel_con[27], RGMII_CLK_SEL_MASK,
+			     sel << RGMII_CLK_SEL_SHIFT);
+		break;
+	case SCLK_GMAC_RMII_SPEED:
+		if (hz == 2500000)
+			sel = 0;
+		else
+			sel = 1;
+		rk_clrsetreg(&cru->clksel_con[27], RMII_CLK_SEL_MASK,
+			     sel << RMII_CLK_SEL_SHIFT);
+		break;
+	default:
+		return -ENOENT;
+	}
+	return 0;
+}
 #endif
 
 static ulong rk1808_bus_get_clk(struct rk1808_clk_priv *priv, ulong clk_id)
@@ -583,6 +644,7 @@ static ulong rk1808_bus_get_clk(struct rk1808_clk_priv *priv, ulong clk_id)
 		parent = priv->gpll_hz;
 		break;
 	case LSCLK_BUS_PRE:
+	case PCLK_WDT:
 		con = readl(&cru->clksel_con[28]);
 		div = (con & LSCLK_BUS_DIV_CON_MASK) >> LSCLK_BUS_DIV_CON_SHIFT;
 		parent = priv->gpll_hz;
@@ -822,6 +884,7 @@ static ulong rk1808_clk_get_rate(struct clk *clk)
 	case HSCLK_BUS_PRE:
 	case MSCLK_BUS_PRE:
 	case LSCLK_BUS_PRE:
+	case PCLK_WDT:
 		rate = rk1808_bus_get_clk(priv, clk->id);
 		break;
 	case MSCLK_PERI:
@@ -914,6 +977,14 @@ static ulong rk1808_clk_set_rate(struct clk *clk, ulong rate)
 	case DCLK_VOPLITE:
 		ret = rk1808_vop_set_clk(priv, clk->id, rate);
 		break;
+	case SCLK_GMAC:
+	case SCLK_GMAC_SRC:
+		ret = rk1808_mac_set_clk(clk, rate);
+		break;
+	case SCLK_GMAC_RMII_SPEED:
+	case SCLK_GMAC_RGMII_SPEED:
+		ret = rk1808_mac_set_speed_clk(clk, clk->id, rate);
+		break;
 #endif
 	case HSCLK_BUS_PRE:
 	case MSCLK_BUS_PRE:
@@ -924,6 +995,8 @@ static ulong rk1808_clk_set_rate(struct clk *clk, ulong rate)
 	case LSCLK_PERI:
 		ret = rk1808_peri_set_clk(priv, clk->id, rate);
 		break;
+	case SCLK_32K_IOE:
+		return 0;
 	default:
 		return -ENOENT;
 	}
@@ -1060,11 +1133,45 @@ static int rk1808_clk_set_phase(struct clk *clk, int degrees)
 	return ret;
 }
 
+#if CONFIG_IS_ENABLED(OF_CONTROL) && !CONFIG_IS_ENABLED(OF_PLATDATA)
+static int rk1808_gmac_set_parent(struct clk *clk, struct clk *parent)
+{
+	struct rk1808_clk_priv *priv = dev_get_priv(clk->dev);
+	struct rk1808_cru *cru = priv->cru;
+
+	if (parent->id == SCLK_GMAC_SRC) {
+		debug("%s: switching GAMC to SCLK_GMAC_SRC\n", __func__);
+		rk_clrsetreg(&cru->clksel_con[27], RMII_EXTCLK_SEL_MASK,
+			     RMII_EXTCLK_SEL_INT << RMII_EXTCLK_SEL_SHIFT);
+	} else {
+		debug("%s: switching GMAC to external clock\n", __func__);
+		rk_clrsetreg(&cru->clksel_con[27], RMII_EXTCLK_SEL_MASK,
+			     RMII_EXTCLK_SEL_EXT << RMII_EXTCLK_SEL_SHIFT);
+	}
+	return 0;
+}
+
+static int rk1808_clk_set_parent(struct clk *clk, struct clk *parent)
+{
+	switch (clk->id) {
+	case SCLK_GMAC:
+		return rk1808_gmac_set_parent(clk, parent);
+	case SCLK_32K_IOE:
+		return 0;
+	default:
+		return -ENOENT;
+	}
+}
+#endif
+
 static struct clk_ops rk1808_clk_ops = {
 	.get_rate = rk1808_clk_get_rate,
 	.set_rate = rk1808_clk_set_rate,
 	.get_phase	= rk1808_clk_get_phase,
 	.set_phase	= rk1808_clk_set_phase,
+#if CONFIG_IS_ENABLED(OF_CONTROL) && !CONFIG_IS_ENABLED(OF_PLATDATA)
+	.set_parent	= rk1808_clk_set_parent,
+#endif
 };
 
 static int rk1808_clk_probe(struct udevice *dev)
diff --git a/drivers/clk/rockchip/clk_rk3128.c b/drivers/clk/rockchip/clk_rk3128.c
index 493a0a01c7..edfdcef1c4 100644
--- a/drivers/clk/rockchip/clk_rk3128.c
+++ b/drivers/clk/rockchip/clk_rk3128.c
@@ -237,6 +237,7 @@ static ulong rk3128_peri_get_clk(struct rk3128_clk_priv *priv, ulong clk_id)
 	case PCLK_I2C2:
 	case PCLK_I2C3:
 	case PCLK_PWM:
+	case PCLK_WDT:
 		con = readl(&cru->cru_clksel_con[10]);
 		div = (con & PCLK_PERI_DIV_MASK) >> PCLK_PERI_DIV_SHIFT;
 		parent = rk3128_peri_get_clk(priv, ACLK_PERI);
@@ -503,6 +504,7 @@ static ulong rk3128_clk_get_rate(struct clk *clk)
 	case PCLK_I2C2:
 	case PCLK_I2C3:
 	case PCLK_PWM:
+	case PCLK_WDT:
 		rate = rk3128_peri_get_clk(priv, clk->id);
 		break;
 	case ACLK_CPU:
diff --git a/drivers/clk/rockchip/clk_rk3288.c b/drivers/clk/rockchip/clk_rk3288.c
index f7536bac18..b42d36cbd0 100644
--- a/drivers/clk/rockchip/clk_rk3288.c
+++ b/drivers/clk/rockchip/clk_rk3288.c
@@ -148,6 +148,10 @@ enum {
 	CLK_CRYPTO_DIV_CON_SHIFT	= 6,
 	CLK_CRYPTO_DIV_CON_MASK		= GENMASK(7, 6),
 
+	/* CLKSEL33 */
+	PCLK_ALIVE_DIV_CON_SHIFT	= 8,
+	PCLK_ALIVE_DIV_CON_MASK		= 0x1f << PCLK_ALIVE_DIV_CON_SHIFT,
+
 	SOCSTS_DPLL_LOCK	= 1 << 5,
 	SOCSTS_APLL_LOCK	= 1 << 6,
 	SOCSTS_CPLL_LOCK	= 1 << 7,
@@ -865,6 +869,17 @@ static ulong rockchip_crypto_set_clk(struct rk3288_cru *cru,
 
 	return rockchip_crypto_get_clk(cru, gclk_rate);
 }
+
+static ulong rk3288_alive_get_clk(struct rk3288_cru *cru, uint gclk_rate)
+{
+	u32 div, con, parent;
+
+	con = readl(&cru->cru_clksel_con[33]);
+	div = (con & PCLK_ALIVE_DIV_CON_MASK) >>
+	      PCLK_ALIVE_DIV_CON_SHIFT;
+	parent = gclk_rate;
+	return DIV_TO_RATE(parent, div);
+}
 #endif
 
 static ulong rk3288_clk_get_rate(struct clk *clk)
@@ -914,6 +929,9 @@ static ulong rk3288_clk_get_rate(struct clk *clk)
 	case SCLK_CRYPTO:
 		new_rate = rockchip_crypto_get_clk(priv->cru, gclk_rate);
 		break;
+	case PCLK_WDT:
+		new_rate = rk3288_alive_get_clk(priv->cru, gclk_rate);
+		break;
 #endif
 	default:
 		return -ENOENT;
diff --git a/drivers/clk/rockchip/clk_rk3308.c b/drivers/clk/rockchip/clk_rk3308.c
index fa16d7449c..75c78eaa8a 100644
--- a/drivers/clk/rockchip/clk_rk3308.c
+++ b/drivers/clk/rockchip/clk_rk3308.c
@@ -206,6 +206,52 @@ static ulong rk3308_i2c_set_clk(struct clk *clk, uint hz)
 	return rk3308_i2c_get_clk(clk);
 }
 
+static ulong rk3308_mac_set_clk(struct clk *clk, uint hz)
+{
+	struct rk3308_clk_priv *priv = dev_get_priv(clk->dev);
+	struct rk3308_cru *cru = priv->cru;
+	u32 con = readl(&cru->clksel_con[43]);
+	ulong pll_rate;
+	u8 div;
+
+	if ((con >> MAC_PLL_SHIFT) & MAC_SEL_VPLL0)
+		pll_rate = rockchip_pll_get_rate(&rk3308_pll_clks[VPLL0],
+						 priv->cru, VPLL0);
+	else if ((con >> MAC_PLL_SHIFT) & MAC_SEL_VPLL1)
+		pll_rate = rockchip_pll_get_rate(&rk3308_pll_clks[VPLL1],
+						 priv->cru, VPLL1);
+	else
+		pll_rate = rockchip_pll_get_rate(&rk3308_pll_clks[DPLL],
+						 priv->cru, DPLL);
+
+	/*default set 50MHZ for gmac*/
+	if (!hz)
+		hz = 50000000;
+
+	div = DIV_ROUND_UP(pll_rate, hz) - 1;
+	assert(div < 32);
+	rk_clrsetreg(&cru->clksel_con[43], MAC_DIV_MASK,
+		     div << MAC_DIV_SHIFT);
+
+	return DIV_TO_RATE(pll_rate, div);
+}
+
+static int rk3308_mac_set_speed_clk(struct clk *clk, uint hz)
+{
+	struct rk3308_clk_priv *priv = dev_get_priv(clk->dev);
+	struct rk3308_cru *cru = priv->cru;
+
+	if (hz != 2500000 && hz != 25000000) {
+		debug("Unsupported mac speed:%d\n", hz);
+		return -EINVAL;
+	}
+
+	rk_clrsetreg(&cru->clksel_con[43], MAC_CLK_SPEED_SEL_MASK,
+		     ((hz == 2500000) ? 0 : 1) << MAC_CLK_SPEED_SEL_SHIFT);
+
+	return 0;
+}
+
 static ulong rk3308_mmc_get_clk(struct clk *clk)
 {
 	struct rk3308_clk_priv *priv = dev_get_priv(clk->dev);
@@ -530,6 +576,7 @@ static ulong rk3308_bus_get_clk(struct rk3308_clk_priv *priv, ulong clk_id)
 		div = (con & BUS_HCLK_DIV_MASK) >> BUS_HCLK_DIV_SHIFT;
 		break;
 	case PCLK_BUS:
+	case PCLK_WDT:
 		con = readl(&cru->clksel_con[6]);
 		div = (con & BUS_PCLK_DIV_MASK) >> BUS_PCLK_DIV_SHIFT;
 		break;
@@ -812,6 +859,7 @@ static ulong rk3308_clk_get_rate(struct clk *clk)
 	case ACLK_BUS:
 	case HCLK_BUS:
 	case PCLK_BUS:
+	case PCLK_WDT:
 		rate = rk3308_bus_get_clk(priv, clk->id);
 		break;
 	case ACLK_PERI:
@@ -867,6 +915,12 @@ static ulong rk3308_clk_set_rate(struct clk *clk, ulong rate)
 	case SCLK_I2C3:
 		ret = rk3308_i2c_set_clk(clk, rate);
 		break;
+	case SCLK_MAC:
+		ret = rk3308_mac_set_clk(clk, rate);
+		break;
+	case SCLK_MAC_RMII:
+		ret = rk3308_mac_set_speed_clk(clk, rate);
+		break;
 	case SCLK_SARADC:
 		ret = rk3308_saradc_set_clk(clk, rate);
 		break;
@@ -1033,11 +1087,46 @@ static int rk3308_clk_set_phase(struct clk *clk, int degrees)
 	return ret;
 }
 
+static int __maybe_unused rk3308_mac_set_parent(struct clk *clk, struct clk *parent)
+{
+	struct rk3308_clk_priv *priv = dev_get_priv(clk->dev);
+
+	/*
+	 * If the requested parent is in the same clock-controller and
+	 * the id is SCLK_MAC_SRC, switch to the internal clock.
+	 */
+	if (parent->id == SCLK_MAC_SRC) {
+		debug("%s: switching RMII to SCLK_MAC\n", __func__);
+		rk_clrreg(&priv->cru->clksel_con[43], BIT(14));
+	} else {
+		debug("%s: switching RMII to CLKIN\n", __func__);
+		rk_setreg(&priv->cru->clksel_con[43], BIT(14));
+	}
+
+	return 0;
+}
+
+static int __maybe_unused rk3308_clk_set_parent(struct clk *clk, struct clk *parent)
+{
+	switch (clk->id) {
+	case SCLK_MAC:
+		return rk3308_mac_set_parent(clk, parent);
+	default:
+		break;
+	}
+
+	debug("%s: unsupported clk %ld\n", __func__, clk->id);
+	return -ENOENT;
+}
+
 static struct clk_ops rk3308_clk_ops = {
 	.get_rate = rk3308_clk_get_rate,
 	.set_rate = rk3308_clk_set_rate,
 	.get_phase	= rk3308_clk_get_phase,
 	.set_phase	= rk3308_clk_set_phase,
+#if CONFIG_IS_ENABLED(OF_CONTROL) && !CONFIG_IS_ENABLED(OF_PLATDATA)
+	.set_parent = rk3308_clk_set_parent,
+#endif
 };
 
 static void rk3308_clk_init(struct udevice *dev)
diff --git a/drivers/clk/rockchip/clk_rk3368.c b/drivers/clk/rockchip/clk_rk3368.c
index a3419b7945..1ed2bea3f4 100644
--- a/drivers/clk/rockchip/clk_rk3368.c
+++ b/drivers/clk/rockchip/clk_rk3368.c
@@ -774,6 +774,18 @@ static ulong rk3368_vop_set_clk(struct rk3368_cru *cru, int clk_id, uint hz)
 
 	return 0;
 }
+
+static ulong rk3368_alive_get_clk(struct rk3368_clk_priv *priv)
+{
+	struct rk3368_cru *cru = priv->cru;
+	u32 div, con, parent;
+
+	con = readl(&cru->clksel_con[10]);
+	div = (con & PCLK_ALIVE_DIV_CON_MASK) >>
+	      PCLK_ALIVE_DIV_CON_SHIFT;
+	parent = GPLL_HZ;
+	return DIV_TO_RATE(parent, div);
+}
 #endif
 
 static ulong rk3368_armclk_set_clk(struct rk3368_clk_priv *priv,
@@ -893,6 +905,9 @@ static ulong rk3368_clk_get_rate(struct clk *clk)
 	case DCLK_VOP:
 		rate =  rk3368_vop_get_clk(priv->cru, clk->id);
 		break;
+	case PCLK_WDT:
+		rate = rk3368_alive_get_clk(priv);
+		break;
 #endif
 	default:
 		return -ENOENT;
diff --git a/drivers/clk/rockchip/clk_rk3399.c b/drivers/clk/rockchip/clk_rk3399.c
index 814f43772e..f11fe3926b 100644
--- a/drivers/clk/rockchip/clk_rk3399.c
+++ b/drivers/clk/rockchip/clk_rk3399.c
@@ -252,6 +252,10 @@ enum {
 	DCLK_VOP_DIV_CON_MASK           = 0xff,
 	DCLK_VOP_DIV_CON_SHIFT          = 0,
 
+	/* CLKSEL_CON57 */
+	PCLK_ALIVE_DIV_CON_SHIFT	= 0,
+	PCLK_ALIVE_DIV_CON_MASK		= 0x1f << PCLK_ALIVE_DIV_CON_SHIFT,
+
 	/* CLKSEL_CON58 */
 	CLK_SPI_PLL_SEL_WIDTH = 1,
 	CLK_SPI_PLL_SEL_MASK = ((1 < CLK_SPI_PLL_SEL_WIDTH) - 1),
@@ -1117,6 +1121,17 @@ static ulong rk3399_peri_get_clk(struct rk3399_clk_priv *priv, ulong clk_id)
 	return DIV_TO_RATE(parent, div);
 }
 
+static ulong rk3399_alive_get_clk(struct rk3399_clk_priv *priv)
+{
+	struct rk3399_cru *cru = priv->cru;
+	u32 div, con, parent;
+
+	con = readl(&cru->clksel_con[57]);
+	div = (con & PCLK_ALIVE_DIV_CON_MASK) >>
+	      PCLK_ALIVE_DIV_CON_SHIFT;
+	parent = GPLL_HZ;
+	return DIV_TO_RATE(parent, div);
+}
 #endif
 
 static ulong rk3399_clk_get_rate(struct clk *clk)
@@ -1184,6 +1199,10 @@ static ulong rk3399_clk_get_rate(struct clk *clk)
 	case PCLK_PERILP1:
 		rate = rk3399_peri_get_clk(priv, clk->id);
 		break;
+	case PCLK_ALIVE:
+	case PCLK_WDT:
+		rate = rk3399_alive_get_clk(priv);
+		break;
 #endif
 	default:
 		return -ENOENT;
@@ -1620,6 +1639,7 @@ static ulong rk3399_pmuclk_get_rate(struct clk *clk)
 
 	switch (clk->id) {
 	case PCLK_RKPWM_PMU:
+	case PCLK_WDT_M0_PMU:
 		rate = rk3399_pwm_get_clk(priv->pmucru);
 		break;
 	case SCLK_I2C0_PMU:
diff --git a/drivers/cpu/Kconfig b/drivers/cpu/Kconfig
index 0d1424d38e..6dfced4f4f 100644
--- a/drivers/cpu/Kconfig
+++ b/drivers/cpu/Kconfig
@@ -6,3 +6,15 @@ config CPU
 	  multiple CPUs, then normally have to be set up in U-Boot so that
 	  they can work correctly in the OS. This provides a framework for
 	  finding out information about available CPUs and making changes.
+
+config AMP
+	bool "Enable AMP drivers using Driver Model"
+	help
+	  This support Asymmetric Multi-Processing, cpus can run on different
+	  firmware.
+
+config ROCKCHIP_AMP
+	bool "Enable Rockchip AMP driver"
+	depends on AMP && ROCKCHIP_SMCCC && RKIMG_BOOTLOADER
+	help
+	  This enable Rockchip AMP driver support.
diff --git a/drivers/cpu/Makefile b/drivers/cpu/Makefile
index db515f6f17..d50912ffe5 100644
--- a/drivers/cpu/Makefile
+++ b/drivers/cpu/Makefile
@@ -5,5 +5,7 @@
 # SPDX-License-Identifier:      GPL-2.0+
 #
 obj-$(CONFIG_CPU) += cpu-uclass.o
+obj-$(CONFIG_AMP) += amp-uclass.o
 
 obj-$(CONFIG_ARCH_BMIPS) += bmips_cpu.o
+obj-$(CONFIG_ROCKCHIP_AMP) += rockchip_amp.o
diff --git a/drivers/cpu/amp-uclass.c b/drivers/cpu/amp-uclass.c
new file mode 100644
index 0000000000..7d52722a2d
--- /dev/null
+++ b/drivers/cpu/amp-uclass.c
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Fuzhou Rockchip Electronics Co., Ltd
+ */
+
+#include <common.h>
+#include <amp.h>
+#include <dm.h>
+#include <dm/lists.h>
+
+int amp_cpu_on(u32 cpu)
+{
+	struct dm_amp_uclass_platdata *uc_pdata;
+	const struct dm_amp_ops *ops;
+	struct udevice *dev;
+	struct uclass *uc;
+	int ret;
+
+	ret = uclass_get(UCLASS_AMP, &uc);
+	if (ret)
+		return ret;
+
+	for (uclass_first_device(UCLASS_AMP, &dev);
+	     dev;
+	     uclass_next_device(&dev)) {
+		uc_pdata = dev_get_uclass_platdata(dev);
+		if (!uc_pdata || uc_pdata->cpu != cpu)
+			continue;
+
+		ops = dev_get_driver_ops(dev);
+		if (!ops || !ops->cpu_on)
+			return -ENOSYS;
+
+		return ops->cpu_on(dev);
+	}
+
+	return -ENODEV;
+}
+
+int amp_cpus_on(void)
+{
+	const struct dm_amp_ops *ops;
+	struct udevice *dev;
+	struct uclass *uc;
+	int ret;
+
+	ret = uclass_get(UCLASS_AMP, &uc);
+	if (ret)
+		return ret;
+
+	for (uclass_first_device(UCLASS_AMP, &dev);
+	     dev;
+	     uclass_next_device(&dev)) {
+		ops = dev_get_driver_ops(dev);
+		if (!ops || !ops->cpu_on)
+			continue;
+		ret = ops->cpu_on(dev);
+	}
+
+	return ret;
+}
+
+int amp_bind_children(struct udevice *dev, const char *drv_name)
+{
+	const char *name;
+	ofnode node;
+	int ret;
+
+	dev_for_each_subnode(node, dev) {
+		/*
+		 * If this node has "compatible" property, this is not
+		 * a amp subnode, but a normal device. skip.
+		 */
+		ofnode_get_property(node, "compatible", &ret);
+		if (ret >= 0)
+			continue;
+
+		if (ret != -FDT_ERR_NOTFOUND)
+			return ret;
+
+		name = ofnode_get_name(node);
+		if (!name)
+			return -EINVAL;
+		ret = device_bind_driver_to_node(dev, drv_name, name,
+						 node, NULL);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int amp_pre_probe(struct udevice *dev)
+{
+	struct dm_amp_uclass_platdata *uc_pdata;
+
+	uc_pdata = dev_get_uclass_platdata(dev);
+	if (!uc_pdata)
+		return -ENXIO;
+
+	uc_pdata->desc = dev_read_string(dev, "description");
+	uc_pdata->partition = dev_read_string(dev, "partition");
+	uc_pdata->cpu = dev_read_u32_default(dev, "cpu", -ENODATA);
+#ifdef CONFIG_ARM64
+	uc_pdata->aarch = dev_read_u32_default(dev, "aarch", 64);
+#else
+	uc_pdata->aarch = dev_read_u32_default(dev, "aarch", 32);
+#endif
+	uc_pdata->load = dev_read_u32_default(dev, "load", -ENODATA);
+	uc_pdata->entry = dev_read_u32_default(dev, "entry", -ENODATA);
+
+	dev_read_u32_array(dev, "memory",
+			   uc_pdata->reserved_mem,
+			   ARRAY_SIZE(uc_pdata->reserved_mem));
+
+	if (!uc_pdata->desc || !uc_pdata->partition ||
+	    uc_pdata->cpu == -ENODATA || uc_pdata->load == -ENODATA ||
+	    uc_pdata->entry == -ENODATA || !uc_pdata->reserved_mem[0] ||
+	    !uc_pdata->reserved_mem[1] ||
+	    (uc_pdata->aarch != 64 && uc_pdata->aarch != 32)) {
+		printf("AMP: \"%s\" is not complete\n", dev->name);
+		return -EINVAL;
+	}
+
+#ifdef DEBUG
+	printf("[%s]:\n", dev_read_name(dev));
+	printf("    descrption: %s\n", uc_pdata->desc);
+	printf("     partition: %s\n", uc_pdata->partition);
+	printf("           cpu: 0x%x\n", uc_pdata->cpu);
+	printf("         aarch: %d\n", uc_pdata->aarch);
+	printf("          load: 0x%08x\n", uc_pdata->load);
+	printf("         entry: 0x%08x\n", uc_pdata->entry);
+	printf("  reserved_mem: 0x%08x - 0x%08x\n\n",
+	       uc_pdata->reserved_mem[0],
+	       uc_pdata->reserved_mem[0] + uc_pdata->reserved_mem[1]);
+#endif
+
+	return 0;
+}
+
+UCLASS_DRIVER(amp) = {
+	.id		= UCLASS_AMP,
+	.name		= "amp",
+	.pre_probe	= amp_pre_probe,
+	.per_device_platdata_auto_alloc_size =
+			sizeof(struct dm_amp_uclass_platdata),
+};
+
+#ifdef DEBUG
+static int do_amp_cpus_on(cmd_tbl_t *cmdtp, int flag,
+			  int argc, char *const argv[])
+{
+	amp_cpus_on();
+	return 0;
+}
+
+U_BOOT_CMD(
+	amp_cpus_on, 1, 1, do_amp_cpus_on,
+	"Brought up all amp cpus",
+	""
+);
+#endif
diff --git a/drivers/cpu/rockchip_amp.c b/drivers/cpu/rockchip_amp.c
new file mode 100644
index 0000000000..9408c8c1b6
--- /dev/null
+++ b/drivers/cpu/rockchip_amp.c
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Fuzhou Rockchip Electronics Co., Ltd
+ */
+#include <common.h>
+#include <amp.h>
+#include <boot_rkimg.h>
+#include <bidram.h>
+#include <dm.h>
+#include <sysmem.h>
+#include <asm/arch/rockchip_smccc.h>
+
+#define AMP_I(fmt, args...)	printf("AMP: "fmt, ##args)
+#define AMP_E(fmt, args...)	printf("AMP Error: "fmt, ##args)
+
+/*
+ * An example for amps dts node configure:
+ *
+ * amps {
+ *	compatible = "uboot,rockchip-amp";
+ *	status = "okay";
+ *
+ *	amp@0 {
+ *		description  = "mcu-os1";
+ *		partition    = "mcu1";
+ *		cpu          = <0x1>;		// this is mpidr!
+ *		load         = <0x800000>;
+ *		entry        = <0x800000>;
+ *		memory       = <0x800000 0x400000>;
+ *	};
+ *
+ *	amp@1 {
+ *		......
+ *	};
+ *
+ *	......
+ * };
+ *
+ * U-Boot loads "mcu-os1" firmware to "0x800000" address from partiton
+ * "mcu1" for cpu[1], the cpu[1] entry address is 0x800000. And
+ * U-Boot reserve memory from 0x800000 with 0x400000 size in order
+ * to make it invisible for kernel.
+ *
+ * Please use rockchip tool "mkkrnlimg" to pack firmware binary, example:
+ * ./scripts/mkkrnlimg mcu-os1.bin mcu-os1.img
+ */
+
+static int rockchip_amp_cpu_on(struct udevice *dev)
+{
+	struct dm_amp_uclass_platdata *uc_pdata;
+	struct blk_desc *dev_desc;
+	disk_partition_t part_info;
+	int ret, size;
+
+	uc_pdata = dev_get_uclass_platdata(dev);
+	if (!uc_pdata)
+		return -ENXIO;
+
+	dev_desc = rockchip_get_bootdev();
+	if (!dev_desc)
+		return -EEXIST;
+
+	ret = part_get_info_by_name(dev_desc, uc_pdata->partition, &part_info);
+	if (ret < 0) {
+		AMP_E("\"%s\" find partition \"%s\" failed\n",
+		      uc_pdata->desc, uc_pdata->partition);
+		return ret;
+	}
+
+	ret = bidram_reserve_by_name(uc_pdata->partition,
+				     uc_pdata->reserved_mem[0],
+				     uc_pdata->reserved_mem[1]);
+	if (ret) {
+		AMP_E("Reserve \"%s\" region at 0x%08x - 0x%08x failed, ret=%d\n",
+		      uc_pdata->desc, uc_pdata->reserved_mem[0],
+		      uc_pdata->reserved_mem[0] + uc_pdata->reserved_mem[1], ret);
+		return -ENOMEM;
+	}
+
+	size = read_rockchip_image(dev_desc, &part_info,
+				   (void *)(ulong)uc_pdata->load);
+	if (size < 0) {
+		AMP_E("\"%s\" load at 0x%08x failed\n",
+		      uc_pdata->desc, uc_pdata->load);
+		return size;
+	}
+
+	flush_dcache_range(uc_pdata->load,
+			   uc_pdata->load + ALIGN(size, ARCH_DMA_MINALIGN));
+
+	AMP_I("Brought up cpu[%x] on \"%s\" entry 0x%08x ...",
+	      uc_pdata->cpu, uc_pdata->desc, uc_pdata->entry);
+
+	ret = psci_cpu_on(uc_pdata->cpu, uc_pdata->entry);
+	if (ret) {
+		printf("failed\n");
+		return ret;
+	}
+	printf("OK\n");
+
+	return 0;
+}
+
+static const struct dm_amp_ops rockchip_amp_ops = {
+	.cpu_on = rockchip_amp_cpu_on,
+};
+
+U_BOOT_DRIVER(rockchip_amp) = {
+	.name	   = "rockchip_amp",
+	.id	   = UCLASS_AMP,
+	.ops	   = &rockchip_amp_ops,
+};
+
+/* AMP bus driver as all amp parent */
+static int rockchip_amp_bus_bind(struct udevice *dev)
+{
+	return amp_bind_children(dev, "rockchip_amp");
+}
+
+static const struct udevice_id rockchip_amp_bus_match[] = {
+	{ .compatible = "uboot,rockchip-amp", },
+	{},
+};
+
+U_BOOT_DRIVER(rockchip_amp_bus) = {
+	.name	   = "rockchip_amp_bus",
+	.id	   = UCLASS_SIMPLE_BUS,
+	.of_match  = rockchip_amp_bus_match,
+	.bind	   = rockchip_amp_bus_bind,
+};
diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
index 7d48cfe526..e49f23c2d2 100644
--- a/drivers/input/Kconfig
+++ b/drivers/input/Kconfig
@@ -47,7 +47,7 @@ config I8042_KEYB
 
 config RK8XX_PWRKEY
 	bool "Enable RK805/816/817 pwrkey support"
-	depends on DM_KEY && PMIC_RK8XX
+	depends on DM_KEY && PMIC_RK8XX && IRQ
 	help
 	  This adds a driver for the RK805/816/817 pwrkey support.
 
diff --git a/drivers/input/adc_key.c b/drivers/input/adc_key.c
index 65645d01bc..d3d7df911c 100644
--- a/drivers/input/adc_key.c
+++ b/drivers/input/adc_key.c
@@ -4,92 +4,77 @@
  * SPDX-License-Identifier:     GPL-2.0+
  */
 
-#include <dm.h>
-#include <dm/read.h>
-#include <adc.h>
 #include <common.h>
-#include <console.h>
-#include <errno.h>
-#include <fdtdec.h>
-#include <malloc.h>
+#include <dm.h>
 #include <key.h>
-#include <linux/input.h>
 
-static int adc_keys_ofdata_to_platdata(struct udevice *dev)
+static int adc_key_ofdata_to_platdata(struct udevice *dev)
 {
-	struct input_key *key;
-	u32 adc_channels[2], microvolt;
+	struct dm_key_uclass_platdata *uc_key;
+	u32 chn[2], mV;
 	int vref, ret;
-	ofnode node;
 
-	/* Get vref */
-	vref = dev_read_u32_default(dev, "keyup-threshold-microvolt", -1);
-	if (vref < 0) {
-		printf("failed to read 'keyup-threshold-microvolt', ret=%d\n",
-		       vref);
-		return -EINVAL;
-	}
+	uc_key = dev_get_uclass_platdata(dev);
+	if (!uc_key)
+		return -ENXIO;
 
-	/* Get IO channel */
-	ret = dev_read_u32_array(dev, "io-channels", adc_channels, 2);
+	uc_key->type = ADC_KEY;
+	uc_key->name = dev_read_string(dev, "label");
+	ret = dev_read_u32_array(dev_get_parent(dev),
+				 "io-channels", chn, ARRAY_SIZE(chn));
 	if (ret) {
-		printf("failed to read 'io-channels', ret=%d\n", ret);
+		printf("%s: read 'io-channels' failed, ret=%d\n",
+		       uc_key->name, ret);
 		return -EINVAL;
 	}
 
-	/* Parse every adc key data */
-	dev_for_each_subnode(node, dev) {
-		key = calloc(1, sizeof(struct input_key));
-		if (!key)
-			return -ENOMEM;
-
-		key->parent = dev;
-		key->type = ADC_KEY;
-		key->vref = vref;
-		key->channel = adc_channels[1];
-		key->name = ofnode_read_string(node, "label");
-		ret = ofnode_read_u32(node, "linux,code", &key->code);
-		if (ret) {
-			printf("%s: failed to read 'linux,code', ret=%d\n",
-			       key->name, ret);
-			free(key);
-			continue;
-		}
-
-		ret = ofnode_read_u32(node, "press-threshold-microvolt",
-				      &microvolt);
-		if (ret) {
-			printf("%s: failed to read 'press-threshold-microvolt', ret=%d\n",
-			       key->name, ret);
-			free(key);
-			continue;
-		}
+	vref = dev_read_u32_default(dev_get_parent(dev),
+				    "keyup-threshold-microvolt", -ENODATA);
+	if (vref < 0) {
+		printf("%s: read 'keyup-threshold-microvolt' failed, ret=%d\n",
+		       uc_key->name, vref);
+		return -EINVAL;
+	}
 
-		/* Convert microvolt to adc value */
-		key->adcval = microvolt / (key->vref / 1024);
-		key_add(key);
+	uc_key->code = dev_read_u32_default(dev, "linux,code", -ENODATA);
+	if (uc_key->code < 0) {
+		printf("%s: read 'linux,code' failed\n", uc_key->name);
+		return -EINVAL;
+	}
 
-		debug("%s: name=%s: code=%d, vref=%d, channel=%d, microvolt=%d, adcval=%d\n",
-		      __func__, key->name, key->code, key->vref,
-		      key->channel, microvolt, key->adcval);
+	mV = dev_read_u32_default(dev, "press-threshold-microvolt", -ENODATA);
+	if (mV < 0) {
+		printf("%s: read 'press-threshold-microvolt' failed\n",
+		       uc_key->name);
+		return -EINVAL;
 	}
 
+	uc_key->channel = chn[1];
+	uc_key->adcval = mV / (vref / 1024);
+
 	return 0;
 }
 
-static const struct dm_key_ops key_ops = {
-	.name = "adc-keys",
+U_BOOT_DRIVER(adc_key) = {
+	.name   = "adc_key",
+	.id     = UCLASS_KEY,
+	.ofdata_to_platdata = adc_key_ofdata_to_platdata,
 };
 
-static const struct udevice_id adc_keys_ids[] = {
+/* Key Bus */
+static int adc_key_bus_bind(struct udevice *dev)
+{
+	return key_bind_children(dev, "adc_key");
+}
+
+static const struct udevice_id adc_key_bus_match[] = {
 	{ .compatible = "adc-keys" },
 	{ },
 };
 
-U_BOOT_DRIVER(adc_keys) = {
-	.name   = "adc-keys",
-	.id     = UCLASS_KEY,
-	.ops	= &key_ops,
-	.of_match = adc_keys_ids,
-	.ofdata_to_platdata = adc_keys_ofdata_to_platdata,
+U_BOOT_DRIVER(adc_key_bus) = {
+	.name	   = "adc_key_bus",
+	.id	   = UCLASS_SIMPLE_BUS,
+	.of_match  = adc_key_bus_match,
+	.bind	   = adc_key_bus_bind,
 };
diff --git a/drivers/input/gpio_key.c b/drivers/input/gpio_key.c
index 34db0d868d..053c159080 100644
--- a/drivers/input/gpio_key.c
+++ b/drivers/input/gpio_key.c
@@ -4,119 +4,55 @@
  * SPDX-License-Identifier:     GPL-2.0+
  */
 
-#include <dm.h>
-#include <adc.h>
 #include <common.h>
-#include <console.h>
 #include <dm.h>
-#include <errno.h>
-#include <fdtdec.h>
-#include <malloc.h>
 #include <key.h>
-#include <linux/input.h>
-#include <errno.h>
-#include <dm/read.h>
-#include <irq-generic.h>
-#include <irq-platform.h>
-
-static void gpio_irq_handler(int irq, void *data)
-{
-	struct input_key *key = data;
-
-	if (key->irq != irq)
-		return;
-
-	/* up event */
-	if (irq_get_gpio_level(irq)) {
-		key->up_t = key_timer(0);
-		debug("%s: key down: %llu ms\n", key->name, key->down_t);
-	/* down event */
-	} else {
-		key->down_t = key_timer(0);
-		debug("%s: key up: %llu ms\n", key->name, key->up_t);
-	}
-	/* Must delay */
-	mdelay(10);
-	irq_revert_irq_type(irq);
-}
 
 static int gpio_key_ofdata_to_platdata(struct udevice *dev)
 {
-	struct input_key *key;
-	u32 gpios[2];
-	ofnode node;
-	int irq, ret;
-
-	dev_for_each_subnode(node, dev) {
-		key = calloc(1, sizeof(struct input_key));
-		if (!key)
-			return -ENOMEM;
-
-		key->parent = dev;
-		key->type = GPIO_KEY;
-		key->name = ofnode_read_string(node, "label");
-		ret = ofnode_read_u32(node, "linux,code", &key->code);
-		if (ret) {
-			printf("%s: failed read 'linux,code', ret=%d\n",
-			       key->name, ret);
-			free(key);
-			continue;
-		}
-
-		/* Only register power key as interrupt */
-		if (key->code == KEY_POWER) {
-			ret = ofnode_read_u32_array(node, "gpios", gpios, 2);
-			if (ret) {
-				printf("%s: failed to read 'gpios', ret=%d\n",
-				       key->name, ret);
-				free(key);
-				continue;
-			}
-
-			/* Must register as interrupt, be able to wakeup system */
-			irq = phandle_gpio_to_irq(gpios[0], gpios[1]);
-			if (irq < 0) {
-				printf("%s: failed to request irq, ret=%d\n",
-				       key->name, irq);
-				free(key);
-				continue;
-			}
-			key->irq = irq;
-			key_add(key);
-			irq_install_handler(irq, gpio_irq_handler, key);
-			irq_set_irq_type(irq, IRQ_TYPE_EDGE_FALLING);
-			irq_handler_enable(irq);
-		} else {
-			ret = gpio_request_by_name_nodev(node, "gpios", 0,
-							 &key->gpio,
-							 GPIOD_IS_IN);
-			if (ret) {
-				printf("%s: failed to request gpio, ret=%d\n",
-				       key->name, ret);
-			}
-
-			key_add(key);
-		}
+	struct dm_key_uclass_platdata *uc_key;
+
+	uc_key = dev_get_uclass_platdata(dev);
+	if (!uc_key)
+		return -ENXIO;
+
+	uc_key->type = GPIO_KEY;
+	uc_key->name = dev_read_string(dev, "label");
+	uc_key->code = dev_read_u32_default(dev, "linux,code", -ENODATA);
+	if (uc_key->code < 0) {
+		printf("%s: read 'linux,code' failed\n", uc_key->name);
+		return -EINVAL;
+	}
 
-		debug("%s: name=%s: code=%d\n", __func__, key->name, key->code);
+	if (dev_read_u32_array(dev, "gpios",
+			       uc_key->gpios, ARRAY_SIZE(uc_key->gpios))) {
+		printf("%s: read 'gpios' failed\n", uc_key->name);
+		return -EINVAL;
 	}
 
 	return 0;
 }
 
-static const struct dm_key_ops key_ops = {
-	.name = "gpio-keys",
+U_BOOT_DRIVER(gpio_key) = {
+	.name   = "gpio_key",
+	.id     = UCLASS_KEY,
+	.ofdata_to_platdata = gpio_key_ofdata_to_platdata,
 };
 
-static const struct udevice_id gpio_key_ids[] = {
+/* Key Bus */
+static int gpio_key_bus_bind(struct udevice *dev)
+{
+	return key_bind_children(dev, "gpio_key");
+}
+
+static const struct udevice_id gpio_key_bus_match[] = {
 	{ .compatible = "gpio-keys" },
 	{ },
 };
 
-U_BOOT_DRIVER(gpio_keys) = {
-	.name   = "gpio-keys",
-	.id     = UCLASS_KEY,
-	.of_match = gpio_key_ids,
-	.ops	= &key_ops,
-	.ofdata_to_platdata = gpio_key_ofdata_to_platdata,
+U_BOOT_DRIVER(gpio_key_bus) = {
+	.name	   = "gpio_key_bus",
+	.id	   = UCLASS_SIMPLE_BUS,
+	.of_match  = gpio_key_bus_match,
+	.bind	   = gpio_key_bus_bind,
 };
diff --git a/drivers/input/key-uclass.c b/drivers/input/key-uclass.c
index 7f369665b2..1a370a5fa9 100644
--- a/drivers/input/key-uclass.c
+++ b/drivers/input/key-uclass.c
@@ -8,15 +8,12 @@
 #include <adc.h>
 #include <dm.h>
 #include <key.h>
+#include <dm/lists.h>
+#include <irq-generic.h>
 
-static LIST_HEAD(key_list);
-
-const char *evt_name[] = {
-	"Not down",
-	"Down",
-	"Long down",
-	"Not exist",
-};
+#define KEY_WARN(fmt, args...)	printf("Key Warn: "fmt, ##args)
+#define KEY_ERR(fmt, args...)	printf("Key Error: "fmt, ##args)
+#define KEY_DBG(fmt, args...)	 debug("Key Debug: "fmt, ##args)
 
 static inline uint64_t arch_counter_get_cntpct(void)
 {
@@ -26,7 +23,7 @@ static inline uint64_t arch_counter_get_cntpct(void)
 #ifdef CONFIG_ARM64
 	asm volatile("mrs %0, cntpct_el0" : "=r" (cval));
 #else
-	asm volatile ("mrrc p15, 0, %Q0, %R0, c14" : "=r" (cval));
+	asm volatile("mrrc p15, 0, %Q0, %R0, c14" : "=r" (cval));
 #endif
 	return cval;
 }
@@ -39,197 +36,263 @@ uint64_t key_timer(uint64_t base)
 	return (cntpct > base) ? (cntpct - base) : 0;
 }
 
-/*
- * What's simple and complex event mean?
- *
- * simple event:   key press down or none;
- * complext event: key press down, long down or none;
- */
-static int key_read_adc_simple_event(struct input_key *key, unsigned int adcval)
+static int key_adc_event(struct dm_key_uclass_platdata *uc_key, int adcval)
 {
-	int max, min, margin = 30;
-	int keyval;
-
-	/* Get min, max */
-	max = key->adcval + margin;
-	if (key->adcval > margin)
-		min = key->adcval - margin;
-	else
-		min = 0;
-
-	debug("%s: '%s' configure adc=%d: range[%d~%d]; hw adcval=%d\n",
-	      __func__, key->name, key->adcval, min, max, adcval);
-
-	/* Check */
-	if ((adcval <= max) && (adcval >= min)) {
-		keyval = KEY_PRESS_DOWN;
-		debug("%s key pressed..\n", key->name);
-	} else {
-		keyval = KEY_PRESS_NONE;
-	}
-
-	return keyval;
+	return (adcval <= uc_key->max && adcval >= uc_key->min) ?
+		KEY_PRESS_DOWN : KEY_PRESS_NONE;
 }
 
-static int key_read_gpio_simple_event(struct input_key *key)
+static int key_gpio_event(struct dm_key_uclass_platdata *uc_key)
 {
-	if (!dm_gpio_is_valid(&key->gpio)) {
-		printf("%s: invalid gpio\n", key->name);
+	if (!dm_gpio_is_valid(&uc_key->gpio)) {
+		KEY_ERR("'%s' Invalid gpio\n", uc_key->name);
 		return KEY_PRESS_NONE;
 	}
 
-	return dm_gpio_get_value(&key->gpio) ? KEY_PRESS_DOWN : KEY_PRESS_NONE;
+	return dm_gpio_get_value(&uc_key->gpio) ?
+	       KEY_PRESS_DOWN : KEY_PRESS_NONE;
 }
 
-static int key_read_gpio_complex_event(struct input_key *key)
+static int key_gpio_interrupt_event(struct dm_key_uclass_platdata *uc_key)
 {
-	int keyval;
+	int event;
 
 	debug("%s: %s: up=%llu, down=%llu, delta=%llu\n",
-	      __func__, key->name, key->up_t, key->down_t,
-	      key->up_t - key->down_t);
+	      __func__, uc_key->name, uc_key->rise_ms, uc_key->fall_ms,
+	      uc_key->rise_ms - uc_key->fall_ms);
 
 	/* Possible this is machine power-on long pressed, so ignore this */
-	if (key->down_t == 0 && key->up_t != 0) {
-		keyval = KEY_PRESS_NONE;
+	if (uc_key->fall_ms == 0 && uc_key->rise_ms != 0) {
+		event = KEY_PRESS_NONE;
 		goto out;
 	}
 
-	if ((key->up_t > key->down_t) &&
-	    (key->up_t - key->down_t) >= KEY_LONG_DOWN_MS) {
-		key->up_t = 0;
-		key->down_t = 0;
-		keyval = KEY_PRESS_LONG_DOWN;
-		debug("%s key long pressed..\n", key->name);
-	} else if (key->down_t &&
-		   key_timer(key->down_t) >= KEY_LONG_DOWN_MS) {
-		key->up_t = 0;
-		key->down_t = 0;
-		keyval = KEY_PRESS_LONG_DOWN;
-		debug("%s key long pressed(hold)..\n", key->name);
-	} else if ((key->up_t > key->down_t) &&
-		   (key->up_t - key->down_t) < KEY_LONG_DOWN_MS) {
-		key->up_t = 0;
-		key->down_t = 0;
-		keyval = KEY_PRESS_DOWN;
-		debug("%s key short pressed..\n", key->name);
+	if ((uc_key->rise_ms > uc_key->fall_ms) &&
+	    (uc_key->rise_ms - uc_key->fall_ms) >= KEY_LONG_DOWN_MS) {
+		uc_key->rise_ms = 0;
+		uc_key->fall_ms = 0;
+		event = KEY_PRESS_LONG_DOWN;
+		KEY_DBG("%s key long pressed..\n", uc_key->name);
+	} else if (uc_key->fall_ms &&
+		   key_timer(uc_key->fall_ms) >= KEY_LONG_DOWN_MS) {
+		uc_key->rise_ms = 0;
+		uc_key->fall_ms = 0;
+		event = KEY_PRESS_LONG_DOWN;
+		KEY_DBG("%s key long pressed(hold)..\n", uc_key->name);
+	} else if ((uc_key->rise_ms > uc_key->fall_ms) &&
+		   (uc_key->rise_ms - uc_key->fall_ms) < KEY_LONG_DOWN_MS) {
+		uc_key->rise_ms = 0;
+		uc_key->fall_ms = 0;
+		event = KEY_PRESS_DOWN;
+		KEY_DBG("%s key short pressed..\n", uc_key->name);
 	/* Possible in charge animation, we enable irq after fuel gauge updated */
-	} else if (key->up_t && key->down_t && (key->up_t == key->down_t)){
-		key->up_t = 0;
-		key->down_t = 0;
-		keyval = KEY_PRESS_DOWN;
-		debug("%s key short pressed..\n", key->name);
+	} else if (uc_key->rise_ms && uc_key->fall_ms &&
+		   (uc_key->rise_ms == uc_key->fall_ms)) {
+		uc_key->rise_ms = 0;
+		uc_key->fall_ms = 0;
+		event = KEY_PRESS_DOWN;
+		KEY_DBG("%s key short pressed..\n", uc_key->name);
 	} else {
-		keyval = KEY_PRESS_NONE;
+		event = KEY_PRESS_NONE;
 	}
 
 out:
-	return keyval;
+	return event;
+}
+
+int key_is_pressed(int event)
+{
+	return (event == KEY_PRESS_DOWN || event == KEY_PRESS_LONG_DOWN);
 }
 
-static int key_read_gpio_interrupt_event(struct input_key *key)
+static int key_core_read(struct dm_key_uclass_platdata *uc_key)
 {
-	debug("%s: %s\n", __func__, key->name);
+	unsigned int adcval;
+
+	if (uc_key->type == ADC_KEY) {
+		if (adc_channel_single_shot("saradc",
+					    uc_key->channel, &adcval)) {
+			KEY_ERR("%s failed to read saradc\n", uc_key->name);
+			return KEY_NOT_EXIST;
+		}
 
-	return key_read_gpio_complex_event(key);
+		return key_adc_event(uc_key, adcval);
+	}
+
+	return (uc_key->code == KEY_POWER) ?
+		key_gpio_interrupt_event(uc_key) :
+		key_gpio_event(uc_key);
 }
 
-int key_is_pressed(int keyval)
+int key_read(int code)
 {
-	return (keyval == KEY_PRESS_DOWN || keyval == KEY_PRESS_LONG_DOWN);
+	struct dm_key_uclass_platdata *uc_key;
+	struct udevice *dev;
+	struct uclass *uc;
+	bool allow_pre_reloc = false;
+	int ret, event = KEY_NOT_EXIST;
+
+	ret = uclass_get(UCLASS_KEY, &uc);
+	if (ret)
+		return ret;
+
+try_again:
+	for (uclass_first_device(UCLASS_KEY, &dev);
+	     dev;
+	     uclass_next_device(&dev)) {
+		uc_key = dev_get_uclass_platdata(dev);
+
+		if (!allow_pre_reloc && uc_key->pre_reloc)
+			continue;
+
+		if (uc_key->code != code)
+			continue;
+
+		event = key_core_read(uc_key);
+		if (key_is_pressed(event))
+			return event;
+	}
+
+	/* If not find valid key node from kernel, try from u-boot */
+	if (event == KEY_NOT_EXIST && !allow_pre_reloc) {
+		allow_pre_reloc = true;
+		goto try_again;
+	}
+
+	return event;
 }
 
-void key_add(struct input_key *key)
+#ifdef CONFIG_IRQ
+static void gpio_irq_handler(int irq, void *data)
 {
-	if (!key)
-		return;
+	struct dm_key_uclass_platdata *uc_key = data;
 
-	if (!key->parent) {
-		printf("Err: Can't find key(code=%d) device\n", key->code);
+	if (uc_key->irq != irq)
 		return;
+
+	if (irq_get_gpio_level(irq)) {
+		uc_key->rise_ms = key_timer(0);
+		KEY_DBG("%s: key dn: %llu ms\n", uc_key->name, uc_key->fall_ms);
+	} else {
+		uc_key->fall_ms = key_timer(0);
+		KEY_DBG("%s: key up: %llu ms\n", uc_key->name, uc_key->rise_ms);
 	}
 
-	key->pre_reloc = dev_read_bool(key->parent, "u-boot,dm-pre-reloc");
-	list_add_tail(&key->link, &key_list);
+	/* Must delay */
+	mdelay(10);
+	irq_revert_irq_type(irq);
 }
+#endif
 
-static int __key_read(struct input_key *key)
+int key_bind_children(struct udevice *dev, const char *drv_name)
 {
-	unsigned int adcval;
-	int keyval = KEY_NOT_EXIST;
+	const char *name;
+	ofnode node;
 	int ret;
 
-	/* Is a adc key? */
-	if (key->type & ADC_KEY) {
-		ret = adc_channel_single_shot("saradc",
-					      key->channel, &adcval);
+	dev_for_each_subnode(node, dev) {
+		/*
+		 * If this node has "compatible" property, this is not
+		 * a amp subnode, but a normal device. skip.
+		 */
+		ofnode_get_property(node, "compatible", &ret);
+		if (ret >= 0)
+			continue;
+
+		if (ret != -FDT_ERR_NOTFOUND)
+			return ret;
+
+		name = ofnode_get_name(node);
+		if (!name)
+			return -EINVAL;
+		ret = device_bind_driver_to_node(dev, drv_name, name,
+						 node, NULL);
 		if (ret)
-			printf("%s: failed to read saradc, ret=%d\n",
-			       key->name, ret);
-		else
-			keyval = key_read_adc_simple_event(key, adcval);
-	/* Is a gpio key? */
-	} else if (key->type & GPIO_KEY) {
-		/* All pwrkey must register as an interrupt event */
-		if (key->code == KEY_POWER)
-			keyval = key_read_gpio_interrupt_event(key);
-		else
-			keyval = key_read_gpio_simple_event(key);
-	} else {
-		printf("%s: invalid key type!\n", __func__);
+			return ret;
 	}
 
-	debug("%s: '%s'(code=%d) is %s\n",
-	      __func__, key->name, key->code, evt_name[keyval]);
-
-	return keyval;
+	return 0;
 }
 
-int key_read(int code)
+static int key_post_probe(struct udevice *dev)
 {
-	struct udevice *dev;
-	struct input_key *key;
-	static int initialized;
-	int keyval = KEY_NOT_EXIST;
-
-	/* Initialize all key drivers */
-	if (!initialized) {
-		for (uclass_first_device(UCLASS_KEY, &dev);
-		     dev;
-		     uclass_next_device(&dev)) {
-			debug("%s: have found key driver '%s'\n\n",
-			      __func__, dev->name);
-		}
-	}
+	struct dm_key_uclass_platdata *uc_key;
+	int margin = 30;
+	int ret;
 
-	/* The key from kernel dtb has higher priority */
-	debug("Reading key from kernel\n");
-	list_for_each_entry(key, &key_list, link) {
-		if (key->pre_reloc || (key->code != code))
-			continue;
+	uc_key = dev_get_uclass_platdata(dev);
+	if (!uc_key)
+		return -ENXIO;
+
+	/* True from U-Boot key node */
+	uc_key->pre_reloc = dev_read_bool(dev, "u-boot,dm-pre-reloc");
 
-		keyval = __key_read(key);
-		if (key_is_pressed(keyval))
-			return keyval;
+	if (uc_key->type == ADC_KEY) {
+		uc_key->max = uc_key->adcval + margin;
+		uc_key->min = uc_key->adcval > margin ?
+					uc_key->adcval - margin : 0;
+	} else {
+		if (uc_key->code == KEY_POWER) {
+			/* The gpio irq has been setup by key driver */
+			if (uc_key->irq)
+				goto finish;
+#ifdef CONFIG_IRQ
+			int irq;
+
+			irq = phandle_gpio_to_irq(uc_key->gpios[0],
+						  uc_key->gpios[1]);
+			if (irq < 0) {
+				KEY_ERR("%s: failed to request irq, ret=%d\n",
+					uc_key->name, irq);
+				return irq;
+			}
+
+			uc_key->irq = irq;
+			irq_install_handler(irq, gpio_irq_handler, uc_key);
+			irq_set_irq_type(irq, IRQ_TYPE_EDGE_FALLING);
+			irq_handler_enable(irq);
+#else
+			KEY_WARN("%s: no IRQ framework available\n", uc_key->name);
+#endif
+		} else {
+			ret = gpio_request_by_name(dev, "gpios", 0,
+						   &uc_key->gpio, GPIOD_IS_IN);
+			if (ret) {
+				KEY_ERR("%s: failed to request gpio, ret=%d\n",
+					uc_key->name, ret);
+				return ret;
+			}
+		}
 	}
 
-	/* If not found any key from kernel dtb, reading from U-Boot dtb */
-	if (keyval == KEY_NOT_EXIST) {
-		debug("Reading key from U-Boot\n");
-		list_for_each_entry(key, &key_list, link) {
-			if (!key->pre_reloc || (key->code != code))
-				continue;
+finish:
+#ifdef DEBUG
+	printf("[%s] (%s, %s, %s):\n", uc_key->name,
+	       uc_key->type == ADC_KEY ? "ADC" : "GPIO",
+	       uc_key->pre_reloc ? "U-Boot" : "Kernel",
+	       dev->parent->name);
+
+	if (uc_key->type == ADC_KEY) {
+		printf("    adcval: %d (%d, %d)\n", uc_key->adcval,
+		       uc_key->min, uc_key->max);
+		printf("   channel: %d\n\n", uc_key->channel);
+	} else {
+		const char *gpio_name =
+		     ofnode_get_name(ofnode_get_by_phandle(uc_key->gpios[0]));
 
-			keyval = __key_read(key);
-			if (key_is_pressed(keyval))
-				return keyval;
-		}
+		printf("       irq: %d\n", uc_key->irq);
+		printf("   gpio[0]: %s\n", gpio_name);
+		printf("   gpio[1]: %d\n\n", uc_key->gpios[1]);
 	}
+#endif
 
-	return keyval;
+	return 0;
 }
 
 UCLASS_DRIVER(key) = {
 	.id		= UCLASS_KEY,
 	.name		= "key",
+	.post_probe	= key_post_probe,
+	.per_device_platdata_auto_alloc_size =
+			sizeof(struct dm_key_uclass_platdata),
 };
diff --git a/drivers/input/rk8xx_pwrkey.c b/drivers/input/rk8xx_pwrkey.c
index fc3ee631e5..14fe5bce3f 100644
--- a/drivers/input/rk8xx_pwrkey.c
+++ b/drivers/input/rk8xx_pwrkey.c
@@ -105,7 +105,7 @@ static void pwrkey_irq_handler(int irq, void *data)
 {
 	struct udevice *dev = data;
 	struct rk8xx_key_priv *priv = dev_get_priv(dev);
-	struct input_key *key = dev_get_platdata(dev);
+	struct dm_key_uclass_platdata *uc_key = dev_get_uclass_platdata(dev);
 	int ret, val, i;
 
 	debug("%s: irq = %d\n", __func__, irq);
@@ -135,14 +135,14 @@ static void pwrkey_irq_handler(int irq, void *data)
 
 	/* fall event */
 	if (val & priv->pwron_fall_int) {
-		key->down_t = key_timer(0);
-		debug("%s: key down: %llu ms\n", __func__, key->down_t);
+		uc_key->fall_ms = key_timer(0);
+		debug("%s: key down: %llu ms\n", __func__, uc_key->fall_ms);
 	}
 
 	/* rise event */
 	if (val & priv->pwron_rise_int) {
-		key->up_t = key_timer(0);
-		debug("%s: key up: %llu ms\n", __func__, key->up_t);
+		uc_key->rise_ms = key_timer(0);
+		debug("%s: key up: %llu ms\n", __func__, uc_key->rise_ms);
 	}
 
 	/* clear intertup */
@@ -162,33 +162,31 @@ static void pwrkey_irq_handler(int irq, void *data)
 
 static int pwrkey_interrupt_init(struct udevice *dev)
 {
-	struct input_key *key = dev_get_platdata(dev);
+	struct dm_key_uclass_platdata *uc_key = dev_get_uclass_platdata(dev);
 	u32 interrupt[2], phandle;
 	int irq, ret;
 
 	phandle = dev_read_u32_default(dev->parent, "interrupt-parent", -1);
 	if (phandle < 0) {
-		printf("failed get 'interrupt-parent', ret=%d\n", phandle);
+		printf("read 'interrupt-parent' failed, ret=%d\n", phandle);
 		return phandle;
 	}
 
 	ret = dev_read_u32_array(dev->parent, "interrupts", interrupt, 2);
 	if (ret) {
-		printf("failed get 'interrupt', ret=%d\n", ret);
+		printf("read 'interrupt' failed, ret=%d\n", ret);
 		return ret;
 	}
 
-	key->parent = dev;
-	key->name = "rk8xx_pwrkey";
-	key->code = KEY_POWER;
-	key->type = GPIO_KEY;
+	uc_key->name = "rk8xx_pwr";
+	uc_key->type = GPIO_KEY;
+	uc_key->code = KEY_POWER;
 	irq = phandle_gpio_to_irq(phandle, interrupt[0]);
 	if (irq < 0) {
-		printf("%s: failed to request irq, ret=%d\n", key->name, irq);
+		printf("%s: request irq failed, ret=%d\n", uc_key->name, irq);
 		return irq;
 	}
-	key->irq = irq;
-	key_add(key);
+	uc_key->irq = irq;
 	irq_install_handler(irq, pwrkey_irq_handler, dev);
 	irq_set_irq_type(irq, IRQ_TYPE_EDGE_FALLING);
 	irq_handler_enable(irq);
@@ -196,10 +194,6 @@ static int pwrkey_interrupt_init(struct udevice *dev)
 	return 0;
 }
 
-static const struct dm_key_ops key_ops = {
-	.name = "rk8xx-pwrkey",
-};
-
 static int rk8xx_pwrkey_probe(struct udevice *dev)
 {
 	struct rk8xx_priv *rk8xx = dev_get_priv(dev->parent);
@@ -270,8 +264,6 @@ static int rk8xx_pwrkey_probe(struct udevice *dev)
 U_BOOT_DRIVER(rk8xx_pwrkey) = {
 	.name   = "rk8xx_pwrkey",
 	.id     = UCLASS_KEY,
-	.ops	= &key_ops,
 	.probe  = rk8xx_pwrkey_probe,
-	.platdata_auto_alloc_size = sizeof(struct input_key),
 	.priv_auto_alloc_size = sizeof(struct rk8xx_key_priv),
 };
diff --git a/drivers/input/rk_key.c b/drivers/input/rk_key.c
index 44f2b5d4a7..2619a8e3b0 100644
--- a/drivers/input/rk_key.c
+++ b/drivers/input/rk_key.c
@@ -4,145 +4,65 @@
  * SPDX-License-Identifier:     GPL-2.0+
  */
 
-#include <dm.h>
-#include <adc.h>
 #include <common.h>
-#include <console.h>
 #include <dm.h>
-#include <errno.h>
-#include <fdtdec.h>
-#include <malloc.h>
 #include <key.h>
-#include <linux/input.h>
-#include <errno.h>
-#include <dm/read.h>
-#include <irq-generic.h>
-#include <irq-platform.h>
 
-static void gpio_irq_handler(int irq, void *data)
+static int rk_key_ofdata_to_platdata(struct udevice *dev)
 {
-	struct input_key *key = data;
+	struct dm_key_uclass_platdata *uc_key;
+	u32 chn[2];
 
-	if (key->irq != irq)
-		return;
+	uc_key = dev_get_uclass_platdata(dev);
+	if (!uc_key)
+		return -ENXIO;
 
-	/* up event */
-	if (irq_get_gpio_level(irq)) {
-		key->up_t = key_timer(0);
-		debug("%s: key down: %llu ms\n", key->name, key->down_t);
-	/* down event */
-	} else {
-		key->down_t = key_timer(0);
-		debug("%s: key up: %llu ms\n", key->name, key->up_t);
-	}
-	/* Must delay */
-	mdelay(10);
-	irq_revert_irq_type(irq);
-}
+	uc_key->name = dev_read_string(dev, "label");
+	uc_key->code = dev_read_u32_default(dev, "linux,code", -ENODATA);
 
-static int rk_keys_ofdata_to_platdata(struct udevice *dev)
-{
-	struct input_key *key;
-	u32 adc_channels[2], gpios[2], adcval;
-	int irq, ret;
-	ofnode node;
-
-	/* Get IO channel */
-	if (dev_read_u32_array(dev, "io-channels", adc_channels, 2)) {
-		printf("%s: failed to read 'io-channels'\n", __func__);
+	if (dev_read_u32_array(dev_get_parent(dev), "io-channels", chn, 2)) {
+		printf("%s: read 'io-channels' failed\n", uc_key->name);
 		return -EINVAL;
 	}
 
-	dev_for_each_subnode(node, dev) {
-		key = calloc(1, sizeof(struct input_key));
-		if (!key)
-			return -ENOMEM;
-
-		/* This is an ACD key */
-		if (!ofnode_read_u32(node, "rockchip,adc_value", &adcval)) {
-			key->parent = dev;
-			key->name = ofnode_read_string(node, "label");
-			key->type = ADC_KEY;
-			key->adcval = adcval;
-			key->channel = adc_channels[1];
-			if (ofnode_read_u32(node, "linux,code", &key->code)) {
-				printf("%s: failed to read 'linux,code'\n",
-				       key->name);
-				free(key);
-				continue;
-			}
-			key_add(key);
-		/* This is a GPIO key */
-		} else {
-			key->parent = dev;
-			key->type = GPIO_KEY;
-			key->name = ofnode_read_string(node, "label");
-			ret = ofnode_read_u32(node, "linux,code", &key->code);
-			if (ret) {
-				printf("%s: failed read 'linux,code', ret=%d\n",
-				       key->name, ret);
-				free(key);
-				continue;
-			}
-
-			/* Only register power key as interrupt */
-			if (key->code == KEY_POWER) {
-				ret = ofnode_read_u32_array(node, "gpios",
-							    gpios, 2);
-				if (ret) {
-					printf("%s: failed to read 'gpios', ret=%d\n",
-					       key->name, ret);
-					free(key);
-					continue;
-				}
-
-				/* Request irq */
-				irq = phandle_gpio_to_irq(gpios[0], gpios[1]);
-				if (irq < 0) {
-					printf("%s: failed to request irq, ret=%d\n",
-					       __func__, irq);
-					free(key);
-					continue;
-				}
-				key->irq = irq;
-				key_add(key);
-				irq_install_handler(irq, gpio_irq_handler, key);
-				irq_set_irq_type(irq, IRQ_TYPE_EDGE_FALLING);
-				irq_handler_enable(irq);
-			} else {
-				ret = gpio_request_by_name_nodev(node, "gpios",
-						0, &key->gpio, GPIOD_IS_IN);
-				if (ret) {
-					printf("%s: failed to request gpio, ret=%d\n",
-					       key->name, ret);
-					free(key);
-					continue;
-				}
-				key_add(key);
-			}
+	if (dev_read_bool(dev, "rockchip,adc_value")) {
+		uc_key->type = ADC_KEY;
+		uc_key->channel = chn[1];
+		uc_key->adcval =
+			dev_read_u32_default(dev, "rockchip,adc_value", 0);
+	} else {
+		uc_key->type = GPIO_KEY;
+		if (dev_read_u32_array(dev, "gpios",
+				       uc_key->gpios,
+				       ARRAY_SIZE(uc_key->gpios))) {
+			printf("%s: read 'gpios' failed\n", uc_key->name);
+			return -EINVAL;
 		}
-
-		debug("%s: name=%s: code=%d, adcval=%d, channel=%d, type=%d\n",
-		      __func__, key->name, key->code, key->adcval,
-		      key->channel, key->type);
 	}
 
 	return 0;
 }
 
-static const struct dm_key_ops key_ops = {
-	.name = "rk-keys",
+U_BOOT_DRIVER(rk_key) = {
+	.name     = "rk_key",
+	.id       = UCLASS_KEY,
+	.ofdata_to_platdata = rk_key_ofdata_to_platdata,
 };
 
-static const struct udevice_id rk_keys_ids[] = {
+/* Key Bus */
+static int rk_key_bus_bind(struct udevice *dev)
+{
+	return key_bind_children(dev, "rk_key");
+}
+
+static const struct udevice_id rk_key_bus_match[] = {
 	{ .compatible = "rockchip,key" },
 	{ },
 };
 
-U_BOOT_DRIVER(rk_keys) = {
-	.name   = "rk-keys",
-	.id     = UCLASS_KEY,
-	.ops	= &key_ops,
-	.of_match = rk_keys_ids,
-	.ofdata_to_platdata = rk_keys_ofdata_to_platdata,
+U_BOOT_DRIVER(rk_key_bus) = {
+	.name	   = "rk_key_bus",
+	.id	   = UCLASS_SIMPLE_BUS,
+	.of_match  = rk_key_bus_match,
+	.bind	   = rk_key_bus_bind,
 };
diff --git a/drivers/irq/irq-gpio-switch.h b/drivers/irq/irq-gpio-switch.h
index 1442825132..a46604fb03 100644
--- a/drivers/irq/irq-gpio-switch.h
+++ b/drivers/irq/irq-gpio-switch.h
@@ -26,6 +26,7 @@ struct gpio_bank {
 	int id;
 	int irq_base;
 	int ngpio;
+	int use_count;
 };
 
 #define GPIO_BANK_REGISTER(ID, GPIO_BANK_NUM)	\
@@ -35,6 +36,7 @@ struct gpio_bank {
 		.id	  = ID,						\
 		.irq_base = PIN_BASE + (ID) * (GPIO_BANK_NUM),		\
 		.ngpio    = GPIO_BANK_NUM,				\
+		.use_count = 0						\
 	}
 
 /* gpio bank[31:8] and pin[7:0] */
diff --git a/drivers/irq/irq-gpio.c b/drivers/irq/irq-gpio.c
index ce88cc8f7b..3e61d188fa 100644
--- a/drivers/irq/irq-gpio.c
+++ b/drivers/irq/irq-gpio.c
@@ -276,6 +276,10 @@ static int gpio_irq_enable(int gpio_irq)
 
 	gpio_irq_unmask(bank->regbase, offset_to_bit(gpio));
 
+	if (bank->use_count == 0)
+		irq_handler_enable(IRQ_GPIO0 + bank->id);
+	bank->use_count++;
+
 	return 0;
 }
 
@@ -293,6 +297,10 @@ static int gpio_irq_disable(int irq)
 
 	gpio_irq_mask(bank->regbase, offset_to_bit(gpio));
 
+	if (bank->use_count == 1)
+		irq_handler_disable(IRQ_GPIO0 + bank->id);
+	bank->use_count--;
+
 	return 0;
 }
 
@@ -311,8 +319,8 @@ static int gpio_irq_init(void)
 			irq_install_handler(IRQ_GPIO0 + bank->id,
 			(interrupt_handler_t *)generic_gpio_handle_irq, NULL);
 
-			/* default enable all gpio group interrupt */
-			irq_handler_enable(IRQ_GPIO0 + bank->id);
+			/* default disable all gpio group interrupt */
+			irq_handler_disable(IRQ_GPIO0 + bank->id);
 		}
 	}
 
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3d282d5b14..f936fd791f 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -41,6 +41,13 @@ config ROCKCHIP_EFUSE
 	  extended (by porting the read function from the Linux kernel sources)
 	  to support other recent Rockchip devices.
 
+config ROCKCHIP_OTP
+	bool "Rockchip OTP Support"
+	depends on MISC
+	help
+	  This is a simple drive to dump specified values of Rockchip SoC
+	  from otp, such as cpu-leakage.
+
 config CMD_CROS_EC
 	bool "Enable crosec command"
 	depends on CROS_EC
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 1e6a58d2f8..72f3156812 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -52,3 +52,4 @@ obj-$(CONFIG_FSL_DEVICE_DISABLE) += fsl_devdis.o
 obj-$(CONFIG_WINBOND_W83627) += winbond_w83627.o
 obj-$(CONFIG_QFW) += qfw.o
 obj-$(CONFIG_ROCKCHIP_EFUSE) += rockchip-efuse.o
+obj-$(CONFIG_ROCKCHIP_OTP) += rockchip-otp.o
diff --git a/drivers/misc/rockchip-efuse.c b/drivers/misc/rockchip-efuse.c
index d23e091940..a2e4da408f 100644
--- a/drivers/misc/rockchip-efuse.c
+++ b/drivers/misc/rockchip-efuse.c
@@ -16,6 +16,46 @@
 #include <linux/delay.h>
 #include <misc.h>
 
+#define T_CSB_P_S		0
+#define T_PGENB_P_S		0
+#define T_LOAD_P_S		0
+#define T_ADDR_P_S		0
+#define T_STROBE_P_S		(0 + 110) /* 1.1us */
+#define T_CSB_P_L		(0 + 110 + 1000 + 20) /* 200ns */
+#define T_PGENB_P_L		(0 + 110 + 1000 + 20)
+#define T_LOAD_P_L		(0 + 110 + 1000 + 20)
+#define T_ADDR_P_L		(0 + 110 + 1000 + 20)
+#define T_STROBE_P_L		(0 + 110 + 1000) /* 10us */
+#define T_CSB_R_S		0
+#define T_PGENB_R_S		0
+#define T_LOAD_R_S		0
+#define T_ADDR_R_S		2
+#define T_STROBE_R_S		(2 + 3)
+#define T_CSB_R_L		(2 + 3 + 3 + 3)
+#define T_PGENB_R_L		(2 + 3 + 3 + 3)
+#define T_LOAD_R_L		(2 + 3 + 3 + 3)
+#define T_ADDR_R_L		(2 + 3 + 3 + 2)
+#define T_STROBE_R_L		(2 + 3 + 3)
+
+#define T_CSB_P			0x28
+#define T_PGENB_P		0x2c
+#define T_LOAD_P		0x30
+#define T_ADDR_P		0x34
+#define T_STROBE_P		0x38
+#define T_CSB_R			0x3c
+#define T_PGENB_R		0x40
+#define T_LOAD_R		0x44
+#define T_ADDR_R		0x48
+#define T_STROBE_R		0x4c
+
+#define RK1808_USER_MODE	BIT(0)
+#define RK1808_INT_FINISH	BIT(0)
+#define RK1808_AUTO_ENB		BIT(0)
+#define RK1808_AUTO_RD		BIT(1)
+#define RK1808_A_SHIFT		16
+#define RK1808_A_MASK		0x3ff
+#define RK1808_NBYTES		4
+
 #define RK3399_A_SHIFT          16
 #define RK3399_A_MASK           0x3ff
 #define RK3399_NFUSES           32
@@ -106,6 +146,76 @@ U_BOOT_CMD(
 );
 #endif
 
+static void rk1808_efuse_timing_init(void __iomem *base)
+{
+	static bool init;
+
+	if (init)
+		return;
+
+	/* enable auto mode */
+	writel(readl(base) & (~RK1808_USER_MODE), base);
+
+	/* setup efuse timing */
+	writel((T_CSB_P_S << 16) | T_CSB_P_L, base + T_CSB_P);
+	writel((T_PGENB_P_S << 16) | T_PGENB_P_L, base + T_PGENB_P);
+	writel((T_LOAD_P_S << 16) | T_LOAD_P_L, base + T_LOAD_P);
+	writel((T_ADDR_P_S << 16) | T_ADDR_P_L, base + T_ADDR_P);
+	writel((T_STROBE_P_S << 16) | T_STROBE_P_L, base + T_STROBE_P);
+	writel((T_CSB_R_S << 16) | T_CSB_R_L, base + T_CSB_R);
+	writel((T_PGENB_R_S << 16) | T_PGENB_R_L, base + T_PGENB_R);
+	writel((T_LOAD_R_S << 16) | T_LOAD_R_L, base + T_LOAD_R);
+	writel((T_ADDR_R_S << 16) | T_ADDR_R_L, base + T_ADDR_R);
+	writel((T_STROBE_R_S << 16) | T_STROBE_R_L, base + T_STROBE_R);
+
+	init = true;
+}
+
+static int rockchip_rk1808_efuse_read(struct udevice *dev, int offset,
+				      void *buf, int size)
+{
+	struct rockchip_efuse_platdata *plat = dev_get_platdata(dev);
+	struct rockchip_efuse_regs *efuse =
+		(struct rockchip_efuse_regs *)plat->base;
+	unsigned int addr_start, addr_end, addr_offset, addr_len;
+	u32 out_value, status;
+	u8 *buffer;
+	int ret = 0, i = 0;
+
+	rk1808_efuse_timing_init(plat->base);
+
+	addr_start = rounddown(offset, RK1808_NBYTES) / RK1808_NBYTES;
+	addr_end = roundup(offset + size, RK1808_NBYTES) / RK1808_NBYTES;
+	addr_offset = offset % RK1808_NBYTES;
+	addr_len = addr_end - addr_start;
+
+	buffer = calloc(1, sizeof(*buffer) * addr_len * RK1808_NBYTES);
+	if (!buffer)
+		return -ENOMEM;
+
+	while (addr_len--) {
+		writel(RK1808_AUTO_RD | RK1808_AUTO_ENB |
+		       ((addr_start++ & RK1808_A_MASK) << RK1808_A_SHIFT),
+		       &efuse->auto_ctrl);
+		udelay(2);
+		status = readl(&efuse->int_status);
+		if (!(status & RK1808_INT_FINISH)) {
+			ret = -EIO;
+			goto err;
+		}
+		out_value = readl(&efuse->dout2);
+		writel(RK1808_INT_FINISH, &efuse->int_status);
+
+		memcpy(&buffer[i], &out_value, RK1808_NBYTES);
+		i += RK1808_NBYTES;
+	}
+	memcpy(buf, buffer + addr_offset, size);
+err:
+	kfree(buffer);
+
+	return ret;
+}
+
 static int rockchip_rk3399_efuse_read(struct udevice *dev, int offset,
 				      void *buf, int size)
 {
@@ -270,6 +380,10 @@ static int rockchip_efuse_ofdata_to_platdata(struct udevice *dev)
 
 static const struct udevice_id rockchip_efuse_ids[] = {
 	{
+		.compatible = "rockchip,rk1808-efuse",
+		.data = (ulong)&rockchip_rk1808_efuse_read,
+	},
+	{
 		.compatible = "rockchip,rockchip-efuse",
 		.data = (ulong)&rockchip_rk3288_efuse_read,
 	},
diff --git a/drivers/misc/rockchip-otp.c b/drivers/misc/rockchip-otp.c
new file mode 100644
index 0000000000..c6ec5d9b3f
--- /dev/null
+++ b/drivers/misc/rockchip-otp.c
@@ -0,0 +1,213 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Fuzhou Rockchip Electronics Co., Ltd
+ */
+
+#include <common.h>
+#include <asm/io.h>
+#include <command.h>
+#include <dm.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <misc.h>
+
+/* OTP Register Offsets */
+#define OTPC_SBPI_CTRL			0x0020
+#define OTPC_SBPI_CMD_VALID_PRE		0x0024
+#define OTPC_SBPI_CS_VALID_PRE		0x0028
+#define OTPC_SBPI_STATUS		0x002C
+#define OTPC_USER_CTRL			0x0100
+#define OTPC_USER_ADDR			0x0104
+#define OTPC_USER_ENABLE		0x0108
+#define OTPC_USER_Q			0x0124
+#define OTPC_INT_STATUS			0x0304
+#define OTPC_SBPI_CMD0_OFFSET		0x1000
+#define OTPC_SBPI_CMD1_OFFSET		0x1004
+
+/* OTP Register bits and masks */
+#define OTPC_USER_ADDR_MASK		GENMASK(31, 16)
+#define OTPC_USE_USER			BIT(0)
+#define OTPC_USE_USER_MASK		GENMASK(16, 16)
+#define OTPC_USER_FSM_ENABLE		BIT(0)
+#define OTPC_USER_FSM_ENABLE_MASK	GENMASK(16, 16)
+#define OTPC_SBPI_DONE			BIT(1)
+#define OTPC_USER_DONE			BIT(2)
+
+#define SBPI_DAP_ADDR			0x02
+#define SBPI_DAP_ADDR_SHIFT		8
+#define SBPI_DAP_ADDR_MASK		GENMASK(31, 24)
+#define SBPI_CMD_VALID_MASK		GENMASK(31, 16)
+#define SBPI_DAP_CMD_WRF		0xC0
+#define SBPI_DAP_REG_ECC		0x3A
+#define SBPI_ECC_ENABLE			0x00
+#define SBPI_ECC_DISABLE		0x09
+#define SBPI_ENABLE			BIT(0)
+#define SBPI_ENABLE_MASK		GENMASK(16, 16)
+
+#define OTPC_TIMEOUT			10000
+
+typedef int (*OTP_READ)(struct udevice *dev, int offset, void *buf, int size);
+
+struct rockchip_otp_platdata {
+	void __iomem *base;
+};
+
+#if defined(DEBUG)
+static int dump_otps(cmd_tbl_t *cmdtp, int flag,
+		     int argc, char * const argv[])
+{
+	struct udevice *dev;
+	u8 otps[64] = {0};
+	int ret;
+
+	/* retrieve the device */
+	ret = uclass_get_device_by_driver(UCLASS_MISC,
+					  DM_GET_DRIVER(rockchip_otp), &dev);
+	if (ret) {
+		printf("%s: no misc-device found\n", __func__);
+		return 0;
+	}
+
+	ret = misc_read(dev, 0, &otps, sizeof(otps));
+	if (ret) {
+		printf("%s: misc_read failed\n", __func__);
+		return 0;
+	}
+
+	printf("otp-contents:\n");
+	print_buffer(0, otps, 1, 64, 16);
+
+	return 0;
+}
+
+U_BOOT_CMD(
+	rockchip_dump_otps, 1, 1, dump_otps,
+	"Dump the content of the otps",
+	""
+);
+#endif
+
+static int rockchip_otp_wait_status(struct rockchip_otp_platdata *otp,
+				    u32 flag)
+{
+	int delay = OTPC_TIMEOUT;
+
+	while (!(readl(otp->base + OTPC_INT_STATUS) & flag)) {
+		udelay(1);
+		delay--;
+		if (delay <= 0) {
+			printf("%s: wait init status timeout\n", __func__);
+			return -ETIMEDOUT;
+		}
+	}
+
+	/* clean int status */
+	writel(flag, otp->base + OTPC_INT_STATUS);
+
+	return 0;
+}
+
+static int rockchip_otp_ecc_enable(struct rockchip_otp_platdata *otp,
+				   bool enable)
+{
+	int ret = 0;
+
+	writel(SBPI_DAP_ADDR_MASK | (SBPI_DAP_ADDR << SBPI_DAP_ADDR_SHIFT),
+	       otp->base + OTPC_SBPI_CTRL);
+
+	writel(SBPI_CMD_VALID_MASK | 0x1, otp->base + OTPC_SBPI_CMD_VALID_PRE);
+	writel(SBPI_DAP_CMD_WRF | SBPI_DAP_REG_ECC,
+	       otp->base + OTPC_SBPI_CMD0_OFFSET);
+	if (enable)
+		writel(SBPI_ECC_ENABLE, otp->base + OTPC_SBPI_CMD1_OFFSET);
+	else
+		writel(SBPI_ECC_DISABLE, otp->base + OTPC_SBPI_CMD1_OFFSET);
+
+	writel(SBPI_ENABLE_MASK | SBPI_ENABLE, otp->base + OTPC_SBPI_CTRL);
+
+	ret = rockchip_otp_wait_status(otp, OTPC_SBPI_DONE);
+	if (ret < 0)
+		printf("%s timeout during ecc_enable\n", __func__);
+
+	return ret;
+}
+
+static int rockchip_px30_otp_read(struct udevice *dev, int offset,
+				  void *buf, int size)
+{
+	struct rockchip_otp_platdata *otp = dev_get_platdata(dev);
+	u8 *buffer = buf;
+	int ret = 0;
+
+	ret = rockchip_otp_ecc_enable(otp, false);
+	if (ret < 0) {
+		printf("%s rockchip_otp_ecc_enable err\n", __func__);
+		return ret;
+	}
+
+	writel(OTPC_USE_USER | OTPC_USE_USER_MASK, otp->base + OTPC_USER_CTRL);
+	udelay(5);
+	while (size--) {
+		writel(offset++ | OTPC_USER_ADDR_MASK,
+		       otp->base + OTPC_USER_ADDR);
+		writel(OTPC_USER_FSM_ENABLE | OTPC_USER_FSM_ENABLE_MASK,
+		       otp->base + OTPC_USER_ENABLE);
+		ret = rockchip_otp_wait_status(otp, OTPC_USER_DONE);
+		if (ret < 0) {
+			printf("%s timeout during read setup\n", __func__);
+			goto read_end;
+		}
+		*buffer++ = readb(otp->base + OTPC_USER_Q);
+	}
+
+read_end:
+	writel(0x0 | OTPC_USE_USER_MASK, otp->base + OTPC_USER_CTRL);
+
+	return ret;
+}
+
+static int rockchip_otp_read(struct udevice *dev, int offset,
+			     void *buf, int size)
+{
+	OTP_READ otp_read = NULL;
+
+	otp_read = (OTP_READ)dev_get_driver_data(dev);
+	if (!otp_read)
+		return -ENOSYS;
+
+	return (*otp_read)(dev, offset, buf, size);
+}
+
+static const struct misc_ops rockchip_otp_ops = {
+	.read = rockchip_otp_read,
+};
+
+static int rockchip_otp_ofdata_to_platdata(struct udevice *dev)
+{
+	struct rockchip_otp_platdata *otp = dev_get_platdata(dev);
+
+	otp->base = dev_read_addr_ptr(dev);
+
+	return 0;
+}
+
+static const struct udevice_id rockchip_otp_ids[] = {
+	{
+		.compatible = "rockchip,px30-otp",
+		.data = (ulong)&rockchip_px30_otp_read,
+	},
+	{
+		.compatible = "rockchip,rk3308-otp",
+		.data = (ulong)&rockchip_px30_otp_read,
+	},
+	{}
+};
+
+U_BOOT_DRIVER(rockchip_otp) = {
+	.name = "rockchip_otp",
+	.id = UCLASS_MISC,
+	.of_match = rockchip_otp_ids,
+	.ops = &rockchip_otp_ops,
+	.ofdata_to_platdata = rockchip_otp_ofdata_to_platdata,
+	.platdata_auto_alloc_size = sizeof(struct rockchip_otp_platdata),
+};
diff --git a/drivers/mmc/dw_mmc.c b/drivers/mmc/dw_mmc.c
index 3a13b51a41..f8347f0c52 100644
--- a/drivers/mmc/dw_mmc.c
+++ b/drivers/mmc/dw_mmc.c
@@ -13,6 +13,10 @@
 #include <memalign.h>
 #include <mmc.h>
 #include <dwmmc.h>
+#ifdef CONFIG_DM_GPIO
+#include <asm/gpio.h>
+#include <asm-generic/gpio.h>
+#endif
 
 #define PAGE_SIZE 4096
 
@@ -580,8 +584,16 @@ static int dwmci_init(struct mmc *mmc)
 
 	if (host->board_init)
 		host->board_init(host);
-
+#ifdef CONFIG_ARCH_ROCKCHIP
+	if (host->dev_index == 0)
+		dwmci_writel(host, DWMCI_PWREN, 1);
+	else if (host->dev_index == 1)
+		dwmci_writel(host, DWMCI_PWREN, 0);
+	else
+		dwmci_writel(host, DWMCI_PWREN, 1);
+#else
 	dwmci_writel(host, DWMCI_PWREN, 1);
+#endif
 
 	if (!dwmci_wait_reset(host, DWMCI_RESET_ALL)) {
 		debug("%s[%d] Fail-reset!!\n", __func__, __LINE__);
@@ -623,6 +635,24 @@ static int dwmci_init(struct mmc *mmc)
 	return 0;
 }
 
+static int dwmci_get_cd(struct udevice *dev)
+{
+	int ret = -1;
+#ifndef CONFIG_SPL_BUILD
+#ifdef CONFIG_DM_GPIO
+	struct gpio_desc detect;
+
+	ret = gpio_request_by_name(dev, "cd-gpios", 0, &detect, GPIOD_IS_IN);
+	if (ret) {
+		return ret;
+	}
+
+	ret = !dm_gpio_get_value(&detect);
+#endif
+#endif
+	return ret;
+}
+
 #ifdef CONFIG_DM_MMC
 int dwmci_probe(struct udevice *dev)
 {
@@ -635,6 +665,7 @@ const struct dm_mmc_ops dm_dwmci_ops = {
 	.card_busy	= dwmci_card_busy,
 	.send_cmd	= dwmci_send_cmd,
 	.set_ios	= dwmci_set_ios,
+	.get_cd         = dwmci_get_cd,
 	.execute_tuning	= dwmci_execute_tuning,
 };
 
@@ -643,6 +674,7 @@ static const struct mmc_ops dwmci_ops = {
 	.card_busy	= dwmci_card_busy,
 	.send_cmd	= dwmci_send_cmd,
 	.set_ios	= dwmci_set_ios,
+	.get_cd         = dwmci_get_cd,
 	.init		= dwmci_init,
 	.execute_tuning	= dwmci_execute_tuning,
 };
diff --git a/drivers/mmc/rpmb.c b/drivers/mmc/rpmb.c
index dda84de781..88136f0644 100644
--- a/drivers/mmc/rpmb.c
+++ b/drivers/mmc/rpmb.c
@@ -84,7 +84,7 @@ static int mmc_rpmb_request(struct mmc *mmc, const void *s,
 
 	cmd.cmdidx = MMC_CMD_WRITE_MULTIPLE_BLOCK;
 	cmd.cmdarg = 0;
-	cmd.resp_type = MMC_RSP_R1b;
+	cmd.resp_type = MMC_RSP_R1;
 
 	data.src = (const char *)s;
 	data.blocks = count;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index b43d86d050..f3372d65f7 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -79,9 +79,17 @@ config NAND_PXA3XX
 config NAND_ROCKCHIP
 	bool "Support for NAND on Rockchip SoCs"
 	select SYS_NAND_SELF_INIT
+	default n
 	---help---
 	Enable support for Rockchip nand.
 
+config NAND_ROCKCHIP_V9
+	bool "Support for NAND V9 on Rockchip SoCs"
+	select SYS_NAND_SELF_INIT
+	default n
+	---help---
+	Enable support for Rockchip nand v9.
+
 config NAND_SUNXI
 	bool "Support for NAND on Allwinner SoCs"
 	depends on MACH_SUN4I || MACH_SUN5I || MACH_SUN7I
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index 6067b89837..de8675d227 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -70,7 +70,7 @@ obj-$(CONFIG_NAND_PLAT) += nand_plat.o
 obj-$(CONFIG_NAND_SUNXI) += sunxi_nand.o
 obj-$(CONFIG_NAND_ZYNQ) += zynq_nand.o
 obj-$(CONFIG_NAND_ROCKCHIP) += rockchip_nand.o
-
+obj-$(CONFIG_NAND_ROCKCHIP_V9) += rockchip_nand_v9.o
 else  # minimal SPL drivers
 
 obj-$(CONFIG_NAND_FSL_ELBC) += fsl_elbc_spl.o
diff --git a/drivers/mtd/nand/nand_bbt.c b/drivers/mtd/nand/nand_bbt.c
index 74c4c9a3c8..aa4cf30c3f 100644
--- a/drivers/mtd/nand/nand_bbt.c
+++ b/drivers/mtd/nand/nand_bbt.c
@@ -487,8 +487,10 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf,
 		int ret;
 
 		BUG_ON(bd->options & NAND_BBT_NO_OOB);
-
-		ret = scan_block_fast(mtd, bd, from, buf, numpages);
+		if (this->block_bad)
+			ret = this->block_bad(mtd, from);
+		else
+			ret = scan_block_fast(mtd, bd, from, buf, numpages);
 		if (ret < 0)
 			return ret;
 
diff --git a/drivers/mtd/nand/rockchip_nand.c b/drivers/mtd/nand/rockchip_nand.c
index d8f443972a..b8607c82ee 100644
--- a/drivers/mtd/nand/rockchip_nand.c
+++ b/drivers/mtd/nand/rockchip_nand.c
@@ -307,7 +307,6 @@ static void rockchip_nand_write_extra_oob(struct mtd_info *mtd, u8 *oob)
 	rockchip_nand_write_buf(mtd, oob + offset, len);
 }
 
-
 static int rockchip_nand_hw_syndrome_pio_read_page(struct mtd_info *mtd,
 						   struct nand_chip *chip,
 						   uint8_t *buf,
@@ -535,6 +534,33 @@ static int rockchip_nand_ecc_init(struct mtd_info *mtd,
 	return 0;
 }
 
+static int rockchip_nand_block_bad(struct mtd_info *mtd, loff_t ofs)
+{
+	int page, res = 0, i;
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	u16 bad = 0xff;
+	int chipnr = (int)(ofs >> chip->chip_shift);
+
+	page = (int)(ofs >> chip->page_shift) & chip->pagemask;
+	chip->select_chip(mtd, chipnr);
+	chip->cmdfunc(mtd, NAND_CMD_READ0, 0x00, page);
+	if(rockchip_nand_hw_syndrome_pio_read_page(mtd,
+	   chip, chip->buffers->databuf, 0, page) == -1) {
+		chip->cmdfunc(mtd, NAND_CMD_READOOB, chip->badblockpos, page);
+		for (i = 0; i < 8; i++) {
+			bad = chip->read_byte(mtd);
+			if (bad)
+				break;
+		}
+		if (i >= 8)
+			res = 1;
+	}
+	chip->select_chip(mtd, -1);
+	if (res)
+		printf("%s 0x%x %x %x\n", __func__, page, res, bad);
+	return res;
+}
+
 static int rockchip_nand_chip_init(int node, struct rk_nand *rknand, int devnum)
 {
 	const void *blob = gd->fdt_blob;
@@ -553,6 +579,9 @@ static int rockchip_nand_chip_init(int node, struct rk_nand *rknand, int devnum)
 	chip->read_byte = rockchip_nand_read_byte;
 	chip->dev_ready = rockchip_nand_dev_ready;
 	chip->controller = &rknand->controller;
+	chip->block_bad = rockchip_nand_block_bad;
+	chip->bbt_options = NAND_BBT_USE_FLASH | NAND_BBT_NO_OOB;
+	chip->options = NAND_NO_SUBPAGE_WRITE;
 
 	rknand->banks[devnum] = fdtdec_get_int(blob, node, "reg", -1);
 
@@ -625,7 +654,7 @@ void board_nand_init(void)
 		goto err;
 	}
 
-	regs = fdtdec_get_addr(blob, node, "reg");
+	regs = fdt_get_base_address(blob, node);
 	if (regs == FDT_ADDR_T_NONE) {
 		debug("Nand address not found\n");
 		goto err;
@@ -652,9 +681,10 @@ err:
 int nand_spl_load_image(uint32_t offs, unsigned int size, void *dst)
 {
 	struct mtd_info *mtd;
+	size_t length = size;
 
 	mtd = get_nand_dev_by_index(0);
-	return nand_read_skip_bad(mtd, offs, &size, NULL, size, (u_char *)dst);
+	return nand_read_skip_bad(mtd, offs, &length, NULL, size, (u_char *)dst);
 }
 
 void nand_deselect(void) {}
diff --git a/drivers/mtd/nand/rockchip_nand_v9.c b/drivers/mtd/nand/rockchip_nand_v9.c
new file mode 100644
index 0000000000..b2ff609d33
--- /dev/null
+++ b/drivers/mtd/nand/rockchip_nand_v9.c
@@ -0,0 +1,691 @@
+/*
+ * Copyright (c) 2017 Yifeng Zhao <yifeng.zhao@rock-chips.com>
+ * Copyright (c) 2017 Paweł Jarosz <paweljarosz3691@gmail.com>
+ *
+ * SPDX-License-Identifier:     GPL-2.0+
+ */
+
+#include <common.h>
+#include <fdtdec.h>
+#include <inttypes.h>
+#include <nand.h>
+#include <linux/kernel.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/partitions.h>
+#include <linux/io.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#define NANDC_V9_BOOTROM_ECC	70
+#define NANDC_V9_NUM_BANKS	4
+#define NANDC_V9_DEF_TIMEOUT	20000
+#define NANDC_V9_READ		0
+#define NANDC_V9_WRITE		1
+#define NANDC_REG_V9_FMCTL	0x00
+#define NANDC_REG_V9_FMWAIT	0x04
+#define NANDC_REG_V9_FLCTL	0x10
+#define NANDC_REG_V9_BCHCTL	0x20
+#define NANDC_REG_V9_DMA_CFG	0x30
+#define NANDC_REG_V9_DMA_BUF0	0x34
+#define NANDC_REG_V9_DMA_BUF1	0x38
+#define NANDC_REG_V9_DMA_ST	0x40
+#define NANDC_REG_V9_VER	0x80
+#define NANDC_REG_V9_INTEN	0x120
+#define NANDC_REG_V9_INTCLR	0x124
+#define NANDC_REG_V9_INTST	0x128
+#define NANDC_REG_V9_BCHST	0x150
+#define NANDC_REG_V9_SPARE0	0x200
+#define NANDC_REG_V9_SPARE1	0x204
+#define NANDC_REG_V9_RANDMZ	0x208
+#define NANDC_REG_V9_BANK0	0x800
+#define NANDC_REG_V9_SRAM0	0x1000
+#define NANDC_REG_V9_SRAM_SIZE	0x400
+
+#define NANDC_REG_V9_DATA	0x00
+#define NANDC_REG_V9_ADDR	0x04
+#define NANDC_REG_V9_CMD	0x08
+
+/* FMCTL */
+#define NANDC_V9_FM_WP		BIT(8)
+#define NANDC_V9_FM_CE_SEL_M	0xFF
+#define NANDC_V9_FM_CE_SEL(x)	(1 << (x))
+#define NANDC_V9_FM_FREADY	BIT(9)
+
+/* FLCTL */
+#define NANDC_V9_FL_RST		BIT(0)
+#define NANDC_V9_FL_DIR_S	0x1
+#define NANDC_V9_FL_XFER_START	BIT(2)
+#define NANDC_V9_FL_XFER_EN	BIT(3)
+#define NANDC_V9_FL_ST_BUF_S	0x4
+#define NANDC_V9_FL_XFER_COUNT	BIT(5)
+#define NANDC_V9_FL_ACORRECT	BIT(10)
+#define NANDC_V9_FL_XFER_READY	BIT(20)
+
+/* BCHCTL */
+#define NAND_V9_BCH_MODE_S	25
+#define NAND_V9_BCH_MODE_M	0x7
+
+/* BCHST */
+#define NANDC_V9_BCH0_ST_ERR	BIT(2)
+#define NANDC_V9_BCH1_ST_ERR	BIT(18)
+#define NANDC_V9_ECC_ERR_CNT0(x) (((x) & (0x7F << 3)) >> 3)
+#define NANDC_V9_ECC_ERR_CNT1(x) (((x) & (0x7F << 19)) >> 19)
+
+struct rk_nand {
+	uint32_t banks[NANDC_V9_NUM_BANKS];
+	struct nand_hw_control controller;
+	uint32_t ecc_strength;
+	uint32_t max_ecc_strength;
+	struct mtd_info mtd;
+	bool bootromblocks;
+	void __iomem *regs;
+	int selected_bank;
+};
+
+static struct nand_ecclayout nand_oob_fix = {
+	.eccbytes = 24,
+	.eccpos = {
+		4, 5, 6, 7, 8, 9, 10
+        },
+	.oobfree = {
+		{
+			.offset = 0,
+			.length = 4
+                }
+        }
+};
+
+static inline struct rk_nand *to_rknand(struct nand_hw_control *ctrl)
+{
+	return container_of(ctrl, struct rk_nand, controller);
+}
+
+static void rockchip_nand_init(struct rk_nand *rknand)
+{
+	writel(0, rknand->regs + NANDC_REG_V9_RANDMZ);
+	writel(0, rknand->regs + NANDC_REG_V9_DMA_CFG);
+	writel(0, rknand->regs + NANDC_REG_V9_BCHCTL);
+	writel(NANDC_V9_FM_WP, rknand->regs + NANDC_REG_V9_FMCTL);
+	writel(0x1081, rknand->regs + NANDC_REG_V9_FMWAIT);
+}
+
+static void rockchip_nand_select_chip(struct mtd_info *mtd, int chipnr)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	void __iomem *bank_base;
+	uint32_t reg;
+	int banknr;
+
+	reg = readl(rknand->regs + NANDC_REG_V9_FMCTL);
+	reg &= ~NANDC_V9_FM_CE_SEL_M;
+
+	if (chipnr == -1) {
+		banknr = -1;
+	} else {
+		banknr = rknand->banks[chipnr];
+		bank_base = rknand->regs + NANDC_REG_V9_BANK0 + banknr * 0x100;
+
+		chip->IO_ADDR_R = bank_base;
+		chip->IO_ADDR_W = bank_base;
+
+		reg |= 1 << banknr;
+	}
+	writel(reg, rknand->regs + NANDC_REG_V9_FMCTL);
+
+	rknand->selected_bank = banknr;
+}
+
+static void rockchip_nand_cmd_ctrl(struct mtd_info *mtd,
+				   int dat,
+				   unsigned int ctrl)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	void __iomem *bank_base = rknand->regs + NANDC_REG_V9_BANK0
+				+ rknand->selected_bank * 0x100;
+
+	if (ctrl & NAND_CTRL_CHANGE) {
+		if (ctrl & NAND_ALE)
+			bank_base += NANDC_REG_V9_ADDR;
+		else if (ctrl & NAND_CLE)
+			bank_base += NANDC_REG_V9_CMD;
+		chip->IO_ADDR_W = bank_base;
+	}
+
+	if (dat != NAND_CMD_NONE)
+		writeb(dat & 0xFF, chip->IO_ADDR_W);
+}
+
+static void rockchip_nand_read_buf(struct mtd_info *mtd,
+				   uint8_t *buf,
+				   int len)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	int offs = 0;
+	void __iomem *bank_base = rknand->regs + NANDC_REG_V9_BANK0
+				+ rknand->selected_bank * 0x100;
+
+	for (offs = 0; offs < len; offs++)
+		buf[offs] = readb(bank_base);
+}
+
+static void rockchip_nand_write_buf(struct mtd_info *mtd,
+				    const uint8_t *buf,
+				    int len)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	int offs = 0;
+	void __iomem *bank_base = rknand->regs + NANDC_REG_V9_BANK0
+				+ rknand->selected_bank * 0x100;
+
+	for (offs = 0; offs < len; offs++)
+		writeb(buf[offs], bank_base);
+}
+
+static uint8_t rockchip_nand_read_byte(struct mtd_info *mtd)
+{
+	uint8_t ret;
+
+	rockchip_nand_read_buf(mtd, &ret, 1);
+
+	return ret;
+}
+
+static int rockchip_nand_dev_ready(struct mtd_info *mtd)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+
+	if (readl(rknand->regs + NANDC_REG_V9_FMCTL) & NANDC_V9_FM_FREADY)
+		return 1;
+
+	return 0;
+}
+
+static int rockchip_nand_hw_ecc_setup(struct mtd_info *mtd,
+				      struct nand_ecc_ctrl *ecc,
+				      uint32_t strength)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	u32 reg;
+
+	ecc->strength = strength;
+	ecc->bytes = DIV_ROUND_UP(ecc->strength * 14, 8);
+	ecc->bytes = ALIGN(ecc->bytes, 2);
+
+	switch (ecc->strength) {
+	case 70:
+		reg = 0x00000001;
+		break;
+	case 60:
+		reg = 0x06000001;
+		break;
+	case 40:
+		reg = 0x04000001;
+		break;
+	case 16:
+		reg = 0x02000001;
+		break;
+	default:
+		return -EINVAL;
+	}
+	writel(reg, rknand->regs + NANDC_REG_V9_BCHCTL);
+
+	return 0;
+}
+
+static void rockchip_nand_pio_xfer_start(struct rk_nand *rknand,
+					 u8 dir,
+					 u8 st_buf)
+{
+	u32 reg;
+
+	reg = (dir << NANDC_V9_FL_DIR_S) | (st_buf << NANDC_V9_FL_ST_BUF_S) |
+	      NANDC_V9_FL_XFER_EN | NANDC_V9_FL_XFER_COUNT |
+	      NANDC_V9_FL_ACORRECT;
+	writel(reg, rknand->regs + NANDC_REG_V9_FLCTL);
+
+	reg |= NANDC_V9_FL_XFER_START;
+	writel(reg, rknand->regs + NANDC_REG_V9_FLCTL);
+}
+
+static int rockchip_nand_wait_pio_xfer_done(struct rk_nand *rknand)
+{
+	int timeout = NANDC_V9_DEF_TIMEOUT;
+	int reg;
+
+	while (timeout--) {
+		reg = readl(rknand->regs + NANDC_REG_V9_FLCTL);
+
+		if ((reg & NANDC_V9_FL_XFER_READY)  != 0)
+			break;
+
+		udelay(1);
+	}
+
+	if (timeout == 0)
+		return -1;
+
+	return 0;
+}
+
+static void rockchip_nand_read_extra_oob(struct mtd_info *mtd, u8 *oob)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct nand_ecc_ctrl *ecc = &chip->ecc;
+	int offset = ((ecc->bytes + ecc->prepad) * ecc->steps);
+	int len = mtd->oobsize - offset;
+
+	if (len <= 0)
+		return;
+
+	chip->cmdfunc(mtd, NAND_CMD_RNDOUT, offset + mtd->writesize, -1);
+
+	rockchip_nand_read_buf(mtd, oob + offset, len);
+}
+
+static void rockchip_nand_write_extra_oob(struct mtd_info *mtd, u8 *oob)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct nand_ecc_ctrl *ecc = &chip->ecc;
+	int offset = ((ecc->bytes + ecc->prepad) * ecc->steps);
+	int len = mtd->oobsize - offset;
+
+	if (len <= 0)
+		return;
+
+	chip->cmdfunc(mtd, NAND_CMD_RNDIN, offset + mtd->writesize, -1);
+
+	rockchip_nand_write_buf(mtd, oob + offset, len);
+}
+
+static int rockchip_nand_hw_syndrome_pio_read_page(struct mtd_info *mtd,
+						   struct nand_chip *chip,
+						   uint8_t *buf,
+						   int oob_required,
+						   int page)
+{
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	struct nand_ecc_ctrl *ecc = &chip->ecc;
+	void __iomem *sram_base = rknand->regs + NANDC_REG_V9_SRAM0;
+	unsigned int max_bitflips = 0;
+	int ret, step, bch_st;
+	int offset = page * mtd->writesize;
+
+	if (rknand->bootromblocks && (offset < (4 * mtd->erasesize)))
+		rockchip_nand_hw_ecc_setup(mtd, ecc, NANDC_V9_BOOTROM_ECC);
+
+	rockchip_nand_pio_xfer_start(rknand, NANDC_V9_READ, 0);
+
+	for (step = 0; step < ecc->steps; step++) {
+		int data_off = step * ecc->size;
+		int oob_off = step * (ecc->bytes + ecc->prepad);
+		u8 *data = buf + data_off;
+		u8 *oob = chip->oob_poi + oob_off;
+
+		ret = rockchip_nand_wait_pio_xfer_done(rknand);
+		if (ret)
+			return ret;
+
+		bch_st = readl(rknand->regs + NANDC_REG_V9_BCHST);
+
+		if (bch_st & NANDC_V9_BCH0_ST_ERR) {
+			mtd->ecc_stats.failed++;
+			max_bitflips = -1;
+		} else {
+			ret = NANDC_V9_ECC_ERR_CNT0(bch_st);
+			mtd->ecc_stats.corrected += ret;
+			max_bitflips = max_t(unsigned int, max_bitflips, ret);
+		}
+
+		if ((step + 1) < ecc->steps)
+			rockchip_nand_pio_xfer_start(rknand, NANDC_V9_READ,
+					      		(step + 1) & 0x1);
+
+		memcpy_fromio(data, sram_base + NANDC_REG_V9_SRAM_SIZE *
+			     				(step & 1), ecc->size);
+
+		if (step & 1)
+			memcpy_fromio(oob, rknand->regs + NANDC_REG_V9_SPARE1, 4);
+		else
+			memcpy_fromio(oob, rknand->regs + NANDC_REG_V9_SPARE0, 4);
+	}
+
+	rockchip_nand_read_extra_oob(mtd, chip->oob_poi);
+
+	if (rknand->bootromblocks)
+		rockchip_nand_hw_ecc_setup(mtd, ecc, rknand->ecc_strength);
+
+	return max_bitflips;
+}
+
+static uint32_t rockchip_nand_make_bootrom_compat(struct mtd_info *mtd,
+						  int page,
+						  const u8 *oob,
+						  bool bootromblocks)
+{
+	int pages_per_block = mtd->erasesize / mtd->writesize;
+	int offset = page * mtd->writesize;
+
+	if ((offset < (2 * mtd->erasesize)) || !(page % 2) ||
+	    (offset >= (7 * mtd->erasesize)) || !bootromblocks)
+		return oob[3] | (oob[2] << 8) | (oob[1] << 16) | (oob[0] << 24);
+
+	return (page % pages_per_block + 1) * 4;
+}
+
+static int rockchip_nand_hw_syndrome_pio_write_page(struct mtd_info *mtd,
+						    struct nand_chip *chip,
+						    const uint8_t *buf,
+						    int oob_required,
+						    int page)
+{
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	struct nand_ecc_ctrl *ecc = &chip->ecc;
+	void __iomem *sram_base = rknand->regs + NANDC_REG_V9_SRAM0;
+	int ret, index, step = 0;
+	int offset = page * mtd->writesize;
+	int data_off = step * ecc->size;
+	int oob_off = step * (ecc->bytes + ecc->prepad);
+	const u8 *data = buf + data_off;
+	const u8 *oob = chip->oob_poi + oob_off;
+
+	if (rknand->bootromblocks && (offset < (7 * mtd->erasesize)))
+		rockchip_nand_hw_ecc_setup(mtd, ecc, NANDC_V9_BOOTROM_ECC);
+
+	index = rockchip_nand_make_bootrom_compat(mtd, page, oob,
+					   rknand->bootromblocks);
+
+	memcpy_toio(sram_base, data, ecc->size);
+	memcpy_toio(rknand->regs + NANDC_REG_V9_SPARE0, &index, ecc->prepad);
+
+	for (step = 1; step <= ecc->steps; step++) {
+		rockchip_nand_pio_xfer_start(rknand, NANDC_V9_WRITE,
+					     (step - 1) & 0x1);
+		data_off = step * ecc->size;
+		oob_off = step * (ecc->bytes + ecc->prepad);
+		data = buf + data_off;
+		oob = chip->oob_poi + oob_off;
+
+		if (step < ecc->steps) {
+			memcpy_toio(sram_base + NANDC_REG_V9_SRAM_SIZE *
+				    (step & 1), data, ecc->size);
+			if (step & 1)
+				memcpy_toio(rknand->regs + NANDC_REG_V9_SPARE1,
+					    oob, ecc->prepad);
+			else
+				memcpy_toio(rknand->regs + NANDC_REG_V9_SPARE0,
+					    oob, ecc->prepad);
+		}
+
+		ret = rockchip_nand_wait_pio_xfer_done(rknand);
+		if (ret)
+			return ret;
+	}
+
+	rockchip_nand_write_extra_oob(mtd, chip->oob_poi);
+
+	if (rknand->bootromblocks)
+		rockchip_nand_hw_ecc_setup(mtd, ecc, rknand->ecc_strength);
+
+	return 0;
+}
+
+static const u8 strengths[] = {70, 60, 40, 16};
+
+static int rockchip_nand_ecc_max_strength(struct mtd_info *mtd,
+					  struct nand_ecc_ctrl *ecc)
+{
+	uint32_t max_strength, index;
+
+	max_strength = ((mtd->oobsize / ecc->steps) - ecc->prepad) * 8 / 14;
+
+	for (index = 0; index < ARRAY_SIZE(strengths); index++)
+		if (max_strength >= strengths[index])
+			break;
+
+	if (index >= ARRAY_SIZE(strengths))
+		return -ENOTSUPP;
+
+	return strengths[index];
+}
+
+static bool rockchip_nand_strength_is_valid(int strength)
+{
+	uint32_t index;
+
+	for (index = 0; index < ARRAY_SIZE(strengths); index++)
+		if (strength == strengths[index])
+			break;
+
+	if (index == ARRAY_SIZE(strengths))
+		return false;
+
+	return true;
+}
+
+static int rockchip_nand_hw_ecc_ctrl_init(struct mtd_info *mtd,
+					  struct nand_ecc_ctrl *ecc)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct rk_nand *rknand = to_rknand(chip->controller);
+	uint32_t strength;
+	int index;
+
+	ecc->prepad = 4;
+	ecc->steps = mtd->writesize / ecc->size;
+
+	if (fdtdec_get_bool(gd->fdt_blob, chip->flash_node,
+			    "rockchip,protect-bootrom-blocks"))
+                rknand->bootromblocks = true;
+	else
+		rknand->bootromblocks = false;
+
+	if (rockchip_nand_strength_is_valid(ecc->strength))
+		strength = ecc->strength;
+	else
+		strength = rockchip_nand_ecc_max_strength(mtd, ecc);
+
+	rknand->max_ecc_strength = 70;
+	if (strength > rknand->max_ecc_strength)
+		strength = rknand->max_ecc_strength;
+
+	rockchip_nand_hw_ecc_setup(mtd, ecc, strength);
+
+	rknand->ecc_strength = ecc->strength;
+
+	nand_oob_fix.eccbytes = ecc->bytes * ecc->steps;
+	for (index = 0; index < ecc->bytes; index++)
+		nand_oob_fix.eccpos[index] = index + ecc->prepad;
+	ecc->layout = &nand_oob_fix;
+
+	if (mtd->oobsize < ((ecc->bytes + ecc->prepad) * ecc->steps)) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int rockchip_nand_ecc_init(struct mtd_info *mtd,
+				  struct nand_ecc_ctrl *ecc)
+{
+	int ret;
+
+	switch (ecc->mode) {
+	case NAND_ECC_HW_SYNDROME:
+		ret = rockchip_nand_hw_ecc_ctrl_init(mtd, ecc);
+		if (ret)
+			return ret;
+		ecc->read_page =  rockchip_nand_hw_syndrome_pio_read_page;
+		ecc->write_page = rockchip_nand_hw_syndrome_pio_write_page;
+		break;
+	case NAND_ECC_SOFT_BCH:
+	case NAND_ECC_NONE:
+	case NAND_ECC_SOFT:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int rockchip_nand_block_bad(struct mtd_info *mtd, loff_t ofs)
+{
+	int page, res = 0, i;
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	u16 bad = 0xff;
+	int chipnr = (int)(ofs >> chip->chip_shift);
+
+	page = (int)(ofs >> chip->page_shift) & chip->pagemask;
+	chip->select_chip(mtd, chipnr);
+	chip->cmdfunc(mtd, NAND_CMD_READ0, 0x00, page);
+	if(rockchip_nand_hw_syndrome_pio_read_page(mtd,
+	   chip, chip->buffers->databuf, 0, page) == -1) {
+		chip->cmdfunc(mtd, NAND_CMD_READOOB, chip->badblockpos, page);
+		for (i = 0; i < 8; i++) {
+			bad = chip->read_byte(mtd);
+			if (bad)
+				break;
+		}
+		if (i >= 8)
+			res = 1;
+	}
+	chip->select_chip(mtd, -1);
+	if (res)
+		printf("%s 0x%x %x %x\n", __func__, page, res, bad);
+	return res;
+}
+
+static int rockchip_nand_chip_init(int node, struct rk_nand *rknand, int devnum)
+{
+	const void *blob = gd->fdt_blob;
+	struct nand_chip *chip;
+	struct mtd_info *mtd;
+	int ret;
+
+	chip = kzalloc(sizeof(*chip), GFP_KERNEL);
+
+	chip->chip_delay = 50;
+	chip->flash_node = node;
+	chip->select_chip = rockchip_nand_select_chip;
+	chip->cmd_ctrl = rockchip_nand_cmd_ctrl;
+	chip->read_buf = rockchip_nand_read_buf;
+	chip->write_buf = rockchip_nand_write_buf;
+	chip->read_byte = rockchip_nand_read_byte;
+	chip->dev_ready = rockchip_nand_dev_ready;
+	chip->controller = &rknand->controller;
+	chip->block_bad = rockchip_nand_block_bad;
+	chip->bbt_options = NAND_BBT_USE_FLASH | NAND_BBT_NO_OOB;
+	chip->options = NAND_NO_SUBPAGE_WRITE;
+
+	rknand->banks[devnum] = fdtdec_get_int(blob, node, "reg", -1);
+
+	if (rknand->banks[devnum] < 0)
+		return -EINVAL;
+
+	mtd = nand_to_mtd(chip);
+	mtd->name = "rknand";
+
+	ret = nand_scan_ident(mtd, 1, NULL);
+	if (ret)
+		return ret;
+
+	ret = rockchip_nand_ecc_init(mtd, &chip->ecc);
+	if (ret) {
+		debug("rockchip_nand_ecc_init failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = nand_scan_tail(mtd);
+	if (ret) {
+		debug("nand_scan_tail failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = nand_register(devnum, mtd);
+	if (ret) {
+		debug("Failed to register mtd device: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int rockchip_nand_chips_init(int node, struct rk_nand *rknand)
+{
+	const void *blob = gd->fdt_blob;
+	int nand_node;
+	int ret, i = 0;
+
+	for (nand_node = fdt_first_subnode(blob, node); nand_node >= 0;
+	     nand_node = fdt_next_subnode(blob, nand_node)) {
+		ret = rockchip_nand_chip_init(nand_node, rknand, i++);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+void board_nand_init(void)
+{
+	const void *blob = gd->fdt_blob;
+	struct rk_nand *rknand;
+	fdt_addr_t regs;
+	int node;
+	int ret;
+
+	rknand = kzalloc(sizeof(*rknand), GFP_KERNEL);
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_ROCKCHIP_NANDC);
+
+	if (node < 0) {
+		debug("Nand node not found\n");
+		goto err;
+	}
+
+	if (!fdtdec_get_is_enabled(blob, node)) {
+		debug("Nand disabled in device tree\n");
+		goto err;
+	}
+
+	regs = fdt_get_base_address(blob, node);
+	if (regs == FDT_ADDR_T_NONE) {
+		debug("Nand address not found\n");
+		goto err;
+	}
+
+	rknand->regs = (void *)regs;
+
+	spin_lock_init(&rknand->controller.lock);
+	init_waitqueue_head(&rknand->controller.wq);
+
+	rockchip_nand_init(rknand);
+
+	ret = rockchip_nand_chips_init(node, rknand);
+	if (ret) {
+		debug("Failed to init nand chips\n");
+		goto err;
+	}
+
+	return;
+err:
+	kfree(rknand);
+}
+
+int nand_spl_load_image(uint32_t offs, unsigned int size, void *dst)
+{
+	struct mtd_info *mtd;
+	size_t length = size;
+
+	mtd = get_nand_dev_by_index(0);
+	return nand_read_skip_bad(mtd, offs, &length, NULL, size, (u_char *)dst);
+}
+
+void nand_deselect(void) {}
diff --git a/drivers/net/gmac_rockchip.c b/drivers/net/gmac_rockchip.c
index 172d423e2e..9007e4cdac 100644
--- a/drivers/net/gmac_rockchip.c
+++ b/drivers/net/gmac_rockchip.c
@@ -15,8 +15,11 @@
 #include <asm/arch/periph.h>
 #include <asm/arch/clock.h>
 #include <asm/arch/hardware.h>
+#include <asm/arch/grf_px30.h>
+#include <asm/arch/grf_rk1808.h>
 #include <asm/arch/grf_rk322x.h>
 #include <asm/arch/grf_rk3288.h>
+#include <asm/arch/grf_rk3308.h>
 #include <asm/arch/grf_rk3328.h>
 #include <asm/arch/grf_rk3368.h>
 #include <asm/arch/grf_rk3399.h>
@@ -81,6 +84,81 @@ static int gmac_rockchip_ofdata_to_platdata(struct udevice *dev)
 	return designware_eth_ofdata_to_platdata(dev);
 }
 
+static int px30_gmac_fix_mac_speed(struct dw_eth_dev *priv)
+{
+	struct px30_grf *grf;
+	struct clk clk_speed;
+	int speed, ret;
+	enum {
+		PX30_GMAC_SPEED_SHIFT = 0x2,
+		PX30_GMAC_SPEED_MASK  = BIT(2),
+		PX30_GMAC_SPEED_10M   = 0,
+		PX30_GMAC_SPEED_100M  = BIT(2),
+	};
+
+	ret = clk_get_by_name(priv->phydev->dev, "clk_mac_speed",
+			      &clk_speed);
+	if (ret)
+		return ret;
+
+	switch (priv->phydev->speed) {
+	case 10:
+		speed = PX30_GMAC_SPEED_10M;
+		ret = clk_set_rate(&clk_speed, 2500000);
+		if (ret)
+			return ret;
+		break;
+	case 100:
+		speed = PX30_GMAC_SPEED_100M;
+		ret = clk_set_rate(&clk_speed, 25000000);
+		if (ret)
+			return ret;
+		break;
+	default:
+		debug("Unknown phy speed: %d\n", priv->phydev->speed);
+		return -EINVAL;
+	}
+
+	grf = syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
+	rk_clrsetreg(&grf->mac_con1, PX30_GMAC_SPEED_MASK, speed);
+
+	return 0;
+}
+
+static int rk1808_gmac_fix_mac_speed(struct dw_eth_dev *priv)
+{
+	struct clk clk_speed;
+	int ret;
+
+	ret = clk_get_by_name(priv->phydev->dev, "clk_mac_speed",
+			      &clk_speed);
+	if (ret)
+		return ret;
+
+	switch (priv->phydev->speed) {
+	case 10:
+		ret = clk_set_rate(&clk_speed, 2500000);
+		if (ret)
+			return ret;
+		break;
+	case 100:
+		ret = clk_set_rate(&clk_speed, 25000000);
+		if (ret)
+			return ret;
+		break;
+	case 1000:
+		ret = clk_set_rate(&clk_speed, 125000000);
+		if (ret)
+			return ret;
+		break;
+	default:
+		debug("Unknown phy speed: %d\n", priv->phydev->speed);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int rk3228_gmac_fix_mac_speed(struct dw_eth_dev *priv)
 {
 	struct rk322x_grf *grf;
@@ -140,6 +218,47 @@ static int rk3288_gmac_fix_mac_speed(struct dw_eth_dev *priv)
 	return 0;
 }
 
+static int rk3308_gmac_fix_mac_speed(struct dw_eth_dev *priv)
+{
+	struct rk3308_grf *grf;
+	struct clk clk_speed;
+	int speed, ret;
+	enum {
+		RK3308_GMAC_SPEED_SHIFT = 0x0,
+		RK3308_GMAC_SPEED_MASK  = BIT(0),
+		RK3308_GMAC_SPEED_10M   = 0,
+		RK3308_GMAC_SPEED_100M  = BIT(0),
+	};
+
+	ret = clk_get_by_name(priv->phydev->dev, "clk_mac_speed",
+			      &clk_speed);
+	if (ret)
+		return ret;
+
+	switch (priv->phydev->speed) {
+	case 10:
+		speed = RK3308_GMAC_SPEED_10M;
+		ret = clk_set_rate(&clk_speed, 2500000);
+		if (ret)
+			return ret;
+		break;
+	case 100:
+		speed = RK3308_GMAC_SPEED_100M;
+		ret = clk_set_rate(&clk_speed, 25000000);
+		if (ret)
+			return ret;
+		break;
+	default:
+		debug("Unknown phy speed: %d\n", priv->phydev->speed);
+		return -EINVAL;
+	}
+
+	grf = syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
+	rk_clrsetreg(&grf->mac_con0, RK3308_GMAC_SPEED_MASK, speed);
+
+	return 0;
+}
+
 static int rk3328_gmac_fix_mac_speed(struct dw_eth_dev *priv)
 {
 	struct rk3328_grf_regs *grf;
@@ -266,6 +385,62 @@ static int rv1108_set_rmii_speed(struct dw_eth_dev *priv)
 	return 0;
 }
 
+static void px30_gmac_set_to_rmii(struct gmac_rockchip_platdata *pdata)
+{
+	struct px30_grf *grf;
+	enum {
+		px30_GMAC_PHY_INTF_SEL_SHIFT = 4,
+		px30_GMAC_PHY_INTF_SEL_MASK  = GENMASK(4, 6),
+		px30_GMAC_PHY_INTF_SEL_RMII  = BIT(6),
+	};
+
+	grf = syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
+
+	rk_clrsetreg(&grf->mac_con1,
+		     px30_GMAC_PHY_INTF_SEL_MASK,
+		     px30_GMAC_PHY_INTF_SEL_RMII);
+}
+
+static void rk1808_gmac_set_to_rgmii(struct gmac_rockchip_platdata *pdata)
+{
+	struct rk1808_grf *grf;
+	enum {
+		RK1808_GMAC_PHY_INTF_SEL_SHIFT = 4,
+		RK1808_GMAC_PHY_INTF_SEL_MASK  = GENMASK(6, 4),
+		RK1808_GMAC_PHY_INTF_SEL_RGMII = BIT(4),
+
+		RK1808_RXCLK_DLY_ENA_GMAC_MASK = BIT(1),
+		RK1808_RXCLK_DLY_ENA_GMAC_DISABLE = 0,
+		RK1808_RXCLK_DLY_ENA_GMAC_ENABLE = BIT(1),
+
+		RK1808_TXCLK_DLY_ENA_GMAC_MASK = BIT(0),
+		RK1808_TXCLK_DLY_ENA_GMAC_DISABLE = 0,
+		RK1808_TXCLK_DLY_ENA_GMAC_ENABLE = BIT(0),
+	};
+	enum {
+		RK1808_CLK_RX_DL_CFG_GMAC_SHIFT = 0x8,
+		RK1808_CLK_RX_DL_CFG_GMAC_MASK = GENMASK(15, 7),
+
+		RK1808_CLK_TX_DL_CFG_GMAC_SHIFT = 0x0,
+		RK1808_CLK_TX_DL_CFG_GMAC_MASK = GENMASK(7, 0),
+	};
+
+	grf = syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
+	rk_clrsetreg(&grf->mac_con1,
+		     RK1808_GMAC_PHY_INTF_SEL_MASK |
+		     RK1808_RXCLK_DLY_ENA_GMAC_MASK |
+		     RK1808_TXCLK_DLY_ENA_GMAC_MASK,
+		     RK1808_GMAC_PHY_INTF_SEL_RGMII |
+		     RK1808_RXCLK_DLY_ENA_GMAC_ENABLE |
+		     RK1808_TXCLK_DLY_ENA_GMAC_ENABLE);
+
+	rk_clrsetreg(&grf->mac_con0,
+		     RK1808_CLK_RX_DL_CFG_GMAC_MASK |
+		     RK1808_CLK_TX_DL_CFG_GMAC_MASK,
+		     pdata->rx_delay << RK1808_CLK_RX_DL_CFG_GMAC_SHIFT |
+		     pdata->tx_delay << RK1808_CLK_TX_DL_CFG_GMAC_SHIFT);
+}
+
 static void rk3228_gmac_set_to_rgmii(struct gmac_rockchip_platdata *pdata)
 {
 	struct rk322x_grf *grf;
@@ -330,6 +505,22 @@ static void rk3288_gmac_set_to_rgmii(struct gmac_rockchip_platdata *pdata)
 		     pdata->tx_delay << RK3288_CLK_TX_DL_CFG_GMAC_SHIFT);
 }
 
+static void rk3308_gmac_set_to_rmii(struct gmac_rockchip_platdata *pdata)
+{
+	struct rk3308_grf *grf;
+	enum {
+		RK3308_GMAC_PHY_INTF_SEL_SHIFT = 2,
+		RK3308_GMAC_PHY_INTF_SEL_MASK  = GENMASK(4, 2),
+		RK3308_GMAC_PHY_INTF_SEL_RMII  = BIT(4),
+	};
+
+	grf = syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
+
+	rk_clrsetreg(&grf->mac_con0,
+		     RK3308_GMAC_PHY_INTF_SEL_MASK,
+		     RK3308_GMAC_PHY_INTF_SEL_RMII);
+}
+
 static void rk3328_gmac_set_to_rgmii(struct gmac_rockchip_platdata *pdata)
 {
 	struct rk3328_grf_regs *grf;
@@ -542,6 +733,16 @@ const struct eth_ops gmac_rockchip_eth_ops = {
 	.write_hwaddr		= designware_eth_write_hwaddr,
 };
 
+const struct rk_gmac_ops px30_gmac_ops = {
+	.fix_mac_speed = px30_gmac_fix_mac_speed,
+	.set_to_rmii = px30_gmac_set_to_rmii,
+};
+
+const struct rk_gmac_ops rk1808_gmac_ops = {
+	.fix_mac_speed = rk1808_gmac_fix_mac_speed,
+	.set_to_rgmii = rk1808_gmac_set_to_rgmii,
+};
+
 const struct rk_gmac_ops rk3228_gmac_ops = {
 	.fix_mac_speed = rk3228_gmac_fix_mac_speed,
 	.set_to_rgmii = rk3228_gmac_set_to_rgmii,
@@ -552,6 +753,11 @@ const struct rk_gmac_ops rk3288_gmac_ops = {
 	.set_to_rgmii = rk3288_gmac_set_to_rgmii,
 };
 
+const struct rk_gmac_ops rk3308_gmac_ops = {
+	.fix_mac_speed = rk3308_gmac_fix_mac_speed,
+	.set_to_rmii = rk3308_gmac_set_to_rmii,
+};
+
 const struct rk_gmac_ops rk3328_gmac_ops = {
 	.fix_mac_speed = rk3328_gmac_fix_mac_speed,
 	.set_to_rgmii = rk3328_gmac_set_to_rgmii,
@@ -573,10 +779,16 @@ const struct rk_gmac_ops rv1108_gmac_ops = {
 };
 
 static const struct udevice_id rockchip_gmac_ids[] = {
+	{ .compatible = "rockchip,px30-gmac",
+	  .data = (ulong)&px30_gmac_ops },
+	{ .compatible = "rockchip,rk1808-gmac",
+	  .data = (ulong)&rk1808_gmac_ops },
 	{ .compatible = "rockchip,rk3228-gmac",
 	  .data = (ulong)&rk3228_gmac_ops },
 	{ .compatible = "rockchip,rk3288-gmac",
 	  .data = (ulong)&rk3288_gmac_ops },
+	{ .compatible = "rockchip,rk3308-mac",
+	  .data = (ulong)&rk3308_gmac_ops },
 	{ .compatible = "rockchip,rk3328-gmac",
 	  .data = (ulong)&rk3328_gmac_ops },
 	{ .compatible = "rockchip,rk3368-gmac",
diff --git a/drivers/power/charge_animation.c b/drivers/power/charge_animation.c
index 3a0e885689..b1a814e02b 100644
--- a/drivers/power/charge_animation.c
+++ b/drivers/power/charge_animation.c
@@ -35,7 +35,7 @@ DECLARE_GLOBAL_DATA_PTR;
 #define IMAGE_RESET_IDX				-1
 #define IMAGE_SOC_100_IDX(n)			((n) - 2)
 #define IMAGE_LOWPOWER_IDX(n)			((n) - 1)
-
+#define SYSTEM_SUSPEND_DELAY_MS			5000
 #define FUEL_GAUGE_POLL_MS			1000
 
 #define LED_CHARGING_NAME			"battery_charging"
@@ -59,7 +59,8 @@ struct charge_animation_priv {
 	int image_num;
 
 	int auto_wakeup_key_state;
-	ulong auto_screen_off_timeout;
+	ulong auto_screen_off_timeout;	/* ms */
+	ulong suspend_delay_timeout;	/* ms */
 };
 
 /*
@@ -170,7 +171,7 @@ static int check_key_press(struct udevice *dev)
  * period timer is useless.
  */
 #ifndef CONFIG_IRQ
-static int system_suspend_enter(struct charge_animation_pdata *pdata)
+static int system_suspend_enter(struct udevice *dev)
 {
 	return 0;
 }
@@ -179,8 +180,23 @@ static void autowakeup_timer_init(struct udevice *dev, uint32_t seconds) {}
 static void autowakeup_timer_uninit(void) {}
 
 #else
-static int system_suspend_enter(struct charge_animation_pdata *pdata)
+static int system_suspend_enter(struct udevice *dev)
 {
+	struct charge_animation_pdata *pdata = dev_get_platdata(dev);
+	struct charge_animation_priv *priv = dev_get_priv(dev);
+
+	/*
+	 * When cpu is in wfi and we try to give a long key press event without
+	 * key release, cpu would wakeup and enter wfi again immediately. So
+	 * here is the problem: cpu can only wakeup when long key released.
+	 *
+	 * Actually, we want cpu can detect long key event without key release,
+	 * so we give a suspend delay timeout for cpu to detect this.
+	 */
+	if (priv->suspend_delay_timeout &&
+	    get_timer(priv->suspend_delay_timeout) <= SYSTEM_SUSPEND_DELAY_MS)
+		return 0;
+
 	if (pdata->system_suspend && IS_ENABLED(CONFIG_ARM_SMCCC)) {
 		printf("\nSystem suspend: ");
 		putc('0');
@@ -209,8 +225,11 @@ static int system_suspend_enter(struct charge_animation_pdata *pdata)
 	} else {
 		printf("\nWfi\n");
 		wfi();
+		putc('1');
 	}
 
+	priv->suspend_delay_timeout = get_timer(0);
+
 	/*
 	 * We must wait for key release event finish, otherwise
 	 * we may read key state too early.
@@ -362,7 +381,7 @@ static int charge_extrem_low_power(struct udevice *dev)
 		       pdata->low_power_voltage, voltage);
 
 		/* System suspend */
-		system_suspend_enter(pdata);
+		system_suspend_enter(dev);
 
 		/* Update voltage */
 		voltage = fuel_gauge_get_voltage(fg);
@@ -629,8 +648,7 @@ show_images:
 				priv->auto_screen_off_timeout = get_timer(0);
 		} else {
 			priv->auto_screen_off_timeout = 0;
-
-			system_suspend_enter(pdata);
+			system_suspend_enter(dev);
 		}
 
 		mdelay(5);
@@ -673,14 +691,19 @@ show_images:
 			if (screen_on) {
 				charge_show_bmp(NULL); /* Turn off screen */
 				screen_on = false;
+				priv->suspend_delay_timeout = get_timer(0);
 			} else {
 				screen_on = true;
 			}
+
+			printf("screen %s\n", screen_on ? "on" : "off");
 		} else if (key_state == KEY_PRESS_LONG_DOWN) {
 			/* Set screen_on=true anyway when key long pressed */
 			if (!screen_on)
 				screen_on = true;
 
+			printf("screen %s\n", screen_on ? "on" : "off");
+
 			/* Is able to boot now ? */
 			if (soc < pdata->exit_charge_level) {
 				printf("soc=%d%%, threshold soc=%d%%\n",
diff --git a/drivers/power/dvfs/dvfs-uclass.c b/drivers/power/dvfs/dvfs-uclass.c
index abd04dcb5e..64778aaa8e 100644
--- a/drivers/power/dvfs/dvfs-uclass.c
+++ b/drivers/power/dvfs/dvfs-uclass.c
@@ -34,7 +34,8 @@ int dvfs_init(bool apply)
 
 	ret = uclass_get_device(UCLASS_DVFS, 0, &dev);
 	if (ret) {
-		printf("DVFS: Get dvfs device failed, ret=%d\n", ret);
+		if (ret != -ENODEV)
+			printf("DVFS: Get dvfs device failed, ret=%d\n", ret);
 		return ret;
 	}
 
diff --git a/drivers/power/fuel_gauge/fg_rk817.c b/drivers/power/fuel_gauge/fg_rk817.c
index 57ff70e5ec..86eaf93772 100644
--- a/drivers/power/fuel_gauge/fg_rk817.c
+++ b/drivers/power/fuel_gauge/fg_rk817.c
@@ -406,9 +406,10 @@ static int rk817_bat_get_battery_voltage(struct rk817_battery_device *battery)
 	val |= rk817_bat_read(battery, BAT_VOL_L) << 0;
 
 	vol = battery->voltage_k * val / 1000 + battery->voltage_b;
-	vol_temp = (vol * battery->bat_res_up / battery->bat_res_down + vol);
-	vol = vol_temp;
-
+	if (battery->variant == RK809_ID) {
+		vol_temp = (vol * battery->bat_res_up / battery->bat_res_down + vol);
+		vol = vol_temp;
+	}
 	return vol;
 }
 
diff --git a/drivers/power/pmic/rk8xx.c b/drivers/power/pmic/rk8xx.c
index 02ea363e1a..1e5f45bfc0 100644
--- a/drivers/power/pmic/rk8xx.c
+++ b/drivers/power/pmic/rk8xx.c
@@ -13,17 +13,21 @@
 
 DECLARE_GLOBAL_DATA_PTR;
 
+static struct reg_data rk817_init_reg[] = {
+/* enable the under-voltage protection,
+ * the under-voltage protection will shutdown the LDO3 and reset the PMIC
+ */
+	{ RK817_BUCK4_CMIN, 0x60, 0x60},
 /*
  * Only when system suspend while U-Boot charge needs this config support
  */
 #ifdef CONFIG_DM_CHARGE_DISPLAY
-static struct reg_data rk817_init_reg[] = {
 	/* Set pmic_sleep as sleep function */
 	{ RK817_PMIC_SYS_CFG3, 0x08, 0x18 },
 	/* Set pmic_int active low */
 	{ RK817_GPIO_INT_CFG,  0x00, 0x02 },
-};
 #endif
+};
 
 static const struct pmic_child_info pmic_children_info[] = {
 	{ .prefix = "DCDC", .driver = "rk8xx_buck"},
@@ -213,10 +217,8 @@ static int rk8xx_probe(struct udevice *dev)
 	case RK817_ID:
 		on_source = RK817_ON_SOURCE;
 		off_source = RK817_OFF_SOURCE;
-#ifdef CONFIG_DM_CHARGE_DISPLAY
 		init_data = rk817_init_reg;
 		init_data_num = ARRAY_SIZE(rk817_init_reg);
-#endif
 		power_en0 = pmic_reg_read(dev, RK817_POWER_EN0);
 		power_en1 = pmic_reg_read(dev, RK817_POWER_EN1);
 		power_en2 = pmic_reg_read(dev, RK817_POWER_EN2);
diff --git a/drivers/ram/Kconfig b/drivers/ram/Kconfig
index 2cf8adefb6..3139af0833 100644
--- a/drivers/ram/Kconfig
+++ b/drivers/ram/Kconfig
@@ -41,7 +41,7 @@ config DM_RAMDISK
           This enables the Ramdisk uclass support. These appear as block devices
           in U-Boot.
 
-config RAMDISK_READONLY
+config RAMDISK_RO
         bool "Enable read only ramdisk support"
         depends on DM_RAMDISK
         help
diff --git a/drivers/ram/Makefile b/drivers/ram/Makefile
index 9d6abb0cfa..b4dd4d3293 100644
--- a/drivers/ram/Makefile
+++ b/drivers/ram/Makefile
@@ -11,4 +11,4 @@ obj-$(CONFIG_ARCH_BMIPS) += bmips_ram.o
 
 obj-$(CONFIG_ARCH_ROCKCHIP) += rockchip/
 obj-$(CONFIG_DM_RAMDISK) += ramdisk-uclass.o
-obj-$(CONFIG_RAMDISK_READONLY) += ramdisk_readonly.o
+obj-$(CONFIG_RAMDISK_RO) += ramdisk_ro.o
diff --git a/drivers/ram/ramdisk_readonly.c b/drivers/ram/ramdisk_ro.c
index 7f2b3b8c7a..e2f5c29b54 100644
--- a/drivers/ram/ramdisk_readonly.c
+++ b/drivers/ram/ramdisk_ro.c
@@ -12,8 +12,8 @@
 
 DECLARE_GLOBAL_DATA_PTR;
 
-static ulong ramdisk_readonly_bread(struct blk_desc *desc, lbaint_t start,
-				    lbaint_t blkcnt, void *dst)
+static ulong ramdisk_ro_bread(struct blk_desc *desc, lbaint_t start,
+			      lbaint_t blkcnt, void *dst)
 {
 	unsigned long b_size, b_start;
 
@@ -28,7 +28,7 @@ static ulong ramdisk_readonly_bread(struct blk_desc *desc, lbaint_t start,
 	return blkcnt;
 }
 
-static int ramdisk_readonly_bind(struct udevice *dev)
+static int ramdisk_ro_bind(struct udevice *dev)
 {
 	struct udevice *bdev;
 	int ret;
@@ -43,19 +43,19 @@ static int ramdisk_readonly_bind(struct udevice *dev)
 	return 0;
 }
 
-static const struct ramdisk_ops ramdisk_readonly_ops = {
-	.read = ramdisk_readonly_bread,
+static const struct ramdisk_ops ramdisk_ro_ops = {
+	.read = ramdisk_ro_bread,
 };
 
-static const struct udevice_id ramdisk_readonly_ids[] = {
-	{ .compatible = "ramdisk-readonly" },
+static const struct udevice_id ramdisk_ro_ids[] = {
+	{ .compatible = "ramdisk-ro" },
 	{ }
 };
 
-U_BOOT_DRIVER(ramdisk_readonly) = {
-	.name		= "ramdisk-readonly",
+U_BOOT_DRIVER(ramdisk_ro) = {
+	.name		= "ramdisk-ro",
 	.id		= UCLASS_RAMDISK,
-	.ops		= &ramdisk_readonly_ops,
-	.of_match	= ramdisk_readonly_ids,
-	.bind		= ramdisk_readonly_bind,
+	.ops		= &ramdisk_ro_ops,
+	.of_match	= ramdisk_ro_ids,
+	.bind		= ramdisk_ro_bind,
 };
diff --git a/drivers/ram/rockchip/Makefile b/drivers/ram/rockchip/Makefile
index fa2b99d24c..db46f5680f 100644
--- a/drivers/ram/rockchip/Makefile
+++ b/drivers/ram/rockchip/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_ROCKCHIP_RK3399) += sdram_rk3399.o
 obj-$(CONFIG_ROCKCHIP_PX30) += sdram_px30.o sdram_pctl_px30.o sdram_phy_px30.o
 obj-$(CONFIG_ROCKCHIP_PX30) += rockchip_sdram.o
 obj-$(CONFIG_ROCKCHIP_RK1808) = rockchip_sdram.o
+obj-$(CONFIG_ROCKCHIP_RV1108) += rockchip_sdram.o
 obj-$(CONFIG_ROCKCHIP_RK3036) = rockchip_sdram.o
 obj-$(CONFIG_ROCKCHIP_RK3308) = rockchip_sdram.o
 ifeq ($(CONFIG_SPL_BUILD)$(CONFIG_TPL_BUILD),)
diff --git a/drivers/ram/rockchip/rockchip_sdram.c b/drivers/ram/rockchip/rockchip_sdram.c
index 78e15eb142..437e675e30 100644
--- a/drivers/ram/rockchip/rockchip_sdram.c
+++ b/drivers/ram/rockchip/rockchip_sdram.c
@@ -9,6 +9,7 @@
 #include <syscon.h>
 #include <asm/arch/clock.h>
 #include <asm/arch/grf_px30.h>
+#include <asm/arch/grf_rv1108.h>
 #include <asm/arch/grf_rk1808.h>
 #include <asm/arch/grf_rk3036.h>
 #include <asm/arch/grf_rk3308.h>
@@ -28,7 +29,13 @@ static int dmc_probe(struct udevice *dev)
 	struct dram_info *priv = dev_get_priv(dev);
 
 	if (!(gd->flags & GD_FLG_RELOC)) {
-#if defined(CONFIG_ROCKCHIP_RK3036)
+#if defined(CONFIG_ROCKCHIP_RV1108)
+		struct rv1108_grf *grf =
+			syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
+
+		priv->info.size =
+			rockchip_sdram_size((phys_addr_t)&grf->os_reg2);
+#elif defined(CONFIG_ROCKCHIP_RK3036)
 		struct rk3036_grf *grf =
 			syscon_get_first_range(ROCKCHIP_SYSCON_GRF);
 
@@ -81,7 +88,9 @@ static struct ram_ops dmc_ops = {
 };
 
 static const struct udevice_id dmc_ids[] = {
-#if defined(CONFIG_ROCKCHIP_RK3036)
+#if defined(CONFIG_ROCKCHIP_RV1108)
+	{ .compatible = "rockchip,rv1108-dmc" },
+#elif defined(CONFIG_ROCKCHIP_RK3036)
 	{ .compatible = "rockchip,rk3036-dmc" },
 #elif defined(CONFIG_ROCKCHIP_RK3308)
 	{ .compatible = "rockchip,rk3308-dmc" },
diff --git a/drivers/ram/rockchip/sdram_rk3399.c b/drivers/ram/rockchip/sdram_rk3399.c
index 2d1e094c2f..11641468cc 100644
--- a/drivers/ram/rockchip/sdram_rk3399.c
+++ b/drivers/ram/rockchip/sdram_rk3399.c
@@ -1436,6 +1436,9 @@ static int data_training_ca(const struct chan_info *chan, u32 channel,
 	u32 rank = sdram_params->ch[channel].cap_info.rank;
 	u32 rank_mask;
 
+	/* clear interrupt,PI_175 PI_INT_ACK:WR:0:17 */
+	writel(0x00003f7c, (&denali_pi[175]));
+
 	if (sdram_params->base.dramtype == LPDDR4)
 		rank_mask = (rank == 1) ? 0x5 : 0xf;
 	else
@@ -1493,6 +1496,9 @@ static int data_training_wl(const struct chan_info *chan, u32 channel,
 	u32 obs_0, obs_1, obs_2, obs_3, obs_err = 0;
 	u32 rank = sdram_params->ch[channel].cap_info.rank;
 
+	/* clear interrupt,PI_175 PI_INT_ACK:WR:0:17 */
+	writel(0x00003f7c, (&denali_pi[175]));
+
 	for (i = 0; i < rank; i++) {
 		select_per_cs_training_index(chan, i);
 		/* PI_60 PI_WRLVL_EN:RW:8:2 */
@@ -1549,6 +1555,9 @@ static int data_training_rg(const struct chan_info *chan, u32 channel,
 	u32 obs_0, obs_1, obs_2, obs_3, obs_err = 0;
 	u32 rank = sdram_params->ch[channel].cap_info.rank;
 
+	/* clear interrupt,PI_175 PI_INT_ACK:WR:0:17 */
+	writel(0x00003f7c, (&denali_pi[175]));
+
 	for (i = 0; i < rank; i++) {
 		select_per_cs_training_index(chan, i);
 		/* PI_80 PI_RDLVL_GATE_EN:RW:24:2 */
@@ -1604,6 +1613,9 @@ static int data_training_rl(const struct chan_info *chan, u32 channel,
 	u32 i, tmp;
 	u32 rank = sdram_params->ch[channel].cap_info.rank;
 
+	/* clear interrupt,PI_175 PI_INT_ACK:WR:0:17 */
+	writel(0x00003f7c, (&denali_pi[175]));
+
 	for (i = 0; i < rank; i++) {
 		select_per_cs_training_index(chan, i);
 		/* PI_80 PI_RDLVL_EN:RW:16:2 */
@@ -1646,6 +1658,9 @@ static int data_training_wdql(const struct chan_info *chan, u32 channel,
 	u32 rank = sdram_params->ch[channel].cap_info.rank;
 	u32 rank_mask;
 
+	/* clear interrupt,PI_175 PI_INT_ACK:WR:0:17 */
+	writel(0x00003f7c, (&denali_pi[175]));
+
 	if (sdram_params->base.dramtype == LPDDR4)
 		rank_mask = (rank == 1) ? 0x5 : 0xf;
 	else
diff --git a/drivers/ram/rockchip/sdram_rv1108.c b/drivers/ram/rockchip/sdram_rv1108.c
index d8851adf79..696e24838c 100644
--- a/drivers/ram/rockchip/sdram_rv1108.c
+++ b/drivers/ram/rockchip/sdram_rv1108.c
@@ -112,9 +112,21 @@ void *get_base_addr(unsigned int *reg, unsigned int offset)
 	return (void *)p;
 }
 
+void get_ddr_param(struct dram_info *sdram_priv,
+		   struct ddr_param *ddr_param)
+{
+	size_t ram_size =
+		rockchip_sdram_size((phys_addr_t)&sdram_priv->grf->os_reg2);
+
+	ddr_param->count = 1;
+	ddr_param->para[0] = CONFIG_SYS_SDRAM_BASE;
+	ddr_param->para[1] = ram_size;
+}
+
 int sdram_init(void)
 {
 	int ret;
+	struct ddr_param ddr_param;
 	struct dram_info *sdram_priv = &info;
 	struct driver_info *info =
 		ll_entry_start(struct driver_info, driver_info);
@@ -136,5 +148,8 @@ int sdram_init(void)
 	if (ret)
 		debug("rv1108_sdram_init() fail!");
 
+	get_ddr_param(sdram_priv, &ddr_param);
+	rockchip_setup_ddr_param(&ddr_param);
+
 	return ret;
 }
diff --git a/drivers/rkflash/flash.c b/drivers/rkflash/flash.c
index 71ed9694ad..835efe7f51 100644
--- a/drivers/rkflash/flash.c
+++ b/drivers/rkflash/flash.c
@@ -20,6 +20,7 @@ static u8 g_nand_max_die;
 static u16 g_totle_block;
 static u8 g_nand_flash_ecc_bits;
 static u8 g_nand_idb_res_blk_num;
+static u8 g_nand_ecc_en;
 
 static struct NAND_PARA_INFO_T nand_para = {
 	2,
@@ -145,9 +146,28 @@ static void flash_read_random_dataout_cmd(u8 cs, u32 col_addr)
 	nandc_writel(READ_DP_OUT_CMD & 0x00ff, NANDC_CHIP_CMD(cs));
 }
 
+static u32 flash_read_ecc(u8 cs)
+{
+	u32 ecc0, ecc1;
+
+	nandc_writel(READ_ECC_STATUS_CMD, NANDC_CHIP_CMD(cs));
+	nandc_delayns(80);
+	ecc0 = nandc_readl(NANDC_CHIP_DATA(cs)) & 0xF;
+	ecc1 = nandc_readl(NANDC_CHIP_DATA(cs)) & 0xF;
+	if (ecc1 > ecc0)
+		ecc0 = ecc1;
+	ecc1 = nandc_readl(NANDC_CHIP_DATA(cs)) & 0xF;
+	if (ecc1 > ecc0)
+		ecc0 = ecc1;
+	ecc1 = nandc_readl(NANDC_CHIP_DATA(cs)) & 0xF;
+	if (ecc1 > ecc0)
+		ecc0 = ecc1;
+
+	return ecc0;
+}
+
 static u32 flash_read_page_raw(u8 cs, u32 page_addr, u32 *p_data, u32 *p_spare)
 {
-	u32 ret = 0;
 	u32 error_ecc_bits;
 	u32 sec_per_page = nand_para.sec_per_page;
 
@@ -160,34 +180,53 @@ static u32 flash_read_page_raw(u8 cs, u32 page_addr, u32 *p_data, u32 *p_spare)
 
 	error_ecc_bits = nandc_xfer_data(cs, NANDC_READ, sec_per_page,
 					 p_data, p_spare);
-	if (error_ecc_bits > 2) {
-		PRINT_NANDC_E("FlashReadRawPage %x %x error_ecc_bits %d\n",
-			      cs, page_addr, error_ecc_bits);
+	/*
+	if (error_ecc_bits > 12) {
+		PRINT_NANDC_E("%s %x %x error_ecc_bits %d\n",
+			      __func__, cs, page_addr, error_ecc_bits);
 		if (p_data)
-			PRINT_NANDC_HEX("data:", p_data, 4, 8);
+			PRINT_NANDC_HEX("data:", p_data, 4, 2);
 		if (p_spare)
 			PRINT_NANDC_HEX("spare:", p_spare, 4, 2);
 	}
+	*/
 	nandc_flash_de_cs(cs);
 
 	if (error_ecc_bits != NAND_STS_ECC_ERR) {
-		if (error_ecc_bits >= (u32)nand_para.ecc_bits - 3)
-			ret = NAND_STS_REFRESH;
-		else
-			ret = NAND_STS_OK;
+		if (error_ecc_bits >= (u32)nand_para.ecc_bits - 3) {
+			error_ecc_bits = NAND_STS_REFRESH;
+		} else {
+			error_ecc_bits = NAND_STS_OK;
+			if (g_nand_ecc_en) {
+				u32 nand_ecc = flash_read_ecc(cs);
+
+				if (nand_ecc >= 6) {
+					PRINT_NANDC_E("%s nand ecc %x ecc %d\n",
+						      __func__, page_addr, nand_ecc);
+					error_ecc_bits = NAND_STS_REFRESH;
+				}
+			}
+		}
 	}
 
-	return ret;
+	return error_ecc_bits;
 }
 
 static u32 flash_read_page(u8 cs, u32 page_addr, u32 *p_data, u32 *p_spare)
 {
-	u32 ret;
+	u32 ret, i;
 
 	ret = flash_read_page_raw(cs, page_addr, p_data, p_spare);
-	if (ret == NAND_STS_ECC_ERR)
-		ret = flash_read_page_raw(cs, page_addr, p_data, p_spare);
-
+	if (ret == NAND_STS_ECC_ERR) {
+		for (i = 0; i < 50; i++) {
+			ret = flash_read_page_raw(cs, page_addr, p_data, p_spare);
+			if (ret != NAND_STS_ECC_ERR) {
+				ret = NAND_STS_REFRESH;
+				break;
+			}
+		}
+		PRINT_NANDC_E("flash_read_page %x err_ecc %d\n", page_addr, ret);
+	}
 	return ret;
 }
 
@@ -471,6 +510,7 @@ u32 nandc_flash_init(void __iomem *nandc_addr)
 
 	PRINT_NANDC_I("...%s enter...\n", __func__);
 	g_nand_idb_res_blk_num = MAX_IDB_RESERVED_BLOCK;
+	g_nand_ecc_en = 0;
 
 	nandc_init(nandc_addr);
 
@@ -485,11 +525,14 @@ u32 nandc_flash_init(void __iomem *nandc_addr)
 			    id_byte[0][1] != 0xDA &&
 			    id_byte[0][1] != 0xD1 &&
 			    id_byte[0][1] != 0x95 &&
-			    id_byte[0][1] != 0xDC)
+			    id_byte[0][1] != 0xDC &&
+			    id_byte[0][1] != 0x48)
 
 				return FTL_UNSUPPORTED_FLASH;
 		}
 	}
+	if (id_byte[0][0] == 0x98 && (id_byte[0][4] & 0x80))
+		g_nand_ecc_en = 1;
 	nand_para.nand_id[1] = id_byte[0][1];
 	if (id_byte[0][1] == 0xDA) {
 		nand_para.plane_per_die = 2;
@@ -500,12 +543,18 @@ u32 nandc_flash_init(void __iomem *nandc_addr)
 			nand_para.plane_per_die = 2;
 			nand_para.sec_per_page = 8;
 		} else if (id_byte[0][0] == 0x98 && id_byte[0][3] == 0x26) {
-			nand_para.blk_per_plane = 2048;
+			nand_para.blk_per_plane = 1024;
 			nand_para.sec_per_page = 8;
+			nand_para.plane_per_die = 2;
 		} else {
 			nand_para.plane_per_die = 2;
 			nand_para.blk_per_plane = 2048;
 		}
+	} else if (id_byte[0][1] == 0x48) {
+		nand_para.sec_per_page = 8;
+		nand_para.page_per_blk = 128;
+		nand_para.plane_per_die = 2;
+		nand_para.blk_per_plane = 2048;
 	}
 	flash_die_info_init();
 	flash_bch_sel(nand_para.ecc_bits);
diff --git a/drivers/rkflash/flash.h b/drivers/rkflash/flash.h
index abc3fe14da..92e9878030 100644
--- a/drivers/rkflash/flash.h
+++ b/drivers/rkflash/flash.h
@@ -42,6 +42,7 @@
 #define BLOCK_ERASE_CMD		0x60d0
 #define READ_CMD		0x0030
 #define READ_DP_OUT_CMD		0x05E0
+#define READ_ECC_STATUS_CMD	0x7A
 
 #define SAMSUNG			0x00	/* SAMSUNG */
 #define TOSHIBA			0x01	/* TOSHIBA */
diff --git a/drivers/rkflash/flash_com.h b/drivers/rkflash/flash_com.h
index 71055797c8..b60875d382 100644
--- a/drivers/rkflash/flash_com.h
+++ b/drivers/rkflash/flash_com.h
@@ -17,6 +17,11 @@
 #define NAND_STS_EMPTY                  512	/* page is not proged */
 #define NAND_STS_ECC_ERR                NAND_ERROR
 
+#define NAND_IDB_START    64 /* 32 KB*/
+#define NAND_IDB_SIZE    512 /* 256 KB*/
+#define NAND_IDB_END    NAND_IDB_START + NAND_IDB_SIZE - 1
+#define DEFAULT_IDB_RESERVED_BLOCK	16
+
 #define FULL_SLC			0
 #define SLC				1
 
diff --git a/drivers/rkflash/rk_sftl_arm_v7.S b/drivers/rkflash/rk_sftl_arm_v7.S
index 294e85db8e..ddde4a609f 100644
--- a/drivers/rkflash/rk_sftl_arm_v7.S
+++ b/drivers/rkflash/rk_sftl_arm_v7.S
@@ -2,7 +2,7 @@
  * Copyright (c) 2018 Fuzhou Rockchip Electronics Co., Ltd
  *
  * SPDX-License-Identifier:    GPL-2.0
- * date: 2018-12-27
+ * date: 2019-02-20
  */
 	.arch armv7-a
 	.eabi_attribute 20, 1
@@ -812,126 +812,100 @@ IsInFreeQueue:
 	.fpu softvfp
 	.type	insert_data_list, %function
 insert_data_list:
-	@ args = 0, pretend = 0, frame = 16
+	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
-	ldr	r3, .L100
-	ldrh	lr, [r3]
-	cmp	lr, r0
+	ldr	r3, .L99
+	push	{r4, r5, r6, r7, r8, r10, fp, lr}
+	ldrh	r8, [r3]
+	cmp	r8, r0
 	bls	.L86
-	ldr	r3, .L100+4
+	ldr	r3, .L99+4
 	movs	r5, #6
+	muls	r5, r0, r5
 	ldr	r4, [r3]
-	mul	r3, r5, r0
-	str	r3, [sp, #4]
-	adds	r1, r4, r3
-	ldr	r2, [sp, #4]
 	movw	r3, #65535
+	adds	r1, r4, r5
 	strh	r3, [r1, #2]	@ movhi
-	strh	r3, [r4, r2]	@ movhi
-	ldr	r3, .L100+8
+	strh	r3, [r4, r5]	@ movhi
+	ldr	r3, .L99+8
 	ldr	ip, [r3]
 	cmp	ip, #0
 	bne	.L87
-.L99:
+.L98:
 	str	r1, [r3]
 .L86:
 	movs	r0, #0
-	add	sp, sp, #16
-	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
 .L87:
-	ldr	r3, .L100+12
-	lsls	r2, r0, #1
-	ldr	r3, [r3]
-	str	r3, [sp, #8]
-	ldrh	r6, [r3, r0, lsl #1]
-	ldrh	r3, [r1, #4]
-	cbz	r3, .L97
-	mul	fp, r3, r6
+	ldr	r3, .L99+12
+	ldrh	r6, [r1, #4]
+	ldr	r10, [r3]
+	ldrh	r3, [r10, r0, lsl #1]
+	cbz	r6, .L94
+	muls	r6, r3, r6
 .L88:
-	sub	r3, ip, r4
-	asrs	r6, r3, #1
-	ldr	r3, .L100+16
-	muls	r3, r6, r3
-	ldr	r6, .L100+20
-	ldr	r8, [r6]
-	movs	r6, #0
-	uxth	r3, r3
-	add	r2, r8, r2
-	str	r2, [sp, #12]
-	mov	r2, ip
-.L95:
-	adds	r6, r6, #1
-	uxth	r6, r6
-	cmp	lr, r6
+	sub	r2, ip, r4
+	movs	r7, #0
+	asrs	r3, r2, #1
+	ldr	r2, .L99+16
+	muls	r2, r3, r2
+	mov	r3, ip
+	uxth	r2, r2
+.L92:
+	adds	r7, r7, #1
+	uxth	r7, r7
+	cmp	r8, r7
 	bcc	.L86
-	cmp	r3, r0
+	cmp	r2, r0
 	beq	.L86
-	ldr	r7, [sp, #8]
-	lsl	r10, r3, #1
-	ldrh	r7, [r7, r3, lsl #1]
-	mov	r5, r7
-	ldrh	r7, [r2, #4]
-	cbz	r7, .L98
-	muls	r7, r5, r7
-.L90:
-	cmp	fp, r7
+	ldrh	lr, [r3, #4]
+	cmp	lr, #0
+	beq	.L90
+	ldrh	fp, [r10, r2, lsl #1]
+	mul	lr, lr, fp
+	cmp	r6, lr
+	bls	.L90
+	ldrh	lr, [r3]
+	movw	fp, #65535
+	cmp	lr, fp
 	bne	.L91
-	ldr	r5, [sp, #12]
-	ldrh	r10, [r8, r10]
-	ldrh	r7, [r5]
-	cmp	r10, r7
-	bcc	.L93
-.L92:
-	ldr	r5, [sp, #4]
-	cmp	r2, ip
-	strh	r3, [r4, r5]	@ movhi
-	ldrh	r3, [r2, #2]
-	strh	r3, [r1, #2]	@ movhi
-	bne	.L96
-	strh	r0, [r2, #2]	@ movhi
-	ldr	r3, .L100+8
-	b	.L99
-.L97:
-	mov	fp, #-1
+	strh	r2, [r1, #2]	@ movhi
+	strh	r0, [r3]	@ movhi
+	ldr	r3, .L99+20
+	b	.L98
+.L94:
+	mov	r6, #-1
 	b	.L88
-.L98:
-	mov	r7, #-1
-	b	.L90
 .L91:
-	bcc	.L92
-.L93:
-	ldrh	r7, [r2]
-	movw	r5, #65535
-	cmp	r7, r5
-	bne	.L94
-	strh	r3, [r1, #2]	@ movhi
-	strh	r0, [r2]	@ movhi
-	ldr	r3, .L100+24
-	b	.L99
-.L94:
 	movs	r3, #6
-	mla	r2, r3, r7, r4
-	mov	r3, r7
-	b	.L95
-.L96:
-	ldrh	r1, [r2, #2]
-	movs	r3, #6
-	muls	r3, r1, r3
-	strh	r0, [r4, r3]	@ movhi
-	strh	r0, [r2, #2]	@ movhi
+	mov	r2, lr
+	mla	r3, r3, lr, r4
+	b	.L92
+.L90:
+	strh	r2, [r4, r5]	@ movhi
+	cmp	r3, ip
+	ldrh	r2, [r3, #2]
+	strh	r2, [r1, #2]	@ movhi
+	bne	.L93
+	strh	r0, [r3, #2]	@ movhi
+	ldr	r3, .L99+8
+	b	.L98
+.L93:
+	ldrh	r1, [r3, #2]
+	movs	r2, #6
+	muls	r2, r1, r2
+	strh	r0, [r4, r2]	@ movhi
+	strh	r0, [r3, #2]	@ movhi
 	b	.L86
-.L101:
-	.align	2
 .L100:
+	.align	2
+.L99:
 	.word	.LANCHOR5
 	.word	.LANCHOR40
 	.word	.LANCHOR41
 	.word	.LANCHOR42
 	.word	-1431655765
 	.word	.LANCHOR43
-	.word	.LANCHOR44
 	.size	insert_data_list, .-insert_data_list
 	.section	.text.INSERT_DATA_LIST,"ax",%progbits
 	.align	1
@@ -946,28 +920,28 @@ INSERT_DATA_LIST:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, lr}
 	bl	insert_data_list
-	ldr	r2, .L104
+	ldr	r2, .L103
 	ldrh	r3, [r2]
 	adds	r3, r3, #1
 	uxth	r3, r3
 	strh	r3, [r2]	@ movhi
-	ldr	r2, .L104+4
+	ldr	r2, .L103+4
 	ldrh	r2, [r2]
 	cmp	r2, r3
-	bcs	.L102
+	bcs	.L101
 	movs	r2, #214
-	ldr	r1, .L104+8
-	ldr	r0, .L104+12
+	ldr	r1, .L103+8
+	ldr	r0, .L103+12
 	pop	{r3, lr}
 	b	printf
-.L102:
+.L101:
 	pop	{r3, pc}
-.L105:
-	.align	2
 .L104:
-	.word	.LANCHOR45
+	.align	2
+.L103:
+	.word	.LANCHOR44
 	.word	.LANCHOR5
-	.word	.LANCHOR46
+	.word	.LANCHOR45
 	.word	.LC1
 	.size	INSERT_DATA_LIST, .-INSERT_DATA_LIST
 	.section	.text.insert_free_list,"ax",%progbits
@@ -984,48 +958,48 @@ insert_free_list:
 	movw	r1, #65535
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	cmp	r0, r1
-	beq	.L107
-	ldr	r3, .L113
+	beq	.L106
+	ldr	r3, .L112
 	mov	r10, #6
 	mul	r7, r10, r0
 	ldr	r4, [r3]
-	ldr	r3, .L113+4
+	ldr	r3, .L112+4
 	adds	r5, r4, r7
 	ldr	r6, [r3]
 	mov	lr, r3
 	strh	r1, [r5, #2]	@ movhi
 	strh	r1, [r4, r7]	@ movhi
-	cbnz	r6, .L108
+	cbnz	r6, .L107
 	str	r5, [r3]
-.L107:
+.L106:
 	movs	r0, #0
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L108:
-	ldr	r3, .L113+8
+.L107:
+	ldr	r3, .L112+8
 	subs	r2, r6, r4
 	mov	fp, r1
 	ldr	ip, [r3]
 	asrs	r3, r2, #1
-	ldr	r2, .L113+12
+	ldr	r2, .L112+12
 	ldrh	r8, [ip, r0, lsl #1]
 	muls	r2, r3, r2
 	mov	r3, r6
 	uxth	r2, r2
-.L111:
+.L110:
 	ldrh	r1, [ip, r2, lsl #1]
 	cmp	r1, r8
-	bcs	.L109
+	bcs	.L108
 	ldrh	r1, [r3]
 	cmp	r1, fp
-	bne	.L110
+	bne	.L109
 	strh	r2, [r5, #2]	@ movhi
 	strh	r0, [r3]	@ movhi
-	b	.L107
-.L110:
+	b	.L106
+.L109:
 	mla	r3, r10, r1, r4
 	mov	r2, r1
-	b	.L111
-.L109:
+	b	.L110
+.L108:
 	ldrh	r1, [r3, #2]
 	cmp	r3, r6
 	strh	r1, [r5, #2]	@ movhi
@@ -1040,13 +1014,13 @@ insert_free_list:
 	itt	ne
 	strhne	r0, [r4, r2]	@ movhi
 	strhne	r0, [r3, #2]	@ movhi
-	b	.L107
-.L114:
-	.align	2
+	b	.L106
 .L113:
+	.align	2
+.L112:
 	.word	.LANCHOR40
+	.word	.LANCHOR46
 	.word	.LANCHOR47
-	.word	.LANCHOR43
 	.word	-1431655765
 	.size	insert_free_list, .-insert_free_list
 	.section	.text.INSERT_FREE_LIST,"ax",%progbits
@@ -1062,25 +1036,25 @@ INSERT_FREE_LIST:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, lr}
 	bl	insert_free_list
-	ldr	r2, .L117
+	ldr	r2, .L116
 	ldrh	r3, [r2]
 	adds	r3, r3, #1
 	uxth	r3, r3
 	strh	r3, [r2]	@ movhi
-	ldr	r2, .L117+4
+	ldr	r2, .L116+4
 	ldrh	r2, [r2]
 	cmp	r2, r3
-	bcs	.L115
+	bcs	.L114
 	movs	r2, #207
-	ldr	r1, .L117+8
-	ldr	r0, .L117+12
+	ldr	r1, .L116+8
+	ldr	r0, .L116+12
 	pop	{r3, lr}
 	b	printf
-.L115:
+.L114:
 	pop	{r3, pc}
-.L118:
-	.align	2
 .L117:
+	.align	2
+.L116:
 	.word	.LANCHOR48
 	.word	.LANCHOR5
 	.word	.LANCHOR49
@@ -1099,7 +1073,7 @@ List_remove_node:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, r7, r8, lr}
 	movs	r6, #6
-	ldr	r5, .L125
+	ldr	r5, .L124
 	muls	r6, r1, r6
 	movw	r3, #65535
 	mov	r8, r0
@@ -1107,20 +1081,20 @@ List_remove_node:
 	adds	r4, r7, r6
 	ldrh	r2, [r4, #2]
 	cmp	r2, r3
-	bne	.L120
+	bne	.L119
 	ldr	r3, [r0]
 	cmp	r4, r3
-	beq	.L120
+	beq	.L119
 	mov	r2, #372
-	ldr	r1, .L125+4
-	ldr	r0, .L125+8
+	ldr	r1, .L124+4
+	ldr	r0, .L124+8
 	bl	printf
-.L120:
+.L119:
 	ldr	r3, [r8]
 	movw	r1, #65535
 	cmp	r4, r3
 	ldrh	r3, [r7, r6]
-	bne	.L121
+	bne	.L120
 	cmp	r3, r1
 	ittee	ne
 	ldrne	r0, [r5]
@@ -1131,24 +1105,24 @@ List_remove_node:
 	mlane	r3, r2, r3, r0
 	strne	r3, [r8]
 	strhne	r1, [r3, #2]	@ movhi
-.L123:
+.L122:
 	movw	r3, #65535
 	movs	r0, #0
 	strh	r3, [r7, r6]	@ movhi
 	strh	r3, [r4, #2]	@ movhi
 	pop	{r4, r5, r6, r7, r8, pc}
-.L121:
+.L120:
 	cmp	r3, r1
 	ldrh	r1, [r4, #2]
-	bne	.L124
+	bne	.L123
 	cmp	r1, r3
-	beq	.L123
+	beq	.L122
 	movs	r2, #6
 	ldr	r0, [r5]
 	muls	r1, r2, r1
 	strh	r3, [r0, r1]	@ movhi
-	b	.L123
-.L124:
+	b	.L122
+.L123:
 	ldr	r0, [r5]
 	movs	r2, #6
 	mla	r5, r2, r3, r0
@@ -1156,10 +1130,10 @@ List_remove_node:
 	ldrh	r1, [r4, #2]
 	muls	r2, r1, r2
 	strh	r3, [r0, r2]	@ movhi
-	b	.L123
-.L126:
-	.align	2
+	b	.L122
 .L125:
+	.align	2
+.L124:
 	.word	.LANCHOR40
 	.word	.LANCHOR50
 	.word	.LC1
@@ -1177,15 +1151,15 @@ List_pop_index_node:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	ldr	r3, [r0]
 	push	{r4, r5, r6, lr}
-	cbz	r3, .L133
-	ldr	r2, .L134
+	cbz	r3, .L132
+	ldr	r2, .L133
 	movw	r5, #65535
 	movs	r6, #6
 	ldr	r2, [r2]
-.L129:
-	cbnz	r1, .L130
-.L132:
-	ldr	r4, .L134+4
+.L128:
+	cbnz	r1, .L129
+.L131:
+	ldr	r4, .L133+4
 	subs	r3, r3, r2
 	asrs	r3, r3, #1
 	muls	r4, r3, r4
@@ -1193,20 +1167,20 @@ List_pop_index_node:
 	bl	List_remove_node
 	uxth	r0, r4
 	pop	{r4, r5, r6, pc}
-.L130:
+.L129:
 	ldrh	r4, [r3]
 	cmp	r4, r5
-	beq	.L132
+	beq	.L131
 	subs	r1, r1, #1
 	mla	r3, r6, r4, r2
 	uxth	r1, r1
-	b	.L129
-.L133:
+	b	.L128
+.L132:
 	movw	r0, #65535
 	pop	{r4, r5, r6, pc}
-.L135:
-	.align	2
 .L134:
+	.align	2
+.L133:
 	.word	.LANCHOR40
 	.word	-1431655765
 	.size	List_pop_index_node, .-List_pop_index_node
@@ -1236,37 +1210,37 @@ List_pop_head_node:
 List_get_gc_head_node:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L143
+	ldr	r3, .L142
 	push	{r4, lr}
 	ldr	r3, [r3]
-	cbz	r3, .L142
-	ldr	r2, .L143+4
+	cbz	r3, .L141
+	ldr	r2, .L142+4
 	movs	r4, #6
 	ldr	r1, [r2]
 	movw	r2, #65535
-.L139:
-	cbz	r0, .L140
+.L138:
+	cbz	r0, .L139
 	ldrh	r3, [r3]
 	cmp	r3, r2
-	bne	.L141
-.L142:
+	bne	.L140
+.L141:
 	movw	r0, #65535
 	pop	{r4, pc}
-.L141:
+.L140:
 	subs	r0, r0, #1
 	mla	r3, r4, r3, r1
 	uxth	r0, r0
-	b	.L139
-.L140:
-	ldr	r0, .L143+8
+	b	.L138
+.L139:
+	ldr	r0, .L142+8
 	subs	r3, r3, r1
 	asrs	r3, r3, #1
 	muls	r3, r0, r3
 	uxth	r0, r3
 	pop	{r4, pc}
-.L144:
-	.align	2
 .L143:
+	.align	2
+.L142:
 	.word	.LANCHOR41
 	.word	.LANCHOR40
 	.word	-1431655765
@@ -1282,61 +1256,61 @@ List_get_gc_head_node:
 List_update_data_list:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L156
+	ldr	r3, .L155
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r4, r0
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	beq	.L147
-	ldr	r3, .L156+4
+	beq	.L146
+	ldr	r3, .L155+4
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	beq	.L147
-	ldr	r3, .L156+8
+	beq	.L146
+	ldr	r3, .L155+8
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	beq	.L147
-	ldr	r7, .L156+12
+	beq	.L146
+	ldr	r7, .L155+12
 	movs	r6, #6
-	ldr	r3, .L156+16
+	ldr	r3, .L155+16
 	muls	r6, r0, r6
 	ldr	fp, [r7]
 	ldr	r3, [r3]
 	add	r10, fp, r6
 	cmp	r10, r3
-	beq	.L147
-	ldr	r3, .L156+20
+	beq	.L146
+	ldr	r3, .L155+20
 	ldrh	r5, [r10, #4]
 	ldr	r2, [r3]
 	mov	r8, r3
 	ldrh	r2, [r2, r0, lsl #1]
 	cmp	r5, #0
-	beq	.L154
+	beq	.L153
 	muls	r5, r2, r5
-.L149:
+.L148:
 	ldrh	r3, [r10, #2]
 	movw	r2, #65535
 	cmp	r3, r2
-	bne	.L150
+	bne	.L149
 	ldrh	r2, [fp, r6]
 	cmp	r2, r3
-	bne	.L150
+	bne	.L149
 	movw	r2, #463
-	ldr	r1, .L156+24
-	ldr	r0, .L156+28
+	ldr	r1, .L155+24
+	ldr	r0, .L155+28
 	bl	printf
-.L150:
+.L149:
 	ldrh	r3, [r10, #2]
 	movw	r2, #65535
 	cmp	r3, r2
-	bne	.L151
+	bne	.L150
 	ldrh	r2, [fp, r6]
 	cmp	r2, r3
-	beq	.L147
-.L151:
+	beq	.L146
+.L150:
 	movs	r2, #6
 	muls	r2, r3, r2
-	ldr	r3, .L156+32
+	ldr	r3, .L155+32
 	asrs	r1, r2, #1
 	muls	r3, r1, r3
 	ldr	r1, [r8]
@@ -1344,39 +1318,39 @@ List_update_data_list:
 	ldr	r1, [r7]
 	add	r2, r2, r1
 	ldrh	r3, [r2, #4]
-	cbz	r3, .L155
+	cbz	r3, .L154
 	muls	r3, r0, r3
-.L152:
+.L151:
 	cmp	r5, r3
-	bcs	.L147
-	ldr	r5, .L156+36
+	bcs	.L146
+	ldr	r5, .L155+36
 	mov	r1, r4
-	ldr	r0, .L156+16
+	ldr	r0, .L155+16
 	bl	List_remove_node
 	ldrh	r3, [r5]
-	cbnz	r3, .L153
+	cbnz	r3, .L152
 	mov	r2, #474
-	ldr	r1, .L156+24
-	ldr	r0, .L156+28
+	ldr	r1, .L155+24
+	ldr	r0, .L155+28
 	bl	printf
-.L153:
+.L152:
 	ldrh	r3, [r5]
 	mov	r0, r4
 	subs	r3, r3, #1
 	strh	r3, [r5]	@ movhi
 	bl	INSERT_DATA_LIST
-.L147:
+.L146:
 	movs	r0, #0
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L154:
+.L153:
 	mov	r5, #-1
-	b	.L149
-.L155:
+	b	.L148
+.L154:
 	mov	r3, #-1
-	b	.L152
-.L157:
-	.align	2
+	b	.L151
 .L156:
+	.align	2
+.L155:
 	.word	.LANCHOR51
 	.word	.LANCHOR52
 	.word	.LANCHOR53
@@ -1386,7 +1360,7 @@ List_update_data_list:
 	.word	.LANCHOR54
 	.word	.LC1
 	.word	-1431655765
-	.word	.LANCHOR45
+	.word	.LANCHOR44
 	.size	List_update_data_list, .-List_update_data_list
 	.section	.text.select_l2p_ram_region,"ax",%progbits
 	.align	1
@@ -1401,79 +1375,79 @@ select_l2p_ram_region:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, r6, r7, lr}
 	movs	r1, #0
-	ldr	r3, .L168
+	ldr	r3, .L167
 	movs	r0, #12
 	movw	r5, #65535
 	ldrh	r2, [r3]
-	ldr	r3, .L168+4
+	ldr	r3, .L167+4
 	ldr	r3, [r3]
-.L159:
+.L158:
 	uxth	r4, r1
 	cmp	r4, r2
-	bcc	.L161
+	bcc	.L160
 	mov	r4, r2
 	movs	r1, #0
 	mov	r6, #-2147483648
 	movs	r7, #12
-.L162:
+.L161:
 	uxth	r5, r1
 	cmp	r5, r2
-	bcc	.L164
+	bcc	.L163
 	cmp	r4, r2
-	bcc	.L160
-	ldr	r1, .L168+8
+	bcc	.L159
+	ldr	r1, .L167+8
 	mov	r4, r2
 	mov	r0, #-1
 	ldrh	r7, [r1]
 	movs	r1, #0
-.L165:
+.L164:
 	uxth	r5, r1
 	cmp	r5, r2
-	bcc	.L167
+	bcc	.L166
 	cmp	r4, r2
-	bcc	.L160
+	bcc	.L159
 	movw	r2, #789
-	ldr	r1, .L168+12
-	ldr	r0, .L168+16
+	ldr	r1, .L167+12
+	ldr	r0, .L167+16
 	bl	printf
-	b	.L160
-.L161:
+	b	.L159
+.L160:
 	adds	r1, r1, #1
 	mla	r6, r0, r1, r3
 	ldrh	r6, [r6, #-12]
 	cmp	r6, r5
-	bne	.L159
-.L160:
+	bne	.L158
+.L159:
 	mov	r0, r4
 	pop	{r3, r4, r5, r6, r7, pc}
-.L164:
+.L163:
 	mla	r0, r7, r1, r3
 	ldr	r0, [r0, #4]
 	cmp	r0, #0
-	blt	.L163
+	blt	.L162
 	cmp	r6, r0
 	itt	hi
 	movhi	r6, r0
 	movhi	r4, r5
-.L163:
+.L162:
 	adds	r1, r1, #1
-	b	.L162
-.L167:
+	b	.L161
+.L166:
 	ldr	r6, [r3, #4]
 	cmp	r0, r6
-	bls	.L166
+	bls	.L165
 	ldrh	ip, [r3]
 	cmp	ip, r7
 	itt	ne
 	movne	r0, r6
 	movne	r4, r5
-.L166:
+.L165:
 	adds	r1, r1, #1
 	adds	r3, r3, #12
-	b	.L165
-.L169:
-	.align	2
+	b	.L164
 .L168:
+	.align	2
+.L167:
 	.word	.LANCHOR33
 	.word	.LANCHOR55
 	.word	.LANCHOR56
@@ -1491,45 +1465,45 @@ select_l2p_ram_region:
 FtlUpdateVaildLpn:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r2, .L180
+	ldr	r2, .L179
 	push	{r4, r5, r6, lr}
 	mov	r1, r2
 	ldrh	r3, [r2]
 	cmp	r3, #4
-	bhi	.L171
-	cbnz	r0, .L171
+	bhi	.L170
+	cbnz	r0, .L170
 	adds	r3, r3, #1
 	strh	r3, [r2]	@ movhi
 	pop	{r4, r5, r6, pc}
-.L171:
+.L170:
 	movs	r3, #0
-	ldr	r0, .L180+4
+	ldr	r0, .L179+4
 	strh	r3, [r1]	@ movhi
 	movw	r6, #65535
-	ldr	r1, .L180+8
+	ldr	r1, .L179+8
 	ldrh	r4, [r0]
 	mov	r0, r3
-	ldr	r2, .L180+12
+	ldr	r2, .L179+12
 	ldr	r1, [r1]
 	str	r3, [r2]
 	add	r4, r1, r4, lsl #1
-.L172:
+.L171:
 	cmp	r1, r4
-	bne	.L174
-	cbz	r3, .L170
+	bne	.L173
+	cbz	r3, .L169
 	str	r0, [r2]
-.L170:
+.L169:
 	pop	{r4, r5, r6, pc}
-.L174:
+.L173:
 	ldrh	r5, [r1], #2
 	cmp	r5, r6
 	itt	ne
 	addne	r0, r0, r5
 	movne	r3, #1
-	b	.L172
-.L181:
-	.align	2
+	b	.L171
 .L180:
+	.align	2
+.L179:
 	.word	.LANCHOR58
 	.word	.LANCHOR5
 	.word	.LANCHOR42
@@ -1548,10 +1522,10 @@ ftl_set_blk_mode:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	@ link register save eliminated.
 	mov	r3, r0
-	cbz	r1, .L183
+	cbz	r1, .L182
 	b	ftl_set_blk_mode.part.6
-.L183:
-	ldr	r2, .L184
+.L182:
+	ldr	r2, .L183
 	lsrs	r0, r0, #5
 	and	r3, r3, #31
 	ldr	r1, [r2]
@@ -1561,9 +1535,9 @@ ftl_set_blk_mode:
 	bic	r2, r2, r3
 	str	r2, [r1, r0, lsl #2]
 	bx	lr
-.L185:
-	.align	2
 .L184:
+	.align	2
+.L183:
 	.word	.LANCHOR1
 	.size	ftl_set_blk_mode, .-ftl_set_blk_mode
 	.section	.text.ftl_get_blk_mode,"ax",%progbits
@@ -1578,7 +1552,7 @@ ftl_get_blk_mode:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	@ link register save eliminated.
-	ldr	r3, .L187
+	ldr	r3, .L186
 	lsrs	r2, r0, #5
 	and	r0, r0, #31
 	ldr	r3, [r3]
@@ -1586,9 +1560,9 @@ ftl_get_blk_mode:
 	lsr	r0, r3, r0
 	and	r0, r0, #1
 	bx	lr
-.L188:
-	.align	2
 .L187:
+	.align	2
+.L186:
 	.word	.LANCHOR1
 	.size	ftl_get_blk_mode, .-ftl_get_blk_mode
 	.section	.text.ftl_sb_update_avl_pages,"ax",%progbits
@@ -1606,14 +1580,14 @@ ftl_sb_update_avl_pages:
 	push	{r4, r5, r6, lr}
 	strh	r3, [r0, #4]	@ movhi
 	movw	r6, #65535
-	ldr	r3, .L196
+	ldr	r3, .L195
 	ldrh	r4, [r3]
 	add	r3, r0, r2, lsl #1
 	adds	r3, r3, #14
-.L190:
+.L189:
 	cmp	r2, r4
-	bcc	.L192
-	ldr	r3, .L196+4
+	bcc	.L191
+	ldr	r3, .L195+4
 	add	r5, r0, #16
 	movw	r6, #65535
 	ldrh	r3, [r3]
@@ -1621,12 +1595,12 @@ ftl_sb_update_avl_pages:
 	subs	r1, r3, r1
 	movs	r3, #0
 	uxth	r1, r1
-.L193:
+.L192:
 	uxth	r2, r3
 	cmp	r4, r2
-	bhi	.L195
+	bhi	.L194
 	pop	{r4, r5, r6, pc}
-.L192:
+.L191:
 	ldrh	r5, [r3, #2]!
 	adds	r2, r2, #1
 	uxth	r2, r2
@@ -1635,8 +1609,8 @@ ftl_sb_update_avl_pages:
 	ldrhne	r5, [r0, #4]
 	addne	r5, r5, #1
 	strhne	r5, [r0, #4]	@ movhi
-	b	.L190
-.L195:
+	b	.L189
+.L194:
 	ldrh	r2, [r5], #2
 	adds	r3, r3, #1
 	cmp	r2, r6
@@ -1644,10 +1618,10 @@ ftl_sb_update_avl_pages:
 	ldrhne	r2, [r0, #4]
 	addne	r2, r2, r1
 	strhne	r2, [r0, #4]	@ movhi
-	b	.L193
-.L197:
-	.align	2
+	b	.L192
 .L196:
+	.align	2
+.L195:
 	.word	.LANCHOR3
 	.word	.LANCHOR19
 	.size	ftl_sb_update_avl_pages, .-ftl_sb_update_avl_pages
@@ -1664,24 +1638,24 @@ FtlSlcSuperblockCheck:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	ldrh	r3, [r0, #4]
 	push	{r4, r5, lr}
-	cbz	r3, .L198
+	cbz	r3, .L197
 	ldrh	r2, [r0]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L198
+	beq	.L197
 	ldrb	r2, [r0, #6]	@ zero_extendqisi2
 	movs	r5, #0
 	adds	r2, r2, #8
 	ldrh	r1, [r0, r2, lsl #1]
-	ldr	r2, .L204
+	ldr	r2, .L203
 	ldrh	r4, [r2]
 	mov	r2, r3
-.L201:
+.L200:
 	cmp	r1, r2
-	beq	.L203
-.L198:
+	beq	.L202
+.L197:
 	pop	{r4, r5, pc}
-.L203:
+.L202:
 	ldrb	r3, [r0, #6]	@ zero_extendqisi2
 	adds	r3, r3, #1
 	uxtb	r3, r3
@@ -1695,10 +1669,10 @@ FtlSlcSuperblockCheck:
 	ldrb	r3, [r0, #6]	@ zero_extendqisi2
 	adds	r3, r3, #8
 	ldrh	r1, [r0, r3, lsl #1]
-	b	.L201
-.L205:
-	.align	2
+	b	.L200
 .L204:
+	.align	2
+.L203:
 	.word	.LANCHOR3
 	.size	FtlSlcSuperblockCheck, .-FtlSlcSuperblockCheck
 	.section	.text.make_superblock,"ax",%progbits
@@ -1718,48 +1692,57 @@ make_superblock:
 	mov	r4, r0
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bcc	.L207
-	movw	r2, #2156
+	bcc	.L206
+	movw	r2, #2148
 	ldr	r1, .L211+4
 	ldr	r0, .L211+8
 	bl	printf
-.L207:
+.L206:
 	ldr	r3, .L211+12
 	add	r6, r4, #16
-	ldr	r10, .L211+20
+	ldr	r10, .L211+24
 	movw	r7, #65535
 	movs	r5, #0
 	ldrh	r8, [r3]
 	strh	r5, [r4, #4]	@ movhi
 	strb	r5, [r4, #7]
-.L208:
+.L207:
 	uxth	r3, r5
+	ldrh	r1, [r4]
 	cmp	r8, r3
-	bhi	.L210
+	bhi	.L209
 	ldr	r2, .L211+16
 	movs	r0, #0
 	ldrb	r3, [r4, #7]	@ zero_extendqisi2
-	strb	r0, [r4, #9]
 	ldrh	r2, [r2]
 	smulbb	r3, r3, r2
 	strh	r3, [r4, #4]	@ movhi
+	movs	r3, #0
+	strb	r3, [r4, #9]
+	ldr	r3, .L211+20
+	ldr	r3, [r3]
+	ldrh	r2, [r3, r1, lsl #1]
+	movw	r3, #10000
+	cmp	r2, r3
+	itt	hi
+	movhi	r3, #1
+	strbhi	r3, [r4, #9]
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L210:
-	ldrh	r1, [r4]
+.L209:
 	ldrb	r0, [r10, r5]	@ zero_extendqisi2
 	bl	V2P_block
 	strh	r7, [r6]	@ movhi
 	mov	fp, r0
 	bl	FtlBbmIsBadBlock
-	cbnz	r0, .L209
+	cbnz	r0, .L208
 	strh	fp, [r6]	@ movhi
 	ldrb	r3, [r4, #7]	@ zero_extendqisi2
 	adds	r3, r3, #1
 	strb	r3, [r4, #7]
-.L209:
+.L208:
 	adds	r5, r5, #1
 	adds	r6, r6, #2
-	b	.L208
+	b	.L207
 .L212:
 	.align	2
 .L211:
@@ -1768,6 +1751,7 @@ make_superblock:
 	.word	.LC1
 	.word	.LANCHOR3
 	.word	.LANCHOR19
+	.word	.LANCHOR47
 	.word	.LANCHOR13
 	.size	make_superblock, .-make_superblock
 	.section	.text.update_multiplier_value,"ax",%progbits
@@ -1858,10 +1842,10 @@ GetFreeBlockMinEraseCount:
 .L225:
 	.align	2
 .L224:
-	.word	.LANCHOR47
+	.word	.LANCHOR46
 	.word	.LANCHOR40
 	.word	-1431655765
-	.word	.LANCHOR43
+	.word	.LANCHOR47
 	.size	GetFreeBlockMinEraseCount, .-GetFreeBlockMinEraseCount
 	.section	.text.GetFreeBlockMaxEraseCount,"ax",%progbits
 	.align	1
@@ -1918,11 +1902,11 @@ GetFreeBlockMaxEraseCount:
 .L235:
 	.align	2
 .L234:
-	.word	.LANCHOR47
+	.word	.LANCHOR46
 	.word	.LANCHOR48
 	.word	.LANCHOR40
 	.word	-1431655765
-	.word	.LANCHOR43
+	.word	.LANCHOR47
 	.size	GetFreeBlockMaxEraseCount, .-GetFreeBlockMaxEraseCount
 	.section	.text.free_data_superblock,"ax",%progbits
 	.align	1
@@ -1969,49 +1953,52 @@ get_new_active_ppa:
 	mov	r4, r0
 	cmp	r2, r3
 	bne	.L241
-	movw	r2, #2786
-	ldr	r1, .L254
-	ldr	r0, .L254+4
+	movw	r2, #2781
+	ldr	r1, .L255
+	ldr	r0, .L255+4
 	bl	printf
 .L241:
-	ldr	r5, .L254+8
+	ldr	r6, .L255+8
 	ldrh	r2, [r4, #2]
-	ldrh	r3, [r5]
+	ldrh	r3, [r6]
 	cmp	r2, r3
 	bne	.L242
-	movw	r2, #2787
-	ldr	r1, .L254
-	ldr	r0, .L254+4
+	movw	r2, #2782
+	ldr	r1, .L255
+	ldr	r0, .L255+4
 	bl	printf
 .L242:
 	ldrh	r3, [r4, #4]
 	cbnz	r3, .L243
-	movw	r2, #2788
-	ldr	r1, .L254
-	ldr	r0, .L254+4
+	movw	r2, #2783
+	ldr	r1, .L255
+	ldr	r0, .L255+4
 	bl	printf
 .L243:
 	ldrb	r2, [r4, #6]	@ zero_extendqisi2
 	movs	r3, #0
 	strb	r3, [r4, #10]
-	movw	r6, #65535
+	movw	r5, #65535
 	adds	r2, r2, #8
 	ldrh	r0, [r4, r2, lsl #1]
-	ldr	r2, .L254+12
+	ldr	r2, .L255+12
 	ldrh	r1, [r2]
 	mov	r2, r3
 .L244:
-	cmp	r0, r6
-	ldrb	r3, [r4, #6]	@ zero_extendqisi2
+	cmp	r0, r5
 	beq	.L246
+	ldrh	r5, [r4, #2]
+	ldrh	r6, [r6]
+	cmp	r5, r6
+	bcs	.L250
 	ldrh	r2, [r4, #4]
-	ldrh	r6, [r4, #2]
+	orr	r5, r5, r0, lsl #10
+	ldrb	r3, [r4, #6]	@ zero_extendqisi2
+	movw	r0, #65535
 	subs	r2, r2, #1
 	uxth	r2, r2
-	orr	r6, r6, r0, lsl #10
-	movw	r0, #65535
 	strh	r2, [r4, #4]	@ movhi
-.L248:
+.L249:
 	adds	r3, r3, #1
 	uxtb	r3, r3
 	cmp	r1, r3
@@ -2023,21 +2010,21 @@ get_new_active_ppa:
 	add	r7, r3, #8
 	ldrh	r7, [r4, r7, lsl #1]
 	cmp	r7, r0
-	beq	.L248
+	beq	.L249
 	strb	r3, [r4, #6]
-	ldrh	r1, [r4, #2]
-	ldrh	r3, [r5]
-	cmp	r1, r3
+	ldrh	r3, [r4, #2]
+	cmp	r3, r6
 	bne	.L240
 	cbz	r2, .L240
-	movw	r2, #2809
-	ldr	r1, .L254
-	ldr	r0, .L254+4
+	movw	r2, #2806
+	ldr	r1, .L255
+	ldr	r0, .L255+4
 	bl	printf
 .L240:
-	mov	r0, r6
+	mov	r0, r5
 	pop	{r3, r4, r5, r6, r7, pc}
 .L246:
+	ldrb	r3, [r4, #6]	@ zero_extendqisi2
 	adds	r3, r3, #1
 	uxtb	r3, r3
 	cmp	r3, r1
@@ -2051,9 +2038,12 @@ get_new_active_ppa:
 	adds	r3, r3, #8
 	ldrh	r0, [r4, r3, lsl #1]
 	b	.L244
-.L255:
+.L250:
+	movw	r5, #65535
+	b	.L240
+.L256:
 	.align	2
-.L254:
+.L255:
 	.word	.LANCHOR61
 	.word	.LC1
 	.word	.LANCHOR19
@@ -2072,54 +2062,54 @@ FtlGcBufInit:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r3, #0
-	ldr	r1, .L261
+	ldr	r1, .L262
 	mov	fp, #1
-	ldr	r2, .L261+4
+	ldr	r2, .L262+4
 	ldr	r5, [r1]
-	ldr	r1, .L261+8
+	ldr	r1, .L262+8
 	str	r3, [r2]
-	ldr	r2, .L261+12
+	ldr	r2, .L262+12
 	mov	r0, r5
 	ldr	r1, [r1]
 	ldrh	r2, [r2]
 	str	r1, [sp, #4]
-	ldr	r1, .L261+16
+	ldr	r1, .L262+16
 	ldrh	r1, [r1]
 	str	r1, [sp]
-	ldr	r1, .L261+20
+	ldr	r1, .L262+20
 	ldr	r10, [r1]
-	ldr	r1, .L261+24
+	ldr	r1, .L262+24
 	ldrh	r7, [r1]
-	ldr	r1, .L261+28
+	ldr	r1, .L262+28
 	ldr	r4, [r1]
 	movs	r1, #12
 	mla	r1, r2, r1, r1
 	adds	r4, r4, #8
 	add	r8, r5, r1
 	mov	r1, r3
-.L257:
+.L258:
 	adds	r0, r0, #12
 	ldr	r6, [sp]
 	cmp	r0, r8
 	add	ip, r3, r7
 	add	r4, r4, #20
 	add	lr, r1, r6
-	bne	.L258
-	ldr	r3, .L261+32
+	bne	.L259
+	ldr	r3, .L262+32
 	mov	lr, #12
 	mov	r8, #0
 	ldr	r0, [r3]
-	ldr	r3, .L261+8
+	ldr	r3, .L262+8
 	ldr	r4, [r3]
-	ldr	r3, .L261+20
+	ldr	r3, .L262+20
 	ldr	ip, [r3]
-.L259:
+.L260:
 	cmp	r2, r0
-	bcc	.L260
+	bcc	.L261
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L258:
+.L259:
 	bic	r1, r1, #3
 	bic	r3, r3, #3
 	mov	r6, r1
@@ -2133,8 +2123,8 @@ FtlGcBufInit:
 	str	r3, [r4, #-16]
 	mov	r3, ip
 	str	r6, [r4, #-20]
-	b	.L257
-.L260:
+	b	.L258
+.L261:
 	ldr	r3, [sp]
 	mul	r10, lr, r2
 	muls	r3, r2, r3
@@ -2149,10 +2139,10 @@ FtlGcBufInit:
 	bic	r3, r3, #3
 	add	r3, r3, ip
 	str	r3, [r1, #4]
-	b	.L259
-.L262:
+	b	.L260
+.L263:
 	.align	2
-.L261:
+.L262:
 	.word	.LANCHOR63
 	.word	.LANCHOR62
 	.word	.LANCHOR64
@@ -2174,41 +2164,41 @@ FtlGcBufInit:
 FtlGcBufFree:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L270
+	ldr	r3, .L271
 	mov	ip, #12
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r4, #0
 	mov	fp, #20
 	mov	lr, r4
 	ldr	r7, [r3]
-	ldr	r3, .L270+4
+	ldr	r3, .L271+4
 	ldr	r5, [r3]
-.L264:
+.L265:
 	uxth	r3, r4
 	cmp	r1, r3
-	bls	.L263
+	bls	.L264
 	mla	r8, fp, r3, r0
 	movs	r2, #0
-.L265:
+.L266:
 	uxth	r3, r2
 	cmp	r7, r3
-	bls	.L266
+	bls	.L267
 	mul	r3, ip, r3
 	ldr	r6, [r8, #8]
 	adds	r2, r2, #1
 	add	r10, r5, r3
 	ldr	r3, [r5, r3]
 	cmp	r3, r6
-	bne	.L265
+	bne	.L266
 	str	lr, [r10, #8]
-.L266:
+.L267:
 	adds	r4, r4, #1
-	b	.L264
-.L263:
+	b	.L265
+.L264:
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L271:
+.L272:
 	.align	2
-.L270:
+.L271:
 	.word	.LANCHOR67
 	.word	.LANCHOR63
 	.size	FtlGcBufFree, .-FtlGcBufFree
@@ -2223,43 +2213,43 @@ FtlGcBufFree:
 FtlGcBufAlloc:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L279
+	ldr	r3, .L280
 	movs	r2, #0
 	push	{r4, r5, r6, r7, r8, r10, lr}
 	mov	ip, #12
 	movs	r7, #1
 	mov	lr, #20
 	ldr	r4, [r3]
-	ldr	r3, .L279+4
+	ldr	r3, .L280+4
 	ldr	r5, [r3]
-.L273:
+.L274:
 	uxth	r8, r2
 	cmp	r1, r8
-	bhi	.L277
+	bhi	.L278
 	pop	{r4, r5, r6, r7, r8, r10, pc}
-.L277:
+.L278:
 	mov	r10, #0
-.L274:
+.L275:
 	uxth	r3, r10
 	cmp	r4, r3
-	bls	.L275
+	bls	.L276
 	mla	r3, ip, r3, r5
 	add	r10, r10, #1
 	ldr	r6, [r3, #8]
 	cmp	r6, #0
-	bne	.L274
+	bne	.L275
 	mla	r8, lr, r8, r0
 	str	r7, [r3, #8]
 	ldr	r6, [r3]
 	ldr	r3, [r3, #4]
 	str	r6, [r8, #8]
 	str	r3, [r8, #12]
-.L275:
+.L276:
 	adds	r2, r2, #1
-	b	.L273
-.L280:
+	b	.L274
+.L281:
 	.align	2
-.L279:
+.L280:
 	.word	.LANCHOR67
 	.word	.LANCHOR63
 	.size	FtlGcBufAlloc, .-FtlGcBufAlloc
@@ -2275,25 +2265,25 @@ IsBlkInGcList:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	@ link register save eliminated.
-	ldr	r3, .L286
-	ldr	r2, .L286+4
+	ldr	r3, .L287
+	ldr	r2, .L287+4
 	ldr	r3, [r3]
 	ldrh	r2, [r2]
 	add	r2, r3, r2, lsl #1
-.L282:
+.L283:
 	cmp	r3, r2
-	bne	.L284
+	bne	.L285
 	movs	r0, #0
 	bx	lr
-.L284:
+.L285:
 	ldrh	r1, [r3], #2
 	cmp	r1, r0
-	bne	.L282
+	bne	.L283
 	movs	r0, #1
 	bx	lr
-.L287:
+.L288:
 	.align	2
-.L286:
+.L287:
 	.word	.LANCHOR68
 	.word	.LANCHOR69
 	.size	IsBlkInGcList, .-IsBlkInGcList
@@ -2310,35 +2300,35 @@ FtlGcUpdatePage:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, r6, r7, lr}
 	mov	r5, r0
-	ldr	r4, .L292
+	ldr	r4, .L293
 	ubfx	r0, r0, #10, #16
 	mov	r6, r1
 	mov	r7, r2
 	bl	P2V_block_in_plane
-	ldr	r3, .L292+4
+	ldr	r3, .L293+4
 	ldrh	r1, [r4]
 	ldr	r2, [r3]
 	movs	r3, #0
-.L289:
+.L290:
 	uxth	ip, r3
 	cmp	ip, r1
-	bcc	.L291
-	bne	.L290
+	bcc	.L292
+	bne	.L291
 	strh	r0, [r2, ip, lsl #1]	@ movhi
 	ldrh	r3, [r4]
 	adds	r3, r3, #1
 	strh	r3, [r4]	@ movhi
-	b	.L290
-.L291:
+	b	.L291
+.L292:
 	adds	r3, r3, #1
 	add	ip, r2, r3, lsl #1
 	ldrh	ip, [ip, #-2]
 	cmp	ip, r0
-	bne	.L289
-.L290:
-	ldr	r2, .L292+8
+	bne	.L290
+.L291:
+	ldr	r2, .L293+8
 	movs	r0, #12
-	ldr	r1, .L292+12
+	ldr	r1, .L293+12
 	ldrh	r3, [r2]
 	ldr	r1, [r1]
 	muls	r0, r3, r0
@@ -2349,9 +2339,9 @@ FtlGcUpdatePage:
 	str	r5, [r1, r0]
 	strh	r3, [r2]	@ movhi
 	pop	{r3, r4, r5, r6, r7, pc}
-.L293:
+.L294:
 	.align	2
-.L292:
+.L293:
 	.word	.LANCHOR69
 	.word	.LANCHOR68
 	.word	.LANCHOR70
@@ -2369,29 +2359,29 @@ FtlGcRefreshBlock:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, lr}
-	ldr	r4, .L297
+	ldr	r4, .L298
 	ldrh	r5, [r4]
 	cmp	r5, r0
-	beq	.L295
-	ldr	r3, .L297+4
+	beq	.L296
+	ldr	r3, .L298+4
 	ldrh	r1, [r3]
 	cmp	r0, r1
-	beq	.L295
+	beq	.L296
 	movw	r2, #65535
 	cmp	r5, r2
-	bne	.L296
+	bne	.L297
 	strh	r0, [r4]	@ movhi
-.L295:
+.L296:
 	movs	r0, #0
 	pop	{r4, r5, pc}
-.L296:
+.L297:
 	cmp	r1, r2
 	it	eq
 	strheq	r0, [r3]	@ movhi
-	b	.L295
-.L298:
+	b	.L296
+.L299:
 	.align	2
-.L297:
+.L298:
 	.word	.LANCHOR72
 	.word	.LANCHOR73
 	.size	FtlGcRefreshBlock, .-FtlGcRefreshBlock
@@ -2410,33 +2400,33 @@ FtlGcMarkBadPhyBlk:
 	mov	r4, r0
 	bl	P2V_block_in_plane
 	bl	FtlGcRefreshBlock
-	ldr	r2, .L303
+	ldr	r2, .L304
 	movs	r1, #0
-	ldr	r5, .L303+4
+	ldr	r5, .L304+4
 	ldrh	r3, [r2]
-.L300:
+.L301:
 	uxth	r0, r1
 	cmp	r3, r0
-	bhi	.L302
+	bhi	.L303
 	cmp	r3, #15
 	itttt	ls
 	addls	r1, r3, #1
 	strhls	r1, [r2]	@ movhi
-	ldrls	r2, .L303+4
+	ldrls	r2, .L304+4
 	strhls	r4, [r2, r3, lsl #1]	@ movhi
-	b	.L301
-.L302:
+	b	.L302
+.L303:
 	adds	r1, r1, #1
 	add	r0, r5, r1, lsl #1
 	ldrh	r0, [r0, #-2]
 	cmp	r0, r4
-	bne	.L300
-.L301:
+	bne	.L301
+.L302:
 	movs	r0, #0
 	pop	{r3, r4, r5, pc}
-.L304:
+.L305:
 	.align	2
-.L303:
+.L304:
 	.word	.LANCHOR74
 	.word	.LANCHOR75
 	.size	FtlGcMarkBadPhyBlk, .-FtlGcMarkBadPhyBlk
@@ -2451,22 +2441,22 @@ FtlGcMarkBadPhyBlk:
 FtlGcReFreshBadBlk:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L311
+	ldr	r3, .L312
 	push	{r4, lr}
 	ldrh	r3, [r3]
-	cbz	r3, .L306
-	ldr	r2, .L311+4
+	cbz	r3, .L307
+	ldr	r2, .L312+4
 	ldrh	r1, [r2]
 	movw	r2, #65535
 	cmp	r1, r2
-	bne	.L306
-	ldr	r4, .L311+8
+	bne	.L307
+	ldr	r4, .L312+8
 	ldrh	r2, [r4]
 	cmp	r2, r3
 	itt	cs
 	movcs	r3, #0
 	strhcs	r3, [r4]	@ movhi
-	ldr	r3, .L311+12
+	ldr	r3, .L312+12
 	ldrh	r2, [r4]
 	ldrh	r0, [r3, r2, lsl #1]
 	bl	P2V_block_in_plane
@@ -2474,12 +2464,12 @@ FtlGcReFreshBadBlk:
 	ldrh	r3, [r4]
 	adds	r3, r3, #1
 	strh	r3, [r4]	@ movhi
-.L306:
+.L307:
 	movs	r0, #0
 	pop	{r4, pc}
-.L312:
+.L313:
 	.align	2
-.L311:
+.L312:
 	.word	.LANCHOR74
 	.word	.LANCHOR72
 	.word	.LANCHOR76
@@ -2533,48 +2523,48 @@ rknand_print_hex:
 	mov	r10, r3
 	mov	r5, r6
 	mov	r4, r6
-.L316:
+.L317:
 	cmp	r4, r10
-	bcc	.L322
-	ldr	r0, .L325
+	bcc	.L323
+	ldr	r0, .L326
 	pop	{r4, r5, r6, r7, r8, r10, fp, lr}
 	b	printf
-.L322:
-	cbnz	r5, .L317
+.L323:
+	cbnz	r5, .L318
 	mov	r2, r6
 	mov	r1, fp
-	ldr	r0, .L325+4
+	ldr	r0, .L326+4
 	bl	printf
-.L317:
+.L318:
 	cmp	r8, #4
-	bne	.L318
+	bne	.L319
 	ldr	r1, [r7, r4, lsl #2]
+.L325:
+	ldr	r0, .L326+8
 .L324:
-	ldr	r0, .L325+8
-.L323:
 	adds	r5, r5, #1
 	bl	printf
 	cmp	r5, #15
-	bls	.L321
+	bls	.L322
 	movs	r5, #0
-	ldr	r0, .L325
+	ldr	r0, .L326
 	bl	printf
-.L321:
+.L322:
 	adds	r4, r4, #1
 	add	r6, r6, r8
-	b	.L316
-.L318:
+	b	.L317
+.L319:
 	cmp	r8, #2
-	bne	.L320
+	bne	.L321
 	ldrh	r1, [r7, r4, lsl #1]
-	b	.L324
-.L320:
+	b	.L325
+.L321:
 	ldrb	r1, [r7, r4]	@ zero_extendqisi2
-	ldr	r0, .L325+12
-	b	.L323
-.L326:
+	ldr	r0, .L326+12
+	b	.L324
+.L327:
 	.align	2
-.L325:
+.L326:
 	.word	.LC5
 	.word	.LC2
 	.word	.LC3
@@ -2593,41 +2583,41 @@ FlashEraseBlocks:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r4, r0
-	ldr	r6, .L343
+	ldr	r6, .L344
 	add	r8, r0, #4
 	movs	r7, #0
-	ldr	fp, .L343+20
+	ldr	fp, .L344+20
 	ldrh	r10, [r6, #12]
 	str	r2, [sp]
 	lsl	r3, r10, #3
 	str	r3, [sp, #4]
-.L328:
+.L329:
 	ldr	r3, [sp]
 	cmp	r7, r3
-	beq	.L342
+	beq	.L343
 	add	r2, sp, #8
 	add	r1, sp, #12
 	ldr	r0, [r8]
 	bl	l2p_addr_tran.isra.0
 	ldr	r5, [sp, #8]
-	cbnz	r5, .L329
+	cbnz	r5, .L330
 	ldr	r2, [sp, #12]
 	ldr	r3, [sp, #4]
 	cmp	r3, r2
-	bls	.L329
-	ldr	r6, .L343+4
-	ldr	r7, .L343+8
-.L330:
+	bls	.L330
+	ldr	r6, .L344+4
+	ldr	r7, .L344+8
+.L331:
 	ldr	r3, [sp]
 	adds	r4, r4, #20
 	cmp	r5, r3
-	bne	.L331
-.L342:
+	bne	.L332
+.L343:
 	movs	r0, #0
 	add	sp, sp, #16
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L331:
+.L332:
 	mov	r3, #-1
 	ldr	r2, [sp, #12]
 	str	r3, [r4, #-20]
@@ -2638,44 +2628,44 @@ FlashEraseBlocks:
 	movs	r3, #16
 	movs	r2, #4
 	ldr	r1, [r4, #-12]
-	ldr	r0, .L343+12
+	ldr	r0, .L344+12
 	bl	rknand_print_hex
 	movs	r3, #4
 	ldr	r1, [r4, #-8]
 	mov	r2, r3
-	ldr	r0, .L343+16
+	ldr	r0, .L344+16
 	bl	rknand_print_hex
-	b	.L330
-.L329:
+	b	.L331
+.L330:
 	ldr	r2, [fp, #4]
 	uxtb	r0, r5
 	ldr	r1, [sp, #12]
 	blx	r2
-	cbnz	r0, .L332
+	cbnz	r0, .L333
 	str	r0, [r8, #-4]
-.L333:
+.L334:
 	ldrh	r2, [r6, #14]
 	cmp	r2, #4
-	bne	.L335
+	bne	.L336
 	ldr	r1, [sp, #12]
 	ldr	r2, [fp, #4]
 	ldrb	r0, [sp, #8]	@ zero_extendqisi2
 	add	r1, r1, r10
 	blx	r2
-	cbz	r0, .L335
+	cbz	r0, .L336
 	mov	r2, #-1
 	str	r2, [r8, #-4]
-.L335:
+.L336:
 	adds	r7, r7, #1
 	add	r8, r8, #20
-	b	.L328
-.L332:
+	b	.L329
+.L333:
 	mov	r2, #-1
 	str	r2, [r8, #-4]
-	b	.L333
-.L344:
+	b	.L334
+.L345:
 	.align	2
-.L343:
+.L344:
 	.word	.LANCHOR0
 	.word	.LANCHOR77
 	.word	.LC6
@@ -2700,14 +2690,14 @@ FtlFreeSysBlkQueueIn:
 	push	{r4, r5, r6, lr}
 	mov	r5, r0
 	cmp	r3, r2
-	bhi	.L345
-	ldr	r4, .L354
+	bhi	.L346
+	ldr	r4, .L355
 	ldrh	r3, [r4, #6]
 	cmp	r3, #1024
-	beq	.L345
-	cbz	r1, .L347
+	beq	.L346
+	cbz	r1, .L348
 	bl	P2V_block_in_plane
-	ldr	r3, .L354+4
+	ldr	r3, .L355+4
 	mov	r6, r0
 	movs	r2, #1
 	mov	r1, r2
@@ -2715,16 +2705,16 @@ FtlFreeSysBlkQueueIn:
 	lsls	r3, r5, #10
 	str	r3, [r0, #4]
 	bl	FlashEraseBlocks
-	ldr	r3, .L354+8
+	ldr	r3, .L355+8
 	ldr	r2, [r3]
 	ldrh	r3, [r2, r6, lsl #1]
 	adds	r3, r3, #1
 	strh	r3, [r2, r6, lsl #1]	@ movhi
-	ldr	r2, .L354+12
+	ldr	r2, .L355+12
 	ldr	r3, [r2]
 	adds	r3, r3, #1
 	str	r3, [r2]
-.L347:
+.L348:
 	ldrh	r3, [r4, #6]
 	adds	r3, r3, #1
 	strh	r3, [r4, #6]	@ movhi
@@ -2734,14 +2724,14 @@ FtlFreeSysBlkQueueIn:
 	ubfx	r3, r3, #0, #10
 	strh	r5, [r4, r2, lsl #1]	@ movhi
 	strh	r3, [r4, #4]	@ movhi
-.L345:
+.L346:
 	pop	{r4, r5, r6, pc}
-.L355:
+.L356:
 	.align	2
-.L354:
+.L355:
 	.word	.LANCHOR38
 	.word	.LANCHOR79
-	.word	.LANCHOR43
+	.word	.LANCHOR47
 	.word	.LANCHOR80
 	.size	FtlFreeSysBlkQueueIn, .-FtlFreeSysBlkQueueIn
 	.section	.text.FtlFreeSysBlkQueueOut,"ax",%progbits
@@ -2756,9 +2746,9 @@ FtlFreeSysBlkQueueOut:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
-	ldr	r4, .L361
+	ldr	r4, .L362
 	ldrh	r2, [r4, #6]
-	cbz	r2, .L360
+	cbz	r2, .L361
 	ldrh	r3, [r4, #2]
 	subs	r2, r2, #1
 	strh	r2, [r4, #6]	@ movhi
@@ -2769,36 +2759,36 @@ FtlFreeSysBlkQueueOut:
 	ldrh	r5, [r4, r1, lsl #1]
 	strh	r3, [r4, #2]	@ movhi
 	mov	r1, r2
-	ldr	r3, .L361+4
+	ldr	r3, .L362+4
 	ldr	r0, [r3]
 	lsls	r3, r5, #10
 	str	r3, [r0, #4]
 	bl	FlashEraseBlocks
-	ldr	r2, .L361+8
+	ldr	r2, .L362+8
 	ldr	r3, [r2]
 	adds	r3, r3, #1
 	str	r3, [r2]
-.L357:
+.L358:
 	subs	r3, r5, #1
 	movw	r2, #65533
 	uxth	r3, r3
 	cmp	r3, r2
-	bls	.L358
+	bls	.L359
 	ldrh	r2, [r4, #6]
 	mov	r1, r5
-	ldr	r0, .L361+12
+	ldr	r0, .L362+12
 	bl	printf
-.L359:
-	b	.L359
 .L360:
+	b	.L360
+.L361:
 	movw	r5, #65535
-	b	.L357
-.L358:
+	b	.L358
+.L359:
 	mov	r0, r5
 	pop	{r3, r4, r5, pc}
-.L362:
+.L363:
 	.align	2
-.L361:
+.L362:
 	.word	.LANCHOR38
 	.word	.LANCHOR79
 	.word	.LANCHOR80
@@ -2820,16 +2810,16 @@ ftl_map_blk_alloc_new_blk:
 	push	{r3, r4, r5, r6, r7, lr}
 	mov	r4, r0
 	movs	r3, #0
-.L364:
+.L365:
 	uxth	r5, r3
 	cmp	r5, r1
-	bcs	.L367
+	bcs	.L368
 	mov	r7, r2
 	adds	r3, r3, #1
 	ldrh	r6, [r7]
 	adds	r2, r2, #2
 	cmp	r6, #0
-	bne	.L364
+	bne	.L365
 	bl	FtlFreeSysBlkQueueOut
 	subs	r3, r0, #1
 	movw	r2, #65533
@@ -2837,14 +2827,14 @@ ftl_map_blk_alloc_new_blk:
 	mov	r1, r0
 	strh	r0, [r7]	@ movhi
 	cmp	r3, r2
-	bls	.L365
-	ldr	r3, .L371
-	ldr	r0, .L371+4
+	bls	.L366
+	ldr	r3, .L372
+	ldr	r0, .L372+4
 	ldrh	r2, [r3, #6]
 	bl	printf
+.L367:
+	b	.L367
 .L366:
-	b	.L366
-.L365:
 	ldr	r3, [r4, #28]
 	strh	r6, [r4, #2]	@ movhi
 	strh	r5, [r4]	@ movhi
@@ -2853,20 +2843,20 @@ ftl_map_blk_alloc_new_blk:
 	ldrh	r3, [r4, #8]
 	adds	r3, r3, #1
 	strh	r3, [r4, #8]	@ movhi
-.L367:
+.L368:
 	ldrh	r3, [r4, #10]
 	cmp	r3, r5
-	bhi	.L369
+	bhi	.L370
 	movw	r2, #578
-	ldr	r1, .L371+8
-	ldr	r0, .L371+12
+	ldr	r1, .L372+8
+	ldr	r0, .L372+12
 	bl	printf
-.L369:
+.L370:
 	movs	r0, #0
 	pop	{r3, r4, r5, r6, r7, pc}
-.L372:
+.L373:
 	.align	2
-.L371:
+.L372:
 	.word	.LANCHOR38
 	.word	.LC10
 	.word	.LANCHOR81
@@ -2897,102 +2887,102 @@ ftl_memset:
 FtlMemInit:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L379
+	ldr	r3, .L380
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r4, #0
-	ldr	r2, .L379+4
+	ldr	r2, .L380+4
 	movs	r6, #12
 	str	r4, [r3]
-	ldr	r3, .L379+8
-	ldr	r5, .L379+12
-	ldr	r10, .L379+292
+	ldr	r3, .L380+8
+	ldr	r5, .L380+12
+	ldr	r10, .L380+292
 	str	r4, [r3]
-	ldr	r3, .L379+16
+	ldr	r3, .L380+16
 	ldrh	r0, [r5]
-	ldr	r8, .L379+296
+	ldr	r8, .L380+296
 	str	r4, [r3]
-	ldr	r3, .L379+20
+	ldr	r3, .L380+20
 	lsls	r0, r0, #1
-	ldr	fp, .L379+300
+	ldr	fp, .L380+300
 	str	r4, [r3]
-	ldr	r3, .L379+24
+	ldr	r3, .L380+24
 	str	r4, [r3]
-	ldr	r3, .L379+28
+	ldr	r3, .L380+28
 	str	r4, [r3]
-	ldr	r3, .L379+32
+	ldr	r3, .L380+32
 	str	r4, [r3]
-	ldr	r3, .L379+36
+	ldr	r3, .L380+36
 	str	r4, [r3]
-	ldr	r3, .L379+40
+	ldr	r3, .L380+40
 	str	r4, [r3]
-	ldr	r3, .L379+44
+	ldr	r3, .L380+44
 	str	r4, [r3]
-	ldr	r3, .L379+48
+	ldr	r3, .L380+48
 	str	r4, [r3]
-	ldr	r3, .L379+52
+	ldr	r3, .L380+52
 	str	r4, [r3]
-	ldr	r3, .L379+56
+	ldr	r3, .L380+56
 	str	r4, [r3]
-	ldr	r3, .L379+60
+	ldr	r3, .L380+60
 	str	r4, [r3]
-	ldr	r3, .L379+64
+	ldr	r3, .L380+64
 	str	r4, [r3]
 	movw	r3, #65535
 	str	r3, [r2]
-	ldr	r2, .L379+68
+	ldr	r2, .L380+68
 	str	r4, [r2]
-	ldr	r2, .L379+72
+	ldr	r2, .L380+72
 	str	r4, [r2]
-	ldr	r2, .L379+76
+	ldr	r2, .L380+76
 	str	r4, [r2]
-	ldr	r2, .L379+80
+	ldr	r2, .L380+80
 	strh	r3, [r2]	@ movhi
-	ldr	r2, .L379+84
+	ldr	r2, .L380+84
 	strh	r3, [r2]	@ movhi
 	movs	r2, #32
-	ldr	r3, .L379+88
+	ldr	r3, .L380+88
 	strh	r2, [r3]	@ movhi
 	movs	r2, #128
-	ldr	r3, .L379+92
+	ldr	r3, .L380+92
 	strh	r2, [r3]	@ movhi
-	ldr	r3, .L379+96
+	ldr	r3, .L380+96
 	strh	r4, [r3]	@ movhi
-	ldr	r3, .L379+100
+	ldr	r3, .L380+100
 	strh	r4, [r3]	@ movhi
-	ldr	r3, .L379+104
+	ldr	r3, .L380+104
 	strh	r4, [r3]	@ movhi
 	bl	ftl_malloc
-	ldr	r3, .L379+108
+	ldr	r3, .L380+108
 	str	r0, [r3]
 	ldrh	r0, [r5]
 	movs	r5, #20
 	muls	r0, r6, r0
 	bl	ftl_malloc
-	ldr	r3, .L379+112
+	ldr	r3, .L380+112
 	str	r0, [r3]
 	ldrh	r3, [r10]
 	muls	r5, r3, r5
 	lsls	r7, r5, #2
 	mov	r0, r7
 	bl	ftl_malloc
-	ldr	r3, .L379+116
+	ldr	r3, .L380+116
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+120
+	ldr	r3, .L380+120
 	str	r0, [r3]
 	mov	r0, r7
 	bl	ftl_malloc
-	ldr	r3, .L379+124
-	ldr	r7, .L379+128
+	ldr	r3, .L380+124
+	ldr	r7, .L380+128
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+132
+	ldr	r3, .L380+132
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+136
+	ldr	r3, .L380+136
 	ldrh	r5, [r7]
 	str	r0, [r3]
 	ldrh	r3, [r10]
@@ -3001,166 +2991,166 @@ FtlMemInit:
 	adds	r3, r3, #1
 	str	r3, [r8]
 	bl	ftl_malloc
-	ldr	r3, .L379+140
+	ldr	r3, .L380+140
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+144
+	ldr	r3, .L380+144
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+148
+	ldr	r3, .L380+148
 	str	r0, [r3]
 	ldr	r0, [r8]
 	muls	r0, r5, r0
 	bl	ftl_malloc
-	ldr	r3, .L379+152
+	ldr	r3, .L380+152
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+156
+	ldr	r3, .L380+156
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+160
+	ldr	r3, .L380+160
 	str	r0, [r3]
 	ldr	r0, [r8]
 	muls	r0, r6, r0
 	bl	ftl_malloc
-	ldr	r3, .L379+164
+	ldr	r3, .L380+164
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+168
+	ldr	r3, .L380+168
 	str	r0, [r3]
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+172
+	ldr	r3, .L380+172
 	str	r0, [r3]
-	ldr	r3, .L379+176
+	ldr	r3, .L380+176
 	ldrh	r0, [r3]
 	lsls	r0, r0, #2
 	bl	ftl_malloc
-	ldr	r3, .L379+180
+	ldr	r3, .L380+180
 	ldrh	r5, [r10]
-	ldr	r10, .L379+304
+	ldr	r10, .L380+304
 	str	r0, [r3]
 	ldrh	r3, [fp]
 	muls	r5, r3, r5
 	mov	r0, r5
 	bl	ftl_malloc
-	ldr	r3, .L379+184
+	ldr	r3, .L380+184
 	str	r0, [r3]
 	lsls	r0, r5, #2
-	ldr	r5, .L379+188
+	ldr	r5, .L380+188
 	bl	ftl_malloc
-	ldr	r3, .L379+192
+	ldr	r3, .L380+192
 	str	r0, [r3]
 	ldrh	r3, [fp]
 	ldr	r0, [r8]
-	ldr	r8, .L379+308
+	ldr	r8, .L380+308
 	muls	r0, r3, r0
 	bl	ftl_malloc
-	ldr	r3, .L379+196
+	ldr	r3, .L380+196
 	str	r0, [r3]
 	ldrh	r0, [r5]
 	lsls	r0, r0, #1
 	uxth	r0, r0
 	strh	r0, [r8]	@ movhi
 	bl	ftl_malloc
-	ldr	r3, .L379+200
+	ldr	r3, .L380+200
 	str	r0, [r3]
 	ldrh	r3, [r8]
-	ldr	r0, .L379+204
+	ldr	r0, .L380+204
 	addw	r3, r3, #547
 	lsrs	r3, r3, #9
 	and	r0, r0, r3, lsl #9
 	strh	r3, [r8]	@ movhi
 	bl	ftl_malloc
-	ldr	r3, .L379+208
+	ldr	r3, .L380+208
 	str	r0, [r3]
 	adds	r0, r0, #32
-	ldr	r3, .L379+212
+	ldr	r3, .L380+212
 	str	r0, [r3]
 	ldrh	r0, [r5]
 	lsls	r0, r0, #1
 	bl	ftl_malloc
-	ldr	r3, .L379+216
+	ldr	r3, .L380+216
 	str	r0, [r3]
 	ldr	r3, [r10]
 	lsl	r8, r3, #1
 	mov	r0, r8
 	bl	ftl_malloc
-	ldr	r3, .L379+220
+	ldr	r3, .L380+220
 	str	r0, [r3]
 	mov	r0, r8
 	bl	ftl_malloc
-	ldr	r3, .L379+224
-	ldr	r8, .L379+312
+	ldr	r3, .L380+224
+	ldr	r8, .L380+312
 	str	r0, [r3]
 	ldrh	r0, [r5]
 	lsrs	r0, r0, #3
 	adds	r0, r0, #4
 	bl	ftl_malloc
-	ldr	r3, .L379+228
+	ldr	r3, .L380+228
 	str	r0, [r3]
 	ldrh	r0, [r8]
 	lsls	r0, r0, #1
 	bl	ftl_malloc
-	ldr	r3, .L379+232
+	ldr	r3, .L380+232
 	str	r0, [r3]
 	ldrh	r0, [r8]
 	lsls	r0, r0, #1
 	bl	ftl_malloc
-	ldr	r3, .L379+236
+	ldr	r3, .L380+236
 	str	r0, [r3]
 	ldrh	r0, [r8]
-	ldr	r8, .L379+316
+	ldr	r8, .L380+316
 	lsls	r0, r0, #2
 	bl	ftl_malloc
-	ldr	r3, .L379+240
+	ldr	r3, .L380+240
 	str	r0, [r3]
 	ldrh	r0, [r8]
 	lsls	r0, r0, #2
 	bl	ftl_malloc
 	ldrh	r2, [r8]
 	mov	r1, r4
-	ldr	r3, .L379+244
-	ldr	r4, .L379+248
+	ldr	r3, .L380+244
+	ldr	r4, .L380+248
 	lsls	r2, r2, #2
 	str	r0, [r3]
 	bl	ftl_memset
-	ldr	r3, .L379+252
+	ldr	r3, .L380+252
 	ldrh	r0, [r3]
 	lsls	r0, r0, #2
 	bl	ftl_malloc
-	ldr	r3, .L379+256
+	ldr	r3, .L380+256
 	str	r0, [r3]
 	ldr	r0, [r10]
 	lsls	r0, r0, #2
 	bl	ftl_malloc
-	ldr	r3, .L379+260
+	ldr	r3, .L380+260
 	str	r0, [r3]
 	ldrh	r0, [r4]
 	muls	r0, r6, r0
-	ldr	r6, .L379+264
+	ldr	r6, .L380+264
 	bl	ftl_malloc
-	ldr	r3, .L379+268
+	ldr	r3, .L380+268
 	str	r0, [r3]
 	ldrh	r3, [r4]
 	ldrh	r0, [r7]
 	muls	r0, r3, r0
 	bl	ftl_malloc
-	ldr	r3, .L379+272
+	ldr	r3, .L380+272
 	str	r0, [r3]
 	movs	r0, #6
 	ldrh	r3, [r5]
-	ldr	r5, .L379+276
+	ldr	r5, .L380+276
 	muls	r0, r3, r0
 	bl	ftl_malloc
-	ldr	r3, .L379+280
+	ldr	r3, .L380+280
 	str	r0, [r3]
-	ldr	r3, .L379+284
+	ldr	r3, .L380+284
 	ldrh	r0, [r3]
 	ldrh	r3, [r6]
 	adds	r0, r0, #31
@@ -3171,16 +3161,16 @@ FtlMemInit:
 	bl	ftl_malloc
 	ldrh	r1, [r5]
 	movs	r2, #1
-	ldr	r3, .L379+288
+	ldr	r3, .L380+288
 	ldrh	r6, [r6]
 	lsls	r1, r1, #2
 	mov	r4, r3
 	str	r0, [r4, #28]!
 	mov	r0, r1
-	b	.L380
-.L381:
+	b	.L381
+.L382:
 	.align	2
-.L379:
+.L380:
 	.word	.LANCHOR82
 	.word	.LANCHOR96
 	.word	.LANCHOR83
@@ -3234,7 +3224,7 @@ FtlMemInit:
 	.word	.LANCHOR117
 	.word	33553920
 	.word	.LANCHOR118
-	.word	.LANCHOR43
+	.word	.LANCHOR47
 	.word	.LANCHOR42
 	.word	.LANCHOR119
 	.word	.LANCHOR120
@@ -3261,32 +3251,32 @@ FtlMemInit:
 	.word	.LANCHOR116
 	.word	.LANCHOR27
 	.word	.LANCHOR28
-.L380:
-.L375:
+.L381:
+.L376:
 	cmp	r2, r6
-	bcc	.L376
+	bcc	.L377
 	add	r3, r3, r2, lsl #2
-	ldr	r2, .L382
+	ldr	r2, .L383
 	movs	r1, #0
 	adds	r3, r3, #24
-.L377:
+.L378:
 	cmp	r3, r2
-	bne	.L378
+	bne	.L379
 	movs	r0, #0
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L376:
+.L377:
 	ldr	r5, [r3, #28]
 	adds	r2, r2, #1
 	add	r5, r5, r0
 	add	r0, r0, r1
 	str	r5, [r4, #4]!
-	b	.L375
-.L378:
+	b	.L376
+.L379:
 	str	r1, [r3, #4]!
-	b	.L377
-.L383:
+	b	.L378
+.L384:
 	.align	2
-.L382:
+.L383:
 	.word	.LANCHOR37+56
 	.size	FtlMemInit, .-FtlMemInit
 	.section	.text.FtlBbt2Bitmap,"ax",%progbits
@@ -3300,32 +3290,32 @@ FtlMemInit:
 FtlBbt2Bitmap:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L390
+	ldr	r3, .L391
 	push	{r4, r5, r6, r7, r8, lr}
 	mov	r5, r0
-	ldr	r7, .L390+4
+	ldr	r7, .L391+4
 	mov	r6, r1
 	subs	r4, r5, #2
 	addw	r5, r5, #1022
 	ldrh	r2, [r3]
 	movs	r1, #0
-	ldr	r8, .L390+12
+	ldr	r8, .L391+12
 	mov	r0, r6
 	lsls	r2, r2, #2
 	bl	ftl_memset
-.L387:
+.L388:
 	ldrh	r3, [r4, #2]
 	movw	r2, #65535
 	cmp	r3, r2
-	beq	.L384
+	beq	.L385
 	ldrh	r2, [r7]
 	cmp	r2, r3
-	bhi	.L386
+	bhi	.L387
 	movs	r2, #74
 	mov	r1, r8
-	ldr	r0, .L390+8
+	ldr	r0, .L391+8
 	bl	printf
-.L386:
+.L387:
 	ldrh	r3, [r4, #2]!
 	movs	r2, #1
 	cmp	r5, r4
@@ -3335,12 +3325,12 @@ FtlBbt2Bitmap:
 	ldr	r2, [r6, r1, lsl #2]
 	orr	r2, r2, r3
 	str	r2, [r6, r1, lsl #2]
-	bne	.L387
-.L384:
+	bne	.L388
+.L385:
 	pop	{r4, r5, r6, r7, r8, pc}
-.L391:
+.L392:
 	.align	2
-.L390:
+.L391:
 	.word	.LANCHOR127
 	.word	.LANCHOR17
 	.word	.LC1
@@ -3358,7 +3348,7 @@ FtlBbtMemInit:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	@ link register save eliminated.
-	ldr	r0, .L393
+	ldr	r0, .L394
 	movw	r3, #65535
 	movs	r2, #16
 	movs	r1, #255
@@ -3367,9 +3357,9 @@ FtlBbtMemInit:
 	strh	r3, [r0, #6]	@ movhi
 	adds	r0, r0, #12
 	b	ftl_memset
-.L394:
+.L395:
 	.align	2
-.L393:
+.L394:
 	.word	.LANCHOR37
 	.size	FtlBbtMemInit, .-FtlBbtMemInit
 	.section	.text.FtlFreeSysBlkQueueInit,"ax",%progbits
@@ -3383,7 +3373,7 @@ FtlBbtMemInit:
 FtlFreeSysBlkQueueInit:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L396
+	ldr	r3, .L397
 	mov	r2, #2048
 	push	{r4, lr}
 	movs	r4, #0
@@ -3396,9 +3386,9 @@ FtlFreeSysBlkQueueInit:
 	bl	ftl_memset
 	mov	r0, r4
 	pop	{r4, pc}
-.L397:
+.L398:
 	.align	2
-.L396:
+.L397:
 	.word	.LANCHOR38
 	.size	FtlFreeSysBlkQueueInit, .-FtlFreeSysBlkQueueInit
 	.section	.text.ftl_free_no_use_map_blk,"ax",%progbits
@@ -3423,12 +3413,12 @@ ftl_free_no_use_map_blk:
 	mov	r0, r5
 	bl	ftl_memset
 	movs	r3, #0
-.L399:
+.L400:
 	ldrh	r1, [r4, #6]
 	uxth	r2, r3
 	cmp	r1, r2
-	bhi	.L403
-	ldr	r3, .L418
+	bhi	.L404
+	ldr	r3, .L419
 	movs	r6, #0
 	mov	r10, r6
 	ldrh	r2, [r3]
@@ -3436,59 +3426,59 @@ ftl_free_no_use_map_blk:
 	strh	r2, [r5, r3, lsl #1]	@ movhi
 	mov	r2, r6
 	ldrh	fp, [r5]
-.L404:
+.L405:
 	ldrh	r3, [r4, #10]
 	uxth	ip, r6
 	cmp	r3, ip
-	bhi	.L408
+	bhi	.L409
 	mov	r0, r10
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L403:
+.L404:
 	uxth	r2, r3
 	ldr	r1, [r6, r2, lsl #2]
 	movs	r2, #0
 	ubfx	r1, r1, #10, #16
-.L400:
+.L401:
 	ldrh	ip, [r4, #10]
 	uxth	r0, r2
 	cmp	ip, r0
-	bhi	.L402
+	bhi	.L403
 	adds	r3, r3, #1
-	b	.L399
-.L402:
+	b	.L400
+.L403:
 	uxth	r0, r2
 	ldrh	ip, [r7, r0, lsl #1]
 	cmp	ip, r1
-	bne	.L401
-	cbz	r1, .L401
+	bne	.L402
+	cbz	r1, .L402
 	ldrh	ip, [r5, r0, lsl #1]
 	add	ip, ip, #1
 	strh	ip, [r5, r0, lsl #1]	@ movhi
-.L401:
+.L402:
 	adds	r2, r2, #1
-	b	.L400
-.L408:
+	b	.L401
+.L409:
 	uxth	r1, r6
 	ldrh	r3, [r5, r1, lsl #1]
 	lsl	r8, r1, #1
 	cmp	fp, r3
-	bls	.L405
+	bls	.L406
 	ldrh	r0, [r7, r1, lsl #1]
 	add	r8, r8, r7
-	cbnz	r0, .L406
-.L407:
+	cbnz	r0, .L407
+.L408:
 	adds	r6, r6, #1
-	b	.L404
-.L405:
+	b	.L405
+.L406:
 	cmp	r3, #0
-	bne	.L407
+	bne	.L408
 	ldrh	r0, [r7, r1, lsl #1]
 	add	r8, r8, r7
 	cmp	r0, #0
-	beq	.L407
-.L409:
+	beq	.L408
+.L410:
 	movs	r1, #1
 	str	r2, [sp, #4]
 	bl	FtlFreeSysBlkQueueIn
@@ -3497,16 +3487,16 @@ ftl_free_no_use_map_blk:
 	ldrh	r3, [r4, #8]
 	subs	r3, r3, #1
 	strh	r3, [r4, #8]	@ movhi
-	b	.L407
-.L406:
+	b	.L408
+.L407:
 	mov	r10, ip
 	mov	fp, r3
 	cmp	r3, #0
-	beq	.L409
-	b	.L407
-.L419:
+	beq	.L410
+	b	.L408
+.L420:
 	.align	2
-.L418:
+.L419:
 	.word	.LANCHOR20
 	.size	ftl_free_no_use_map_blk, .-ftl_free_no_use_map_blk
 	.section	.text.FtlL2PDataInit,"ax",%progbits
@@ -3522,14 +3512,14 @@ FtlL2PDataInit:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, r7, r8, lr}
 	movs	r1, #0
-	ldr	r5, .L423
-	ldr	r4, .L423+4
+	ldr	r5, .L424
+	ldr	r4, .L424+4
 	ldr	r2, [r5]
-	ldr	r7, .L423+8
-	ldr	r6, .L423+12
+	ldr	r7, .L424+8
+	ldr	r6, .L424+12
 	ldr	r0, [r4]
 	lsls	r2, r2, #1
-	ldr	r8, .L423+44
+	ldr	r8, .L424+44
 	bl	ftl_memset
 	ldrh	r3, [r7]
 	movs	r1, #255
@@ -3537,7 +3527,7 @@ FtlL2PDataInit:
 	ldr	r0, [r8]
 	muls	r2, r3, r2
 	bl	ftl_memset
-	ldr	r3, .L423+16
+	ldr	r3, .L424+16
 	movw	r0, #65535
 	ldrh	r1, [r6]
 	ldr	ip, [r8]
@@ -3548,47 +3538,47 @@ FtlL2PDataInit:
 	adds	r1, r2, r3
 	movs	r3, #0
 	mov	lr, r3
-.L421:
+.L422:
 	adds	r2, r2, #12
 	adds	r6, r3, r7
 	cmp	r2, r1
-	bne	.L422
-	ldr	r3, .L423+20
+	bne	.L423
+	ldr	r3, .L424+20
 	ldr	r2, [r5]
 	strh	r0, [r3, #2]	@ movhi
 	strh	r2, [r3, #10]	@ movhi
 	movw	r2, #61634
 	strh	r2, [r3, #4]	@ movhi
-	ldr	r2, .L423+24
+	ldr	r2, .L424+24
 	strh	r0, [r3]	@ movhi
 	ldrh	r2, [r2]
 	strh	r2, [r3, #8]	@ movhi
-	ldr	r2, .L423+28
+	ldr	r2, .L424+28
 	ldrh	r2, [r2]
 	strh	r2, [r3, #6]	@ movhi
-	ldr	r2, .L423+32
+	ldr	r2, .L424+32
 	ldr	r2, [r2]
 	str	r2, [r3, #12]
-	ldr	r2, .L423+36
+	ldr	r2, .L424+36
 	ldr	r2, [r2]
 	str	r2, [r3, #16]
 	ldr	r2, [r4]
 	str	r2, [r3, #20]
-	ldr	r2, .L423+40
+	ldr	r2, .L424+40
 	ldr	r2, [r2]
 	str	r2, [r3, #24]
 	pop	{r4, r5, r6, r7, r8, pc}
-.L422:
+.L423:
 	bic	r3, r3, #3
 	str	lr, [r2, #-8]
 	add	r3, r3, ip
 	strh	r0, [r2, #-12]	@ movhi
 	str	r3, [r2, #-4]
 	mov	r3, r6
-	b	.L421
-.L424:
+	b	.L422
+.L425:
 	.align	2
-.L423:
+.L424:
 	.word	.LANCHOR30
 	.word	.LANCHOR120
 	.word	.LANCHOR23
@@ -3615,53 +3605,53 @@ FtlVariablesInit:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	movw	r2, #65535
-	ldr	r3, .L426
+	ldr	r3, .L427
 	movs	r4, #0
 	mov	r1, r4
-	ldr	r5, .L426+4
+	ldr	r5, .L427+4
 	strh	r2, [r3]	@ movhi
 	mov	r2, #-1
-	ldr	r3, .L426+8
+	ldr	r3, .L427+8
 	str	r4, [r3]
-	ldr	r3, .L426+12
+	ldr	r3, .L427+12
 	str	r4, [r3]
-	ldr	r3, .L426+16
+	ldr	r3, .L427+16
 	str	r2, [r3]
-	ldr	r3, .L426+20
+	ldr	r3, .L427+20
 	strh	r4, [r3]	@ movhi
-	ldr	r3, .L426+24
+	ldr	r3, .L427+24
 	ldrh	r2, [r3]
-	ldr	r3, .L426+28
+	ldr	r3, .L427+28
 	lsls	r2, r2, #1
 	ldr	r0, [r3]
 	bl	ftl_memset
 	ldrh	r2, [r5]
 	mov	r1, r4
-	ldr	r3, .L426+32
+	ldr	r3, .L427+32
 	lsls	r2, r2, #1
 	ldr	r0, [r3]
 	bl	ftl_memset
 	ldrh	r2, [r5]
 	mov	r1, r4
-	ldr	r3, .L426+36
+	ldr	r3, .L427+36
 	lsls	r2, r2, #1
 	ldr	r0, [r3]
 	bl	ftl_memset
 	mov	r1, r4
 	movs	r2, #48
-	ldr	r0, .L426+40
+	ldr	r0, .L427+40
 	bl	ftl_memset
 	mov	r2, #512
 	mov	r1, r4
-	ldr	r0, .L426+44
+	ldr	r0, .L427+44
 	bl	ftl_memset
 	bl	FtlGcBufInit
 	bl	FtlL2PDataInit
 	mov	r0, r4
 	pop	{r3, r4, r5, pc}
-.L427:
+.L428:
 	.align	2
-.L426:
+.L427:
 	.word	.LANCHOR131
 	.word	.LANCHOR6
 	.word	.LANCHOR132
@@ -3670,7 +3660,7 @@ FtlVariablesInit:
 	.word	.LANCHOR35
 	.word	.LANCHOR27
 	.word	.LANCHOR36
-	.word	.LANCHOR43
+	.word	.LANCHOR47
 	.word	.LANCHOR117
 	.word	.LANCHOR39
 	.word	.LANCHOR135
@@ -3688,10 +3678,10 @@ SupperBlkListInit:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r2, #6
-	ldr	r3, .L439
+	ldr	r3, .L440
 	movs	r1, #0
 	movs	r4, #0
-	ldr	r6, .L439+4
+	ldr	r6, .L440+4
 	mov	r8, r4
 	ldrh	r3, [r3]
 	mov	r5, r4
@@ -3699,125 +3689,125 @@ SupperBlkListInit:
 	mov	r10, r6
 	muls	r2, r3, r2
 	bl	ftl_memset
-	ldr	r3, .L439+8
-	ldr	r2, .L439+12
+	ldr	r3, .L440+8
+	ldr	r2, .L440+12
 	str	r4, [r3]
-	ldr	r3, .L439+16
+	ldr	r3, .L440+16
 	strh	r4, [r2]	@ movhi
 	str	r2, [sp, #4]
 	str	r4, [r3]
-	ldr	r3, .L439+20
+	ldr	r3, .L440+20
 	str	r4, [r3]
-	ldr	r3, .L439+24
+	ldr	r3, .L440+24
 	mov	fp, r3
 	strh	r4, [r3]	@ movhi
-.L429:
-	ldr	r3, .L439+28
+.L430:
+	ldr	r3, .L440+28
 	uxth	r7, r4
 	ldrh	r3, [r3]
 	cmp	r7, r3
-	bcs	.L436
-	ldr	r3, .L439+32
+	bcs	.L437
+	ldr	r3, .L440+32
 	ldrh	r2, [r3]
-	ldr	r3, .L439+36
+	ldr	r3, .L440+36
 	ldrh	r3, [r3]
 	str	r3, [sp]
 	movs	r3, #0
 	mov	r6, r3
-	b	.L437
-.L431:
+	b	.L438
+.L432:
 	str	r2, [sp, #12]
 	mov	r1, r7
-	ldr	r2, .L439+40
+	ldr	r2, .L440+40
 	str	r3, [sp, #8]
 	ldrb	r0, [r2, r3]	@ zero_extendqisi2
 	bl	V2P_block
 	bl	FtlBbmIsBadBlock
 	ldr	r3, [sp, #8]
 	ldr	r2, [sp, #12]
-	cbnz	r0, .L430
+	cbnz	r0, .L431
 	ldr	r1, [sp]
 	add	r6, r6, r1
 	uxth	r6, r6
-.L430:
+.L431:
 	adds	r3, r3, #1
-.L437:
+.L438:
 	uxth	r1, r3
 	cmp	r2, r1
-	bhi	.L431
+	bhi	.L432
 	uxth	r3, r4
-	cbz	r6, .L432
+	cbz	r6, .L433
 	mov	r1, r6
 	str	r3, [sp]
 	mov	r0, #32768
 	bl	__aeabi_idiv
 	ldr	r3, [sp]
 	uxth	r6, r0
-.L433:
+.L434:
 	ldr	r1, [r10]
 	movs	r2, #6
 	mla	r2, r2, r3, r1
 	strh	r6, [r2, #4]	@ movhi
-	ldr	r2, .L439+44
+	ldr	r2, .L440+44
 	ldrh	r2, [r2]
 	cmp	r2, r7
-	beq	.L434
-	ldr	r2, .L439+48
+	beq	.L435
+	ldr	r2, .L440+48
 	ldrh	r2, [r2]
 	cmp	r2, r7
-	beq	.L434
-	ldr	r2, .L439+52
+	beq	.L435
+	ldr	r2, .L440+52
 	ldrh	r2, [r2]
 	cmp	r2, r7
-	beq	.L434
-	ldr	r2, .L439+56
+	beq	.L435
+	ldr	r2, .L440+56
 	ldr	r2, [r2]
 	ldrh	r3, [r2, r3, lsl #1]
-	cbnz	r3, .L435
+	cbnz	r3, .L436
 	add	r8, r8, #1
 	mov	r0, r7
 	uxth	r8, r8
 	bl	INSERT_FREE_LIST
-.L434:
+.L435:
 	adds	r4, r4, #1
-	b	.L429
-.L432:
-	ldr	r2, .L439+56
+	b	.L430
+.L433:
+	ldr	r2, .L440+56
 	movw	r1, #65535
 	ldr	r2, [r2]
 	strh	r1, [r2, r3, lsl #1]	@ movhi
-	b	.L433
-.L435:
+	b	.L434
+.L436:
 	adds	r5, r5, #1
 	mov	r0, r7
 	uxth	r5, r5
 	bl	INSERT_DATA_LIST
-	b	.L434
-.L436:
+	b	.L435
+.L437:
 	ldr	r2, [sp, #4]
 	strh	r8, [fp]	@ movhi
 	strh	r5, [r2]	@ movhi
 	add	r5, r5, r8
 	cmp	r5, r3
-	ble	.L438
-	movw	r2, #2216
-	ldr	r1, .L439+60
-	ldr	r0, .L439+64
+	ble	.L439
+	movw	r2, #2210
+	ldr	r1, .L440+60
+	ldr	r0, .L440+64
 	bl	printf
-.L438:
+.L439:
 	movs	r0, #0
 	add	sp, sp, #16
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L440:
+.L441:
 	.align	2
-.L439:
+.L440:
 	.word	.LANCHOR6
 	.word	.LANCHOR40
-	.word	.LANCHOR47
-	.word	.LANCHOR45
-	.word	.LANCHOR41
+	.word	.LANCHOR46
 	.word	.LANCHOR44
+	.word	.LANCHOR41
+	.word	.LANCHOR43
 	.word	.LANCHOR48
 	.word	.LANCHOR5
 	.word	.LANCHOR3
@@ -3841,16 +3831,16 @@ SupperBlkListInit:
 FtlGcPageVarInit:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r2, .L442
+	ldr	r2, .L443
 	movs	r3, #0
 	push	{r4, lr}
 	movs	r1, #255
-	ldr	r4, .L442+4
+	ldr	r4, .L443+4
 	strh	r3, [r2]	@ movhi
-	ldr	r2, .L442+8
+	ldr	r2, .L443+8
 	strh	r3, [r2]	@ movhi
 	ldrh	r2, [r4]
-	ldr	r3, .L442+12
+	ldr	r3, .L443+12
 	lsls	r2, r2, #1
 	ldr	r0, [r3]
 	bl	ftl_memset
@@ -3858,14 +3848,14 @@ FtlGcPageVarInit:
 	movs	r2, #12
 	movs	r1, #255
 	muls	r2, r3, r2
-	ldr	r3, .L442+16
+	ldr	r3, .L443+16
 	ldr	r0, [r3]
 	bl	ftl_memset
 	pop	{r4, lr}
 	b	FtlGcBufInit
-.L443:
+.L444:
 	.align	2
-.L442:
+.L443:
 	.word	.LANCHOR69
 	.word	.LANCHOR21
 	.word	.LANCHOR70
@@ -3889,39 +3879,39 @@ FlashGetBadBlockList:
 	movs	r1, #255
 	mov	r4, r0
 	bl	ftl_memset
-	ldr	r3, .L451
+	ldr	r3, .L452
 	mov	r1, r5
 	mov	r0, r4
 	ldr	r3, [r3]
 	blx	r3
 	uxth	r0, r0
 	cmp	r0, #50
-	bls	.L445
+	bls	.L446
 	mov	r2, #256
 	movs	r1, #255
 	mov	r0, r4
 	bl	ftl_memset
 	movs	r0, #0
-.L445:
-	ldr	r3, .L451+4
+.L446:
+	ldr	r3, .L452+4
 	ldrh	r3, [r3, #14]
 	cmp	r3, #4
-	bne	.L450
+	bne	.L451
 	add	r1, r4, r0, lsl #1
 	mov	r3, r4
-.L447:
+.L448:
 	cmp	r3, r1
-	bne	.L448
-.L450:
+	bne	.L449
+.L451:
 	pop	{r3, r4, r5, pc}
-.L448:
+.L449:
 	ldrh	r2, [r3]
 	lsrs	r2, r2, #1
 	strh	r2, [r3], #2	@ movhi
-	b	.L447
-.L452:
+	b	.L448
+.L453:
 	.align	2
-.L451:
+.L452:
 	.word	.LANCHOR78
 	.word	.LANCHOR0
 	.size	FlashGetBadBlockList, .-FlashGetBadBlockList
@@ -3952,48 +3942,48 @@ FlashReadPages:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	fp, r1
-	ldr	r3, .L482
+	ldr	r3, .L495
 	mov	r4, r0
 	mov	r10, #0
 	ldrh	r2, [r3, #12]
 	str	r3, [sp, #4]
 	str	r2, [sp]
-.L455:
+.L456:
 	cmp	r10, fp
-	bne	.L466
+	bne	.L470
 	movs	r0, #0
 	add	sp, sp, #16
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L466:
+.L470:
 	ldr	r3, [r4, #8]
-	cbz	r3, .L456
+	cbz	r3, .L457
 	ldr	r3, [r4, #12]
-	cbnz	r3, .L457
-.L456:
+	cbnz	r3, .L458
+.L457:
 	movs	r2, #90
-	ldr	r1, .L482+4
-	ldr	r0, .L482+8
+	ldr	r1, .L495+4
+	ldr	r0, .L495+8
 	bl	printf
-.L457:
+.L458:
 	add	r2, sp, #8
 	add	r1, sp, #12
 	ldr	r0, [r4, #4]
 	bl	l2p_addr_tran.isra.0
 	ldr	r0, [sp, #8]
 	cmp	r0, #3
-	bls	.L458
+	bls	.L459
 	mov	r3, #-1
 	str	r3, [r4]
-.L459:
+.L460:
 	add	r10, r10, #1
 	adds	r4, r4, #20
-	b	.L455
-.L458:
+	b	.L456
+.L459:
 	ldr	r5, [r4, #8]
 	uxtb	r0, r0
-	ldr	r8, .L482+20
-	ldr	r7, .L482+12
+	ldr	r8, .L495+32
+	ldr	r7, .L495+12
 	tst	r5, #63
 	ldr	r3, [r4, #12]
 	it	ne
@@ -4006,7 +3996,7 @@ FlashReadPages:
 	str	r0, [r4]
 	ldrh	r3, [r3, #14]
 	cmp	r3, #4
-	bne	.L462
+	bne	.L463
 	ldr	r0, [sp]
 	add	r2, r5, #2048
 	ldr	r3, [r4, #12]
@@ -4016,48 +4006,75 @@ FlashReadPages:
 	add	r1, r1, r0
 	ldrb	r0, [sp, #8]	@ zero_extendqisi2
 	blx	r7
-	adds	r3, r0, #1
-	beq	.L463
+	adds	r1, r0, #1
+	beq	.L464
 	ldr	r3, [r4, #12]
 	ldr	r2, [r3, #12]
 	adds	r2, r2, #1
-	bne	.L464
+	bne	.L465
 	ldr	r2, [r3, #8]
 	adds	r2, r2, #1
-	bne	.L464
+	bne	.L465
 	ldr	r3, [r3]
 	adds	r3, r3, #1
-	beq	.L464
-.L463:
+	beq	.L465
+.L464:
 	mov	r3, #-1
 	str	r3, [r4]
-.L464:
+.L465:
 	ldr	r3, [r4]
 	adds	r3, r3, #1
-	beq	.L462
+	beq	.L466
 	cmp	r0, #256
 	it	eq
 	streq	r0, [r4]
-.L462:
+.L466:
+	ldr	r3, [r4]
+	adds	r2, r3, #1
+	beq	.L467
+	cmp	r3, #256
+	bne	.L463
+.L467:
+	ldr	r1, [r4, #4]
+	ldr	r2, [sp, #12]
+	ldr	r0, .L495+16
+	bl	printf
+	ldr	r1, [r4, #8]
+	cbz	r1, .L469
+	movs	r3, #4
+	ldr	r0, .L495+20
+	mov	r2, r3
+	bl	rknand_print_hex
+.L469:
+	ldr	r1, [r4, #12]
+	cbz	r1, .L463
+	movs	r3, #4
+	ldr	r0, .L495+24
+	mov	r2, r3
+	bl	rknand_print_hex
+.L463:
 	ldr	r3, [r8]
 	cmp	r5, r3
-	bne	.L459
+	bne	.L460
 	ldr	r0, [r4, #8]
 	cmp	r5, r0
-	beq	.L459
-	ldr	r3, .L482+16
+	beq	.L460
+	ldr	r3, .L495+28
 	mov	r1, r5
 	ldrh	r2, [r3]
 	lsls	r2, r2, #9
 	bl	ftl_memcpy
-	b	.L459
-.L483:
+	b	.L460
+.L496:
 	.align	2
-.L482:
+.L495:
 	.word	.LANCHOR0
 	.word	.LANCHOR137
 	.word	.LC1
 	.word	.LANCHOR78
+	.word	.LC11
+	.word	.LC12
+	.word	.LC13
 	.word	.LANCHOR12
 	.word	.LANCHOR111
 	.size	FlashReadPages, .-FlashReadPages
@@ -4072,36 +4089,36 @@ FlashReadPages:
 FtlLoadFactoryBbt:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L494
+	ldr	r3, .L507
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r6, #0
-	ldr	r5, .L494+4
+	ldr	r5, .L507+4
 	ldr	r3, [r3]
-	ldr	r7, .L494+8
-	ldr	r10, .L494+20
+	ldr	r7, .L507+8
+	ldr	r10, .L507+20
 	str	r3, [r5, #8]
-	ldr	r3, .L494+12
+	ldr	r3, .L507+12
 	ldr	r8, [r3]
 	str	r8, [r5, #12]
-.L485:
-	ldr	r3, .L494+16
+.L498:
+	ldr	r3, .L507+16
 	ldrh	r3, [r3]
 	cmp	r6, r3
-	bcc	.L490
+	bcc	.L503
 	movs	r0, #0
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L490:
+.L503:
 	ldrh	r4, [r10]
 	movw	r3, #65535
-	ldr	fp, .L494+4
+	ldr	fp, .L507+4
 	strh	r3, [r7, #2]!	@ movhi
 	subs	r4, r4, #1
 	uxth	r4, r4
-.L486:
+.L499:
 	ldrh	r3, [r10]
 	sub	r2, r3, #15
 	cmp	r2, r4
-	bgt	.L488
+	bgt	.L501
 	mla	r3, r6, r3, r4
 	movs	r2, #1
 	mov	r1, r2
@@ -4111,22 +4128,22 @@ FtlLoadFactoryBbt:
 	bl	FlashReadPages
 	ldr	r3, [r5]
 	adds	r3, r3, #1
-	beq	.L487
+	beq	.L500
 	ldrh	r2, [r8]
 	movw	r3, #61664
 	cmp	r2, r3
-	bne	.L487
+	bne	.L500
 	strh	r4, [r7]	@ movhi
-.L488:
+.L501:
 	adds	r6, r6, #1
-	b	.L485
-.L487:
+	b	.L498
+.L500:
 	subs	r4, r4, #1
 	uxth	r4, r4
-	b	.L486
-.L495:
+	b	.L499
+.L508:
 	.align	2
-.L494:
+.L507:
 	.word	.LANCHOR106
 	.word	.LANCHOR138
 	.word	.LANCHOR37+10
@@ -4148,17 +4165,17 @@ FtlGetLastWrittenPage:
 	cmp	r1, #1
 	push	{r4, r5, r6, r7, r8, lr}
 	it	eq
-	ldreq	r3, .L508
+	ldreq	r3, .L521
 	sub	sp, sp, #88
 	lsl	r7, r0, #10
 	mov	r2, r1
 	it	ne
-	ldrne	r3, .L508+4
+	ldrne	r3, .L521+4
 	mov	r6, r1
 	add	r0, sp, #4
 	movs	r1, #1
 	ldrh	r5, [r3]
-	ldr	r3, .L508+8
+	ldr	r3, .L521+8
 	subs	r5, r5, #1
 	ldr	r3, [r3]
 	sxth	r5, r5
@@ -4170,17 +4187,17 @@ FtlGetLastWrittenPage:
 	bl	FlashReadPages
 	ldr	r3, [sp, #24]
 	adds	r3, r3, #1
-	bne	.L499
+	bne	.L512
 	mov	r8, #0
-.L500:
+.L513:
 	cmp	r8, r5
-	ble	.L503
-.L499:
+	ble	.L516
+.L512:
 	mov	r0, r5
 	add	sp, sp, #88
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, pc}
-.L503:
+.L516:
 	add	r3, r8, r5
 	mov	r2, r6
 	add	r3, r3, r3, lsr #31
@@ -4193,23 +4210,23 @@ FtlGetLastWrittenPage:
 	bl	FlashReadPages
 	ldr	r3, [sp, #24]
 	adds	r3, r3, #1
-	bne	.L501
+	bne	.L514
 	ldr	r3, [sp, #28]
 	adds	r3, r3, #1
-	bne	.L501
+	bne	.L514
 	ldr	r3, [sp, #4]
 	adds	r3, r3, #1
-	beq	.L501
+	beq	.L514
 	subs	r4, r4, #1
 	sxth	r5, r4
-	b	.L500
-.L501:
+	b	.L513
+.L514:
 	adds	r4, r4, #1
 	sxth	r8, r4
-	b	.L500
-.L509:
+	b	.L513
+.L522:
 	.align	2
-.L508:
+.L521:
 	.word	.LANCHOR20
 	.word	.LANCHOR19
 	.word	.LANCHOR112
@@ -4227,69 +4244,69 @@ FtlScanSysBlk:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r4, #0
-	ldr	r5, .L591
+	ldr	r5, .L604
 	sub	sp, sp, #32
 	mov	r1, r4
-	ldr	r3, .L591+4
+	ldr	r3, .L604+4
 	ldr	r2, [r5]
-	ldr	r6, .L591+8
+	ldr	r6, .L604+8
 	strh	r4, [r3]	@ movhi
-	ldr	r3, .L591+12
+	ldr	r3, .L604+12
 	lsls	r2, r2, #2
 	strh	r4, [r6]	@ movhi
-	ldr	r7, .L591+16
+	ldr	r7, .L604+16
 	ldr	r0, [r3]
 	bl	ftl_memset
 	ldr	r2, [r5]
 	mov	r1, r4
-	ldr	r3, .L591+20
+	ldr	r3, .L604+20
 	lsls	r2, r2, #1
 	ldr	r0, [r3]
 	bl	ftl_memset
 	ldrh	r2, [r7]
 	mov	r1, r4
-	ldr	r3, .L591+24
+	ldr	r3, .L604+24
 	lsls	r2, r2, #2
 	ldr	r0, [r3]
 	bl	ftl_memset
 	ldrh	r2, [r7]
 	mov	r1, r4
-	ldr	r3, .L591+28
+	ldr	r3, .L604+28
 	lsls	r2, r2, #1
 	ldr	r0, [r3]
 	bl	ftl_memset
 	movs	r2, #16
 	movs	r1, #255
-	ldr	r0, .L591+32
+	ldr	r0, .L604+32
 	bl	ftl_memset
-	ldr	r3, .L591+36
+	ldr	r3, .L604+36
 	str	r6, [sp, #12]
 	str	r5, [sp, #16]
 	ldrh	r3, [r3]
 	str	r3, [sp, #4]
-.L511:
-	ldr	r3, .L591+40
+.L524:
+	ldr	r3, .L604+40
 	ldr	r2, [sp, #4]
 	ldrh	r3, [r3]
 	cmp	r3, r2
-	bls	.L552
-	ldr	r3, .L591+44
+	bls	.L565
+	ldr	r3, .L604+44
 	movs	r5, #0
-	ldr	r1, .L591+48
+	ldr	r1, .L604+48
 	mov	fp, r5
 	movs	r7, #20
 	ldrh	r8, [r3]
-	ldr	r3, .L591+52
+	ldr	r3, .L604+52
 	ldr	r2, [r1]
-	ldr	r1, .L591+56
+	ldr	r1, .L604+56
 	ldr	r6, [r3]
-	ldr	r3, .L591+60
+	ldr	r3, .L604+60
 	str	r2, [sp, #8]
 	ldrh	r10, [r1]
 	ldr	r3, [r3]
-	ldr	r2, .L591+64
-	b	.L553
-.L513:
+	ldr	r2, .L604+64
+	b	.L566
+.L526:
 	ldrb	r0, [r2, r5]	@ zero_extendqisi2
 	ldr	r1, [sp, #4]
 	str	r3, [sp, #28]
@@ -4299,7 +4316,7 @@ FtlScanSysBlk:
 	bl	FtlBbmIsBadBlock
 	ldr	r2, [sp, #24]
 	ldr	r3, [sp, #28]
-	cbnz	r0, .L512
+	cbnz	r0, .L525
 	ldr	r1, [sp, #20]
 	mla	r0, r7, fp, r6
 	ldr	r4, [sp, #8]
@@ -4312,31 +4329,31 @@ FtlScanSysBlk:
 	str	r1, [r0, #12]
 	add	r1, fp, #1
 	uxth	fp, r1
-.L512:
+.L525:
 	adds	r5, r5, #1
-.L553:
+.L566:
 	uxth	r1, r5
 	cmp	r8, r1
-	bhi	.L513
+	bhi	.L526
 	cmp	fp, #0
-	bne	.L514
-.L551:
+	bne	.L527
+.L564:
 	ldr	r3, [sp, #4]
 	adds	r3, r3, #1
 	uxth	r3, r3
 	str	r3, [sp, #4]
-	b	.L511
-.L514:
+	b	.L524
+.L527:
 	movs	r7, #0
 	movs	r2, #1
 	mov	r1, fp
 	mov	r0, r6
 	bl	FlashReadPages
-.L515:
+.L528:
 	uxth	r3, r7
 	cmp	fp, r3
-	bls	.L551
-	ldr	r3, .L591+52
+	bls	.L564
+	ldr	r3, .L604+52
 	mov	r8, #20
 	mul	r8, r8, r7
 	ldr	r3, [r3]
@@ -4346,10 +4363,10 @@ FtlScanSysBlk:
 	ldr	r6, [r2, #12]
 	adds	r3, r3, #1
 	ubfx	r5, r5, #10, #16
-	bne	.L518
+	bne	.L531
 	mov	r10, #16
-.L520:
-	ldr	r3, .L591+52
+.L533:
+	ldr	r3, .L604+52
 	movs	r2, #1
 	mov	r1, r2
 	ldr	r0, [r3]
@@ -4361,83 +4378,83 @@ FtlScanSysBlk:
 	ldrh	r2, [r6]
 	movw	r3, #65535
 	cmp	r2, r3
-	ldr	r3, .L591+52
+	ldr	r3, .L604+52
 	ldr	r3, [r3]
-	bne	.L517
+	bne	.L530
 	mov	r2, #-1
 	str	r2, [r3, r8]
-	ldr	r3, .L591+52
+	ldr	r3, .L604+52
 	ldr	r3, [r3]
 	ldr	r3, [r3, r8]
 	cmp	r3, r2
-	bne	.L518
-.L519:
+	bne	.L531
+.L532:
 	movs	r1, #1
-	b	.L590
-.L517:
+	b	.L603
+.L530:
 	ldr	r3, [r3, r8]
 	adds	r3, r3, #1
-	bne	.L518
+	bne	.L531
 	add	r10, r10, #-1
 	uxth	r10, r10
 	cmp	r10, #0
-	bne	.L520
-	b	.L519
-.L518:
-	ldr	r3, .L591+68
+	bne	.L533
+	b	.L532
+.L531:
+	ldr	r3, .L604+68
 	ldr	r2, [r3]
 	ldr	r3, [r6, #4]
 	adds	r1, r2, #1
-	beq	.L521
+	beq	.L534
 	cmp	r2, r3
-	bhi	.L522
-.L521:
+	bhi	.L535
+.L534:
 	adds	r2, r3, #1
 	ittt	ne
-	ldrne	r1, .L591+68
+	ldrne	r1, .L604+68
 	addne	r2, r3, #1
 	strne	r2, [r1]
-.L522:
+.L535:
 	ldrh	r2, [r6]
 	movw	r1, #61604
 	cmp	r2, r1
-	beq	.L524
-	bhi	.L525
+	beq	.L537
+	bhi	.L538
 	movw	r3, #61574
 	cmp	r2, r3
-	beq	.L526
-.L523:
+	beq	.L539
+.L536:
 	adds	r7, r7, #1
-	b	.L515
-.L525:
+	b	.L528
+.L538:
 	movw	r3, #61634
 	cmp	r2, r3
-	beq	.L527
+	beq	.L540
 	movw	r3, #65535
 	cmp	r2, r3
-	bne	.L523
+	bne	.L536
 	movs	r1, #0
-.L590:
+.L603:
 	mov	r0, r5
 	bl	FtlFreeSysBlkQueueIn
-	b	.L523
-.L527:
-	ldr	r3, .L591+8
+	b	.L536
+.L540:
+	ldr	r3, .L604+8
 	ldrh	r2, [r3]
-	ldr	r3, .L591
+	ldr	r3, .L604
 	ldr	r3, [r3]
 	cmp	r2, r3
-	bls	.L529
+	bls	.L542
 	movw	r2, #1225
-	ldr	r1, .L591+72
-	ldr	r0, .L591+76
+	ldr	r1, .L604+72
+	ldr	r0, .L604+76
 	bl	printf
-.L529:
+.L542:
 	ldr	r3, [sp, #16]
 	ldr	r2, [sp, #12]
 	ldr	r1, [r3]
 	ldrh	r0, [r2]
-	ldr	r2, .L591+12
+	ldr	r2, .L604+12
 	uxth	r10, r1
 	ldr	ip, [r2]
 	add	r3, r10, #-1
@@ -4445,61 +4462,61 @@ FtlScanSysBlk:
 	add	r10, r10, #-1
 	sxth	r3, r3
 	sxth	r10, r10
-.L530:
+.L543:
 	cmp	r3, r10
-	bgt	.L536
+	bgt	.L549
 	cmp	r3, #0
-	bge	.L568
-	b	.L523
-.L536:
+	bge	.L581
+	b	.L536
+.L549:
 	ldr	r2, [ip, r3, lsl #2]
 	add	r8, ip, r3, lsl #2
 	ldr	r4, [r6, #4]
 	cmp	r4, r2
-	bls	.L531
+	bls	.L544
 	ldr	r2, [ip]
-	cbnz	r2, .L532
+	cbnz	r2, .L545
 	cmp	r1, r0
 	ittt	ne
-	ldrne	r2, .L591+8
+	ldrne	r2, .L604+8
 	addne	r0, r0, #1
 	strhne	r0, [r2]	@ movhi
-.L532:
-	ldr	r2, .L591+20
+.L545:
+	ldr	r2, .L604+20
 	uxth	r10, r3
 	ldr	r0, [r2]
 	movs	r2, #0
-.L533:
+.L546:
 	uxth	lr, r2
 	sxth	r1, r2
 	cmp	r10, lr
-	bhi	.L534
+	bhi	.L547
 	ldr	r2, [r6, #4]
 	cmp	r3, #0
 	str	r2, [r8]
 	strh	r5, [r0, r3, lsl #1]	@ movhi
-	blt	.L523
-	ldr	r2, .L591+8
+	blt	.L536
+	ldr	r2, .L604+8
 	ldrh	r0, [r2]
-	ldr	r2, .L591
+	ldr	r2, .L604
 	ldr	r2, [r2]
 	subs	r2, r2, r0
 	subs	r2, r2, #1
 	sxth	r2, r2
 	cmp	r3, r2
-	bgt	.L523
-.L568:
-	ldr	r2, .L591+8
+	bgt	.L536
+.L581:
+	ldr	r2, .L604+8
 	adds	r0, r0, #1
 	strh	r0, [r2]	@ movhi
 	ldr	r2, [r6, #4]
 	str	r2, [ip, r3, lsl #2]
-	ldr	r2, .L591+20
-.L588:
+	ldr	r2, .L604+20
+.L601:
 	ldr	r2, [r2]
 	strh	r5, [r2, r3, lsl #1]	@ movhi
-	b	.L523
-.L534:
+	b	.L536
+.L547:
 	add	lr, ip, r1, lsl #2
 	adds	r2, r2, #1
 	ldr	r4, [lr, #4]
@@ -4507,14 +4524,14 @@ FtlScanSysBlk:
 	ldrh	lr, [lr, #2]
 	str	r4, [ip, r1, lsl #2]
 	strh	lr, [r0, r1, lsl #1]	@ movhi
-	b	.L533
-.L531:
+	b	.L546
+.L544:
 	subs	r3, r3, #1
 	sxth	r3, r3
-	b	.L530
-.L592:
+	b	.L543
+.L605:
 	.align	2
-.L591:
+.L604:
 	.word	.LANCHOR30
 	.word	.LANCHOR35
 	.word	.LANCHOR130
@@ -4535,72 +4552,72 @@ FtlScanSysBlk:
 	.word	.LANCHOR82
 	.word	.LANCHOR140
 	.word	.LC1
-.L526:
-	ldr	r8, .L593+12
-	ldr	r10, .L593+20
+.L539:
+	ldr	r8, .L606+12
+	ldr	r10, .L606+20
 	ldrh	r2, [r8]
 	ldrh	r3, [r10]
 	cmp	r2, r3
-	bls	.L539
+	bls	.L552
 	movw	r2, #1266
-	ldr	r1, .L593
-	ldr	r0, .L593+4
+	ldr	r1, .L606
+	ldr	r0, .L606+4
 	bl	printf
-.L539:
-	ldr	r2, .L593+8
+.L552:
+	ldr	r2, .L606+8
 	ldrh	lr, [r10]
 	ldrh	ip, [r8]
 	ldr	r0, [r2]
 	add	r10, lr, #-1
 	sxth	r3, r10
 	sub	r10, r10, ip
-.L540:
+.L553:
 	cmp	r3, r10
-	ble	.L545
+	ble	.L558
 	ldr	r1, [r6, #4]
 	add	r8, r0, r3, lsl #2
 	ldr	r2, [r0, r3, lsl #2]
 	cmp	r1, r2
-	bls	.L541
+	bls	.L554
 	ldr	r2, [r0]
-	cbnz	r2, .L542
+	cbnz	r2, .L555
 	cmp	lr, ip
 	ittt	ne
-	ldrne	r2, .L593+12
+	ldrne	r2, .L606+12
 	addne	ip, ip, #1
 	strhne	ip, [r2]	@ movhi
-.L542:
-	ldr	r2, .L593+16
+.L555:
+	ldr	r2, .L606+16
 	uxth	r10, r3
 	ldr	ip, [r2]
 	movs	r2, #0
-.L543:
+.L556:
 	uxth	lr, r2
 	sxth	r1, r2
 	cmp	r10, lr
-	bhi	.L544
+	bhi	.L557
 	ldr	r2, [r6, #4]
 	str	r2, [r8]
 	strh	r5, [ip, r3, lsl #1]	@ movhi
-.L545:
+.L558:
 	cmp	r3, #0
-	blt	.L523
-	ldr	r2, .L593+20
-	ldr	ip, .L593+12
+	blt	.L536
+	ldr	r2, .L606+20
+	ldr	ip, .L606+12
 	ldrh	r2, [r2]
 	ldrh	r1, [ip]
 	subs	r2, r2, #1
 	subs	r2, r2, r1
 	sxth	r2, r2
 	cmp	r3, r2
-	bgt	.L523
+	bgt	.L536
 	ldr	r2, [r6, #4]
 	adds	r1, r1, #1
 	strh	r1, [ip]	@ movhi
 	str	r2, [r0, r3, lsl #2]
-	ldr	r2, .L593+16
-	b	.L588
-.L544:
+	ldr	r2, .L606+16
+	b	.L601
+.L557:
 	add	lr, r0, r1, lsl #2
 	adds	r2, r2, #1
 	ldr	r4, [lr, #4]
@@ -4608,88 +4625,88 @@ FtlScanSysBlk:
 	ldrh	lr, [lr, #2]
 	str	r4, [r0, r1, lsl #2]
 	strh	lr, [ip, r1, lsl #1]	@ movhi
-	b	.L543
-.L541:
+	b	.L556
+.L554:
 	subs	r3, r3, #1
 	sxth	r3, r3
-	b	.L540
-.L524:
-	ldr	r8, .L593+40
+	b	.L553
+.L537:
+	ldr	r8, .L606+40
 	movw	r2, #65535
 	ldrh	r1, [r8]
 	cmp	r1, r2
-	bne	.L547
-.L589:
+	bne	.L560
+.L602:
 	strh	r5, [r8]	@ movhi
 	str	r3, [r8, #8]
-	b	.L523
-.L547:
+	b	.L536
+.L560:
 	ldrh	r0, [r8, #4]
 	cmp	r0, r2
-	beq	.L548
+	beq	.L561
 	movs	r1, #1
 	bl	FtlFreeSysBlkQueueIn
-.L548:
+.L561:
 	ldr	r3, [r6, #4]
 	ldr	r2, [r8, #8]
 	cmp	r2, r3
-	bcs	.L549
+	bcs	.L562
 	ldrh	r2, [r8]
 	strh	r2, [r8, #4]	@ movhi
-	b	.L589
-.L549:
+	b	.L602
+.L562:
 	strh	r5, [r8, #4]	@ movhi
-	b	.L523
-.L552:
-	ldr	r3, .L593+24
+	b	.L536
+.L565:
+	ldr	r3, .L606+24
 	ldr	r2, [r3]
 	ldrh	r3, [r2]
-	cbz	r3, .L554
-.L557:
-	ldr	r3, .L593+16
+	cbz	r3, .L567
+.L570:
+	ldr	r3, .L606+16
 	ldr	r4, [r3]
 	ldrh	r2, [r4]
 	cmp	r2, #0
-	beq	.L555
-.L556:
-	ldr	r3, .L593+28
+	beq	.L568
+.L569:
+	ldr	r3, .L606+28
 	ldrh	r2, [r3]
-	ldr	r3, .L593+32
+	ldr	r3, .L606+32
 	ldr	r3, [r3]
 	cmp	r2, r3
-	bls	.L587
+	bls	.L600
 	movw	r2, #1391
-	ldr	r1, .L593
-	ldr	r0, .L593+4
+	ldr	r1, .L606
+	ldr	r0, .L606+4
 	bl	printf
-.L587:
+.L600:
 	movs	r0, #0
 	add	sp, sp, #32
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L554:
-	ldr	r1, .L593+28
+.L567:
+	ldr	r1, .L606+28
 	ldrh	r1, [r1]
 	cmp	r1, #0
-	beq	.L557
-	ldr	r5, .L593+32
+	beq	.L570
+	ldr	r5, .L606+32
 	ldr	r0, [r5]
-.L558:
+.L571:
 	sxth	r1, r3
 	cmp	r1, r0
-	bcs	.L557
+	bcs	.L570
 	ldrh	r4, [r2, r1, lsl #1]
 	adds	r3, r3, #1
 	cmp	r4, #0
-	beq	.L558
-	ldr	r3, .L593+36
+	beq	.L571
+	ldr	r3, .L606+36
 	movs	r6, #0
 	ldr	r0, [r3]
 	mov	r3, r1
-.L559:
+.L572:
 	ldr	r4, [r5]
 	cmp	r3, r4
-	bcs	.L557
+	bcs	.L570
 	ldrh	r7, [r2, r3, lsl #1]
 	subs	r4, r3, r1
 	strh	r7, [r2, r4, lsl #1]	@ movhi
@@ -4698,30 +4715,30 @@ FtlScanSysBlk:
 	strh	r6, [r2, r3, lsl #1]	@ movhi
 	adds	r3, r3, #1
 	sxth	r3, r3
-	b	.L559
-.L555:
-	ldr	r3, .L593+12
+	b	.L572
+.L568:
+	ldr	r3, .L606+12
 	ldrh	r3, [r3]
 	cmp	r3, #0
-	beq	.L556
-	ldr	r5, .L593+20
+	beq	.L569
+	ldr	r5, .L606+20
 	ldrh	r1, [r5]
-.L564:
+.L577:
 	sxth	r3, r2
 	cmp	r3, r1
 	mov	r6, r3
-	bge	.L556
+	bge	.L569
 	ldrh	r0, [r4, r3, lsl #1]
 	adds	r2, r2, #1
 	cmp	r0, #0
-	beq	.L564
-	ldr	r2, .L593+8
+	beq	.L577
+	ldr	r2, .L606+8
 	movs	r0, #0
 	ldr	r2, [r2]
-.L565:
+.L578:
 	ldrh	r1, [r5]
 	cmp	r3, r1
-	bge	.L556
+	bge	.L569
 	ldrh	r7, [r4, r3, lsl #1]
 	subs	r1, r3, r6
 	strh	r7, [r4, r1, lsl #1]	@ movhi
@@ -4730,10 +4747,10 @@ FtlScanSysBlk:
 	adds	r1, r3, #1
 	strh	r0, [r4, r3, lsl #1]	@ movhi
 	sxth	r3, r1
-	b	.L565
-.L594:
+	b	.L578
+.L607:
 	.align	2
-.L593:
+.L606:
 	.word	.LANCHOR140
 	.word	.LC1
 	.word	.LANCHOR122
@@ -4758,24 +4775,24 @@ FtlLoadBbt:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, r6, r7, r8, r10, lr}
-	ldr	r8, .L624+40
-	ldr	r4, .L624
+	ldr	r8, .L637+40
+	ldr	r4, .L637
 	ldr	r3, [r8]
-	ldr	r7, .L624+4
+	ldr	r7, .L637+4
 	mov	r10, r4
 	str	r3, [r4, #8]
-	ldr	r3, .L624+8
+	ldr	r3, .L637+8
 	ldr	r6, [r3]
 	str	r6, [r4, #12]
 	bl	FtlBbtMemInit
 	ldrh	r5, [r7]
 	subs	r5, r5, #1
 	uxth	r5, r5
-.L596:
+.L609:
 	ldrh	r3, [r7]
 	subs	r3, r3, #15
 	cmp	r3, r5
-	bgt	.L599
+	bgt	.L612
 	lsls	r3, r5, #10
 	movs	r2, #1
 	mov	r1, r2
@@ -4784,7 +4801,7 @@ FtlLoadBbt:
 	bl	FlashReadPages
 	ldr	r3, [r4]
 	adds	r3, r3, #1
-	bne	.L597
+	bne	.L610
 	ldr	r3, [r4, #4]
 	movs	r2, #1
 	mov	r1, r2
@@ -4792,101 +4809,101 @@ FtlLoadBbt:
 	adds	r3, r3, #1
 	str	r3, [r4, #4]
 	bl	FlashReadPages
-.L597:
+.L610:
 	ldr	r3, [r4]
 	adds	r3, r3, #1
-	beq	.L598
+	beq	.L611
 	ldrh	r2, [r6]
 	movw	r3, #61649
 	cmp	r2, r3
-	bne	.L598
-	ldr	r3, .L624+12
+	bne	.L611
+	ldr	r3, .L637+12
 	ldr	r2, [r6, #4]
 	strh	r5, [r3]	@ movhi
 	str	r2, [r3, #8]
 	ldrh	r2, [r6, #8]
 	strh	r2, [r3, #4]	@ movhi
-.L599:
-	ldr	r5, .L624+12
+.L612:
+	ldr	r5, .L637+12
 	movw	r2, #65535
 	ldrh	r3, [r5]
 	cmp	r3, r2
-	beq	.L613
+	beq	.L626
 	ldrh	r3, [r5, #4]
 	cmp	r3, r2
-	beq	.L603
+	beq	.L616
 	lsls	r3, r3, #10
 	movs	r2, #1
 	mov	r1, r2
-	ldr	r0, .L624
+	ldr	r0, .L637
 	str	r3, [r4, #4]
 	bl	FlashReadPages
 	ldr	r3, [r4]
 	adds	r3, r3, #1
-	beq	.L603
+	beq	.L616
 	ldrh	r2, [r6]
 	movw	r3, #61649
 	cmp	r2, r3
-	bne	.L603
+	bne	.L616
 	ldr	r3, [r6, #4]
 	ldr	r2, [r5, #8]
 	cmp	r3, r2
-	bls	.L603
+	bls	.L616
 	ldrh	r2, [r5, #4]
 	str	r3, [r5, #8]
 	ldrh	r3, [r6, #8]
 	strh	r2, [r5]	@ movhi
 	strh	r3, [r5, #4]	@ movhi
-.L603:
-	ldr	r10, .L624
+.L616:
+	ldr	r10, .L637
 	movs	r1, #1
 	ldrh	r0, [r5]
 	bl	FtlGetLastWrittenPage
 	sxth	r7, r0
 	adds	r0, r0, #1
 	strh	r0, [r5, #2]	@ movhi
-.L605:
+.L618:
 	cmp	r7, #0
-	bge	.L608
-	movs	r2, #253
-	ldr	r1, .L624+16
-	ldr	r0, .L624+20
+	bge	.L621
+	movs	r2, #251
+	ldr	r1, .L637+16
+	ldr	r0, .L637+20
 	bl	printf
-.L607:
+.L620:
 	ldrh	r3, [r6, #10]
 	ldrh	r0, [r6, #12]
 	strh	r3, [r5, #6]	@ movhi
 	movw	r3, #65535
 	cmp	r0, r3
-	beq	.L610
-	ldr	r3, .L624+24
+	beq	.L623
+	ldr	r3, .L637+24
 	ldr	r2, [r3]
 	cmp	r0, r2
-	beq	.L610
-	ldr	r3, .L624+28
+	beq	.L623
+	ldr	r3, .L637+28
 	ldrh	r3, [r3]
 	lsrs	r3, r3, #2
 	cmp	r2, r3
-	bcs	.L610
+	bcs	.L623
 	cmp	r0, r3
-	bcs	.L610
+	bcs	.L623
 	bl	FtlSysBlkNumInit
-.L610:
-	ldr	r6, .L624+32
+.L623:
+	ldr	r6, .L637+32
 	movs	r5, #0
-	ldr	r7, .L624+36
-	ldr	r8, .L624+44
-.L611:
+	ldr	r7, .L637+36
+	ldr	r8, .L637+44
+.L624:
 	ldrh	r3, [r7]
 	cmp	r5, r3
-	bcc	.L612
+	bcc	.L625
 	movs	r0, #0
 	pop	{r3, r4, r5, r6, r7, r8, r10, pc}
-.L598:
+.L611:
 	subs	r5, r5, #1
 	uxth	r5, r5
-	b	.L596
-.L608:
+	b	.L609
+.L621:
 	ldrh	r3, [r5]
 	movs	r2, #1
 	mov	r1, r2
@@ -4898,16 +4915,16 @@ FtlLoadBbt:
 	bl	FlashReadPages
 	ldr	r3, [r4]
 	adds	r3, r3, #1
-	beq	.L606
+	beq	.L619
 	ldrh	r2, [r6]
 	movw	r3, #61649
 	cmp	r2, r3
-	beq	.L607
-.L606:
+	beq	.L620
+.L619:
 	subs	r7, r7, #1
 	sxth	r7, r7
-	b	.L605
-.L612:
+	b	.L618
+.L625:
 	ldrh	r2, [r8]
 	ldr	r1, [r4, #8]
 	ldr	r0, [r6, #4]!
@@ -4915,13 +4932,13 @@ FtlLoadBbt:
 	mla	r1, r5, r2, r1
 	adds	r5, r5, #1
 	bl	ftl_memcpy
-	b	.L611
-.L613:
+	b	.L624
+.L626:
 	mov	r0, #-1
 	pop	{r3, r4, r5, r6, r7, r8, r10, pc}
-.L625:
+.L638:
 	.align	2
-.L624:
+.L637:
 	.word	.LANCHOR138
 	.word	.LANCHOR17
 	.word	.LANCHOR114
@@ -4952,26 +4969,26 @@ FlashProgPages:
 	mov	r10, r1
 	mov	r4, r0
 	mov	r5, r0
-	ldr	r3, .L666
+	ldr	r3, .L680
 	mov	r8, #0
-	ldr	fp, .L666+48
+	ldr	fp, .L680+52
 	str	r2, [sp, #8]
 	ldrh	r3, [r3, #12]
 	str	r3, [sp]
 	lsls	r3, r3, #3
 	str	r3, [sp, #4]
-.L627:
+.L640:
 	cmp	r8, r10
-	bne	.L640
+	bne	.L653
 	ldr	r3, [sp, #12]
 	cmp	r3, #0
-	beq	.L658
-	ldr	r6, .L666+4
+	beq	.L672
+	ldr	r6, .L680+4
 	movs	r5, #0
-.L642:
+.L655:
 	cmp	r8, r5
-	beq	.L658
-	ldr	r7, .L666+8
+	beq	.L672
+	ldr	r7, .L680+8
 	movs	r1, #0
 	ldr	r2, [r6]
 	add	r0, sp, #28
@@ -4987,73 +5004,81 @@ FlashProgPages:
 	bl	FlashReadPages
 	ldr	r10, [sp, #28]
 	cmp	r10, #-1
-	bne	.L643
+	bne	.L656
 	ldr	r1, [r4, #4]
-	ldr	r0, .L666+12
+	ldr	r0, .L680+12
 	bl	printf
 	str	r10, [r4]
-.L643:
+.L656:
+	ldr	r10, [sp, #28]
+	cmp	r10, #256
+	bne	.L657
+	ldr	r1, [r4, #4]
+	ldr	r0, .L680+16
+	bl	printf
+	str	r10, [r4]
+.L657:
 	ldr	r3, [r4, #12]
-	cbz	r3, .L644
+	cbz	r3, .L658
 	ldr	r2, [r3]
 	ldr	r3, [r7]
 	ldr	r3, [r3]
 	cmp	r2, r3
-	beq	.L644
+	beq	.L658
 	ldr	r1, [r4, #4]
-	ldr	r0, .L666+16
+	ldr	r0, .L680+20
 	bl	printf
 	mov	r3, #-1
 	str	r3, [r4]
-.L644:
+.L658:
 	ldr	r3, [r4, #8]
-	cbz	r3, .L645
+	cbz	r3, .L659
 	ldr	r2, [r3]
 	ldr	r3, [r6]
 	ldr	r3, [r3]
 	cmp	r2, r3
-	beq	.L645
+	beq	.L659
 	ldr	r1, [r4, #4]
-	ldr	r0, .L666+20
+	ldr	r0, .L680+24
 	bl	printf
 	mov	r3, #-1
 	str	r3, [r4]
-.L645:
+.L659:
 	adds	r5, r5, #1
 	adds	r4, r4, #20
-	b	.L642
-.L640:
+	b	.L655
+.L653:
 	ldr	r3, [r5, #8]
-	cbz	r3, .L628
+	cbz	r3, .L641
 	ldr	r3, [r5, #12]
-	cbnz	r3, .L629
-.L628:
-	movs	r2, #134
-	ldr	r1, .L666+24
-	ldr	r0, .L666+28
+	cbnz	r3, .L642
+.L641:
+	movs	r2, #142
+	ldr	r1, .L680+28
+	ldr	r0, .L680+32
 	bl	printf
-.L629:
+.L642:
 	add	r2, sp, #20
 	add	r1, sp, #24
 	ldr	r0, [r5, #4]
 	bl	l2p_addr_tran.isra.0
 	ldr	r6, [sp, #20]
 	cmp	r6, #3
-	bls	.L630
-.L665:
+	bls	.L643
+.L679:
 	mov	r3, #-1
 	str	r3, [r5]
-	b	.L631
-.L630:
-	cbnz	r6, .L632
+	b	.L644
+.L643:
+	cbnz	r6, .L645
 	ldr	r3, [sp, #24]
 	ldr	r2, [sp, #4]
 	cmp	r2, r3
-	bls	.L632
-	ldr	r5, .L666+24
-	ldr	r7, .L666+32
-	b	.L664
-.L634:
+	bls	.L645
+	ldr	r5, .L680+28
+	ldr	r7, .L680+36
+	b	.L678
+.L647:
 	mov	r3, #-1
 	ldr	r2, [r4, #-16]
 	str	r3, [r4, #-20]
@@ -5064,49 +5089,49 @@ FlashProgPages:
 	movs	r3, #16
 	movs	r2, #4
 	ldr	r1, [r4, #-12]
-	ldr	r0, .L666+36
+	ldr	r0, .L680+40
 	bl	rknand_print_hex
 	movs	r3, #4
 	ldr	r1, [r4, #-8]
 	mov	r2, r3
-	ldr	r0, .L666+40
+	ldr	r0, .L680+44
 	bl	rknand_print_hex
-.L664:
+.L678:
 	cmp	r6, r10
 	add	r4, r4, #20
-	bne	.L634
-.L658:
+	bne	.L647
+.L672:
 	movs	r0, #0
 	add	sp, sp, #48
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L632:
+.L645:
 	ldr	r1, [r5, #8]
 	lsls	r3, r1, #26
-	beq	.L647
-	ldr	r3, .L666+4
+	beq	.L661
+	ldr	r3, .L680+4
 	ldr	r6, [r3]
 	cmp	r1, r6
-	beq	.L635
-	ldr	r3, .L666+44
+	beq	.L648
+	ldr	r3, .L680+48
 	mov	r0, r6
 	ldrh	r2, [r3]
 	lsls	r2, r2, #9
 	bl	ftl_memcpy
-.L635:
+.L648:
 	ldr	r3, [r5, #12]
 	mov	r2, r6
 	ldr	r1, [sp, #24]
 	ldrb	r0, [sp, #20]	@ zero_extendqisi2
 	ldr	r7, [fp, #8]
 	blx	r7
-	cbnz	r0, .L636
+	cbnz	r0, .L649
 	str	r0, [r5]
-.L637:
-	ldr	r3, .L666
+.L650:
+	ldr	r3, .L680
 	ldrh	r3, [r3, #14]
 	cmp	r3, #4
-	bne	.L631
+	bne	.L644
 	ldr	r0, [sp]
 	add	r2, r6, #2048
 	ldr	r3, [r5, #12]
@@ -5117,27 +5142,28 @@ FlashProgPages:
 	ldrb	r0, [sp, #20]	@ zero_extendqisi2
 	blx	r6
 	cmp	r0, #0
-	bne	.L665
-.L631:
+	bne	.L679
+.L644:
 	add	r8, r8, #1
 	adds	r5, r5, #20
-	b	.L627
-.L647:
+	b	.L640
+.L661:
 	mov	r6, r1
-	b	.L635
-.L636:
+	b	.L648
+.L649:
 	mov	r3, #-1
 	str	r3, [r5]
-	b	.L637
-.L667:
+	b	.L650
+.L681:
 	.align	2
-.L666:
+.L680:
 	.word	.LANCHOR0
 	.word	.LANCHOR111
 	.word	.LANCHOR113
-	.word	.LC11
-	.word	.LC12
-	.word	.LC13
+	.word	.LC14
+	.word	.LC15
+	.word	.LC16
+	.word	.LC17
 	.word	.LANCHOR142
 	.word	.LC1
 	.word	.LC6
@@ -5157,133 +5183,133 @@ FlashProgPages:
 FtlLowFormatEraseBlock:
 	@ args = 0, pretend = 0, frame = 32
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L711
+	ldr	r3, .L725
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	sub	sp, sp, #32
-	ldr	r7, .L711+4
+	ldr	r7, .L725+4
 	mov	r8, #0
 	mov	r6, r1
 	mov	r5, r8
 	str	r0, [r3]
 	mov	r4, r8
-	ldr	r3, .L711+8
+	ldr	r3, .L725+8
 	mov	fp, #20
 	ldr	r10, [r7]
 	str	r0, [sp, #4]
 	ldrh	r3, [r3]
 	str	r3, [sp, #12]
-	ldr	r3, .L711+12
+	ldr	r3, .L725+12
 	ldr	r3, [r3]
 	str	r3, [sp, #16]
-	ldr	r3, .L711+16
+	ldr	r3, .L725+16
 	ldr	r3, [r3]
 	str	r3, [sp, #20]
-	ldr	r3, .L711+20
+	ldr	r3, .L725+20
 	ldrh	r3, [r3]
 	str	r3, [sp, #24]
-.L669:
+.L683:
 	ldr	r3, [sp, #12]
 	uxth	r2, r8
 	cmp	r3, r2
-	bhi	.L673
+	bhi	.L687
 	cmp	r5, #0
-	beq	.L668
+	beq	.L682
 	mov	r0, r10
 	mov	r8, #0
 	mov	r10, #20
 	mov	r2, r5
 	movs	r1, #0
 	bl	FlashEraseBlocks
-.L676:
+.L690:
 	uxth	r3, r8
 	cmp	r5, r3
-	bhi	.L678
+	bhi	.L692
 	cmp	r6, #0
-	beq	.L694
-	ldr	r3, .L711+24
+	beq	.L708
+	ldr	r3, .L725+24
 	mov	r10, #1
 	ldrh	r3, [r3]
 	str	r3, [sp, #8]
-.L679:
+.L693:
 	movs	r7, #0
-.L688:
-	ldr	r3, .L711+8
+.L702:
+	ldr	r3, .L725+8
 	mov	r8, #0
 	mov	r5, r8
 	ldrh	r3, [r3]
 	str	r3, [sp, #16]
-	ldr	r3, .L711+4
+	ldr	r3, .L725+4
 	ldr	fp, [r3]
-	ldr	r3, .L711+28
+	ldr	r3, .L725+28
 	ldr	r3, [r3]
 	str	r3, [sp, #20]
-	ldr	r3, .L711+12
+	ldr	r3, .L725+12
 	ldr	r3, [r3]
 	str	r3, [sp, #24]
-	ldr	r3, .L711+20
+	ldr	r3, .L725+20
 	ldrh	r3, [r3]
 	str	r3, [sp, #28]
-.L680:
+.L694:
 	ldr	r3, [sp, #16]
 	uxth	r2, r8
 	cmp	r3, r2
-	bhi	.L683
-	cbz	r5, .L668
+	bhi	.L697
+	cbz	r5, .L682
 	mov	r0, fp
-	ldr	fp, .L711+4
+	ldr	fp, .L725+4
 	movs	r3, #1
 	mov	r2, r10
 	mov	r1, r5
 	mov	r8, #0
 	bl	FlashProgPages
 	movs	r3, #20
-.L685:
+.L699:
 	uxth	r2, r8
 	cmp	r5, r2
-	bhi	.L687
+	bhi	.L701
 	adds	r7, r7, #1
 	ldr	r2, [sp, #8]
 	uxth	r3, r7
 	cmp	r2, r3
-	bhi	.L688
-	ldr	r8, .L711+4
+	bhi	.L702
+	ldr	r8, .L725+4
 	movs	r7, #0
 	mov	fp, #20
-.L689:
+.L703:
 	uxth	r3, r7
 	cmp	r5, r3
-	bhi	.L691
+	bhi	.L705
 	ldr	r3, [sp, #4]
 	cmp	r3, #63
-	bls	.L692
-	cbz	r6, .L668
-.L692:
-	ldr	r3, .L711+4
+	bls	.L706
+	cbz	r6, .L682
+.L706:
+	ldr	r3, .L725+4
 	mov	r2, r5
 	mov	r1, r10
 	ldr	r0, [r3]
 	bl	FlashEraseBlocks
-.L668:
+.L682:
 	mov	r0, r4
 	add	sp, sp, #32
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L673:
+.L687:
 	mul	r2, fp, r8
 	movs	r3, #0
 	ldr	r1, [sp, #4]
 	str	r3, [r10, r2]
-	ldr	r3, .L711+32
+	ldr	r3, .L725+32
 	ldrb	r0, [r3, r8]	@ zero_extendqisi2
 	bl	V2P_block
 	str	r0, [sp, #8]
-	cbz	r6, .L670
+	cbz	r6, .L684
 	bl	IsBlkInVendorPart
-	cbnz	r0, .L671
-.L670:
+	cbnz	r0, .L685
+.L684:
 	ldr	r0, [sp, #8]
 	bl	FtlBbmIsBadBlock
-	cbnz	r0, .L672
+	cbnz	r0, .L686
 	ldr	r3, [sp, #8]
 	mla	r1, fp, r5, r10
 	lsls	r2, r3, #10
@@ -5298,50 +5324,50 @@ FtlLowFormatEraseBlock:
 	bic	r2, r2, #3
 	add	r2, r2, r3
 	str	r2, [r1, #12]
-.L671:
+.L685:
 	add	r8, r8, #1
-	b	.L669
-.L672:
+	b	.L683
+.L686:
 	adds	r4, r4, #1
 	uxth	r4, r4
-	b	.L671
-.L678:
+	b	.L685
+.L692:
 	mul	r3, r10, r8
 	ldr	r2, [r7]
 	adds	r1, r2, r3
 	ldr	r3, [r2, r3]
 	adds	r3, r3, #1
-	bne	.L677
+	bne	.L691
 	ldr	r0, [r1, #4]
 	adds	r4, r4, #1
 	uxth	r4, r4
 	ubfx	r0, r0, #10, #16
 	bl	FtlBbmMapBadBlock
-.L677:
+.L691:
 	add	r8, r8, #1
-	b	.L676
-.L694:
+	b	.L690
+.L708:
 	movs	r3, #2
 	mov	r10, r6
 	str	r3, [sp, #8]
-	b	.L679
-.L683:
+	b	.L693
+.L697:
 	movs	r3, #20
 	ldr	r1, [sp, #4]
 	mul	r2, r3, r8
 	movs	r3, #0
 	str	r3, [fp, r2]
-	ldr	r3, .L711+32
+	ldr	r3, .L725+32
 	ldrb	r0, [r3, r8]	@ zero_extendqisi2
 	bl	V2P_block
 	str	r0, [sp, #12]
-	cbz	r6, .L681
+	cbz	r6, .L695
 	bl	IsBlkInVendorPart
-	cbnz	r0, .L682
-.L681:
+	cbnz	r0, .L696
+.L695:
 	ldr	r0, [sp, #12]
 	bl	FtlBbmIsBadBlock
-	cbnz	r0, .L682
+	cbnz	r0, .L696
 	movs	r3, #20
 	mla	r1, r3, r5, fp
 	ldr	r3, [sp, #12]
@@ -5357,15 +5383,15 @@ FtlLowFormatEraseBlock:
 	bic	r2, r2, #3
 	add	r2, r2, r3
 	str	r2, [r1, #12]
-.L682:
+.L696:
 	add	r8, r8, #1
-	b	.L680
-.L687:
+	b	.L694
+.L701:
 	mul	r2, r3, r8
 	ldr	r1, [fp]
 	adds	r0, r1, r2
 	ldr	r2, [r1, r2]
-	cbz	r2, .L686
+	cbz	r2, .L700
 	ldr	r0, [r0, #4]
 	adds	r4, r4, #1
 	str	r3, [sp, #12]
@@ -5373,26 +5399,26 @@ FtlLowFormatEraseBlock:
 	ubfx	r0, r0, #10, #16
 	bl	FtlBbmMapBadBlock
 	ldr	r3, [sp, #12]
-.L686:
+.L700:
 	add	r8, r8, #1
-	b	.L685
-.L691:
-	cbz	r6, .L690
+	b	.L699
+.L705:
+	cbz	r6, .L704
 	mul	r3, fp, r7
 	ldr	r2, [r8]
 	adds	r1, r2, r3
 	ldr	r3, [r2, r3]
-	cbnz	r3, .L690
+	cbnz	r3, .L704
 	ldr	r0, [r1, #4]
 	movs	r1, #1
 	ubfx	r0, r0, #10, #16
 	bl	FtlFreeSysBlkQueueIn
-.L690:
+.L704:
 	adds	r7, r7, #1
-	b	.L689
-.L712:
+	b	.L703
+.L726:
 	.align	2
-.L711:
+.L725:
 	.word	.LANCHOR99
 	.word	.LANCHOR79
 	.word	.LANCHOR3
@@ -5418,8 +5444,8 @@ FlashTestBlk:
 	push	{r4, r5, lr}
 	mov	r5, r0
 	sub	sp, sp, #92
-	bls	.L716
-	ldr	r4, .L718
+	bls	.L730
+	ldr	r4, .L732
 	add	r0, sp, #24
 	movs	r2, #32
 	movs	r1, #165
@@ -5443,7 +5469,7 @@ FlashTestBlk:
 	mov	r1, r3
 	bl	FlashProgPages
 	ldr	r3, [sp, #4]
-	cbnz	r3, .L717
+	cbnz	r3, .L731
 	adds	r3, r5, #1
 	add	r0, sp, #4
 	str	r3, [sp, #8]
@@ -5456,26 +5482,26 @@ FlashTestBlk:
 	it	ne
 	movne	r4, #1
 	negs	r4, r4
-.L715:
+.L729:
 	movs	r2, #1
 	movs	r1, #0
 	add	r0, sp, #4
 	str	r5, [sp, #8]
 	bl	FlashEraseBlocks
-.L713:
+.L727:
 	mov	r0, r4
 	add	sp, sp, #92
 	@ sp needed
 	pop	{r4, r5, pc}
-.L717:
+.L731:
 	mov	r4, #-1
-	b	.L715
-.L716:
+	b	.L729
+.L730:
 	movs	r4, #0
-	b	.L713
-.L719:
+	b	.L727
+.L733:
 	.align	2
-.L718:
+.L732:
 	.word	.LANCHOR112
 	.size	FlashTestBlk, .-FlashTestBlk
 	.section	.text.FtlBbmTblFlush,"ax",%progbits
@@ -5490,38 +5516,38 @@ FtlBbmTblFlush:
 	@ args = 0, pretend = 0, frame = 8
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
-	movs	r4, #0
-	ldr	r7, .L729
 	movs	r1, #0
-	ldr	r5, .L729+4
+	ldr	r7, .L748
+	movs	r4, #0
+	ldr	r5, .L748+4
 	ldr	r3, [r7]
-	mov	fp, r7
-	ldr	r8, .L729+48
-	ldr	r6, .L729+8
+	ldr	fp, .L748+52
+	ldr	r6, .L748+8
 	str	r3, [r5, #12]
-	ldr	r7, .L729+12
-	ldr	r3, .L729+16
-	ldr	r10, .L729+52
-	ldr	r0, [r8]
+	ldr	r3, .L748+12
+	ldr	r0, [fp]
+	ldr	r8, .L748+56
 	ldrh	r2, [r3]
 	str	r0, [r5, #8]
 	bl	ftl_memset
-.L721:
+	str	r7, [sp, #12]
+	ldr	r7, .L748+16
+.L735:
 	ldrh	r3, [r7]
 	cmp	r4, r3
-	blt	.L722
+	blt	.L736
 	ldr	r6, [r5, #12]
 	movs	r2, #16
-	ldr	r4, .L729+20
+	ldr	r4, .L748+20
 	movs	r1, #255
 	movs	r7, #0
 	mov	r0, r6
+	mov	r8, r7
 	bl	ftl_memset
 	movw	r3, #61649
 	mov	r10, r4
 	strh	r3, [r6]	@ movhi
 	ldr	r3, [r4, #8]
-	str	r7, [sp, #12]
 	str	r3, [r6, #4]
 	ldrh	r3, [r4]
 	strh	r3, [r6, #2]	@ movhi
@@ -5529,16 +5555,20 @@ FtlBbmTblFlush:
 	strh	r3, [r6, #8]	@ movhi
 	ldrh	r3, [r4, #6]
 	strh	r3, [r6, #10]	@ movhi
-	ldr	r3, .L729+24
+	ldr	r3, .L748+24
 	ldr	r3, [r3]
 	strh	r3, [r6, #12]	@ movhi
-.L723:
-	ldr	r3, [r8]
+	ldr	r3, .L748+28
+	ldr	r3, [r3]
+	strh	r3, [r6, #14]	@ movhi
+.L737:
+	ldr	r3, [fp]
 	ldrh	r2, [r4, #2]
 	ldrh	r1, [r4]
 	str	r3, [r5, #8]
-	ldr	r3, [fp]
+	ldr	r3, [sp, #12]
 	ldrh	r0, [r6, #10]
+	ldr	r3, [r3]
 	str	r3, [r5, #12]
 	movs	r3, #0
 	str	r3, [r5]
@@ -5546,14 +5576,14 @@ FtlBbmTblFlush:
 	str	r3, [r5, #4]
 	ldrh	r3, [r4, #4]
 	str	r0, [sp]
-	ldr	r0, .L729+28
+	ldr	r0, .L748+32
 	bl	printf
-	ldr	r3, .L729+32
+	ldr	r3, .L748+36
 	ldrh	r2, [r4, #2]
 	ldrh	r3, [r3]
 	subs	r3, r3, #1
 	cmp	r2, r3
-	blt	.L724
+	blt	.L738
 	ldr	r3, [r4, #8]
 	mov	r1, #0	@ movhi
 	ldrh	r2, [r4]
@@ -5564,7 +5594,7 @@ FtlBbmTblFlush:
 	strh	r2, [r6, #8]	@ movhi
 	ldrh	r3, [r4, #4]
 	strh	r2, [r4, #4]	@ movhi
-	ldr	r2, .L729+36
+	ldr	r2, .L748+40
 	strh	r3, [r4]	@ movhi
 	lsls	r3, r3, #10
 	ldr	r0, [r2]
@@ -5573,9 +5603,9 @@ FtlBbmTblFlush:
 	mov	r1, r2
 	str	r3, [r0, #4]
 	bl	FlashEraseBlocks
-.L724:
+.L738:
 	movs	r3, #1
-	ldr	r0, .L729+4
+	ldr	r0, .L748+4
 	mov	r2, r3
 	mov	r1, r3
 	bl	FlashProgPages
@@ -5583,23 +5613,23 @@ FtlBbmTblFlush:
 	adds	r3, r3, #1
 	strh	r3, [r10, #2]	@ movhi
 	ldr	r3, [r5]
-	adds	r3, r3, #1
-	bne	.L725
+	adds	r2, r3, #1
+	bne	.L739
 	adds	r7, r7, #1
 	ldr	r1, [r5, #4]
 	uxth	r7, r7
-	ldr	r0, .L729+40
+	ldr	r0, .L748+44
 	bl	printf
 	cmp	r7, #3
-	bls	.L723
+	bls	.L737
 	mov	r2, r7
 	ldr	r1, [r5, #4]
-	ldr	r0, .L729+44
+	ldr	r0, .L748+48
 	bl	printf
-.L727:
-	b	.L727
-.L722:
-	ldrh	r2, [r10]
+.L741:
+	b	.L741
+.L736:
+	ldrh	r2, [r8]
 	ldr	r3, [r5, #8]
 	ldr	r1, [r6, #4]!
 	mul	r0, r2, r4
@@ -5607,34 +5637,33 @@ FtlBbmTblFlush:
 	adds	r4, r4, #1
 	add	r0, r3, r0, lsl #2
 	bl	ftl_memcpy
-	b	.L721
-.L728:
-	movs	r3, #1
-	str	r3, [sp, #12]
-	b	.L723
-.L725:
-	ldr	r3, [sp, #12]
-	cmp	r3, #0
-	beq	.L728
+	b	.L735
+.L739:
+	add	r8, r8, #1
+	cmp	r8, #1
+	beq	.L737
+	cmp	r3, #256
+	beq	.L737
 	movs	r0, #0
 	add	sp, sp, #16
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L730:
+.L749:
 	.align	2
-.L729:
+.L748:
 	.word	.LANCHOR114
 	.word	.LANCHOR138
 	.word	.LANCHOR37+24
-	.word	.LANCHOR10
 	.word	.LANCHOR23
+	.word	.LANCHOR10
 	.word	.LANCHOR37
 	.word	.LANCHOR2
-	.word	.LC14
+	.word	.LANCHOR143
+	.word	.LC18
 	.word	.LANCHOR20
 	.word	.LANCHOR79
-	.word	.LC15
-	.word	.LC16
+	.word	.LC19
+	.word	.LC20
 	.word	.LANCHOR106
 	.word	.LANCHOR127
 	.size	FtlBbmTblFlush, .-FtlBbmTblFlush
@@ -5651,26 +5680,26 @@ allocate_data_superblock:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r4, r0
-.L732:
-	ldr	r3, .L771
-	ldr	r8, .L771+68
+.L751:
+	ldr	r3, .L790
+	ldr	r8, .L790+68
 	ldrh	r3, [r3]
-	ldr	r10, .L771+72
+	ldr	r10, .L790+72
 	ldrh	r2, [r8]
 	add	r3, r3, r2
 	ldrh	r2, [r10]
 	cmp	r3, r2
-	ble	.L733
-	movw	r2, #2661
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	ble	.L752
+	mov	r2, #2656
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-.L733:
-	ldr	r3, .L771+12
+.L752:
+	ldr	r3, .L790+12
 	cmp	r4, r3
-	bne	.L759
-	ldr	r3, .L771
-	ldr	r2, .L771+16
+	bne	.L778
+	ldr	r3, .L790
+	ldr	r2, .L790+16
 	ldrh	r3, [r3]
 	ldr	r2, [r2]
 	lsrs	r1, r3, #1
@@ -5678,118 +5707,118 @@ allocate_data_superblock:
 	adds	r1, r1, #1
 	add	r1, r1, r2, lsr #2
 	uxth	r1, r1
-	cbz	r1, .L734
+	cbz	r1, .L753
 	subs	r1, r1, #1
 	uxth	r1, r1
-.L734:
-	ldr	r0, .L771+20
+.L753:
+	ldr	r0, .L790+20
 	bl	List_pop_index_node
-	ldr	r3, .L771
+	ldr	r3, .L790
 	mov	r5, r0
 	uxth	r7, r0
 	ldrh	r3, [r3]
-	cbnz	r3, .L735
-	movw	r2, #2670
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	cbnz	r3, .L754
+	movw	r2, #2665
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-.L735:
-	ldr	r3, .L771
-	ldr	r2, .L771
+.L754:
+	ldr	r3, .L790
+	ldr	r2, .L790
 	ldrh	r3, [r3]
 	subs	r3, r3, #1
 	strh	r3, [r2]	@ movhi
 	ldrh	r3, [r10]
 	cmp	r3, r7
-	bls	.L732
+	bls	.L751
 	uxth	r5, r5
 	lsls	r3, r5, #1
 	str	r3, [sp]
-	ldr	r3, .L771+24
+	ldr	r3, .L790+24
 	ldr	r3, [r3]
 	ldrh	r6, [r3, r5, lsl #1]
 	cmp	r6, #0
-	bne	.L732
+	bne	.L751
 	strh	r7, [r4]	@ movhi
 	mov	r0, r4
 	bl	make_superblock
 	ldrb	r3, [r4, #7]	@ zero_extendqisi2
-	cbnz	r3, .L737
-	ldr	r3, .L771+24
+	cbnz	r3, .L756
+	ldr	r3, .L790+24
 	movw	r2, #65535
 	mov	r0, r7
 	ldr	r3, [r3]
 	strh	r2, [r3, r5, lsl #1]	@ movhi
 	bl	INSERT_DATA_LIST
-	ldr	r3, .L771
+	ldr	r3, .L790
 	ldrh	r2, [r8]
 	ldrh	r3, [r3]
 	add	r3, r3, r2
 	ldrh	r2, [r10]
 	cmp	r3, r2
-	ble	.L732
-	movw	r2, #2684
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	ble	.L751
+	movw	r2, #2679
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-	b	.L732
-.L759:
+	b	.L751
+.L778:
 	movs	r1, #0
-	b	.L734
-.L737:
-	ldr	r3, .L771
+	b	.L753
+.L756:
+	ldr	r3, .L790
 	ldrh	r2, [r8]
 	ldrh	r3, [r3]
 	add	r3, r3, r2
 	ldrh	r2, [r10]
 	cmp	r3, r2
-	ble	.L739
-	movw	r2, #2687
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	ble	.L758
+	movw	r2, #2682
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-.L739:
-	ldr	r3, .L771+28
+.L758:
+	ldr	r3, .L790+28
 	add	lr, r4, #16
-	ldr	r2, .L771+32
+	ldr	r2, .L790+32
 	mov	r8, #0
 	ldr	ip, [r3]
 	ldrh	r0, [r2]
 	movs	r2, #20
 	mov	r3, ip
 	mla	r0, r2, r0, ip
-.L740:
+.L759:
 	cmp	r0, r3
-	bne	.L742
-	cbnz	r6, .L743
-	movw	r2, #2698
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	bne	.L761
+	cbnz	r6, .L762
+	movw	r2, #2693
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-.L743:
-	ldr	r3, .L771+36
+.L762:
+	ldr	r3, .L790+36
 	ldrh	r3, [r3]
 	cmp	r3, r7
-	bne	.L744
-	movw	r2, #2700
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	bne	.L763
+	movw	r2, #2695
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-.L744:
+.L763:
 	ldrb	r2, [r4, #8]	@ zero_extendqisi2
-	ldr	r3, .L771+40
-	ldr	fp, .L771+76
-	ldr	r8, .L771+80
+	ldr	r3, .L790+40
+	ldr	fp, .L790+76
+	ldr	r8, .L790+80
 	ldr	r1, [r3]
 	cmp	r2, #0
-	bne	.L745
+	bne	.L764
 	ldrh	r2, [r1, r5, lsl #1]
 	cmp	r2, #0
-	beq	.L746
-	ldr	r0, .L771+44
+	beq	.L765
+	ldr	r0, .L790+44
 	ldrh	r0, [r0]
 	add	r2, r2, r0
-.L769:
+.L788:
 	strh	r2, [r1, r5, lsl #1]	@ movhi
 	mov	r0, r7
 	ldr	r2, [fp]
@@ -5798,83 +5827,83 @@ allocate_data_superblock:
 	adds	r2, r2, #1
 	str	r2, [fp]
 	bl	ftl_set_blk_mode
-.L770:
+.L789:
 	ldr	r3, [sp, #4]
 	ldr	r0, [fp]
 	ldr	r3, [r3]
 	ldrh	r1, [r3, r5, lsl #1]
-	ldr	r3, .L771+48
+	ldr	r3, .L790+48
 	ldr	r2, [r3]
 	cmp	r1, r2
 	it	hi
 	strhi	r1, [r3]
-	ldr	r3, .L771+44
+	ldr	r3, .L790+44
 	ldrh	r1, [r10]
 	ldrh	r2, [r3]
 	ldr	r3, [r8]
 	mla	r0, r0, r2, r3
 	bl	__aeabi_uidiv
-	ldr	r3, .L771+52
-	ldr	ip, .L771+84
+	ldr	r3, .L790+52
+	ldr	ip, .L790+84
 	str	r0, [r3]
-	ldr	r3, .L771+56
+	ldr	r3, .L790+56
 	ldr	r2, [r3]
 	ldr	r3, [r2, #16]
 	adds	r3, r3, #1
 	str	r3, [r2, #16]
 	movs	r2, #20
-	ldr	r3, .L771+28
+	ldr	r3, .L790+28
 	ldr	r0, [r3]
 	adds	r3, r0, #4
 	mla	r2, r2, r6, r0
 	adds	r2, r2, #24
-.L750:
+.L769:
 	adds	r3, r3, #20
 	cmp	r2, r3
-	bne	.L751
+	bne	.L770
 	mov	r2, r6
 	ldrb	r1, [r4, #8]	@ zero_extendqisi2
 	mov	r8, #0
 	bl	FlashEraseBlocks
 	mov	r10, r8
 	movs	r3, #20
-.L752:
+.L771:
 	uxth	r2, r8
 	cmp	r6, r2
-	bhi	.L754
+	bhi	.L773
 	cmp	r10, #0
-	beq	.L755
+	beq	.L774
 	mov	r0, r7
 	bl	update_multiplier_value
 	bl	FtlBbmTblFlush
-.L755:
+.L774:
 	ldrb	r2, [r4, #7]	@ zero_extendqisi2
 	cmp	r2, #0
-	bne	.L756
-	ldr	r3, .L771+24
+	bne	.L775
+	ldr	r3, .L790+24
 	movw	r2, #65535
 	ldr	r3, [r3]
 	strh	r2, [r3, r5, lsl #1]	@ movhi
-	b	.L732
-.L742:
+	b	.L751
+.L761:
 	ldrh	r1, [lr], #2
 	movw	fp, #65535
 	str	r8, [r3, #8]
 	str	r8, [r3, #12]
 	cmp	r1, fp
-	beq	.L741
+	beq	.L760
 	mla	fp, r2, r6, ip
 	adds	r6, r6, #1
 	lsls	r1, r1, #10
 	uxth	r6, r6
 	str	r1, [fp, #4]
-.L741:
+.L760:
 	adds	r3, r3, #20
-	b	.L740
-.L746:
+	b	.L759
+.L765:
 	movs	r2, #2
-	b	.L769
-.L745:
+	b	.L788
+.L764:
 	ldrh	r2, [r1, r5, lsl #1]
 	mov	r0, r7
 	str	r3, [sp, #4]
@@ -5884,20 +5913,20 @@ allocate_data_superblock:
 	adds	r2, r2, #1
 	str	r2, [r8]
 	bl	ftl_set_blk_mode.part.6
-	b	.L770
-.L751:
+	b	.L789
+.L770:
 	ldr	r1, [r3, #-20]
 	and	r1, r1, ip
 	str	r1, [r3, #-20]
-	b	.L750
-.L754:
-	ldr	r1, .L771+28
+	b	.L769
+.L773:
+	ldr	r1, .L790+28
 	mul	r2, r3, r8
 	ldr	r1, [r1]
 	ldr	fp, [r1, r2]
 	adds	r0, r1, r2
 	cmp	fp, #-1
-	bne	.L753
+	bne	.L772
 	ldr	r0, [r0, #4]
 	add	r10, r10, #1
 	str	r3, [sp, #4]
@@ -5909,12 +5938,12 @@ allocate_data_superblock:
 	ldrb	r2, [r4, #7]	@ zero_extendqisi2
 	subs	r2, r2, #1
 	strb	r2, [r4, #7]
-.L753:
+.L772:
 	add	r8, r8, #1
-	b	.L752
-.L756:
-	ldr	r3, .L771+60
-	ldr	r1, .L771+64
+	b	.L771
+.L775:
+	ldr	r3, .L790+60
+	ldr	r1, .L790+64
 	ldrh	r3, [r3]
 	strh	r7, [r4]	@ movhi
 	smulbb	r3, r3, r2
@@ -5927,45 +5956,45 @@ allocate_data_superblock:
 	str	r2, [r4, #12]
 	adds	r2, r2, #1
 	str	r2, [r1]
-	ldr	r2, .L771+24
+	ldr	r2, .L790+24
 	ldr	r1, [sp]
 	ldr	r2, [r2]
 	strh	r3, [r2, r1]	@ movhi
 	ldrh	r3, [r4, #4]
-	cbz	r3, .L757
+	cbz	r3, .L776
 	ldrb	r3, [r4, #7]	@ zero_extendqisi2
-	cbnz	r3, .L758
-.L757:
-	movw	r2, #2753
-	ldr	r1, .L771+4
-	ldr	r0, .L771+8
+	cbnz	r3, .L777
+.L776:
+	movw	r2, #2748
+	ldr	r1, .L790+4
+	ldr	r0, .L790+8
 	bl	printf
-.L758:
+.L777:
 	movs	r0, #0
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L772:
+.L791:
 	.align	2
-.L771:
+.L790:
 	.word	.LANCHOR48
-	.word	.LANCHOR143
+	.word	.LANCHOR144
 	.word	.LC1
 	.word	.LANCHOR53
 	.word	.LANCHOR95
-	.word	.LANCHOR47
+	.word	.LANCHOR46
 	.word	.LANCHOR42
 	.word	.LANCHOR79
 	.word	.LANCHOR3
-	.word	.LANCHOR144
-	.word	.LANCHOR43
+	.word	.LANCHOR145
+	.word	.LANCHOR47
 	.word	.LANCHOR14
 	.word	.LANCHOR92
-	.word	.LANCHOR145
+	.word	.LANCHOR143
 	.word	.LANCHOR118
 	.word	.LANCHOR19
 	.word	.LANCHOR82
-	.word	.LANCHOR45
+	.word	.LANCHOR44
 	.word	.LANCHOR5
 	.word	.LANCHOR90
 	.word	.LANCHOR91
@@ -5984,43 +6013,43 @@ FtlGcFreeBadSuperBlk:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r10, r0
-	ldr	r4, .L785
+	ldr	r4, .L804
 	ldrh	r3, [r4]
-	cbz	r3, .L774
-	ldr	r8, .L785+12
+	cbz	r3, .L793
+	ldr	r8, .L804+12
 	movs	r7, #0
-.L775:
-	ldr	r3, .L785+4
+.L794:
+	ldr	r3, .L804+4
 	ldrh	r2, [r3]
 	uxth	r3, r7
 	cmp	r2, r3
-	bhi	.L781
+	bhi	.L800
 	bl	FtlGcReFreshBadBlk
-.L774:
+.L793:
 	movs	r0, #0
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L781:
-	ldr	r2, .L785+8
+.L800:
+	ldr	r2, .L804+8
 	uxth	r3, r7
 	mov	r1, r10
 	mov	fp, #0
 	ldrb	r0, [r2, r3]	@ zero_extendqisi2
 	bl	V2P_block
 	mov	r1, r0
-.L776:
+.L795:
 	ldrh	r3, [r4]
 	uxth	r5, fp
 	cmp	r3, r5
-	bhi	.L780
+	bhi	.L799
 	adds	r7, r7, #1
-	b	.L775
-.L780:
+	b	.L794
+.L799:
 	uxth	r6, fp
 	ldrh	r3, [r8, r6, lsl #1]
 	cmp	r3, r1
-	bne	.L777
+	bne	.L796
 	mov	r0, r1
 	str	r1, [sp, #4]
 	bl	FtlBbmMapBadBlock
@@ -6028,23 +6057,23 @@ FtlGcFreeBadSuperBlk:
 	ldrh	r2, [r4]
 	add	r3, r8, r6, lsl #1
 	ldr	r1, [sp, #4]
-.L778:
+.L797:
 	cmp	r5, r2
-	bcc	.L779
+	bcc	.L798
 	subs	r2, r2, #1
 	strh	r2, [r4]	@ movhi
-.L777:
+.L796:
 	add	fp, fp, #1
-	b	.L776
-.L779:
+	b	.L795
+.L798:
 	ldrh	r0, [r3, #2]!
 	adds	r5, r5, #1
 	uxth	r5, r5
 	strh	r0, [r3, #-2]	@ movhi
-	b	.L778
-.L786:
+	b	.L797
+.L805:
 	.align	2
-.L785:
+.L804:
 	.word	.LANCHOR74
 	.word	.LANCHOR3
 	.word	.LANCHOR13
@@ -6063,29 +6092,41 @@ update_vpc_list:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	mov	r4, r0
-	ldr	r3, .L797
+	ldr	r3, .L818
 	ldr	r3, [r3]
 	ldrh	r3, [r3, r0, lsl #1]
 	cmp	r3, #0
-	bne	.L788
-	ldr	r2, .L797+4
-	ldrh	r1, [r2]
-	cmp	r1, r0
-	bne	.L789
-	movw	r3, #65535
-	strh	r3, [r2]	@ movhi
-.L790:
-	ldr	r5, .L797+8
+	bne	.L807
+	ldr	r3, .L818+4
+	ldrh	r2, [r3]
+	cmp	r2, r0
+	itt	eq
+	movweq	r2, #65535
+	strheq	r2, [r3]	@ movhi
+	ldr	r3, .L818+8
+	ldrh	r2, [r3]
+	cmp	r2, r0
+	itt	eq
+	movweq	r2, #65535
+	strheq	r2, [r3]	@ movhi
+	ldr	r3, .L818+12
+	ldrh	r2, [r3]
+	cmp	r2, r0
+	bne	.L810
+	movw	r2, #65535
+	strh	r2, [r3]	@ movhi
+.L811:
+	ldr	r5, .L818+16
 	mov	r1, r4
-	ldr	r0, .L797+12
+	ldr	r0, .L818+20
 	bl	List_remove_node
 	ldrh	r3, [r5]
-	cbnz	r3, .L792
-	movw	r2, #2823
-	ldr	r1, .L797+16
-	ldr	r0, .L797+20
+	cbnz	r3, .L813
+	movw	r2, #2824
+	ldr	r1, .L818+24
+	ldr	r0, .L818+28
 	bl	printf
-.L792:
+.L813:
 	ldrh	r3, [r5]
 	mov	r0, r4
 	subs	r3, r3, #1
@@ -6093,47 +6134,48 @@ update_vpc_list:
 	bl	free_data_superblock
 	mov	r0, r4
 	bl	FtlGcFreeBadSuperBlk
-	ldr	r3, .L797+24
+	ldr	r3, .L818+32
 	ldrh	r2, [r5]
 	ldrh	r3, [r3]
 	add	r3, r3, r2
-	ldr	r2, .L797+28
+	ldr	r2, .L818+36
 	ldrh	r2, [r2]
 	cmp	r3, r2
-	ble	.L796
-	movw	r2, #2826
-	ldr	r1, .L797+16
-	ldr	r0, .L797+20
+	ble	.L817
+	movw	r2, #2827
+	ldr	r1, .L818+24
+	ldr	r0, .L818+28
 	bl	printf
-.L796:
-	movs	r3, #1
-	b	.L787
-.L789:
-	ldr	r2, .L797+32
-	ldrh	r2, [r2]
-	cmp	r2, r0
-	beq	.L787
-	ldr	r2, .L797+36
-	ldrh	r2, [r2]
-	cmp	r2, r0
-	beq	.L787
-	ldr	r2, .L797+40
-	ldrh	r2, [r2]
-	cmp	r2, r0
-	bne	.L790
-.L787:
-	mov	r0, r3
+.L817:
+	movs	r0, #1
 	pop	{r3, r4, r5, pc}
-.L788:
+.L810:
+	ldr	r3, .L818+40
+	ldrh	r3, [r3]
+	cmp	r3, r0
+	beq	.L816
+	ldr	r3, .L818+44
+	ldrh	r3, [r3]
+	cmp	r3, r0
+	beq	.L816
+	ldr	r3, .L818+48
+	ldrh	r3, [r3]
+	cmp	r3, r0
+	bne	.L811
+.L816:
+	movs	r0, #0
+	pop	{r3, r4, r5, pc}
+.L807:
 	bl	List_update_data_list
-	movs	r3, #0
-	b	.L787
-.L798:
+	b	.L816
+.L819:
 	.align	2
-.L797:
+.L818:
 	.word	.LANCHOR42
-	.word	.LANCHOR144
-	.word	.LANCHOR45
+	.word	.LANCHOR72
+	.word	.LANCHOR73
+	.word	.LANCHOR145
+	.word	.LANCHOR44
 	.word	.LANCHOR41
 	.word	.LANCHOR146
 	.word	.LC1
@@ -6158,47 +6200,47 @@ decrement_vpc_count:
 	push	{r4, r5, r6, lr}
 	cmp	r0, r3
 	mov	r4, r0
-	beq	.L800
-	ldr	r5, .L808
+	beq	.L821
+	ldr	r5, .L829
 	ldr	r3, [r5]
 	ldrh	r2, [r3, r0, lsl #1]
-	cbnz	r2, .L801
+	cbnz	r2, .L822
 	mov	r1, r0
-	ldr	r0, .L808+4
+	ldr	r0, .L829+4
 	bl	printf
 	ldr	r3, [r5]
 	ldrh	r5, [r3, r4, lsl #1]
-	cbz	r5, .L802
-.L806:
+	cbz	r5, .L823
+.L827:
 	movs	r5, #0
-.L799:
+.L820:
 	mov	r0, r5
 	pop	{r4, r5, r6, pc}
-.L802:
-	movw	r2, #2841
-.L807:
-	ldr	r1, .L808+8
-	ldr	r0, .L808+12
+.L823:
+	movw	r2, #2842
+.L828:
+	ldr	r1, .L829+8
+	ldr	r0, .L829+12
 	bl	printf
-	b	.L799
-.L801:
+	b	.L820
+.L822:
 	subs	r2, r2, #1
 	strh	r2, [r3, r0, lsl #1]	@ movhi
-.L800:
-	ldr	r6, .L808+16
+.L821:
+	ldr	r6, .L829+16
 	movw	r3, #65535
 	ldrh	r0, [r6]
 	cmp	r0, r3
-	bne	.L804
+	bne	.L825
 	strh	r4, [r6]	@ movhi
-	b	.L806
-.L804:
+	b	.L827
+.L825:
 	cmp	r4, r0
-	beq	.L806
+	beq	.L827
 	bl	update_vpc_list
-	ldr	r3, .L808+20
+	ldr	r3, .L829+20
 	adds	r5, r0, #0
-	ldr	r2, .L808+24
+	ldr	r2, .L829+24
 	it	ne
 	movne	r5, #1
 	strh	r4, [r6]	@ movhi
@@ -6206,23 +6248,23 @@ decrement_vpc_count:
 	ldr	r2, [r2]
 	subs	r3, r3, r2
 	asrs	r2, r3, #1
-	ldr	r3, .L808+28
+	ldr	r3, .L829+28
 	muls	r3, r2, r3
-	ldr	r2, .L808
+	ldr	r2, .L829
 	ldr	r2, [r2]
 	uxth	r1, r3
 	ldrh	r2, [r2, r1, lsl #1]
 	cmp	r2, #0
-	bne	.L799
+	bne	.L820
 	cmp	r4, r1
-	beq	.L799
-	movw	r2, #2857
-	b	.L807
-.L809:
+	beq	.L820
+	movw	r2, #2858
+	b	.L828
+.L830:
 	.align	2
-.L808:
+.L829:
 	.word	.LANCHOR42
-	.word	.LC17
+	.word	.LC21
 	.word	.LANCHOR147
 	.word	.LC1
 	.word	.LANCHOR131
@@ -6244,14 +6286,14 @@ FtlSuperblockPowerLostFix:
 	push	{r4, r5, r6, r7, r8, lr}
 	mov	r3, #-1
 	sub	sp, sp, #24
-	ldr	r2, .L823
+	ldr	r2, .L844
 	movs	r6, #0
 	mov	r4, r0
 	str	r3, [sp, #20]
-	ldr	r3, .L823+4
+	ldr	r3, .L844+4
 	ldr	r5, [r2]
 	mvn	r2, #2
-	ldr	r8, .L823+16
+	ldr	r8, .L844+16
 	ldr	r3, [r3]
 	str	r5, [sp, #16]
 	str	r3, [sp, #12]
@@ -6272,18 +6314,18 @@ FtlSuperblockPowerLostFix:
 	ite	eq
 	moveq	r7, #6
 	movne	r7, #7
-.L816:
+.L837:
 	ldrh	r3, [r4, #4]
-	cbnz	r3, .L812
-.L813:
-	ldr	r3, .L823+8
+	cbnz	r3, .L833
+.L834:
+	ldr	r3, .L844+8
 	ldrh	r1, [r4]
 	ldrh	r0, [r4, #4]
 	ldr	r2, [r3]
 	ldrh	r3, [r2, r1, lsl #1]
 	subs	r3, r3, r0
 	strh	r3, [r2, r1, lsl #1]	@ movhi
-	ldr	r3, .L823+12
+	ldr	r3, .L844+12
 	ldrh	r3, [r3]
 	strh	r3, [r4, #2]	@ movhi
 	movs	r3, #0
@@ -6292,12 +6334,12 @@ FtlSuperblockPowerLostFix:
 	add	sp, sp, #24
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, pc}
-.L812:
+.L833:
 	mov	r0, r4
 	bl	get_new_active_ppa
 	str	r0, [sp, #8]
 	adds	r0, r0, #1
-	beq	.L813
+	beq	.L834
 	ldr	r3, [r8]
 	movs	r1, #1
 	add	r0, sp, #4
@@ -6313,11 +6355,11 @@ FtlSuperblockPowerLostFix:
 	ldrh	r0, [r4]
 	bl	decrement_vpc_count
 	subs	r7, r7, #1
-	bne	.L816
-	b	.L813
-.L824:
+	bne	.L837
+	b	.L834
+.L845:
 	.align	2
-.L823:
+.L844:
 	.word	.LANCHOR114
 	.word	.LANCHOR106
 	.word	.LANCHOR42
@@ -6337,61 +6379,61 @@ FtlMakeBbt:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r6, #0
-	ldr	r7, .L844
+	ldr	r7, .L865
 	bl	FtlBbtMemInit
 	sub	r8, r7, #18
 	bl	FtlLoadFactoryBbt
-.L826:
-	ldr	r3, .L844+4
+.L847:
+	ldr	r3, .L865+4
 	ldrh	r3, [r3]
 	cmp	r6, r3
-	bcc	.L832
-	ldr	r5, .L844+8
+	bcc	.L853
+	ldr	r5, .L865+8
 	movs	r4, #0
-.L833:
+.L854:
 	ldrh	r3, [r5]
 	uxth	r0, r4
 	adds	r4, r4, #1
 	cmp	r3, r0
-	bhi	.L834
-	ldr	r4, .L844+12
+	bhi	.L855
+	ldr	r4, .L865+12
 	movw	r6, #65535
 	ldrh	r5, [r4, #12]
 	subs	r5, r5, #1
 	uxth	r5, r5
-.L835:
+.L856:
 	ldrh	r3, [r4, #12]
 	subs	r3, r3, #47
 	cmp	r3, r5
-	bgt	.L839
+	bgt	.L860
 	mov	r0, r5
 	bl	FtlBbmIsBadBlock
 	cmp	r0, #1
-	beq	.L836
+	beq	.L857
 	mov	r0, r5
 	bl	FlashTestBlk
 	cmp	r0, #0
-	beq	.L837
+	beq	.L858
 	mov	r0, r5
 	bl	FtlBbmMapBadBlock
-.L836:
+.L857:
 	subs	r5, r5, #1
 	uxth	r5, r5
-	b	.L835
-.L832:
-	ldr	r3, .L844+16
-	ldr	r5, .L844+20
+	b	.L856
+.L853:
+	ldr	r3, .L865+16
+	ldr	r5, .L865+20
 	ldrh	r2, [r8, #2]!
-	ldr	r4, .L844+24
+	ldr	r4, .L865+24
 	ldr	r0, [r3]
 	movw	r3, #65535
 	ldr	r10, [r5]
 	cmp	r2, r3
 	mov	fp, r4
-	ldr	r3, .L844+28
+	ldr	r3, .L865+28
 	str	r0, [r4, #8]
 	str	r10, [r4, #12]
-	beq	.L827
+	beq	.L848
 	ldrh	r5, [r3]
 	mov	r0, r4
 	str	r3, [sp]
@@ -6408,13 +6450,13 @@ FtlMakeBbt:
 	adds	r2, r2, #7
 	asrs	r2, r2, #3
 	bl	ftl_memcpy
-.L828:
+.L849:
 	uxth	r0, r5
 	adds	r6, r6, #1
 	adds	r7, r7, #4
 	bl	FtlBbmMapBadBlock
-	b	.L826
-.L827:
+	b	.L847
+.L848:
 	mov	r1, r6
 	str	r3, [sp]
 	bl	FlashGetBadBlockList
@@ -6426,21 +6468,21 @@ FtlMakeBbt:
 	ldrh	r4, [r3]
 	subs	r4, r4, #1
 	uxth	r4, r4
-.L829:
+.L850:
 	ldr	r3, [sp]
 	ldrh	r0, [r3]
 	smlabb	r0, r0, r6, r4
 	uxth	r0, r0
 	bl	FtlBbmIsBadBlock
 	cmp	r0, #1
-	beq	.L830
+	beq	.L851
 	ldr	r3, [sp, #4]
 	movs	r2, #16
 	movs	r1, #0
 	strh	r4, [r8]	@ movhi
 	ldr	r0, [r3]
 	bl	ftl_memset
-	ldr	r3, .L844+16
+	ldr	r3, .L865+16
 	mov	r2, #4096
 	movs	r1, #0
 	ldr	r0, [r3]
@@ -6458,42 +6500,42 @@ FtlMakeBbt:
 	mla	r5, r6, r5, r3
 	lsls	r3, r5, #10
 	str	r3, [fp, #4]
-	ldr	r3, .L844+32
+	ldr	r3, .L865+32
 	ldrh	r2, [r3]
 	lsls	r2, r2, #2
 	bl	ftl_memcpy
 	movs	r2, #1
-	ldr	r0, .L844+24
+	ldr	r0, .L865+24
 	mov	r1, r2
 	bl	FlashEraseBlocks
 	movs	r3, #1
-	ldr	r0, .L844+24
+	ldr	r0, .L865+24
 	mov	r2, r3
 	mov	r1, r3
 	bl	FlashProgPages
 	ldr	r3, [fp]
 	adds	r3, r3, #1
-	bne	.L828
+	bne	.L849
 	uxth	r0, r5
 	bl	FtlBbmMapBadBlock
-	b	.L829
-.L830:
+	b	.L850
+.L851:
 	subs	r4, r4, #1
 	uxth	r4, r4
-	b	.L829
-.L834:
+	b	.L850
+.L855:
 	bl	FtlBbmMapBadBlock
-	b	.L833
-.L837:
+	b	.L854
+.L858:
 	ldrh	r3, [r4]
 	cmp	r3, r6
-	bne	.L838
+	bne	.L859
 	strh	r5, [r4]	@ movhi
-	b	.L836
-.L838:
+	b	.L857
+.L859:
 	strh	r5, [r4, #4]	@ movhi
-.L839:
-	ldr	r3, .L844+36
+.L860:
+	ldr	r3, .L865+36
 	movs	r5, #0
 	str	r5, [r4, #8]
 	movs	r1, #1
@@ -6525,9 +6567,9 @@ FtlMakeBbt:
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L845:
+.L866:
 	.align	2
-.L844:
+.L865:
 	.word	.LANCHOR37+28
 	.word	.LANCHOR10
 	.word	.LANCHOR25
@@ -6564,24 +6606,24 @@ ftl_memcmp:
 js_hash:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L850
+	ldr	r3, .L871
 	add	r1, r1, r0
 	push	{r4, lr}
-.L848:
+.L869:
 	cmp	r0, r1
-	bne	.L849
+	bne	.L870
 	mov	r0, r3
 	pop	{r4, pc}
-.L849:
+.L870:
 	lsrs	r2, r3, #2
 	ldrb	r4, [r0], #1	@ zero_extendqisi2
 	add	r2, r2, r3, lsl #5
 	add	r2, r2, r4
 	eors	r3, r3, r2
-	b	.L848
-.L851:
+	b	.L869
+.L872:
 	.align	2
-.L850:
+.L871:
 	.word	1204201446
 	.size	js_hash, .-js_hash
 	.section	.text.Ftl_write_map_blk_to_last_page,"ax",%progbits
@@ -6601,14 +6643,14 @@ Ftl_write_map_blk_to_last_page:
 	mov	r4, r0
 	ldr	r5, [r0, #12]
 	cmp	r3, r2
-	bne	.L853
+	bne	.L874
 	ldrh	r3, [r0, #8]
-	cbz	r3, .L854
+	cbz	r3, .L875
 	movw	r2, #641
-	ldr	r1, .L862
-	ldr	r0, .L862+4
+	ldr	r1, .L883
+	ldr	r0, .L883+4
 	bl	printf
-.L854:
+.L875:
 	ldrh	r3, [r4, #8]
 	adds	r3, r3, #1
 	strh	r3, [r4, #8]	@ movhi
@@ -6620,20 +6662,20 @@ Ftl_write_map_blk_to_last_page:
 	ldr	r3, [r4, #28]
 	adds	r3, r3, #1
 	str	r3, [r4, #28]
-.L855:
+.L876:
 	movs	r0, #0
 	pop	{r3, r4, r5, r6, r7, r8, r10, pc}
-.L853:
+.L874:
 	ldrh	r7, [r5, r3, lsl #1]
 	movs	r1, #255
 	ldrh	r3, [r0, #2]
-	ldr	r6, .L862+8
-	ldr	r10, .L862+24
+	ldr	r6, .L883+8
+	ldr	r10, .L883+24
 	ldr	r8, [r0, #24]
 	orr	r3, r3, r7, lsl #10
 	ldr	r0, [r10]
 	str	r3, [r6, #4]
-	ldr	r3, .L862+12
+	ldr	r3, .L883+12
 	str	r0, [r6, #8]
 	ldr	r5, [r3]
 	ldr	r3, [r4, #28]
@@ -6644,7 +6686,7 @@ Ftl_write_map_blk_to_last_page:
 	ldrh	r3, [r4, #4]
 	strh	r7, [r5, #2]	@ movhi
 	strh	r3, [r5]	@ movhi
-	ldr	r3, .L862+16
+	ldr	r3, .L883+16
 	ldrh	r2, [r3]
 	lsls	r2, r2, #3
 	bl	ftl_memset
@@ -6652,11 +6694,11 @@ Ftl_write_map_blk_to_last_page:
 	movs	r3, #0
 	ldr	r1, [r10]
 	mov	r2, r3
-.L856:
+.L877:
 	uxth	r0, r3
 	cmp	ip, r0
-	bhi	.L858
-	ldr	r3, .L862+20
+	bhi	.L879
+	ldr	r3, .L883+20
 	ldr	r0, [r6, #8]
 	ldrh	r1, [r3]
 	bl	js_hash
@@ -6664,30 +6706,30 @@ Ftl_write_map_blk_to_last_page:
 	str	r0, [r5, #12]
 	movs	r3, #0
 	mov	r1, r2
-	ldr	r0, .L862+8
+	ldr	r0, .L883+8
 	bl	FlashProgPages
 	ldrh	r3, [r4, #2]
 	mov	r0, r4
 	adds	r3, r3, #1
 	strh	r3, [r4, #2]	@ movhi
 	bl	ftl_map_blk_gc
-	b	.L855
-.L858:
+	b	.L876
+.L879:
 	ldr	r0, [r8, r3, lsl #2]
 	cmp	r7, r0, lsr #10
-	bne	.L857
+	bne	.L878
 	adds	r2, r2, #1
 	uxth	r2, r2
 	str	r3, [r1, r2, lsl #3]
 	add	lr, r1, r2, lsl #3
 	ldr	r0, [r8, r3, lsl #2]
 	str	r0, [lr, #4]
-.L857:
+.L878:
 	adds	r3, r3, #1
-	b	.L856
-.L863:
+	b	.L877
+.L884:
 	.align	2
-.L862:
+.L883:
 	.word	.LANCHOR148
 	.word	.LC1
 	.word	.LANCHOR138
@@ -6709,13 +6751,13 @@ FtlMapWritePage:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r4, r0
-	ldr	r8, .L888+32
+	ldr	r8, .L909+32
 	mov	r7, r1
 	movs	r6, #0
 	str	r2, [sp]
 	mov	fp, r8
-.L865:
-	ldr	r2, .L888
+.L886:
+	ldr	r2, .L909
 	ldr	r3, [r2]
 	adds	r3, r3, #1
 	str	r3, [r2]
@@ -6723,44 +6765,44 @@ FtlMapWritePage:
 	ldrh	r2, [r4, #2]
 	subs	r3, r3, #1
 	cmp	r2, r3
-	bge	.L866
+	bge	.L887
 	ldrh	r2, [r4]
 	movw	r3, #65535
 	cmp	r2, r3
-	bne	.L867
-.L866:
+	bne	.L888
+.L887:
 	mov	r0, r4
 	bl	Ftl_write_map_blk_to_last_page
-.L867:
+.L888:
 	ldrh	r2, [r4]
 	ldr	r3, [r4, #12]
 	ldrh	r3, [r3, r2, lsl #1]
-	cbnz	r3, .L868
+	cbnz	r3, .L889
 	mov	r2, #700
-	ldr	r1, .L888+4
-	ldr	r0, .L888+8
+	ldr	r1, .L909+4
+	ldr	r0, .L909+8
 	bl	printf
-.L868:
+.L889:
 	ldrh	r2, [r4]
 	ldrh	r3, [r4, #10]
 	cmp	r2, r3
-	bcc	.L869
+	bcc	.L890
 	movw	r2, #701
-	ldr	r1, .L888+4
-	ldr	r0, .L888+8
+	ldr	r1, .L909+4
+	ldr	r0, .L909+8
 	bl	printf
-.L869:
+.L890:
 	ldrh	r2, [r4]
 	movs	r1, #0
 	ldr	r3, [r4, #12]
-	ldr	r5, .L888+12
+	ldr	r5, .L909+12
 	ldrh	r3, [r3, r2, lsl #1]
 	ldrh	r2, [r4, #2]
 	str	r3, [sp, #4]
 	orr	r2, r2, r3, lsl #10
 	ldr	r3, [sp]
 	str	r2, [r5, #4]
-	ldr	r2, .L888+16
+	ldr	r2, .L909+16
 	str	r3, [r5, #8]
 	ldr	r0, [r2]
 	movs	r2, #16
@@ -6773,7 +6815,7 @@ FtlMapWritePage:
 	str	r1, [r10, #4]
 	ldrh	r1, [r4, #4]
 	strh	r3, [r10, #2]	@ movhi
-	ldr	r3, .L888+20
+	ldr	r3, .L909+20
 	strh	r1, [r10]	@ movhi
 	strh	r7, [r10, #8]	@ movhi
 	ldrh	r1, [r3]
@@ -6790,10 +6832,10 @@ FtlMapWritePage:
 	uxth	r2, r2
 	adds	r3, r1, #1
 	strh	r2, [r4, #2]	@ movhi
-	bne	.L870
+	bne	.L891
 	ldr	r1, [r5, #4]
 	adds	r6, r6, #1
-	ldr	r0, .L888+24
+	ldr	r0, .L909+24
 	uxth	r6, r6
 	bl	printf
 	ldrh	r2, [r4, #2]
@@ -6803,48 +6845,48 @@ FtlMapWritePage:
 	addls	r2, r2, #-1
 	strhls	r2, [r4, #2]	@ movhi
 	cmp	r6, #3
-	bls	.L872
+	bls	.L893
 	mov	r2, r6
 	ldr	r1, [r5, #4]
-	ldr	r0, .L888+28
+	ldr	r0, .L909+28
 	bl	printf
-.L873:
-	b	.L873
-.L872:
+.L894:
+	b	.L894
+.L893:
 	ldr	r3, [r4, #32]
 	cmp	r3, #0
-	beq	.L865
-.L887:
-	b	.L887
-.L870:
+	beq	.L886
+.L908:
+	b	.L908
+.L891:
 	cmp	r2, #1
-	beq	.L876
+	beq	.L897
 	cmp	r1, #256
-	beq	.L876
+	beq	.L897
 	ldr	r0, [r4, #36]
-	cbz	r0, .L877
-.L876:
+	cbz	r0, .L898
+.L897:
 	movs	r3, #0
 	str	r3, [r4, #36]
-	b	.L865
-.L877:
+	b	.L886
+.L898:
 	ldr	r2, [r5, #4]
 	ldr	r3, [r4, #24]
 	str	r2, [r3, r7, lsl #2]
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L889:
+.L910:
 	.align	2
-.L888:
+.L909:
 	.word	.LANCHOR88
 	.word	.LANCHOR149
 	.word	.LC1
 	.word	.LANCHOR138
 	.word	.LANCHOR114
 	.word	.LANCHOR23
-	.word	.LC18
-	.word	.LC19
+	.word	.LC22
+	.word	.LC23
 	.word	.LANCHOR20
 	.size	FtlMapWritePage, .-FtlMapWritePage
 	.section	.text.load_l2p_region,"ax",%progbits
@@ -6858,31 +6900,31 @@ FtlMapWritePage:
 load_l2p_region:
 	@ args = 0, pretend = 0, frame = 8
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L897
+	ldr	r3, .L918
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r5, r0
 	mov	r10, r1
 	ldrh	r2, [r3]
 	str	r3, [sp, #4]
 	cmp	r2, r0
-	bcs	.L891
+	bcs	.L912
 	movw	r2, #485
-	ldr	r1, .L897+4
-	ldr	r0, .L897+8
+	ldr	r1, .L918+4
+	ldr	r0, .L918+8
 	bl	printf
-.L891:
-	ldr	fp, .L897+48
+.L912:
+	ldr	fp, .L918+48
 	movs	r4, #12
-	ldr	r7, .L897+12
+	ldr	r7, .L918+12
 	ldr	r3, [fp]
 	ldr	r8, [r3, r5, lsl #2]
 	cmp	r8, #0
-	bne	.L892
+	bne	.L913
 	mul	r4, r4, r10
 	ldr	r2, [r7]
 	movs	r1, #255
 	adds	r0, r2, r4
-	ldr	r2, .L897+16
+	ldr	r2, .L918+16
 	ldr	r0, [r0, #8]
 	ldrh	r2, [r2]
 	bl	ftl_memset
@@ -6890,21 +6932,21 @@ load_l2p_region:
 	adds	r1, r2, r4
 	strh	r5, [r2, r4]	@ movhi
 	str	r8, [r1, #4]
-.L893:
+.L914:
 	movs	r0, #0
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L892:
+.L913:
 	mul	r4, r4, r10
 	ldr	r2, [r7]
-	ldr	r6, .L897+20
+	ldr	r6, .L918+20
 	add	r2, r2, r4
 	mov	r0, r6
 	ldr	r2, [r2, #8]
 	str	r8, [r6, #4]
 	str	r2, [r6, #8]
-	ldr	r2, .L897+24
+	ldr	r2, .L918+24
 	ldr	r2, [r2]
 	str	r2, [r6, #12]
 	movs	r2, #1
@@ -6913,55 +6955,55 @@ load_l2p_region:
 	ldr	r10, [r6, #12]
 	ldrh	r2, [r10, #8]
 	cmp	r2, r5
-	beq	.L894
+	beq	.L915
 	mov	r2, r8
 	mov	r1, r5
-	ldr	r0, .L897+28
+	ldr	r0, .L918+28
 	bl	printf
 	movs	r3, #4
 	ldr	r1, [r6, #12]
 	mov	r2, r3
-	ldr	r0, .L897+32
+	ldr	r0, .L918+32
 	bl	rknand_print_hex
 	ldr	r3, [sp, #4]
 	movs	r2, #4
 	ldr	r1, [fp]
-	ldr	r0, .L897+36
+	ldr	r0, .L918+36
 	ldrh	r3, [r3]
 	bl	rknand_print_hex
-.L895:
+.L916:
 	ldrh	r3, [r10, #8]
 	cmp	r3, r5
-	beq	.L896
+	beq	.L917
 	mov	r2, #508
-	ldr	r1, .L897+4
-	ldr	r0, .L897+8
+	ldr	r1, .L918+4
+	ldr	r0, .L918+8
 	bl	printf
-.L896:
+.L917:
 	ldr	r3, [r7]
 	movs	r1, #0
 	adds	r2, r3, r4
 	str	r1, [r2, #4]
 	strh	r5, [r3, r4]	@ movhi
-	b	.L893
-.L894:
+	b	.L914
+.L915:
 	ldr	r2, [r6]
 	cmp	r2, #256
-	bne	.L895
+	bne	.L916
 	mov	r2, r8
 	mov	r1, r5
-	ldr	r0, .L897+40
+	ldr	r0, .L918+40
 	bl	printf
 	ldr	r3, [r7]
 	mov	r1, r5
-	ldr	r0, .L897+44
+	ldr	r0, .L918+44
 	add	r3, r3, r4
 	ldr	r2, [r3, #8]
 	bl	FtlMapWritePage
-	b	.L895
-.L898:
+	b	.L916
+.L919:
 	.align	2
-.L897:
+.L918:
 	.word	.LANCHOR32
 	.word	.LANCHOR150
 	.word	.LC1
@@ -6969,10 +7011,10 @@ load_l2p_region:
 	.word	.LANCHOR23
 	.word	.LANCHOR138
 	.word	.LANCHOR114
-	.word	.LC20
-	.word	.LC21
-	.word	.LC22
-	.word	.LC23
+	.word	.LC24
+	.word	.LC13
+	.word	.LC25
+	.word	.LC26
 	.word	.LANCHOR129
 	.word	.LANCHOR124
 	.size	load_l2p_region, .-load_l2p_region
@@ -6997,13 +7039,13 @@ ftl_map_blk_gc:
 	ldrh	r2, [r4, #8]
 	subs	r3, r3, #5
 	cmp	r2, r3
-	blt	.L900
+	blt	.L921
 	uxth	r0, r0
 	ldrh	r8, [r5, r0, lsl #1]
 	cmp	r8, #0
-	beq	.L900
+	beq	.L921
 	ldr	r3, [r4, #32]
-	cbnz	r3, .L900
+	cbnz	r3, .L921
 	movs	r2, #1
 	str	r2, [r4, #32]
 	strh	r3, [r5, r0, lsl #1]	@ movhi
@@ -7011,39 +7053,39 @@ ftl_map_blk_gc:
 	ldrh	r2, [r4, #2]
 	subs	r3, r3, #1
 	strh	r3, [r4, #8]	@ movhi
-	ldr	r3, .L915
+	ldr	r3, .L936
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bcc	.L901
+	bcc	.L922
 	mov	r0, r4
 	bl	ftl_map_blk_alloc_new_blk
-.L901:
-	ldr	r5, .L915+4
+.L922:
+	ldr	r5, .L936+4
 	movs	r6, #0
-.L902:
+.L923:
 	ldrh	r3, [r4, #6]
 	uxth	r10, r6
 	cmp	r3, r10
-	bhi	.L909
+	bhi	.L930
 	movs	r1, #1
 	mov	r0, r8
 	bl	FtlFreeSysBlkQueueIn
 	movs	r3, #0
 	str	r3, [r4, #32]
-.L900:
-	ldr	r3, .L915
+.L921:
+	ldr	r3, .L936
 	ldrh	r2, [r4, #2]
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bcc	.L910
+	bcc	.L931
 	mov	r0, r4
 	bl	ftl_map_blk_alloc_new_blk
-.L910:
+.L931:
 	movs	r0, #0
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L909:
+.L930:
 	ldr	r3, [sp]
 	uxth	fp, r6
 	add	r3, r3, fp, lsl #2
@@ -7051,53 +7093,53 @@ ftl_map_blk_gc:
 	ldr	r3, [sp]
 	ldr	r2, [r3, fp, lsl #2]
 	cmp	r8, r2, lsr #10
-	bne	.L903
-	ldr	r3, .L915+8
+	bne	.L924
+	ldr	r3, .L936+8
 	str	r2, [r5, #4]
 	movs	r2, #1
-	ldr	r0, .L915+4
+	ldr	r0, .L936+4
 	ldr	r1, [r3]
 	str	r1, [r5, #8]
-	ldr	r1, .L915+12
+	ldr	r1, .L936+12
 	ldr	r7, [r1]
 	mov	r1, r2
 	str	r7, [r5, #12]
 	bl	FlashReadPages
 	ldrh	r2, [r7, #8]
 	cmp	r2, r10
-	beq	.L904
+	beq	.L925
 	movw	r2, #611
-	ldr	r1, .L915+16
-	ldr	r0, .L915+20
+	ldr	r1, .L936+16
+	ldr	r0, .L936+20
 	bl	printf
-.L904:
+.L925:
 	ldr	r2, [r5]
 	adds	r2, r2, #1
-	bne	.L905
-.L907:
+	bne	.L926
+.L928:
 	ldr	r2, [sp, #4]
 	movs	r3, #0
 	str	r3, [r2]
-.L906:
-	b	.L906
-.L905:
+.L927:
+	b	.L927
+.L926:
 	ldrh	r2, [r7, #8]
 	cmp	r2, r10
-	bne	.L907
+	bne	.L928
 	ldrh	r1, [r7]
 	ldrh	r2, [r4, #4]
 	cmp	r1, r2
-	bne	.L907
+	bne	.L928
 	ldr	r2, [r5, #8]
 	mov	r1, fp
 	mov	r0, r4
 	bl	FtlMapWritePage
-.L903:
+.L924:
 	adds	r6, r6, #1
-	b	.L902
-.L916:
+	b	.L923
+.L937:
 	.align	2
-.L915:
+.L936:
 	.word	.LANCHOR20
 	.word	.LANCHOR138
 	.word	.LANCHOR107
@@ -7118,9 +7160,9 @@ flush_l2p_region:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	movs	r4, #12
-	ldr	r5, .L918
+	ldr	r5, .L939
 	muls	r4, r0, r4
-	ldr	r0, .L918+4
+	ldr	r0, .L939+4
 	ldr	r3, [r5]
 	adds	r2, r3, r4
 	ldrh	r1, [r3, r4]
@@ -7133,9 +7175,9 @@ flush_l2p_region:
 	bic	r3, r3, #-2147483648
 	str	r3, [r4, #4]
 	pop	{r3, r4, r5, pc}
-.L919:
+.L940:
 	.align	2
-.L918:
+.L939:
 	.word	.LANCHOR55
 	.word	.LANCHOR129
 	.size	flush_l2p_region, .-flush_l2p_region
@@ -7152,30 +7194,30 @@ l2p_flush:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, lr}
 	movs	r4, #0
-	ldr	r5, .L924
-	ldr	r6, .L924+4
-.L921:
+	ldr	r5, .L945
+	ldr	r6, .L945+4
+.L942:
 	ldrh	r3, [r5]
 	uxth	r0, r4
 	cmp	r3, r0
-	bhi	.L923
+	bhi	.L944
 	movs	r0, #0
 	pop	{r4, r5, r6, pc}
-.L923:
+.L944:
 	ldr	r2, [r6]
 	uxth	r3, r4
 	movs	r1, #12
 	mla	r3, r1, r3, r2
 	ldr	r3, [r3, #4]
 	cmp	r3, #0
-	bge	.L922
+	bge	.L943
 	bl	flush_l2p_region
-.L922:
+.L943:
 	adds	r4, r4, #1
-	b	.L921
-.L925:
+	b	.L942
+.L946:
 	.align	2
-.L924:
+.L945:
 	.word	.LANCHOR33
 	.word	.LANCHOR55
 	.size	l2p_flush, .-l2p_flush
@@ -7192,36 +7234,36 @@ log2phys:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r7, r2
-	ldr	r4, .L939
+	ldr	r4, .L960
 	mov	r10, r0
 	mov	r5, r1
-	ldr	r3, .L939+4
+	ldr	r3, .L960+4
 	ldr	r2, [r4]
 	ldrh	fp, [r3]
 	cmp	r0, r2
-	bcc	.L927
+	bcc	.L948
 	movw	r2, #813
-	ldr	r1, .L939+8
-	ldr	r0, .L939+12
+	ldr	r1, .L960+8
+	ldr	r0, .L960+12
 	bl	printf
-.L927:
+.L948:
 	ldr	r3, [r4]
 	cmp	r10, r3
-	bcs	.L928
-	ldr	r3, .L939+16
+	bcs	.L949
+	ldr	r3, .L960+16
 	add	fp, fp, #7
 	lsr	r6, r10, fp
 	movs	r2, #0
 	ldrh	r1, [r3]
 	uxth	r6, r6
-	ldr	r3, .L939+20
+	ldr	r3, .L960+20
 	ldr	r0, [r3]
 	mov	r8, r3
 	movs	r3, #12
-.L929:
+.L950:
 	uxth	r4, r2
 	cmp	r4, r1
-	bcc	.L934
+	bcc	.L955
 	str	r3, [sp, #4]
 	bl	select_l2p_ram_region
 	ldr	r3, [sp, #4]
@@ -7232,31 +7274,31 @@ log2phys:
 	ldrh	r2, [r2, r3]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L935
+	beq	.L956
 	ldr	r3, [r1, #4]
 	cmp	r3, #0
-	bge	.L935
+	bge	.L956
 	bl	flush_l2p_region
-.L935:
+.L956:
 	mov	r1, r4
 	mov	r0, r6
 	bl	load_l2p_region
-	b	.L931
-.L928:
+	b	.L952
+.L949:
 	mov	r0, #-1
-	cbnz	r7, .L926
+	cbnz	r7, .L947
 	str	r0, [r5]
-.L926:
+.L947:
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L934:
+.L955:
 	adds	r2, r2, #1
 	mla	ip, r3, r2, r0
 	ldrh	ip, [ip, #-12]
 	cmp	ip, r6
-	bne	.L929
-.L931:
+	bne	.L950
+.L952:
 	movs	r0, #1
 	ldr	r2, [r8]
 	lsl	r0, r0, fp
@@ -7265,35 +7307,35 @@ log2phys:
 	and	r0, r0, r10
 	uxth	r0, r0
 	mla	r3, r3, r4, r2
-	cbnz	r7, .L932
+	cbnz	r7, .L953
 	ldr	r3, [r3, #8]
 	ldr	r3, [r3, r0, lsl #2]
 	str	r3, [r5]
-.L933:
+.L954:
 	ldr	r2, [r8]
 	movs	r3, #12
 	mla	r4, r3, r4, r2
 	ldr	r3, [r4, #4]
 	adds	r2, r3, #1
-	beq	.L937
+	beq	.L958
 	adds	r3, r3, #1
 	str	r3, [r4, #4]
-.L937:
+.L958:
 	movs	r0, #0
-	b	.L926
-.L932:
+	b	.L947
+.L953:
 	ldr	r1, [r5]
 	ldr	r2, [r3, #8]
 	str	r1, [r2, r0, lsl #2]
 	ldr	r2, [r3, #4]
 	orr	r2, r2, #-2147483648
 	str	r2, [r3, #4]
-	ldr	r3, .L939+24
+	ldr	r3, .L960+24
 	strh	r6, [r3]	@ movhi
-	b	.L933
-.L940:
+	b	.L954
+.L961:
 	.align	2
-.L939:
+.L960:
 	.word	.LANCHOR152
 	.word	.LANCHOR22
 	.word	.LANCHOR153
@@ -7315,22 +7357,22 @@ FtlReUsePrevPpa:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, lr}
 	mov	r6, r0
-	ldr	r5, .L951
+	ldr	r5, .L972
 	ubfx	r0, r1, #10, #16
 	str	r1, [sp, #4]
 	bl	P2V_block_in_plane
 	ldr	r2, [r5]
 	mov	r7, r0
 	ldrh	r3, [r2, r0, lsl #1]
-	cbnz	r3, .L942
-	ldr	r2, .L951+4
+	cbnz	r3, .L963
+	ldr	r2, .L972+4
 	ldr	r4, [r2]
 	cmp	r4, #0
-	beq	.L943
-	ldr	r2, .L951+8
+	beq	.L964
+	ldr	r2, .L972+8
 	movw	lr, #65535
-	ldr	ip, .L951+24
-	ldr	r0, .L951+12
+	ldr	ip, .L972+24
+	ldr	r0, .L972+12
 	ldr	r2, [r2]
 	ldrh	r1, [r0]
 	mov	r8, r0
@@ -7339,22 +7381,22 @@ FtlReUsePrevPpa:
 	mul	r4, ip, r4
 	mov	ip, #6
 	uxth	r4, r4
-.L944:
+.L965:
 	uxth	r0, r3
 	cmp	r1, r0
-	bls	.L943
+	bls	.L964
 	cmp	r4, r7
-	bne	.L945
+	bne	.L966
 	mov	r1, r4
-	ldr	r0, .L951+4
+	ldr	r0, .L972+4
 	bl	List_remove_node
 	ldrh	r3, [r8]
-	cbnz	r3, .L946
+	cbnz	r3, .L967
 	movw	r2, #1733
-	ldr	r1, .L951+16
-	ldr	r0, .L951+20
+	ldr	r1, .L972+16
+	ldr	r0, .L972+20
 	bl	printf
-.L946:
+.L967:
 	ldrh	r3, [r8]
 	mov	r0, r4
 	subs	r3, r3, #1
@@ -7362,17 +7404,17 @@ FtlReUsePrevPpa:
 	bl	INSERT_DATA_LIST
 	ldr	r2, [r5]
 	ldrh	r3, [r2, r7, lsl #1]
-.L942:
+.L963:
 	adds	r3, r3, #1
 	strh	r3, [r2, r7, lsl #1]	@ movhi
-	b	.L943
-.L945:
+	b	.L964
+.L966:
 	mul	r4, ip, r4
 	adds	r3, r3, #1
 	ldrh	r4, [r2, r4]
 	cmp	r4, lr
-	bne	.L944
-.L943:
+	bne	.L965
+.L964:
 	movs	r2, #1
 	add	r1, sp, #4
 	mov	r0, r6
@@ -7380,11 +7422,11 @@ FtlReUsePrevPpa:
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, pc}
-.L952:
+.L973:
 	.align	2
-.L951:
+.L972:
 	.word	.LANCHOR42
-	.word	.LANCHOR47
+	.word	.LANCHOR46
 	.word	.LANCHOR40
 	.word	.LANCHOR48
 	.word	.LANCHOR154
@@ -7408,144 +7450,144 @@ FtlRecoverySuperblock:
 	mov	r8, r0
 	sub	sp, sp, #48
 	cmp	r3, r2
-	beq	.L1081
+	beq	.L1106
 	ldrh	r3, [r0, #2]
 	str	r3, [sp, #4]
 	ldrb	r3, [r0, #6]	@ zero_extendqisi2
 	ldr	r1, [sp, #4]
 	str	r3, [sp, #20]
-	ldr	r3, .L1091
+	ldr	r3, .L1115
 	ldrh	r3, [r3]
 	cmp	r3, r1
 	mov	r3, #0
-	bne	.L956
+	bne	.L977
 	strh	r3, [r0, #4]	@ movhi
-.L1089:
+.L1113:
 	strb	r3, [r8, #6]
-.L1081:
+.L1106:
 	movs	r0, #0
 	add	sp, sp, #48
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L956:
+.L977:
 	ldrh	r0, [r0, #16]
-.L957:
+.L978:
 	cmp	r0, r2
 	uxth	r5, r3
 	add	r3, r3, #1
-	beq	.L958
+	beq	.L979
 	movs	r1, #1
 	bl	FtlGetLastWrittenPage
 	mov	r4, r0
 	adds	r0, r0, #1
-	beq	.L959
-	ldr	r3, .L1091+4
+	beq	.L980
+	ldr	r3, .L1115+4
 	movs	r2, #0
 	mov	r5, r2
 	movw	fp, #65535
 	mov	r10, #20
 	ldrh	ip, [r3]
-	ldr	r3, .L1091+8
+	ldr	r3, .L1115+8
 	ldr	r0, [r3]
-	ldr	r3, .L1091+12
+	ldr	r3, .L1115+12
 	ldr	r3, [r3]
 	str	r3, [sp, #8]
-	ldr	r3, .L1091+16
+	ldr	r3, .L1115+16
 	ldrh	r7, [r3]
-	ldr	r3, .L1091+20
+	ldr	r3, .L1115+20
 	ldr	r3, [r3]
 	str	r3, [sp, #12]
-	ldr	r3, .L1091+24
+	ldr	r3, .L1115+24
 	ldrh	lr, [r3]
 	add	r3, r8, #16
 	str	r3, [sp, #16]
 	str	r3, [sp]
-.L960:
+.L981:
 	uxth	r3, r2
 	cmp	ip, r3
-	bhi	.L964
+	bhi	.L985
 	movs	r2, #0
 	mov	r1, r5
 	bl	FlashReadPages
-	ldr	r2, .L1091+28
+	ldr	r2, .L1115+28
 	uxth	r1, r4
 	movw	fp, #65535
 	str	r1, [sp, #12]
 	ldr	r3, [r2]
 	subs	r3, r3, #1
 	str	r3, [sp]
-	ldr	r3, .L1091+8
+	ldr	r3, .L1115+8
 	ldr	r10, [r3]
 	movs	r3, #0
 	mov	r7, r10
-.L965:
+.L986:
 	uxth	r1, r3
 	cmp	r5, r1
-	bhi	.L970
-	bne	.L968
+	bhi	.L991
+	bne	.L989
 	adds	r3, r4, #1
 	uxth	r3, r3
 	str	r3, [sp, #8]
-.L1082:
+.L1107:
 	ldr	r0, [r10, #4]
 	ubfx	r0, r0, #10, #16
 	bl	P2V_plane
-	ldr	r3, .L1091
+	ldr	r3, .L1115
 	mov	r10, r0
 	ldr	r2, [sp, #8]
 	ldrh	r3, [r3]
 	cmp	r3, r2
-	bne	.L972
+	bne	.L993
 	ldrh	r3, [sp, #8]
 	strh	r3, [r8, #2]	@ movhi
 	movs	r3, #0
 	strb	r3, [r8, #6]
 	strh	r3, [r8, #4]	@ movhi
-.L972:
+.L993:
 	ldr	r3, [sp, #8]
 	ldr	r2, [sp, #4]
 	cmp	r3, r2
-	bne	.L973
+	bne	.L994
 	ldr	r3, [sp, #20]
 	cmp	r10, r3
-	bne	.L973
+	bne	.L994
 	ldr	r1, [sp, #8]
 	mov	r2, r10
-.L1090:
+.L1114:
 	mov	r0, r8
 	bl	ftl_sb_update_avl_pages
-	b	.L1081
-.L958:
+	b	.L1106
+.L979:
 	uxth	r1, r3
 	adds	r1, r1, #8
 	ldrh	r0, [r8, r1, lsl #1]
-	b	.L957
-.L959:
+	b	.L978
+.L980:
 	ldr	r3, [sp, #4]
-	cbz	r3, .L961
+	cbz	r3, .L982
 	mov	r2, #1800
-	ldr	r1, .L1091+32
-	ldr	r0, .L1091+36
+	ldr	r1, .L1115+32
+	ldr	r0, .L1115+36
 	bl	printf
-.L961:
+.L982:
 	ldr	r3, [sp, #20]
-	cbz	r3, .L962
+	cbz	r3, .L983
 	cmp	r5, r3
-	beq	.L962
+	beq	.L983
 	movw	r2, #1801
-	ldr	r1, .L1091+32
-	ldr	r0, .L1091+36
+	ldr	r1, .L1115+32
+	ldr	r0, .L1115+36
 	bl	printf
-.L962:
+.L983:
 	movs	r3, #0
 	strh	r3, [r8, #2]	@ movhi
-	b	.L1089
-.L964:
+	b	.L1113
+.L985:
 	ldr	r1, [sp]
 	ldrh	r3, [r1], #2
 	cmp	r3, fp
 	str	r1, [sp]
-	beq	.L963
+	beq	.L984
 	mla	r1, r10, r5, r0
 	ldr	r6, [sp, #8]
 	orr	r3, r4, r3, lsl #10
@@ -7561,53 +7603,53 @@ FtlRecoverySuperblock:
 	bic	r3, r3, #3
 	add	r3, r3, r6
 	str	r3, [r1, #12]
-.L963:
+.L984:
 	adds	r2, r2, #1
-	b	.L960
-.L970:
+	b	.L981
+.L991:
 	ldr	r1, [r7]
-	cbnz	r1, .L966
+	cbnz	r1, .L987
 	ldr	r1, [r7, #12]
 	ldr	r6, [r1, #4]
 	str	r1, [sp, #8]
 	adds	r1, r6, #1
-	beq	.L967
+	beq	.L988
 	ldr	r1, [r2]
 	mov	r0, r6
 	bl	ftl_cmp_data_ver
-	cbz	r0, .L967
+	cbz	r0, .L988
 	adds	r6, r6, #1
 	str	r6, [r2]
-.L967:
+.L988:
 	ldr	r1, [sp, #8]
 	ldr	r1, [r1]
 	adds	r1, r1, #1
-	bne	.L969
-.L968:
+	bne	.L990
+.L989:
 	uxth	r2, r4
 	uxth	r3, r3
 	str	r2, [sp, #8]
 	movs	r2, #20
 	mla	r10, r2, r3, r10
-	b	.L1082
-.L966:
+	b	.L1107
+.L987:
 	ldr	fp, [sp, #12]
-.L969:
+.L990:
 	adds	r3, r3, #1
 	adds	r7, r7, #20
-	b	.L965
-.L973:
+	b	.L986
+.L994:
 	movw	r3, #65535
 	cmp	fp, r3
-	bne	.L974
+	bne	.L995
 	ldrb	r3, [r8, #8]	@ zero_extendqisi2
 	cmp	r3, #0
-	bne	.L975
-.L974:
-	ldr	r3, .L1091+40
+	bne	.L996
+.L995:
+	ldr	r3, .L1115+40
 	uxth	r6, r4
 	uxth	r4, r4
-	ldr	r7, .L1091+8
+	ldr	r7, .L1115+8
 	ldr	r2, [r3]
 	adds	r2, r2, #1
 	itt	eq
@@ -7620,10 +7662,10 @@ FtlRecoverySuperblock:
 	subgt	r4, r6, #7
 	ldrle	r4, [sp, #4]
 	uxthgt	r4, r4
-.L978:
+.L999:
 	cmp	r4, r6
-	bhi	.L988
-	ldr	r3, .L1091+4
+	bhi	.L1009
+	ldr	r3, .L1115+4
 	movw	lr, #65535
 	ldr	r0, [r7]
 	mov	ip, #20
@@ -7632,47 +7674,47 @@ FtlRecoverySuperblock:
 	str	r3, [sp, #12]
 	movs	r3, #0
 	mov	r5, r3
-	b	.L989
-.L980:
+	b	.L1010
+.L1001:
 	ldr	r1, [sp, #12]
 	ldrh	r2, [r1], #2
 	cmp	r2, lr
 	str	r1, [sp, #12]
-	beq	.L979
+	beq	.L1000
 	mla	r1, ip, r5, r0
 	adds	r5, r5, #1
 	orr	r2, r4, r2, lsl #10
 	uxth	r5, r5
 	str	r2, [r1, #4]
-.L979:
+.L1000:
 	adds	r3, r3, #1
-.L989:
+.L1010:
 	uxth	r2, r3
 	cmp	fp, r2
-	bhi	.L980
+	bhi	.L1001
 	mov	r1, r5
 	movs	r2, #0
 	bl	FlashReadPages
-	ldr	r3, .L1091+40
+	ldr	r3, .L1115+40
 	movs	r1, #20
 	movs	r0, #0
 	movw	ip, #65535
 	ldr	r2, [r3]
 	ldr	r3, [r7]
 	mla	r5, r1, r5, r3
-.L981:
+.L1002:
 	cmp	r5, r3
-	bne	.L986
-	cbz	r0, .L987
-	ldr	r3, .L1091+40
+	bne	.L1007
+	cbz	r0, .L1008
+	ldr	r3, .L1115+40
 	str	r2, [r3]
-.L987:
+.L1008:
 	adds	r4, r4, #1
 	uxth	r4, r4
-	b	.L978
-.L1092:
+	b	.L999
+.L1116:
 	.align	2
-.L1091:
+.L1115:
 	.word	.LANCHOR19
 	.word	.LANCHOR3
 	.word	.LANCHOR103
@@ -7684,22 +7726,22 @@ FtlRecoverySuperblock:
 	.word	.LANCHOR155
 	.word	.LC1
 	.word	.LANCHOR134
-.L986:
+.L1007:
 	ldr	r1, [r3]
 	cmp	r1, #0
-	beq	.L982
-	cbz	r0, .L975
-.L1083:
-	ldr	r3, .L1093
+	beq	.L1003
+	cbz	r0, .L996
+.L1108:
+	ldr	r3, .L1117
 	str	r2, [r3]
-.L975:
+.L996:
 	ldr	fp, [sp, #4]
 	movs	r2, #1
-	ldr	r6, .L1093+4
-	ldr	r3, .L1093+8
+	ldr	r6, .L1117+4
+	ldr	r3, .L1117+8
 	strh	r2, [r3]	@ movhi
-.L990:
-	ldr	r3, .L1093+12
+.L1011:
+	ldr	r3, .L1117+12
 	movw	lr, #65535
 	ldr	r0, [r6]
 	movs	r7, #20
@@ -7707,64 +7749,64 @@ FtlRecoverySuperblock:
 	ldrh	r4, [r3]
 	movs	r3, #0
 	str	r3, [sp, #12]
-.L991:
+.L1012:
 	uxth	r2, r3
 	cmp	r4, r2
-	bhi	.L993
+	bhi	.L1014
 	movs	r2, #0
 	ldr	r1, [sp, #12]
 	bl	FlashReadPages
 	movs	r3, #0
-.L1088:
+.L1112:
 	str	r3, [sp, #24]
 	ldr	r2, [sp, #12]
 	ldrh	r3, [sp, #24]
 	cmp	r2, r3
-	bhi	.L1024
-	ldr	r3, .L1093+16
+	bhi	.L1043
+	ldr	r3, .L1117+16
 	add	fp, fp, #1
 	uxth	fp, fp
 	ldrh	r3, [r3]
 	cmp	r3, fp
-	bne	.L990
-	ldr	r2, .L1093+12
+	bne	.L1011
+	ldr	r2, .L1117+12
 	movw	r0, #65535
 	movs	r3, #0
 	strh	fp, [r8, #2]	@ movhi
 	strh	r3, [r8, #4]	@ movhi
 	ldrh	r2, [r2]
-.L1025:
+.L1044:
 	uxth	r1, r3
 	cmp	r1, r2
-	bcs	.L1081
+	bcs	.L1106
 	ldr	r1, [sp, #16]
 	ldrh	r4, [r1], #2
 	cmp	r4, r0
 	str	r1, [sp, #16]
 	add	r1, r3, #1
-	bne	.L1089
+	bne	.L1113
 	mov	r3, r1
-	b	.L1025
-.L982:
+	b	.L1044
+.L1003:
 	ldr	r1, [r3, #12]
 	ldrh	lr, [r1]
 	cmp	lr, ip
-	beq	.L985
+	beq	.L1006
 	ldr	r1, [r1, #4]
 	cmp	r1, #-1
 	itt	ne
 	movne	r2, r1
 	movne	r0, #1
-.L985:
+.L1006:
 	adds	r3, r3, #20
-	b	.L981
-.L988:
+	b	.L1002
+.L1009:
 	mov	r2, #-1
-	b	.L1083
-.L993:
+	b	.L1108
+.L1014:
 	ldrh	r2, [r1], #2
 	cmp	r2, lr
-	beq	.L992
+	beq	.L1013
 	ldr	r5, [sp, #12]
 	orr	r2, fp, r2, lsl #10
 	mla	ip, r7, r5, r0
@@ -7773,10 +7815,10 @@ FtlRecoverySuperblock:
 	adds	r2, r2, #1
 	uxth	r2, r2
 	str	r2, [sp, #12]
-.L992:
+.L1013:
 	adds	r3, r3, #1
-	b	.L991
-.L1024:
+	b	.L1012
+.L1043:
 	ldr	r3, [sp, #24]
 	movs	r5, #20
 	muls	r5, r3, r5
@@ -7789,45 +7831,45 @@ FtlRecoverySuperblock:
 	bl	P2V_plane
 	ldr	r3, [sp, #4]
 	cmp	fp, r3
-	bcc	.L995
+	bcc	.L1016
 	ldr	r3, [sp, #28]
-	bne	.L996
+	bne	.L1017
 	ldr	r2, [sp, #20]
 	cmp	r2, r0
-	bhi	.L995
-.L996:
+	bhi	.L1016
+.L1017:
 	ldr	r2, [sp, #8]
 	cmp	fp, r2
-	bne	.L997
+	bne	.L1018
 	cmp	r10, r0
-	beq	.L998
-.L997:
+	beq	.L1019
+.L1018:
 	ldr	r3, [r3, r5]
 	adds	r3, r3, #1
-	beq	.L999
+	beq	.L1020
 	ldr	r3, [r7, #12]
 	movw	r2, #61589
 	ldrh	r1, [r3]
 	cmp	r1, r2
-	beq	.L1000
+	beq	.L1021
 	ldrh	r0, [r8]
-.L1086:
+.L1109:
 	bl	decrement_vpc_count
-	b	.L995
-.L1000:
+	b	.L1016
+.L1021:
 	ldr	r2, [r3, #4]
 	str	r2, [sp]
 	adds	r2, r2, #1
-	beq	.L1001
-	ldr	r2, .L1093+20
+	beq	.L1022
+	ldr	r2, .L1117+20
 	ldr	r0, [sp]
 	ldr	r1, [r2]
 	bl	ftl_cmp_data_ver
-	cbz	r0, .L1001
+	cbz	r0, .L1022
 	ldr	r1, [sp]
 	adds	r1, r1, #1
 	str	r1, [r2]
-.L1001:
+.L1022:
 	ldr	r4, [r3, #8]
 	add	r1, sp, #40
 	ldr	r3, [r3, #12]
@@ -7835,17 +7877,17 @@ FtlRecoverySuperblock:
 	mov	r0, r4
 	str	r3, [sp, #36]
 	bl	log2phys
-	ldr	r3, .L1093
+	ldr	r3, .L1117
 	ldr	r1, [r3]
 	adds	r3, r1, #1
-	beq	.L1002
+	beq	.L1023
 	ldr	r0, [sp]
 	bl	ftl_cmp_data_ver
 	cmp	r0, #0
-	beq	.L1002
+	beq	.L1023
 	ldr	r3, [sp, #36]
 	adds	r7, r3, #1
-	beq	.L1003
+	beq	.L1024
 	ldr	r0, [r6]
 	movs	r2, #0
 	movs	r1, #1
@@ -7857,103 +7899,119 @@ FtlRecoverySuperblock:
 	ldr	r1, [r2, r5]
 	adds	r3, r2, r5
 	adds	r1, r1, #1
-	bne	.L1004
-.L1005:
+	bne	.L1025
+.L1026:
 	mov	r3, #-1
 	str	r3, [sp, #36]
-.L1012:
+.L1033:
 	ldr	r7, [sp, #36]
 	adds	r0, r7, #1
-	beq	.L995
-.L1028:
+	beq	.L1016
+.L1047:
 	ubfx	r0, r7, #10, #16
 	bl	P2V_block_in_plane
-	ldr	r3, .L1093+24
+	ldr	r3, .L1117+24
 	mov	r4, r0
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	bhi	.L1020
-	movw	r2, #2065
-	ldr	r1, .L1093+28
-	ldr	r0, .L1093+32
+	bhi	.L1039
+	movw	r2, #2057
+	ldr	r1, .L1117+28
+	ldr	r0, .L1117+32
 	bl	printf
-.L1020:
-	ldr	r3, .L1093+36
+.L1039:
+	ldr	r3, .L1117+36
 	ldr	r3, [r3]
 	ldrh	r3, [r3, r4, lsl #1]
 	cmp	r3, #0
-	beq	.L1021
+	beq	.L1040
 	mov	r0, r4
-	b	.L1086
-.L1003:
+	b	.L1109
+.L1024:
 	ldr	r3, [sp, #44]
 	ldr	r2, [sp, #40]
 	cmp	r2, r3
-	bne	.L995
+	bne	.L1016
 	movs	r2, #1
 	add	r1, sp, #36
 	mov	r0, r4
 	bl	log2phys
-.L995:
+.L1016:
 	ldr	r3, [sp, #24]
 	adds	r3, r3, #1
-	b	.L1088
-.L1004:
+	b	.L1112
+.L1025:
 	ldr	r1, [r7, #8]
 	cmp	r4, r1
-	bne	.L1005
-	ldr	r0, .L1093
+	bne	.L1026
+	ldr	r0, .L1117
 	ldr	r1, [r7, #4]
 	ldr	r0, [r0]
 	str	r1, [sp, #28]
 	bl	ftl_cmp_data_ver
 	cmp	r0, #0
-	beq	.L1005
+	beq	.L1026
 	ldr	r1, [sp, #40]
 	ldr	r0, [sp, #44]
 	cmp	r1, r0
-	bne	.L1007
-.L1010:
+	bne	.L1028
+.L1031:
 	ldr	r1, [sp, #36]
 	mov	r0, r4
 	bl	FtlReUsePrevPpa
-	b	.L1005
-.L1007:
+	b	.L1026
+.L1028:
 	ldr	r0, [sp, #36]
 	cmp	r1, r0
-	beq	.L1005
+	beq	.L1026
 	adds	r0, r1, #1
-	beq	.L1008
+	beq	.L1029
 	str	r1, [r3, #4]
 	movs	r2, #0
 	movs	r1, #1
 	mov	r0, r3
 	ldr	r7, [r3, #12]
 	bl	FlashReadPages
-.L1009:
+.L1030:
 	ldr	r3, [r6]
 	ldr	r3, [r3, r5]
 	adds	r3, r3, #1
-	beq	.L1010
+	beq	.L1031
 	ldr	r3, [r7, #4]
-	ldr	r2, .L1093
+	ldr	r2, .L1117
 	mov	r1, r3
 	ldr	r0, [r2]
 	bl	ftl_cmp_data_ver
 	cmp	r0, #0
-	beq	.L1010
+	beq	.L1031
 	mov	r1, r3
 	ldr	r0, [sp, #28]
 	bl	ftl_cmp_data_ver
 	cmp	r0, #0
-	beq	.L1005
-	b	.L1010
-.L1008:
+	beq	.L1026
+	b	.L1031
+.L1029:
 	str	r1, [r2, r5]
-	b	.L1009
-.L1094:
+	b	.L1030
+.L1023:
+	ldr	r3, [sp, #44]
+	ldr	r2, [sp, #40]
+	cmp	r2, r3
+	beq	.L1033
+	ldr	r1, [sp, #36]
+	adds	r7, r1, #1
+	beq	.L1035
+	ldr	r3, .L1117+40
+	ldr	r3, [r3]
+	cmp	r3, r1, lsr #10
+	bhi	.L1035
+	ldr	r0, .L1117+44
+.L1111:
+	bl	printf
+	b	.L1016
+.L1118:
 	.align	2
-.L1093:
+.L1117:
 	.word	.LANCHOR134
 	.word	.LANCHOR103
 	.word	.LANCHOR156
@@ -7964,44 +8022,34 @@ FtlRecoverySuperblock:
 	.word	.LANCHOR155
 	.word	.LC1
 	.word	.LANCHOR42
-.L1002:
-	ldr	r3, [sp, #44]
-	ldr	r2, [sp, #40]
-	cmp	r2, r3
-	beq	.L1012
-	ldr	r2, .L1095
-	ldr	r3, [sp, #36]
-	ldr	r2, [r2]
-	cmp	r2, r3, lsr #10
-	bhi	.L1014
-	adds	r3, r3, #1
-.L1085:
-	bne	.L995
+	.word	.LANCHOR8
+	.word	.LC27
+.L1035:
 	movs	r2, #1
 	add	r1, sp, #44
 	mov	r0, r4
 	bl	log2phys
 	ldr	r7, [sp, #40]
 	adds	r5, r7, #1
-	beq	.L1012
+	beq	.L1033
 	ldr	r3, [sp, #36]
 	cmp	r7, r3
-	beq	.L1028
+	beq	.L1047
 	ubfx	r0, r7, #10, #16
 	bl	P2V_block_in_plane
-	ldr	r3, .L1095+4
+	ldr	r3, .L1119
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	beq	.L1019
-	ldr	r3, .L1095+8
+	beq	.L1038
+	ldr	r3, .L1119+4
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	beq	.L1019
-	ldr	r3, .L1095+12
+	beq	.L1038
+	ldr	r3, .L1119+8
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	bne	.L1012
-.L1019:
+	bne	.L1033
+.L1038:
 	ldr	r0, [r6]
 	movs	r2, #0
 	movs	r1, #1
@@ -8011,77 +8059,61 @@ FtlRecoverySuperblock:
 	ldr	r3, [r6]
 	ldr	r3, [r3]
 	adds	r3, r3, #1
-	beq	.L1012
+	beq	.L1033
 	ldr	r1, [r5, #4]
 	ldr	r0, [sp]
 	bl	ftl_cmp_data_ver
 	cmp	r0, #0
-	bne	.L1012
+	bne	.L1033
 	movs	r2, #1
 	add	r1, sp, #40
 	mov	r0, r4
 	bl	log2phys
-	b	.L1012
-.L1014:
-	ldr	r0, [r6]
-	movs	r2, #0
-	movs	r1, #1
-	ldr	r5, [r0, #12]
-	str	r3, [r0, #4]
-	bl	FlashReadPages
-	ldr	r3, [r5, #8]
-	cmp	r4, r3
-	bne	.L995
-	ldrh	r2, [r5]
-	movw	r3, #61589
-	cmp	r2, r3
-	b	.L1085
-.L1021:
+	b	.L1033
+.L1040:
 	mov	r1, r4
-	ldr	r0, .L1095+16
-	bl	printf
-	b	.L995
-.L999:
-	ldr	r3, .L1095+20
+	ldr	r0, .L1119+12
+	b	.L1111
+.L1020:
+	ldr	r3, .L1119+16
 	ldr	r3, [r3]
 	cmp	r3, #31
-	bhi	.L1022
-	ldr	r2, .L1095+24
+	bhi	.L1041
+	ldr	r2, .L1119+20
 	str	r4, [r2, r3, lsl #2]
 	adds	r3, r3, #1
-	ldr	r2, .L1095+20
+	ldr	r2, .L1119+16
 	str	r3, [r2]
-.L1022:
+.L1041:
 	ldrh	r0, [r8]
 	bl	decrement_vpc_count
-	ldr	r3, .L1095+28
+	ldr	r3, .L1119+24
 	ldr	r2, [r3]
 	adds	r1, r2, #1
-	bne	.L1023
+	bne	.L1042
 	ldr	r2, [sp]
-.L1087:
+.L1110:
 	str	r2, [r3]
-	b	.L995
-.L1023:
+	b	.L1016
+.L1042:
 	ldr	r1, [sp]
 	cmp	r1, r2
-	bcs	.L995
+	bcs	.L1016
 	mov	r2, r1
-	b	.L1087
-.L998:
+	b	.L1110
+.L1019:
 	strb	r10, [r8, #6]
 	mov	r2, r10
 	strh	fp, [r8, #2]	@ movhi
 	mov	r1, fp
-	b	.L1090
-.L1096:
+	b	.L1114
+.L1120:
 	.align	2
-.L1095:
-	.word	.LANCHOR8
+.L1119:
 	.word	.LANCHOR51
 	.word	.LANCHOR52
 	.word	.LANCHOR53
-	.word	.LC24
+	.word	.LC28
 	.word	.LANCHOR157
 	.word	.LANCHOR158
 	.word	.LANCHOR134
@@ -8099,56 +8131,56 @@ ftl_check_vpc:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r4, #0
-	ldr	r6, .L1121
-	ldr	r5, .L1121+4
-	ldr	r1, .L1121+8
-	ldr	r0, .L1121+12
+	ldr	r6, .L1145
+	ldr	r5, .L1145+4
+	ldr	r1, .L1145+8
+	ldr	r0, .L1145+12
 	bl	printf
 	mov	r2, #8192
 	movs	r1, #0
-	ldr	r0, .L1121+4
+	ldr	r0, .L1145+4
 	bl	ftl_memset
-.L1098:
+.L1122:
 	ldr	r3, [r6]
 	cmp	r4, r3
-	bcc	.L1100
-	ldr	r10, .L1121+48
+	bcc	.L1124
+	ldr	r10, .L1145+48
 	movs	r4, #0
-	ldr	r7, .L1121+16
+	ldr	r7, .L1145+16
 	mov	r6, r4
-.L1101:
+.L1125:
 	ldrh	r2, [r10]
 	uxth	r3, r4
 	cmp	r2, r3
-	bhi	.L1103
-	ldr	r3, .L1121+20
+	bhi	.L1127
+	ldr	r3, .L1145+20
 	ldr	r4, [r3]
-	cbz	r4, .L1104
-	ldr	r3, .L1121+24
+	cbz	r4, .L1128
+	ldr	r3, .L1145+24
 	mov	r8, #0
-	ldr	r5, .L1121+28
-	ldr	r10, .L1121+16
+	ldr	r5, .L1145+28
+	ldr	r10, .L1145+16
 	ldrh	r7, [r3]
 	ldr	r3, [r5]
-	ldr	fp, .L1121+4
+	ldr	fp, .L1145+4
 	subs	r4, r4, r3
-	ldr	r3, .L1121+32
+	ldr	r3, .L1145+32
 	asrs	r4, r4, #1
 	muls	r4, r3, r4
 	uxth	r4, r4
-.L1105:
+.L1129:
 	uxth	r3, r8
 	cmp	r7, r3
-	bls	.L1104
+	bls	.L1128
 	ldr	r3, [r10]
 	ldrh	r2, [r3, r4, lsl #1]
-	cbz	r2, .L1106
+	cbz	r2, .L1130
 	movs	r6, #1
 	ldrh	r3, [fp, r4, lsl #1]
 	mov	r1, r4
-	ldr	r0, .L1121+36
+	ldr	r0, .L1145+36
 	bl	printf
-.L1106:
+.L1130:
 	movs	r3, #6
 	ldr	r2, [r5]
 	muls	r4, r3, r4
@@ -8156,71 +8188,71 @@ ftl_check_vpc:
 	add	r8, r8, #1
 	ldrh	r4, [r2, r4]
 	cmp	r4, r3
-	bne	.L1105
-.L1104:
-	cbz	r6, .L1097
-	movw	r2, #2389
-	ldr	r1, .L1121+8
-	ldr	r0, .L1121+40
+	bne	.L1129
+.L1128:
+	cbz	r6, .L1121
+	movw	r2, #2383
+	ldr	r1, .L1145+8
+	ldr	r0, .L1145+40
 	bl	printf
-.L1097:
+.L1121:
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1100:
+.L1124:
 	movs	r2, #0
 	add	r1, sp, #4
 	mov	r0, r4
 	bl	log2phys
 	ldr	r0, [sp, #4]
 	adds	r3, r0, #1
-	beq	.L1099
+	beq	.L1123
 	ubfx	r0, r0, #10, #16
 	bl	P2V_block_in_plane
 	ldrh	r3, [r5, r0, lsl #1]
 	adds	r3, r3, #1
 	strh	r3, [r5, r0, lsl #1]	@ movhi
-.L1099:
+.L1123:
 	adds	r4, r4, #1
-	b	.L1098
-.L1103:
+	b	.L1122
+.L1127:
 	ldr	r3, [r7]
 	uxth	r5, r4
-	ldr	r8, .L1121+4
+	ldr	r8, .L1145+4
 	ldrh	r2, [r3, r5, lsl #1]
 	ldrh	r3, [r8, r5, lsl #1]
 	cmp	r2, r3
-	beq	.L1102
+	beq	.L1126
 	mov	r1, r5
-	ldr	r0, .L1121+44
+	ldr	r0, .L1145+44
 	bl	printf
 	ldr	r3, [r7]
 	movw	r2, #65535
 	ldrh	r3, [r3, r5, lsl #1]
 	cmp	r3, r2
-	beq	.L1102
+	beq	.L1126
 	ldrh	r2, [r8, r5, lsl #1]
 	cmp	r2, r3
 	it	hi
 	movhi	r6, #1
-.L1102:
+.L1126:
 	adds	r4, r4, #1
-	b	.L1101
-.L1122:
+	b	.L1125
+.L1146:
 	.align	2
-.L1121:
+.L1145:
 	.word	.LANCHOR152
 	.word	check_vpc_table
 	.word	.LANCHOR159
-	.word	.LC25
+	.word	.LC29
 	.word	.LANCHOR42
-	.word	.LANCHOR47
+	.word	.LANCHOR46
 	.word	.LANCHOR48
 	.word	.LANCHOR40
 	.word	-1431655765
-	.word	.LC27
+	.word	.LC31
 	.word	.LC1
-	.word	.LC26
+	.word	.LC30
 	.word	.LANCHOR5
 	.size	ftl_check_vpc, .-ftl_check_vpc
 	.section	.text.ftl_scan_all_data,"ax",%progbits
@@ -8236,60 +8268,60 @@ ftl_scan_all_data:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, r7, r8, lr}
 	movs	r5, #0
-	ldr	r7, .L1137
+	ldr	r7, .L1161
 	sub	sp, sp, #32
 	movs	r1, #0
-	ldr	r8, .L1137+24
-	ldr	r0, .L1137+4
+	ldr	r8, .L1161+24
+	ldr	r0, .L1161+4
 	bl	printf
-.L1124:
+.L1148:
 	ldr	r3, [r7]
 	cmp	r5, r3
-	bcc	.L1130
+	bcc	.L1154
 	add	sp, sp, #32
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, pc}
-.L1130:
+.L1154:
 	movs	r2, #0
 	add	r1, sp, #28
 	mov	r0, r5
 	bl	log2phys
 	ubfx	r3, r5, #0, #11
-	cbnz	r3, .L1125
+	cbnz	r3, .L1149
 	ldr	r2, [sp, #28]
 	mov	r1, r5
 	mov	r0, r8
 	bl	printf
-.L1125:
+.L1149:
 	ldr	r3, [sp, #28]
 	adds	r2, r3, #1
-	beq	.L1127
-	ldr	r4, .L1137+8
+	beq	.L1151
+	ldr	r4, .L1161+8
 	movs	r2, #0
 	movs	r1, #1
 	str	r3, [r4, #4]
 	mov	r0, r4
-	ldr	r3, .L1137+12
+	ldr	r3, .L1161+12
 	str	r5, [r4, #16]
 	str	r2, [r4]
 	ldr	r3, [r3]
 	str	r3, [r4, #8]
-	ldr	r3, .L1137+16
+	ldr	r3, .L1161+16
 	ldr	r6, [r3]
 	str	r6, [r4, #12]
 	bl	FlashReadPages
 	ldr	r3, [r4]
 	cmp	r3, #256
-	beq	.L1128
+	beq	.L1152
 	adds	r3, r3, #1
-	beq	.L1128
+	beq	.L1152
 	ldr	r3, [r6, #8]
 	cmp	r5, r3
-	beq	.L1127
-.L1128:
+	beq	.L1151
+.L1152:
 	ldr	r2, [r4, #8]
 	ldr	r3, [r4, #12]
-	ldr	r0, .L1137+20
+	ldr	r0, .L1161+20
 	ldr	r1, [r2, #4]
 	str	r1, [sp, #16]
 	mov	r1, r5
@@ -8304,19 +8336,19 @@ ftl_scan_all_data:
 	ldr	r2, [r4, #4]
 	ldr	r3, [r3]
 	bl	printf
-.L1127:
+.L1151:
 	adds	r5, r5, #1
-	b	.L1124
-.L1138:
+	b	.L1148
+.L1162:
 	.align	2
-.L1137:
+.L1161:
 	.word	.LANCHOR152
-	.word	.LC28
+	.word	.LC32
 	.word	.LANCHOR138
 	.word	.LANCHOR106
 	.word	.LANCHOR114
-	.word	.LC30
-	.word	.LC29
+	.word	.LC34
+	.word	.LC33
 	.size	ftl_scan_all_data, .-ftl_scan_all_data
 	.section	.text.FtlGcScanTempBlk,"ax",%progbits
 	.align	1
@@ -8329,7 +8361,7 @@ ftl_scan_all_data:
 FtlGcScanTempBlk:
 	@ args = 0, pretend = 0, frame = 48
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L1169
+	ldr	r3, .L1195
 	movw	r2, #65535
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	sub	sp, sp, #48
@@ -8337,29 +8369,29 @@ FtlGcScanTempBlk:
 	ldrh	r5, [r3]
 	str	r3, [sp, #20]
 	cmp	r5, r2
-	beq	.L1161
-	cbnz	r5, .L1140
-.L1141:
+	beq	.L1185
+	cbnz	r5, .L1164
+.L1165:
 	bl	FtlGcPageVarInit
-	b	.L1142
-.L1161:
+	b	.L1166
+.L1185:
 	movs	r5, #0
-.L1140:
-	ldr	r3, .L1169+4
+.L1164:
+	ldr	r3, .L1195+4
 	ldrh	r3, [r3]
 	cmp	r3, r1
-	beq	.L1141
-.L1142:
-	ldr	fp, .L1169+52
-.L1143:
+	beq	.L1165
+.L1166:
+	ldr	fp, .L1195+56
+.L1182:
 	ldrh	r2, [r4]
 	movs	r3, #0
 	strb	r3, [r4, #8]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L1144
-.L1160:
-	ldr	r3, .L1169+8
+	beq	.L1167
+.L1184:
+	ldr	r3, .L1195+8
 	movs	r2, #0
 	ldr	r0, [fp]
 	mov	r10, r2
@@ -8367,38 +8399,38 @@ FtlGcScanTempBlk:
 	mov	r8, #20
 	ldrh	r3, [r3]
 	str	r3, [sp, #8]
-	ldr	r3, .L1169+12
+	ldr	r3, .L1195+12
 	ldr	r3, [r3]
 	str	r3, [sp, #12]
-	ldr	r3, .L1169+16
+	ldr	r3, .L1195+16
 	ldrh	r3, [r3]
 	str	r3, [sp, #16]
-	ldr	r3, .L1169+20
+	ldr	r3, .L1195+20
 	ldr	r7, [r3]
-	ldr	r3, .L1169+24
+	ldr	r3, .L1195+24
 	ldrh	ip, [r3]
 	add	r3, r4, #16
 	str	r3, [sp, #4]
-.L1145:
+.L1168:
 	ldr	r1, [sp, #8]
 	uxth	r3, r2
 	cmp	r1, r3
-	bhi	.L1147
+	bhi	.L1170
 	mov	r8, #0
 	movs	r2, #0
 	mov	r1, r10
 	bl	FlashReadPages
-.L1148:
+.L1171:
 	uxth	r3, r8
 	cmp	r10, r3
-	bhi	.L1159
-	ldr	r3, .L1169+4
+	bhi	.L1183
+	ldr	r3, .L1195+4
 	adds	r5, r5, #1
 	uxth	r5, r5
 	ldrh	r3, [r3]
 	cmp	r3, r5
-	bhi	.L1160
-.L1144:
+	bhi	.L1184
+.L1167:
 	ldr	r2, [sp, #20]
 	movw	r3, #65535
 	mov	r0, r4
@@ -8412,12 +8444,12 @@ FtlGcScanTempBlk:
 	add	sp, sp, #48
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1147:
+.L1170:
 	ldr	r1, [sp, #4]
 	ldrh	r3, [r1], #2
 	cmp	r3, lr
 	str	r1, [sp, #4]
-	beq	.L1146
+	beq	.L1169
 	mla	r1, r8, r10, r0
 	orr	r3, r5, r3, lsl #10
 	str	r3, [r1, #4]
@@ -8434,30 +8466,31 @@ FtlGcScanTempBlk:
 	str	r3, [r1, #12]
 	add	r3, r10, #1
 	uxth	r10, r3
-.L1146:
+.L1169:
 	adds	r2, r2, #1
-	b	.L1145
-.L1159:
+	b	.L1168
+.L1183:
 	movs	r3, #20
-	ldr	r1, [fp]
+	ldr	r2, [fp]
 	mul	r3, r3, r8
-	adds	r2, r1, r3
-	ldr	r6, [r1, r3]
-	ldr	r0, [r2, #4]
+	adds	r1, r2, r3
+	ldr	r6, [r2, r3]
+	ldr	r0, [r1, #4]
+	ldr	r7, [r1, #12]
 	str	r0, [sp, #4]
-	cbnz	r6, .L1149
-	ldr	r7, [r2, #12]
-	movw	r2, #65535
+	cmp	r6, #0
+	bne	.L1172
 	ldrh	r1, [r7]
+	movw	r2, #65535
 	cmp	r1, r2
-	beq	.L1149
-	ldr	r2, .L1169+28
+	beq	.L1193
+	ldr	r2, .L1195+28
 	ldr	r0, [r7, #8]
 	ldr	r2, [r2]
 	cmp	r0, r2
-	bls	.L1151
-.L1149:
-	ldr	r3, .L1169+32
+	bls	.L1174
+.L1193:
+	ldr	r3, .L1195+32
 	movs	r1, #0
 	ldrh	r2, [r4]
 	movs	r5, #0
@@ -8465,11 +8498,13 @@ FtlGcScanTempBlk:
 	strh	r1, [r3, r2, lsl #1]	@ movhi
 	ldrh	r0, [r4]
 	bl	INSERT_FREE_LIST
+	ldr	r2, .L1195+36
 	movw	r3, #65535
 	strh	r3, [r4]	@ movhi
+	strh	r3, [r2]	@ movhi
 	bl	FtlGcPageVarInit
-	b	.L1143
-.L1151:
+	b	.L1182
+.L1174:
 	mov	r2, r6
 	add	r1, sp, #24
 	str	r3, [sp, #8]
@@ -8478,55 +8513,59 @@ FtlGcScanTempBlk:
 	ldr	r1, [sp, #24]
 	ldr	r3, [sp, #8]
 	cmp	r2, r1
-	beq	.L1153
-.L1154:
+	beq	.L1176
+.L1178:
 	ldr	r2, [r7, #8]
-	add	r8, r8, #1
+.L1194:
 	ldr	r1, [sp, #4]
+	add	r8, r8, #1
 	ldr	r0, [r7, #12]
 	bl	FtlGcUpdatePage
-	b	.L1148
-.L1153:
+	b	.L1171
+.L1176:
 	str	r3, [sp, #8]
 	adds	r3, r2, #1
-	beq	.L1154
+	beq	.L1178
 	str	r2, [sp, #32]
 	movs	r1, #1
-	ldr	r2, .L1169+36
+	ldr	r2, .L1195+40
 	add	r0, sp, #28
 	ldr	r2, [r2]
 	str	r2, [sp, #36]
-	ldr	r2, .L1169+40
+	ldr	r2, .L1195+44
 	ldr	r2, [r2]
 	str	r2, [sp, #40]
 	mov	r2, r6
 	bl	FlashReadPages
-	ldr	r2, .L1169+44
+	ldr	r2, .L1195+48
 	ldr	r1, [fp]
 	ldr	r3, [sp, #8]
 	ldrh	r2, [r2]
 	ldr	r0, [sp, #36]
 	add	ip, r3, r1
 	lsls	r2, r2, #7
-.L1155:
+.L1179:
 	cmp	r6, r2
-	beq	.L1154
+	beq	.L1178
 	ldr	r1, [ip, #8]
 	ldr	r3, [r0, r6, lsl #2]
 	ldr	r1, [r1, r6, lsl #2]
 	cmp	r1, r3
-	beq	.L1156
+	beq	.L1180
 	ldr	r2, [sp, #32]
 	ldrh	r1, [r4]
-	ldr	r0, .L1169+48
+	ldr	r0, .L1195+52
 	bl	printf
-	b	.L1149
-.L1156:
+	b	.L1193
+.L1180:
 	adds	r6, r6, #1
-	b	.L1155
-.L1170:
+	b	.L1179
+.L1172:
+	mov	r2, #-1
+	b	.L1194
+.L1196:
 	.align	2
-.L1169:
+.L1195:
 	.word	.LANCHOR160
 	.word	.LANCHOR19
 	.word	.LANCHOR3
@@ -8536,10 +8575,11 @@ FtlGcScanTempBlk:
 	.word	.LANCHOR24
 	.word	.LANCHOR152
 	.word	.LANCHOR42
+	.word	.LANCHOR145
 	.word	.LANCHOR110
 	.word	.LANCHOR115
 	.word	.LANCHOR12
-	.word	.LC31
+	.word	.LC35
 	.word	.LANCHOR103
 	.size	FtlGcScanTempBlk, .-FtlGcScanTempBlk
 	.section	.text.FtlVendorPartWrite,"ax",%progbits
@@ -8553,7 +8593,7 @@ FtlGcScanTempBlk:
 FtlVendorPartWrite:
 	@ args = 0, pretend = 0, frame = 104
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L1183
+	ldr	r3, .L1209
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	sub	sp, sp, #104
 	str	r2, [sp]
@@ -8562,26 +8602,26 @@ FtlVendorPartWrite:
 	mov	r5, r1
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bhi	.L1179
-	ldr	r3, .L1183+4
+	bhi	.L1205
+	ldr	r3, .L1209+4
 	mov	r8, #0
 	ldrh	r6, [r3]
 	lsr	r6, r0, r6
 	lsl	fp, r6, #2
-.L1173:
-	cbnz	r5, .L1178
-.L1171:
+.L1199:
+	cbnz	r5, .L1204
+.L1197:
 	mov	r0, r8
 	add	sp, sp, #104
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1178:
-	ldr	r3, .L1183+8
+.L1204:
+	ldr	r3, .L1209+8
 	mov	r0, r7
-	ldr	r10, .L1183+24
+	ldr	r10, .L1209+24
 	ldr	r3, [r3]
 	ldr	r2, [r3, fp]
-	ldr	r3, .L1183+12
+	ldr	r3, .L1209+12
 	str	r2, [sp, #12]
 	ldrh	r3, [r3]
 	mov	r1, r3
@@ -8595,9 +8635,9 @@ FtlVendorPartWrite:
 	cmp	r5, r4
 	it	cc
 	uxthcc	r4, r5
-	cbz	r2, .L1175
+	cbz	r2, .L1201
 	cmp	r4, r3
-	beq	.L1175
+	beq	.L1201
 	ldr	r3, [r10]
 	add	r0, sp, #20
 	str	r2, [sp, #24]
@@ -8607,7 +8647,7 @@ FtlVendorPartWrite:
 	add	r3, sp, #40
 	str	r3, [sp, #32]
 	bl	FlashReadPages
-.L1176:
+.L1202:
 	lsls	r3, r4, #9
 	ldr	r0, [r10]
 	subs	r5, r5, r4
@@ -8620,7 +8660,7 @@ FtlVendorPartWrite:
 	bl	ftl_memcpy
 	ldr	r2, [r10]
 	mov	r1, r6
-	ldr	r0, .L1183+16
+	ldr	r0, .L1209+16
 	adds	r6, r6, #1
 	bl	FtlMapWritePage
 	ldr	r3, [sp]
@@ -8631,20 +8671,20 @@ FtlVendorPartWrite:
 	ldr	r3, [sp, #8]
 	add	r2, r2, r3
 	str	r2, [sp]
-	b	.L1173
-.L1175:
-	ldr	r3, .L1183+20
+	b	.L1199
+.L1201:
+	ldr	r3, .L1209+20
 	movs	r1, #0
 	ldr	r0, [r10]
 	ldrh	r2, [r3]
 	bl	ftl_memset
-	b	.L1176
-.L1179:
+	b	.L1202
+.L1205:
 	mov	r8, #-1
-	b	.L1171
-.L1184:
+	b	.L1197
+.L1210:
 	.align	2
-.L1183:
+.L1209:
 	.word	.LANCHOR16
 	.word	.LANCHOR22
 	.word	.LANCHOR123
@@ -8665,57 +8705,57 @@ Ftl_save_ext_data:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	@ link register save eliminated.
-	ldr	r2, .L1187
-	ldr	r3, .L1187+4
+	ldr	r2, .L1213
+	ldr	r3, .L1213+4
 	ldr	r1, [r2]
 	cmp	r1, r3
-	bne	.L1185
-	ldr	r3, .L1187+8
+	bne	.L1211
+	ldr	r3, .L1213+8
 	movs	r1, #1
 	movs	r0, #0
 	str	r3, [r2, #4]
-	ldr	r3, .L1187+12
+	ldr	r3, .L1213+12
 	ldr	r3, [r3]
 	str	r3, [r2, #88]
-	ldr	r3, .L1187+16
+	ldr	r3, .L1213+16
 	ldr	r3, [r3]
 	str	r3, [r2, #92]
-	ldr	r3, .L1187+20
+	ldr	r3, .L1213+20
 	ldr	r3, [r3]
 	str	r3, [r2, #8]
-	ldr	r3, .L1187+24
+	ldr	r3, .L1213+24
 	ldr	r3, [r3]
 	str	r3, [r2, #12]
-	ldr	r3, .L1187+28
+	ldr	r3, .L1213+28
 	ldr	r3, [r3]
 	str	r3, [r2, #16]
-	ldr	r3, .L1187+32
+	ldr	r3, .L1213+32
 	ldr	r3, [r3]
 	str	r3, [r2, #20]
-	ldr	r3, .L1187+36
+	ldr	r3, .L1213+36
 	ldr	r3, [r3]
 	str	r3, [r2, #28]
-	ldr	r3, .L1187+40
+	ldr	r3, .L1213+40
 	ldr	r3, [r3]
 	str	r3, [r2, #32]
-	ldr	r3, .L1187+44
+	ldr	r3, .L1213+44
 	ldr	r3, [r3]
 	str	r3, [r2, #36]
-	ldr	r3, .L1187+48
+	ldr	r3, .L1213+48
 	ldr	r3, [r3]
 	str	r3, [r2, #40]
-	ldr	r3, .L1187+52
+	ldr	r3, .L1213+52
 	ldr	r3, [r3]
 	str	r3, [r2, #44]
-	ldr	r3, .L1187+56
+	ldr	r3, .L1213+56
 	ldr	r3, [r3]
 	str	r3, [r2, #48]
 	b	FtlVendorPartWrite
-.L1185:
+.L1211:
 	bx	lr
-.L1188:
+.L1214:
 	.align	2
-.L1187:
+.L1213:
 	.word	.LANCHOR135
 	.word	1179929683
 	.word	1342177352
@@ -8743,7 +8783,7 @@ Ftl_save_ext_data:
 FtlEctTblFlush:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r2, .L1194
+	ldr	r2, .L1220
 	push	{r3, lr}
 	ldrh	r3, [r2]
 	cmp	r3, #31
@@ -8752,22 +8792,22 @@ FtlEctTblFlush:
 	movhi	r3, #32
 	strhls	r3, [r2]	@ movhi
 	movls	r3, #1
-	ldr	r2, .L1194+4
-	cbnz	r0, .L1191
+	ldr	r2, .L1220+4
+	cbnz	r0, .L1217
 	ldr	r1, [r2]
 	ldr	r0, [r1, #20]
 	ldr	r1, [r1, #16]
 	add	r3, r3, r0
 	cmp	r1, r3
-	bcc	.L1192
-.L1191:
+	bcc	.L1218
+.L1217:
 	ldr	r2, [r2]
 	movs	r0, #64
 	ldr	r3, [r2, #16]
 	str	r3, [r2, #20]
-	ldr	r3, .L1194+8
+	ldr	r3, .L1220+8
 	str	r3, [r2]
-	ldr	r3, .L1194+12
+	ldr	r3, .L1220+12
 	ldrh	r1, [r3]
 	lsls	r3, r1, #9
 	str	r3, [r2, #12]
@@ -8778,12 +8818,12 @@ FtlEctTblFlush:
 	str	r3, [r2, #4]
 	bl	FtlVendorPartWrite
 	bl	Ftl_save_ext_data
-.L1192:
+.L1218:
 	movs	r0, #0
 	pop	{r3, pc}
-.L1195:
+.L1221:
 	.align	2
-.L1194:
+.L1220:
 	.word	.LANCHOR164
 	.word	.LANCHOR118
 	.word	1112818501
@@ -8815,7 +8855,7 @@ sftl_vendor_write:
 FtlVendorPartRead:
 	@ args = 0, pretend = 0, frame = 104
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L1207
+	ldr	r3, .L1233
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r10, r2
 	adds	r2, r0, r1
@@ -8824,28 +8864,28 @@ FtlVendorPartRead:
 	mov	r6, r1
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bhi	.L1206
-	ldr	r3, .L1207+4
+	bhi	.L1232
+	ldr	r3, .L1233+4
 	mov	r8, #0
-	ldr	fp, .L1207+28
+	ldr	fp, .L1233+28
 	ldrh	r5, [r3]
 	lsr	r5, r0, r5
 	lsls	r3, r5, #2
 	str	r3, [sp]
-.L1199:
-	cbnz	r6, .L1205
-.L1197:
+.L1225:
+	cbnz	r6, .L1231
+.L1223:
 	mov	r0, r8
 	add	sp, sp, #104
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1205:
-	ldr	r3, .L1207+8
+.L1231:
+	ldr	r3, .L1233+8
 	mov	r0, r7
 	ldr	r2, [sp]
 	ldr	r3, [r3]
 	ldr	r3, [r3, r2]
-	ldr	r2, .L1207+12
+	ldr	r2, .L1233+12
 	str	r3, [sp, #8]
 	ldrh	r4, [r2]
 	mov	r1, r4
@@ -8860,7 +8900,7 @@ FtlVendorPartRead:
 	lsls	r2, r4, #9
 	str	r2, [sp, #8]
 	cmp	r3, #0
-	beq	.L1201
+	beq	.L1227
 	ldr	r2, [fp]
 	add	r0, sp, #20
 	str	r3, [sp, #24]
@@ -8874,28 +8914,28 @@ FtlVendorPartRead:
 	ldr	r2, [sp, #20]
 	ldr	r3, [sp, #12]
 	adds	r2, r2, #1
-	ldr	r2, .L1207+16
+	ldr	r2, .L1233+16
 	it	eq
 	moveq	r8, #-1
 	ldr	r2, [r2]
 	cmp	r2, #256
-	bne	.L1203
+	bne	.L1229
 	mov	r2, r3
 	mov	r1, r5
-	ldr	r0, .L1207+20
+	ldr	r0, .L1233+20
 	bl	printf
 	ldr	r2, [fp]
 	mov	r1, r5
-	ldr	r0, .L1207+24
+	ldr	r0, .L1233+24
 	bl	FtlMapWritePage
-.L1203:
+.L1229:
 	ldr	r1, [fp]
 	lsls	r2, r4, #9
 	ldr	r3, [sp, #4]
 	mov	r0, r10
 	add	r1, r1, r3, lsl #9
 	bl	ftl_memcpy
-.L1204:
+.L1230:
 	ldr	r3, [sp, #8]
 	adds	r5, r5, #1
 	subs	r6, r6, r4
@@ -8904,25 +8944,25 @@ FtlVendorPartRead:
 	ldr	r3, [sp]
 	adds	r3, r3, #4
 	str	r3, [sp]
-	b	.L1199
-.L1201:
+	b	.L1225
+.L1227:
 	lsls	r2, r4, #9
 	mov	r1, r3
 	mov	r0, r10
 	bl	ftl_memset
-	b	.L1204
-.L1206:
+	b	.L1230
+.L1232:
 	mov	r8, #-1
-	b	.L1197
-.L1208:
+	b	.L1223
+.L1234:
 	.align	2
-.L1207:
+.L1233:
 	.word	.LANCHOR16
 	.word	.LANCHOR22
 	.word	.LANCHOR123
 	.word	.LANCHOR12
 	.word	.LANCHOR138
-	.word	.LC32
+	.word	.LC36
 	.word	.LANCHOR161
 	.word	.LANCHOR108
 	.size	FtlVendorPartRead, .-FtlVendorPartRead
@@ -8939,35 +8979,35 @@ FtlLoadEctTbl:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	movs	r0, #64
-	ldr	r4, .L1211
-	ldr	r5, .L1211+4
+	ldr	r4, .L1237
+	ldr	r5, .L1237+4
 	ldr	r2, [r4]
 	ldrh	r1, [r5]
 	bl	FtlVendorPartRead
 	ldr	r3, [r4]
 	ldr	r2, [r3]
-	ldr	r3, .L1211+8
+	ldr	r3, .L1237+8
 	cmp	r2, r3
-	beq	.L1210
-	ldr	r1, .L1211+12
-	ldr	r0, .L1211+16
+	beq	.L1236
+	ldr	r1, .L1237+12
+	ldr	r0, .L1237+16
 	bl	printf
 	ldrh	r2, [r5]
 	movs	r1, #0
 	ldr	r0, [r4]
 	lsls	r2, r2, #9
 	bl	ftl_memset
-.L1210:
+.L1236:
 	movs	r0, #0
 	pop	{r3, r4, r5, pc}
-.L1212:
+.L1238:
 	.align	2
-.L1211:
+.L1237:
 	.word	.LANCHOR118
 	.word	.LANCHOR116
 	.word	1112818501
-	.word	.LC33
-	.word	.LC34
+	.word	.LC37
+	.word	.LC38
 	.size	FtlLoadEctTbl, .-FtlLoadEctTbl
 	.section	.text.Ftl_load_ext_data,"ax",%progbits
 	.align	1
@@ -8982,75 +9022,75 @@ Ftl_load_ext_data:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	movs	r1, #1
-	ldr	r4, .L1216
+	ldr	r4, .L1242
 	movs	r0, #0
-	ldr	r5, .L1216+4
+	ldr	r5, .L1242+4
 	mov	r2, r4
 	bl	FtlVendorPartRead
 	ldr	r3, [r4]
 	cmp	r3, r5
-	beq	.L1214
+	beq	.L1240
 	mov	r2, #512
 	movs	r1, #0
 	mov	r0, r4
 	bl	ftl_memset
 	str	r5, [r4]
-.L1214:
+.L1240:
 	ldr	r3, [r4]
 	cmp	r3, r5
-	ldr	r3, .L1216+8
-	bne	.L1215
+	ldr	r3, .L1242+8
+	bne	.L1241
 	ldr	r1, [r4, #88]
-	ldr	r2, .L1216+12
+	ldr	r2, .L1242+12
 	str	r1, [r2]
 	ldr	r1, [r4, #92]
-	ldr	r2, .L1216+16
+	ldr	r2, .L1242+16
 	str	r1, [r2]
 	ldr	r1, [r4, #8]
-	ldr	r2, .L1216+20
+	ldr	r2, .L1242+20
 	str	r1, [r2]
 	ldr	r1, [r4, #12]
-	ldr	r2, .L1216+24
+	ldr	r2, .L1242+24
 	str	r1, [r2]
 	ldr	r1, [r4, #16]
-	ldr	r2, .L1216+28
+	ldr	r2, .L1242+28
 	str	r1, [r2]
 	ldr	r1, [r4, #20]
-	ldr	r2, .L1216+32
+	ldr	r2, .L1242+32
 	str	r1, [r2]
 	ldr	r2, [r4, #28]
 	ldr	r1, [r4, #32]
 	str	r2, [r3]
-	ldr	r2, .L1216+36
+	ldr	r2, .L1242+36
 	str	r1, [r2]
 	ldr	r1, [r4, #36]
-	ldr	r2, .L1216+40
+	ldr	r2, .L1242+40
 	str	r1, [r2]
 	ldr	r1, [r4, #40]
-	ldr	r2, .L1216+44
+	ldr	r2, .L1242+44
 	str	r1, [r2]
 	ldr	r1, [r4, #44]
-	ldr	r2, .L1216+48
+	ldr	r2, .L1242+48
 	str	r1, [r2]
 	ldr	r1, [r4, #48]
-	ldr	r2, .L1216+52
+	ldr	r2, .L1242+52
 	str	r1, [r2]
-.L1215:
-	ldr	r1, .L1216+56
-	ldr	r2, .L1216+60
+.L1241:
+	ldr	r1, .L1242+56
+	ldr	r2, .L1242+60
 	ldr	r3, [r3]
 	ldr	r0, [r1]
 	ldrh	r2, [r2]
-	ldr	r1, .L1216+64
+	ldr	r1, .L1242+64
 	mla	r0, r0, r2, r3
 	ldrh	r1, [r1]
 	bl	__aeabi_uidiv
-	ldr	r3, .L1216+68
+	ldr	r3, .L1242+68
 	str	r0, [r3]
 	pop	{r3, r4, r5, pc}
-.L1217:
+.L1243:
 	.align	2
-.L1216:
+.L1242:
 	.word	.LANCHOR135
 	.word	1179929683
 	.word	.LANCHOR91
@@ -9068,7 +9108,7 @@ Ftl_load_ext_data:
 	.word	.LANCHOR90
 	.word	.LANCHOR14
 	.word	.LANCHOR5
-	.word	.LANCHOR145
+	.word	.LANCHOR143
 	.size	Ftl_load_ext_data, .-Ftl_load_ext_data
 	.section	.text.sftl_vendor_read,"ax",%progbits
 	.align	1
@@ -9100,30 +9140,30 @@ FtlMapBlkWriteDump_data:
 	mov	r4, r0
 	ldr	r3, [r0, #36]
 	cmp	r3, #0
-	beq	.L1219
+	beq	.L1245
 	movs	r3, #0
-	ldr	r5, .L1231
+	ldr	r5, .L1257
 	str	r3, [r0, #36]
-	ldr	r3, .L1231+4
+	ldr	r3, .L1257+4
 	ldrh	r6, [r0, #6]
 	mov	r7, r5
 	ldr	r10, [r0, #24]
 	ldr	r3, [r3]
 	str	r3, [r5, #8]
-	ldr	r3, .L1231+8
+	ldr	r3, .L1257+8
 	ldr	r8, [r3]
 	ldrh	r3, [r0, #2]
 	str	r8, [r5, #12]
-	cbz	r3, .L1221
-	ldr	r2, .L1231+12
+	cbz	r3, .L1247
+	ldr	r2, .L1257+12
 	ldrh	r2, [r2]
 	subs	r2, r2, #1
 	cmp	r3, r2
-	bge	.L1221
+	bge	.L1247
 	ldrh	r2, [r0]
 	movw	r1, #65535
 	cmp	r2, r1
-	beq	.L1221
+	beq	.L1247
 	ldr	r1, [r0, #12]
 	subs	r3, r3, #1
 	mov	r0, r5
@@ -9135,44 +9175,44 @@ FtlMapBlkWriteDump_data:
 	bl	FlashReadPages
 	ldr	r3, [r5]
 	adds	r3, r3, #1
-	beq	.L1221
+	beq	.L1247
 	ldr	r3, [r4, #24]
 	ldrh	r1, [r8, #8]
 	ldr	r2, [r3, r1, lsl #2]
 	ldr	r3, [r5, #4]
 	cmp	r2, r3
-	bne	.L1221
+	bne	.L1247
 	ldr	r2, [r5, #8]
-.L1230:
+.L1256:
 	mov	r0, r4
 	pop	{r3, r4, r5, r6, r7, r8, r10, lr}
 	b	FtlMapWritePage
-.L1221:
+.L1247:
 	subs	r6, r6, #1
 	uxth	r6, r6
 	ldr	r3, [r10, r6, lsl #2]
 	str	r3, [r7, #4]
-	cbz	r3, .L1222
+	cbz	r3, .L1248
 	movs	r2, #1
-	ldr	r0, .L1231
+	ldr	r0, .L1257
 	mov	r1, r2
 	bl	FlashReadPages
-.L1223:
+.L1249:
 	ldr	r2, [r7, #8]
 	mov	r1, r6
-	b	.L1230
-.L1222:
-	ldr	r3, .L1231+16
+	b	.L1256
+.L1248:
+	ldr	r3, .L1257+16
 	movs	r1, #255
 	ldr	r0, [r7, #8]
 	ldrh	r2, [r3]
 	bl	ftl_memset
-	b	.L1223
-.L1219:
+	b	.L1249
+.L1245:
 	pop	{r3, r4, r5, r6, r7, r8, r10, pc}
-.L1232:
+.L1258:
 	.align	2
-.L1231:
+.L1257:
 	.word	.LANCHOR138
 	.word	.LANCHOR107
 	.word	.LANCHOR114
@@ -9192,10 +9232,10 @@ FtlVpcTblFlush:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
 	mov	r10, #0
-	ldr	r5, .L1248
-	ldr	r3, .L1248+4
-	ldr	fp, .L1248+76
-	ldr	r6, .L1248+8
+	ldr	r5, .L1274
+	ldr	r3, .L1274+4
+	ldr	fp, .L1274+76
+	ldr	r6, .L1274+8
 	ldr	r7, [r3]
 	ldr	r0, [fp]
 	ldrh	r3, [r5]
@@ -9203,23 +9243,23 @@ FtlVpcTblFlush:
 	str	r0, [r6, #8]
 	strh	r3, [r7, #2]	@ movhi
 	movw	r3, #61604
-	ldr	r4, .L1248+12
+	ldr	r4, .L1274+12
 	strh	r3, [r7]	@ movhi
-	ldr	r2, .L1248+16
+	ldr	r2, .L1274+16
 	ldr	r3, [r5, #8]
-	ldr	ip, .L1248+80
+	ldr	ip, .L1274+80
 	str	r10, [r7, #8]
 	str	r3, [r7, #4]
 	stm	r4, {r2, ip}
 	ldrh	r2, [r5, #6]
 	str	r10, [r7, #12]
-	ldr	r8, .L1248+84
+	ldr	r8, .L1274+84
 	strh	r2, [r4, #8]	@ movhi
-	ldr	r2, .L1248+20
-	ldr	r3, .L1248+24
+	ldr	r2, .L1274+20
+	ldr	r3, .L1274+24
 	ldrh	r2, [r2]
 	strb	r2, [r4, #10]
-	ldr	r2, .L1248+28
+	ldr	r2, .L1274+28
 	ldrh	r1, [r2]
 	ldrh	ip, [r2, #2]
 	strh	r1, [r4, #14]	@ movhi
@@ -9227,7 +9267,7 @@ FtlVpcTblFlush:
 	ldrb	r2, [r2, #8]	@ zero_extendqisi2
 	strb	r2, [r4, #11]
 	orr	r1, r1, ip, lsl #6
-	ldr	r2, .L1248+32
+	ldr	r2, .L1274+32
 	strh	r1, [r4, #16]	@ movhi
 	ldrh	r1, [r2]
 	ldrh	ip, [r2, #2]
@@ -9236,7 +9276,7 @@ FtlVpcTblFlush:
 	ldrb	r2, [r2, #8]	@ zero_extendqisi2
 	strb	r2, [r4, #12]
 	orr	r1, r1, ip, lsl #6
-	ldr	r2, .L1248+36
+	ldr	r2, .L1274+36
 	strh	r1, [r4, #20]	@ movhi
 	ldrh	r1, [r2]
 	ldrh	ip, [r2, #2]
@@ -9245,32 +9285,32 @@ FtlVpcTblFlush:
 	ldrb	r2, [r2, #8]	@ zero_extendqisi2
 	strb	r2, [r4, #13]
 	orr	r1, r1, ip, lsl #6
-	ldr	r2, .L1248+40
+	ldr	r2, .L1274+40
 	strh	r1, [r4, #24]	@ movhi
 	movs	r1, #255
 	ldr	r2, [r2]
 	str	r2, [r4, #32]
 	ldr	r2, [r8]
 	str	r2, [r4, #40]
-	ldr	r2, .L1248+44
+	ldr	r2, .L1274+44
 	ldr	r2, [r2]
 	str	r2, [r4, #36]
 	ldrh	r2, [r3]
 	bl	ftl_memset
 	mov	r1, r4
-	ldr	r4, .L1248+48
+	ldr	r4, .L1274+48
 	movs	r2, #48
 	ldr	r0, [r6, #8]
 	bl	ftl_memcpy
 	ldrh	r2, [r4]
 	ldr	r0, [r6, #8]
-	ldr	r1, .L1248+52
+	ldr	r1, .L1274+52
 	lsls	r2, r2, #1
 	adds	r0, r0, #48
 	ldr	r1, [r1]
 	bl	ftl_memcpy
 	ldrh	r0, [r4]
-	ldr	r1, .L1248+56
+	ldr	r1, .L1274+56
 	ldr	r4, [r6, #8]
 	lsrs	r2, r0, #3
 	adds	r0, r0, #24
@@ -9282,13 +9322,13 @@ FtlVpcTblFlush:
 	mov	r4, r10
 	bl	ftl_memcpy
 	mov	r0, r10
-	ldr	r10, .L1248+4
+	ldr	r10, .L1274+4
 	bl	FtlUpdateVaildLpn
 	movw	r3, #65535
 	str	r3, [sp]
-	ldr	r3, .L1248+24
+	ldr	r3, .L1274+24
 	str	r3, [sp, #4]
-.L1234:
+.L1260:
 	ldr	r3, [fp]
 	ldrh	r1, [r5, #2]
 	ldrh	r2, [r5]
@@ -9297,11 +9337,11 @@ FtlVpcTblFlush:
 	str	r3, [r6, #12]
 	orr	r3, r1, r2, lsl #10
 	str	r3, [r6, #4]
-	ldr	r3, .L1248+60
+	ldr	r3, .L1274+60
 	ldrh	r3, [r3]
 	subs	r3, r3, #1
 	cmp	r1, r3
-	blt	.L1235
+	blt	.L1261
 	ldrh	r3, [r5, #4]
 	strh	r2, [r5, #4]	@ movhi
 	str	r3, [sp]
@@ -9317,7 +9357,7 @@ FtlVpcTblFlush:
 	str	r2, [r6, #4]
 	str	r3, [r7, #4]
 	strh	r0, [r7, #2]	@ movhi
-.L1235:
+.L1261:
 	ldr	r3, [sp, #4]
 	ldr	r0, [fp]
 	ldrh	r1, [r3]
@@ -9326,7 +9366,7 @@ FtlVpcTblFlush:
 	str	r0, [r7, #12]
 	mov	r2, r3
 	mov	r1, r3
-	ldr	r0, .L1248+8
+	ldr	r0, .L1274+8
 	bl	FlashProgPages
 	ldrh	r3, [r5, #2]
 	ldr	r2, [r6]
@@ -9334,51 +9374,51 @@ FtlVpcTblFlush:
 	uxth	r3, r3
 	adds	r1, r2, #1
 	strh	r3, [r5, #2]	@ movhi
-	bne	.L1236
+	bne	.L1262
 	cmp	r3, #1
-	bne	.L1237
+	bne	.L1263
 	movw	r2, #1138
-	ldr	r1, .L1248+64
-	ldr	r0, .L1248+68
+	ldr	r1, .L1274+64
+	ldr	r0, .L1274+68
 	bl	printf
-.L1237:
+.L1263:
 	ldrh	r3, [r5, #2]
 	adds	r4, r4, #1
 	uxth	r4, r4
 	cmp	r3, #1
 	itttt	eq
-	ldreq	r3, .L1248+60
+	ldreq	r3, .L1274+60
 	ldrheq	r3, [r3]
 	addeq	r3, r3, #-1
 	strheq	r3, [r5, #2]	@ movhi
 	cmp	r4, #3
-	bls	.L1234
+	bls	.L1260
 	mov	r2, r4
 	ldr	r1, [r6, #4]
-	ldr	r0, .L1248+72
+	ldr	r0, .L1274+72
 	bl	printf
-.L1240:
-	b	.L1240
-.L1236:
+.L1266:
+	b	.L1266
+.L1262:
 	cmp	r3, #1
-	beq	.L1234
+	beq	.L1260
 	cmp	r2, #256
-	beq	.L1234
+	beq	.L1260
 	ldr	r2, [sp]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L1241
+	beq	.L1267
 	movs	r1, #1
 	mov	r0, r2
 	bl	FtlFreeSysBlkQueueIn
-.L1241:
+.L1267:
 	movs	r0, #0
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1249:
+.L1275:
 	.align	2
-.L1248:
+.L1274:
 	.word	.LANCHOR139
 	.word	.LANCHOR114
 	.word	.LANCHOR138
@@ -9397,7 +9437,7 @@ FtlVpcTblFlush:
 	.word	.LANCHOR20
 	.word	.LANCHOR165
 	.word	.LC1
-	.word	.LC35
+	.word	.LC39
 	.word	.LANCHOR106
 	.word	1342177352
 	.word	.LANCHOR82
@@ -9433,17 +9473,17 @@ sftl_deinit:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, lr}
-	ldr	r3, .L1253
+	ldr	r3, .L1279
 	ldr	r3, [r3]
 	cmp	r3, #1
-	bne	.L1252
+	bne	.L1278
 	bl	FtlSysFlush
-.L1252:
+.L1278:
 	movs	r0, #0
 	pop	{r3, pc}
-.L1254:
+.L1280:
 	.align	2
-.L1253:
+.L1279:
 	.word	.LANCHOR166
 	.size	sftl_deinit, .-sftl_deinit
 	.section	.text.FtlDiscard,"ax",%progbits
@@ -9457,24 +9497,24 @@ sftl_deinit:
 FtlDiscard:
 	@ args = 0, pretend = 0, frame = 8
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L1270
+	ldr	r3, .L1296
 	adds	r2, r0, r1
 	push	{r0, r1, r4, r5, r6, r7, r8, lr}
 	mov	r7, r0
 	mov	r5, r1
 	ldr	r3, [r3]
 	cmp	r2, r3
-	bhi	.L1263
+	bhi	.L1289
 	cmp	r1, #31
-	bhi	.L1257
-.L1262:
+	bhi	.L1283
+.L1288:
 	movs	r0, #0
-.L1255:
+.L1281:
 	add	sp, sp, #8
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, pc}
-.L1257:
-	ldr	r8, .L1270+12
+.L1283:
+	ldr	r8, .L1296+12
 	ldrh	r4, [r8]
 	mov	r1, r4
 	bl	__aeabi_uidiv
@@ -9482,7 +9522,7 @@ FtlDiscard:
 	mov	r6, r0
 	subs	r7, r7, r3
 	uxth	r7, r7
-	cbz	r7, .L1258
+	cbz	r7, .L1284
 	subs	r4, r4, r7
 	adds	r6, r6, #1
 	cmp	r4, r5
@@ -9490,32 +9530,32 @@ FtlDiscard:
 	movcs	r4, r5
 	uxth	r4, r4
 	subs	r5, r5, r4
-.L1258:
-	ldr	r4, .L1270+4
+.L1284:
+	ldr	r4, .L1296+4
 	mov	r3, #-1
-	ldr	r7, .L1270+8
+	ldr	r7, .L1296+8
 	str	r3, [sp, #4]
-.L1259:
+.L1285:
 	ldrh	r3, [r8]
 	cmp	r5, r3
-	bcs	.L1261
-	ldr	r3, .L1270+4
+	bcs	.L1287
+	ldr	r3, .L1296+4
 	ldr	r2, [r3]
 	cmp	r2, #32
-	bls	.L1262
+	bls	.L1288
 	movs	r4, #0
 	str	r4, [r3]
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-	b	.L1262
-.L1261:
+	b	.L1288
+.L1287:
 	movs	r2, #0
 	mov	r1, sp
 	mov	r0, r6
 	bl	log2phys
 	ldr	r3, [sp]
 	adds	r3, r3, #1
-	beq	.L1260
+	beq	.L1286
 	ldr	r3, [r4]
 	movs	r2, #1
 	add	r1, sp, #4
@@ -9530,17 +9570,17 @@ FtlDiscard:
 	ubfx	r0, r0, #10, #16
 	bl	P2V_block_in_plane
 	bl	decrement_vpc_count
-.L1260:
+.L1286:
 	ldrh	r3, [r8]
 	adds	r6, r6, #1
 	subs	r5, r5, r3
-	b	.L1259
-.L1263:
+	b	.L1285
+.L1289:
 	mov	r0, #-1
-	b	.L1255
-.L1271:
+	b	.L1281
+.L1297:
 	.align	2
-.L1270:
+.L1296:
 	.word	.LANCHOR34
 	.word	.LANCHOR167
 	.word	.LANCHOR86
@@ -9557,47 +9597,47 @@ FtlDiscard:
 allocate_new_data_superblock:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L1282
+	ldr	r3, .L1308
 	push	{r4, r5, r6, lr}
 	mov	r6, r0
 	ldrh	r4, [r0]
 	ldrh	r3, [r3]
 	cmp	r3, r4
-	bcs	.L1273
-	movw	r2, #2760
-	ldr	r1, .L1282+4
-	ldr	r0, .L1282+8
+	bcs	.L1299
+	movw	r2, #2755
+	ldr	r1, .L1308+4
+	ldr	r0, .L1308+8
 	bl	printf
-.L1273:
+.L1299:
 	movw	r3, #65535
 	cmp	r4, r3
-	beq	.L1274
-	ldr	r3, .L1282+12
+	beq	.L1300
+	ldr	r3, .L1308+12
 	mov	r0, r4
 	ldr	r3, [r3]
 	ldrh	r3, [r3, r4, lsl #1]
-	cbz	r3, .L1275
+	cbz	r3, .L1301
 	bl	INSERT_DATA_LIST
-.L1274:
-	ldr	r5, .L1282+16
+.L1300:
+	ldr	r5, .L1308+16
 	movw	r2, #65535
 	movs	r3, #1
 	strb	r3, [r6, #8]
 	ldrh	r0, [r5]
 	cmp	r0, r2
-	beq	.L1276
+	beq	.L1302
 	cmp	r4, r0
-	bne	.L1277
-	ldr	r3, .L1282+12
+	bne	.L1303
+	ldr	r3, .L1308+12
 	ldr	r3, [r3]
 	ldrh	r3, [r3, r0, lsl #1]
-	cbz	r3, .L1278
-.L1277:
+	cbz	r3, .L1304
+.L1303:
 	bl	update_vpc_list
-.L1278:
+.L1304:
 	movw	r3, #65535
 	strh	r3, [r5]	@ movhi
-.L1276:
+.L1302:
 	mov	r0, r6
 	bl	allocate_data_superblock
 	bl	l2p_flush
@@ -9606,12 +9646,12 @@ allocate_new_data_superblock:
 	bl	FtlVpcTblFlush
 	movs	r0, #0
 	pop	{r4, r5, r6, pc}
-.L1275:
+.L1301:
 	bl	INSERT_FREE_LIST
-	b	.L1274
-.L1283:
+	b	.L1300
+.L1309:
 	.align	2
-.L1282:
+.L1308:
 	.word	.LANCHOR5
 	.word	.LANCHOR168
 	.word	.LC1
@@ -9627,125 +9667,109 @@ allocate_new_data_superblock:
 	.fpu softvfp
 	.type	FtlProgPages, %function
 FtlProgPages:
-	@ args = 0, pretend = 0, frame = 8
+	@ args = 0, pretend = 0, frame = 16
 	@ frame_needed = 0, uses_anonymous_args = 0
-	push	{r0, r1, r4, r5, r6, r7, r8, r10, fp, lr}
+	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r6, #0
-	ldr	r8, .L1298+24
-	mov	r4, r3
+	ldr	r10, .L1329+20
+	mov	r5, r3
 	movs	r2, #0
-	mov	r5, r0
+	mov	r4, r0
+	ldr	fp, .L1329
+	mov	r8, r1
 	ldrb	r3, [r3, #9]	@ zero_extendqisi2
-	mov	r10, r1
 	bl	FlashProgPages
-.L1285:
-	cmp	r6, r10
-	beq	.L1292
-	ldr	r7, .L1298
-	b	.L1293
-.L1288:
-	ldr	r0, [r5, #4]
+.L1311:
+	cmp	r6, r8
+	bne	.L1318
+	ldr	r3, .L1329
+	ldrb	r2, [r5, #6]	@ zero_extendqisi2
+	ldrh	r3, [r3]
+	cmp	r2, r3
+	bcc	.L1310
+	movw	r2, #997
+	ldr	r1, .L1329+4
+	ldr	r0, .L1329+8
+	bl	printf
+.L1310:
+	add	sp, sp, #16
+	@ sp needed
+	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
+.L1313:
+	ldr	r1, [r4, #4]
+	mov	r0, r10
+	bl	printf
+	ldr	r0, [r4, #4]
 	ubfx	r0, r0, #10, #16
 	bl	P2V_block_in_plane
-	ldrh	r3, [r4]
-	cmp	r3, r0
-	bne	.L1286
-	ldr	r1, [r8]
-	ldrh	r0, [r4, #4]
-	ldrh	r2, [r1, r3, lsl #1]
-	subs	r2, r2, r0
-	strh	r2, [r1, r3, lsl #1]	@ movhi
-	ldrh	r3, [r7]
-	strh	r3, [r4, #2]	@ movhi
-	movs	r3, #0
-	strb	r3, [r4, #6]
-	strh	r3, [r4, #4]	@ movhi
-.L1286:
-	ldrh	r3, [r4, #4]
-	cbnz	r3, .L1287
-	mov	r0, r4
+	bl	decrement_vpc_count
+	ldrh	r3, [r5, #4]
+	cbnz	r3, .L1312
+	mov	r0, r5
 	bl	allocate_new_data_superblock
-.L1287:
-	ldr	r2, .L1298+4
-	ldr	r3, [r2, #96]
-	adds	r3, r3, #1
-	str	r3, [r2, #96]
-	ldr	r0, [r5, #4]
-	ubfx	r0, r0, #10, #16
-	bl	FtlGcMarkBadPhyBlk
-	mov	r0, r4
+.L1312:
+	mov	r0, r5
 	bl	get_new_active_ppa
 	movs	r2, #0
-	str	r0, [r5, #4]
-	str	r0, [sp, #4]
+	str	r0, [r4, #4]
+	str	r0, [sp, #12]
 	movs	r1, #1
-	ldrb	r3, [r4, #9]	@ zero_extendqisi2
-	mov	r0, r5
+	ldrb	r3, [r5, #9]	@ zero_extendqisi2
+	mov	r0, r4
 	bl	FlashProgPages
-.L1293:
-	ldr	r3, [r5]
-	adds	r3, r3, #1
-	beq	.L1288
-	ldr	r3, .L1298+8
-	ldrb	r2, [r4, #6]	@ zero_extendqisi2
-	ldrh	r3, [r3]
+.L1318:
+	ldr	r2, [r4]
+	adds	r3, r2, #1
+	beq	.L1313
+	cmp	r2, #256
+	beq	.L1313
+	ldrb	r2, [r5, #6]	@ zero_extendqisi2
+	ldrh	r3, [fp]
 	cmp	r2, r3
-	bcc	.L1289
-	mov	r2, #960
-	ldr	r1, .L1298+12
-	ldr	r0, .L1298+16
+	bcc	.L1314
+	movw	r2, #982
+	ldr	r1, .L1329+4
+	ldr	r0, .L1329+8
 	bl	printf
-.L1289:
-	ldr	r3, [r5, #4]
-	add	r1, sp, #8
+.L1314:
+	ldr	r3, [r4, #4]
+	add	r1, sp, #16
 	movs	r2, #1
-	ldr	r0, [r5, #16]
+	ldr	r0, [r4, #16]
 	str	r3, [r1, #-4]!
 	bl	log2phys
-	ldr	r3, [r5, #12]
-	ldr	fp, [r3, #12]
-	ubfx	r0, fp, #10, #16
+	ldr	r3, [r4, #12]
+	ldr	r3, [r3, #12]
+	ubfx	r0, r3, #10, #16
+	str	r3, [sp, #4]
 	bl	P2V_block_in_plane
-	cmp	fp, #-1
+	ldr	r3, [sp, #4]
 	mov	r7, r0
-	beq	.L1290
-	ldr	r3, [r8]
+	adds	r3, r3, #1
+	beq	.L1315
+	ldr	r3, .L1329+12
+	ldr	r3, [r3]
 	ldrh	r2, [r3, r0, lsl #1]
-	cbnz	r2, .L1291
+	cbnz	r2, .L1316
 	mov	r1, r0
-	ldr	r0, .L1298+20
+	ldr	r0, .L1329+16
 	bl	printf
-.L1291:
+.L1316:
 	mov	r0, r7
 	bl	decrement_vpc_count
-.L1290:
+.L1315:
 	adds	r6, r6, #1
-	adds	r5, r5, #20
-	b	.L1285
-.L1292:
-	ldr	r3, .L1298+8
-	ldrb	r2, [r4, #6]	@ zero_extendqisi2
-	ldrh	r3, [r3]
-	cmp	r2, r3
-	bcc	.L1284
-	movw	r2, #975
-	ldr	r1, .L1298+12
-	ldr	r0, .L1298+16
-	bl	printf
-.L1284:
-	add	sp, sp, #8
-	@ sp needed
-	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1299:
+	adds	r4, r4, #20
+	b	.L1311
+.L1330:
 	.align	2
-.L1298:
-	.word	.LANCHOR19
-	.word	.LANCHOR135
+.L1329:
 	.word	.LANCHOR3
 	.word	.LANCHOR169
 	.word	.LC1
-	.word	.LC36
 	.word	.LANCHOR42
+	.word	.LC41
+	.word	.LC40
 	.size	FtlProgPages, .-FtlProgPages
 	.section	.text.FtlGcFreeTempBlock,"ax",%progbits
 	.align	1
@@ -9760,183 +9784,148 @@ FtlGcFreeTempBlock:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
 	movw	r3, #65535
-	ldr	r0, .L1319
-	ldr	r5, .L1319+4
-	ldrh	r6, [r0]
-	mov	r4, r0
-	cmp	r6, r3
-	beq	.L1301
-	ldr	r3, .L1319+8
+	ldr	r4, .L1346
+	ldrh	r2, [r4]
+	cmp	r2, r3
+	beq	.L1332
+	ldr	r3, .L1346+4
+	mov	r0, r4
 	ldrh	r1, [r3]
 	bl	FtlGcScanTempBlk
 	str	r0, [sp, #12]
-	adds	r0, r0, #1
-	beq	.L1301
-	ldr	r3, .L1319+12
-	ldr	r2, [r3]
-	ldrh	r3, [r2, r6, lsl #1]
-	cmp	r3, #4
-	bls	.L1302
-	subs	r3, r3, #5
-	movs	r0, #1
-	strh	r3, [r2, r6, lsl #1]	@ movhi
-	bl	FtlEctTblFlush
-.L1302:
-	ldr	r3, [r5]
-	cbnz	r3, .L1303
-	ldr	r2, .L1319+16
-	ldr	r0, [sp, #12]
-	ldr	r3, [r2, #96]
-	ubfx	r0, r0, #10, #16
-	adds	r3, r3, #1
-	str	r3, [r2, #96]
-	bl	FtlBbmMapBadBlock
-	bl	FtlBbmTblFlush
-.L1303:
-	movs	r0, #1
-	movs	r3, #0
-	str	r3, [r5]
-.L1300:
-	add	sp, sp, #16
-	@ sp needed
-	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1301:
-	ldrh	r2, [r4]
-	movs	r3, #0
-	str	r3, [r5]
+.L1332:
+	ldr	r3, .L1346+8
+	movs	r2, #0
+	str	r2, [r3]
 	movw	r3, #65535
+	ldrh	r2, [r4]
 	cmp	r2, r3
-	bne	.L1305
-.L1314:
-	movs	r0, #0
-	b	.L1300
-.L1305:
-	ldr	r6, .L1319+8
+	beq	.L1334
+	ldr	r6, .L1346+4
 	ldrb	r0, [r4, #7]	@ zero_extendqisi2
-	ldr	r5, .L1319+20
+	ldr	r5, .L1346+12
 	ldrh	r2, [r6]
 	ldrh	r1, [r5]
 	muls	r2, r0, r2
 	cmp	r1, r2
-	beq	.L1306
-	movs	r2, #162
-	ldr	r1, .L1319+24
-	ldr	r0, .L1319+28
+	beq	.L1335
+	movs	r2, #164
+	ldr	r1, .L1346+16
+	ldr	r0, .L1346+20
 	bl	printf
-.L1306:
+.L1335:
 	ldrh	r6, [r6]
 	ldrb	r3, [r4, #7]	@ zero_extendqisi2
-	ldr	r2, .L1319+32
+	ldr	r2, .L1346+24
 	ldrh	r0, [r4]
-	ldr	fp, .L1319+64
+	ldr	fp, .L1346+56
 	smulbb	r3, r3, r6
 	ldr	r1, [r2]
 	movs	r6, #0
-	str	r2, [sp, #4]
+	mov	r10, r2
 	strh	r3, [r1, r0, lsl #1]	@ movhi
-	ldr	r1, .L1319+36
+	ldr	r1, .L1346+28
 	ldrh	r3, [r5]
 	ldr	r0, [r1]
 	add	r3, r3, r0
 	str	r3, [r1]
-.L1307:
+.L1336:
 	ldrh	r2, [r5]
 	uxth	r3, r6
 	cmp	r2, r3
-	bhi	.L1311
+	bhi	.L1340
 	movw	r0, #65535
 	bl	decrement_vpc_count
-	ldr	r3, [sp, #4]
 	ldrh	r0, [r4]
-	ldr	r3, [r3]
+	ldr	r3, [r10]
 	ldrh	r3, [r3, r0, lsl #1]
 	cmp	r3, #0
-	beq	.L1312
+	beq	.L1341
 	bl	INSERT_DATA_LIST
-.L1313:
-	ldr	r3, .L1319+40
+.L1342:
+	ldr	r2, .L1346+32
+	movs	r3, #0
 	movw	r6, #65535
+	strh	r3, [r5]	@ movhi
 	strh	r6, [r4]	@ movhi
-	movs	r4, #0
-	strh	r4, [r5]	@ movhi
-	strh	r4, [r3]	@ movhi
+	strh	r3, [r2]	@ movhi
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-	ldr	r3, .L1319+44
+	ldr	r3, .L1346+36
 	strh	r6, [r3]	@ movhi
-	ldr	r3, .L1319+48
+	ldr	r3, .L1346+40
 	ldrh	r2, [r3]
-	ldr	r3, .L1319+52
+	ldr	r3, .L1346+44
 	ldrh	r3, [r3]
 	add	r3, r3, r3, lsl #1
 	cmp	r2, r3, asr #2
-	ble	.L1314
-	ldr	r3, .L1319+56
-	movs	r2, #20
-	mov	r0, r4
-	strh	r2, [r3]	@ movhi
-	b	.L1300
-.L1311:
+	ittt	gt
+	ldrgt	r3, .L1346+48
+	movgt	r2, #20
+	strhgt	r2, [r3]	@ movhi
+.L1334:
+	movs	r0, #0
+	add	sp, sp, #16
+	@ sp needed
+	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
+.L1340:
 	uxth	r3, r6
-	movs	r7, #12
+	mov	r8, #12
 	ldr	r2, [fp]
-	muls	r7, r3, r7
-	ldr	r3, .L1319+60
-	ldr	r8, [r3]
-	add	r10, r8, r7
-	ldr	r1, [r10, #8]
-	cmp	r1, r2
-	bcc	.L1308
-	movs	r2, #168
-	ldr	r1, .L1319+24
-	ldr	r0, .L1319+28
-	bl	printf
-.L1308:
+	mul	r8, r8, r3
+	ldr	r3, .L1346+52
+	ldr	r3, [r3]
+	add	r7, r3, r8
+	ldr	r0, [r7, #8]
+	cmp	r0, r2
+	bcc	.L1337
+.L1344:
+	ldrh	r0, [r4]
+	b	.L1345
+.L1337:
 	movs	r2, #0
 	add	r1, sp, #12
-	ldr	r0, [r10, #8]
+	str	r3, [sp, #4]
 	bl	log2phys
+	ldr	r3, [sp, #4]
 	ldr	r2, [sp, #12]
-	ldr	r0, [r8, r7]
+	ldr	r0, [r3, r8]
 	cmp	r0, r2
-	bne	.L1309
+	bne	.L1339
 	ubfx	r0, r0, #10, #16
 	bl	P2V_block_in_plane
 	movs	r2, #1
-	mov	r7, r0
-	add	r1, r10, #4
-	ldr	r0, [r10, #8]
+	mov	r8, r0
+	adds	r1, r7, #4
+	ldr	r0, [r7, #8]
 	bl	log2phys
-	mov	r0, r7
-.L1318:
+	mov	r0, r8
+.L1345:
 	bl	decrement_vpc_count
-.L1310:
-	adds	r6, r6, #1
-	b	.L1307
-.L1309:
-	ldr	r3, [r10, #4]
+	b	.L1338
+.L1339:
+	ldr	r3, [r7, #4]
 	cmp	r2, r3
-	beq	.L1310
-	ldrh	r0, [r4]
-	b	.L1318
-.L1312:
+	bne	.L1344
+.L1338:
+	adds	r6, r6, #1
+	b	.L1336
+.L1341:
 	bl	INSERT_FREE_LIST
-	b	.L1313
-.L1320:
+	b	.L1342
+.L1347:
 	.align	2
-.L1319:
+.L1346:
 	.word	.LANCHOR53
-	.word	.LANCHOR133
 	.word	.LANCHOR19
-	.word	.LANCHOR43
-	.word	.LANCHOR135
+	.word	.LANCHOR133
 	.word	.LANCHOR70
 	.word	.LANCHOR170
 	.word	.LC1
 	.word	.LANCHOR42
 	.word	.LANCHOR84
 	.word	.LANCHOR69
-	.word	.LANCHOR144
+	.word	.LANCHOR145
 	.word	.LANCHOR48
 	.word	.LANCHOR171
 	.word	.LANCHOR100
@@ -9955,27 +9944,27 @@ FtlGcPageRecovery:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
-	ldr	r4, .L1323
-	ldr	r5, .L1323+4
+	ldr	r4, .L1350
+	ldr	r5, .L1350+4
 	ldrh	r1, [r4]
 	mov	r0, r5
 	bl	FtlGcScanTempBlk
 	ldrh	r2, [r5, #2]
 	ldrh	r3, [r4]
 	cmp	r2, r3
-	bcc	.L1321
-	ldr	r0, .L1323+8
+	bcc	.L1348
+	ldr	r0, .L1350+8
 	bl	FtlMapBlkWriteDump_data
 	movs	r0, #0
 	bl	FtlGcFreeTempBlock
-	ldr	r3, .L1323+12
+	ldr	r3, .L1350+12
 	movs	r2, #0
 	str	r2, [r3]
-.L1321:
+.L1348:
 	pop	{r3, r4, r5, pc}
-.L1324:
+.L1351:
 	.align	2
-.L1323:
+.L1350:
 	.word	.LANCHOR19
 	.word	.LANCHOR53
 	.word	.LANCHOR129
@@ -9994,13 +9983,13 @@ FtlPowerLostRecovery:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	movs	r4, #0
-	ldr	r5, .L1326
-	ldr	r3, .L1326+4
+	ldr	r5, .L1353
+	ldr	r3, .L1353+4
 	mov	r0, r5
 	str	r4, [r3]
 	bl	FtlRecoverySuperblock
 	mov	r0, r5
-	ldr	r5, .L1326+8
+	ldr	r5, .L1353+8
 	bl	FtlSlcSuperblockCheck
 	mov	r0, r5
 	bl	FtlRecoverySuperblock
@@ -10011,9 +10000,9 @@ FtlPowerLostRecovery:
 	bl	decrement_vpc_count
 	mov	r0, r4
 	pop	{r3, r4, r5, pc}
-.L1327:
+.L1354:
 	.align	2
-.L1326:
+.L1353:
 	.word	.LANCHOR51
 	.word	.LANCHOR157
 	.word	.LANCHOR52
@@ -10031,72 +10020,51 @@ Ftl_gc_temp_data_write_back:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, r6, r7, lr}
 	movs	r3, #0
-	ldr	r4, .L1335
+	ldr	r4, .L1363
 	movs	r6, #0
 	movs	r7, #20
 	mov	r2, r3
-	ldr	r5, .L1335+4
+	ldr	r5, .L1363+4
 	ldr	r1, [r4]
 	ldr	r0, [r5]
 	bl	FlashProgPages
-.L1329:
+.L1356:
 	ldr	r1, [r4]
 	uxth	r3, r6
 	cmp	r1, r3
-	bhi	.L1332
+	bhi	.L1359
 	ldr	r0, [r5]
 	bl	FtlGcBufFree
-	ldr	r3, .L1335+8
+	ldr	r3, .L1363+8
 	movs	r0, #0
 	str	r0, [r4]
 	ldrh	r3, [r3, #4]
-	cbnz	r3, .L1328
+	cbnz	r3, .L1355
 	movs	r0, #1
 	bl	FtlGcFreeTempBlock
-	b	.L1334
-.L1332:
+	movs	r0, #1
+.L1355:
+	pop	{r3, r4, r5, r6, r7, pc}
+.L1359:
 	muls	r3, r7, r3
 	ldr	r2, [r5]
 	adds	r6, r6, #1
 	adds	r1, r2, r3
 	ldr	r2, [r2, r3]
-	adds	r3, r2, #1
-	bne	.L1330
-	ldr	r3, .L1335+8
-	movs	r5, #0
-	ldr	r0, .L1335+12
-	ldrh	r4, [r3]
-	ldr	r0, [r0]
-	strh	r5, [r0, r4, lsl #1]	@ movhi
-	strh	r2, [r3]	@ movhi
-	ldr	r2, .L1335+16
-	ldr	r0, [r1, #4]
-	ldr	r3, [r2, #96]
-	ubfx	r0, r0, #10, #16
-	adds	r3, r3, #1
-	str	r3, [r2, #96]
-	bl	FtlBbmMapBadBlock
-	bl	FtlBbmTblFlush
-	bl	FtlGcPageVarInit
-.L1334:
-	movs	r0, #1
-.L1328:
-	pop	{r3, r4, r5, r6, r7, pc}
-.L1330:
-	ldr	r3, [r1, #12]
+	ldr	r0, [r1, #12]
 	ldr	r1, [r1, #4]
-	ldr	r2, [r3, #8]
-	ldr	r0, [r3, #12]
+	adds	r3, r2, #1
+	it	ne
+	ldrne	r2, [r0, #8]
+	ldr	r0, [r0, #12]
 	bl	FtlGcUpdatePage
-	b	.L1329
-.L1336:
+	b	.L1356
+.L1364:
 	.align	2
-.L1335:
+.L1363:
 	.word	.LANCHOR62
 	.word	.LANCHOR104
 	.word	.LANCHOR53
-	.word	.LANCHOR42
-	.word	.LANCHOR135
 	.size	Ftl_gc_temp_data_write_back, .-Ftl_gc_temp_data_write_back
 	.section	.text.Ftl_get_new_temp_ppa,"ax",%progbits
 	.align	1
@@ -10111,34 +10079,34 @@ Ftl_get_new_temp_ppa:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, lr}
 	movw	r3, #65535
-	ldr	r4, .L1340
+	ldr	r4, .L1368
 	ldrh	r2, [r4]
 	cmp	r2, r3
-	beq	.L1338
+	beq	.L1366
 	ldrh	r3, [r4, #4]
-	cbnz	r3, .L1339
-.L1338:
+	cbnz	r3, .L1367
+.L1366:
 	movs	r0, #0
 	movs	r5, #0
 	bl	FtlGcFreeTempBlock
-	ldr	r0, .L1340
+	ldr	r0, .L1368
 	strb	r5, [r4, #8]
 	bl	allocate_data_superblock
-	ldr	r3, .L1340+4
+	ldr	r3, .L1368+4
 	strh	r5, [r3]	@ movhi
-	ldr	r3, .L1340+8
+	ldr	r3, .L1368+8
 	strh	r5, [r3]	@ movhi
 	bl	l2p_flush
 	mov	r0, r5
 	bl	FtlEctTblFlush
 	bl	FtlVpcTblFlush
-.L1339:
-	ldr	r0, .L1340
+.L1367:
+	ldr	r0, .L1368
 	pop	{r3, r4, r5, lr}
 	b	get_new_active_ppa
-.L1341:
+.L1369:
 	.align	2
-.L1340:
+.L1368:
 	.word	.LANCHOR53
 	.word	.LANCHOR69
 	.word	.LANCHOR70
@@ -10154,184 +10122,188 @@ Ftl_get_new_temp_ppa:
 rk_ftl_garbage_collect:
 	@ args = 0, pretend = 0, frame = 40
 	@ frame_needed = 0, uses_anonymous_args = 0
-	ldr	r3, .L1424
+	ldr	r3, .L1460
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
-	sub	sp, sp, #40
-	str	r0, [sp, #20]
+	sub	sp, sp, #48
+	str	r0, [sp, #28]
 	ldr	r0, [r3]
 	cmp	r0, #0
-	bne	.L1394
-	ldr	r3, .L1424+4
+	bne	.L1427
+	ldr	r3, .L1460+4
 	ldrh	r3, [r3]
 	cmp	r3, #47
-	bls	.L1342
-	ldr	r3, .L1424+8
+	bls	.L1370
+	ldr	r3, .L1460+8
 	movw	r4, #65535
 	ldrh	r0, [r3]
 	cmp	r0, r4
-	beq	.L1344
-	ldr	r1, .L1424+12
+	beq	.L1372
+	ldr	r1, .L1460+12
 	ldrh	r2, [r1]
 	cmp	r2, r4
 	itt	eq
 	strheq	r0, [r1]	@ movhi
 	strheq	r2, [r3]	@ movhi
-.L1344:
-	ldr	r3, [sp, #20]
+.L1372:
+	ldr	r3, [sp, #28]
 	cmp	r3, #0
-	bne	.L1396
-	ldr	r3, .L1424+16
+	bne	.L1429
+	ldr	r3, .L1460+16
 	ldrh	r3, [r3]
 	cmp	r3, #24
-	bhi	.L1397
-	ldr	r2, .L1424+20
+	bhi	.L1430
+	ldr	r2, .L1460+20
 	cmp	r3, #16
 	ldrh	r4, [r2]
-	bls	.L1347
+	bls	.L1375
 	lsrs	r4, r4, #5
-.L1346:
-	ldr	r2, .L1424+24
+.L1374:
+	ldr	r2, .L1460+24
 	ldrh	r1, [r2]
 	cmp	r1, r3
 	mov	r1, r2
-	bcs	.L1350
-	ldr	r3, .L1424+28
+	bcs	.L1378
+	ldr	r3, .L1460+28
 	movw	r0, #65535
 	ldrh	r3, [r3]
 	cmp	r3, r0
-	bne	.L1351
-	ldr	r0, .L1424+12
+	bne	.L1379
+	ldr	r0, .L1460+12
 	ldrh	r0, [r0]
 	cmp	r0, r3
-	bne	.L1351
-	ldr	r3, .L1424+32
+	bne	.L1379
+	ldr	r3, .L1460+32
 	ldrh	r0, [r3]
-	cbnz	r0, .L1352
-	ldr	r3, .L1424+36
-	ldr	r4, .L1424+40
+	cbnz	r0, .L1380
+	ldr	r3, .L1460+36
+	ldr	r4, .L1460+40
 	ldr	r3, [r3]
 	ldr	r4, [r4]
 	add	r3, r3, r3, lsl #1
 	cmp	r4, r3, lsr #2
-	bcs	.L1353
-.L1352:
-	ldr	r3, .L1424+44
+	bcs	.L1381
+.L1380:
+	ldr	r3, .L1460+44
 	ldrh	r3, [r3]
 	add	r3, r3, r3, lsl #1
 	asrs	r3, r3, #2
 	strh	r3, [r1]	@ movhi
-.L1354:
-	ldr	r3, .L1424+48
+.L1382:
+	ldr	r3, .L1460+48
 	movs	r2, #0
 	str	r2, [r3]
-.L1342:
-	add	sp, sp, #40
+.L1370:
+	add	sp, sp, #48
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1347:
+.L1375:
 	cmp	r3, #12
-	bls	.L1348
+	bls	.L1376
 	lsrs	r4, r4, #4
-	b	.L1346
-.L1348:
+	b	.L1374
+.L1376:
 	cmp	r3, #8
-	bls	.L1346
+	bls	.L1374
 	lsrs	r4, r4, #2
-	b	.L1346
-.L1397:
+	b	.L1374
+.L1430:
 	movs	r4, #1
-	b	.L1346
-.L1353:
+	b	.L1374
+.L1381:
 	movs	r3, #18
 	strh	r3, [r2]	@ movhi
-	b	.L1354
-.L1351:
-	ldr	r3, .L1424+44
+	b	.L1382
+.L1379:
+	ldr	r3, .L1460+44
 	ldrh	r3, [r3]
 	add	r3, r3, r3, lsl #1
 	asrs	r3, r3, #2
 	strh	r3, [r1]	@ movhi
-.L1350:
-	ldr	r3, .L1424+52
+.L1378:
+	ldr	r3, .L1460+52
 	ldrh	r3, [r3]
-	cbz	r3, .L1345
+	cbz	r3, .L1373
 	adds	r4, r4, #32
 	uxth	r4, r4
-.L1345:
-	ldr	r5, .L1424+56
+.L1373:
+	ldr	r5, .L1460+56
 	movw	r3, #65535
 	ldrh	r2, [r5]
 	cmp	r2, r3
-	bne	.L1357
-	ldr	r3, .L1424+12
+	bne	.L1385
+	ldr	r3, .L1460+12
 	ldrh	r1, [r3]
 	cmp	r1, r2
-	beq	.L1358
-	ldr	r0, .L1424+60
+	beq	.L1386
+	ldr	r0, .L1460+60
 	ldr	r0, [r0]
 	ldrh	r1, [r0, r1, lsl #1]
-	cbnz	r1, .L1359
+	cbnz	r1, .L1387
 	strh	r2, [r3]	@ movhi
-.L1359:
+.L1387:
 	ldrh	r2, [r3]
 	strh	r2, [r5]	@ movhi
 	movw	r2, #65535
 	strh	r2, [r3]	@ movhi
-.L1358:
+.L1386:
 	ldrh	r0, [r5]
 	movw	r6, #65535
 	movs	r3, #0
 	strb	r3, [r5, #8]
 	cmp	r0, r6
-	beq	.L1357
+	beq	.L1385
 	bl	IsBlkInGcList
-	cbz	r0, .L1361
+	cbz	r0, .L1389
 	strh	r6, [r5]	@ movhi
-.L1361:
+.L1389:
 	ldrh	r2, [r5]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L1357
-	ldr	r0, .L1424+56
+	beq	.L1385
+	ldr	r0, .L1460+56
 	bl	make_superblock
-	ldr	r2, .L1424+64
+	ldr	r2, .L1460+64
 	movs	r3, #0
 	strh	r3, [r5, #2]	@ movhi
 	strb	r3, [r5, #6]
 	strh	r3, [r2]	@ movhi
-	ldr	r3, .L1424+60
+	ldr	r3, .L1460+60
 	ldrh	r2, [r5]
 	ldr	r3, [r3]
 	ldrh	r2, [r3, r2, lsl #1]
-	ldr	r3, .L1424+68
+	ldr	r3, .L1460+68
 	strh	r2, [r3]	@ movhi
-.L1357:
-	ldr	r2, .L1424+72
+.L1385:
+	ldr	r2, .L1460+72
 	ldrh	r3, [r5]
 	ldrh	r2, [r2]
 	cmp	r2, r3
-	beq	.L1362
-	ldr	r2, .L1424+76
+	beq	.L1390
+	ldr	r2, .L1460+76
 	ldrh	r2, [r2]
 	cmp	r2, r3
-	bne	.L1363
-.L1362:
+	beq	.L1390
+	ldr	r2, .L1460+28
+	ldrh	r2, [r2]
+	cmp	r2, r3
+	bne	.L1391
+.L1390:
 	movw	r3, #65535
 	strh	r3, [r5]	@ movhi
-.L1363:
-	ldr	r5, .L1424+56
+.L1391:
+	ldr	r5, .L1460+56
 	mov	r6, r5
-.L1393:
+.L1426:
 	ldrh	r2, [r5]
 	movw	r3, #65535
 	cmp	r2, r3
-	bne	.L1364
-	ldr	fp, .L1424+88
+	bne	.L1392
+	ldr	fp, .L1460+88
 	movs	r2, #0
-	ldr	r3, .L1424+48
+	ldr	r3, .L1460+48
 	mov	r8, fp
 	str	r2, [r3]
-.L1365:
+.L1393:
 	ldrh	r7, [fp]
 	mov	r0, r7
 	bl	List_get_gc_head_node
@@ -10339,78 +10311,78 @@ rk_ftl_garbage_collect:
 	movw	r1, #65535
 	cmp	r3, r1
 	strh	r3, [r6]	@ movhi
-	bne	.L1366
+	bne	.L1394
 	movs	r3, #0
 	movs	r0, #8
 	strh	r3, [fp]	@ movhi
-	b	.L1342
-.L1396:
+	b	.L1370
+.L1429:
 	movs	r4, #1
-	b	.L1345
-.L1366:
-	str	r0, [sp, #8]
+	b	.L1373
+.L1394:
+	str	r0, [sp, #16]
 	mov	r0, r3
-	str	r3, [sp, #4]
+	str	r3, [sp, #12]
 	adds	r7, r7, #1
 	bl	IsBlkInGcList
-	ldr	r3, [sp, #4]
-	ldr	r2, [sp, #8]
-	cbz	r0, .L1367
+	ldr	r3, [sp, #12]
+	ldr	r2, [sp, #16]
+	cbz	r0, .L1395
 	strh	r7, [fp]	@ movhi
-	b	.L1365
-.L1367:
+	b	.L1393
+.L1395:
 	uxth	r0, r2
-	ldr	r2, .L1424+20
-	ldr	r10, .L1424+60
+	ldr	r2, .L1460+20
+	ldr	r10, .L1460+60
 	uxth	r7, r7
 	ldrh	lr, [r2]
-	ldr	r2, .L1424+80
+	ldr	r2, .L1460+80
 	ldr	r1, [r10]
 	strh	r7, [fp]	@ movhi
 	ldrh	r2, [r2]
 	ldrh	ip, [r1, r0, lsl #1]
 	mul	r2, r2, lr
 	cmp	ip, r2, asr #1
-	bgt	.L1369
+	bgt	.L1397
 	cmp	r7, #48
-	bls	.L1370
+	bls	.L1398
 	cmp	ip, #8
-	bls	.L1370
-	ldr	r7, .L1424+84
+	bls	.L1398
+	ldr	r7, .L1460+84
 	ldrh	r7, [r7]
 	cmp	r7, #35
-	bhi	.L1370
-.L1369:
+	bhi	.L1398
+.L1397:
 	movs	r7, #0
 	strh	r7, [r8]	@ movhi
-.L1370:
+.L1398:
 	ldrh	r1, [r1, r0, lsl #1]
 	cmp	r2, r1
-	bgt	.L1371
+	bgt	.L1399
 	ldrh	r2, [r8]
 	cmp	r2, #3
-	bhi	.L1371
+	bhi	.L1399
 	movw	r3, #65535
 	strh	r3, [r6]	@ movhi
 	movs	r3, #0
 	strh	r3, [r8]	@ movhi
-.L1423:
-	ldr	r3, .L1424+32
+.L1459:
+	ldr	r3, .L1460+32
 	ldrh	r0, [r3]
-	b	.L1342
-.L1371:
-	cbnz	r1, .L1372
+	b	.L1370
+.L1399:
+	cbnz	r1, .L1400
 	movw	r0, #65535
 	bl	decrement_vpc_count
 	ldrh	r3, [r8]
 	adds	r3, r3, #1
 	strh	r3, [r8]	@ movhi
-	b	.L1365
-.L1425:
+	b	.L1393
+.L1461:
 	.align	2
-.L1424:
+.L1460:
 	.word	.LANCHOR94
-	.word	.LANCHOR45
+	.word	.LANCHOR44
 	.word	.LANCHOR73
 	.word	.LANCHOR72
 	.word	.LANCHOR48
@@ -10423,7 +10395,7 @@ rk_ftl_garbage_collect:
 	.word	.LANCHOR171
 	.word	.LANCHOR95
 	.word	.LANCHOR74
-	.word	.LANCHOR144
+	.word	.LANCHOR145
 	.word	.LANCHOR42
 	.word	.LANCHOR173
 	.word	.LANCHOR174
@@ -10432,65 +10404,65 @@ rk_ftl_garbage_collect:
 	.word	.LANCHOR3
 	.word	.LANCHOR69
 	.word	.LANCHOR102
-.L1372:
+.L1400:
 	movs	r2, #0
 	strb	r2, [r6, #8]
-	ldr	r2, .L1426
+	ldr	r2, .L1462
 	ldrh	r2, [r2]
 	cmp	r2, r3
-	bne	.L1373
-	mov	r2, #700
-	ldr	r1, .L1426+4
-	ldr	r0, .L1426+8
+	bne	.L1401
+	movw	r2, #717
+	ldr	r1, .L1462+4
+	ldr	r0, .L1462+8
 	bl	printf
-.L1373:
-	ldr	r3, .L1426+12
+.L1401:
+	ldr	r3, .L1462+12
 	ldrh	r2, [r6]
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bne	.L1374
-	movw	r2, #701
-	ldr	r1, .L1426+4
-	ldr	r0, .L1426+8
+	bne	.L1402
+	movw	r2, #718
+	ldr	r1, .L1462+4
+	ldr	r0, .L1462+8
 	bl	printf
-.L1374:
-	ldr	r3, .L1426+16
+.L1402:
+	ldr	r3, .L1462+16
 	ldrh	r2, [r6]
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bne	.L1375
-	movw	r2, #702
-	ldr	r1, .L1426+4
-	ldr	r0, .L1426+8
+	bne	.L1403
+	movw	r2, #719
+	ldr	r1, .L1462+4
+	ldr	r0, .L1462+8
 	bl	printf
-.L1375:
+.L1403:
 	mov	r0, r5
 	bl	make_superblock
-	ldr	r2, .L1426+20
+	ldr	r2, .L1462+20
 	movs	r3, #0
 	ldrh	r1, [r6]
 	strh	r3, [r2]	@ movhi
 	ldr	r2, [r10]
 	ldrh	r1, [r2, r1, lsl #1]
-	ldr	r2, .L1426+24
+	ldr	r2, .L1462+24
 	strh	r3, [r6, #2]	@ movhi
 	strb	r3, [r6, #6]
 	strh	r1, [r2]	@ movhi
-.L1364:
-	ldr	r3, .L1426+28
+.L1392:
+	ldr	r3, .L1462+28
 	movs	r2, #1
 	str	r2, [r3]
-	ldr	r3, .L1426+32
+	ldr	r3, .L1462+32
 	ldrh	r3, [r3]
-	str	r3, [sp, #12]
-	ldr	r3, [sp, #20]
-	cbz	r3, .L1376
-	ldr	r3, .L1426+36
-	ldr	r2, [sp, #12]
+	str	r3, [sp, #16]
+	ldr	r3, [sp, #28]
+	cbz	r3, .L1404
+	ldr	r3, .L1462+36
+	ldr	r2, [sp, #16]
 	ldrh	r1, [r6]
 	ldrh	r3, [r3]
 	muls	r3, r2, r3
-	ldr	r2, .L1426+40
+	ldr	r2, .L1462+40
 	ldr	r2, [r2]
 	ldrh	r2, [r2, r1, lsl #1]
 	subs	r3, r3, r2
@@ -10498,10 +10470,10 @@ rk_ftl_garbage_collect:
 	addmi	r3, r3, #3
 	add	r4, r4, r3, asr #2
 	uxth	r4, r4
-.L1376:
+.L1404:
 	ldrh	r3, [r6, #2]
-	ldr	r1, [sp, #12]
-	ldr	fp, .L1426+64
+	ldr	r1, [sp, #16]
+	ldr	fp, .L1462+64
 	adds	r2, r3, r4
 	cmp	r2, r1
 	itt	gt
@@ -10510,94 +10482,94 @@ rk_ftl_garbage_collect:
 	mov	r3, #0
 	it	gt
 	uxthgt	r4, r4
-	str	r3, [sp, #8]
-.L1379:
-	ldrh	r3, [sp, #8]
+	str	r3, [sp, #24]
+.L1407:
+	ldrh	r3, [sp, #24]
 	cmp	r4, r3
-	bls	.L1387
-	ldr	r3, .L1426+36
+	bls	.L1415
+	ldr	r3, .L1462+36
 	movw	r10, #65535
 	ldrh	r1, [r5, #2]
 	mov	ip, #20
 	ldr	r0, [fp]
 	ldrh	lr, [r3]
-	ldr	r3, [sp, #8]
-	ldr	r7, .L1426+44
+	ldr	r3, [sp, #24]
+	ldr	r7, .L1462+44
 	adds	r3, r1, r3
-	str	r3, [sp, #16]
+	str	r3, [sp, #20]
 	movs	r3, #0
-	str	r3, [sp, #4]
-	b	.L1388
-.L1381:
+	str	r3, [sp, #12]
+	b	.L1416
+.L1409:
 	ldrh	r2, [r7, #2]!
 	cmp	r2, r10
-	beq	.L1380
-	ldr	r1, [sp, #4]
+	beq	.L1408
+	ldr	r1, [sp, #12]
 	mla	r8, ip, r1, r0
-	ldr	r1, [sp, #16]
+	ldr	r1, [sp, #20]
 	orr	r2, r1, r2, lsl #10
 	str	r2, [r8, #4]
-	ldr	r2, [sp, #4]
+	ldr	r2, [sp, #12]
 	adds	r2, r2, #1
 	uxth	r2, r2
-	str	r2, [sp, #4]
-.L1380:
+	str	r2, [sp, #12]
+.L1408:
 	adds	r3, r3, #1
-.L1388:
+.L1416:
 	uxth	r2, r3
 	cmp	lr, r2
-	bhi	.L1381
+	bhi	.L1409
 	ldrb	r2, [r5, #8]	@ zero_extendqisi2
-	ldr	r1, [sp, #4]
+	ldr	r1, [sp, #12]
 	bl	FlashReadPages
 	movs	r3, #0
-.L1422:
-	str	r3, [sp, #16]
-	ldr	r2, [sp, #4]
-	ldrh	r3, [sp, #16]
+.L1458:
+	str	r3, [sp, #20]
+	ldr	r2, [sp, #12]
+	ldrh	r3, [sp, #20]
 	cmp	r2, r3
-	bhi	.L1386
-	ldr	r3, [sp, #8]
+	bhi	.L1414
+	ldr	r3, [sp, #24]
 	adds	r3, r3, #1
-	str	r3, [sp, #8]
-	b	.L1379
-.L1386:
-	ldr	r3, [sp, #16]
+	str	r3, [sp, #24]
+	b	.L1407
+.L1414:
+	ldr	r3, [sp, #20]
 	movs	r7, #20
 	muls	r7, r3, r7
 	ldr	r3, [fp]
 	adds	r2, r3, r7
 	ldr	r3, [r3, r7]
 	adds	r3, r3, #1
-	beq	.L1383
+	beq	.L1411
 	ldr	r8, [r2, #12]
 	movw	r3, #61589
 	ldrh	r2, [r8]
 	cmp	r2, r3
-	bne	.L1383
+	bne	.L1411
 	ldr	r10, [r8, #8]
 	cmp	r10, #-1
-	bne	.L1384
-	mov	r2, #736
-	ldr	r1, .L1426+4
-	ldr	r0, .L1426+8
+	bne	.L1412
+	movw	r2, #753
+	ldr	r1, .L1462+4
+	ldr	r0, .L1462+8
 	bl	printf
-.L1384:
+.L1412:
 	movs	r2, #0
-	add	r1, sp, #36
+	add	r1, sp, #40
 	mov	r0, r10
 	bl	log2phys
 	ldr	r0, [fp]
-	ldr	r3, [sp, #36]
+	ldr	r3, [sp, #40]
 	add	r0, r0, r7
 	ldr	r2, [r0, #4]
 	cmp	r2, r3
-	bne	.L1383
-	ldr	r2, .L1426+20
-	ldr	r10, .L1426+56
-	ldr	r1, .L1426+48
+	bne	.L1411
+	ldr	r2, .L1462+20
+	ldr	r10, .L1462+60
+	ldr	r1, .L1462+48
 	ldrh	r3, [r2]
-	str	r1, [sp, #28]
+	str	r1, [sp, #36]
 	adds	r3, r3, #1
 	strh	r3, [r2]	@ movhi
 	ldr	r2, [r1]
@@ -10606,10 +10578,10 @@ rk_ftl_garbage_collect:
 	mla	r3, r1, r3, r2
 	ldr	r2, [r0, #16]
 	str	r2, [r3, #16]
-	str	r3, [sp, #24]
+	str	r3, [sp, #32]
 	bl	Ftl_get_new_temp_ppa
-	ldr	r3, [sp, #24]
-	ldr	r1, [sp, #28]
+	ldr	r3, [sp, #32]
+	ldr	r1, [sp, #36]
 	str	r0, [r3, #4]
 	ldr	r2, [r1]
 	movs	r1, #20
@@ -10617,18 +10589,18 @@ rk_ftl_garbage_collect:
 	ldr	r0, [fp]
 	mla	r2, r1, r3, r2
 	add	r0, r0, r7
-	ldr	r7, .L1426+16
+	ldr	r7, .L1462+16
 	ldr	r1, [r0, #8]
 	adds	r3, r3, #1
 	str	r1, [r2, #8]
 	ldr	r1, [r0, #12]
 	str	r1, [r2, #12]
 	movs	r1, #1
-	ldr	r2, [sp, #36]
+	ldr	r2, [sp, #40]
 	str	r2, [r8, #12]
 	ldrh	r2, [r7]
 	strh	r2, [r8, #2]	@ movhi
-	ldr	r2, .L1426+52
+	ldr	r2, .L1462+52
 	str	r3, [r10]
 	ldr	r2, [r2]
 	str	r2, [r8, #4]
@@ -10636,90 +10608,148 @@ rk_ftl_garbage_collect:
 	ldrb	r2, [r7, #7]	@ zero_extendqisi2
 	ldr	r3, [r10]
 	cmp	r2, r3
-	beq	.L1385
+	beq	.L1413
 	ldrh	r3, [r7, #4]
-	cbnz	r3, .L1383
-.L1385:
+	cbnz	r3, .L1411
+.L1413:
 	bl	Ftl_gc_temp_data_write_back
-	cbz	r0, .L1383
-	ldr	r3, .L1426+28
+	cbz	r0, .L1411
+	ldr	r3, .L1462+28
 	movs	r2, #0
+	movw	r1, #65535
 	str	r2, [r3]
-	b	.L1423
-.L1383:
-	ldr	r3, [sp, #16]
+	ldr	r3, .L1462+56
+	strh	r1, [r3]	@ movhi
+	strh	r2, [r3, #2]	@ movhi
+	b	.L1459
+.L1411:
+	ldr	r3, [sp, #20]
 	adds	r3, r3, #1
-	b	.L1422
-.L1387:
+	b	.L1458
+.L1415:
 	ldrh	r3, [r5, #2]
 	add	r4, r4, r3
-	ldr	r3, [sp, #12]
+	ldr	r3, [sp, #16]
 	uxth	r4, r4
 	cmp	r3, r4
 	strh	r4, [r5, #2]	@ movhi
-	ldr	r4, .L1426+28
-	bhi	.L1389
-	ldr	r3, .L1426+56
+	bhi	.L1417
+	ldr	r3, .L1462+60
 	ldr	r3, [r3]
-	cbz	r3, .L1390
+	cbz	r3, .L1418
 	bl	Ftl_gc_temp_data_write_back
-	cbz	r0, .L1390
-	movs	r3, #0
-	str	r3, [r4]
-	b	.L1423
-.L1390:
-	ldr	r3, .L1426+20
-	ldrh	r1, [r3]
-	cbnz	r1, .L1391
-	ldr	r3, .L1426+40
+	cbz	r0, .L1418
+	ldr	r3, .L1462+28
+	movs	r2, #0
+	str	r2, [r3]
+	b	.L1459
+.L1463:
+	.align	2
+.L1462:
+	.word	.LANCHOR51
+	.word	.LANCHOR175
+	.word	.LC1
+	.word	.LANCHOR52
+	.word	.LANCHOR53
+	.word	.LANCHOR173
+	.word	.LANCHOR174
+	.word	.LANCHOR94
+	.word	.LANCHOR19
+	.word	.LANCHOR3
+	.word	.LANCHOR42
+	.word	.LANCHOR145+14
+	.word	.LANCHOR104
+	.word	.LANCHOR83
+	.word	.LANCHOR145
+	.word	.LANCHOR62
+	.word	.LANCHOR66
+.L1418:
+	ldr	r3, .L1464
+	ldrh	r4, [r3]
+	cmp	r4, #0
+	bne	.L1419
+	ldr	r8, .L1464+28
+	ldrh	r1, [r5]
+	ldr	r3, [r8]
+	ldrh	r3, [r3, r1, lsl #1]
+	cmp	r3, #0
+	beq	.L1419
+	ldr	r0, .L1464+4
+	ldr	r10, .L1464+32
+	ldrh	r2, [r5, #2]
+	ldrh	r0, [r0]
+	str	r3, [sp]
+	mov	r3, r4
+	str	r0, [sp, #4]
+	ldr	r0, .L1464+8
+	bl	printf
+.L1420:
+	ldr	r3, [r10]
+	cmp	r4, r3
+	bcs	.L1422
+	movs	r2, #0
+	add	r1, sp, #44
+	mov	r0, r4
+	bl	log2phys
+	ldr	r7, [sp, #44]
+	adds	r3, r7, #1
+	beq	.L1421
+	ubfx	r0, r7, #10, #16
+	bl	P2V_block_in_plane
+	ldrh	r3, [r5]
+	cmp	r3, r0
+	bne	.L1421
+	mov	r2, r7
+	mov	r1, r4
+	ldr	r0, .L1464+12
+	bl	printf
+.L1422:
+	ldr	r3, [r10]
+	cmp	r4, r3
+	bcc	.L1419
 	ldrh	r2, [r5]
-	ldr	r3, [r3]
-	ldrh	r0, [r3, r2, lsl #1]
-	cbz	r0, .L1391
+	movs	r1, #0
+	ldr	r3, [r8]
 	strh	r1, [r3, r2, lsl #1]	@ movhi
 	ldrh	r0, [r5]
 	bl	update_vpc_list
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-.L1391:
+.L1419:
 	movw	r3, #65535
 	strh	r3, [r5]	@ movhi
-.L1389:
-	movs	r3, #0
-	str	r3, [r4]
-	ldr	r3, .L1426+60
+.L1417:
+	ldr	r3, .L1464+16
+	movs	r2, #0
+	str	r2, [r3]
+	ldr	r3, .L1464+20
 	ldrh	r0, [r3]
 	cmp	r0, #2
-	bhi	.L1392
-	ldr	r3, .L1426+32
+	bhi	.L1425
+	ldr	r3, .L1464+24
 	ldrh	r4, [r3]
-	b	.L1393
-.L1392:
+	b	.L1426
+.L1421:
+	adds	r4, r4, #1
+	b	.L1420
+.L1425:
 	adds	r0, r0, #1
-	b	.L1342
-.L1394:
-	movs	r0, #0
-	b	.L1342
+	b	.L1370
 .L1427:
+	movs	r0, #0
+	b	.L1370
+.L1465:
 	.align	2
-.L1426:
-	.word	.LANCHOR51
-	.word	.LANCHOR175
-	.word	.LC1
-	.word	.LANCHOR52
-	.word	.LANCHOR53
+.L1464:
 	.word	.LANCHOR173
 	.word	.LANCHOR174
+	.word	.LC42
+	.word	.LC43
 	.word	.LANCHOR94
+	.word	.LANCHOR48
 	.word	.LANCHOR19
-	.word	.LANCHOR3
 	.word	.LANCHOR42
-	.word	.LANCHOR144+14
-	.word	.LANCHOR104
-	.word	.LANCHOR83
-	.word	.LANCHOR62
-	.word	.LANCHOR48
-	.word	.LANCHOR66
+	.word	.LANCHOR152
 	.size	rk_ftl_garbage_collect, .-rk_ftl_garbage_collect
 	.section	.text.FtlRead,"ax",%progbits
 	.align	1
@@ -10738,31 +10768,31 @@ FtlRead:
 	mov	r6, r1
 	mov	r8, r3
 	str	r2, [sp, #24]
-	bne	.L1429
+	bne	.L1467
 	mov	r2, r3
 	ldr	r1, [sp, #24]
 	add	r0, r6, #256
 	bl	FtlVendorPartRead
 	str	r0, [sp, #4]
-.L1428:
+.L1466:
 	ldr	r0, [sp, #4]
 	add	sp, sp, #56
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1429:
+.L1467:
 	ldr	r3, [sp, #24]
 	adds	r3, r1, r3
 	str	r3, [sp, #12]
-	ldr	r3, .L1461
+	ldr	r3, .L1499
 	ldr	r2, [sp, #12]
 	ldr	r3, [r3]
 	cmp	r2, r3
-	bhi	.L1450
-	ldr	r3, .L1461+4
+	bhi	.L1488
+	ldr	r3, .L1499+4
 	ldr	r3, [r3]
 	adds	r4, r3, #1
-	beq	.L1451
-	ldr	r3, .L1461+8
+	beq	.L1489
+	ldr	r3, .L1499+8
 	mov	r0, r6
 	movs	r7, #0
 	mov	r5, r7
@@ -10775,7 +10805,7 @@ FtlRead:
 	subs	r0, r3, #1
 	bl	__aeabi_uidiv
 	ldr	r3, [sp, #16]
-	ldr	r2, .L1461+12
+	ldr	r2, .L1499+12
 	ldr	r1, [sp, #24]
 	rsb	r3, r3, #1
 	ldr	r4, [sp, #16]
@@ -10788,54 +10818,54 @@ FtlRead:
 	add	r3, r3, r1
 	ldr	r1, [sp, #8]
 	str	r3, [r2]
-	ldr	r2, .L1461+16
+	ldr	r2, .L1499+16
 	str	r7, [sp, #4]
 	ldr	r3, [r2]
 	add	r3, r3, r1
 	str	r3, [r2]
-.L1431:
+.L1469:
 	ldr	r3, [sp, #8]
-	cbnz	r3, .L1448
-	ldr	r3, .L1461+20
+	cbnz	r3, .L1486
+	ldr	r3, .L1499+20
 	ldrh	r3, [r3]
-	cbnz	r3, .L1449
-	ldr	r3, .L1461+24
+	cbnz	r3, .L1487
+	ldr	r3, .L1499+24
 	ldrh	r3, [r3]
 	cmp	r3, #31
-	bhi	.L1428
-.L1449:
+	bhi	.L1466
+.L1487:
 	movs	r1, #1
 	movs	r0, #0
 	bl	rk_ftl_garbage_collect
-	b	.L1428
-.L1448:
+	b	.L1466
+.L1486:
 	movs	r2, #0
 	add	r1, sp, #52
 	mov	r0, r4
 	bl	log2phys
 	ldr	r3, [sp, #52]
 	adds	r0, r3, #1
-	bne	.L1432
-	ldr	fp, .L1461+8
+	bne	.L1470
+	ldr	fp, .L1499+8
 	mov	r10, #0
-.L1433:
+.L1471:
 	ldrh	r0, [fp]
 	cmp	r10, r0
-	bcc	.L1435
-.L1436:
+	bcc	.L1473
+.L1474:
 	ldr	r3, [sp, #8]
 	adds	r4, r4, #1
 	subs	r3, r3, #1
 	str	r3, [sp, #8]
-	beq	.L1440
-	ldr	r3, .L1461+28
+	beq	.L1478
+	ldr	r3, .L1499+28
 	ldrh	r3, [r3]
 	cmp	r5, r3, lsl #2
-	bne	.L1431
-.L1440:
+	bne	.L1469
+.L1478:
 	cmp	r5, #0
-	beq	.L1431
-	ldr	r3, .L1461+32
+	beq	.L1469
+	ldr	r3, .L1499+32
 	movs	r2, #0
 	mov	r1, r5
 	mov	r10, #0
@@ -10849,29 +10879,29 @@ FtlRead:
 	ldr	r3, [sp, #32]
 	lsls	r3, r3, #9
 	str	r3, [sp, #40]
-.L1447:
+.L1485:
 	movs	r3, #20
 	mul	fp, r3, r10
-	ldr	r3, .L1461+32
+	ldr	r3, .L1499+32
 	ldr	r2, [r3]
 	ldr	r3, [sp, #16]
 	add	r2, r2, fp
 	ldr	r1, [r2, #16]
 	cmp	r3, r1
-	bne	.L1442
+	bne	.L1480
 	ldr	r1, [r2, #8]
-	ldr	r2, .L1461+36
+	ldr	r2, .L1499+36
 	ldr	r2, [r2]
 	cmp	r1, r2
-	bne	.L1443
+	bne	.L1481
 	ldr	r3, [sp, #36]
 	mov	r0, r8
 	ldr	r2, [sp, #40]
 	add	r1, r1, r3
-.L1460:
+.L1498:
 	bl	ftl_memcpy
-.L1443:
-	ldr	r3, .L1461+32
+.L1481:
+	ldr	r3, .L1499+32
 	ldr	r3, [r3]
 	add	r2, r3, fp
 	ldr	r3, [r3, fp]
@@ -10880,49 +10910,49 @@ FtlRead:
 	ldr	r0, [r0, #8]
 	cmp	r1, r0
 	itttt	ne
-	ldrne	r0, .L1461+40
+	ldrne	r0, .L1499+40
 	ldrne	r1, [r0, #72]
 	addne	r1, r1, #1
 	strne	r1, [r0, #72]
 	adds	r1, r3, #1
-	bne	.L1445
-	ldr	r1, .L1461+40
+	bne	.L1483
+	ldr	r1, .L1499+40
 	str	r3, [sp, #4]
 	ldr	r2, [r1, #72]
 	adds	r2, r2, #1
 	str	r2, [r1, #72]
-.L1446:
+.L1484:
 	add	r10, r10, #1
 	cmp	r5, r10
-	bne	.L1447
+	bne	.L1485
 	movs	r5, #0
-	b	.L1431
-.L1435:
+	b	.L1469
+.L1473:
 	mla	r0, r0, r4, r10
 	cmp	r6, r0
-	bhi	.L1434
+	bhi	.L1472
 	ldr	r3, [sp, #12]
 	cmp	r3, r0
-	bls	.L1434
+	bls	.L1472
 	subs	r0, r0, r6
 	mov	r2, #512
 	movs	r1, #0
 	add	r0, r8, r0, lsl #9
 	bl	ftl_memset
-.L1434:
+.L1472:
 	add	r10, r10, #1
-	b	.L1433
-.L1432:
-	ldr	r2, .L1461+32
+	b	.L1471
+.L1470:
+	ldr	r2, .L1499+32
 	mov	r10, #20
 	ldr	r2, [r2]
 	mla	r10, r10, r5, r2
 	str	r3, [r10, #4]
 	ldr	r3, [sp, #16]
 	cmp	r4, r3
-	ldr	r3, .L1461+8
-	bne	.L1437
-	ldr	r2, .L1461+36
+	ldr	r3, .L1499+8
+	bne	.L1475
+	ldr	r2, .L1499+36
 	mov	r0, r6
 	ldrh	fp, [r3]
 	ldr	r2, [r2]
@@ -10937,11 +10967,11 @@ FtlRead:
 	movcs	r3, r2
 	cmp	fp, r3
 	str	r3, [sp, #32]
-	bne	.L1438
+	bne	.L1476
 	str	r8, [r10, #8]
-.L1438:
-	ldr	r3, .L1461+44
-	ldr	r2, .L1461+48
+.L1476:
+	ldr	r3, .L1499+44
+	ldr	r2, .L1499+48
 	str	r4, [r10, #16]
 	ldrh	r3, [r3]
 	ldr	r2, [r2]
@@ -10950,12 +10980,12 @@ FtlRead:
 	bic	r3, r3, #3
 	add	r3, r3, r2
 	str	r3, [r10, #12]
-	b	.L1436
-.L1437:
+	b	.L1474
+.L1475:
 	ldr	r2, [sp, #20]
 	cmp	r4, r2
-	bne	.L1439
-	ldr	r2, .L1461+52
+	bne	.L1477
+	ldr	r2, .L1499+52
 	ldr	r1, [sp, #12]
 	ldr	r2, [r2]
 	str	r2, [r10, #8]
@@ -10963,49 +10993,49 @@ FtlRead:
 	mul	r3, r2, r4
 	subs	r7, r1, r3
 	cmp	r2, r7
-	bne	.L1438
-.L1459:
+	bne	.L1476
+.L1497:
 	subs	r3, r3, r6
 	add	r3, r8, r3, lsl #9
 	str	r3, [r10, #8]
-	b	.L1438
-.L1439:
+	b	.L1476
+.L1477:
 	ldrh	r3, [r3]
 	muls	r3, r4, r3
-	b	.L1459
-.L1442:
+	b	.L1497
+.L1480:
 	ldr	r3, [sp, #20]
 	cmp	r3, r1
-	bne	.L1443
-	ldr	r3, .L1461+52
+	bne	.L1481
+	ldr	r3, .L1499+52
 	ldr	r1, [r2, #8]
 	ldr	r2, [r3]
 	cmp	r1, r2
-	bne	.L1443
-	ldr	r2, .L1461+8
+	bne	.L1481
+	ldr	r2, .L1499+8
 	ldr	r3, [sp, #20]
 	ldrh	r0, [r2]
 	ldr	r2, [sp, #44]
 	muls	r0, r3, r0
 	subs	r0, r0, r6
 	add	r0, r8, r0, lsl #9
-	b	.L1460
-.L1445:
+	b	.L1498
+.L1483:
 	cmp	r3, #256
-	bne	.L1446
+	bne	.L1484
 	ldr	r0, [r2, #4]
 	ubfx	r0, r0, #10, #16
 	bl	P2V_block_in_plane
 	bl	FtlGcRefreshBlock
-	b	.L1446
-.L1450:
+	b	.L1484
+.L1488:
 	mov	r3, #-1
-.L1451:
+.L1489:
 	str	r3, [sp, #4]
-	b	.L1428
-.L1462:
+	b	.L1466
+.L1500:
 	.align	2
-.L1461:
+.L1499:
 	.word	.LANCHOR34
 	.word	.LANCHOR166
 	.word	.LANCHOR12
@@ -11053,37 +11083,35 @@ FtlWrite:
 	cmp	r0, #16
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	sub	sp, sp, #72
-	str	r1, [sp, #4]
+	mov	fp, r1
 	str	r2, [sp, #20]
 	str	r3, [sp, #16]
-	bne	.L1465
+	bne	.L1503
 	mov	r2, r3
-	ldr	r3, [sp, #4]
 	ldr	r1, [sp, #20]
-	add	r0, r3, #256
+	add	r0, fp, #256
 	bl	FtlVendorPartWrite
-.L1464:
+.L1502:
 	add	sp, sp, #72
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1465:
-	ldr	r3, [sp, #4]
-	ldr	r2, [sp, #20]
-	adds	r4, r3, r2
-	ldr	r3, .L1508
+.L1503:
+	ldr	r3, [sp, #20]
+	adds	r4, r1, r3
+	ldr	r3, .L1547
 	ldr	r3, [r3]
 	cmp	r4, r3
-	bhi	.L1498
-	ldr	r3, .L1508+4
+	bhi	.L1536
+	ldr	r3, .L1547+4
 	ldr	r0, [r3]
-	adds	r5, r0, #1
-	beq	.L1464
-	ldr	r3, .L1508+8
+	adds	r1, r0, #1
+	beq	.L1502
+	ldr	r3, .L1547+8
 	mov	r2, #2048
-	ldr	r0, [sp, #4]
-	ldr	r7, .L1508+12
+	mov	r0, fp
+	ldr	r7, .L1547+12
 	str	r2, [r3]
-	ldr	r3, .L1508+16
+	ldr	r3, .L1547+16
 	ldrh	r5, [r3]
 	mov	r1, r5
 	bl	__aeabi_uidiv
@@ -11095,7 +11123,7 @@ FtlWrite:
 	ldr	r1, [sp, #20]
 	ldr	r5, [sp, #12]
 	subs	r3, r0, r2
-	ldr	r2, .L1508+20
+	ldr	r2, .L1547+20
 	str	r3, [sp, #32]
 	adds	r3, r3, #1
 	str	r3, [sp, #8]
@@ -11104,39 +11132,39 @@ FtlWrite:
 	add	r3, r3, r1
 	ldr	r1, [sp, #8]
 	str	r3, [r2]
-	ldr	r2, .L1508+24
+	ldr	r2, .L1547+24
 	ldr	r3, [r2]
 	add	r3, r3, r1
 	str	r3, [r2]
-.L1467:
+.L1505:
 	ldr	r3, [sp, #8]
-	cbnz	r3, .L1493
-	ldr	r5, .L1508+28
+	cbnz	r3, .L1531
+	ldr	r5, .L1547+28
 	mov	r0, r3
 	ldr	r1, [sp, #32]
 	bl	rk_ftl_garbage_collect
 	ldrh	r2, [r5]
 	cmp	r2, #5
-	bls	.L1494
-.L1496:
+	bls	.L1532
+.L1534:
 	movs	r0, #0
-	b	.L1464
-.L1493:
-	ldr	r4, .L1508+32
+	b	.L1502
+.L1531:
+	ldr	r4, .L1547+32
 	ldrb	r2, [r7, #6]	@ zero_extendqisi2
 	ldrh	r3, [r4]
 	cmp	r2, r3
-	bcc	.L1468
-	mov	r2, #1016
-	ldr	r1, .L1508+36
-	ldr	r0, .L1508+40
+	bcc	.L1506
+	movw	r2, #1038
+	ldr	r1, .L1547+36
+	ldr	r0, .L1547+40
 	bl	printf
-.L1468:
+.L1506:
 	ldrh	r3, [r7, #4]
-	cbnz	r3, .L1469
+	cbnz	r3, .L1507
 	mov	r0, r7
 	bl	allocate_new_data_superblock
-.L1469:
+.L1507:
 	ldrb	r3, [r7, #7]	@ zero_extendqisi2
 	ldrh	r2, [r7, #4]
 	lsls	r3, r3, #2
@@ -11151,87 +11179,92 @@ FtlWrite:
 	str	r3, [sp, #44]
 	ldrh	r3, [r4]
 	cmp	r2, r3
-	bcc	.L1470
-	movw	r2, #1049
-	ldr	r1, .L1508+36
-	ldr	r0, .L1508+40
+	bcc	.L1508
+	movw	r2, #1071
+	ldr	r1, .L1547+36
+	ldr	r0, .L1547+40
 	bl	printf
-.L1470:
-	ldr	r8, .L1508+44
-	mov	fp, #0
-.L1471:
-	ldr	r3, [sp, #44]
-	cmp	fp, r3
-	bne	.L1491
-.L1472:
-	ldr	r0, .L1508+44
+.L1508:
+	ldr	r8, .L1547+44
+	movs	r3, #0
+	str	r3, [sp, #4]
+.L1509:
+	ldr	r3, [sp, #4]
+	ldr	r2, [sp, #44]
+	cmp	r3, r2
+	bne	.L1529
+.L1510:
+	ldr	r0, .L1547+44
 	mov	r3, r7
 	movs	r2, #0
-	mov	r1, fp
+	ldr	r1, [sp, #4]
 	ldr	r0, [r0]
 	bl	FtlProgPages
-	ldr	r3, [sp, #8]
-	cmp	fp, r3
-	bls	.L1492
-	movw	r2, #1126
-	ldr	r1, .L1508+36
-	ldr	r0, .L1508+40
+	ldr	r3, [sp, #4]
+	ldr	r2, [sp, #8]
+	cmp	r3, r2
+	bls	.L1530
+	movw	r2, #1149
+	ldr	r1, .L1547+36
+	ldr	r0, .L1547+40
 	bl	printf
-.L1492:
+.L1530:
 	ldr	r3, [sp, #8]
-	sub	r3, r3, fp
+	ldr	r2, [sp, #4]
+	subs	r3, r3, r2
 	str	r3, [sp, #8]
-	b	.L1467
-.L1491:
-	ldrh	r2, [r7, #4]
-	cmp	r2, #0
-	beq	.L1472
+	b	.L1505
+.L1529:
+	ldrh	r3, [r7, #4]
+	cmp	r3, #0
+	beq	.L1510
 	movs	r2, #0
 	add	r1, sp, #48
 	mov	r0, r5
 	movs	r6, #20
 	bl	log2phys
 	mov	r0, r7
-	mul	r6, r6, fp
 	bl	get_new_active_ppa
-	ldr	r2, .L1508+48
-	ldr	r1, [r8]
+	ldr	r2, .L1547+48
+	ldr	r1, [sp, #4]
+	ldr	r3, [sp, #4]
 	ldrh	r2, [r2]
-	add	r1, r1, r6
-	str	r0, [r1, #4]
-	str	r5, [r1, #16]
-	mul	r0, r2, fp
-	bic	r3, r0, #3
-	ldr	r0, .L1508+52
-	str	r3, [sp, #36]
-	ldr	r3, [r0]
+	muls	r6, r3, r6
+	ldr	r3, [r8]
+	muls	r1, r2, r1
+	add	r3, r3, r6
+	str	r0, [r3, #4]
+	bic	r1, r1, #3
+	str	r5, [r3, #16]
+	str	r1, [sp, #36]
+	ldr	r1, .L1547+52
 	ldr	r0, [sp, #36]
-	str	r3, [sp, #40]
-	add	r10, r3, r0
-	str	r10, [r1, #12]
-	mov	r0, r10
+	ldr	r1, [r1]
+	add	r10, r1, r0
+	str	r1, [sp, #40]
+	str	r10, [r3, #12]
 	movs	r1, #0
+	mov	r0, r10
 	bl	ftl_memset
 	ldr	r3, [sp, #12]
-	ldr	r2, .L1508+16
+	ldr	r2, .L1547+16
 	cmp	r5, r3
-	beq	.L1473
+	beq	.L1511
 	ldr	r3, [sp, #28]
 	cmp	r5, r3
-	bne	.L1504
+	bne	.L1542
 	ldrh	r2, [r2]
-	ldr	r3, [sp, #4]
-	ldr	r1, [sp, #20]
+	ldr	r3, [sp, #20]
 	smulbb	r2, r2, r5
-	adds	r4, r3, r1
+	add	r4, fp, r3
 	movs	r3, #0
-	subs	r4, r4, r2
 	str	r3, [sp, #24]
+	subs	r4, r4, r2
 	uxth	r4, r4
-	b	.L1476
-.L1473:
+	b	.L1514
+.L1511:
 	ldrh	r4, [r2]
-	ldr	r0, [sp, #4]
+	mov	r0, fp
 	mov	r1, r4
 	bl	__aeabi_uidivmod
 	ldr	r3, [sp, #20]
@@ -11240,144 +11273,140 @@ FtlWrite:
 	cmp	r4, r3
 	it	cs
 	movcs	r4, r3
-.L1476:
-	ldr	r2, .L1508+16
+.L1514:
+	ldr	r3, .L1547+16
+	ldrh	r3, [r3]
+	cmp	r4, r3
 	ldr	r3, [sp, #12]
-	ldrh	r2, [r2]
-	cmp	r4, r2
-	ldr	r2, [r8]
-	bne	.L1477
+	bne	.L1515
 	cmp	r5, r3
-	add	r6, r6, r2
-	ittet	ne
-	mulne	r4, r4, r5
-	ldrne	r3, [sp, #4]
-	ldreq	r3, [sp, #16]
-	subne	r4, r4, r3
-	itett	ne
-	ldrne	r3, [sp, #16]
-	streq	r3, [r6, #8]
-	addne	r4, r3, r4, lsl #9
-	strne	r4, [r6, #8]
-.L1479:
-	ldr	r2, .L1508+32
-	ldrb	r1, [r7, #6]	@ zero_extendqisi2
-	ldrh	r2, [r2]
-	cmp	r1, r2
-	bcc	.L1488
-	movw	r2, #1117
-	ldr	r1, .L1508+36
-	ldr	r0, .L1508+40
+	ldr	r3, [r8]
+	add	r6, r6, r3
+	bne	.L1516
+	ldr	r3, [sp, #16]
+.L1544:
+	str	r3, [r6, #8]
+	b	.L1517
+.L1516:
+	muls	r4, r5, r4
+	ldr	r3, [sp, #16]
+	sub	r4, r4, fp
+	add	r4, r3, r4, lsl #9
+	str	r4, [r6, #8]
+.L1517:
+	ldr	r3, .L1547+32
+	ldrb	r2, [r7, #6]	@ zero_extendqisi2
+	ldrh	r3, [r3]
+	cmp	r2, r3
+	bcc	.L1526
+	movw	r2, #1140
+	ldr	r1, .L1547+36
+	ldr	r0, .L1547+40
 	bl	printf
-.L1488:
-	ldr	r3, [sp, #40]
-	movw	r2, #61589
+.L1526:
+	ldr	r2, [sp, #40]
+	movw	r3, #61589
 	ldr	r1, [sp, #36]
-	add	fp, fp, #1
-	strh	r2, [r3, r1]	@ movhi
-	ldr	r1, .L1508+56
+	strh	r3, [r2, r1]	@ movhi
+	ldr	r2, .L1547+56
 	str	r5, [r10, #8]
 	adds	r5, r5, #1
-	ldr	r2, [r1]
-	str	r2, [r10, #4]
-	adds	r2, r2, #1
-	adds	r3, r2, #1
+	ldr	r3, [r2]
+	str	r3, [r10, #4]
+	adds	r3, r3, #1
+	adds	r1, r3, #1
 	it	eq
-	moveq	r2, #0
-	str	r2, [r1]
-	ldr	r2, [sp, #48]
-	str	r2, [r10, #12]
-	ldrh	r2, [r7]
-	strh	r2, [r10, #2]	@ movhi
-	b	.L1471
-.L1477:
+	moveq	r3, #0
+	str	r3, [r2]
+	ldr	r3, [sp, #48]
+	str	r3, [r10, #12]
+	ldrh	r3, [r7]
+	strh	r3, [r10, #2]	@ movhi
+	ldr	r3, [sp, #4]
+	adds	r3, r3, #1
+	str	r3, [sp, #4]
+	b	.L1509
+.L1515:
 	cmp	r5, r3
-	add	r2, r2, r6
+	ldr	r3, [r8]
 	ite	eq
-	ldreq	r1, .L1508+60
-	ldrne	r1, .L1508+64
-	ldr	r1, [r1]
-	str	r1, [r2, #8]
-	ldr	r2, [sp, #48]
-	adds	r1, r2, #1
-	beq	.L1482
-	str	r2, [sp, #56]
+	ldreq	r2, .L1547+60
+	ldrne	r2, .L1547+64
+	add	r3, r3, r6
+	ldr	r2, [r2]
+	str	r2, [r3, #8]
+	ldr	r3, [sp, #48]
+	adds	r2, r3, #1
+	beq	.L1520
+	str	r3, [sp, #56]
+	movs	r1, #1
+	ldr	r3, [r8]
 	add	r0, sp, #52
-	ldr	r2, [r8]
 	str	r5, [sp, #68]
-	add	r2, r2, r6
-	ldr	r1, [r2, #8]
-	ldr	r2, [r2, #12]
-	str	r1, [sp, #60]
-	movs	r1, #1
-	str	r2, [sp, #64]
+	add	r3, r3, r6
+	ldr	r2, [r3, #8]
+	ldr	r3, [r3, #12]
+	str	r2, [sp, #60]
 	movs	r2, #0
+	str	r3, [sp, #64]
 	bl	FlashReadPages
-	ldr	r2, [sp, #52]
-	adds	r2, r2, #1
-	bne	.L1483
-	ldr	r1, .L1508+68
+	ldr	r3, [sp, #52]
+	adds	r0, r3, #1
+	bne	.L1521
+	ldr	r1, .L1547+68
+	ldr	r0, .L1547+72
 	ldr	r2, [r1, #72]
 	adds	r2, r2, #1
 	str	r2, [r1, #72]
-.L1486:
+	mov	r2, r5
+	ldr	r1, [r10, #8]
+	bl	printf
+.L1524:
 	ldr	r3, [sp, #12]
 	lsls	r2, r4, #9
 	cmp	r5, r3
-	bne	.L1487
-	ldr	r1, [r8]
-	ldr	r3, [sp, #24]
-	add	r6, r6, r1
+	bne	.L1525
+	ldr	r3, [r8]
 	ldr	r1, [sp, #16]
+	add	r6, r6, r3
+	ldr	r3, [sp, #24]
 	ldr	r0, [r6, #8]
 	add	r0, r0, r3, lsl #9
-.L1506:
+.L1545:
 	bl	ftl_memcpy
-	b	.L1479
-.L1483:
+	b	.L1517
+.L1521:
 	ldr	r1, [r10, #8]
 	cmp	r5, r1
-	beq	.L1485
-	ldr	r0, .L1508+68
-	ldr	r2, [r0, #72]
-	adds	r2, r2, #1
-	str	r2, [r0, #72]
+	beq	.L1523
+	ldr	r2, .L1547+68
+	ldr	r0, .L1547+76
+	ldr	r3, [r2, #72]
+	adds	r3, r3, #1
+	str	r3, [r2, #72]
 	mov	r2, r5
-	ldr	r0, .L1508+72
 	bl	printf
-.L1485:
-	ldr	r2, [r10, #8]
-	cmp	r5, r2
-	beq	.L1486
-	movw	r2, #1102
-	ldr	r1, .L1508+36
-	ldr	r0, .L1508+40
+.L1523:
+	ldr	r3, [r10, #8]
+	cmp	r5, r3
+	beq	.L1524
+	movw	r2, #1125
+	ldr	r1, .L1547+36
+	ldr	r0, .L1547+40
 	bl	printf
-	b	.L1486
-.L1482:
-	ldr	r2, [r8]
+	b	.L1524
+.L1520:
+	ldr	r3, [r8]
 	movs	r1, #0
-	adds	r0, r2, r6
-	ldr	r2, .L1508+76
-	ldr	r0, [r0, #8]
+	ldr	r2, .L1547+80
+	add	r3, r3, r6
 	ldrh	r2, [r2]
+	ldr	r0, [r3, #8]
 	bl	ftl_memset
-	b	.L1486
-.L1487:
-	ldr	r1, .L1508+16
-	ldr	r3, [sp, #4]
-	ldr	r0, [r8]
-	ldrh	r1, [r1]
-	add	r6, r6, r0
-	ldr	r0, [r6, #8]
-	muls	r1, r5, r1
-	subs	r1, r1, r3
-	ldr	r3, [sp, #16]
-	add	r1, r3, r1, lsl #9
-	b	.L1506
-.L1509:
+	b	.L1524
+.L1548:
 	.align	2
-.L1508:
+.L1547:
 	.word	.LANCHOR34
 	.word	.LANCHOR166
 	.word	.LANCHOR176
@@ -11396,42 +11425,52 @@ FtlWrite:
 	.word	.LANCHOR109
 	.word	.LANCHOR110
 	.word	.LANCHOR135
-	.word	.LC37
+	.word	.LC44
+	.word	.LC45
 	.word	.LANCHOR23
-.L1504:
-	ldrh	r2, [r2]
-	ldr	r3, [sp, #4]
-	ldr	r1, [r8]
-	muls	r2, r5, r2
-	add	r6, r6, r1
-	subs	r2, r2, r3
+.L1525:
+	ldr	r3, .L1549
+	ldrh	r1, [r3]
+	ldr	r3, [r8]
+	muls	r1, r5, r1
+	add	r6, r6, r3
 	ldr	r3, [sp, #16]
-	add	r2, r3, r2, lsl #9
-	str	r2, [r6, #8]
-	b	.L1479
-.L1494:
-	ldr	r6, .L1510
+	ldr	r0, [r6, #8]
+	sub	r1, r1, fp
+	add	r1, r3, r1, lsl #9
+	b	.L1545
+.L1542:
+	ldr	r3, [r8]
+	add	r6, r6, r3
+	ldrh	r3, [r2]
+	ldr	r2, [sp, #16]
+	muls	r3, r5, r3
+	sub	r3, r3, fp
+	add	r3, r2, r3, lsl #9
+	b	.L1544
+.L1532:
+	ldr	r6, .L1549+4
 	mov	r4, #256
-	ldr	r7, .L1510+4
-.L1497:
+	ldr	r7, .L1549+8
+.L1535:
 	ldrh	r3, [r6]
 	movw	r2, #65535
 	cmp	r3, r2
-	bne	.L1495
+	bne	.L1533
 	ldrh	r2, [r7]
 	cmp	r2, r3
-	bne	.L1495
+	bne	.L1533
 	movs	r0, #0
 	bl	List_get_gc_head_node
 	uxth	r0, r0
 	bl	FtlGcRefreshBlock
-.L1495:
-	ldr	r2, .L1510+8
+.L1533:
+	ldr	r2, .L1549+12
 	movs	r3, #128
 	movs	r1, #1
 	mov	r0, r1
 	strh	r3, [r2]	@ movhi
-	ldr	r2, .L1510+12
+	ldr	r2, .L1549+16
 	strh	r3, [r2]	@ movhi
 	bl	rk_ftl_garbage_collect
 	movs	r1, #1
@@ -11439,17 +11478,18 @@ FtlWrite:
 	bl	rk_ftl_garbage_collect
 	ldrh	r3, [r5]
 	cmp	r3, #2
-	bhi	.L1496
+	bhi	.L1534
 	subs	r4, r4, #1
-	bne	.L1497
-	b	.L1496
-.L1498:
+	bne	.L1535
+	b	.L1534
+.L1536:
 	mov	r0, #-1
-	b	.L1464
-.L1511:
+	b	.L1502
+.L1550:
 	.align	2
-.L1510:
-	.word	.LANCHOR144
+.L1549:
+	.word	.LANCHOR12
+	.word	.LANCHOR145
 	.word	.LANCHOR72
 	.word	.LANCHOR101
 	.word	.LANCHOR100
@@ -11483,16 +11523,16 @@ FtlLoadSysInfo:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r1, #0
-	ldr	r8, .L1540+144
+	ldr	r8, .L1582+144
 	sub	sp, sp, #24
-	ldr	r7, .L1540
+	ldr	r7, .L1582
 	ldr	r3, [r8]
-	ldr	r4, .L1540+4
-	ldr	fp, .L1540+148
+	ldr	r4, .L1582+4
+	ldr	fp, .L1582+148
 	ldrh	r2, [r7]
-	ldr	r5, .L1540+8
+	ldr	r5, .L1582+8
 	str	r3, [r4, #8]
-	ldr	r6, .L1540+12
+	ldr	r6, .L1582+12
 	ldr	r3, [fp]
 	lsls	r2, r2, #1
 	ldr	r0, [r5]
@@ -11502,33 +11542,33 @@ FtlLoadSysInfo:
 	movw	r3, #65535
 	str	r5, [sp, #16]
 	cmp	r0, r3
-	bne	.L1514
-.L1525:
+	bne	.L1553
+.L1564:
 	mov	r0, #-1
-.L1513:
+.L1552:
 	add	sp, sp, #24
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1514:
+.L1553:
 	movs	r1, #1
 	bl	FtlGetLastWrittenPage
 	ldrsh	r10, [r6]
 	sxth	r5, r0
 	adds	r0, r0, #1
 	strh	r0, [r6, #2]	@ movhi
-.L1516:
+.L1555:
 	cmp	r5, #0
-	bge	.L1522
+	bge	.L1561
 	movw	r2, #1465
-	ldr	r1, .L1540+16
-	ldr	r0, .L1540+20
+	ldr	r1, .L1582+16
+	ldr	r0, .L1582+20
 	bl	printf
-	b	.L1521
-.L1522:
+	b	.L1560
+.L1561:
 	orr	r3, r5, r10, lsl #10
 	movs	r2, #1
 	mov	r1, r2
-	ldr	r0, .L1540+4
+	ldr	r0, .L1582+4
 	str	r3, [r4, #4]
 	ldr	r3, [r8]
 	str	r3, [r4, #8]
@@ -11536,64 +11576,67 @@ FtlLoadSysInfo:
 	ldr	r3, [r4, #12]
 	ldr	r3, [r3, #12]
 	str	r3, [sp, #20]
-	cbz	r3, .L1517
-	ldr	r2, .L1540+24
+	cbz	r3, .L1556
+	ldr	r2, [r4]
+	adds	r2, r2, #1
+	beq	.L1556
+	ldr	r2, .L1582+24
 	ldr	r0, [r4, #8]
 	ldrh	r1, [r2]
 	bl	js_hash
 	ldr	r3, [sp, #20]
 	cmp	r3, r0
-	beq	.L1517
+	beq	.L1556
 	str	r0, [sp, #8]
 	mov	r2, r10
 	str	r3, [sp, #4]
 	ldrh	r3, [r6, #4]
-	ldr	r1, .L1540+16
-	ldr	r0, .L1540+28
+	ldr	r1, .L1582+16
+	ldr	r0, .L1582+28
 	str	r3, [sp]
 	mov	r3, r5
 	bl	printf
-	cbnz	r5, .L1518
+	cbnz	r5, .L1557
 	ldrh	r3, [r6, #4]
 	cmp	r10, r3
-	beq	.L1518
+	beq	.L1557
 	sxth	r10, r3
-	ldr	r3, .L1540+32
+	ldr	r3, .L1582+32
 	ldrh	r5, [r3]
-.L1520:
+.L1559:
 	subs	r5, r5, #1
 	sxth	r5, r5
-	b	.L1516
-.L1518:
+	b	.L1555
+.L1557:
 	mov	r3, #-1
 	str	r3, [r4]
-.L1517:
+.L1556:
 	ldr	r3, [r4]
 	adds	r3, r3, #1
-	beq	.L1520
+	beq	.L1559
 	ldr	r3, [r8]
-	ldr	r2, .L1540+36
+	ldr	r2, .L1582+36
 	ldr	r3, [r3]
 	cmp	r3, r2
-	bne	.L1520
+	bne	.L1559
 	ldr	r3, [fp]
 	ldrh	r2, [r3]
 	movw	r3, #61604
 	cmp	r2, r3
-	bne	.L1520
-.L1521:
-	ldr	r2, .L1540+24
+	bne	.L1559
+.L1560:
+	ldr	r2, .L1582+24
 	ldrh	r3, [r7]
 	ldrh	r2, [r2]
 	adds	r3, r3, #24
 	cmp	r2, r3, lsl #1
-	bcs	.L1524
+	bcs	.L1563
 	movw	r2, #1467
-	ldr	r1, .L1540+16
-	ldr	r0, .L1540+20
+	ldr	r1, .L1582+16
+	ldr	r0, .L1582+20
 	bl	printf
-.L1524:
-	ldr	r5, .L1540+40
+.L1563:
+	ldr	r5, .L1582+40
 	movs	r2, #48
 	ldr	r1, [r4, #8]
 	mov	r0, r5
@@ -11614,60 +11657,60 @@ FtlLoadSysInfo:
 	adds	r2, r2, #4
 	bic	r1, r1, #3
 	add	r1, r1, r3
-	ldr	r3, .L1540+44
+	ldr	r3, .L1582+44
 	ldr	r0, [r3]
 	bl	ftl_memcpy
 	ldr	r2, [r5]
-	ldr	r3, .L1540+36
+	ldr	r3, .L1582+36
 	cmp	r2, r3
-	bne	.L1525
-	ldr	r3, .L1540+48
+	bne	.L1564
+	ldr	r3, .L1582+48
 	ldrb	r2, [r4, #10]	@ zero_extendqisi2
 	ldrh	r5, [r5, #8]
 	ldrh	r3, [r3]
 	strh	r5, [r6, #6]	@ movhi
 	cmp	r2, r3
-	bne	.L1525
-	ldr	r3, .L1540+52
-	ldr	r2, .L1540+56
+	bne	.L1564
+	ldr	r3, .L1582+52
+	ldr	r2, .L1582+56
 	str	r5, [r3]
-	ldr	r3, .L1540+60
+	ldr	r3, .L1582+60
 	ldrh	r3, [r3]
 	muls	r3, r5, r3
 	str	r3, [r2]
-	ldr	r2, .L1540+64
+	ldr	r2, .L1582+64
 	ldrh	r2, [r2]
 	muls	r3, r2, r3
-	ldr	r2, .L1540+68
+	ldr	r2, .L1582+68
 	str	r3, [r2]
-	ldr	r3, .L1540+72
+	ldr	r3, .L1582+72
 	ldr	r6, [r3]
-	ldr	r3, .L1540+76
+	ldr	r3, .L1582+76
 	ldrh	r0, [r3, #6]
-	ldr	r3, .L1540+80
+	ldr	r3, .L1582+80
 	subs	r0, r6, r0
 	ldrh	r1, [r3]
 	subs	r0, r0, r5
 	bl	__aeabi_uidiv
-	ldr	r3, .L1540+84
+	ldr	r3, .L1582+84
 	cmp	r5, r6
 	strh	r0, [r3]	@ movhi
-	bls	.L1526
+	bls	.L1565
 	movw	r2, #1489
-	ldr	r1, .L1540+16
-	ldr	r0, .L1540+20
+	ldr	r1, .L1582+16
+	ldr	r0, .L1582+20
 	bl	printf
-.L1526:
+.L1565:
 	ldrh	r2, [r4, #16]
-	ldr	r3, .L1540+88
+	ldr	r3, .L1582+88
 	ldrh	ip, [r4, #14]
-	ldr	r7, .L1540+92
+	ldr	r7, .L1582+92
 	lsrs	r1, r2, #6
 	and	r2, r2, #63
 	strb	r2, [r3, #6]
 	ldrb	r2, [r4, #11]	@ zero_extendqisi2
 	strh	r1, [r3, #2]	@ movhi
-	ldr	r1, .L1540+96
+	ldr	r1, .L1582+96
 	strb	r2, [r3, #8]
 	ldrh	r2, [r4, #18]
 	strh	ip, [r3]	@ movhi
@@ -11686,7 +11729,7 @@ FtlLoadSysInfo:
 	strh	r5, [r1, #2]	@ movhi
 	ldrh	r5, [r4, #22]
 	strb	r2, [r1, #8]
-	ldr	r2, .L1540+100
+	ldr	r2, .L1582+100
 	strh	r5, [r2]	@ movhi
 	ldrh	r5, [r4, #24]
 	lsrs	r6, r5, #6
@@ -11696,31 +11739,31 @@ FtlLoadSysInfo:
 	strh	r6, [r2, #2]	@ movhi
 	ldr	r6, [r4, #32]
 	strb	r5, [r2, #8]
-	ldr	r5, .L1540+104
+	ldr	r5, .L1582+104
 	str	r3, [r5]
-	ldr	r5, .L1540+108
+	ldr	r5, .L1582+108
 	str	r3, [r5]
-	ldr	r5, .L1540+112
+	ldr	r5, .L1582+112
 	str	r3, [r5]
-	ldr	r5, .L1540+116
+	ldr	r5, .L1582+116
 	str	r3, [r5]
-	ldr	r5, .L1540+120
+	ldr	r5, .L1582+120
 	str	r6, [r5]
 	mov	r6, r1
-	ldr	r5, .L1540+124
+	ldr	r5, .L1582+124
 	str	r3, [r5]
-	ldr	r5, .L1540+128
+	ldr	r5, .L1582+128
 	str	r3, [r5]
-	ldr	r5, .L1540+132
+	ldr	r5, .L1582+132
 	ldr	lr, [r4, #40]
 	str	r3, [r5]
-	ldr	r3, .L1540+136
+	ldr	r3, .L1582+136
 	ldr	r5, [r3]
 	cmp	lr, r5
 	mov	r5, r2
 	it	hi
 	strhi	lr, [r3]
-	ldr	r3, .L1540+140
+	ldr	r3, .L1582+140
 	ldr	r2, [r4, #36]
 	ldr	r1, [r3]
 	cmp	r2, r1
@@ -11728,36 +11771,36 @@ FtlLoadSysInfo:
 	strhi	r2, [r3]
 	movw	r3, #65535
 	cmp	ip, r3
-	beq	.L1529
-	ldr	r0, .L1540+88
+	beq	.L1568
+	ldr	r0, .L1582+88
 	bl	make_superblock
-.L1529:
+.L1568:
 	ldrh	r2, [r6]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L1530
-	ldr	r0, .L1540+96
+	beq	.L1569
+	ldr	r0, .L1582+96
 	bl	make_superblock
-.L1530:
+.L1569:
 	ldrh	r2, [r5]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L1531
-	ldr	r0, .L1540+100
+	beq	.L1570
+	ldr	r0, .L1582+100
 	bl	make_superblock
-.L1531:
+.L1570:
 	ldrh	r2, [r7]
 	movw	r3, #65535
 	cmp	r2, r3
-	beq	.L1532
-	ldr	r0, .L1540+92
+	beq	.L1571
+	ldr	r0, .L1582+92
 	bl	make_superblock
-.L1532:
+.L1571:
 	movs	r0, #0
-	b	.L1513
-.L1541:
+	b	.L1552
+.L1583:
 	.align	2
-.L1540:
+.L1582:
 	.word	.LANCHOR5
 	.word	.LANCHOR138
 	.word	.LANCHOR42
@@ -11765,7 +11808,7 @@ FtlLoadSysInfo:
 	.word	.LANCHOR178
 	.word	.LC1
 	.word	.LANCHOR23
-	.word	.LC38
+	.word	.LC46
 	.word	.LANCHOR20
 	.word	1179929683
 	.word	.LANCHOR39
@@ -11781,7 +11824,7 @@ FtlLoadSysInfo:
 	.word	.LANCHOR3
 	.word	.LANCHOR171
 	.word	.LANCHOR51
-	.word	.LANCHOR144
+	.word	.LANCHOR145
 	.word	.LANCHOR52
 	.word	.LANCHOR53
 	.word	.LANCHOR84
@@ -11817,7 +11860,7 @@ FtlMapTblRecovery:
 	movs	r7, #0
 	str	r3, [sp, #8]
 	ldr	r3, [r0, #16]
-	ldr	r6, .L1577
+	ldr	r6, .L1625
 	str	r3, [sp, #24]
 	ldrh	r3, [r0, #6]
 	str	r3, [sp, #12]
@@ -11827,13 +11870,13 @@ FtlMapTblRecovery:
 	ldr	r3, [sp, #12]
 	lsls	r2, r3, #2
 	bl	ftl_memset
-	ldr	r3, .L1577+4
+	ldr	r3, .L1625+4
 	str	r7, [r4, #32]
 	str	r7, [r4, #28]
 	ldr	r2, [r3]
 	str	r3, [sp, #20]
 	str	r2, [r6, #8]
-	ldr	r2, .L1577+8
+	ldr	r2, .L1625+8
 	ldr	fp, [r2]
 	movw	r2, #65535
 	str	fp, [r6, #12]
@@ -11841,20 +11884,20 @@ FtlMapTblRecovery:
 	strh	r2, [r4, #2]	@ movhi
 	movs	r2, #1
 	str	r2, [r4, #36]
-.L1543:
+.L1585:
 	ldr	r3, [sp, #16]
 	sxth	r5, r7
 	cmp	r5, r3
-	bge	.L1562
+	bge	.L1604
 	ldr	r3, [sp, #16]
 	subs	r3, r3, #1
 	cmp	r5, r3
-	bne	.L1544
+	bne	.L1586
 	movs	r1, #1
 	ldrh	r0, [r8, r5, lsl #1]
 	bl	FtlGetLastWrittenPage
 	sxth	r3, r0
-	ldr	r6, .L1577
+	ldr	r6, .L1625
 	add	r10, r8, r5, lsl #1
 	strh	r7, [r4]	@ movhi
 	str	r3, [sp, #16]
@@ -11864,22 +11907,22 @@ FtlMapTblRecovery:
 	strh	r0, [r4, #2]	@ movhi
 	ldr	r3, [r3, r5, lsl #2]
 	str	r3, [r4, #28]
-.L1545:
+.L1587:
 	ldr	r3, [sp, #16]
 	sxth	r8, r7
 	cmp	r8, r3
-	ble	.L1548
-.L1562:
+	ble	.L1590
+.L1604:
 	mov	r0, r4
 	bl	ftl_free_no_use_map_blk
-	ldr	r3, .L1577+12
+	ldr	r3, .L1625+12
 	ldrh	r2, [r4, #2]
 	ldrh	r3, [r3]
 	cmp	r2, r3
-	bne	.L1550
+	bne	.L1592
 	mov	r0, r4
 	bl	ftl_map_blk_alloc_new_blk
-.L1550:
+.L1592:
 	mov	r0, r4
 	bl	ftl_map_blk_gc
 	mov	r0, r4
@@ -11888,9 +11931,9 @@ FtlMapTblRecovery:
 	add	sp, sp, #40
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1548:
+.L1590:
 	ldrh	r2, [r10]
-	ldr	r0, .L1577
+	ldr	r0, .L1625
 	orr	r2, r8, r2, lsl #10
 	str	r2, [r6, #4]
 	movs	r2, #1
@@ -11899,31 +11942,34 @@ FtlMapTblRecovery:
 	ldr	r2, [r6, #12]
 	ldr	r2, [r2, #12]
 	str	r2, [sp, #20]
-	cbz	r2, .L1546
-	ldr	r3, .L1577+16
+	cbz	r2, .L1588
+	ldr	r1, [r6]
+	adds	r1, r1, #1
+	beq	.L1588
+	ldr	r3, .L1625+16
 	ldr	r0, [r6, #8]
 	ldrh	r1, [r3]
 	bl	js_hash
 	ldr	r2, [sp, #20]
 	cmp	r2, r0
-	beq	.L1546
+	beq	.L1588
 	str	r0, [sp, #4]
 	mov	r3, r8
 	str	r2, [sp]
 	mov	r2, r5
-	ldr	r1, .L1577+20
-	ldr	r0, .L1577+24
+	ldr	r1, .L1625+20
+	ldr	r0, .L1625+24
 	bl	printf
 	mov	r3, #-1
 	str	r3, [r6]
-.L1546:
+.L1588:
 	ldr	r3, [r6]
 	adds	r3, r3, #1
-	beq	.L1547
+	beq	.L1589
 	ldrh	r3, [fp, #8]
 	ldr	r2, [sp, #12]
 	cmp	r2, r3
-	bls	.L1547
+	bls	.L1589
 	ldrh	r1, [fp]
 	ldrh	r2, [r4, #4]
 	cmp	r1, r2
@@ -11931,15 +11977,15 @@ FtlMapTblRecovery:
 	ldreq	r2, [r6, #4]
 	ldreq	r1, [sp, #8]
 	streq	r2, [r1, r3, lsl #2]
-.L1547:
+.L1589:
 	adds	r7, r7, #1
-	b	.L1545
-.L1544:
+	b	.L1587
+.L1586:
 	ldr	r3, [sp, #20]
-	ldr	r10, .L1577+12
+	ldr	r10, .L1625+12
 	ldrh	r2, [r8, r5, lsl #1]
 	ldr	r3, [r3]
-	ldr	r0, .L1577
+	ldr	r0, .L1625
 	str	r3, [r6, #8]
 	add	r3, r8, r5, lsl #1
 	str	r3, [sp, #28]
@@ -11952,25 +11998,25 @@ FtlMapTblRecovery:
 	bl	FlashReadPages
 	ldr	r3, [r6]
 	adds	r3, r3, #1
-	beq	.L1564
+	beq	.L1606
 	ldrh	r2, [fp]
 	ldrh	r3, [r4, #4]
 	cmp	r2, r3
-	bne	.L1564
+	bne	.L1606
 	ldrh	r2, [fp, #8]
 	movw	r3, #64245
 	cmp	r2, r3
-	beq	.L1552
-.L1564:
+	beq	.L1594
+.L1606:
 	mov	r10, #0
-.L1553:
-	ldr	r2, .L1577+12
+.L1595:
+	ldr	r2, .L1625+12
 	sxth	r3, r10
 	ldrh	r2, [r2]
 	cmp	r3, r2
-	bge	.L1560
+	bge	.L1602
 	ldr	r2, [sp, #28]
-	ldr	r0, .L1577
+	ldr	r0, .L1625
 	str	r3, [sp, #36]
 	ldrh	r2, [r2]
 	orr	r2, r3, r2, lsl #10
@@ -11981,31 +12027,34 @@ FtlMapTblRecovery:
 	ldr	r2, [r6, #12]
 	ldr	r2, [r2, #12]
 	str	r2, [sp, #32]
-	cbz	r2, .L1557
-	ldr	r1, .L1577+16
+	cbz	r2, .L1599
+	ldr	r1, [r6]
+	adds	r1, r1, #1
+	beq	.L1599
+	ldr	r1, .L1625+16
 	ldr	r0, [r6, #8]
 	ldrh	r1, [r1]
 	bl	js_hash
 	ldr	r2, [sp, #32]
 	cmp	r2, r0
-	beq	.L1557
+	beq	.L1599
 	str	r0, [sp, #4]
 	str	r2, [sp]
 	mov	r2, r5
 	ldr	r3, [sp, #36]
-	ldr	r1, .L1577+20
-	ldr	r0, .L1577+28
+	ldr	r1, .L1625+20
+	ldr	r0, .L1625+28
 	bl	printf
 	mov	r3, #-1
 	str	r3, [r6]
-.L1557:
+.L1599:
 	ldr	r3, [r6]
 	adds	r3, r3, #1
-	beq	.L1558
+	beq	.L1600
 	ldrh	r3, [fp, #8]
 	ldr	r2, [sp, #12]
 	cmp	r2, r3
-	bls	.L1558
+	bls	.L1600
 	ldrh	r1, [fp]
 	ldrh	r2, [r4, #4]
 	cmp	r1, r2
@@ -12013,47 +12062,47 @@ FtlMapTblRecovery:
 	ldreq	r2, [r6, #4]
 	ldreq	r1, [sp, #8]
 	streq	r2, [r1, r3, lsl #2]
-.L1558:
+.L1600:
 	add	r10, r10, #1
-	b	.L1553
-.L1552:
+	b	.L1595
+.L1594:
 	ldr	r3, [sp, #20]
 	movs	r1, #0
 	ldrh	r2, [r10]
 	ldr	r0, [r3]
 	add	lr, r2, #-1
-.L1554:
+.L1596:
 	sxth	r3, r1
 	cmp	r3, lr
-	blt	.L1556
-.L1560:
+	blt	.L1598
+.L1602:
 	adds	r7, r7, #1
-	b	.L1543
-.L1556:
+	b	.L1585
+.L1598:
 	lsls	r5, r3, #3
 	ldr	r3, [r0, r3, lsl #3]
 	ldr	r2, [sp, #12]
 	uxth	ip, r3
 	cmp	r2, ip
-	bls	.L1555
+	bls	.L1597
 	add	r5, r5, r0
 	ldr	r2, [sp, #8]
 	ldr	r5, [r5, #4]
 	str	r5, [r2, ip, lsl #2]
-.L1555:
+.L1597:
 	adds	r1, r1, #1
-	b	.L1554
-.L1578:
+	b	.L1596
+.L1626:
 	.align	2
-.L1577:
+.L1625:
 	.word	.LANCHOR138
 	.word	.LANCHOR106
 	.word	.LANCHOR114
 	.word	.LANCHOR20
 	.word	.LANCHOR23
 	.word	.LANCHOR180
-	.word	.LC39
-	.word	.LC40
+	.word	.LC47
+	.word	.LC48
 	.size	FtlMapTblRecovery, .-FtlMapTblRecovery
 	.section	.text.FtlLoadVonderInfo,"ax",%progbits
 	.align	1
@@ -12067,36 +12116,36 @@ FtlLoadVonderInfo:
 	@ args = 0, pretend = 0, frame = 0
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, lr}
-	ldr	r3, .L1580
-	ldr	r0, .L1580+4
+	ldr	r3, .L1628
+	ldr	r0, .L1628+4
 	ldrh	r3, [r3]
 	strh	r3, [r0, #10]	@ movhi
 	movw	r3, #61574
 	strh	r3, [r0, #4]	@ movhi
-	ldr	r3, .L1580+8
+	ldr	r3, .L1628+8
 	ldrh	r3, [r3]
 	strh	r3, [r0, #8]	@ movhi
-	ldr	r3, .L1580+12
+	ldr	r3, .L1628+12
 	ldrh	r3, [r3]
 	strh	r3, [r0, #6]	@ movhi
-	ldr	r3, .L1580+16
+	ldr	r3, .L1628+16
 	ldr	r3, [r3]
 	str	r3, [r0, #12]
-	ldr	r3, .L1580+20
+	ldr	r3, .L1628+20
 	ldr	r3, [r3]
 	str	r3, [r0, #16]
-	ldr	r3, .L1580+24
+	ldr	r3, .L1628+24
 	ldr	r3, [r3]
 	str	r3, [r0, #20]
-	ldr	r3, .L1580+28
+	ldr	r3, .L1628+28
 	ldr	r3, [r3]
 	str	r3, [r0, #24]
 	bl	FtlMapTblRecovery
 	movs	r0, #0
 	pop	{r3, pc}
-.L1581:
+.L1629:
 	.align	2
-.L1580:
+.L1628:
 	.word	.LANCHOR27
 	.word	.LANCHOR161
 	.word	.LANCHOR35
@@ -12119,13 +12168,13 @@ FtlLoadMapInfo:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, lr}
 	bl	FtlL2PDataInit
-	ldr	r0, .L1583
+	ldr	r0, .L1631
 	bl	FtlMapTblRecovery
 	movs	r0, #0
 	pop	{r3, pc}
-.L1584:
+.L1632:
 	.align	2
-.L1583:
+.L1631:
 	.word	.LANCHOR129
 	.size	FtlLoadMapInfo, .-FtlLoadMapInfo
 	.section	.text.FtlSysBlkInit,"ax",%progbits
@@ -12141,27 +12190,27 @@ FtlSysBlkInit:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r3, r4, r5, r6, r7, lr}
 	movs	r3, #0
-	ldr	r4, .L1598
+	ldr	r4, .L1646
 	strh	r3, [r4]	@ movhi
-	ldr	r3, .L1598+4
+	ldr	r3, .L1646+4
 	ldrh	r0, [r3]
 	bl	FtlFreeSysBlkQueueInit
 	bl	FtlScanSysBlk
-	ldr	r3, .L1598+8
+	ldr	r3, .L1646+8
 	ldrh	r2, [r3]
 	movw	r3, #65535
 	cmp	r2, r3
-	bne	.L1586
-.L1588:
+	bne	.L1634
+.L1636:
 	mov	r6, #-1
-.L1585:
+.L1633:
 	mov	r0, r6
 	pop	{r3, r4, r5, r6, r7, pc}
-.L1586:
+.L1634:
 	bl	FtlLoadSysInfo
 	mov	r6, r0
 	cmp	r0, #0
-	bne	.L1588
+	bne	.L1636
 	bl	FtlLoadMapInfo
 	bl	FtlLoadVonderInfo
 	bl	Ftl_load_ext_data
@@ -12171,40 +12220,40 @@ FtlSysBlkInit:
 	bl	FtlPowerLostRecovery
 	movs	r0, #1
 	bl	FtlUpdateVaildLpn
-	ldr	r3, .L1598+12
+	ldr	r3, .L1646+12
 	movs	r0, #12
 	ldrh	r1, [r3]
-	ldr	r3, .L1598+16
+	ldr	r3, .L1646+16
 	ldr	r2, [r3]
 	mov	r3, r6
-.L1589:
+.L1637:
 	cmp	r3, r1
-	bge	.L1594
+	bge	.L1642
 	mla	r5, r0, r3, r2
 	ldr	r5, [r5, #4]
 	cmp	r5, #0
-	bge	.L1590
-.L1594:
-	ldr	r0, .L1598+20
+	bge	.L1638
+.L1642:
+	ldr	r0, .L1646+20
 	cmp	r3, r1
 	ldr	r2, [r0]
 	add	r2, r2, #32
 	str	r2, [r0]
-	bge	.L1596
-.L1591:
-	ldr	r5, .L1598+24
-	ldr	r4, .L1598+28
+	bge	.L1644
+.L1639:
+	ldr	r5, .L1646+24
+	ldr	r4, .L1646+28
 	mov	r0, r5
 	bl	FtlSuperblockPowerLostFix
 	mov	r0, r4
 	bl	FtlSuperblockPowerLostFix
-	ldr	r3, .L1598+32
+	ldr	r3, .L1646+32
 	ldrh	r1, [r5]
 	ldrh	r0, [r5, #4]
 	ldr	r2, [r3]
 	ldrh	r3, [r2, r1, lsl #1]
 	subs	r3, r3, r0
-	ldr	r0, .L1598+36
+	ldr	r0, .L1646+36
 	strh	r3, [r2, r1, lsl #1]	@ movhi
 	ldrh	r7, [r4, #4]
 	ldrh	r3, [r0]
@@ -12220,27 +12269,27 @@ FtlSysBlkInit:
 	strb	r3, [r4, #6]
 	strh	r3, [r4, #4]	@ movhi
 	strh	r2, [r4, #2]	@ movhi
-	ldr	r2, .L1598+40
+	ldr	r2, .L1646+40
 	ldrh	r3, [r2, #30]
 	adds	r3, r3, #1
 	strh	r3, [r2, #30]	@ movhi
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-.L1597:
+.L1645:
 	bl	FtlVpcTblFlush
-	b	.L1585
-.L1590:
+	b	.L1633
+.L1638:
 	adds	r3, r3, #1
-	b	.L1589
-.L1596:
+	b	.L1637
+.L1644:
 	ldrh	r3, [r4]
 	cmp	r3, #0
-	bne	.L1591
+	bne	.L1639
 	bl	l2p_flush
-	b	.L1597
-.L1599:
+	b	.L1645
+.L1647:
 	.align	2
-.L1598:
+.L1646:
 	.word	.LANCHOR156
 	.word	.LANCHOR4
 	.word	.LANCHOR139
@@ -12266,62 +12315,64 @@ ftl_low_format:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r0, r1, r2, r3, r4, r5, r6, r7, r8, r10, fp, lr}
 	movs	r3, #0
-	ldr	r6, .L1624
-	ldr	r2, .L1624+4
-	ldr	r5, .L1624+8
-	ldrh	r0, [r6]
+	ldr	r2, .L1672
+	ldr	r6, .L1672+4
 	str	r3, [r2]
+	ldr	r5, .L1672+8
+	ldr	r2, .L1672+12
+	ldrh	r0, [r6]
 	str	r3, [r5]
+	str	r3, [r2]
 	bl	FtlFreeSysBlkQueueInit
 	bl	FtlLoadBbt
-	cbz	r0, .L1601
+	cbz	r0, .L1649
 	bl	FtlMakeBbt
-.L1601:
-	ldr	r3, .L1624+12
-	ldr	r2, .L1624+16
-	ldr	ip, .L1624+100
+.L1649:
+	ldr	r3, .L1672+16
+	ldr	r2, .L1672+20
+	ldr	ip, .L1672+104
 	ldrh	r1, [r3]
 	ldr	r4, [r2]
-	ldr	r2, .L1624+20
+	ldr	r2, .L1672+24
 	str	r3, [sp, #4]
 	lsls	r1, r1, #7
 	ldr	r7, [r2]
 	movs	r2, #0
-.L1602:
+.L1650:
 	uxth	r3, r2
 	adds	r2, r2, #1
 	cmp	r3, r1
-	blt	.L1603
-	ldr	r3, .L1624+24
+	blt	.L1651
+	ldr	r3, .L1672+28
 	movs	r7, #0
-	ldr	r10, .L1624+104
+	ldr	r10, .L1672+108
 	ldrh	r4, [r3]
 	mov	r8, r3
 	mov	fp, r10
-.L1604:
+.L1652:
 	ldrh	r3, [r10]
 	cmp	r3, r4
-	bhi	.L1605
-	ldr	r4, .L1624+28
+	bhi	.L1653
+	ldr	r4, .L1672+32
 	subs	r3, r7, #2
 	ldrh	r1, [r4]
 	cmp	r3, r1, lsl #1
-	bgt	.L1606
-.L1610:
+	bgt	.L1654
+.L1658:
 	movs	r6, #0
 	mov	r7, r6
-.L1607:
+.L1655:
 	ldrh	r3, [r8]
 	uxth	r0, r6
 	adds	r6, r6, #1
 	cmp	r3, r0
-	bhi	.L1611
+	bhi	.L1659
 	ldrh	r2, [fp]
-	ldr	r3, .L1624+32
+	ldr	r3, .L1672+36
 	ldrh	r4, [r4]
-	ldr	r6, .L1624+36
+	ldr	r6, .L1672+40
 	str	r2, [r3]
-	ldr	r3, .L1624+40
+	ldr	r3, .L1672+44
 	mov	r1, r4
 	ldr	r2, [r3]
 	mov	r0, r2
@@ -12331,13 +12382,13 @@ ftl_low_format:
 	mov	r3, r0
 	str	r0, [r6]
 	add	r1, r10, #36
-	ldr	r0, .L1624+44
+	ldr	r0, .L1672+48
 	strh	r1, [r0]	@ movhi
 	movs	r1, #24
 	muls	r1, r4, r1
 	str	r0, [sp]
 	cmp	r7, r1
-	ble	.L1612
+	ble	.L1660
 	ldr	r2, [sp, #12]
 	mov	r1, r4
 	str	r3, [sp, #8]
@@ -12349,11 +12400,11 @@ ftl_low_format:
 	adds	r0, r0, #24
 	strh	r0, [r3]	@ movhi
 	ldr	r3, [sp, #8]
-.L1612:
-	ldr	r2, .L1624+48
+.L1660:
+	ldr	r2, .L1672+52
 	ldrh	r2, [r2]
-	cbz	r2, .L1614
-	ldr	r1, .L1624+44
+	cbz	r2, .L1662
+	ldr	r1, .L1672+48
 	ldrh	r0, [r1]
 	add	r0, r0, r2, lsr #1
 	strh	r0, [r1]	@ movhi
@@ -12364,24 +12415,24 @@ ftl_low_format:
 	strlt	r3, [r6]
 	addlt	r2, r2, r10
 	strhlt	r2, [r1]	@ movhi
-.L1614:
+.L1662:
 	ldr	r3, [sp]
-	ldr	r7, .L1624+52
-	ldr	r10, .L1624+108
+	ldr	r7, .L1672+56
+	ldr	r10, .L1672+112
 	ldrh	r2, [r3]
 	ldr	r3, [r6]
 	subs	r3, r3, r2
 	muls	r4, r3, r4
-	ldr	r3, .L1624+56
+	ldr	r3, .L1672+60
 	ldrh	r3, [r3]
 	str	r4, [r7]
 	muls	r4, r3, r4
 	ldr	r3, [sp, #4]
 	ldrh	r3, [r3]
 	str	r4, [r6]
-	ldr	r6, .L1624+60
+	ldr	r6, .L1672+64
 	muls	r4, r3, r4
-	ldr	r3, .L1624+64
+	ldr	r3, .L1672+68
 	str	r4, [r3]
 	movw	r4, #65535
 	bl	FtlBbmTblFlush
@@ -12390,13 +12441,13 @@ ftl_low_format:
 	ldr	r0, [r10]
 	lsls	r2, r2, #1
 	bl	ftl_memset
-	ldr	r2, .L1624+68
+	ldr	r2, .L1672+72
 	movs	r3, #0
 	strh	r3, [r6, #2]	@ movhi
 	movs	r1, #255
 	strb	r3, [r6, #6]
 	str	r3, [r2]
-	ldr	r2, .L1624+72
+	ldr	r2, .L1672+76
 	strh	r3, [r6]	@ movhi
 	strh	r3, [r2, #2]	@ movhi
 	strb	r3, [r2, #6]
@@ -12407,30 +12458,30 @@ ftl_low_format:
 	mov	r8, r10
 	strb	r3, [r6, #8]
 	mov	r10, r6
-	ldr	r3, .L1624+76
+	ldr	r3, .L1672+80
 	lsrs	r2, r2, #3
 	ldr	r0, [r3]
 	bl	ftl_memset
-.L1616:
+.L1664:
 	mov	r0, r10
 	bl	make_superblock
 	ldrb	r3, [r6, #7]	@ zero_extendqisi2
 	ldrh	r2, [r6]
 	cmp	r3, #0
-	bne	.L1617
+	bne	.L1665
 	ldr	r3, [r8]
 	strh	r4, [r3, r2, lsl #1]	@ movhi
 	ldrh	r3, [r6]
 	adds	r3, r3, #1
 	strh	r3, [r6]	@ movhi
-	b	.L1616
-.L1603:
+	b	.L1664
+.L1651:
 	mvns	r0, r3
 	orr	r0, r3, r0, lsl #16
 	str	r0, [r4, r3, lsl #2]
 	str	ip, [r7, r3, lsl #2]
-	b	.L1602
-.L1605:
+	b	.L1650
+.L1653:
 	mov	r0, r4
 	movs	r1, #1
 	bl	FtlLowFormatEraseBlock
@@ -12438,11 +12489,11 @@ ftl_low_format:
 	add	r7, r7, r0
 	uxth	r7, r7
 	uxth	r4, r4
-	b	.L1604
-.L1606:
+	b	.L1652
+.L1654:
 	mov	r0, r7
 	bl	__aeabi_uidiv
-	ldr	r3, .L1624+80
+	ldr	r3, .L1672+84
 	ldr	r3, [r3]
 	add	r0, r0, r3
 	uxth	r0, r0
@@ -12450,26 +12501,26 @@ ftl_low_format:
 	ldrh	r0, [r6]
 	bl	FtlFreeSysBlkQueueInit
 	ldrh	r6, [r8]
-.L1608:
+.L1656:
 	ldrh	r3, [fp]
 	cmp	r3, r6
-	bls	.L1610
+	bls	.L1658
 	mov	r0, r6
 	movs	r1, #1
 	adds	r6, r6, #1
 	bl	FtlLowFormatEraseBlock
 	uxth	r6, r6
-	b	.L1608
-.L1611:
+	b	.L1656
+.L1659:
 	movs	r1, #0
 	bl	FtlLowFormatEraseBlock
 	add	r7, r7, r0
 	uxth	r7, r7
-	b	.L1607
-.L1617:
+	b	.L1655
+.L1665:
 	ldr	r3, [r5]
 	ldrh	r1, [r6, #4]
-	ldr	r4, .L1624+84
+	ldr	r4, .L1672+88
 	str	r3, [r6, #12]
 	adds	r3, r3, #1
 	str	r3, [r5]
@@ -12485,19 +12536,19 @@ ftl_low_format:
 	strh	r3, [r4]	@ movhi
 	movs	r3, #1
 	strb	r3, [r4, #8]
-.L1618:
+.L1666:
 	mov	r0, r10
 	bl	make_superblock
 	ldrb	r3, [r4, #7]	@ zero_extendqisi2
 	ldrh	r2, [r4]
-	cbnz	r3, .L1619
+	cbnz	r3, .L1667
 	ldr	r3, [r8]
 	strh	r6, [r3, r2, lsl #1]	@ movhi
 	ldrh	r3, [r4]
 	adds	r3, r3, #1
 	strh	r3, [r4]	@ movhi
-	b	.L1618
-.L1619:
+	b	.L1666
+.L1667:
 	ldr	r3, [r5]
 	ldrh	r1, [r4, #4]
 	str	r3, [r4, #12]
@@ -12506,10 +12557,10 @@ ftl_low_format:
 	movw	r4, #65535
 	ldr	r3, [r8]
 	strh	r1, [r3, r2, lsl #1]	@ movhi
-	ldr	r3, .L1624+88
+	ldr	r3, .L1672+92
 	strh	r4, [r3]	@ movhi
 	bl	FtlFreeSysBlkQueueOut
-	ldr	r3, .L1624+92
+	ldr	r3, .L1672+96
 	movs	r2, #0
 	strh	r2, [r3, #2]	@ movhi
 	ldr	r2, [r7]
@@ -12522,21 +12573,22 @@ ftl_low_format:
 	str	r2, [r5]
 	bl	FtlVpcTblFlush
 	bl	FtlSysBlkInit
-	cbnz	r0, .L1620
-	ldr	r3, .L1624+96
+	cbnz	r0, .L1668
+	ldr	r3, .L1672+100
 	movs	r2, #1
 	str	r2, [r3]
-.L1620:
+.L1668:
 	movs	r0, #0
 	add	sp, sp, #16
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1625:
+.L1673:
 	.align	2
-.L1624:
-	.word	.LANCHOR4
+.L1672:
 	.word	.LANCHOR83
+	.word	.LANCHOR4
 	.word	.LANCHOR82
+	.word	.LANCHOR143
 	.word	.LANCHOR12
 	.word	.LANCHOR109
 	.word	.LANCHOR110
@@ -12552,7 +12604,7 @@ ftl_low_format:
 	.word	.LANCHOR51
 	.word	.LANCHOR34
 	.word	.LANCHOR59
-	.word	.LANCHOR144
+	.word	.LANCHOR145
 	.word	.LANCHOR1
 	.word	.LANCHOR31
 	.word	.LANCHOR52
@@ -12576,60 +12628,46 @@ sftl_init:
 	@ frame_needed = 0, uses_anonymous_args = 0
 	push	{r4, r5, r6, lr}
 	mov	r3, #-1
-	ldr	r4, .L1643
+	ldr	r4, .L1686
 	movs	r6, #0
-	ldr	r1, .L1643+4
-	ldr	r0, .L1643+8
+	ldr	r1, .L1686+4
+	ldr	r0, .L1686+8
 	str	r3, [r4]
 	bl	printf
-	ldr	r0, .L1643+12
+	ldr	r0, .L1686+12
 	bl	FtlConstantsInit
-	ldr	r5, .L1643+16
+	ldr	r5, .L1686+16
 	bl	FtlMemInit
 	bl	FtlVariablesInit
-	ldr	r3, .L1643+20
+	ldr	r3, .L1686+20
 	ldrh	r0, [r3]
 	bl	FtlFreeSysBlkQueueInit
-.L1627:
+.L1675:
 	bl	FtlLoadBbt
-	cbz	r0, .L1628
-.L1642:
+	cbz	r0, .L1676
+.L1685:
 	ldr	r3, [r5]
 	cmp	r3, #1
-	bne	.L1627
+	bne	.L1675
 	str	r6, [r5]
 	bl	ftl_low_format
-	b	.L1627
-.L1628:
+	b	.L1675
+.L1676:
 	bl	FtlSysBlkInit
 	cmp	r0, #0
-	bne	.L1642
+	bne	.L1685
 	movs	r3, #1
 	str	r3, [r4]
-	ldr	r3, .L1643+24
-	ldrh	r3, [r3]
-	cmp	r3, #15
-	bhi	.L1640
-	movw	r4, #8129
-.L1634:
-	movs	r1, #1
-	movs	r0, #0
-	bl	rk_ftl_garbage_collect
-	subs	r4, r4, #1
-	bne	.L1634
-.L1640:
-	movs	r0, #0
 	pop	{r4, r5, r6, pc}
-.L1644:
+.L1687:
 	.align	2
-.L1643:
+.L1686:
 	.word	.LANCHOR166
-	.word	.LC41
-	.word	.LC34
+	.word	.LC49
+	.word	.LC38
 	.word	.LANCHOR0
 	.word	.LANCHOR181
 	.word	.LANCHOR4
-	.word	.LANCHOR48
 	.size	sftl_init, .-sftl_init
 	.section	.text.FtlWriteToIDB,"ax",%progbits
 	.align	1
@@ -12650,33 +12688,33 @@ FtlWriteToIDB:
 	mov	r4, r0
 	mov	r6, r1
 	mov	r7, r2
-	ldr	r5, .L1715
-	bls	.L1646
+	ldr	r5, .L1758
+	bls	.L1689
 	cmp	r0, #576
-	bcc	.L1647
-.L1646:
+	bcc	.L1690
+.L1689:
 	ldr	r3, [r5]
-	cbnz	r3, .L1648
-.L1714:
+	cbnz	r3, .L1691
+.L1757:
 	movs	r4, #0
-	b	.L1645
-.L1648:
-	ldr	r3, .L1715+4
+	b	.L1688
+.L1691:
+	ldr	r3, .L1758+4
 	ldr	r3, [r3]
 	ldr	r2, [r3]
 	str	r3, [sp, #12]
-	ldr	r3, .L1715+8
+	ldr	r3, .L1758+8
 	cmp	r2, r3
-	bne	.L1650
-	ldr	r3, .L1715+12
+	bne	.L1693
+	ldr	r3, .L1758+12
 	movs	r2, #0
 	ldrh	r1, [r3, #10]
 	ldr	r3, [sp, #12]
 	add	r0, r3, #262144
 	movw	r3, #65535
-.L1654:
+.L1697:
 	ldr	r4, [r0, #-4]
-	cbnz	r4, .L1651
+	cbnz	r4, .L1694
 	ldr	r4, [sp, #12]
 	subs	r3, r3, #1
 	ldr	r4, [r4, r2, lsl #2]
@@ -12686,18 +12724,18 @@ FtlWriteToIDB:
 	movhi	r2, #0
 	cmp	r3, #4096
 	str	r4, [r0, #-4]!
-	bne	.L1654
+	bne	.L1697
 	mov	r3, #512
-	b	.L1711
-.L1651:
+	b	.L1754
+.L1694:
 	adds	r3, r3, #127
 	lsrs	r3, r3, #7
-.L1711:
+.L1754:
 	str	r3, [sp, #16]
 	lsls	r1, r1, #2
 	ldr	r3, [sp, #16]
 	uxth	r1, r1
-	ldr	r4, .L1715+16
+	ldr	r4, .L1758+16
 	adds	r0, r3, #4
 	bl	__aeabi_uidiv
 	adds	r3, r0, #1
@@ -12708,53 +12746,53 @@ FtlWriteToIDB:
 	movs	r3, #0
 	mov	r10, r3
 	str	r3, [sp, #20]
-.L1676:
-	ldr	r3, .L1715+20
+.L1719:
+	ldr	r3, .L1758+20
 	mov	r2, #512
 	movs	r1, #0
 	ldr	r0, [r3]
 	bl	memset
-	ldr	r3, .L1715+12
+	ldr	r3, .L1758+12
 	ldrh	r6, [r3, #10]
 	ldr	r3, [r4, #16]
 	mul	fp, r10, r6
 	cmp	r3, #0
-	beq	.L1684
+	beq	.L1727
 	ldr	r3, [r4, #20]
 	cmp	r3, #0
 	ite	eq
 	moveq	r3, #6
 	movne	r3, #9
-.L1712:
+.L1755:
 	str	r3, [sp, #28]
 	mov	r1, fp
-	ldr	r3, .L1715+16
+	ldr	r3, .L1758+16
 	movs	r0, #0
 	ldr	r3, [r3, #4]
 	blx	r3
 	ldr	r3, [sp, #24]
 	cmp	r3, #1
-	beq	.L1656
-	ldr	r3, .L1715+16
+	beq	.L1699
+	ldr	r3, .L1758+16
 	add	r1, r6, fp
 	movs	r0, #0
 	ldr	r3, [r3, #4]
 	blx	r3
-.L1656:
+.L1699:
 	ldr	r3, [sp, #28]
 	cmp	r3, #9
-	bne	.L1686
-	ldr	r3, .L1715+20
+	bne	.L1729
+	ldr	r3, .L1758+20
 	mov	r2, #1024
 	movs	r1, #0
 	ldr	r5, [r3]
 	mov	r0, r5
 	bl	ftl_memset
 	movs	r2, #4
-	ldr	r3, .L1715+24
+	ldr	r3, .L1758+24
 	strb	r2, [r5, #17]
 	movs	r1, #12
-	ldr	r2, .L1715+12
+	ldr	r2, .L1758+12
 	adds	r0, r5, r1
 	str	r3, [r5]
 	movs	r3, #0
@@ -12769,7 +12807,7 @@ FtlWriteToIDB:
 	strh	r3, [r5, #22]	@ movhi
 	bl	js_hash
 	str	r0, [r5, #8]
-.L1657:
+.L1700:
 	ldr	r3, [sp, #24]
 	mov	r8, fp
 	muls	r3, r6, r3
@@ -12777,10 +12815,10 @@ FtlWriteToIDB:
 	str	r3, [sp, #40]
 	ldr	r3, [sp, #12]
 	str	r3, [sp, #32]
-.L1658:
+.L1701:
 	ldr	r3, [sp, #40]
 	cmp	r6, r3
-	beq	.L1665
+	beq	.L1708
 	ldr	r3, [sp, #28]
 	cmp	r3, #9
 	itet	ne
@@ -12791,10 +12829,10 @@ FtlWriteToIDB:
 	movw	r3, #61424
 	str	r3, [sp, #52]
 	cmp	r6, #0
-	bne	.L1661
+	bne	.L1704
 	ldr	r3, [sp, #28]
 	cmp	r3, #9
-	bne	.L1661
+	bne	.L1704
 	ldr	r3, [r4, #16]
 	movs	r0, #70
 	blx	r3
@@ -12804,40 +12842,40 @@ FtlWriteToIDB:
 	mov	r0, r6
 	ldr	r7, [r4, #8]
 	blx	r7
-	ldr	r2, .L1715+12
+	ldr	r2, .L1758+12
 	str	r0, [sp, #44]
 	ldr	r3, [r4, #16]
 	ldrb	r0, [r2, #22]	@ zero_extendqisi2
 	blx	r3
 	ldr	r2, [sp, #44]
 	adds	r2, r2, #1
-	bne	.L1662
-.L1665:
-	ldr	r3, .L1715+20
+	bne	.L1705
+.L1708:
+	ldr	r3, .L1758+20
 	ldr	r2, [r4, #16]
 	ldr	r6, [r3]
-	ldr	r3, .L1715+12
+	ldr	r3, .L1758+12
 	ldrb	r3, [r3, #14]	@ zero_extendqisi2
 	str	r3, [sp, #28]
-	ldr	r3, .L1715+12
+	ldr	r3, .L1758+12
 	ldrh	r3, [r3, #10]
 	mul	r8, r10, r3
 	cmp	r2, #0
-	bne	.L1663
+	bne	.L1706
 	mov	fp, #6
-.L1664:
+.L1707:
 	ldr	r2, [sp, #24]
 	movs	r5, #0
 	muls	r3, r2, r3
 	str	r3, [sp, #32]
-.L1667:
+.L1710:
 	ldr	r3, [sp, #32]
 	cmp	r5, r3
-	beq	.L1671
+	beq	.L1714
 	cmp	r5, #0
-	bne	.L1668
+	bne	.L1711
 	cmp	fp, #9
-	bne	.L1668
+	bne	.L1711
 	ldr	r3, [r4, #16]
 	movs	r0, #70
 	blx	r3
@@ -12853,77 +12891,77 @@ FtlWriteToIDB:
 	ldr	r3, [r4, #20]
 	ldr	r0, [sp, #28]
 	blx	r3
-	ldr	r2, .L1715+12
+	ldr	r2, .L1758+12
 	ldr	r3, [r4, #16]
 	ldrb	r0, [r2, #22]	@ zero_extendqisi2
 	blx	r3
 	ldr	r3, [r6]
-	ldr	r2, .L1715+24
+	ldr	r2, .L1758+24
 	cmp	r3, r2
-	beq	.L1669
-.L1671:
-	ldr	r3, .L1715+20
+	beq	.L1712
+.L1714:
+	ldr	r3, .L1758+20
 	movs	r5, #0
 	ldr	r1, [sp, #12]
 	ldr	r0, [r3]
-.L1670:
+.L1713:
 	mov	r8, r1
 	ldr	r2, [r0, r5, lsl #2]
 	ldr	r3, [r8]
 	lsls	r6, r5, #2
 	adds	r1, r1, #4
 	cmp	r2, r3
-	beq	.L1673
+	beq	.L1716
 	mov	r2, #512
 	movs	r1, #0
 	bl	memset
-	ldr	r3, .L1715+20
+	ldr	r3, .L1758+20
 	mov	r1, r10
-	ldr	r0, .L1715+28
+	ldr	r0, .L1758+28
 	ldr	r2, [r3]
 	str	r5, [sp]
 	ldr	r3, [r8]
 	ldr	r2, [r2, r6]
 	bl	printf
-	ldr	r3, .L1715+12
+	ldr	r3, .L1758+12
 	movs	r0, #0
 	ldrh	r1, [r3, #10]
 	ldr	r3, [r4, #4]
 	mul	r1, r10, r1
 	blx	r3
-.L1674:
+.L1717:
 	ldr	r3, [sp, #24]
 	add	r10, r10, r3
 	cmp	r10, #15
-	bls	.L1676
+	bls	.L1719
 	ldr	r3, [sp, #20]
-	cbnz	r3, .L1677
-.L1650:
+	cbnz	r3, .L1720
+.L1693:
 	mov	r3, #-1
 	str	r3, [sp, #16]
-.L1677:
-	ldr	r3, .L1715
+.L1720:
+	ldr	r3, .L1758
 	movs	r2, #0
 	ldr	r4, [sp, #16]
 	str	r2, [r3]
-	ldr	r3, .L1715+4
+	ldr	r3, .L1758+4
 	ldr	r0, [r3]
 	bl	free
-	ldr	r3, .L1715+20
+	ldr	r3, .L1758+20
 	ldr	r0, [r3]
 	bl	free
-.L1645:
+.L1688:
 	mov	r0, r4
 	add	sp, sp, #112
 	@ sp needed
 	pop	{r4, r5, r6, r7, r8, r10, fp, pc}
-.L1684:
+.L1727:
 	movs	r3, #6
-	b	.L1712
-.L1686:
+	b	.L1755
+.L1729:
 	movs	r5, #0
-	b	.L1657
-.L1661:
+	b	.L1700
+.L1704:
 	add	r3, sp, #48
 	ldr	r2, [sp, #32]
 	mov	r1, r8
@@ -12931,22 +12969,22 @@ FtlWriteToIDB:
 	ldr	r7, [r4, #8]
 	blx	r7
 	adds	r0, r0, #1
-	beq	.L1665
+	beq	.L1708
 	ldr	r3, [sp, #32]
 	add	r3, r3, #2048
 	str	r3, [sp, #32]
-.L1662:
+.L1705:
 	adds	r6, r6, #1
 	add	r8, r8, #1
-	b	.L1658
-.L1663:
+	b	.L1701
+.L1706:
 	ldr	r2, [r4, #20]
 	cmp	r2, #0
 	ite	eq
 	moveq	fp, #6
 	movne	fp, #9
-	b	.L1664
-.L1668:
+	b	.L1707
+.L1711:
 	add	r3, sp, #48
 	mov	r2, r6
 	add	r1, r8, r5
@@ -12954,18 +12992,18 @@ FtlWriteToIDB:
 	ldr	r7, [r4, #12]
 	blx	r7
 	adds	r0, r0, #1
-	beq	.L1671
+	beq	.L1714
 	ldr	r2, [sp, #52]
 	movw	r3, #61424
 	cmp	r2, r3
-	bne	.L1671
+	bne	.L1714
 	add	r6, r6, #2048
-.L1669:
+.L1712:
 	adds	r5, r5, #1
-	b	.L1667
-.L1716:
+	b	.L1710
+.L1759:
 	.align	2
-.L1715:
+.L1758:
 	.word	.LANCHOR182
 	.word	.LANCHOR183
 	.word	-52655045
@@ -12973,46 +13011,46 @@ FtlWriteToIDB:
 	.word	.LANCHOR78
 	.word	.LANCHOR184
 	.word	1179535694
-	.word	.LC42
-.L1673:
+	.word	.LC50
+.L1716:
 	ldr	r3, [sp, #36]
 	adds	r5, r5, #1
 	cmp	r5, r3
-	bne	.L1670
+	bne	.L1713
 	ldr	r3, [sp, #20]
 	adds	r3, r3, #1
 	cmp	r3, #5
 	str	r3, [sp, #20]
-	bls	.L1674
-	b	.L1677
-.L1647:
+	bls	.L1717
+	b	.L1720
+.L1690:
 	cmp	r0, #64
-	bne	.L1678
-	ldr	fp, .L1717+4
+	bne	.L1721
+	ldr	fp, .L1760+4
 	mov	r0, #262144
 	bl	ftl_malloc
 	str	r0, [fp]
 	mov	r0, #262144
 	bl	ftl_malloc
-	ldr	r3, .L1717
+	ldr	r3, .L1760
 	str	r0, [r3]
 	ldr	r3, [fp]
-	cbz	r3, .L1679
-	cbz	r0, .L1679
+	cbz	r3, .L1722
+	cbz	r0, .L1722
 	movs	r2, #1
 	movs	r1, #0
 	str	r2, [r5]
 	mov	r0, r3
 	mov	r2, #262144
 	bl	ftl_memset
-.L1678:
+.L1721:
 	ldr	r3, [r5]
 	cmp	r3, #0
-	beq	.L1714
-	ldr	r3, .L1717+4
+	beq	.L1757
+	ldr	r3, .L1760+4
 	cmp	r4, #63
 	iteee	hi
-	ldrhi	r5, .L1717+8
+	ldrhi	r5, .L1760+8
 	rsbls	r4, r4, #64
 	subls	r6, r6, r4
 	addls	r7, r7, r4, lsl #9
@@ -13020,7 +13058,7 @@ FtlWriteToIDB:
 	mov	r2, #262144
 	it	hi
 	addhi	r5, r5, r4
-	ldr	r0, .L1717+12
+	ldr	r0, .L1760+12
 	ite	ls
 	movls	r5, r1
 	addhi	r5, r1, r5, lsl #9
@@ -13035,21 +13073,21 @@ FtlWriteToIDB:
 	mov	r1, r7
 	mov	r0, r5
 	bl	ftl_memcpy
-	b	.L1714
-.L1679:
-	ldr	r1, .L1717+16
-	ldr	r0, .L1717+20
+	b	.L1757
+.L1722:
+	ldr	r1, .L1760+16
+	ldr	r0, .L1760+20
 	bl	printf
-	b	.L1678
-.L1718:
+	b	.L1721
+.L1761:
 	.align	2
-.L1717:
+.L1760:
 	.word	.LANCHOR184
 	.word	.LANCHOR183
 	.word	8388544
-	.word	.LC44
+	.word	.LC52
 	.word	.LANCHOR185
-	.word	.LC43
+	.word	.LC51
 	.size	FtlWriteToIDB, .-FtlWriteToIDB
 	.section	.text.sftl_write,"ax",%progbits
 	.align	1
@@ -13715,7 +13753,7 @@ g_gc_skip_write_count:
 	.space	4
 	.section	.bss.g_gc_superblock,"aw",%nobits
 	.align	2
-	.set	.LANCHOR144,. + 0
+	.set	.LANCHOR145,. + 0
 	.type	g_gc_superblock, %object
 	.size	g_gc_superblock, 48
 g_gc_superblock:
@@ -13778,7 +13816,7 @@ g_nand_phy_info:
 	.space	24
 	.section	.bss.g_num_data_superblocks,"aw",%nobits
 	.align	1
-	.set	.LANCHOR45,. + 0
+	.set	.LANCHOR44,. + 0
 	.type	g_num_data_superblocks, %object
 	.size	g_num_data_superblocks, 2
 g_num_data_superblocks:
@@ -13841,7 +13879,7 @@ g_tmp_data_superblock_id:
 	.space	2
 	.section	.bss.g_totle_avg_erase_count,"aw",%nobits
 	.align	2
-	.set	.LANCHOR145,. + 0
+	.set	.LANCHOR143,. + 0
 	.type	g_totle_avg_erase_count, %object
 	.size	g_totle_avg_erase_count, 4
 g_totle_avg_erase_count:
@@ -14029,21 +14067,21 @@ p_data_block_list_table:
 	.space	4
 	.section	.bss.p_data_block_list_tail,"aw",%nobits
 	.align	2
-	.set	.LANCHOR44,. + 0
+	.set	.LANCHOR43,. + 0
 	.type	p_data_block_list_tail, %object
 	.size	p_data_block_list_tail, 4
 p_data_block_list_tail:
 	.space	4
 	.section	.bss.p_erase_count_table,"aw",%nobits
 	.align	2
-	.set	.LANCHOR43,. + 0
+	.set	.LANCHOR47,. + 0
 	.type	p_erase_count_table, %object
 	.size	p_erase_count_table, 4
 p_erase_count_table:
 	.space	4
 	.section	.bss.p_free_data_block_list_head,"aw",%nobits
 	.align	2
-	.set	.LANCHOR47,. + 0
+	.set	.LANCHOR46,. + 0
 	.type	p_free_data_block_list_head, %object
 	.size	p_free_data_block_list_head, 4
 p_free_data_block_list_head:
@@ -14312,316 +14350,334 @@ power_up_flag:
 .LC8:
 	.ascii	"not free: w: s:\000"
 	.section	.rodata.FlashProgPages.str1.1,"aMS",%progbits,1
-.LC11:
+.LC14:
 	.ascii	"prog read error: = %x\012\000"
-.LC12:
+.LC15:
+	.ascii	"prog read REFRESH: = %x\012\000"
+.LC16:
 	.ascii	"prog read s error: = %x %x %x\012\000"
-.LC13:
+.LC17:
 	.ascii	"prog read d error: = %x %x %x\012\000"
+	.section	.rodata.FlashReadPages.str1.1,"aMS",%progbits,1
+.LC11:
+	.ascii	"FlashReadPages %x %x error_ecc_bits %d\012\000"
+.LC12:
+	.ascii	"data:\000"
+.LC13:
+	.ascii	"spare:\000"
 	.section	.rodata.FtlBbmMapBadBlock.str1.1,"aMS",%progbits,1
 .LC0:
 	.ascii	"phyBlk = 0x%x die = %d block_in_die = 0x%x 0x%8x\012"
 	.ascii	"\000"
 	.section	.rodata.FtlBbmTblFlush.str1.1,"aMS",%progbits,1
-.LC14:
+.LC18:
 	.ascii	"FtlBbmTblFlush id=%x,page=%x,previd=%x cnt=%d\012\000"
-.LC15:
+.LC19:
 	.ascii	"FtlBbmTblFlush error:%x\012\000"
-.LC16:
+.LC20:
 	.ascii	"FtlBbmTblFlush error = %x error count = %d\012\000"
 	.section	.rodata.FtlFreeSysBlkQueueOut.str1.1,"aMS",%progbits,1
 .LC9:
 	.ascii	"FtlFreeSysBlkQueueOut = %x, free count = %d, error\012"
 	.ascii	"\000"
 	.section	.rodata.FtlGcScanTempBlk.str1.1,"aMS",%progbits,1
-.LC31:
+.LC35:
 	.ascii	"FtlGcScanTempBlk Error ID %x %x!!!!!!! \012\000"
 	.section	.rodata.FtlLoadEctTbl.str1.1,"aMS",%progbits,1
-.LC33:
+.LC37:
 	.ascii	"no ect\000"
-.LC34:
+.LC38:
 	.ascii	"%s\012\000"
 	.section	.rodata.FtlLoadSysInfo.str1.1,"aMS",%progbits,1
-.LC38:
+.LC46:
 	.ascii	"%s hash error this.id =%x page =%x pre_id =%x hash "
 	.ascii	"=%x hash_r =%x\012\000"
 	.section	.rodata.FtlMapTblRecovery.str1.1,"aMS",%progbits,1
-.LC39:
+.LC47:
 	.ascii	"%s last blk_id =%x page =%x hash error hash =%x has"
 	.ascii	"h_r =%x\012\000"
-.LC40:
+.LC48:
 	.ascii	"%s scan blk_id =%x page =%x hash error hash =%x has"
 	.ascii	"h_r =%x\012\000"
 	.section	.rodata.FtlMapWritePage.str1.1,"aMS",%progbits,1
-.LC18:
+.LC22:
 	.ascii	"FtlMapWritePage error = %x \012\000"
-.LC19:
+.LC23:
 	.ascii	"FtlMapWritePage error = %x error count = %d\012\000"
 	.section	.rodata.FtlProgPages.str1.1,"aMS",%progbits,1
-.LC36:
+.LC40:
+	.ascii	"FtlProgPages error %x = %d\012\000"
+.LC41:
 	.ascii	"Ftlwrite decrement_vpc_count %x = %d\012\000"
 	.section	.rodata.FtlRecoverySuperblock.str1.1,"aMS",%progbits,1
-.LC24:
+.LC27:
+	.ascii	"data prev_ppa = %x error...................\012\000"
+.LC28:
 	.ascii	"spuer block %x vpn is 0\012 \000"
 	.section	.rodata.FtlVendorPartRead.str1.1,"aMS",%progbits,1
-.LC32:
+.LC36:
 	.ascii	"FtlVendorPartRead refresh = %x phyAddr = %x\012\000"
 	.section	.rodata.FtlVpcTblFlush.str1.1,"aMS",%progbits,1
-.LC35:
+.LC39:
 	.ascii	"FtlVpcTblFlush error = %x error count = %d\012\000"
 	.section	.rodata.FtlWrite.str1.1,"aMS",%progbits,1
-.LC37:
+.LC44:
+	.ascii	"FtlWrite: ecc error:%x %x %x\012\000"
+.LC45:
 	.ascii	"FtlWrite: lpa error:%x %x\012\000"
 	.section	.rodata.FtlWriteToIDB.str1.1,"aMS",%progbits,1
-.LC42:
+.LC50:
 	.ascii	"write_idblock fail! %x %x %x %x\012\000"
-.LC43:
+.LC51:
 	.ascii	"%s idb buffer alloc fail\012\000"
-.LC44:
+.LC52:
 	.ascii	"%p %x %p %x\012\000"
 	.section	.rodata.INSERT_DATA_LIST.str1.1,"aMS",%progbits,1
 .LC1:
 	.ascii	"\012!!!!! error @ func:%s - line:%d\012\000"
-	.section	.rodata.__func__.10015,"a",%progbits
+	.section	.rodata.__func__.10006,"a",%progbits
 	.set	.LANCHOR175,. + 0
-	.type	__func__.10015, %object
-	.size	__func__.10015, 23
-__func__.10015:
+	.type	__func__.10006, %object
+	.size	__func__.10006, 23
+__func__.10006:
 	.ascii	"rk_ftl_garbage_collect\000"
-	.section	.rodata.__func__.10277,"a",%progbits
+	.section	.rodata.__func__.10278,"a",%progbits
 	.set	.LANCHOR137,. + 0
-	.type	__func__.10277, %object
-	.size	__func__.10277, 15
-__func__.10277:
+	.type	__func__.10278, %object
+	.size	__func__.10278, 15
+__func__.10278:
 	.ascii	"FlashReadPages\000"
-	.section	.rodata.__func__.10296,"a",%progbits
+	.section	.rodata.__func__.10297,"a",%progbits
 	.set	.LANCHOR142,. + 0
-	.type	__func__.10296, %object
-	.size	__func__.10296, 15
-__func__.10296:
+	.type	__func__.10297, %object
+	.size	__func__.10297, 15
+__func__.10297:
 	.ascii	"FlashProgPages\000"
-	.section	.rodata.__func__.10320,"a",%progbits
+	.section	.rodata.__func__.10321,"a",%progbits
 	.set	.LANCHOR77,. + 0
-	.type	__func__.10320, %object
-	.size	__func__.10320, 17
-__func__.10320:
+	.type	__func__.10321, %object
+	.size	__func__.10321, 17
+__func__.10321:
 	.ascii	"FlashEraseBlocks\000"
-	.section	.rodata.__func__.10435,"a",%progbits
+	.section	.rodata.__func__.10436,"a",%progbits
 	.set	.LANCHOR185,. + 0
-	.type	__func__.10435, %object
-	.size	__func__.10435, 14
-__func__.10435:
+	.type	__func__.10436, %object
+	.size	__func__.10436, 14
+__func__.10436:
 	.ascii	"FtlWriteToIDB\000"
-	.section	.rodata.__func__.8940,"a",%progbits
+	.section	.rodata.__func__.8930,"a",%progbits
 	.set	.LANCHOR169,. + 0
-	.type	__func__.8940, %object
-	.size	__func__.8940, 13
-__func__.8940:
+	.type	__func__.8930, %object
+	.size	__func__.8930, 13
+__func__.8930:
 	.ascii	"FtlProgPages\000"
-	.section	.rodata.__func__.8968,"a",%progbits
+	.section	.rodata.__func__.8958,"a",%progbits
 	.set	.LANCHOR177,. + 0
-	.type	__func__.8968, %object
-	.size	__func__.8968, 9
-__func__.8968:
+	.type	__func__.8958, %object
+	.size	__func__.8958, 9
+__func__.8958:
 	.ascii	"FtlWrite\000"
-	.section	.rodata.__func__.9043,"a",%progbits
+	.section	.rodata.__func__.9033,"a",%progbits
 	.set	.LANCHOR128,. + 0
-	.type	__func__.9043, %object
-	.size	__func__.9043, 14
-__func__.9043:
+	.type	__func__.9033, %object
+	.size	__func__.9033, 14
+__func__.9033:
 	.ascii	"FtlBbt2Bitmap\000"
-	.section	.rodata.__func__.9078,"a",%progbits
+	.section	.rodata.__func__.9068,"a",%progbits
 	.set	.LANCHOR141,. + 0
-	.type	__func__.9078, %object
-	.size	__func__.9078, 11
-__func__.9078:
+	.type	__func__.9068, %object
+	.size	__func__.9068, 11
+__func__.9068:
 	.ascii	"FtlLoadBbt\000"
-	.section	.rodata.__func__.9193,"a",%progbits
+	.section	.rodata.__func__.9183,"a",%progbits
 	.set	.LANCHOR49,. + 0
-	.type	__func__.9193, %object
-	.size	__func__.9193, 17
-__func__.9193:
+	.type	__func__.9183, %object
+	.size	__func__.9183, 17
+__func__.9183:
 	.ascii	"INSERT_FREE_LIST\000"
-	.section	.rodata.__func__.9198,"a",%progbits
-	.set	.LANCHOR46,. + 0
-	.type	__func__.9198, %object
-	.size	__func__.9198, 17
-__func__.9198:
+	.section	.rodata.__func__.9188,"a",%progbits
+	.set	.LANCHOR45,. + 0
+	.type	__func__.9188, %object
+	.size	__func__.9188, 17
+__func__.9188:
 	.ascii	"INSERT_DATA_LIST\000"
-	.section	.rodata.__func__.9229,"a",%progbits
+	.section	.rodata.__func__.9219,"a",%progbits
 	.set	.LANCHOR50,. + 0
-	.type	__func__.9229, %object
-	.size	__func__.9229, 17
-__func__.9229:
+	.type	__func__.9219, %object
+	.size	__func__.9219, 17
+__func__.9219:
 	.ascii	"List_remove_node\000"
-	.section	.rodata.__func__.9261,"a",%progbits
+	.section	.rodata.__func__.9251,"a",%progbits
 	.set	.LANCHOR54,. + 0
-	.type	__func__.9261, %object
-	.size	__func__.9261, 22
-__func__.9261:
+	.type	__func__.9251, %object
+	.size	__func__.9251, 22
+__func__.9251:
 	.ascii	"List_update_data_list\000"
-	.section	.rodata.__func__.9270,"a",%progbits
+	.section	.rodata.__func__.9260,"a",%progbits
 	.set	.LANCHOR150,. + 0
-	.type	__func__.9270, %object
-	.size	__func__.9270, 16
-__func__.9270:
+	.type	__func__.9260, %object
+	.size	__func__.9260, 16
+__func__.9260:
 	.ascii	"load_l2p_region\000"
-	.section	.rodata.__func__.9303,"a",%progbits
+	.section	.rodata.__func__.9293,"a",%progbits
 	.set	.LANCHOR81,. + 0
-	.type	__func__.9303, %object
-	.size	__func__.9303, 26
-__func__.9303:
+	.type	__func__.9293, %object
+	.size	__func__.9293, 26
+__func__.9293:
 	.ascii	"ftl_map_blk_alloc_new_blk\000"
-	.section	.rodata.__func__.9314,"a",%progbits
+	.section	.rodata.__func__.9304,"a",%progbits
 	.set	.LANCHOR151,. + 0
-	.type	__func__.9314, %object
-	.size	__func__.9314, 15
-__func__.9314:
+	.type	__func__.9304, %object
+	.size	__func__.9304, 15
+__func__.9304:
 	.ascii	"ftl_map_blk_gc\000"
-	.section	.rodata.__func__.9329,"a",%progbits
+	.section	.rodata.__func__.9319,"a",%progbits
 	.set	.LANCHOR148,. + 0
-	.type	__func__.9329, %object
-	.size	__func__.9329, 31
-__func__.9329:
+	.type	__func__.9319, %object
+	.size	__func__.9319, 31
+__func__.9319:
 	.ascii	"Ftl_write_map_blk_to_last_page\000"
-	.section	.rodata.__func__.9343,"a",%progbits
+	.section	.rodata.__func__.9333,"a",%progbits
 	.set	.LANCHOR149,. + 0
-	.type	__func__.9343, %object
-	.size	__func__.9343, 16
-__func__.9343:
+	.type	__func__.9333, %object
+	.size	__func__.9333, 16
+__func__.9333:
 	.ascii	"FtlMapWritePage\000"
-	.section	.rodata.__func__.9368,"a",%progbits
+	.section	.rodata.__func__.9358,"a",%progbits
 	.set	.LANCHOR57,. + 0
-	.type	__func__.9368, %object
-	.size	__func__.9368, 22
-__func__.9368:
+	.type	__func__.9358, %object
+	.size	__func__.9358, 22
+__func__.9358:
 	.ascii	"select_l2p_ram_region\000"
-	.section	.rodata.__func__.9385,"a",%progbits
+	.section	.rodata.__func__.9375,"a",%progbits
 	.set	.LANCHOR153,. + 0
-	.type	__func__.9385, %object
-	.size	__func__.9385, 9
-__func__.9385:
+	.type	__func__.9375, %object
+	.size	__func__.9375, 9
+__func__.9375:
 	.ascii	"log2phys\000"
-	.section	.rodata.__func__.9449,"a",%progbits
+	.section	.rodata.__func__.9439,"a",%progbits
 	.set	.LANCHOR165,. + 0
-	.type	__func__.9449, %object
-	.size	__func__.9449, 15
-__func__.9449:
+	.type	__func__.9439, %object
+	.size	__func__.9439, 15
+__func__.9439:
 	.ascii	"FtlVpcTblFlush\000"
-	.section	.rodata.__func__.9471,"a",%progbits
+	.section	.rodata.__func__.9461,"a",%progbits
 	.set	.LANCHOR140,. + 0
-	.type	__func__.9471, %object
-	.size	__func__.9471, 14
-__func__.9471:
+	.type	__func__.9461, %object
+	.size	__func__.9461, 14
+__func__.9461:
 	.ascii	"FtlScanSysBlk\000"
-	.section	.rodata.__func__.9527,"a",%progbits
+	.section	.rodata.__func__.9517,"a",%progbits
 	.set	.LANCHOR178,. + 0
-	.type	__func__.9527, %object
-	.size	__func__.9527, 15
-__func__.9527:
+	.type	__func__.9517, %object
+	.size	__func__.9517, 15
+__func__.9517:
 	.ascii	"FtlLoadSysInfo\000"
-	.section	.rodata.__func__.9549,"a",%progbits
+	.section	.rodata.__func__.9539,"a",%progbits
 	.set	.LANCHOR180,. + 0
-	.type	__func__.9549, %object
-	.size	__func__.9549, 18
-__func__.9549:
+	.type	__func__.9539, %object
+	.size	__func__.9539, 18
+__func__.9539:
 	.ascii	"FtlMapTblRecovery\000"
-	.section	.rodata.__func__.9595,"a",%progbits
+	.section	.rodata.__func__.9585,"a",%progbits
 	.set	.LANCHOR154,. + 0
-	.type	__func__.9595, %object
-	.size	__func__.9595, 16
-__func__.9595:
+	.type	__func__.9585, %object
+	.size	__func__.9585, 16
+__func__.9585:
 	.ascii	"FtlReUsePrevPpa\000"
-	.section	.rodata.__func__.9629,"a",%progbits
+	.section	.rodata.__func__.9619,"a",%progbits
 	.set	.LANCHOR155,. + 0
-	.type	__func__.9629, %object
-	.size	__func__.9629, 22
-__func__.9629:
+	.type	__func__.9619, %object
+	.size	__func__.9619, 22
+__func__.9619:
 	.ascii	"FtlRecoverySuperblock\000"
-	.section	.rodata.__func__.9686,"a",%progbits
+	.section	.rodata.__func__.9676,"a",%progbits
 	.set	.LANCHOR60,. + 0
-	.type	__func__.9686, %object
-	.size	__func__.9686, 16
-__func__.9686:
+	.type	__func__.9676, %object
+	.size	__func__.9676, 16
+__func__.9676:
 	.ascii	"make_superblock\000"
-	.section	.rodata.__func__.9707,"a",%progbits
+	.section	.rodata.__func__.9697,"a",%progbits
 	.set	.LANCHOR136,. + 0
-	.type	__func__.9707, %object
-	.size	__func__.9707, 18
-__func__.9707:
+	.type	__func__.9697, %object
+	.size	__func__.9697, 18
+__func__.9697:
 	.ascii	"SupperBlkListInit\000"
-	.section	.rodata.__func__.9734,"a",%progbits
+	.section	.rodata.__func__.9724,"a",%progbits
 	.set	.LANCHOR159,. + 0
-	.type	__func__.9734, %object
-	.size	__func__.9734, 14
-__func__.9734:
+	.type	__func__.9724, %object
+	.size	__func__.9724, 14
+__func__.9724:
 	.ascii	"ftl_check_vpc\000"
-	.section	.rodata.__func__.9799,"a",%progbits
-	.set	.LANCHOR143,. + 0
-	.type	__func__.9799, %object
-	.size	__func__.9799, 25
-__func__.9799:
+	.section	.rodata.__func__.9789,"a",%progbits
+	.set	.LANCHOR144,. + 0
+	.type	__func__.9789, %object
+	.size	__func__.9789, 25
+__func__.9789:
 	.ascii	"allocate_data_superblock\000"
-	.section	.rodata.__func__.9820,"a",%progbits
+	.section	.rodata.__func__.9810,"a",%progbits
 	.set	.LANCHOR168,. + 0
-	.type	__func__.9820, %object
-	.size	__func__.9820, 29
-__func__.9820:
+	.type	__func__.9810, %object
+	.size	__func__.9810, 29
+__func__.9810:
 	.ascii	"allocate_new_data_superblock\000"
-	.section	.rodata.__func__.9827,"a",%progbits
+	.section	.rodata.__func__.9817,"a",%progbits
 	.set	.LANCHOR61,. + 0
-	.type	__func__.9827, %object
-	.size	__func__.9827, 19
-__func__.9827:
+	.type	__func__.9817, %object
+	.size	__func__.9817, 19
+__func__.9817:
 	.ascii	"get_new_active_ppa\000"
-	.section	.rodata.__func__.9840,"a",%progbits
+	.section	.rodata.__func__.9830,"a",%progbits
 	.set	.LANCHOR146,. + 0
-	.type	__func__.9840, %object
-	.size	__func__.9840, 16
-__func__.9840:
+	.type	__func__.9830, %object
+	.size	__func__.9830, 16
+__func__.9830:
 	.ascii	"update_vpc_list\000"
-	.section	.rodata.__func__.9847,"a",%progbits
+	.section	.rodata.__func__.9837,"a",%progbits
 	.set	.LANCHOR147,. + 0
-	.type	__func__.9847, %object
-	.size	__func__.9847, 20
-__func__.9847:
+	.type	__func__.9837, %object
+	.size	__func__.9837, 20
+__func__.9837:
 	.ascii	"decrement_vpc_count\000"
-	.section	.rodata.__func__.9917,"a",%progbits
+	.section	.rodata.__func__.9907,"a",%progbits
 	.set	.LANCHOR170,. + 0
-	.type	__func__.9917, %object
-	.size	__func__.9917, 19
-__func__.9917:
+	.type	__func__.9907, %object
+	.size	__func__.9907, 19
+__func__.9907:
 	.ascii	"FtlGcFreeTempBlock\000"
 	.section	.rodata.decrement_vpc_count.str1.1,"aMS",%progbits,1
-.LC17:
+.LC21:
 	.ascii	"decrement_vpc_count %x = %d\012\000"
 	.section	.rodata.ftl_check_vpc.str1.1,"aMS",%progbits,1
-.LC25:
+.LC29:
 	.ascii	"...%s enter...\012\000"
-.LC26:
+.LC30:
 	.ascii	"FtlCheckVpc2 %x = %x  %x\012\000"
-.LC27:
+.LC31:
 	.ascii	"free blk vpc error %x = %x  %x\012\000"
 	.section	.rodata.ftl_map_blk_alloc_new_blk.str1.1,"aMS",%progbits,1
 .LC10:
 	.ascii	"FtlFreeSysBlkQueueOut = %x, free count = %d\012\000"
 	.section	.rodata.ftl_scan_all_data.str1.1,"aMS",%progbits,1
-.LC28:
+.LC32:
 	.ascii	"ftl_scan_all_data = %x\012\000"
-.LC29:
+.LC33:
 	.ascii	"scan lpa = %x ppa= %x\012\000"
-.LC30:
+.LC34:
 	.ascii	"lba = %x,addr= %x,spare= %x %x %x %x data=%x %x\012"
 	.ascii	"\000"
 	.section	.rodata.load_l2p_region.str1.1,"aMS",%progbits,1
-.LC20:
+.LC24:
 	.ascii	"region_id = %x phyAddr = %x\012\000"
-.LC21:
-	.ascii	"spare:\000"
-.LC22:
+.LC25:
 	.ascii	"map_ppn:\000"
-.LC23:
+.LC26:
 	.ascii	"load_l2p_region refresh = %x phyAddr = %x\012\000"
+	.section	.rodata.rk_ftl_garbage_collect.str1.1,"aMS",%progbits,1
+.LC42:
+	.ascii	"g_gc_superblock_free %x %x %x %x %x\012\000"
+.LC43:
+	.ascii	"lpa=%x, ppa=%x\012\000"
 	.section	.rodata.rknand_print_hex.str1.1,"aMS",%progbits,1
 .LC2:
 	.ascii	"%s 0x%x:\000"
@@ -14632,6 +14688,6 @@ __func__.9917:
 .LC5:
 	.ascii	"\012\000"
 	.section	.rodata.sftl_init.str1.1,"aMS",%progbits,1
-.LC41:
-	.ascii	"SFTL version: 5.0.50 20181227\000"
+.LC49:
+	.ascii	"SFTL version: 5.0.50 20190215\000"
 	.hidden	free
diff --git a/drivers/rkflash/rk_sftl_arm_v8.S b/drivers/rkflash/rk_sftl_arm_v8.S
index d54b12f7b3..8298fdd27c 100644
--- a/drivers/rkflash/rk_sftl_arm_v8.S
+++ b/drivers/rkflash/rk_sftl_arm_v8.S
@@ -2,7 +2,7 @@
  * Copyright (c) 2018 Fuzhou Rockchip Electronics Co., Ltd
  *
  * SPDX-License-Identifier:    GPL-2.0
- * date: 2018-12-27
+ * date: 2019-02-20
  */
 	.arch armv8-a+nosimd
 	.file	"rk_sftl.c"
@@ -545,105 +545,84 @@ IsInFreeQueue:
 insert_data_list:
 	adrp	x1, .LANCHOR5
 	and	w0, w0, 65535
-	ldrh	w14, [x1, #:lo12:.LANCHOR5]
-	cmp	w14, w0
-	bls	.L72
+	ldrh	w12, [x1, #:lo12:.LANCHOR5]
+	cmp	w12, w0
+	bls	.L58
 	adrp	x1, .LANCHOR40
-	mov	w3, 6
-	ldr	x6, [x1, #:lo12:.LANCHOR40]
-	umull	x13, w0, w3
+	mov	w8, 6
+	ldr	x4, [x1, #:lo12:.LANCHOR40]
+	umull	x10, w0, w8
 	mov	w1, -1
-	add	x5, x6, x13
-	strh	w1, [x5, 2]
-	strh	w1, [x6, x13]
+	add	x3, x4, x10
+	strh	w1, [x3, 2]
+	strh	w1, [x4, x10]
 	adrp	x1, .LANCHOR41
 	mov	x15, x1
-	ldr	x12, [x1, #:lo12:.LANCHOR41]
-	cbnz	x12, .L59
-	str	x5, [x1, #:lo12:.LANCHOR41]
-.L72:
+	ldr	x7, [x1, #:lo12:.LANCHOR41]
+	cbnz	x7, .L59
+	str	x3, [x1, #:lo12:.LANCHOR41]
+.L58:
 	mov	w0, 0
 	ret
 .L59:
-	stp	x29, x30, [sp, -32]!
 	adrp	x1, .LANCHOR42
-	ubfiz	x2, x0, 1, 16
-	mov	x4, -6148914691236517206
-	add	x29, sp, 0
-	ldr	x16, [x1, #:lo12:.LANCHOR42]
-	movk	x4, 0xaaab, lsl 0
-	ldrh	w1, [x5, 4]
-	mov	w8, -1
-	mov	w11, w8
-	stp	x19, x20, [sp, 16]
+	mov	x2, -6148914691236517206
+	movk	x2, 0xaaab, lsl 0
+	mov	w6, 0
+	ldr	x13, [x1, #:lo12:.LANCHOR42]
+	ubfiz	x1, x0, 1, 16
+	mov	w16, 65535
+	ldrh	w5, [x13, x1]
+	ldrh	w1, [x3, 4]
 	cmp	w1, 0
-	mov	w20, 65535
-	ldrh	w7, [x16, x2]
-	mul	w7, w7, w1
-	sub	x1, x12, x6
+	mul	w5, w5, w1
+	sub	x1, x7, x4
 	asr	x1, x1, 1
-	csel	w7, w7, w8, ne
-	mov	w8, w3
-	mul	x1, x1, x4
-	adrp	x4, .LANCHOR43
-	ldr	x17, [x4, #:lo12:.LANCHOR43]
+	csinv	w5, w5, wzr, ne
+	mul	x1, x1, x2
+	mov	x2, x7
 	and	w1, w1, 65535
-	mov	x4, x12
-	add	x10, x17, x2
-	mov	w2, 0
-.L67:
-	add	w2, w2, 1
-	and	w2, w2, 65535
-	cmp	w14, w2
+.L64:
+	add	w6, w6, 1
+	and	w6, w6, 65535
+	cmp	w12, w6
 	bcc	.L58
 	cmp	w1, w0
 	beq	.L58
-	ubfiz	x30, x1, 1, 16
-	ldrh	w19, [x4, 4]
-	cmp	w19, 0
-	ldrh	w3, [x16, x30]
-	mul	w3, w3, w19
-	csel	w3, w3, w11, ne
-	cmp	w7, w3
+	ldrh	w14, [x2, 4]
+	cbz	w14, .L62
+	ubfiz	x11, x1, 1, 16
+	ldrh	w11, [x13, x11]
+	mul	w11, w11, w14
+	cmp	w5, w11
+	bls	.L62
+	ldrh	w11, [x2]
+	cmp	w11, w16
 	bne	.L63
-	ldrh	w19, [x17, x30]
-	ldrh	w3, [x10]
-	cmp	w19, w3
-	bcc	.L65
-.L64:
-	strh	w1, [x6, x13]
-	cmp	x4, x12
-	ldrh	w1, [x4, 2]
-	strh	w1, [x5, 2]
-	bne	.L68
-	strh	w0, [x4, 2]
-	str	x5, [x15, #:lo12:.LANCHOR41]
+	strh	w1, [x3, 2]
+	strh	w0, [x2]
+	adrp	x0, .LANCHOR43
+	str	x3, [x0, #:lo12:.LANCHOR43]
 	b	.L58
 .L63:
-	bcc	.L64
+	umaddl	x2, w11, w8, x4
+	mov	w1, w11
+	b	.L64
+.L62:
+	strh	w1, [x4, x10]
+	cmp	x2, x7
+	ldrh	w1, [x2, 2]
+	strh	w1, [x3, 2]
+	bne	.L65
+	strh	w0, [x2, 2]
+	str	x3, [x15, #:lo12:.LANCHOR41]
+	b	.L58
 .L65:
-	ldrh	w3, [x4]
-	cmp	w3, w20
-	bne	.L66
-	strh	w1, [x5, 2]
-	strh	w0, [x4]
-	adrp	x0, .LANCHOR44
-	str	x5, [x0, #:lo12:.LANCHOR44]
-.L58:
-	mov	w0, 0
-	ldp	x19, x20, [sp, 16]
-	ldp	x29, x30, [sp], 32
-	ret
-.L66:
-	umaddl	x4, w3, w8, x6
-	mov	w1, w3
-	b	.L67
-.L68:
-	ldrh	w1, [x4, 2]
-	mov	w2, 6
-	umull	x1, w1, w2
-	strh	w0, [x6, x1]
-	strh	w0, [x4, 2]
+	ldrh	w1, [x2, 2]
+	mov	w3, 6
+	umull	x1, w1, w3
+	strh	w0, [x4, x1]
+	strh	w0, [x2, 2]
 	b	.L58
 	.size	insert_data_list, .-insert_data_list
 	.section	.text.INSERT_DATA_LIST,"ax",@progbits
@@ -654,23 +633,23 @@ INSERT_DATA_LIST:
 	stp	x29, x30, [sp, -16]!
 	add	x29, sp, 0
 	bl	insert_data_list
-	adrp	x1, .LANCHOR45
-	ldrh	w0, [x1, #:lo12:.LANCHOR45]
+	adrp	x1, .LANCHOR44
+	ldrh	w0, [x1, #:lo12:.LANCHOR44]
 	add	w0, w0, 1
 	and	w0, w0, 65535
-	strh	w0, [x1, #:lo12:.LANCHOR45]
+	strh	w0, [x1, #:lo12:.LANCHOR44]
 	adrp	x1, .LANCHOR5
 	ldrh	w1, [x1, #:lo12:.LANCHOR5]
 	cmp	w1, w0
-	bcs	.L74
+	bcs	.L70
 	ldp	x29, x30, [sp], 16
 	mov	w2, 214
-	adrp	x1, .LANCHOR46
+	adrp	x1, .LANCHOR45
 	adrp	x0, .LC1
-	add	x1, x1, :lo12:.LANCHOR46
+	add	x1, x1, :lo12:.LANCHOR45
 	add	x0, x0, :lo12:.LC1
 	b	printf
-.L74:
+.L70:
 	ldp	x29, x30, [sp], 16
 	ret
 	.size	INSERT_DATA_LIST, .-INSERT_DATA_LIST
@@ -682,7 +661,7 @@ insert_free_list:
 	and	w0, w0, 65535
 	mov	w7, 65535
 	cmp	w0, w7
-	beq	.L78
+	beq	.L74
 	adrp	x1, .LANCHOR40
 	mov	w6, 6
 	ldr	x3, [x1, #:lo12:.LANCHOR40]
@@ -691,19 +670,19 @@ insert_free_list:
 	add	x4, x3, x8
 	strh	w1, [x4, 2]
 	strh	w1, [x3, x8]
-	adrp	x1, .LANCHOR47
+	adrp	x1, .LANCHOR46
 	mov	x12, x1
-	ldr	x5, [x1, #:lo12:.LANCHOR47]
-	cbnz	x5, .L79
-	str	x4, [x1, #:lo12:.LANCHOR47]
-.L78:
+	ldr	x5, [x1, #:lo12:.LANCHOR46]
+	cbnz	x5, .L75
+	str	x4, [x1, #:lo12:.LANCHOR46]
+.L74:
 	mov	w0, 0
 	ret
-.L79:
-	adrp	x1, .LANCHOR43
+.L75:
+	adrp	x1, .LANCHOR47
 	mov	x2, -6148914691236517206
 	movk	x2, 0xaaab, lsl 0
-	ldr	x11, [x1, #:lo12:.LANCHOR43]
+	ldr	x11, [x1, #:lo12:.LANCHOR47]
 	ubfiz	x1, x0, 1, 16
 	ldrh	w13, [x11, x1]
 	sub	x1, x5, x3
@@ -711,37 +690,37 @@ insert_free_list:
 	mul	x1, x1, x2
 	mov	x2, x5
 	and	w1, w1, 65535
-.L82:
+.L78:
 	ubfiz	x10, x1, 1, 16
 	ldrh	w10, [x11, x10]
 	cmp	w10, w13
-	bcs	.L80
+	bcs	.L76
 	ldrh	w10, [x2]
 	cmp	w10, w7
-	bne	.L81
+	bne	.L77
 	strh	w1, [x4, 2]
 	strh	w0, [x2]
-	b	.L78
-.L81:
+	b	.L74
+.L77:
 	umaddl	x2, w10, w6, x3
 	mov	w1, w10
-	b	.L82
-.L80:
+	b	.L78
+.L76:
 	ldrh	w6, [x2, 2]
 	cmp	x2, x5
 	strh	w6, [x4, 2]
 	strh	w1, [x3, x8]
-	bne	.L83
+	bne	.L79
 	strh	w0, [x2, 2]
-	str	x4, [x12, #:lo12:.LANCHOR47]
-	b	.L78
-.L83:
+	str	x4, [x12, #:lo12:.LANCHOR46]
+	b	.L74
+.L79:
 	ldrh	w1, [x2, 2]
 	mov	w4, 6
 	umull	x1, w1, w4
 	strh	w0, [x3, x1]
 	strh	w0, [x2, 2]
-	b	.L78
+	b	.L74
 	.size	insert_free_list, .-insert_free_list
 	.section	.text.INSERT_FREE_LIST,"ax",@progbits
 	.align	2
@@ -759,7 +738,7 @@ INSERT_FREE_LIST:
 	adrp	x1, .LANCHOR5
 	ldrh	w1, [x1, #:lo12:.LANCHOR5]
 	cmp	w1, w0
-	bcs	.L84
+	bcs	.L80
 	ldp	x29, x30, [sp], 16
 	mov	w2, 207
 	adrp	x1, .LANCHOR49
@@ -767,7 +746,7 @@ INSERT_FREE_LIST:
 	add	x1, x1, :lo12:.LANCHOR49
 	add	x0, x0, :lo12:.LC1
 	b	printf
-.L84:
+.L80:
 	ldp	x29, x30, [sp], 16
 	ret
 	.size	INSERT_FREE_LIST, .-INSERT_FREE_LIST
@@ -791,26 +770,26 @@ List_remove_node:
 	add	x19, x23, x21
 	ldrh	w1, [x19, 2]
 	cmp	w1, w0
-	bne	.L88
+	bne	.L84
 	ldr	x0, [x22]
 	cmp	x19, x0
-	beq	.L88
+	beq	.L84
 	adrp	x1, .LANCHOR50
 	adrp	x0, .LC1
 	mov	w2, 372
 	add	x1, x1, :lo12:.LANCHOR50
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L88:
+.L84:
 	ldr	x0, [x22]
 	mov	w1, 65535
 	cmp	x19, x0
 	ldrh	w0, [x23, x21]
-	bne	.L89
+	bne	.L85
 	cmp	w0, w1
-	bne	.L90
+	bne	.L86
 	str	xzr, [x22]
-.L91:
+.L87:
 	mov	w0, -1
 	strh	w0, [x23, x21]
 	strh	w0, [x19, 2]
@@ -820,27 +799,27 @@ List_remove_node:
 	ldr	x23, [sp, 48]
 	ldp	x29, x30, [sp], 64
 	ret
-.L90:
+.L86:
 	ldr	x1, [x20, #:lo12:.LANCHOR40]
 	mov	w2, 6
 	umaddl	x0, w0, w2, x1
 	mov	w1, -1
 	str	x0, [x22]
 	strh	w1, [x0, 2]
-	b	.L91
-.L89:
+	b	.L87
+.L85:
 	cmp	w0, w1
 	ldrh	w1, [x19, 2]
-	bne	.L92
+	bne	.L88
 	cmp	w1, w0
-	beq	.L91
+	beq	.L87
 	mov	w0, 6
 	mov	w2, -1
 	umull	x1, w1, w0
 	ldr	x0, [x20, #:lo12:.LANCHOR40]
 	strh	w2, [x0, x1]
-	b	.L91
-.L92:
+	b	.L87
+.L88:
 	ldr	x2, [x20, #:lo12:.LANCHOR40]
 	mov	w3, 6
 	umaddl	x4, w0, w3, x2
@@ -848,7 +827,7 @@ List_remove_node:
 	ldrh	w1, [x19, 2]
 	umull	x1, w1, w3
 	strh	w0, [x2, x1]
-	b	.L91
+	b	.L87
 	.size	List_remove_node, .-List_remove_node
 	.section	.text.List_pop_index_node,"ax",@progbits
 	.align	2
@@ -856,7 +835,7 @@ List_remove_node:
 	.type	List_pop_index_node, %function
 List_pop_index_node:
 	ldr	x2, [x0]
-	cbz	x2, .L100
+	cbz	x2, .L96
 	stp	x29, x30, [sp, -32]!
 	adrp	x3, .LANCHOR40
 	and	w1, w1, 65535
@@ -865,9 +844,9 @@ List_pop_index_node:
 	str	x19, [sp, 16]
 	mov	w5, 6
 	ldr	x19, [x3, #:lo12:.LANCHOR40]
-.L96:
-	cbnz	w1, .L97
-.L99:
+.L92:
+	cbnz	w1, .L93
+.L95:
 	sub	x19, x2, x19
 	mov	x2, -6148914691236517206
 	asr	x19, x19, 1
@@ -880,15 +859,15 @@ List_pop_index_node:
 	ldr	x19, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
-.L97:
+.L93:
 	ldrh	w3, [x2]
 	cmp	w3, w4
-	beq	.L99
+	beq	.L95
 	sub	w1, w1, #1
 	umaddl	x2, w3, w5, x19
 	and	w1, w1, 65535
-	b	.L96
-.L100:
+	b	.L92
+.L96:
 	mov	w0, 65535
 	ret
 	.size	List_pop_index_node, .-List_pop_index_node
@@ -908,26 +887,26 @@ List_get_gc_head_node:
 	and	w2, w0, 65535
 	adrp	x0, .LANCHOR41
 	ldr	x1, [x0, #:lo12:.LANCHOR41]
-	cbz	x1, .L111
+	cbz	x1, .L107
 	adrp	x0, .LANCHOR40
 	mov	w4, 6
 	ldr	x3, [x0, #:lo12:.LANCHOR40]
 	mov	w0, 65535
-.L108:
-	cbz	w2, .L109
+.L104:
+	cbz	w2, .L105
 	ldrh	w1, [x1]
 	cmp	w1, w0
-	bne	.L110
+	bne	.L106
 	ret
-.L110:
+.L106:
 	sub	w2, w2, #1
 	umaddl	x1, w1, w4, x3
 	and	w2, w2, 65535
-	b	.L108
-.L111:
+	b	.L104
+.L107:
 	mov	w0, 65535
 	ret
-.L109:
+.L105:
 	sub	x0, x1, x3
 	mov	x1, -6148914691236517206
 	asr	x0, x0, 1
@@ -951,15 +930,15 @@ List_update_data_list:
 	ldrh	w0, [x0, #:lo12:.LANCHOR51]
 	stp	x25, x26, [sp, 64]
 	cmp	w0, w19
-	beq	.L114
+	beq	.L110
 	adrp	x0, .LANCHOR52
 	ldrh	w0, [x0, #:lo12:.LANCHOR52]
 	cmp	w0, w19
-	beq	.L114
+	beq	.L110
 	adrp	x0, .LANCHOR53
 	ldrh	w0, [x0, #:lo12:.LANCHOR53]
 	cmp	w0, w19
-	beq	.L114
+	beq	.L110
 	adrp	x0, .LANCHOR40
 	mov	w21, 6
 	adrp	x24, .LANCHOR41
@@ -969,7 +948,7 @@ List_update_data_list:
 	ldr	x1, [x24, #:lo12:.LANCHOR41]
 	add	x22, x23, x21
 	cmp	x22, x1
-	beq	.L114
+	beq	.L110
 	adrp	x1, .LANCHOR42
 	ubfiz	x0, x19, 1, 16
 	mov	x25, x1
@@ -982,25 +961,25 @@ List_update_data_list:
 	ldrh	w0, [x22, 2]
 	csinv	w20, w20, wzr, ne
 	cmp	w0, w1
-	bne	.L117
+	bne	.L113
 	ldrh	w1, [x23, x21]
 	cmp	w1, w0
-	bne	.L117
+	bne	.L113
 	adrp	x1, .LANCHOR54
 	adrp	x0, .LC1
 	mov	w2, 463
 	add	x1, x1, :lo12:.LANCHOR54
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L117:
+.L113:
 	ldrh	w0, [x22, 2]
 	mov	w1, 65535
 	cmp	w0, w1
-	bne	.L118
+	bne	.L114
 	ldrh	w1, [x23, x21]
 	cmp	w1, w0
-	beq	.L114
-.L118:
+	beq	.L110
+.L114:
 	mov	w1, 6
 	mov	x2, -6148914691236517206
 	movk	x2, 0xaaab, lsl 0
@@ -1016,26 +995,26 @@ List_update_data_list:
 	mul	w0, w1, w2
 	csinv	w0, w0, wzr, ne
 	cmp	w20, w0
-	bcs	.L114
-	adrp	x20, .LANCHOR45
+	bcs	.L110
+	adrp	x20, .LANCHOR44
 	mov	w1, w19
 	add	x0, x24, :lo12:.LANCHOR41
 	bl	List_remove_node
-	ldrh	w0, [x20, #:lo12:.LANCHOR45]
-	cbnz	w0, .L120
+	ldrh	w0, [x20, #:lo12:.LANCHOR44]
+	cbnz	w0, .L116
 	adrp	x1, .LANCHOR54
 	adrp	x0, .LC1
 	mov	w2, 474
 	add	x1, x1, :lo12:.LANCHOR54
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L120:
-	ldrh	w0, [x20, #:lo12:.LANCHOR45]
+.L116:
+	ldrh	w0, [x20, #:lo12:.LANCHOR44]
 	sub	w0, w0, #1
-	strh	w0, [x20, #:lo12:.LANCHOR45]
+	strh	w0, [x20, #:lo12:.LANCHOR44]
 	mov	w0, w19
 	bl	INSERT_DATA_LIST
-.L114:
+.L110:
 	mov	w0, 0
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -1058,72 +1037,72 @@ select_l2p_ram_region:
 	adrp	x0, .LANCHOR55
 	str	x19, [sp, 16]
 	ldr	x0, [x0, #:lo12:.LANCHOR55]
-.L125:
+.L121:
 	and	w19, w1, 65535
 	cmp	w19, w2
-	bcc	.L127
+	bcc	.L123
 	add	x3, x0, 4
 	mov	w19, w2
 	mov	w5, -2147483648
 	mov	w1, 0
-.L128:
+.L124:
 	cmp	w1, w2
-	bne	.L130
+	bne	.L126
 	cmp	w19, w2
-	bcc	.L126
+	bcc	.L122
 	adrp	x1, .LANCHOR56
 	mov	w19, w2
 	mov	w3, -1
 	ldrh	w4, [x1, #:lo12:.LANCHOR56]
 	mov	w1, 0
-.L131:
+.L127:
 	cmp	w1, w2
-	bne	.L133
+	bne	.L129
 	cmp	w19, w1
-	bcc	.L126
+	bcc	.L122
 	mov	w2, 789
 	adrp	x1, .LANCHOR57
 	adrp	x0, .LC1
 	add	x1, x1, :lo12:.LANCHOR57
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-	b	.L126
-.L127:
+	b	.L122
+.L123:
 	add	x1, x1, 1
 	add	x4, x0, x1, lsl 4
 	ldrh	w4, [x4, -16]
 	cmp	w4, w3
-	bne	.L125
-.L126:
+	bne	.L121
+.L122:
 	mov	w0, w19
 	ldr	x19, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
-.L130:
+.L126:
 	ldr	w4, [x3]
-	tbnz	w4, #31, .L129
+	tbnz	w4, #31, .L125
 	cmp	w5, w4
-	bls	.L129
+	bls	.L125
 	mov	w5, w4
 	mov	w19, w1
-.L129:
+.L125:
 	add	w1, w1, 1
 	add	x3, x3, 16
 	and	w1, w1, 65535
-	b	.L128
-.L133:
+	b	.L124
+.L129:
 	ldr	w6, [x0, 4]
 	cmp	w3, w6
-	bls	.L132
+	bls	.L128
 	ldrh	w5, [x0]
 	cmp	w5, w4
 	csel	w3, w3, w6, eq
 	csel	w19, w19, w1, eq
-.L132:
+.L128:
 	add	w1, w1, 1
 	add	x0, x0, 16
 	and	w1, w1, 65535
-	b	.L131
+	b	.L127
 	.size	select_l2p_ram_region, .-select_l2p_ram_region
 	.section	.text.FtlUpdateVaildLpn,"ax",@progbits
 	.align	2
@@ -1134,12 +1113,12 @@ FtlUpdateVaildLpn:
 	mov	x3, x2
 	ldrh	w1, [x2, #:lo12:.LANCHOR58]
 	cmp	w1, 4
-	bhi	.L136
-	cbnz	w0, .L136
+	bhi	.L132
+	cbnz	w0, .L132
 	add	w1, w1, 1
 	strh	w1, [x2, #:lo12:.LANCHOR58]
 	ret
-.L136:
+.L132:
 	adrp	x1, .LANCHOR5
 	adrp	x0, .LANCHOR59
 	strh	wzr, [x3, #:lo12:.LANCHOR58]
@@ -1151,22 +1130,22 @@ FtlUpdateVaildLpn:
 	ldr	x6, [x1, #:lo12:.LANCHOR42]
 	mov	w7, 65535
 	mov	x1, 0
-.L137:
+.L133:
 	cmp	w5, w1, uxth
-	bhi	.L139
-	cbz	w3, .L135
+	bhi	.L135
+	cbz	w3, .L131
 	str	w2, [x0, #:lo12:.LANCHOR59]
-.L135:
+.L131:
 	ret
-.L139:
+.L135:
 	ldrh	w4, [x6, x1, lsl 1]
 	cmp	w4, w7
-	beq	.L138
+	beq	.L134
 	add	w2, w2, w4
 	mov	w3, 1
-.L138:
+.L134:
 	add	x1, x1, 1
-	b	.L137
+	b	.L133
 	.size	FtlUpdateVaildLpn, .-FtlUpdateVaildLpn
 	.section	.text.ftl_set_blk_mode,"ax",@progbits
 	.align	2
@@ -1174,9 +1153,9 @@ FtlUpdateVaildLpn:
 	.type	ftl_set_blk_mode, %function
 ftl_set_blk_mode:
 	and	w0, w0, 65535
-	cbz	w1, .L146
+	cbz	w1, .L142
 	b	ftl_set_blk_mode.part.6
-.L146:
+.L142:
 	adrp	x1, .LANCHOR1
 	ubfx	x2, x0, 5, 11
 	lsl	x2, x2, 2
@@ -1216,9 +1195,9 @@ ftl_sb_update_avl_pages:
 	add	x4, x0, x4
 	ldrh	w3, [x1, #:lo12:.LANCHOR3]
 	mov	w1, 65535
-.L149:
+.L145:
 	cmp	w2, w3
-	bcc	.L151
+	bcc	.L147
 	adrp	x1, .LANCHOR19
 	ubfiz	x3, x3, 1, 16
 	add	x3, x3, 16
@@ -1229,32 +1208,32 @@ ftl_sb_update_avl_pages:
 	sub	w1, w1, #1
 	and	w1, w1, 65535
 	sub	w1, w1, w6
-.L152:
+.L148:
 	cmp	x2, x3
-	bne	.L154
+	bne	.L150
 	ret
-.L151:
+.L147:
 	ldrh	w5, [x4]
 	cmp	w5, w1
-	beq	.L150
+	beq	.L146
 	ldrh	w5, [x0, 4]
 	add	w5, w5, 1
 	strh	w5, [x0, 4]
-.L150:
+.L146:
 	add	w2, w2, 1
 	add	x4, x4, 2
 	and	w2, w2, 65535
-	b	.L149
-.L154:
+	b	.L145
+.L150:
 	ldrh	w4, [x2]
 	cmp	w4, w5
-	beq	.L153
+	beq	.L149
 	ldrh	w4, [x0, 4]
 	add	w4, w1, w4
 	strh	w4, [x0, 4]
-.L153:
+.L149:
 	add	x2, x2, 2
-	b	.L152
+	b	.L148
 	.size	ftl_sb_update_avl_pages, .-ftl_sb_update_avl_pages
 	.section	.text.FtlSlcSuperblockCheck,"ax",@progbits
 	.align	2
@@ -1262,38 +1241,38 @@ ftl_sb_update_avl_pages:
 	.type	FtlSlcSuperblockCheck, %function
 FtlSlcSuperblockCheck:
 	ldrh	w1, [x0, 4]
-	cbz	w1, .L155
+	cbz	w1, .L151
 	ldrh	w2, [x0]
 	mov	w1, 65535
 	cmp	w2, w1
-	beq	.L155
+	beq	.L151
 	ldrb	w2, [x0, 6]
 	add	x2, x2, 8
 	ldrh	w3, [x0, x2, lsl 1]
 	adrp	x2, .LANCHOR3
 	ldrh	w4, [x2, #:lo12:.LANCHOR3]
 	mov	w2, w1
-.L158:
+.L154:
 	cmp	w3, w2
-	beq	.L160
-.L155:
+	beq	.L156
+.L151:
 	ret
-.L160:
+.L156:
 	ldrb	w1, [x0, 6]
 	add	w1, w1, 1
 	and	w1, w1, 255
 	strb	w1, [x0, 6]
 	cmp	w1, w4
-	bne	.L159
+	bne	.L155
 	ldrh	w1, [x0, 2]
 	strb	wzr, [x0, 6]
 	add	w1, w1, 1
 	strh	w1, [x0, 2]
-.L159:
+.L155:
 	ldrb	w1, [x0, 6]
 	add	x1, x1, 8
 	ldrh	w3, [x0, x1, lsl 1]
-	b	.L158
+	b	.L154
 	.size	FtlSlcSuperblockCheck, .-FtlSlcSuperblockCheck
 	.section	.text.make_superblock,"ax",@progbits
 	.align	2
@@ -1308,14 +1287,14 @@ make_superblock:
 	adrp	x0, .LANCHOR5
 	ldrh	w0, [x0, #:lo12:.LANCHOR5]
 	cmp	w1, w0
-	bcc	.L162
+	bcc	.L158
 	adrp	x1, .LANCHOR60
 	adrp	x0, .LC1
-	mov	w2, 2156
+	mov	w2, 2148
 	add	x1, x1, :lo12:.LANCHOR60
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L162:
+.L158:
 	adrp	x0, .LANCHOR3
 	adrp	x7, .LANCHOR13
 	add	x6, x19, 16
@@ -1325,35 +1304,45 @@ make_superblock:
 	strh	wzr, [x19, 4]
 	mov	w10, -1
 	strb	wzr, [x19, 7]
-.L163:
+.L159:
 	cmp	w8, w5, uxth
-	bhi	.L165
+	bhi	.L161
 	adrp	x1, .LANCHOR19
 	ldrb	w0, [x19, 7]
 	strb	wzr, [x19, 9]
 	ldrh	w1, [x1, #:lo12:.LANCHOR19]
 	mul	w0, w0, w1
+	ldrh	w1, [x19]
 	strh	w0, [x19, 4]
+	adrp	x0, .LANCHOR47
+	ldr	x0, [x0, #:lo12:.LANCHOR47]
+	ldrh	w1, [x0, x1, lsl 1]
+	mov	w0, 10000
+	cmp	w1, w0
+	bls	.L162
+	mov	w0, 1
+	strb	w0, [x19, 9]
+.L162:
 	mov	w0, 0
 	ldr	x19, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
-.L165:
+.L161:
 	ldrh	w1, [x19]
 	ldrb	w0, [x7, x5]
 	bl	V2P_block
 	mov	w4, w0
 	strh	w10, [x6]
 	bl	FtlBbmIsBadBlock
-	cbnz	w0, .L164
+	cbnz	w0, .L160
 	strh	w4, [x6]
 	ldrb	w0, [x19, 7]
 	add	w0, w0, 1
 	strb	w0, [x19, 7]
-.L164:
+.L160:
 	add	x5, x5, 1
 	add	x6, x6, 2
-	b	.L163
+	b	.L159
 	.size	make_superblock, .-make_superblock
 	.section	.text.update_multiplier_value,"ax",@progbits
 	.align	2
@@ -1370,11 +1359,11 @@ update_multiplier_value:
 	add	x8, x8, :lo12:.LANCHOR13
 	ldrh	w11, [x0, #:lo12:.LANCHOR19]
 	cmp	w10, w7, uxth
-	bhi	.L179
-	cbz	w5, .L177
+	bhi	.L176
+	cbz	w5, .L174
 	mov	w0, 32768
 	sdiv	w5, w0, w5
-.L178:
+.L175:
 	adrp	x0, .LANCHOR40
 	mov	w1, 6
 	ldr	x0, [x0, #:lo12:.LANCHOR40]
@@ -1382,31 +1371,31 @@ update_multiplier_value:
 	mov	w0, 0
 	strh	w5, [x6, 4]
 	ret
-.L172:
+.L169:
 	mov	w5, 0
-	b	.L171
-.L177:
+	b	.L168
+.L174:
 	mov	w5, 0
-	b	.L178
-.L179:
+	b	.L175
+.L176:
 	stp	x29, x30, [sp, -16]!
 	add	x29, sp, 0
-.L170:
+.L167:
 	ldrb	w0, [x8, x7]
 	mov	w1, w6
 	bl	V2P_block
 	bl	FtlBbmIsBadBlock
-	cbnz	w0, .L169
+	cbnz	w0, .L166
 	add	w5, w5, w11
 	and	w5, w5, 65535
-.L169:
+.L166:
 	add	x7, x7, 1
 	cmp	w10, w7, uxth
-	bhi	.L170
-	cbz	w5, .L172
+	bhi	.L167
+	cbz	w5, .L169
 	mov	w0, 32768
 	sdiv	w5, w0, w5
-.L171:
+.L168:
 	adrp	x0, .LANCHOR40
 	mov	w1, 6
 	ldr	x0, [x0, #:lo12:.LANCHOR40]
@@ -1421,9 +1410,9 @@ update_multiplier_value:
 	.global	GetFreeBlockMinEraseCount
 	.type	GetFreeBlockMinEraseCount, %function
 GetFreeBlockMinEraseCount:
-	adrp	x0, .LANCHOR47
-	ldr	x0, [x0, #:lo12:.LANCHOR47]
-	cbz	x0, .L182
+	adrp	x0, .LANCHOR46
+	ldr	x0, [x0, #:lo12:.LANCHOR46]
+	cbz	x0, .L179
 	adrp	x1, .LANCHOR40
 	ldr	x1, [x1, #:lo12:.LANCHOR40]
 	sub	x0, x0, x1
@@ -1431,12 +1420,12 @@ GetFreeBlockMinEraseCount:
 	asr	x0, x0, 1
 	movk	x1, 0xaaab, lsl 0
 	mul	x0, x0, x1
-	adrp	x1, .LANCHOR43
-	ldr	x1, [x1, #:lo12:.LANCHOR43]
+	adrp	x1, .LANCHOR47
+	ldr	x1, [x1, #:lo12:.LANCHOR47]
 	and	x0, x0, 65535
 	ldrh	w0, [x1, x0, lsl 1]
 	ret
-.L182:
+.L179:
 	mov	w0, 0
 	ret
 	.size	GetFreeBlockMinEraseCount, .-GetFreeBlockMinEraseCount
@@ -1445,10 +1434,10 @@ GetFreeBlockMinEraseCount:
 	.global	GetFreeBlockMaxEraseCount
 	.type	GetFreeBlockMaxEraseCount, %function
 GetFreeBlockMaxEraseCount:
-	adrp	x1, .LANCHOR47
+	adrp	x1, .LANCHOR46
 	and	w0, w0, 65535
-	ldr	x1, [x1, #:lo12:.LANCHOR47]
-	cbz	x1, .L190
+	ldr	x1, [x1, #:lo12:.LANCHOR46]
+	cbz	x1, .L187
 	adrp	x2, .LANCHOR48
 	mov	w3, 7
 	mov	w5, 6
@@ -1467,25 +1456,25 @@ GetFreeBlockMaxEraseCount:
 	mul	x1, x1, x2
 	mov	w2, 0
 	and	w1, w1, 65535
-.L186:
+.L183:
 	cmp	w0, w2
-	beq	.L189
+	beq	.L186
 	umull	x4, w1, w5
 	ldrh	w4, [x3, x4]
 	cmp	w4, w6
-	bne	.L187
-.L189:
-	adrp	x0, .LANCHOR43
+	bne	.L184
+.L186:
+	adrp	x0, .LANCHOR47
 	ubfiz	x1, x1, 1, 16
-	ldr	x0, [x0, #:lo12:.LANCHOR43]
+	ldr	x0, [x0, #:lo12:.LANCHOR47]
 	ldrh	w0, [x0, x1]
 	ret
-.L187:
+.L184:
 	add	w2, w2, 1
 	mov	w1, w4
 	and	w2, w2, 65535
-	b	.L186
-.L190:
+	b	.L183
+.L187:
 	mov	w0, 0
 	ret
 	.size	GetFreeBlockMaxEraseCount, .-GetFreeBlockMaxEraseCount
@@ -1497,7 +1486,7 @@ free_data_superblock:
 	and	w0, w0, 65535
 	mov	w1, 65535
 	cmp	w0, w1
-	beq	.L194
+	beq	.L191
 	stp	x29, x30, [sp, -16]!
 	adrp	x2, .LANCHOR42
 	ubfiz	x1, x0, 1, 16
@@ -1508,7 +1497,7 @@ free_data_superblock:
 	mov	w0, 0
 	ldp	x29, x30, [sp], 16
 	ret
-.L194:
+.L191:
 	mov	w0, 0
 	ret
 	.size	free_data_superblock, .-free_data_superblock
@@ -1525,101 +1514,106 @@ get_new_active_ppa:
 	mov	w0, 65535
 	str	x21, [sp, 32]
 	cmp	w1, w0
-	bne	.L198
+	bne	.L195
 	adrp	x1, .LANCHOR61
 	adrp	x0, .LC1
-	mov	w2, 2786
+	mov	w2, 2781
 	add	x1, x1, :lo12:.LANCHOR61
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L198:
-	adrp	x20, .LANCHOR19
+.L195:
+	adrp	x21, .LANCHOR19
 	ldrh	w1, [x19, 2]
-	ldrh	w0, [x20, #:lo12:.LANCHOR19]
+	ldrh	w0, [x21, #:lo12:.LANCHOR19]
 	cmp	w1, w0
-	bne	.L199
+	bne	.L196
 	adrp	x1, .LANCHOR61
 	adrp	x0, .LC1
-	mov	w2, 2787
+	mov	w2, 2782
 	add	x1, x1, :lo12:.LANCHOR61
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L199:
+.L196:
 	ldrh	w0, [x19, 4]
-	cbnz	w0, .L200
+	cbnz	w0, .L197
 	adrp	x1, .LANCHOR61
 	adrp	x0, .LC1
-	mov	w2, 2788
+	mov	w2, 2783
 	add	x1, x1, :lo12:.LANCHOR61
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L200:
+.L197:
 	ldrb	w0, [x19, 6]
 	adrp	x1, .LANCHOR3
 	strb	wzr, [x19, 10]
 	add	x0, x0, 8
-	ldrh	w2, [x1, #:lo12:.LANCHOR3]
+	ldrh	w3, [x1, #:lo12:.LANCHOR3]
 	mov	w1, 65535
 	ldrh	w0, [x19, x0, lsl 1]
-.L201:
+.L198:
 	cmp	w0, w1
-	beq	.L203
-	ldrh	w21, [x19, 2]
-	mov	w3, 65535
+	beq	.L200
+	ldrh	w20, [x19, 2]
+	ldrh	w2, [x21, #:lo12:.LANCHOR19]
+	cmp	w20, w2
+	bcs	.L204
 	ldrh	w1, [x19, 4]
-	orr	w21, w21, w0, lsl 10
+	orr	w20, w20, w0, lsl 10
 	ldrb	w0, [x19, 6]
+	mov	w4, 65535
 	sub	w1, w1, #1
 	and	w1, w1, 65535
 	strh	w1, [x19, 4]
-.L205:
+.L203:
 	add	w0, w0, 1
 	and	w0, w0, 255
-	cmp	w2, w0
-	bne	.L204
+	cmp	w3, w0
+	bne	.L202
 	ldrh	w0, [x19, 2]
 	add	w0, w0, 1
 	strh	w0, [x19, 2]
 	mov	w0, 0
-.L204:
-	add	x4, x19, x0, sxtw 1
-	ldrh	w4, [x4, 16]
-	cmp	w4, w3
-	beq	.L205
+.L202:
+	add	x5, x19, x0, sxtw 1
+	ldrh	w5, [x5, 16]
+	cmp	w5, w4
+	beq	.L203
 	strb	w0, [x19, 6]
-	ldrh	w2, [x19, 2]
-	ldrh	w0, [x20, #:lo12:.LANCHOR19]
-	cmp	w2, w0
-	bne	.L197
-	cbz	w1, .L197
+	ldrh	w0, [x19, 2]
+	cmp	w0, w2
+	bne	.L194
+	cbz	w1, .L194
 	adrp	x1, .LANCHOR61
 	adrp	x0, .LC1
-	mov	w2, 2809
+	mov	w2, 2806
 	add	x1, x1, :lo12:.LANCHOR61
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L197:
-	mov	w0, w21
+.L194:
+	mov	w0, w20
 	ldr	x21, [sp, 32]
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 48
 	ret
-.L203:
+.L200:
 	ldrb	w0, [x19, 6]
 	add	w0, w0, 1
 	and	w0, w0, 255
 	strb	w0, [x19, 6]
-	cmp	w0, w2
-	bne	.L202
+	cmp	w0, w3
+	bne	.L199
 	ldrh	w0, [x19, 2]
 	strb	wzr, [x19, 6]
 	add	w0, w0, 1
 	strh	w0, [x19, 2]
-.L202:
+.L199:
 	ldrb	w0, [x19, 6]
 	add	x0, x0, 8
 	ldrh	w0, [x19, x0, lsl 1]
-	b	.L201
+	b	.L198
+.L204:
+	mov	w20, 65535
+	b	.L194
 	.size	get_new_active_ppa, .-get_new_active_ppa
 	.section	.text.FtlGcBufInit,"ax",@progbits
 	.align	2
@@ -1650,21 +1644,21 @@ FtlGcBufInit:
 	add	x4, x4, 8
 	mov	w1, 0
 	mov	w16, 1
-.L213:
+.L211:
 	add	w13, w2, w10
 	add	w12, w1, w11
 	cmp	x3, x8
-	bne	.L214
+	bne	.L212
 	adrp	x1, .LANCHOR67
 	ldr	x7, [x7, #:lo12:.LANCHOR64]
 	ldr	x6, [x6, #:lo12:.LANCHOR65]
 	mov	w8, 24
 	ldr	w4, [x1, #:lo12:.LANCHOR67]
-.L215:
+.L213:
 	cmp	w0, w4
-	bcc	.L216
+	bcc	.L214
 	ret
-.L214:
+.L212:
 	asr	w2, w2, 2
 	asr	w1, w1, 2
 	add	x2, x14, x2, sxtw 2
@@ -1676,8 +1670,8 @@ FtlGcBufInit:
 	add	x4, x4, 32
 	mov	w1, w12
 	mov	w2, w13
-	b	.L213
-.L216:
+	b	.L211
+.L214:
 	umull	x3, w0, w8
 	mul	w1, w10, w0
 	add	x2, x5, x3
@@ -1691,7 +1685,7 @@ FtlGcBufInit:
 	asr	w1, w1, 2
 	add	x1, x6, x1, sxtw 2
 	str	x1, [x2, 8]
-	b	.L215
+	b	.L213
 	.size	FtlGcBufInit, .-FtlGcBufInit
 	.section	.text.FtlGcBufFree,"ax",@progbits
 	.align	2
@@ -1704,31 +1698,31 @@ FtlGcBufFree:
 	ldr	w7, [x2, #:lo12:.LANCHOR67]
 	adrp	x2, .LANCHOR63
 	ldr	x5, [x2, #:lo12:.LANCHOR63]
-.L218:
+.L216:
 	cmp	w3, w1
-	bcs	.L217
+	bcs	.L215
 	ubfiz	x4, x3, 5, 16
 	mov	w2, 0
 	add	x4, x0, x4
-	b	.L223
-.L219:
+	b	.L221
+.L217:
 	add	w2, w2, 1
 	and	w2, w2, 65535
-.L223:
+.L221:
 	cmp	w2, w7
-	bcs	.L220
+	bcs	.L218
 	umull	x6, w2, w8
 	add	x10, x5, x6
 	ldr	x11, [x5, x6]
 	ldr	x6, [x4, 8]
 	cmp	x11, x6
-	bne	.L219
+	bne	.L217
 	str	wzr, [x10, 16]
-.L220:
+.L218:
 	add	w3, w3, 1
 	and	w3, w3, 65535
-	b	.L218
-.L217:
+	b	.L216
+.L215:
 	ret
 	.size	FtlGcBufFree, .-FtlGcBufFree
 	.section	.text.FtlGcBufAlloc,"ax",@progbits
@@ -1743,31 +1737,31 @@ FtlGcBufAlloc:
 	ldr	w5, [x2, #:lo12:.LANCHOR67]
 	adrp	x2, .LANCHOR63
 	ldr	x6, [x2, #:lo12:.LANCHOR63]
-.L225:
+.L223:
 	cmp	w3, w1
-	bcs	.L224
+	bcs	.L222
 	mov	w2, 0
-	b	.L230
-.L226:
+	b	.L228
+.L224:
 	add	w2, w2, 1
 	and	w2, w2, 65535
-.L230:
+.L228:
 	cmp	w2, w5
-	bcs	.L227
+	bcs	.L225
 	umaddl	x4, w2, w7, x6
 	ldr	w10, [x4, 16]
-	cbnz	w10, .L226
+	cbnz	w10, .L224
 	ubfiz	x2, x3, 5, 16
 	ldr	x10, [x4]
 	add	x2, x0, x2
 	str	w8, [x4, 16]
 	ldr	x4, [x4, 8]
 	stp	x10, x4, [x2, 8]
-.L227:
+.L225:
 	add	w3, w3, 1
 	and	w3, w3, 65535
-	b	.L225
-.L224:
+	b	.L223
+.L222:
 	ret
 	.size	FtlGcBufAlloc, .-FtlGcBufAlloc
 	.section	.text.IsBlkInGcList,"ax",@progbits
@@ -1781,17 +1775,17 @@ IsBlkInGcList:
 	adrp	x1, .LANCHOR69
 	ldr	x3, [x1, #:lo12:.LANCHOR69]
 	mov	x1, 0
-.L232:
+.L230:
 	cmp	w2, w1, uxth
-	bhi	.L234
+	bhi	.L232
 	mov	w0, 0
 	ret
-.L234:
+.L232:
 	add	x1, x1, 1
 	add	x4, x3, x1, lsl 1
 	ldrh	w4, [x4, -2]
 	cmp	w4, w0
-	bne	.L232
+	bne	.L230
 	mov	w0, 1
 	ret
 	.size	IsBlkInGcList, .-IsBlkInGcList
@@ -1813,24 +1807,24 @@ FtlGcUpdatePage:
 	mov	x3, 0
 	ldrh	w1, [x4, #:lo12:.LANCHOR68]
 	ldr	x5, [x2, #:lo12:.LANCHOR69]
-.L237:
+.L235:
 	and	w2, w3, 65535
 	cmp	w2, w1
-	bcc	.L239
-	bne	.L238
+	bcc	.L237
+	bne	.L236
 	and	x3, x3, 65535
 	strh	w0, [x5, x3, lsl 1]
 	ldrh	w0, [x4, #:lo12:.LANCHOR68]
 	add	w0, w0, 1
 	strh	w0, [x4, #:lo12:.LANCHOR68]
-	b	.L238
-.L239:
+	b	.L236
+.L237:
 	add	x3, x3, 1
 	add	x2, x5, x3, lsl 1
 	ldrh	w2, [x2, -2]
 	cmp	w2, w7
-	bne	.L237
-.L238:
+	bne	.L235
+.L236:
 	adrp	x4, .LANCHOR70
 	adrp	x1, .LANCHOR71
 	mov	w3, 12
@@ -1854,23 +1848,23 @@ FtlGcRefreshBlock:
 	and	w0, w0, 65535
 	ldrh	w5, [x4, #:lo12:.LANCHOR72]
 	cmp	w5, w0
-	beq	.L242
+	beq	.L240
 	adrp	x1, .LANCHOR73
 	ldrh	w3, [x1, #:lo12:.LANCHOR73]
 	cmp	w0, w3
-	beq	.L242
+	beq	.L240
 	mov	w2, 65535
 	cmp	w5, w2
-	bne	.L243
+	bne	.L241
 	strh	w0, [x4, #:lo12:.LANCHOR72]
-.L242:
+.L240:
 	mov	w0, 0
 	ret
-.L243:
+.L241:
 	cmp	w3, w2
-	bne	.L242
+	bne	.L240
 	strh	w0, [x1, #:lo12:.LANCHOR73]
-	b	.L242
+	b	.L240
 	.size	FtlGcRefreshBlock, .-FtlGcRefreshBlock
 	.section	.text.FtlGcMarkBadPhyBlk,"ax",@progbits
 	.align	2
@@ -1888,24 +1882,24 @@ FtlGcMarkBadPhyBlk:
 	add	x3, x3, :lo12:.LANCHOR75
 	mov	x2, 0
 	ldrh	w0, [x1, #:lo12:.LANCHOR74]
-.L245:
+.L243:
 	cmp	w0, w2, uxth
-	bhi	.L247
+	bhi	.L245
 	cmp	w0, 15
-	bhi	.L246
+	bhi	.L244
 	add	w2, w0, 1
 	strh	w2, [x1, #:lo12:.LANCHOR74]
 	adrp	x1, .LANCHOR75
 	add	x1, x1, :lo12:.LANCHOR75
 	strh	w6, [x1, w0, sxtw 1]
-	b	.L246
-.L247:
+	b	.L244
+.L245:
 	add	x2, x2, 1
 	add	x4, x3, x2, lsl 1
 	ldrh	w4, [x4, -2]
 	cmp	w4, w6
-	bne	.L245
-.L246:
+	bne	.L243
+.L244:
 	mov	w0, 0
 	ldp	x29, x30, [sp], 16
 	ret
@@ -1917,20 +1911,20 @@ FtlGcMarkBadPhyBlk:
 FtlGcReFreshBadBlk:
 	adrp	x0, .LANCHOR74
 	ldrh	w0, [x0, #:lo12:.LANCHOR74]
-	cbz	w0, .L256
+	cbz	w0, .L254
 	adrp	x1, .LANCHOR72
 	ldrh	w2, [x1, #:lo12:.LANCHOR72]
 	mov	w1, 65535
 	cmp	w2, w1
-	bne	.L256
+	bne	.L254
 	stp	x29, x30, [sp, -16]!
 	adrp	x6, .LANCHOR76
 	add	x29, sp, 0
 	ldrh	w1, [x6, #:lo12:.LANCHOR76]
 	cmp	w1, w0
-	bcc	.L251
+	bcc	.L249
 	strh	wzr, [x6, #:lo12:.LANCHOR76]
-.L251:
+.L249:
 	ldrh	w1, [x6, #:lo12:.LANCHOR76]
 	adrp	x0, .LANCHOR75
 	add	x0, x0, :lo12:.LANCHOR75
@@ -1943,7 +1937,7 @@ FtlGcReFreshBadBlk:
 	strh	w0, [x6, #:lo12:.LANCHOR76]
 	mov	w0, 0
 	ret
-.L256:
+.L254:
 	mov	w0, 0
 	ret
 	.size	FtlGcReFreshBadBlk, .-FtlGcReFreshBadBlk
@@ -1987,9 +1981,9 @@ rknand_print_hex:
 	mov	x19, 0
 	mov	w20, 0
 	adrp	x26, .LC3
-.L262:
+.L260:
 	cmp	w27, w19
-	bhi	.L268
+	bhi	.L266
 	ldp	x19, x20, [sp, 16]
 	adrp	x0, .LC5
 	ldp	x21, x22, [sp, 32]
@@ -1999,40 +1993,40 @@ rknand_print_hex:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 96
 	b	printf
-.L268:
-	cbnz	w20, .L263
+.L266:
+	cbnz	w20, .L261
 	mov	w2, w21
 	mov	x1, x28
 	mov	x0, x24
 	bl	printf
-.L263:
+.L261:
 	cmp	w23, 4
-	bne	.L264
+	bne	.L262
 	ldr	w1, [x22, x19, lsl 2]
-.L271:
+.L269:
 	add	x0, x26, :lo12:.LC3
-.L270:
+.L268:
 	bl	printf
 	add	w20, w20, 1
 	cmp	w20, 15
-	bls	.L267
+	bls	.L265
 	mov	w20, 0
 	adrp	x0, .LC5
 	add	x0, x0, :lo12:.LC5
 	bl	printf
-.L267:
+.L265:
 	add	x19, x19, 1
 	add	w21, w21, w23
-	b	.L262
-.L264:
+	b	.L260
+.L262:
 	cmp	w23, 2
-	bne	.L266
+	bne	.L264
 	ldrh	w1, [x22, x19, lsl 1]
-	b	.L271
-.L266:
+	b	.L269
+.L264:
 	ldrb	w1, [x22, x19]
 	mov	x0, x25
-	b	.L270
+	b	.L268
 	.size	rknand_print_hex, .-rknand_print_hex
 	.section	.text.FlashEraseBlocks,"ax",@progbits
 	.align	2
@@ -2058,18 +2052,18 @@ FlashEraseBlocks:
 	lsl	w26, w24, 3
 	mov	x22, x0
 	add	x27, x25, :lo12:.LANCHOR78
-.L273:
+.L271:
 	cmp	x19, x23
-	beq	.L287
+	beq	.L285
 	ldr	w0, [x19]
 	add	x2, x29, 104
 	add	x1, x29, 108
 	bl	l2p_addr_tran.isra.0
 	ldr	w0, [x29, 104]
-	cbnz	w0, .L274
+	cbnz	w0, .L272
 	ldr	w1, [x29, 108]
 	cmp	w26, w1
-	bls	.L274
+	bls	.L272
 	mov	x19, x20
 	add	x21, x20, x21
 	adrp	x22, .LC6
@@ -2077,10 +2071,10 @@ FlashEraseBlocks:
 	add	x22, x22, :lo12:.LC6
 	add	x20, x20, :lo12:.LANCHOR77
 	mov	w23, -1
-.L275:
+.L273:
 	cmp	x19, x21
-	bne	.L276
-.L287:
+	bne	.L274
+.L285:
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -2089,7 +2083,7 @@ FlashEraseBlocks:
 	ldr	x27, [sp, 80]
 	ldp	x29, x30, [sp], 112
 	ret
-.L276:
+.L274:
 	ldr	w2, [x29, 108]
 	mov	x1, x20
 	str	w23, [x19]
@@ -2108,34 +2102,34 @@ FlashEraseBlocks:
 	mov	w2, w3
 	add	x0, x0, :lo12:.LC8
 	bl	rknand_print_hex
-	b	.L275
-.L274:
+	b	.L273
+.L272:
 	add	x1, x25, :lo12:.LANCHOR78
 	ldr	x2, [x1, 8]
 	ldr	w1, [x29, 108]
 	blr	x2
-	cbnz	w0, .L277
+	cbnz	w0, .L275
 	str	wzr, [x19, -4]
-.L278:
+.L276:
 	add	x0, x22, :lo12:.LANCHOR0
 	ldrh	w0, [x0, 14]
 	cmp	w0, 4
-	bne	.L280
+	bne	.L278
 	ldrb	w0, [x29, 104]
 	ldr	x2, [x27, 8]
 	ldr	w1, [x29, 108]
 	add	w1, w24, w1
 	blr	x2
-	cbz	w0, .L280
+	cbz	w0, .L278
 	mov	w0, -1
 	str	w0, [x19, -4]
-.L280:
+.L278:
 	add	x19, x19, 32
-	b	.L273
-.L277:
+	b	.L271
+.L275:
 	mov	w0, -1
 	str	w0, [x19, -4]
-	b	.L278
+	b	.L276
 	.size	FlashEraseBlocks, .-FlashEraseBlocks
 	.section	.text.FtlFreeSysBlkQueueIn,"ax",@progbits
 	.align	2
@@ -2150,15 +2144,15 @@ FtlFreeSysBlkQueueIn:
 	sub	w2, w20, #1
 	mov	w0, 65533
 	cmp	w0, w2, uxth
-	bcc	.L289
+	bcc	.L287
 	adrp	x0, .LANCHOR38
 	add	x2, x0, :lo12:.LANCHOR38
 	mov	x19, x0
 	ldrh	w2, [x2, 6]
 	cmp	w2, 1024
-	beq	.L289
+	beq	.L287
 	and	w1, w1, 65535
-	cbz	w1, .L291
+	cbz	w1, .L289
 	mov	w0, w20
 	bl	P2V_block_in_plane
 	and	w21, w0, 65535
@@ -2169,9 +2163,9 @@ FtlFreeSysBlkQueueIn:
 	str	w1, [x0, 4]
 	mov	w1, w2
 	bl	FlashEraseBlocks
-	adrp	x1, .LANCHOR43
+	adrp	x1, .LANCHOR47
 	ubfiz	x0, x21, 1, 16
-	ldr	x2, [x1, #:lo12:.LANCHOR43]
+	ldr	x2, [x1, #:lo12:.LANCHOR47]
 	ldrh	w1, [x2, x0]
 	add	w1, w1, 1
 	strh	w1, [x2, x0]
@@ -2179,7 +2173,7 @@ FtlFreeSysBlkQueueIn:
 	ldr	w0, [x1, #:lo12:.LANCHOR80]
 	add	w0, w0, 1
 	str	w0, [x1, #:lo12:.LANCHOR80]
-.L291:
+.L289:
 	add	x0, x19, :lo12:.LANCHOR38
 	ldrh	w1, [x0, 6]
 	add	w1, w1, 1
@@ -2190,7 +2184,7 @@ FtlFreeSysBlkQueueIn:
 	and	w1, w1, 1023
 	strh	w1, [x0, 4]
 	strh	w20, [x2, 8]
-.L289:
+.L287:
 	ldp	x19, x20, [sp, 16]
 	ldr	x21, [sp, 32]
 	ldp	x29, x30, [sp], 48
@@ -2208,7 +2202,7 @@ FtlFreeSysBlkQueueOut:
 	ldrh	w2, [x1, 6]
 	stp	x19, x20, [sp, 16]
 	mov	x19, x0
-	cbz	w2, .L303
+	cbz	w2, .L301
 	ldrh	w0, [x1, 2]
 	sub	w2, w2, #1
 	strh	w2, [x1, 6]
@@ -2228,23 +2222,23 @@ FtlFreeSysBlkQueueOut:
 	ldr	w0, [x1, #:lo12:.LANCHOR80]
 	add	w0, w0, 1
 	str	w0, [x1, #:lo12:.LANCHOR80]
-.L300:
+.L298:
 	sub	w0, w20, #1
 	mov	w1, 65533
 	cmp	w1, w0, uxth
-	bcs	.L301
+	bcs	.L299
 	add	x0, x19, :lo12:.LANCHOR38
 	mov	w1, w20
 	ldrh	w2, [x0, 6]
 	adrp	x0, .LC9
 	add	x0, x0, :lo12:.LC9
 	bl	printf
-.L302:
-	b	.L302
-.L303:
-	mov	w20, 65535
+.L300:
 	b	.L300
 .L301:
+	mov	w20, 65535
+	b	.L298
+.L299:
 	mov	w0, w20
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 32
@@ -2263,27 +2257,27 @@ ftl_map_blk_alloc_new_blk:
 	mov	w20, 0
 	ldr	x0, [x0, 16]
 	str	x21, [sp, 32]
-.L306:
+.L304:
 	cmp	w20, w1
-	beq	.L310
+	beq	.L308
 	mov	x21, x0
 	ldrh	w2, [x0], 2
-	cbnz	w2, .L307
+	cbnz	w2, .L305
 	bl	FtlFreeSysBlkQueueOut
 	and	w1, w0, 65535
 	strh	w0, [x21]
 	sub	w2, w1, #1
 	mov	w0, 65533
 	cmp	w0, w2, uxth
-	bcs	.L308
+	bcs	.L306
 	adrp	x0, .LANCHOR38+6
 	ldrh	w2, [x0, #:lo12:.LANCHOR38+6]
 	adrp	x0, .LC10
 	add	x0, x0, :lo12:.LC10
 	bl	printf
-.L309:
-	b	.L309
-.L308:
+.L307:
+	b	.L307
+.L306:
 	ldr	w0, [x19, 48]
 	strh	wzr, [x19, 2]
 	add	w0, w0, 1
@@ -2292,26 +2286,26 @@ ftl_map_blk_alloc_new_blk:
 	strh	w20, [x19]
 	add	w0, w0, 1
 	strh	w0, [x19, 8]
-.L310:
+.L308:
 	ldrh	w0, [x19, 10]
 	cmp	w0, w20
-	bhi	.L312
+	bhi	.L310
 	adrp	x1, .LANCHOR81
 	adrp	x0, .LC1
 	mov	w2, 578
 	add	x1, x1, :lo12:.LANCHOR81
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L312:
+.L310:
 	mov	w0, 0
 	ldr	x21, [sp, 32]
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 48
 	ret
-.L307:
+.L305:
 	add	w20, w20, 1
 	and	w20, w20, 65535
-	b	.L306
+	b	.L304
 	.size	ftl_map_blk_alloc_new_blk, .-ftl_map_blk_alloc_new_blk
 	.section	.text.ftl_memset,"ax",@progbits
 	.align	2
@@ -2511,9 +2505,9 @@ FtlMemInit:
 	bl	ftl_malloc
 	adrp	x1, .LANCHOR118
 	str	x0, [x1, #:lo12:.LANCHOR118]
-	adrp	x1, .LANCHOR43
+	adrp	x1, .LANCHOR47
 	add	x0, x0, 32
-	str	x0, [x1, #:lo12:.LANCHOR43]
+	str	x0, [x1, #:lo12:.LANCHOR47]
 	ldrh	w0, [x19, #:lo12:.LANCHOR6]
 	lsl	w0, w0, 1
 	bl	ftl_malloc
@@ -2609,36 +2603,36 @@ FtlMemInit:
 	mov	w3, w5
 	str	x0, [x2, 32]
 	mov	x0, 1
-.L316:
+.L314:
 	cmp	w0, w7
-	bcc	.L317
+	bcc	.L315
 	mov	w2, 8
 	sub	w2, w2, w0
 	add	x2, x2, 1
 	add	x1, x1, :lo12:.LANCHOR37
 	mov	x3, 0
-.L318:
+.L316:
 	add	x3, x3, 1
 	cmp	x2, x3
-	bne	.L319
+	bne	.L317
 	mov	w0, 0
 	ldr	x23, [sp, 48]
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x29, x30, [sp], 64
 	ret
-.L317:
+.L315:
 	ldr	x4, [x2, 32]
 	add	w0, w0, 1
 	add	x4, x4, x3, uxtw 2
 	add	w3, w3, w5
 	str	x4, [x6], 8
-	b	.L316
-.L319:
+	b	.L314
+.L317:
 	add	x4, x0, x3
 	add	x4, x1, x4, lsl 3
 	str	xzr, [x4, 24]
-	b	.L318
+	b	.L316
 	.size	FtlMemInit, .-FtlMemInit
 	.section	.text.FtlBbt2Bitmap,"ax",@progbits
 	.align	2
@@ -2664,19 +2658,19 @@ FtlBbt2Bitmap:
 	mov	w1, 0
 	mov	x0, x20
 	bl	ftl_memset
-.L324:
+.L322:
 	ldrh	w0, [x22, x19]
 	cmp	w0, w24
-	beq	.L321
+	beq	.L319
 	ldrh	w1, [x21]
 	cmp	w1, w0
-	bhi	.L323
+	bhi	.L321
 	adrp	x0, .LC1
 	mov	w2, 74
 	mov	x1, x23
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L323:
+.L321:
 	ldrh	w2, [x22, x19]
 	mov	w1, 1
 	add	x19, x19, 2
@@ -2687,8 +2681,8 @@ FtlBbt2Bitmap:
 	ldr	w1, [x20, x0]
 	orr	w1, w1, w2
 	str	w1, [x20, x0]
-	bne	.L324
-.L321:
+	bne	.L322
+.L319:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
@@ -2751,10 +2745,10 @@ ftl_free_no_use_map_blk:
 	str	x25, [sp, 64]
 	bl	ftl_memset
 	mov	w0, 0
-.L332:
+.L330:
 	ldrh	w1, [x19, 6]
 	cmp	w1, w0
-	bhi	.L336
+	bhi	.L334
 	adrp	x0, .LANCHOR20
 	mov	w23, 0
 	mov	w20, 0
@@ -2762,10 +2756,10 @@ ftl_free_no_use_map_blk:
 	ldrh	w0, [x19]
 	strh	w1, [x21, x0, lsl 1]
 	ldrh	w24, [x21]
-.L337:
+.L335:
 	ldrh	w0, [x19, 10]
 	cmp	w0, w20
-	bhi	.L341
+	bhi	.L339
 	mov	w0, w23
 	ldr	x25, [sp, 64]
 	ldp	x19, x20, [sp, 16]
@@ -2773,64 +2767,64 @@ ftl_free_no_use_map_blk:
 	ldp	x23, x24, [sp, 48]
 	ldp	x29, x30, [sp], 80
 	ret
-.L336:
+.L334:
 	ubfiz	x1, x0, 2, 16
 	ldr	w2, [x20, x1]
 	mov	w1, 0
 	ubfx	x2, x2, 10, 16
-.L333:
+.L331:
 	ldrh	w3, [x19, 10]
 	cmp	w3, w1
-	bhi	.L335
+	bhi	.L333
 	add	w0, w0, 1
 	and	w0, w0, 65535
-	b	.L332
-.L335:
+	b	.L330
+.L333:
 	ubfiz	x3, x1, 1, 16
 	ldrh	w4, [x22, x3]
 	cmp	w4, w2
-	bne	.L334
-	cbz	w2, .L334
+	bne	.L332
+	cbz	w2, .L332
 	ldrh	w4, [x21, x3]
 	add	w4, w4, 1
 	strh	w4, [x21, x3]
-.L334:
+.L332:
 	add	w1, w1, 1
 	and	w1, w1, 65535
-	b	.L333
-.L341:
+	b	.L331
+.L339:
 	ubfiz	x0, x20, 1, 16
 	ldrh	w1, [x21, x0]
 	cmp	w24, w1
-	bls	.L338
+	bls	.L336
 	add	x25, x22, x0
 	ldrh	w0, [x22, x0]
-	cbnz	w0, .L339
-.L340:
+	cbnz	w0, .L337
+.L338:
 	add	w20, w20, 1
 	and	w20, w20, 65535
-	b	.L337
-.L338:
-	cbnz	w1, .L340
+	b	.L335
+.L336:
+	cbnz	w1, .L338
 	add	x25, x22, x0
 	ldrh	w0, [x22, x0]
-	cbz	w0, .L340
-.L342:
+	cbz	w0, .L338
+.L340:
 	mov	w1, 1
 	bl	FtlFreeSysBlkQueueIn
 	strh	wzr, [x25]
 	ldrh	w0, [x19, 8]
 	sub	w0, w0, #1
 	strh	w0, [x19, 8]
-	b	.L340
-.L343:
+	b	.L338
+.L341:
 	mov	w24, 0
-	b	.L342
-.L339:
+	b	.L340
+.L337:
 	mov	w23, w20
-	cbz	w1, .L343
+	cbz	w1, .L341
 	mov	w24, w1
-	b	.L340
+	b	.L338
 	.size	ftl_free_no_use_map_blk, .-ftl_free_no_use_map_blk
 	.section	.text.FtlL2PDataInit,"ax",@progbits
 	.align	2
@@ -2866,10 +2860,10 @@ FtlL2PDataInit:
 	mov	w2, -1
 	ldrh	w5, [x22, #:lo12:.LANCHOR23]
 	add	x3, x0, x3, lsl 4
-.L353:
+.L351:
 	add	x4, x1, x5
 	cmp	x0, x3
-	bne	.L354
+	bne	.L352
 	adrp	x1, .LANCHOR129
 	add	x0, x1, :lo12:.LANCHOR129
 	ldp	x21, x22, [sp, 32]
@@ -2900,7 +2894,7 @@ FtlL2PDataInit:
 	str	x1, [x0, 40]
 	ldp	x29, x30, [sp], 64
 	ret
-.L354:
+.L352:
 	and	x1, x1, -4
 	strh	w2, [x0]
 	add	x1, x6, x1
@@ -2908,7 +2902,7 @@ FtlL2PDataInit:
 	str	x1, [x0, 8]
 	add	x0, x0, 16
 	mov	x1, x4
-	b	.L353
+	b	.L351
 	.size	FtlL2PDataInit, .-FtlL2PDataInit
 	.section	.text.FtlVariablesInit,"ax",@progbits
 	.align	2
@@ -2938,10 +2932,10 @@ FtlVariablesInit:
 	ldr	x0, [x0, #:lo12:.LANCHOR36]
 	lsl	w2, w2, 1
 	bl	ftl_memset
-	adrp	x0, .LANCHOR43
+	adrp	x0, .LANCHOR47
 	ldrh	w2, [x19, #:lo12:.LANCHOR6]
 	mov	w1, 0
-	ldr	x0, [x0, #:lo12:.LANCHOR43]
+	ldr	x0, [x0, #:lo12:.LANCHOR47]
 	lsl	w2, w2, 1
 	bl	ftl_memset
 	adrp	x0, .LANCHOR117
@@ -2981,7 +2975,7 @@ SupperBlkListInit:
 	stp	x23, x24, [sp, 48]
 	adrp	x24, .LANCHOR40
 	stp	x19, x20, [sp, 16]
-	adrp	x23, .LANCHOR45
+	adrp	x23, .LANCHOR44
 	stp	x21, x22, [sp, 32]
 	adrp	x22, .LANCHOR48
 	mul	w2, w2, w0
@@ -2994,44 +2988,44 @@ SupperBlkListInit:
 	add	x26, x26, :lo12:.LANCHOR13
 	bl	ftl_memset
 	mov	w21, 0
-	adrp	x0, .LANCHOR47
+	adrp	x0, .LANCHOR46
 	mov	w20, 0
 	mov	w19, 0
-	strh	wzr, [x23, #:lo12:.LANCHOR45]
-	str	xzr, [x0, #:lo12:.LANCHOR47]
+	strh	wzr, [x23, #:lo12:.LANCHOR44]
+	str	xzr, [x0, #:lo12:.LANCHOR46]
 	adrp	x0, .LANCHOR41
 	strh	wzr, [x22, #:lo12:.LANCHOR48]
 	adrp	x27, .LANCHOR3
 	str	xzr, [x0, #:lo12:.LANCHOR41]
-	adrp	x0, .LANCHOR44
-	str	xzr, [x0, #:lo12:.LANCHOR44]
-.L359:
+	adrp	x0, .LANCHOR43
+	str	xzr, [x0, #:lo12:.LANCHOR43]
+.L357:
 	ldrh	w0, [x25]
 	cmp	w19, w0
-	bcs	.L366
+	bcs	.L364
 	adrp	x0, .LANCHOR19
 	ldrh	w8, [x27, #:lo12:.LANCHOR3]
 	mov	x6, 0
 	mov	w5, 0
 	ldrh	w7, [x0, #:lo12:.LANCHOR19]
-	b	.L367
-.L361:
+	b	.L365
+.L359:
 	ldrb	w0, [x26, x6]
 	mov	w1, w19
 	bl	V2P_block
 	bl	FtlBbmIsBadBlock
-	cbnz	w0, .L360
+	cbnz	w0, .L358
 	add	w5, w5, w7
 	and	w5, w5, 65535
-.L360:
+.L358:
 	add	x6, x6, 1
-.L367:
+.L365:
 	cmp	w8, w6, uxth
-	bhi	.L361
-	cbz	w5, .L362
+	bhi	.L359
+	cbz	w5, .L360
 	mov	w0, 32768
 	sdiv	w5, w0, w5
-.L363:
+.L361:
 	ldr	x1, [x24, #:lo12:.LANCHOR40]
 	mov	w0, 6
 	umaddl	x0, w19, w0, x1
@@ -3039,54 +3033,54 @@ SupperBlkListInit:
 	adrp	x0, .LANCHOR51
 	ldrh	w0, [x0, #:lo12:.LANCHOR51]
 	cmp	w0, w19
-	beq	.L364
+	beq	.L362
 	adrp	x0, .LANCHOR52
 	ldrh	w0, [x0, #:lo12:.LANCHOR52]
 	cmp	w0, w19
-	beq	.L364
+	beq	.L362
 	adrp	x0, .LANCHOR53
 	ldrh	w0, [x0, #:lo12:.LANCHOR53]
 	cmp	w0, w19
-	beq	.L364
+	beq	.L362
 	adrp	x1, .LANCHOR42
 	ubfiz	x0, x19, 1, 16
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	ldrh	w0, [x1, x0]
-	cbnz	w0, .L365
+	cbnz	w0, .L363
 	add	w21, w21, 1
 	mov	w0, w19
 	and	w21, w21, 65535
 	bl	INSERT_FREE_LIST
-.L364:
+.L362:
 	add	w19, w19, 1
 	and	w19, w19, 65535
-	b	.L359
-.L362:
+	b	.L357
+.L360:
 	adrp	x1, .LANCHOR42
 	ubfiz	x0, x19, 1, 16
 	mov	w2, -1
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	strh	w2, [x1, x0]
-	b	.L363
-.L365:
+	b	.L361
+.L363:
 	add	w20, w20, 1
 	mov	w0, w19
 	and	w20, w20, 65535
 	bl	INSERT_DATA_LIST
-	b	.L364
-.L366:
-	strh	w20, [x23, #:lo12:.LANCHOR45]
+	b	.L362
+.L364:
+	strh	w20, [x23, #:lo12:.LANCHOR44]
 	add	w20, w20, w21
 	strh	w21, [x22, #:lo12:.LANCHOR48]
 	cmp	w20, w0
-	ble	.L368
+	ble	.L366
 	adrp	x1, .LANCHOR136
 	adrp	x0, .LC1
-	mov	w2, 2216
+	mov	w2, 2210
 	add	x1, x1, :lo12:.LANCHOR136
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L368:
+.L366:
 	mov	w0, 0
 	ldr	x27, [sp, 80]
 	ldp	x19, x20, [sp, 16]
@@ -3146,31 +3140,31 @@ FlashGetBadBlockList:
 	blr	x2
 	and	w0, w0, 65535
 	cmp	w0, 50
-	bls	.L373
+	bls	.L371
 	mov	w2, 256
 	mov	w1, 255
 	mov	x0, x19
 	bl	ftl_memset
 	mov	w0, 0
-.L373:
+.L371:
 	adrp	x1, .LANCHOR0+14
 	ldrh	w1, [x1, #:lo12:.LANCHOR0+14]
 	cmp	w1, 4
-	bne	.L377
+	bne	.L375
 	mov	x1, 0
-.L375:
+.L373:
 	cmp	w0, w1, uxth
-	bhi	.L376
-.L377:
+	bhi	.L374
+.L375:
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
-.L376:
+.L374:
 	ldrh	w2, [x19, x1, lsl 1]
 	lsr	w2, w2, 1
 	strh	w2, [x19, x1, lsl 1]
 	add	x1, x1, 1
-	b	.L375
+	b	.L373
 	.size	FlashGetBadBlockList, .-FlashGetBadBlockList
 	.section	.text.ftl_memcpy,"ax",@progbits
 	.align	2
@@ -3202,7 +3196,7 @@ FlashReadPages:
 	add	x24, x24, :lo12:.LANCHOR137
 	adrp	x25, .LC1
 	add	x25, x25, :lo12:.LC1
-.L381:
+.L379:
 	cmp	x23, x19
 	bne	.L392
 	ldp	x19, x20, [sp, 16]
@@ -3215,34 +3209,34 @@ FlashReadPages:
 	ret
 .L392:
 	ldr	x0, [x19, 8]
-	cbz	x0, .L382
+	cbz	x0, .L380
 	ldr	x0, [x19, 16]
-	cbnz	x0, .L383
-.L382:
+	cbnz	x0, .L381
+.L380:
 	mov	w2, 90
 	mov	x1, x24
 	mov	x0, x25
 	bl	printf
-.L383:
+.L381:
 	ldr	w0, [x19, 4]
 	add	x2, x29, 104
 	add	x1, x29, 108
 	bl	l2p_addr_tran.isra.0
 	ldr	w0, [x29, 104]
 	cmp	w0, 3
-	bls	.L384
+	bls	.L382
 	mov	w0, -1
 	str	w0, [x19]
-.L385:
+.L383:
 	add	x19, x19, 32
-	b	.L381
-.L384:
+	b	.L379
+.L382:
 	ldr	x20, [x19, 8]
 	adrp	x26, .LANCHOR111
 	tst	x20, 63
-	beq	.L386
+	beq	.L384
 	ldr	x20, [x26, #:lo12:.LANCHOR111]
-.L386:
+.L384:
 	adrp	x22, .LANCHOR78
 	add	x22, x22, :lo12:.LANCHOR78
 	ldr	w1, [x29, 108]
@@ -3254,7 +3248,7 @@ FlashReadPages:
 	add	x0, x21, :lo12:.LANCHOR0
 	ldrh	w0, [x0, 14]
 	cmp	w0, 4
-	bne	.L388
+	bne	.L386
 	ldrb	w0, [x29, 104]
 	add	x2, x20, 2048
 	ldr	x4, [x22, 24]
@@ -3264,40 +3258,65 @@ FlashReadPages:
 	add	x3, x3, 8
 	blr	x4
 	cmn	w0, #1
-	beq	.L389
+	beq	.L387
 	ldr	x1, [x19, 16]
 	ldr	w2, [x1, 12]
 	cmn	w2, #1
-	bne	.L390
+	bne	.L388
 	ldr	w2, [x1, 8]
 	cmn	w2, #1
-	bne	.L390
+	bne	.L388
 	ldr	w1, [x1]
 	cmn	w1, #1
-	beq	.L390
-.L389:
+	beq	.L388
+.L387:
 	mov	w1, -1
 	str	w1, [x19]
-.L390:
+.L388:
 	ldr	w1, [x19]
 	cmn	w1, #1
-	beq	.L388
+	beq	.L389
 	cmp	w0, 256
-	bne	.L388
+	bne	.L389
 	str	w0, [x19]
-.L388:
+.L389:
+	ldr	w3, [x19]
+	cmp	w3, 256
+	ccmn	w3, #1, 4, ne
+	bne	.L386
+	ldr	w1, [x19, 4]
+	adrp	x0, .LC11
+	ldr	w2, [x29, 108]
+	add	x0, x0, :lo12:.LC11
+	bl	printf
+	ldr	x1, [x19, 8]
+	cbz	x1, .L391
+	mov	w3, 4
+	adrp	x0, .LC12
+	mov	w2, w3
+	add	x0, x0, :lo12:.LC12
+	bl	rknand_print_hex
+.L391:
+	ldr	x1, [x19, 16]
+	cbz	x1, .L386
+	mov	w3, 4
+	adrp	x0, .LC13
+	mov	w2, w3
+	add	x0, x0, :lo12:.LC13
+	bl	rknand_print_hex
+.L386:
 	ldr	x0, [x26, #:lo12:.LANCHOR111]
 	cmp	x20, x0
-	bne	.L385
+	bne	.L383
 	ldr	x0, [x19, 8]
 	cmp	x20, x0
-	beq	.L385
+	beq	.L383
 	adrp	x1, .LANCHOR12
 	ldrh	w2, [x1, #:lo12:.LANCHOR12]
 	mov	x1, x20
 	lsl	w2, w2, 9
 	bl	ftl_memcpy
-	b	.L385
+	b	.L383
 	.size	FlashReadPages, .-FlashReadPages
 	.section	.text.FtlLoadFactoryBbt,"ax",@progbits
 	.align	2
@@ -3329,10 +3348,10 @@ FtlLoadFactoryBbt:
 	mov	w21, 0
 	mov	w27, -1
 	str	x25, [x1, 16]
-.L410:
+.L419:
 	ldrh	w0, [x23]
 	cmp	w21, w0
-	bcc	.L415
+	bcc	.L424
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -3341,18 +3360,18 @@ FtlLoadFactoryBbt:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 112
 	ret
-.L415:
+.L424:
 	ldrh	w19, [x26, #:lo12:.LANCHOR17]
 	add	x24, x22, :lo12:.LANCHOR138
 	strh	w27, [x20]
 	mov	w3, 61664
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-.L411:
+.L420:
 	ldrh	w0, [x28]
 	sub	w1, w0, #15
 	cmp	w1, w19
-	bgt	.L413
+	bgt	.L422
 	madd	w0, w0, w21, w19
 	mov	w2, 1
 	str	w3, [x29, 108]
@@ -3364,19 +3383,19 @@ FtlLoadFactoryBbt:
 	ldr	w0, [x24]
 	ldr	w3, [x29, 108]
 	cmn	w0, #1
-	beq	.L412
+	beq	.L421
 	ldrh	w0, [x25]
 	cmp	w0, w3
-	bne	.L412
+	bne	.L421
 	strh	w19, [x20]
-.L413:
+.L422:
 	add	w21, w21, 1
 	add	x20, x20, 2
-	b	.L410
-.L412:
+	b	.L419
+.L421:
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-	b	.L411
+	b	.L420
 	.size	FtlLoadFactoryBbt, .-FtlLoadFactoryBbt
 	.section	.text.FtlGetLastWrittenPage,"ax",@progbits
 	.align	2
@@ -3390,10 +3409,10 @@ FtlGetLastWrittenPage:
 	mov	w23, w1
 	stp	x19, x20, [sp, 16]
 	stp	x21, x22, [sp, 32]
-	bne	.L421
+	bne	.L430
 	adrp	x1, .LANCHOR20
 	ldrh	w19, [x1, #:lo12:.LANCHOR20]
-.L422:
+.L431:
 	adrp	x1, .LANCHOR112
 	sub	w19, w19, #1
 	sxth	w19, w19
@@ -3410,24 +3429,24 @@ FtlGetLastWrittenPage:
 	bl	FlashReadPages
 	ldr	w0, [x29, 96]
 	cmn	w0, #1
-	bne	.L423
+	bne	.L432
 	mov	w22, 0
 	mov	w24, 2
-.L424:
+.L433:
 	cmp	w22, w19
-	ble	.L427
-.L423:
+	ble	.L436
+.L432:
 	mov	w0, w19
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
 	ldp	x29, x30, [sp], 160
 	ret
-.L421:
+.L430:
 	adrp	x1, .LANCHOR19
 	ldrh	w19, [x1, #:lo12:.LANCHOR19]
-	b	.L422
-.L427:
+	b	.L431
+.L436:
 	add	w20, w22, w19
 	mov	w2, w23
 	mov	w1, 1
@@ -3439,20 +3458,20 @@ FtlGetLastWrittenPage:
 	bl	FlashReadPages
 	ldr	w0, [x29, 96]
 	cmn	w0, #1
-	bne	.L425
+	bne	.L434
 	ldr	w0, [x29, 100]
 	cmn	w0, #1
-	bne	.L425
+	bne	.L434
 	ldr	w0, [x29, 64]
 	cmn	w0, #1
-	beq	.L425
+	beq	.L434
 	sub	w19, w20, #1
 	sxth	w19, w19
-	b	.L424
-.L425:
+	b	.L433
+.L434:
 	add	w20, w20, 1
 	sxth	w22, w20
-	b	.L424
+	b	.L433
 	.size	FtlGetLastWrittenPage, .-FtlGetLastWrittenPage
 	.section	.text.FtlScanSysBlk,"ax",@progbits
 	.align	2
@@ -3512,12 +3531,12 @@ FtlScanSysBlk:
 	adrp	x0, .LANCHOR82
 	add	x0, x0, :lo12:.LANCHOR82
 	str	x0, [x29, 112]
-.L433:
+.L442:
 	ldr	x0, [x29, 120]
 	ldr	w1, [x29, 172]
 	ldrh	w0, [x0]
 	cmp	w0, w1
-	bls	.L473
+	bls	.L482
 	adrp	x0, .LANCHOR3
 	adrp	x25, .LANCHOR103
 	adrp	x6, .LANCHOR13
@@ -3532,14 +3551,14 @@ FtlScanSysBlk:
 	ldr	x10, [x0, #:lo12:.LANCHOR65]
 	adrp	x0, .LANCHOR24
 	ldrh	w8, [x0, #:lo12:.LANCHOR24]
-	b	.L474
-.L435:
+	b	.L483
+.L444:
 	ldrh	w1, [x29, 172]
 	ldrb	w0, [x6, x5]
 	bl	V2P_block
 	and	w4, w0, 65535
 	bl	FtlBbmIsBadBlock
-	cbnz	w0, .L434
+	cbnz	w0, .L443
 	ubfiz	x0, x22, 5, 16
 	mul	w1, w22, w8
 	add	x0, x7, x0
@@ -3550,19 +3569,19 @@ FtlScanSysBlk:
 	add	x1, x10, x1, sxtw 2
 	str	w4, [x0, 4]
 	stp	x11, x1, [x0, 8]
-.L434:
+.L443:
 	add	x5, x5, 1
-.L474:
+.L483:
 	cmp	w12, w5, uxth
-	bhi	.L435
-	cbnz	w22, .L436
-.L472:
+	bhi	.L444
+	cbnz	w22, .L445
+.L481:
 	ldr	w0, [x29, 172]
 	add	w26, w0, 1
 	and	w0, w26, 65535
 	str	w0, [x29, 172]
-	b	.L433
-.L436:
+	b	.L442
+.L445:
 	mov	w1, w22
 	mov	w2, 1
 	mov	x0, x7
@@ -3573,7 +3592,7 @@ FtlScanSysBlk:
 	adrp	x0, .LANCHOR140
 	add	x0, x0, :lo12:.LANCHOR140
 	str	x0, [x29, 136]
-.L471:
+.L480:
 	ldr	x0, [x25, #:lo12:.LANCHOR103]
 	add	x1, x0, x22
 	ldr	w0, [x0, x22]
@@ -3581,10 +3600,10 @@ FtlScanSysBlk:
 	cmn	w0, #1
 	ldr	x27, [x1, 16]
 	ubfx	x26, x3, 10, 16
-	bne	.L439
+	bne	.L448
 	mov	w5, 16
 	mov	w7, 65535
-.L441:
+.L450:
 	ldr	x0, [x25, #:lo12:.LANCHOR103]
 	add	x6, x25, :lo12:.LANCHOR103
 	mov	w2, 1
@@ -3602,78 +3621,78 @@ FtlScanSysBlk:
 	ldr	w5, [x29, 168]
 	cmp	w0, w7
 	ldr	x6, [x29, 104]
-	bne	.L438
+	bne	.L447
 	ldr	x0, [x6]
 	mov	w1, -1
 	str	w1, [x0, x22]
 	ldr	x0, [x6]
 	ldr	w0, [x0, x22]
 	cmp	w0, w1
-	bne	.L439
-.L440:
+	bne	.L448
+.L449:
 	mov	w1, 1
-	b	.L510
-.L438:
+	b	.L519
+.L447:
 	ldr	x0, [x25, #:lo12:.LANCHOR103]
 	ldr	w0, [x0, x22]
 	cmn	w0, #1
-	bne	.L439
+	bne	.L448
 	sub	w5, w5, #1
 	ands	w5, w5, 65535
-	bne	.L441
-	b	.L440
-.L439:
+	bne	.L450
+	b	.L449
+.L448:
 	adrp	x0, .LANCHOR82
 	ldr	w1, [x0, #:lo12:.LANCHOR82]
 	ldr	w0, [x27, 4]
 	cmn	w1, #1
-	beq	.L442
+	beq	.L451
 	cmp	w1, w0
-	bhi	.L443
-.L442:
+	bhi	.L452
+.L451:
 	cmn	w0, #1
-	beq	.L443
+	beq	.L452
 	ldr	x2, [x29, 112]
 	add	w1, w0, 1
 	str	w1, [x2]
-.L443:
+.L452:
 	ldrh	w1, [x27]
 	mov	w2, 61604
 	cmp	w1, w2
-	beq	.L445
-	bhi	.L446
+	beq	.L454
+	bhi	.L455
 	mov	w0, 61574
 	cmp	w1, w0
-	beq	.L447
-.L444:
+	beq	.L456
+.L453:
 	ldr	x0, [x29, 128]
 	add	x22, x22, 32
 	cmp	x0, x22
-	bne	.L471
-	b	.L472
-.L446:
+	bne	.L480
+	b	.L481
+.L455:
 	mov	w0, 61634
 	cmp	w1, w0
-	beq	.L448
+	beq	.L457
 	mov	w0, 65535
 	cmp	w1, w0
-	bne	.L444
+	bne	.L453
 	mov	w1, 0
-.L510:
+.L519:
 	mov	w0, w26
 	bl	FtlFreeSysBlkQueueIn
-	b	.L444
-.L448:
+	b	.L453
+.L457:
 	ldrh	w1, [x20, #:lo12:.LANCHOR130]
 	ldr	w0, [x21, #:lo12:.LANCHOR30]
 	cmp	w1, w0
-	bls	.L450
+	bls	.L459
 	ldr	x1, [x29, 136]
 	adrp	x0, .LC1
 	mov	w2, 1225
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L450:
+.L459:
 	ldr	w6, [x21, #:lo12:.LANCHOR30]
 	ldr	x3, [x29, 152]
 	ldrh	w1, [x20, #:lo12:.LANCHOR130]
@@ -3684,53 +3703,53 @@ FtlScanSysBlk:
 	sub	w2, w2, #1
 	ldr	x5, [x3, #:lo12:.LANCHOR125]
 	sxth	w2, w2
-.L451:
+.L460:
 	cmp	w0, w2
-	bgt	.L457
-	tbz	w0, #31, .L491
-	b	.L444
-.L457:
+	bgt	.L466
+	tbz	w0, #31, .L500
+	b	.L453
+.L466:
 	sxtw	x8, w0
 	ldr	w11, [x27, 4]
 	lsl	x7, x8, 2
 	add	x10, x5, x7
 	ldr	w7, [x5, x7]
 	cmp	w11, w7
-	bls	.L452
+	bls	.L461
 	ldr	w2, [x5]
-	cbnz	w2, .L453
+	cbnz	w2, .L462
 	cmp	w6, w1
-	beq	.L453
+	beq	.L462
 	add	w1, w1, 1
 	strh	w1, [x20, #:lo12:.LANCHOR130]
-.L453:
+.L462:
 	ldr	x1, [x29, 160]
 	ldr	x6, [x1, #:lo12:.LANCHOR119]
 	mov	w1, 0
-.L454:
+.L463:
 	cmp	w1, w0
-	bne	.L455
+	bne	.L464
 	ldr	w1, [x27, 4]
 	str	w1, [x10]
 	strh	w26, [x6, x8, lsl 1]
-	tbnz	w0, #31, .L444
+	tbnz	w0, #31, .L453
 	ldrh	w1, [x20, #:lo12:.LANCHOR130]
 	ldr	w2, [x21, #:lo12:.LANCHOR30]
 	sub	w2, w2, w1
 	sub	w2, w2, #1
 	cmp	w0, w2, sxth
-	bgt	.L444
-.L491:
+	bgt	.L453
+.L500:
 	add	w1, w1, 1
 	strh	w1, [x20, #:lo12:.LANCHOR130]
 	ldr	w1, [x27, 4]
 	str	w1, [x5, x0, lsl 2]
 	ldr	x1, [x29, 160]
 	ldr	x1, [x1, #:lo12:.LANCHOR119]
-.L509:
+.L518:
 	strh	w26, [x1, x0, lsl 1]
-	b	.L444
-.L455:
+	b	.L453
+.L464:
 	sxtw	x2, w1
 	add	w1, w1, 1
 	lsl	x7, x2, 2
@@ -3742,22 +3761,22 @@ FtlScanSysBlk:
 	add	x7, x6, x2
 	ldrh	w7, [x7, 2]
 	strh	w7, [x6, x2]
-	b	.L454
-.L452:
+	b	.L463
+.L461:
 	sub	w0, w0, #1
 	sxth	x0, w0
-	b	.L451
-.L447:
+	b	.L460
+.L456:
 	ldrh	w1, [x23, #:lo12:.LANCHOR35]
 	ldrh	w0, [x19, #:lo12:.LANCHOR27]
 	cmp	w1, w0
-	bls	.L460
+	bls	.L469
 	ldr	x1, [x29, 136]
 	adrp	x0, .LC1
 	mov	w2, 1266
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L460:
+.L469:
 	ldrh	w6, [x19, #:lo12:.LANCHOR27]
 	ldrh	w2, [x23, #:lo12:.LANCHOR35]
 	sub	w1, w6, #1
@@ -3765,46 +3784,46 @@ FtlScanSysBlk:
 	sub	w5, w1, w2
 	ldr	x1, [x29, 144]
 	ldr	x1, [x1, #:lo12:.LANCHOR122]
-.L461:
+.L470:
 	cmp	w0, w5
-	ble	.L466
+	ble	.L475
 	sxtw	x7, w0
 	ldr	w11, [x27, 4]
 	lsl	x8, x7, 2
 	add	x10, x1, x8
 	ldr	w8, [x1, x8]
 	cmp	w11, w8
-	bls	.L462
+	bls	.L471
 	ldr	w5, [x1]
-	cbnz	w5, .L463
+	cbnz	w5, .L472
 	cmp	w6, w2
-	beq	.L463
+	beq	.L472
 	add	w2, w2, 1
 	strh	w2, [x23, #:lo12:.LANCHOR35]
-.L463:
+.L472:
 	ldr	x6, [x28, #:lo12:.LANCHOR36]
 	mov	w2, 0
-.L464:
+.L473:
 	cmp	w2, w0
-	bne	.L465
+	bne	.L474
 	ldr	w2, [x27, 4]
 	str	w2, [x10]
 	strh	w26, [x6, x7, lsl 1]
-.L466:
-	tbnz	w0, #31, .L444
+.L475:
+	tbnz	w0, #31, .L453
 	ldrh	w2, [x19, #:lo12:.LANCHOR27]
 	ldrh	w5, [x23, #:lo12:.LANCHOR35]
 	sub	w2, w2, #1
 	sub	w2, w2, w5
 	cmp	w0, w2, sxth
-	bgt	.L444
+	bgt	.L453
 	add	w5, w5, 1
 	ldr	w2, [x27, 4]
 	strh	w5, [x23, #:lo12:.LANCHOR35]
 	str	w2, [x1, x0, lsl 2]
 	ldr	x1, [x28, #:lo12:.LANCHOR36]
-	b	.L509
-.L465:
+	b	.L518
+.L474:
 	sxtw	x5, w2
 	add	w2, w2, 1
 	lsl	x8, x5, 2
@@ -3816,61 +3835,61 @@ FtlScanSysBlk:
 	add	x8, x6, x5
 	ldrh	w8, [x8, 2]
 	strh	w8, [x6, x5]
-	b	.L464
-.L462:
+	b	.L473
+.L471:
 	sub	w0, w0, #1
 	sxth	x0, w0
-	b	.L461
-.L445:
+	b	.L470
+.L454:
 	ldrh	w5, [x24, #:lo12:.LANCHOR139]
 	mov	w1, 65535
 	add	x2, x24, :lo12:.LANCHOR139
 	cmp	w5, w1
-	bne	.L468
+	bne	.L477
 	strh	w26, [x24, #:lo12:.LANCHOR139]
 	str	w0, [x2, 8]
-	b	.L444
-.L468:
+	b	.L453
+.L477:
 	ldrh	w0, [x2, 4]
 	cmp	w0, w1
-	beq	.L469
+	beq	.L478
 	mov	w1, 1
 	bl	FtlFreeSysBlkQueueIn
-.L469:
+.L478:
 	add	x0, x24, :lo12:.LANCHOR139
 	ldr	w1, [x27, 4]
 	ldr	w2, [x0, 8]
 	cmp	w2, w1
-	bcs	.L470
+	bcs	.L479
 	ldrh	w2, [x24, #:lo12:.LANCHOR139]
 	strh	w2, [x0, 4]
 	strh	w26, [x24, #:lo12:.LANCHOR139]
 	str	w1, [x0, 8]
-	b	.L444
-.L470:
+	b	.L453
+.L479:
 	strh	w26, [x0, 4]
-	b	.L444
-.L473:
+	b	.L453
+.L482:
 	ldr	x0, [x29, 160]
 	ldr	x2, [x0, #:lo12:.LANCHOR119]
 	ldrh	w0, [x2]
-	cbz	w0, .L475
-.L478:
+	cbz	w0, .L484
+.L487:
 	ldr	x1, [x28, #:lo12:.LANCHOR36]
 	ldrh	w0, [x1]
-	cbz	w0, .L476
-.L477:
+	cbz	w0, .L485
+.L486:
 	ldrh	w1, [x20, #:lo12:.LANCHOR130]
 	ldr	w0, [x21, #:lo12:.LANCHOR30]
 	cmp	w1, w0
-	bls	.L507
+	bls	.L516
 	adrp	x1, .LANCHOR140
 	adrp	x0, .LC1
 	mov	w2, 1391
 	add	x1, x1, :lo12:.LANCHOR140
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L507:
+.L516:
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -3879,24 +3898,24 @@ FtlScanSysBlk:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 176
 	ret
-.L475:
+.L484:
 	ldrh	w0, [x20, #:lo12:.LANCHOR130]
-	cbz	w0, .L478
+	cbz	w0, .L487
 	ldr	w1, [x21, #:lo12:.LANCHOR30]
 	mov	w0, 0
-.L479:
+.L488:
 	cmp	w0, w1
-	bcs	.L478
+	bcs	.L487
 	ldrh	w3, [x2, w0, sxtw 1]
-	cbz	w3, .L480
+	cbz	w3, .L489
 	ldr	x1, [x29, 152]
 	add	x7, x21, :lo12:.LANCHOR30
 	ldr	x4, [x1, #:lo12:.LANCHOR125]
 	mov	w1, w0
-.L481:
+.L490:
 	ldr	w3, [x7]
 	cmp	w1, w3
-	bcs	.L478
+	bcs	.L487
 	sxtw	x6, w1
 	sub	w3, w1, w0
 	lsl	x5, x6, 1
@@ -3908,29 +3927,29 @@ FtlScanSysBlk:
 	strh	w8, [x2, x3, lsl 1]
 	str	w6, [x4, x3, lsl 2]
 	strh	wzr, [x2, x5]
-	b	.L481
-.L480:
+	b	.L490
+.L489:
 	add	w0, w0, 1
 	sxth	w0, w0
-	b	.L479
-.L476:
+	b	.L488
+.L485:
 	ldrh	w0, [x23, #:lo12:.LANCHOR35]
-	cbz	w0, .L477
+	cbz	w0, .L486
 	ldrh	w2, [x19, #:lo12:.LANCHOR27]
 	mov	w0, 0
-.L486:
+.L495:
 	mov	w6, w0
 	cmp	w0, w2
-	bge	.L477
+	bge	.L486
 	ldrh	w3, [x1, w0, sxtw 1]
-	cbz	w3, .L487
+	cbz	w3, .L496
 	ldr	x2, [x29, 144]
 	add	x19, x19, :lo12:.LANCHOR27
 	ldr	x3, [x2, #:lo12:.LANCHOR122]
-.L488:
+.L497:
 	ldrh	w2, [x19]
 	cmp	w0, w2
-	bge	.L477
+	bge	.L486
 	sxtw	x5, w0
 	sub	w2, w0, w6
 	lsl	x4, x5, 1
@@ -3942,11 +3961,11 @@ FtlScanSysBlk:
 	strh	w7, [x1, x2, lsl 1]
 	str	w5, [x3, x2, lsl 2]
 	strh	wzr, [x1, x4]
-	b	.L488
-.L487:
+	b	.L497
+.L496:
 	add	w0, w0, 1
 	sxth	w0, w0
-	b	.L486
+	b	.L495
 	.size	FtlScanSysBlk, .-FtlScanSysBlk
 	.section	.text.FtlLoadBbt,"ax",@progbits
 	.align	2
@@ -3974,11 +3993,11 @@ FtlLoadBbt:
 	add	x24, x24, :lo12:.LANCHOR17
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-.L512:
+.L521:
 	ldrh	w0, [x24]
 	sub	w0, w0, #15
 	cmp	w0, w19
-	bgt	.L515
+	bgt	.L524
 	lsl	w0, w19, 10
 	mov	w2, 1
 	str	w0, [x20, 4]
@@ -3987,7 +4006,7 @@ FtlLoadBbt:
 	bl	FlashReadPages
 	ldr	w0, [x20]
 	cmn	w0, #1
-	bne	.L513
+	bne	.L522
 	ldr	w0, [x20, 4]
 	mov	w2, 1
 	mov	w1, w2
@@ -3995,13 +4014,13 @@ FtlLoadBbt:
 	str	w0, [x20, 4]
 	mov	x0, x20
 	bl	FlashReadPages
-.L513:
+.L522:
 	ldr	w0, [x20]
 	cmn	w0, #1
-	beq	.L514
+	beq	.L523
 	ldrh	w0, [x21]
 	cmp	w0, w25
-	bne	.L514
+	bne	.L523
 	adrp	x1, .LANCHOR37
 	add	x0, x1, :lo12:.LANCHOR37
 	strh	w19, [x1, #:lo12:.LANCHOR37]
@@ -4009,16 +4028,16 @@ FtlLoadBbt:
 	str	w1, [x0, 8]
 	ldrh	w1, [x21, 8]
 	strh	w1, [x0, 4]
-.L515:
+.L524:
 	adrp	x19, .LANCHOR37
 	mov	w0, 65535
 	add	x20, x19, :lo12:.LANCHOR37
 	ldrh	w1, [x19, #:lo12:.LANCHOR37]
 	cmp	w1, w0
-	beq	.L529
+	beq	.L538
 	ldrh	w1, [x20, 4]
 	cmp	w1, w0
-	beq	.L519
+	beq	.L528
 	add	x0, x22, :lo12:.LANCHOR138
 	lsl	w1, w1, 10
 	mov	w2, 1
@@ -4027,21 +4046,21 @@ FtlLoadBbt:
 	bl	FlashReadPages
 	ldr	w0, [x22, #:lo12:.LANCHOR138]
 	cmn	w0, #1
-	beq	.L519
+	beq	.L528
 	ldrh	w1, [x21]
 	mov	w0, 61649
 	cmp	w1, w0
-	bne	.L519
+	bne	.L528
 	ldr	w1, [x20, 8]
 	ldr	w0, [x21, 4]
 	cmp	w0, w1
-	bls	.L519
+	bls	.L528
 	ldrh	w1, [x20, 4]
 	str	w0, [x20, 8]
 	ldrh	w0, [x21, 8]
 	strh	w1, [x19, #:lo12:.LANCHOR37]
 	strh	w0, [x20, 4]
-.L519:
+.L528:
 	ldrh	w0, [x19, #:lo12:.LANCHOR37]
 	add	x24, x19, :lo12:.LANCHOR37
 	mov	w1, 1
@@ -4051,35 +4070,35 @@ FtlLoadBbt:
 	add	w0, w0, 1
 	strh	w0, [x24, 2]
 	add	x24, x22, :lo12:.LANCHOR138
-.L521:
-	tbz	w20, #31, .L524
+.L530:
+	tbz	w20, #31, .L533
 	adrp	x1, .LANCHOR141
 	adrp	x0, .LC1
-	mov	w2, 253
+	mov	w2, 251
 	add	x1, x1, :lo12:.LANCHOR141
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L523:
+.L532:
 	add	x0, x19, :lo12:.LANCHOR37
 	ldrh	w1, [x21, 10]
 	strh	w1, [x0, 6]
 	mov	w1, 65535
 	ldrh	w0, [x21, 12]
 	cmp	w0, w1
-	beq	.L526
+	beq	.L535
 	adrp	x1, .LANCHOR2
 	ldr	w2, [x1, #:lo12:.LANCHOR2]
 	cmp	w0, w2
-	beq	.L526
+	beq	.L535
 	adrp	x1, .LANCHOR6
 	ldrh	w1, [x1, #:lo12:.LANCHOR6]
 	lsr	w1, w1, 2
 	cmp	w2, w1
-	bcs	.L526
+	bcs	.L535
 	cmp	w0, w1
-	bcs	.L526
+	bcs	.L535
 	bl	FtlSysBlkNumInit
-.L526:
+.L535:
 	add	x19, x19, :lo12:.LANCHOR37
 	adrp	x21, .LANCHOR10
 	adrp	x23, .LANCHOR127
@@ -4088,23 +4107,23 @@ FtlLoadBbt:
 	add	x23, x23, :lo12:.LANCHOR127
 	add	x22, x22, :lo12:.LANCHOR138
 	mov	w20, 0
-.L527:
+.L536:
 	ldrh	w0, [x21]
 	cmp	w20, w0
-	bcc	.L528
+	bcc	.L537
 	mov	w0, 0
-.L511:
+.L520:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
 	ldr	x25, [sp, 64]
 	ldp	x29, x30, [sp], 80
 	ret
-.L514:
+.L523:
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-	b	.L512
-.L524:
+	b	.L521
+.L533:
 	ldrh	w0, [x19, #:lo12:.LANCHOR37]
 	mov	w2, 1
 	mov	w1, w2
@@ -4116,15 +4135,15 @@ FtlLoadBbt:
 	bl	FlashReadPages
 	ldr	w0, [x24]
 	cmn	w0, #1
-	beq	.L522
+	beq	.L531
 	ldrh	w0, [x21]
 	cmp	w0, w25
-	beq	.L523
-.L522:
+	beq	.L532
+.L531:
 	sub	w20, w20, #1
 	sxth	w20, w20
-	b	.L521
-.L528:
+	b	.L530
+.L537:
 	ldrh	w2, [x23]
 	ldr	x0, [x22, 8]
 	mul	w1, w2, w20
@@ -4133,10 +4152,10 @@ FtlLoadBbt:
 	add	x1, x0, x1, lsl 2
 	ldr	x0, [x19], 8
 	bl	ftl_memcpy
-	b	.L527
-.L529:
+	b	.L536
+.L538:
 	mov	w0, -1
-	b	.L511
+	b	.L520
 	.size	FtlLoadBbt, .-FtlLoadBbt
 	.section	.text.FlashProgPages,"ax",@progbits
 	.align	2
@@ -4163,18 +4182,18 @@ FlashProgPages:
 	mov	x25, x0
 	add	x28, x24, :lo12:.LANCHOR78
 	lsl	w27, w23, 3
-.L542:
+.L551:
 	cmp	x25, x20
-	bne	.L555
+	bne	.L564
 	ldr	w0, [x29, 104]
-	cbz	w0, .L568
+	cbz	w0, .L578
 	adrp	x21, .LANCHOR111
 	adrp	x22, .LANCHOR113
 	mov	x23, x21
 	mov	x24, x22
-.L557:
+.L566:
 	cmp	x19, x20
-	beq	.L568
+	beq	.L578
 	ldr	x1, [x21, #:lo12:.LANCHOR111]
 	ldr	x0, [x22, #:lo12:.LANCHOR113]
 	str	wzr, [x1]
@@ -4188,78 +4207,87 @@ FlashProgPages:
 	bl	FlashReadPages
 	ldr	w26, [x29, 128]
 	cmn	w26, #1
-	bne	.L558
+	bne	.L567
 	ldr	w1, [x19, 4]
-	adrp	x0, .LC11
-	add	x0, x0, :lo12:.LC11
+	adrp	x0, .LC14
+	add	x0, x0, :lo12:.LC14
 	bl	printf
 	str	w26, [x19]
-.L558:
+.L567:
+	ldr	w26, [x29, 128]
+	cmp	w26, 256
+	bne	.L568
+	ldr	w1, [x19, 4]
+	adrp	x0, .LC15
+	add	x0, x0, :lo12:.LC15
+	bl	printf
+	str	w26, [x19]
+.L568:
 	ldr	x0, [x19, 16]
-	cbz	x0, .L559
+	cbz	x0, .L569
 	ldr	w2, [x0]
 	ldr	x0, [x24, #:lo12:.LANCHOR113]
 	ldr	w3, [x0]
 	cmp	w2, w3
-	beq	.L559
+	beq	.L569
 	ldr	w1, [x19, 4]
-	adrp	x0, .LC12
-	add	x0, x0, :lo12:.LC12
+	adrp	x0, .LC16
+	add	x0, x0, :lo12:.LC16
 	bl	printf
 	mov	w0, -1
 	str	w0, [x19]
-.L559:
+.L569:
 	ldr	x0, [x19, 8]
-	cbz	x0, .L560
+	cbz	x0, .L570
 	ldr	w2, [x0]
 	ldr	x0, [x23, #:lo12:.LANCHOR111]
 	ldr	w3, [x0]
 	cmp	w2, w3
-	beq	.L560
+	beq	.L570
 	ldr	w1, [x19, 4]
-	adrp	x0, .LC13
-	add	x0, x0, :lo12:.LC13
+	adrp	x0, .LC17
+	add	x0, x0, :lo12:.LC17
 	bl	printf
 	mov	w0, -1
 	str	w0, [x19]
-.L560:
+.L570:
 	add	x19, x19, 32
-	b	.L557
-.L555:
+	b	.L566
+.L564:
 	ldr	x0, [x25, 8]
-	cbz	x0, .L543
+	cbz	x0, .L552
 	ldr	x0, [x25, 16]
-	cbnz	x0, .L544
-.L543:
+	cbnz	x0, .L553
+.L552:
 	adrp	x0, .LC1
-	mov	w2, 134
+	mov	w2, 142
 	mov	x1, x22
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L544:
+.L553:
 	ldr	w0, [x25, 4]
 	add	x2, x29, 120
 	add	x1, x29, 124
 	bl	l2p_addr_tran.isra.0
 	ldr	w0, [x29, 120]
 	cmp	w0, 3
-	bls	.L545
-.L581:
+	bls	.L554
+.L591:
 	mov	w0, -1
 	str	w0, [x25]
-	b	.L546
-.L545:
-	cbnz	w0, .L547
+	b	.L555
+.L554:
+	cbnz	w0, .L556
 	ldr	w0, [x29, 124]
 	cmp	w27, w0
-	bls	.L547
+	bls	.L556
 	adrp	x21, .LANCHOR142
 	adrp	x22, .LC6
 	mov	w23, -1
 	add	x21, x21, :lo12:.LANCHOR142
 	add	x22, x22, :lo12:.LC6
-	b	.L579
-.L549:
+	b	.L589
+.L558:
 	ldr	w2, [x19, 4]
 	mov	x1, x21
 	str	w23, [x19]
@@ -4278,10 +4306,10 @@ FlashProgPages:
 	mov	w2, w3
 	add	x0, x0, :lo12:.LC8
 	bl	rknand_print_hex
-.L579:
+.L589:
 	cmp	x19, x20
-	bne	.L549
-.L568:
+	bne	.L558
+.L578:
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -4290,20 +4318,20 @@ FlashProgPages:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 160
 	ret
-.L547:
+.L556:
 	ldr	x1, [x25, 8]
 	tst	x1, 63
-	beq	.L562
+	beq	.L572
 	adrp	x0, .LANCHOR111
 	ldr	x26, [x0, #:lo12:.LANCHOR111]
 	cmp	x1, x26
-	beq	.L550
+	beq	.L559
 	adrp	x0, .LANCHOR12
 	ldrh	w2, [x0, #:lo12:.LANCHOR12]
 	mov	x0, x26
 	lsl	w2, w2, 9
 	bl	ftl_memcpy
-.L550:
+.L559:
 	add	x0, x24, :lo12:.LANCHOR78
 	ldr	w1, [x29, 124]
 	ldr	x3, [x25, 16]
@@ -4311,13 +4339,13 @@ FlashProgPages:
 	ldr	x6, [x0, 16]
 	ldrb	w0, [x29, 120]
 	blr	x6
-	cbnz	w0, .L551
+	cbnz	w0, .L560
 	str	wzr, [x25]
-.L552:
+.L561:
 	add	x0, x21, :lo12:.LANCHOR0
 	ldrh	w0, [x0, 14]
 	cmp	w0, 4
-	bne	.L546
+	bne	.L555
 	ldrb	w0, [x29, 120]
 	add	x2, x26, 2048
 	ldr	x6, [x28, 16]
@@ -4326,17 +4354,17 @@ FlashProgPages:
 	add	w1, w23, w1
 	add	x3, x3, 8
 	blr	x6
-	cbnz	w0, .L581
-.L546:
+	cbnz	w0, .L591
+.L555:
 	add	x25, x25, 32
-	b	.L542
-.L562:
+	b	.L551
+.L572:
 	mov	x26, x1
-	b	.L550
-.L551:
+	b	.L559
+.L560:
 	mov	w0, -1
 	str	w0, [x25]
-	b	.L552
+	b	.L561
 	.size	FlashProgPages, .-FlashProgPages
 	.section	.text.FtlLowFormatEraseBlock,"ax",@progbits
 	.align	2
@@ -4370,43 +4398,43 @@ FtlLowFormatEraseBlock:
 	ldrh	w12, [x25, #:lo12:.LANCHOR24]
 	stp	x27, x28, [sp, 80]
 	str	x0, [x29, 112]
-.L583:
+.L593:
 	cmp	w8, w5, uxth
-	bhi	.L587
-	cbz	w24, .L582
+	bhi	.L597
+	cbz	w24, .L592
 	mov	w2, w24
 	ubfiz	x24, x24, 5, 16
 	mov	x26, 0
 	mov	w1, 0
 	mov	x0, x6
 	bl	FlashEraseBlocks
-.L591:
+.L601:
 	ldr	x0, [x21, #:lo12:.LANCHOR79]
 	add	x1, x0, x26
 	ldr	w0, [x0, x26]
 	cmn	w0, #1
-	bne	.L590
+	bne	.L600
 	ldr	w0, [x1, 4]
 	add	w19, w19, 1
 	and	w19, w19, 65535
 	lsr	w0, w0, 10
 	bl	FtlBbmMapBadBlock
-.L590:
+.L600:
 	add	x26, x26, 32
 	cmp	x26, x24
-	bne	.L591
-	cbz	w22, .L604
+	bne	.L601
+	cbz	w22, .L614
 	adrp	x0, .LANCHOR20
 	mov	w26, 1
 	ldrh	w28, [x0, #:lo12:.LANCHOR20]
-.L592:
+.L602:
 	add	x0, x20, :lo12:.LANCHOR3
 	adrp	x27, .LANCHOR13
 	str	x0, [x29, 120]
 	mov	w24, 0
 	add	x0, x27, :lo12:.LANCHOR13
 	str	x0, [x29, 104]
-.L600:
+.L610:
 	ldr	x0, [x29, 120]
 	mov	x5, 0
 	ldr	x6, [x21, #:lo12:.LANCHOR79]
@@ -4417,10 +4445,10 @@ FtlLowFormatEraseBlock:
 	ldr	x8, [x0, #:lo12:.LANCHOR109]
 	ldr	x0, [x29, 112]
 	ldr	x10, [x0, #:lo12:.LANCHOR110]
-.L593:
+.L603:
 	cmp	w7, w5, uxth
-	bhi	.L596
-	cbz	w20, .L582
+	bhi	.L606
+	cbz	w20, .L592
 	mov	w1, w20
 	mov	w3, 1
 	mov	w2, w26
@@ -4428,11 +4456,11 @@ FtlLowFormatEraseBlock:
 	bl	FlashProgPages
 	mov	x27, 0
 	ubfiz	x1, x20, 5, 16
-.L599:
+.L609:
 	ldr	x0, [x21, #:lo12:.LANCHOR79]
 	add	x3, x0, x27
 	ldr	w0, [x0, x27]
-	cbz	w0, .L598
+	cbz	w0, .L608
 	ldr	w0, [x3, 4]
 	add	w19, w19, 1
 	str	x1, [x29, 96]
@@ -4440,36 +4468,36 @@ FtlLowFormatEraseBlock:
 	lsr	w0, w0, 10
 	bl	FtlBbmMapBadBlock
 	ldr	x1, [x29, 96]
-.L598:
+.L608:
 	add	x27, x27, 32
 	cmp	x1, x27
-	bne	.L599
+	bne	.L609
 	add	w24, w24, 1
 	cmp	w28, w24, uxth
-	bhi	.L600
+	bhi	.L610
 	mov	x24, 0
-.L602:
-	cbz	w22, .L601
+.L612:
+	cbz	w22, .L611
 	ldr	x0, [x21, #:lo12:.LANCHOR79]
 	add	x1, x0, x24
 	ldr	w0, [x0, x24]
-	cbnz	w0, .L601
+	cbnz	w0, .L611
 	ldr	w0, [x1, 4]
 	mov	w1, 1
 	lsr	w0, w0, 10
 	bl	FtlFreeSysBlkQueueIn
-.L601:
+.L611:
 	add	x24, x24, 32
 	cmp	x24, x27
-	bne	.L602
+	bne	.L612
 	cmp	w23, 63
 	ccmp	w22, 0, 0, hi
-	beq	.L582
+	beq	.L592
 	ldr	x0, [x21, #:lo12:.LANCHOR79]
 	mov	w2, w20
 	mov	w1, w26
 	bl	FlashEraseBlocks
-.L582:
+.L592:
 	mov	w0, w19
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -4478,7 +4506,7 @@ FtlLowFormatEraseBlock:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 128
 	ret
-.L587:
+.L597:
 	lsl	x0, x5, 5
 	mov	w1, w23
 	str	wzr, [x6, x0]
@@ -4486,13 +4514,13 @@ FtlLowFormatEraseBlock:
 	bl	V2P_block
 	and	w13, w0, 65535
 	mov	w14, w13
-	cbz	w22, .L584
+	cbz	w22, .L594
 	bl	IsBlkInVendorPart
-	cbnz	w0, .L585
-.L584:
+	cbnz	w0, .L595
+.L594:
 	mov	w0, w14
 	bl	FtlBbmIsBadBlock
-	cbnz	w0, .L586
+	cbnz	w0, .L596
 	ubfiz	x0, x24, 5, 16
 	mul	w1, w24, w12
 	add	x0, x6, x0
@@ -4503,18 +4531,18 @@ FtlLowFormatEraseBlock:
 	add	x1, x11, x1, sxtw 2
 	str	w13, [x0, 4]
 	stp	x10, x1, [x0, 8]
-.L585:
+.L595:
 	add	x5, x5, 1
-	b	.L583
-.L586:
+	b	.L593
+.L596:
 	add	w19, w19, 1
 	and	w19, w19, 65535
-	b	.L585
-.L604:
+	b	.L595
+.L614:
 	mov	w26, 0
 	mov	w28, 2
-	b	.L592
-.L596:
+	b	.L602
+.L606:
 	lsl	x0, x5, 5
 	mov	w1, w23
 	str	wzr, [x6, x0]
@@ -4523,13 +4551,13 @@ FtlLowFormatEraseBlock:
 	bl	V2P_block
 	and	w12, w0, 65535
 	mov	w13, w12
-	cbz	w22, .L594
+	cbz	w22, .L604
 	bl	IsBlkInVendorPart
-	cbnz	w0, .L595
-.L594:
+	cbnz	w0, .L605
+.L604:
 	mov	w0, w13
 	bl	FtlBbmIsBadBlock
-	cbnz	w0, .L595
+	cbnz	w0, .L605
 	ubfiz	x0, x20, 5, 16
 	mul	w1, w20, w11
 	add	x0, x6, x0
@@ -4540,9 +4568,9 @@ FtlLowFormatEraseBlock:
 	add	x1, x10, x1, sxtw 2
 	str	w12, [x0, 4]
 	stp	x8, x1, [x0, 8]
-.L595:
+.L605:
 	add	x5, x5, 1
-	b	.L593
+	b	.L603
 	.size	FtlLowFormatEraseBlock, .-FtlLowFormatEraseBlock
 	.section	.text.FlashTestBlk,"ax",@progbits
 	.align	2
@@ -4554,7 +4582,7 @@ FlashTestBlk:
 	stp	x19, x20, [sp, 16]
 	and	w19, w0, 65535
 	cmp	w19, 11
-	bls	.L628
+	bls	.L638
 	adrp	x20, .LANCHOR112
 	mov	w2, 32
 	mov	w1, 165
@@ -4579,7 +4607,7 @@ FlashTestBlk:
 	mov	w1, w3
 	bl	FlashProgPages
 	ldr	w0, [x29, 32]
-	cbnz	w0, .L629
+	cbnz	w0, .L639
 	add	w0, w19, 1
 	mov	w3, 1
 	str	w0, [x29, 36]
@@ -4590,23 +4618,23 @@ FlashTestBlk:
 	ldr	w0, [x29, 32]
 	cmp	w0, 0
 	csetm	w20, ne
-.L627:
+.L637:
 	mov	w2, 1
 	mov	w1, 0
 	add	x0, x29, 32
 	str	w19, [x29, 36]
 	bl	FlashEraseBlocks
-.L625:
+.L635:
 	mov	w0, w20
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 128
 	ret
-.L629:
+.L639:
 	mov	w20, -1
-	b	.L627
-.L628:
+	b	.L637
+.L638:
 	mov	w20, 0
-	b	.L625
+	b	.L635
 	.size	FlashTestBlk, .-FlashTestBlk
 	.section	.text.FtlBbmTblFlush,"ax",@progbits
 	.align	2
@@ -4639,20 +4667,20 @@ FtlBbmTblFlush:
 	add	x27, x27, :lo12:.LANCHOR127
 	mov	w1, 0
 	bl	ftl_memset
-.L632:
+.L642:
 	ldrh	w0, [x26]
 	cmp	w24, w0
-	blt	.L633
+	blt	.L643
 	add	x20, x20, :lo12:.LANCHOR138
 	add	x19, x21, :lo12:.LANCHOR37
 	mov	w2, 16
 	mov	w1, 255
-	adrp	x24, .LC14
+	adrp	x25, .LC18
 	adrp	x26, .LANCHOR20
 	ldr	x27, [x20, 16]
-	add	x24, x24, :lo12:.LC14
+	add	x25, x25, :lo12:.LC18
 	add	x26, x26, :lo12:.LANCHOR20
-	mov	w25, 0
+	mov	w24, 0
 	mov	x0, x27
 	bl	ftl_memset
 	mov	w0, -3887
@@ -4669,7 +4697,10 @@ FtlBbmTblFlush:
 	adrp	x0, .LANCHOR2
 	ldr	w0, [x0, #:lo12:.LANCHOR2]
 	strh	w0, [x27, 12]
-.L634:
+	adrp	x0, .LANCHOR143
+	ldr	w0, [x0, #:lo12:.LANCHOR143]
+	strh	w0, [x27, 14]
+.L644:
 	ldrh	w1, [x19]
 	ldrh	w4, [x27, 10]
 	ldrh	w2, [x19, 2]
@@ -4681,13 +4712,13 @@ FtlBbmTblFlush:
 	orr	w0, w2, w1, lsl 10
 	str	wzr, [x20]
 	str	w0, [x20, 4]
-	mov	x0, x24
+	mov	x0, x25
 	bl	printf
 	ldrh	w0, [x26]
 	ldrh	w1, [x19, 2]
 	sub	w0, w0, #1
 	cmp	w1, w0
-	blt	.L635
+	blt	.L645
 	ldr	w0, [x19, 8]
 	mov	w2, 1
 	ldrh	w1, [x19, 4]
@@ -4706,7 +4737,7 @@ FtlBbmTblFlush:
 	str	w1, [x0, 4]
 	mov	w1, w2
 	bl	FlashEraseBlocks
-.L635:
+.L645:
 	mov	w3, 1
 	mov	x0, x20
 	mov	w2, w3
@@ -4717,23 +4748,23 @@ FtlBbmTblFlush:
 	strh	w0, [x19, 2]
 	ldr	w0, [x20]
 	cmn	w0, #1
-	bne	.L636
+	bne	.L646
 	ldr	w1, [x20, 4]
 	add	w21, w21, 1
-	adrp	x0, .LC15
+	adrp	x0, .LC19
 	and	w21, w21, 65535
-	add	x0, x0, :lo12:.LC15
+	add	x0, x0, :lo12:.LC19
 	bl	printf
 	cmp	w21, 3
-	bls	.L634
+	bls	.L644
 	ldr	w1, [x20, 4]
-	adrp	x0, .LC16
+	adrp	x0, .LC20
 	mov	w2, w21
-	add	x0, x0, :lo12:.LC16
+	add	x0, x0, :lo12:.LC20
 	bl	printf
-.L638:
-	b	.L638
-.L633:
+.L648:
+	b	.L648
+.L643:
 	ldrh	w2, [x27]
 	ldr	x1, [x25], 8
 	ldr	x0, [x19, 8]
@@ -4742,12 +4773,13 @@ FtlBbmTblFlush:
 	add	w24, w24, 1
 	add	x0, x0, x3, sxtw 2
 	bl	ftl_memcpy
-	b	.L632
-.L639:
-	mov	w25, 1
-	b	.L634
-.L636:
-	cbz	w25, .L639
+	b	.L642
+.L646:
+	add	w24, w24, 1
+	cmp	w24, 1
+	beq	.L644
+	cmp	w0, 256
+	beq	.L644
 	mov	w0, 0
 	ldr	x27, [sp, 80]
 	ldp	x19, x20, [sp, 16]
@@ -4769,13 +4801,13 @@ allocate_data_superblock:
 	stp	x23, x24, [sp, 48]
 	add	x24, x28, :lo12:.LANCHOR48
 	stp	x19, x20, [sp, 16]
-	adrp	x27, .LANCHOR45
+	adrp	x27, .LANCHOR44
 	mov	x19, x0
 	stp	x21, x22, [sp, 32]
-	add	x0, x27, :lo12:.LANCHOR45
+	add	x0, x27, :lo12:.LANCHOR44
 	stp	x25, x26, [sp, 64]
 	str	x0, [x29, 104]
-.L642:
+.L657:
 	ldr	x1, [x29, 104]
 	adrp	x23, .LANCHOR5
 	ldrh	w0, [x28, #:lo12:.LANCHOR48]
@@ -4783,18 +4815,18 @@ allocate_data_superblock:
 	add	w0, w0, w1
 	ldrh	w1, [x23, #:lo12:.LANCHOR5]
 	cmp	w0, w1
-	ble	.L643
-	adrp	x1, .LANCHOR143
+	ble	.L658
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	mov	w2, 2661
-	add	x1, x1, :lo12:.LANCHOR143
+	mov	w2, 2656
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L643:
+.L658:
 	adrp	x0, .LANCHOR53
 	add	x0, x0, :lo12:.LANCHOR53
 	cmp	x19, x0
-	bne	.L669
+	bne	.L684
 	adrp	x1, .LANCHOR95
 	ldrh	w0, [x24]
 	ldr	w1, [x1, #:lo12:.LANCHOR95]
@@ -4803,74 +4835,74 @@ allocate_data_superblock:
 	add	w0, w0, 1
 	add	w1, w0, w1, lsr 2
 	ands	w1, w1, 65535
-	beq	.L644
+	beq	.L659
 	sub	w1, w1, #1
 	and	w1, w1, 65535
-.L644:
-	adrp	x0, .LANCHOR47
-	add	x0, x0, :lo12:.LANCHOR47
+.L659:
+	adrp	x0, .LANCHOR46
+	add	x0, x0, :lo12:.LANCHOR46
 	bl	List_pop_index_node
 	and	w22, w0, 65535
 	ldrh	w0, [x24]
-	cbnz	w0, .L645
-	adrp	x1, .LANCHOR143
+	cbnz	w0, .L660
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	mov	w2, 2670
-	add	x1, x1, :lo12:.LANCHOR143
+	mov	w2, 2665
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L645:
+.L660:
 	ldrh	w0, [x24]
 	sub	w0, w0, #1
 	strh	w0, [x24]
 	ldrh	w0, [x23, #:lo12:.LANCHOR5]
 	cmp	w0, w22
-	bls	.L642
+	bls	.L657
 	adrp	x25, .LANCHOR42
 	ubfiz	x20, x22, 1, 16
 	ldr	x0, [x25, #:lo12:.LANCHOR42]
 	ldrh	w21, [x0, x20]
-	cbnz	w21, .L642
+	cbnz	w21, .L657
 	strh	w22, [x19]
 	mov	x0, x19
 	bl	make_superblock
 	ldrb	w0, [x19, 7]
-	cbnz	w0, .L647
+	cbnz	w0, .L662
 	ldr	x0, [x25, #:lo12:.LANCHOR42]
 	mov	w1, -1
 	strh	w1, [x0, x20]
 	mov	w0, w22
 	bl	INSERT_DATA_LIST
-	ldrh	w1, [x27, #:lo12:.LANCHOR45]
+	ldrh	w1, [x27, #:lo12:.LANCHOR44]
 	ldrh	w0, [x24]
 	add	w0, w0, w1
 	ldrh	w1, [x23, #:lo12:.LANCHOR5]
 	cmp	w0, w1
-	ble	.L642
-	mov	w2, 2684
-	adrp	x1, .LANCHOR143
+	ble	.L657
+	mov	w2, 2679
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	add	x1, x1, :lo12:.LANCHOR143
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-	b	.L642
-.L669:
+	b	.L657
+.L684:
 	mov	w1, 0
-	b	.L644
-.L647:
-	ldrh	w1, [x27, #:lo12:.LANCHOR45]
+	b	.L659
+.L662:
+	ldrh	w1, [x27, #:lo12:.LANCHOR44]
 	ldrh	w0, [x24]
 	add	w0, w0, w1
 	ldrh	w1, [x23, #:lo12:.LANCHOR5]
 	cmp	w0, w1
-	ble	.L649
-	adrp	x1, .LANCHOR143
+	ble	.L664
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	mov	w2, 2687
-	add	x1, x1, :lo12:.LANCHOR143
+	mov	w2, 2682
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L649:
+.L664:
 	adrp	x0, .LANCHOR3
 	adrp	x25, .LANCHOR79
 	add	x26, x19, 16
@@ -4882,40 +4914,40 @@ allocate_data_superblock:
 	add	x1, x3, 8
 	add	x0, x0, 8
 	add	x0, x3, x0
-.L650:
+.L665:
 	cmp	x0, x1
-	bne	.L652
-	cbnz	w21, .L653
-	adrp	x1, .LANCHOR143
+	bne	.L667
+	cbnz	w21, .L668
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	mov	w2, 2698
-	add	x1, x1, :lo12:.LANCHOR143
+	mov	w2, 2693
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L653:
-	adrp	x0, .LANCHOR144
-	ldrh	w0, [x0, #:lo12:.LANCHOR144]
+.L668:
+	adrp	x0, .LANCHOR145
+	ldrh	w0, [x0, #:lo12:.LANCHOR145]
 	cmp	w0, w22
-	bne	.L654
-	adrp	x1, .LANCHOR143
+	bne	.L669
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	mov	w2, 2700
-	add	x1, x1, :lo12:.LANCHOR143
+	mov	w2, 2695
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L654:
+.L669:
 	ldrb	w0, [x19, 8]
-	adrp	x6, .LANCHOR43
+	adrp	x6, .LANCHOR47
 	adrp	x7, .LANCHOR14
 	adrp	x5, .LANCHOR90
 	adrp	x4, .LANCHOR91
-	ldr	x1, [x6, #:lo12:.LANCHOR43]
-	cbnz	w0, .L655
+	ldr	x1, [x6, #:lo12:.LANCHOR47]
+	cbnz	w0, .L670
 	ldrh	w0, [x1, x20]
-	cbz	w0, .L656
+	cbz	w0, .L671
 	ldrh	w2, [x7, #:lo12:.LANCHOR14]
 	add	w0, w0, w2
-.L680:
+.L695:
 	strh	w0, [x1, x20]
 	mov	w1, 0
 	ldr	w0, [x5, #:lo12:.LANCHOR90]
@@ -4923,23 +4955,23 @@ allocate_data_superblock:
 	str	w0, [x5, #:lo12:.LANCHOR90]
 	mov	w0, w22
 	bl	ftl_set_blk_mode
-.L658:
-	ldr	x0, [x6, #:lo12:.LANCHOR43]
+.L673:
+	ldr	x0, [x6, #:lo12:.LANCHOR47]
 	ldrh	w1, [x0, x20]
 	adrp	x0, .LANCHOR92
 	ldr	w2, [x0, #:lo12:.LANCHOR92]
 	cmp	w1, w2
-	bls	.L659
+	bls	.L674
 	str	w1, [x0, #:lo12:.LANCHOR92]
-.L659:
+.L674:
 	ldr	w2, [x5, #:lo12:.LANCHOR90]
 	ldr	w1, [x4, #:lo12:.LANCHOR91]
 	ldrh	w0, [x7, #:lo12:.LANCHOR14]
 	madd	w0, w0, w2, w1
 	ldrh	w1, [x23, #:lo12:.LANCHOR5]
 	udiv	w0, w0, w1
-	adrp	x1, .LANCHOR145
-	str	w0, [x1, #:lo12:.LANCHOR145]
+	adrp	x1, .LANCHOR143
+	str	w0, [x1, #:lo12:.LANCHOR143]
 	adrp	x0, .LANCHOR118
 	ldr	x1, [x0, #:lo12:.LANCHOR118]
 	ldr	w0, [x1, 16]
@@ -4950,48 +4982,48 @@ allocate_data_superblock:
 	add	x1, x1, 4
 	add	x2, x0, 4
 	add	x1, x0, x1
-.L660:
+.L675:
 	cmp	x1, x2
-	bne	.L661
+	bne	.L676
 	ldrb	w1, [x19, 8]
 	mov	w2, w21
 	mov	x23, 0
 	bl	FlashEraseBlocks
 	mov	w1, 0
-.L662:
+.L677:
 	cmp	w21, w23, uxth
-	bhi	.L664
-	cbz	w1, .L665
+	bhi	.L679
+	cbz	w1, .L680
 	mov	w0, w22
 	bl	update_multiplier_value
 	bl	FtlBbmTblFlush
-.L665:
+.L680:
 	ldrb	w0, [x19, 7]
-	cbnz	w0, .L666
+	cbnz	w0, .L681
 	adrp	x0, .LANCHOR42
 	mov	w1, -1
 	ldr	x0, [x0, #:lo12:.LANCHOR42]
 	strh	w1, [x0, x20]
-	b	.L642
-.L652:
+	b	.L657
+.L667:
 	ldrh	w2, [x4]
 	stp	xzr, xzr, [x1]
 	cmp	w2, w6
-	beq	.L651
+	beq	.L666
 	ubfiz	x5, x21, 5, 16
 	add	w21, w21, 1
 	add	x5, x3, x5
 	and	w21, w21, 65535
 	lsl	w2, w2, 10
 	str	w2, [x5, 4]
-.L651:
+.L666:
 	add	x1, x1, 32
 	add	x4, x4, 2
-	b	.L650
-.L656:
+	b	.L665
+.L671:
 	mov	w0, 2
-	b	.L680
-.L655:
+	b	.L695
+.L670:
 	ldrh	w0, [x1, x20]
 	add	w0, w0, 1
 	strh	w0, [x1, x20]
@@ -5000,19 +5032,19 @@ allocate_data_superblock:
 	str	w0, [x4, #:lo12:.LANCHOR91]
 	mov	w0, w22
 	bl	ftl_set_blk_mode.part.6
-	b	.L658
-.L661:
+	b	.L673
+.L676:
 	ldr	w3, [x2]
 	and	w3, w3, -1024
 	str	w3, [x2], 32
-	b	.L660
-.L664:
+	b	.L675
+.L679:
 	ldr	x2, [x25, #:lo12:.LANCHOR79]
 	lsl	x0, x23, 5
 	add	x3, x2, x0
 	ldr	w2, [x2, x0]
 	cmn	w2, #1
-	bne	.L663
+	bne	.L678
 	add	w1, w1, 1
 	ldr	w0, [x3, 4]
 	stp	w2, w1, [x29, 96]
@@ -5023,11 +5055,11 @@ allocate_data_superblock:
 	ldrb	w0, [x19, 7]
 	sub	w0, w0, #1
 	strb	w0, [x19, 7]
-.L663:
+.L678:
 	add	x23, x23, 1
 	add	x26, x26, 2
-	b	.L662
-.L666:
+	b	.L677
+.L681:
 	adrp	x1, .LANCHOR19
 	adrp	x2, .LANCHOR82
 	strh	wzr, [x19, 2]
@@ -5045,17 +5077,17 @@ allocate_data_superblock:
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	strh	w0, [x1, x20]
 	ldrh	w0, [x19, 4]
-	cbz	w0, .L667
+	cbz	w0, .L682
 	ldrb	w0, [x19, 7]
-	cbnz	w0, .L668
-.L667:
-	adrp	x1, .LANCHOR143
+	cbnz	w0, .L683
+.L682:
+	adrp	x1, .LANCHOR144
 	adrp	x0, .LC1
-	mov	w2, 2753
-	add	x1, x1, :lo12:.LANCHOR143
+	mov	w2, 2748
+	add	x1, x1, :lo12:.LANCHOR144
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L668:
+.L683:
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -5080,17 +5112,17 @@ FtlGcFreeBadSuperBlk:
 	stp	x19, x20, [sp, 16]
 	stp	x23, x24, [sp, 48]
 	str	x27, [sp, 80]
-	cbz	w0, .L682
+	cbz	w0, .L697
 	adrp	x23, .LANCHOR75
 	add	x24, x23, :lo12:.LANCHOR75
 	mov	w19, 0
-.L683:
+.L698:
 	adrp	x0, .LANCHOR3
 	ldrh	w0, [x0, #:lo12:.LANCHOR3]
 	cmp	w0, w19
-	bhi	.L689
+	bhi	.L704
 	bl	FtlGcReFreshBadBlk
-.L682:
+.L697:
 	mov	w0, 0
 	ldr	x27, [sp, 80]
 	ldp	x19, x20, [sp, 16]
@@ -5099,7 +5131,7 @@ FtlGcFreeBadSuperBlk:
 	ldp	x25, x26, [sp, 64]
 	ldp	x29, x30, [sp], 96
 	ret
-.L689:
+.L704:
 	adrp	x0, .LANCHOR13
 	add	x0, x0, :lo12:.LANCHOR13
 	mov	w1, w25
@@ -5108,19 +5140,19 @@ FtlGcFreeBadSuperBlk:
 	ldrb	w0, [x0, w19, sxtw]
 	bl	V2P_block
 	and	w26, w0, 65535
-.L684:
+.L699:
 	ldrh	w0, [x22]
 	cmp	w0, w20
-	bhi	.L688
+	bhi	.L703
 	add	w19, w19, 1
 	and	w19, w19, 65535
-	b	.L683
-.L688:
+	b	.L698
+.L703:
 	add	x0, x23, :lo12:.LANCHOR75
 	add	w27, w20, 1
 	ldrh	w0, [x0, w20, sxtw 1]
 	cmp	w0, w26
-	bne	.L685
+	bne	.L700
 	mov	w0, w26
 	bl	FtlBbmMapBadBlock
 	bl	FtlBbmTblFlush
@@ -5128,22 +5160,22 @@ FtlGcFreeBadSuperBlk:
 	sxtw	x3, w27
 	and	x4, x20, 65535
 	mov	x0, 0
-.L686:
+.L701:
 	add	w2, w20, w0
 	cmp	w1, w2, uxth
-	bhi	.L687
+	bhi	.L702
 	sub	w1, w1, #1
 	strh	w1, [x22]
-.L685:
+.L700:
 	and	w20, w27, 65535
-	b	.L684
-.L687:
+	b	.L699
+.L702:
 	add	x2, x3, x0
 	ldrh	w5, [x24, x2, lsl 1]
 	add	x2, x4, x0
 	add	x0, x0, 1
 	strh	w5, [x24, x2, lsl 1]
-	b	.L686
+	b	.L701
 	.size	FtlGcFreeBadSuperBlk, .-FtlGcFreeBadSuperBlk
 	.section	.text.update_vpc_list,"ax",@progbits
 	.align	2
@@ -5158,75 +5190,89 @@ update_vpc_list:
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	ubfiz	x0, x19, 1, 16
 	ldrh	w0, [x1, x0]
-	cbnz	w0, .L695
-	adrp	x0, .LANCHOR144
-	ldrh	w1, [x0, #:lo12:.LANCHOR144]
+	cbnz	w0, .L710
+	adrp	x0, .LANCHOR72
+	ldrh	w1, [x0, #:lo12:.LANCHOR72]
 	cmp	w1, w19
-	bne	.L696
+	bne	.L711
 	mov	w1, -1
-	strh	w1, [x0, #:lo12:.LANCHOR144]
-.L697:
-	adrp	x20, .LANCHOR45
+	strh	w1, [x0, #:lo12:.LANCHOR72]
+.L711:
+	adrp	x0, .LANCHOR73
+	ldrh	w1, [x0, #:lo12:.LANCHOR73]
+	cmp	w1, w19
+	bne	.L712
+	mov	w1, -1
+	strh	w1, [x0, #:lo12:.LANCHOR73]
+.L712:
+	adrp	x0, .LANCHOR145
+	ldrh	w1, [x0, #:lo12:.LANCHOR145]
+	cmp	w1, w19
+	bne	.L713
+	mov	w1, -1
+	strh	w1, [x0, #:lo12:.LANCHOR145]
+.L714:
+	adrp	x20, .LANCHOR44
 	mov	w1, w19
 	adrp	x0, .LANCHOR41
 	add	x0, x0, :lo12:.LANCHOR41
 	bl	List_remove_node
-	ldrh	w0, [x20, #:lo12:.LANCHOR45]
-	cbnz	w0, .L699
+	ldrh	w0, [x20, #:lo12:.LANCHOR44]
+	cbnz	w0, .L716
 	adrp	x1, .LANCHOR146
 	adrp	x0, .LC1
-	mov	w2, 2823
+	mov	w2, 2824
 	add	x1, x1, :lo12:.LANCHOR146
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L699:
-	ldrh	w0, [x20, #:lo12:.LANCHOR45]
+.L716:
+	ldrh	w0, [x20, #:lo12:.LANCHOR44]
 	sub	w0, w0, #1
-	strh	w0, [x20, #:lo12:.LANCHOR45]
+	strh	w0, [x20, #:lo12:.LANCHOR44]
 	mov	w0, w19
 	bl	free_data_superblock
 	mov	w0, w19
 	bl	FtlGcFreeBadSuperBlk
 	adrp	x0, .LANCHOR48
-	ldrh	w1, [x20, #:lo12:.LANCHOR45]
+	ldrh	w1, [x20, #:lo12:.LANCHOR44]
 	ldrh	w0, [x0, #:lo12:.LANCHOR48]
 	add	w0, w0, w1
 	adrp	x1, .LANCHOR5
 	ldrh	w1, [x1, #:lo12:.LANCHOR5]
 	cmp	w0, w1
-	ble	.L703
+	ble	.L720
 	adrp	x1, .LANCHOR146
 	adrp	x0, .LC1
-	mov	w2, 2826
+	mov	w2, 2827
 	add	x1, x1, :lo12:.LANCHOR146
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L703:
+.L720:
 	mov	w0, 1
-	b	.L694
-.L696:
+	b	.L709
+.L713:
 	adrp	x0, .LANCHOR51
 	ldrh	w0, [x0, #:lo12:.LANCHOR51]
 	cmp	w0, w19
-	beq	.L702
+	beq	.L719
 	adrp	x0, .LANCHOR52
 	ldrh	w0, [x0, #:lo12:.LANCHOR52]
 	cmp	w0, w19
-	beq	.L702
+	beq	.L719
 	adrp	x0, .LANCHOR53
 	ldrh	w0, [x0, #:lo12:.LANCHOR53]
 	cmp	w0, w19
-	bne	.L697
-.L702:
+	bne	.L714
+.L719:
 	mov	w0, 0
-.L694:
+.L709:
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
-.L695:
+.L710:
 	mov	w0, w19
 	bl	List_update_data_list
-	b	.L702
+	b	.L719
 	.size	update_vpc_list, .-update_vpc_list
 	.section	.text.decrement_vpc_count,"ax",@progbits
 	.align	2
@@ -5240,50 +5286,50 @@ decrement_vpc_count:
 	str	x21, [sp, 32]
 	mov	w0, 65535
 	cmp	w19, w0
-	beq	.L706
+	beq	.L723
 	adrp	x21, .LANCHOR42
 	ubfiz	x20, x19, 1, 16
 	ldr	x1, [x21, #:lo12:.LANCHOR42]
 	ldrh	w0, [x1, x20]
-	cbnz	w0, .L707
+	cbnz	w0, .L724
 	mov	w2, 0
 	mov	w1, w19
-	adrp	x0, .LC17
-	add	x0, x0, :lo12:.LC17
+	adrp	x0, .LC21
+	add	x0, x0, :lo12:.LC21
 	bl	printf
 	ldr	x0, [x21, #:lo12:.LANCHOR42]
 	ldrh	w0, [x0, x20]
-	cbz	w0, .L708
-.L713:
+	cbz	w0, .L725
+.L730:
 	mov	w20, 0
-.L705:
+.L722:
 	mov	w0, w20
 	ldr	x21, [sp, 32]
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 48
 	ret
-.L708:
-	mov	w2, 2841
+.L725:
+	mov	w2, 2842
 	adrp	x1, .LANCHOR147
 	adrp	x0, .LC1
 	add	x1, x1, :lo12:.LANCHOR147
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-	b	.L713
-.L707:
+	b	.L730
+.L724:
 	sub	w0, w0, #1
 	strh	w0, [x1, x20]
-.L706:
+.L723:
 	adrp	x21, .LANCHOR131
 	mov	w1, 65535
 	ldrh	w0, [x21, #:lo12:.LANCHOR131]
 	cmp	w0, w1
-	bne	.L710
+	bne	.L727
 	strh	w19, [x21, #:lo12:.LANCHOR131]
-	b	.L713
-.L710:
+	b	.L730
+.L727:
 	cmp	w19, w0
-	beq	.L713
+	beq	.L730
 	bl	update_vpc_list
 	cmp	w0, 0
 	adrp	x1, .LANCHOR40
@@ -5301,16 +5347,16 @@ decrement_vpc_count:
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	and	x2, x0, 65535
 	ldrh	w1, [x1, x2, lsl 1]
-	cbnz	w1, .L705
+	cbnz	w1, .L722
 	cmp	w19, w0, uxth
-	beq	.L705
-	mov	w2, 2857
+	beq	.L722
+	mov	w2, 2858
 	adrp	x1, .LANCHOR147
 	adrp	x0, .LC1
 	add	x1, x1, :lo12:.LANCHOR147
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-	b	.L705
+	b	.L722
 	.size	decrement_vpc_count, .-decrement_vpc_count
 	.section	.text.FtlSuperblockPowerLostFix,"ax",@progbits
 	.align	2
@@ -5347,10 +5393,10 @@ FtlSuperblockPowerLostFix:
 	mov	w1, 22136
 	movk	w1, 0x1234, lsl 16
 	str	w1, [x0, 4]
-.L720:
+.L737:
 	ldrh	w0, [x19, 4]
-	cbnz	w0, .L716
-.L717:
+	cbnz	w0, .L733
+.L734:
 	ldrh	w0, [x19]
 	adrp	x1, .LANCHOR42
 	ldrh	w3, [x19, 4]
@@ -5368,12 +5414,12 @@ FtlSuperblockPowerLostFix:
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 80
 	ret
-.L716:
+.L733:
 	mov	x0, x19
 	bl	get_new_active_ppa
 	str	w0, [x29, 52]
 	cmn	w0, #1
-	beq	.L717
+	beq	.L734
 	ldr	w0, [x22]
 	mov	w3, 0
 	str	w0, [x21, 4]
@@ -5388,8 +5434,8 @@ FtlSuperblockPowerLostFix:
 	ldrh	w0, [x19]
 	bl	decrement_vpc_count
 	subs	w20, w20, #1
-	bne	.L720
-	b	.L717
+	bne	.L737
+	b	.L734
 	.size	FtlSuperblockPowerLostFix, .-FtlSuperblockPowerLostFix
 	.section	.text.FtlMakeBbt,"ax",@progbits
 	.align	2
@@ -5415,42 +5461,42 @@ FtlMakeBbt:
 	adrp	x0, .LANCHOR10
 	add	x0, x0, :lo12:.LANCHOR10
 	str	x0, [x29, 120]
-.L729:
+.L746:
 	ldr	x0, [x29, 120]
 	ldrh	w0, [x0]
 	cmp	w22, w0
-	bcc	.L735
+	bcc	.L752
 	adrp	x21, .LANCHOR25
 	add	x21, x21, :lo12:.LANCHOR25
 	mov	w19, 0
-.L736:
+.L753:
 	ldrh	w0, [x21]
 	cmp	w0, w19
-	bhi	.L737
+	bhi	.L754
 	add	x21, x20, :lo12:.LANCHOR37
 	mov	w22, 65535
 	ldrh	w19, [x21, 12]
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-.L738:
+.L755:
 	ldrh	w0, [x21, 12]
 	sub	w0, w0, #47
 	cmp	w0, w19
-	bgt	.L742
+	bgt	.L759
 	mov	w0, w19
 	bl	FtlBbmIsBadBlock
 	cmp	w0, 1
-	beq	.L739
+	beq	.L756
 	mov	w0, w19
 	bl	FlashTestBlk
-	cbz	w0, .L740
+	cbz	w0, .L757
 	mov	w0, w19
 	bl	FtlBbmMapBadBlock
-.L739:
+.L756:
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-	b	.L738
-.L735:
+	b	.L755
+.L752:
 	adrp	x2, .LANCHOR114
 	adrp	x0, .LANCHOR106
 	add	x19, x28, :lo12:.LANCHOR138
@@ -5462,7 +5508,7 @@ FtlMakeBbt:
 	stp	x0, x26, [x19, 8]
 	adrp	x23, .LANCHOR17
 	str	x2, [x29, 112]
-	beq	.L730
+	beq	.L747
 	ldrh	w4, [x23, #:lo12:.LANCHOR17]
 	mov	w2, 1
 	madd	w27, w4, w22, w1
@@ -5477,14 +5523,14 @@ FtlMakeBbt:
 	add	w2, w2, 7
 	lsr	w2, w2, 3
 	bl	ftl_memcpy
-.L731:
+.L748:
 	mov	w0, w27
 	add	w22, w22, 1
 	bl	FtlBbmMapBadBlock
 	add	x24, x24, 8
 	add	x21, x21, 2
-	b	.L729
-.L730:
+	b	.L746
+.L747:
 	mov	w1, w22
 	bl	FlashGetBadBlockList
 	ldr	x0, [x19, 8]
@@ -5497,12 +5543,12 @@ FtlMakeBbt:
 	add	x0, x0, :lo12:.LANCHOR127
 	and	w19, w19, 65535
 	str	x0, [x29, 104]
-.L732:
+.L749:
 	ldrh	w0, [x23]
 	madd	w0, w22, w0, w19
 	bl	FtlBbmIsBadBlock
 	cmp	w0, 1
-	beq	.L733
+	beq	.L750
 	ldr	x0, [x29, 112]
 	mov	w2, 16
 	strh	w19, [x21]
@@ -5540,29 +5586,29 @@ FtlMakeBbt:
 	bl	FlashProgPages
 	ldr	w0, [x25]
 	cmn	w0, #1
-	bne	.L731
+	bne	.L748
 	mov	w0, w27
 	bl	FtlBbmMapBadBlock
-	b	.L732
-.L733:
+	b	.L749
+.L750:
 	sub	w19, w19, #1
 	and	w19, w19, 65535
-	b	.L732
-.L737:
+	b	.L749
+.L754:
 	mov	w0, w19
 	add	w19, w19, 1
 	bl	FtlBbmMapBadBlock
 	and	w19, w19, 65535
-	b	.L736
-.L740:
+	b	.L753
+.L757:
 	ldrh	w0, [x21]
 	cmp	w0, w22
-	bne	.L741
+	bne	.L758
 	strh	w19, [x21]
-	b	.L739
-.L741:
+	b	.L756
+.L758:
 	strh	w19, [x21, 4]
-.L742:
+.L759:
 	adrp	x0, .LANCHOR79
 	add	x19, x20, :lo12:.LANCHOR37
 	ldrh	w1, [x20, #:lo12:.LANCHOR37]
@@ -5617,18 +5663,18 @@ js_hash:
 	mov	w0, 42982
 	mov	x3, 0
 	movk	w0, 0x47c6, lsl 16
-.L750:
+.L767:
 	cmp	w1, w3
-	bhi	.L751
+	bhi	.L768
 	ret
-.L751:
+.L768:
 	lsr	w2, w0, 2
 	ldrb	w5, [x4, x3]
 	add	w2, w2, w0, lsl 5
 	add	x3, x3, 1
 	add	w2, w2, w5
 	eor	w0, w0, w2
-	b	.L750
+	b	.L767
 	.size	js_hash, .-js_hash
 	.section	.text.Ftl_write_map_blk_to_last_page,"ax",@progbits
 	.align	2
@@ -5645,16 +5691,16 @@ Ftl_write_map_blk_to_last_page:
 	ldrh	w0, [x0]
 	stp	x23, x24, [sp, 48]
 	cmp	w0, w1
-	bne	.L753
+	bne	.L770
 	ldrh	w0, [x19, 8]
-	cbz	w0, .L754
+	cbz	w0, .L771
 	adrp	x1, .LANCHOR148
 	adrp	x0, .LC1
 	mov	w2, 641
 	add	x1, x1, :lo12:.LANCHOR148
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L754:
+.L771:
 	ldrh	w0, [x19, 8]
 	add	w0, w0, 1
 	strh	w0, [x19, 8]
@@ -5665,14 +5711,14 @@ Ftl_write_map_blk_to_last_page:
 	add	w0, w0, 1
 	strh	wzr, [x19]
 	str	w0, [x19, 48]
-.L755:
+.L772:
 	mov	w0, 0
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
 	ldp	x29, x30, [sp], 64
 	ret
-.L753:
+.L770:
 	ubfiz	x0, x0, 1, 16
 	adrp	x2, .LANCHOR114
 	adrp	x24, .LANCHOR106
@@ -5703,9 +5749,9 @@ Ftl_write_map_blk_to_last_page:
 	mov	x0, 0
 	ldr	x3, [x24, #:lo12:.LANCHOR106]
 	mov	w1, 0
-.L756:
+.L773:
 	cmp	w4, w0, uxth
-	bhi	.L758
+	bhi	.L775
 	add	x20, x20, :lo12:.LANCHOR138
 	adrp	x0, .LANCHOR23
 	ldrh	w1, [x0, #:lo12:.LANCHOR23]
@@ -5722,11 +5768,11 @@ Ftl_write_map_blk_to_last_page:
 	strh	w0, [x19, 2]
 	mov	x0, x19
 	bl	ftl_map_blk_gc
-	b	.L755
-.L758:
+	b	.L772
+.L775:
 	ldr	w2, [x23, x0, lsl 2]
 	cmp	w22, w2, lsr 10
-	bne	.L757
+	bne	.L774
 	add	w1, w1, 1
 	and	w1, w1, 65535
 	ubfiz	x2, x1, 1, 16
@@ -5734,9 +5780,9 @@ Ftl_write_map_blk_to_last_page:
 	add	x2, x2, 1
 	ldr	w5, [x23, x0, lsl 2]
 	str	w5, [x3, x2, lsl 2]
-.L757:
+.L774:
 	add	x0, x0, 1
-	b	.L756
+	b	.L773
 	.size	Ftl_write_map_blk_to_last_page, .-Ftl_write_map_blk_to_last_page
 	.section	.text.FtlMapWritePage,"ax",@progbits
 	.align	2
@@ -5760,7 +5806,7 @@ FtlMapWritePage:
 	add	x28, x26, :lo12:.LANCHOR20
 	stp	x21, x22, [sp, 32]
 	mov	w22, 0
-.L764:
+.L781:
 	ldr	w0, [x23]
 	ldrh	w1, [x19, 2]
 	add	w0, w0, 1
@@ -5768,35 +5814,35 @@ FtlMapWritePage:
 	ldrh	w0, [x26, #:lo12:.LANCHOR20]
 	sub	w0, w0, #1
 	cmp	w1, w0
-	bge	.L765
+	bge	.L782
 	ldrh	w1, [x19]
 	mov	w0, 65535
 	cmp	w1, w0
-	bne	.L766
-.L765:
+	bne	.L783
+.L782:
 	mov	x0, x19
 	bl	Ftl_write_map_blk_to_last_page
-.L766:
+.L783:
 	ldrh	w1, [x19]
 	ldr	x0, [x19, 16]
 	ldrh	w0, [x0, x1, lsl 1]
-	cbnz	w0, .L767
+	cbnz	w0, .L784
 	adrp	x0, .LC1
 	mov	w2, 700
 	mov	x1, x24
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L767:
+.L784:
 	ldrh	w1, [x19]
 	ldrh	w0, [x19, 10]
 	cmp	w1, w0
-	bcc	.L768
+	bcc	.L785
 	adrp	x0, .LC1
 	mov	w2, 701
 	mov	x1, x24
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L768:
+.L785:
 	ldrh	w1, [x19]
 	adrp	x21, .LANCHOR138
 	ldr	x0, [x19, 16]
@@ -5837,46 +5883,46 @@ FtlMapWritePage:
 	and	w0, w0, 65535
 	strh	w0, [x19, 2]
 	cmn	w1, #1
-	bne	.L769
+	bne	.L786
 	ldr	w1, [x20, 4]
-	adrp	x0, .LC18
-	add	x0, x0, :lo12:.LC18
+	adrp	x0, .LC22
+	add	x0, x0, :lo12:.LC22
 	add	w22, w22, 1
 	and	w22, w22, 65535
 	bl	printf
 	ldrh	w0, [x19, 2]
 	cmp	w0, 2
-	bhi	.L770
+	bhi	.L787
 	ldrh	w0, [x28]
 	sub	w0, w0, #1
 	strh	w0, [x19, 2]
-.L770:
+.L787:
 	cmp	w22, 3
-	bls	.L771
+	bls	.L788
 	add	x21, x21, :lo12:.LANCHOR138
-	adrp	x0, .LC19
+	adrp	x0, .LC23
 	mov	w2, w22
-	add	x0, x0, :lo12:.LC19
+	add	x0, x0, :lo12:.LC23
 	ldr	w1, [x21, 4]
 	bl	printf
-.L772:
-	b	.L772
-.L771:
+.L789:
+	b	.L789
+.L788:
 	ldr	w0, [x19, 52]
-	cbz	w0, .L764
+	cbz	w0, .L781
+.L803:
+	b	.L803
 .L786:
-	b	.L786
-.L769:
 	cmp	w0, 1
-	beq	.L775
+	beq	.L792
 	cmp	w1, 256
-	beq	.L775
+	beq	.L792
 	ldr	w0, [x19, 56]
-	cbz	w0, .L776
-.L775:
+	cbz	w0, .L793
+.L792:
 	str	wzr, [x19, 56]
-	b	.L764
-.L776:
+	b	.L781
+.L793:
 	ldr	x0, [x19, 40]
 	ldr	w1, [x20, 4]
 	ldp	x21, x22, [sp, 32]
@@ -5906,20 +5952,20 @@ load_l2p_region:
 	stp	x25, x26, [sp, 64]
 	str	x27, [sp, 80]
 	cmp	w0, w20
-	bcs	.L789
+	bcs	.L806
 	adrp	x1, .LANCHOR150
 	adrp	x0, .LC1
 	mov	w2, 485
 	add	x1, x1, :lo12:.LANCHOR150
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L789:
+.L806:
 	adrp	x27, .LANCHOR124
 	ubfiz	x0, x20, 2, 16
 	adrp	x22, .LANCHOR55
 	ldr	x1, [x27, #:lo12:.LANCHOR124]
 	ldr	w23, [x1, x0]
-	cbnz	w23, .L790
+	cbnz	w23, .L807
 	ldr	x0, [x22, #:lo12:.LANCHOR55]
 	lsl	x19, x19, 4
 	adrp	x1, .LANCHOR23
@@ -5932,7 +5978,7 @@ load_l2p_region:
 	add	x1, x0, x19
 	strh	w20, [x0, x19]
 	str	wzr, [x1, 4]
-.L791:
+.L808:
 	mov	w0, 0
 	ldr	x27, [sp, 80]
 	ldp	x19, x20, [sp, 16]
@@ -5941,7 +5987,7 @@ load_l2p_region:
 	ldp	x25, x26, [sp, 64]
 	ldp	x29, x30, [sp], 96
 	ret
-.L790:
+.L807:
 	ldr	x0, [x22, #:lo12:.LANCHOR55]
 	lsl	x19, x19, 4
 	adrp	x26, .LANCHOR138
@@ -5960,48 +6006,48 @@ load_l2p_region:
 	ldr	x25, [x21, 16]
 	ldrh	w0, [x25, 8]
 	cmp	w0, w20
-	beq	.L792
+	beq	.L809
 	mov	w2, w23
 	mov	w1, w20
-	adrp	x0, .LC20
-	add	x0, x0, :lo12:.LC20
+	adrp	x0, .LC24
+	add	x0, x0, :lo12:.LC24
 	bl	printf
 	ldr	x1, [x21, 16]
 	mov	w3, 4
-	adrp	x0, .LC21
+	adrp	x0, .LC13
 	mov	w2, w3
-	add	x0, x0, :lo12:.LC21
+	add	x0, x0, :lo12:.LC13
 	bl	rknand_print_hex
 	ldrh	w3, [x24, #:lo12:.LANCHOR32]
-	adrp	x0, .LC22
+	adrp	x0, .LC25
 	ldr	x1, [x27, #:lo12:.LANCHOR124]
 	mov	w2, 4
-	add	x0, x0, :lo12:.LC22
+	add	x0, x0, :lo12:.LC25
 	bl	rknand_print_hex
-.L793:
+.L810:
 	ldrh	w0, [x25, 8]
 	cmp	w0, w20
-	beq	.L794
+	beq	.L811
 	adrp	x1, .LANCHOR150
 	adrp	x0, .LC1
 	mov	w2, 508
 	add	x1, x1, :lo12:.LANCHOR150
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L794:
+.L811:
 	ldr	x0, [x22, #:lo12:.LANCHOR55]
 	add	x1, x0, x19
 	str	wzr, [x1, 4]
 	strh	w20, [x0, x19]
-	b	.L791
-.L792:
+	b	.L808
+.L809:
 	ldr	w0, [x26, #:lo12:.LANCHOR138]
 	cmp	w0, 256
-	bne	.L793
+	bne	.L810
 	mov	w2, w23
 	mov	w1, w20
-	adrp	x0, .LC23
-	add	x0, x0, :lo12:.LC23
+	adrp	x0, .LC26
+	add	x0, x0, :lo12:.LC26
 	bl	printf
 	ldr	x0, [x22, #:lo12:.LANCHOR55]
 	mov	w1, w20
@@ -6010,7 +6056,7 @@ load_l2p_region:
 	adrp	x0, .LANCHOR129
 	add	x0, x0, :lo12:.LANCHOR129
 	bl	FtlMapWritePage
-	b	.L793
+	b	.L810
 	.size	load_l2p_region, .-load_l2p_region
 	.section	.text.ftl_map_blk_gc,"ax",@progbits
 	.align	2
@@ -6033,12 +6079,12 @@ ftl_map_blk_gc:
 	ldrh	w2, [x19, 8]
 	sub	w1, w1, #5
 	cmp	w2, w1
-	blt	.L797
+	blt	.L814
 	ubfiz	x0, x0, 1, 16
 	ldrh	w22, [x20, x0]
-	cbz	w22, .L797
+	cbz	w22, .L814
 	ldr	w1, [x19, 52]
-	cbnz	w1, .L797
+	cbnz	w1, .L814
 	mov	w1, 1
 	str	w1, [x19, 52]
 	strh	wzr, [x20, x0]
@@ -6048,31 +6094,31 @@ ftl_map_blk_gc:
 	strh	w0, [x19, 8]
 	ldrh	w0, [x24, #:lo12:.LANCHOR20]
 	cmp	w1, w0
-	bcc	.L798
+	bcc	.L815
 	mov	x0, x19
 	bl	ftl_map_blk_alloc_new_blk
-.L798:
+.L815:
 	adrp	x26, .LANCHOR138
 	adrp	x23, .LANCHOR151
 	add	x27, x26, :lo12:.LANCHOR138
 	add	x23, x23, :lo12:.LANCHOR151
 	mov	w20, 0
-.L799:
+.L816:
 	ldrh	w0, [x19, 6]
 	cmp	w0, w20
-	bhi	.L806
+	bhi	.L823
 	mov	w1, 1
 	mov	w0, w22
 	bl	FtlFreeSysBlkQueueIn
 	str	wzr, [x19, 52]
-.L797:
+.L814:
 	ldrh	w1, [x19, 2]
 	ldrh	w0, [x24, #:lo12:.LANCHOR20]
 	cmp	w1, w0
-	bcc	.L807
+	bcc	.L824
 	mov	x0, x19
 	bl	ftl_map_blk_alloc_new_blk
-.L807:
+.L824:
 	mov	w0, 0
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -6081,12 +6127,12 @@ ftl_map_blk_gc:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 96
 	ret
-.L806:
+.L823:
 	ubfiz	x0, x20, 2, 16
 	add	x28, x25, x0
 	ldr	w1, [x25, x0]
 	cmp	w22, w1, lsr 10
-	bne	.L800
+	bne	.L817
 	adrp	x2, .LANCHOR107
 	add	x0, x26, :lo12:.LANCHOR138
 	ldr	x2, [x2, #:lo12:.LANCHOR107]
@@ -6100,36 +6146,36 @@ ftl_map_blk_gc:
 	bl	FlashReadPages
 	ldrh	w0, [x21, 8]
 	cmp	w0, w20
-	beq	.L801
+	beq	.L818
 	adrp	x0, .LC1
 	mov	w2, 611
 	mov	x1, x23
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L801:
+.L818:
 	ldr	w0, [x27]
 	cmn	w0, #1
-	bne	.L802
-.L804:
+	bne	.L819
+.L821:
 	str	wzr, [x28]
-.L803:
-	b	.L803
-.L802:
+.L820:
+	b	.L820
+.L819:
 	ldrh	w0, [x21, 8]
 	cmp	w0, w20
-	bne	.L804
+	bne	.L821
 	ldrh	w1, [x21]
 	ldrh	w0, [x19, 4]
 	cmp	w1, w0
-	bne	.L804
+	bne	.L821
 	ldr	x2, [x27, 8]
 	mov	w1, w20
 	mov	x0, x19
 	bl	FtlMapWritePage
-.L800:
+.L817:
 	add	w20, w20, 1
 	and	w20, w20, 65535
-	b	.L799
+	b	.L816
 	.size	ftl_map_blk_gc, .-ftl_map_blk_gc
 	.section	.text.flush_l2p_region,"ax",@progbits
 	.align	2
@@ -6171,27 +6217,27 @@ l2p_flush:
 	str	x21, [sp, 32]
 	mov	w19, 0
 	adrp	x21, .LANCHOR55
-.L816:
+.L833:
 	ldrh	w0, [x20]
 	cmp	w0, w19
-	bhi	.L818
+	bhi	.L835
 	mov	w0, 0
 	ldr	x21, [sp, 32]
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 48
 	ret
-.L818:
+.L835:
 	ldr	x1, [x21, #:lo12:.LANCHOR55]
 	ubfiz	x0, x19, 4, 16
 	add	x0, x1, x0
 	ldr	w0, [x0, 4]
-	tbz	w0, #31, .L817
+	tbz	w0, #31, .L834
 	mov	w0, w19
 	bl	flush_l2p_region
-.L817:
+.L834:
 	add	w19, w19, 1
 	and	w19, w19, 65535
-	b	.L816
+	b	.L833
 	.size	l2p_flush, .-l2p_flush
 	.section	.text.log2phys,"ax",@progbits
 	.align	2
@@ -6213,17 +6259,17 @@ log2phys:
 	ldr	w1, [x0, #:lo12:.LANCHOR152]
 	mov	w21, w2
 	cmp	w25, w1
-	bcc	.L821
+	bcc	.L838
 	adrp	x1, .LANCHOR153
 	adrp	x0, .LC1
 	mov	w2, 813
 	add	x1, x1, :lo12:.LANCHOR153
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L821:
+.L838:
 	ldr	w0, [x19, #:lo12:.LANCHOR152]
 	cmp	w25, w0
-	bcs	.L822
+	bcs	.L839
 	adrp	x23, .LANCHOR55
 	add	w24, w24, 7
 	adrp	x0, .LANCHOR33
@@ -6232,10 +6278,10 @@ log2phys:
 	and	w22, w22, 65535
 	ldrh	w1, [x0, #:lo12:.LANCHOR33]
 	mov	x0, 0
-.L823:
+.L840:
 	and	x19, x0, 65535
 	cmp	w19, w1
-	bcc	.L828
+	bcc	.L845
 	bl	select_l2p_ram_region
 	and	x19, x0, 65535
 	ldr	x2, [x23, #:lo12:.LANCHOR55]
@@ -6245,33 +6291,33 @@ log2phys:
 	ldrh	w2, [x2, x1]
 	mov	w1, 65535
 	cmp	w2, w1
-	beq	.L829
+	beq	.L846
 	ldr	w1, [x3, 4]
-	tbz	w1, #31, .L829
+	tbz	w1, #31, .L846
 	bl	flush_l2p_region
-.L829:
+.L846:
 	mov	w1, w26
 	mov	w0, w22
 	bl	load_l2p_region
-	b	.L825
-.L822:
+	b	.L842
+.L839:
 	mov	w0, -1
-	cbnz	w21, .L820
+	cbnz	w21, .L837
 	str	w0, [x20]
-.L820:
+.L837:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
 	ldp	x25, x26, [sp, 64]
 	ldp	x29, x30, [sp], 80
 	ret
-.L828:
+.L845:
 	add	x0, x0, 1
 	add	x3, x2, x0, lsl 4
 	ldrh	w3, [x3, -16]
 	cmp	w3, w22
-	bne	.L823
-.L825:
+	bne	.L840
+.L842:
 	mov	x0, 1
 	ldr	x1, [x23, #:lo12:.LANCHOR55]
 	lsl	x0, x0, x24
@@ -6279,22 +6325,22 @@ log2phys:
 	and	w0, w0, w25
 	and	x0, x0, 65535
 	add	x1, x1, x19, lsl 4
-	cbnz	w21, .L826
+	cbnz	w21, .L843
 	ldr	x1, [x1, 8]
 	ldr	w0, [x1, x0, lsl 2]
 	str	w0, [x20]
-.L827:
+.L844:
 	ldr	x0, [x23, #:lo12:.LANCHOR55]
 	add	x19, x0, x19, lsl 4
 	ldr	w0, [x19, 4]
 	cmn	w0, #1
-	beq	.L831
+	beq	.L848
 	add	w0, w0, 1
 	str	w0, [x19, 4]
-.L831:
+.L848:
 	mov	w0, 0
-	b	.L820
-.L826:
+	b	.L837
+.L843:
 	ldr	x2, [x1, 8]
 	ldr	w3, [x20]
 	str	w3, [x2, x0, lsl 2]
@@ -6303,7 +6349,7 @@ log2phys:
 	str	w0, [x1, 4]
 	adrp	x0, .LANCHOR56
 	strh	w22, [x0, #:lo12:.LANCHOR56]
-	b	.L827
+	b	.L844
 	.size	log2phys, .-log2phys
 	.section	.text.FtlReUsePrevPpa,"ax",@progbits
 	.align	2
@@ -6324,10 +6370,10 @@ FtlReUsePrevPpa:
 	and	w3, w0, 65535
 	ubfiz	x20, x3, 1, 16
 	ldrh	w1, [x2, x20]
-	cbnz	w1, .L835
-	adrp	x0, .LANCHOR47
-	ldr	x19, [x0, #:lo12:.LANCHOR47]
-	cbz	x19, .L836
+	cbnz	w1, .L852
+	adrp	x0, .LANCHOR46
+	ldr	x19, [x0, #:lo12:.LANCHOR46]
+	cbz	x19, .L853
 	adrp	x2, .LANCHOR40
 	mov	x5, -6148914691236517206
 	movk	x5, 0xaaab, lsl 0
@@ -6340,23 +6386,23 @@ FtlReUsePrevPpa:
 	mul	x19, x19, x5
 	mov	w5, 6
 	and	w19, w19, 65535
-.L837:
+.L854:
 	cmp	w1, w4
-	beq	.L836
+	beq	.L853
 	cmp	w19, w3
-	bne	.L838
+	bne	.L855
 	mov	w1, w19
-	add	x0, x0, :lo12:.LANCHOR47
+	add	x0, x0, :lo12:.LANCHOR46
 	bl	List_remove_node
 	ldrh	w0, [x23, #:lo12:.LANCHOR48]
-	cbnz	w0, .L839
+	cbnz	w0, .L856
 	adrp	x1, .LANCHOR154
 	adrp	x0, .LC1
 	mov	w2, 1733
 	add	x1, x1, :lo12:.LANCHOR154
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L839:
+.L856:
 	ldrh	w0, [x23, #:lo12:.LANCHOR48]
 	sub	w0, w0, #1
 	strh	w0, [x23, #:lo12:.LANCHOR48]
@@ -6366,7 +6412,7 @@ FtlReUsePrevPpa:
 	ldrh	w0, [x1, x20]
 	add	w0, w0, 1
 	strh	w0, [x1, x20]
-.L836:
+.L853:
 	add	x1, x29, 76
 	mov	w2, 1
 	mov	w0, w21
@@ -6376,18 +6422,18 @@ FtlReUsePrevPpa:
 	ldr	x23, [sp, 48]
 	ldp	x29, x30, [sp], 80
 	ret
-.L838:
+.L855:
 	umull	x19, w19, w5
 	ldrh	w19, [x2, x19]
 	cmp	w19, w6
-	beq	.L836
+	beq	.L853
 	add	w1, w1, 1
 	and	w1, w1, 65535
-	b	.L837
-.L835:
+	b	.L854
+.L852:
 	add	w1, w1, 1
 	strh	w1, [x2, x20]
-	b	.L836
+	b	.L853
 	.size	FtlReUsePrevPpa, .-FtlReUsePrevPpa
 	.section	.text.FtlRecoverySuperblock,"ax",@progbits
 	.align	2
@@ -6405,7 +6451,7 @@ FtlRecoverySuperblock:
 	stp	x25, x26, [sp, 64]
 	cmp	w0, w1
 	stp	x27, x28, [sp, 80]
-	beq	.L968
+	beq	.L989
 	ldrb	w0, [x19, 6]
 	str	w0, [x29, 164]
 	adrp	x0, .LANCHOR19
@@ -6413,11 +6459,11 @@ FtlRecoverySuperblock:
 	str	x0, [x29, 128]
 	ldrh	w2, [x0, #:lo12:.LANCHOR19]
 	cmp	w2, w26
-	bne	.L848
+	bne	.L865
 	strh	wzr, [x19, 4]
-.L976:
+.L996:
 	strb	wzr, [x19, 6]
-.L968:
+.L989:
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -6426,17 +6472,17 @@ FtlRecoverySuperblock:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 192
 	ret
-.L848:
+.L865:
 	ldrh	w0, [x19, 16]
 	mov	w20, 0
-.L849:
+.L866:
 	cmp	w0, w1
-	beq	.L850
+	beq	.L867
 	mov	w1, 1
 	bl	FtlGetLastWrittenPage
 	mov	w23, w0
 	cmn	w0, #1
-	beq	.L851
+	beq	.L868
 	adrp	x1, .LANCHOR64
 	adrp	x2, .LANCHOR3
 	adrp	x20, .LANCHOR103
@@ -6457,9 +6503,9 @@ FtlRecoverySuperblock:
 	ldrh	w1, [x2, #:lo12:.LANCHOR3]
 	add	x1, x1, 8
 	add	x1, x19, x1, lsl 1
-.L852:
+.L869:
 	cmp	x4, x1
-	bne	.L856
+	bne	.L873
 	mov	w2, 0
 	mov	w1, w22
 	bl	FlashReadPages
@@ -6473,69 +6519,69 @@ FtlRecoverySuperblock:
 	mov	w3, 0
 	sub	w21, w21, #1
 	str	x0, [x29, 144]
-.L857:
+.L874:
 	cmp	w22, w3
-	bne	.L862
+	bne	.L879
 	add	w22, w23, 1
 	ldr	w0, [x4, 4]
 	and	w22, w22, 65535
-.L970:
+.L991:
 	lsr	w0, w0, 10
 	bl	P2V_plane
 	and	w27, w0, 65535
 	ldr	x0, [x29, 128]
 	ldrh	w0, [x0, #:lo12:.LANCHOR19]
 	cmp	w0, w22
-	bne	.L864
+	bne	.L881
 	strh	w22, [x19, 2]
 	strb	wzr, [x19, 6]
 	strh	wzr, [x19, 4]
-.L864:
+.L881:
 	ldr	w0, [x29, 164]
 	cmp	w22, w26
 	cset	w1, eq
 	cmp	w27, w0
 	cset	w0, eq
 	tst	w1, w0
-	beq	.L865
-.L977:
+	beq	.L882
+.L997:
 	mov	w2, w27
 	mov	w1, w22
 	mov	x0, x19
 	bl	ftl_sb_update_avl_pages
-	b	.L968
-.L850:
+	b	.L989
+.L867:
 	add	w20, w20, 1
 	and	w20, w20, 65535
 	add	x0, x19, x20, sxtw 1
 	ldrh	w0, [x0, 16]
-	b	.L849
-.L851:
-	cbz	w26, .L853
+	b	.L866
+.L868:
+	cbz	w26, .L870
 	adrp	x1, .LANCHOR155
 	adrp	x0, .LC1
 	mov	w2, 1800
 	add	x1, x1, :lo12:.LANCHOR155
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L853:
+.L870:
 	ldr	w0, [x29, 164]
 	cmp	w0, 0
 	ccmp	w20, w0, 4, ne
-	beq	.L854
+	beq	.L871
 	adrp	x1, .LANCHOR155
 	adrp	x0, .LC1
 	mov	w2, 1801
 	add	x1, x1, :lo12:.LANCHOR155
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L854:
+.L871:
 	strh	wzr, [x19, 2]
-	b	.L976
-.L856:
+	b	.L996
+.L873:
 	ldrh	w3, [x4]
 	cmp	w3, w10
-	beq	.L855
+	beq	.L872
 	ubfiz	x2, x22, 5, 16
 	orr	w3, w23, w3, lsl 10
 	add	x2, x0, x2
@@ -6550,90 +6596,90 @@ FtlRecoverySuperblock:
 	asr	w3, w3, 2
 	add	x3, x7, x3, sxtw 2
 	str	x3, [x2, 16]
-.L855:
+.L872:
 	add	x4, x4, 2
-	b	.L852
-.L862:
+	b	.L869
+.L879:
 	ldr	w0, [x11]
-	cbnz	w0, .L858
+	cbnz	w0, .L875
 	ldr	x8, [x11, 16]
 	ldr	w5, [x8, 4]
 	cmn	w5, #1
-	beq	.L859
+	beq	.L876
 	ldr	w1, [x7]
 	mov	w0, w5
 	bl	ftl_cmp_data_ver
-	cbz	w0, .L859
+	cbz	w0, .L876
 	add	w5, w5, 1
 	str	w5, [x7]
-.L859:
+.L876:
 	ldr	w0, [x8]
 	cmn	w0, #1
-	bne	.L861
+	bne	.L878
 	ubfiz	x3, x3, 5, 16
 	and	w22, w23, 65535
 	add	x3, x4, x3
 	ldr	w0, [x3, 4]
-	b	.L970
-.L858:
+	b	.L991
+.L875:
 	mov	w6, w10
-.L861:
+.L878:
 	add	w3, w3, 1
 	add	x11, x11, 32
 	and	w3, w3, 65535
-	b	.L857
-.L865:
+	b	.L874
+.L882:
 	mov	w0, 65535
 	cmp	w6, w0
-	bne	.L866
+	bne	.L883
 	ldrb	w0, [x19, 8]
-	cbnz	w0, .L867
-.L866:
+	cbnz	w0, .L884
+.L883:
 	adrp	x25, .LANCHOR134
 	and	w28, w23, 65535
 	ldr	w0, [x25, #:lo12:.LANCHOR134]
 	cmn	w0, #1
-	bne	.L868
+	bne	.L885
 	str	w21, [x25, #:lo12:.LANCHOR134]
-.L868:
+.L885:
 	add	w0, w26, 7
 	cmp	w0, w23, uxth
-	bge	.L920
+	bge	.L935
 	sub	w24, w28, #7
 	and	w24, w24, 65535
-.L869:
+.L886:
 	ldr	x0, [x29, 152]
 	mov	w3, 65535
 	mov	w5, 1
 	add	x4, x0, :lo12:.LANCHOR3
-.L870:
+.L887:
 	cmp	w24, w28
-	bhi	.L880
+	bhi	.L897
 	ldrh	w1, [x4]
 	mov	w23, 0
 	ldr	x0, [x20, #:lo12:.LANCHOR103]
 	add	x1, x1, 8
 	ldr	x2, [x29, 168]
 	add	x1, x19, x1, lsl 1
-	b	.L881
-.L920:
+	b	.L898
+.L935:
 	mov	w24, w26
-	b	.L869
-.L872:
+	b	.L886
+.L889:
 	ldrh	w6, [x2]
 	cmp	w6, w3
-	beq	.L871
+	beq	.L888
 	ubfiz	x7, x23, 5, 16
 	add	w23, w23, 1
 	add	x7, x0, x7
 	and	w23, w23, 65535
 	orr	w6, w24, w6, lsl 10
 	str	w6, [x7, 4]
-.L871:
+.L888:
 	add	x2, x2, 2
-.L881:
+.L898:
 	cmp	x1, x2
-	bne	.L872
+	bne	.L889
 	mov	w1, w23
 	mov	w2, 0
 	str	w5, [x29, 112]
@@ -6650,105 +6696,105 @@ FtlRecoverySuperblock:
 	add	x23, x2, x23
 	ldr	x4, [x29, 136]
 	mov	w2, 0
-.L873:
+.L890:
 	cmp	x23, x0
-	bne	.L878
-	cbz	w2, .L879
+	bne	.L895
+	cbz	w2, .L896
 	str	w1, [x25, #:lo12:.LANCHOR134]
-.L879:
+.L896:
 	add	w24, w24, 1
 	and	w24, w24, 65535
-	b	.L870
-.L878:
+	b	.L887
+.L895:
 	ldr	w6, [x0, -16]
-	cbz	w6, .L874
-	cbz	w2, .L867
+	cbz	w6, .L891
+	cbz	w2, .L884
 	str	w1, [x25, #:lo12:.LANCHOR134]
-.L867:
+.L884:
 	adrp	x0, .LANCHOR156
-	mov	w24, w26
+	mov	w23, w26
 	mov	w1, 1
 	adrp	x28, .LANCHOR134
 	strh	w1, [x0, #:lo12:.LANCHOR156]
 	add	x0, x28, :lo12:.LANCHOR134
 	str	x0, [x29, 104]
-.L882:
+.L899:
 	ldr	x1, [x29, 152]
-	mov	w23, 0
+	mov	w24, 0
 	ldr	x0, [x20, #:lo12:.LANCHOR103]
 	mov	w5, 65535
 	ldr	x2, [x29, 168]
 	ldrh	w1, [x1, #:lo12:.LANCHOR3]
 	add	x1, x1, 8
 	add	x1, x19, x1, lsl 1
-.L883:
+.L900:
 	cmp	x1, x2
-	bne	.L885
+	bne	.L902
 	mov	w2, 0
-	mov	w1, w23
+	mov	w1, w24
 	bl	FlashReadPages
 	mov	x25, 0
-	ubfiz	x0, x23, 5, 16
+	ubfiz	x0, x24, 5, 16
 	str	x0, [x29, 112]
 	adrp	x0, .LANCHOR157
 	add	x0, x0, :lo12:.LANCHOR157
 	str	x0, [x29, 120]
-.L886:
+.L903:
 	ldr	x0, [x29, 112]
-	cmp	x0, x25
-	bne	.L914
+	cmp	x25, x0
+	bne	.L929
 	ldr	x0, [x29, 128]
-	add	w24, w24, 1
-	and	w24, w24, 65535
+	add	w23, w23, 1
+	and	w23, w23, 65535
 	ldrh	w0, [x0, #:lo12:.LANCHOR19]
-	cmp	w0, w24
-	bne	.L882
+	cmp	w0, w23
+	bne	.L899
 	ldr	x0, [x29, 152]
 	mov	w2, 65535
-	strh	w24, [x19, 2]
+	strh	w23, [x19, 2]
 	strh	wzr, [x19, 4]
 	ldrh	w1, [x0, #:lo12:.LANCHOR3]
 	mov	w0, 0
-.L915:
+.L930:
 	cmp	w0, w1
-	beq	.L968
+	beq	.L989
 	ldr	x4, [x29, 168]
 	ldrh	w3, [x4], 2
 	str	x4, [x29, 168]
 	cmp	w3, w2
-	beq	.L916
+	beq	.L931
 	strb	w0, [x19, 6]
-	b	.L968
-.L874:
+	b	.L989
+.L891:
 	ldr	x6, [x0]
 	ldrh	w7, [x6]
 	cmp	w7, w3
-	beq	.L877
+	beq	.L894
 	ldr	w6, [x6, 4]
 	cmn	w6, #1
 	csel	w1, w1, w6, eq
 	csel	w2, w2, w5, eq
-.L877:
+.L894:
 	add	x0, x0, 32
-	b	.L873
-.L880:
+	b	.L890
+.L897:
 	mov	w0, -1
 	str	w0, [x25, #:lo12:.LANCHOR134]
-	b	.L867
-.L885:
+	b	.L884
+.L902:
 	ldrh	w3, [x2]
 	cmp	w3, w5
-	beq	.L884
-	ubfiz	x4, x23, 5, 16
-	add	w23, w23, 1
+	beq	.L901
+	ubfiz	x4, x24, 5, 16
+	add	w24, w24, 1
 	add	x4, x0, x4
-	and	w23, w23, 65535
-	orr	w3, w24, w3, lsl 10
+	and	w24, w24, 65535
+	orr	w3, w23, w3, lsl 10
 	str	w3, [x4, 4]
-.L884:
+.L901:
 	add	x2, x2, 2
-	b	.L883
-.L914:
+	b	.L900
+.L929:
 	ldr	x4, [x20, #:lo12:.LANCHOR103]
 	add	x4, x4, x25
 	ldr	w5, [x4, 4]
@@ -6756,54 +6802,54 @@ FtlRecoverySuperblock:
 	lsr	w0, w5, 10
 	bl	P2V_plane
 	and	w0, w0, 65535
-	cmp	w24, w26
-	bcc	.L887
+	cmp	w23, w26
+	bcc	.L904
 	ldr	w1, [x29, 164]
 	ccmp	w1, w0, 0, eq
-	bhi	.L887
-	cmp	w24, w22
+	bhi	.L904
+	cmp	w23, w22
 	ccmp	w27, w0, 0, eq
-	beq	.L888
+	beq	.L905
 	ldr	w0, [x4]
 	cmn	w0, #1
-	beq	.L889
+	beq	.L906
 	ldr	x3, [x4, 16]
 	mov	w0, 61589
 	ldrh	w1, [x3]
 	cmp	w1, w0
-	beq	.L890
+	beq	.L907
 	ldrh	w0, [x19]
-.L974:
+.L993:
 	bl	decrement_vpc_count
-	b	.L887
-.L890:
+	b	.L904
+.L907:
 	ldr	w21, [x3, 4]
 	cmn	w21, #1
-	beq	.L891
+	beq	.L908
 	ldr	x0, [x29, 144]
 	ldr	w1, [x0, #:lo12:.LANCHOR83]
 	mov	w0, w21
 	bl	ftl_cmp_data_ver
-	cbz	w0, .L891
+	cbz	w0, .L908
 	ldr	x1, [x29, 144]
 	add	w0, w21, 1
 	str	w0, [x1, #:lo12:.LANCHOR83]
-.L891:
-	ldp	w23, w0, [x3, 8]
+.L908:
+	ldp	w24, w0, [x3, 8]
 	add	x1, x29, 184
 	str	w0, [x29, 180]
 	mov	w2, 0
-	mov	w0, w23
+	mov	w0, w24
 	bl	log2phys
 	ldr	w1, [x28, #:lo12:.LANCHOR134]
 	ldr	w3, [x29, 180]
 	cmn	w1, #1
-	beq	.L892
+	beq	.L909
 	mov	w0, w21
 	bl	ftl_cmp_data_ver
-	cbz	w0, .L892
+	cbz	w0, .L909
 	cmn	w3, #1
-	beq	.L893
+	beq	.L910
 	ldr	x0, [x20, #:lo12:.LANCHOR103]
 	mov	w2, 0
 	mov	w1, 1
@@ -6817,75 +6863,75 @@ FtlRecoverySuperblock:
 	add	x3, x0, x25
 	ldr	w0, [x0, x25]
 	cmn	w0, #1
-	bne	.L894
-.L895:
+	bne	.L911
+.L912:
 	mov	w0, -1
 	str	w0, [x29, 180]
-.L902:
+.L919:
 	ldr	w3, [x29, 180]
 	cmn	w3, #1
-	beq	.L887
-.L919:
+	beq	.L904
+.L934:
 	lsr	w0, w3, 10
 	bl	P2V_block_in_plane
-	and	w23, w0, 65535
+	and	w24, w0, 65535
 	adrp	x0, .LANCHOR5
-	mov	w3, w23
+	mov	w3, w24
 	ldrh	w0, [x0, #:lo12:.LANCHOR5]
-	cmp	w0, w23
-	bhi	.L910
-	mov	w2, 2065
+	cmp	w0, w24
+	bhi	.L925
+	mov	w2, 2057
 	adrp	x1, .LANCHOR155
 	adrp	x0, .LC1
 	add	x1, x1, :lo12:.LANCHOR155
 	add	x0, x0, :lo12:.LC1
-	str	w23, [x29, 136]
+	str	w24, [x29, 136]
 	bl	printf
 	ldr	w3, [x29, 136]
-.L910:
+.L925:
 	adrp	x1, .LANCHOR42
-	ubfiz	x0, x23, 1, 16
+	ubfiz	x0, x24, 1, 16
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	ldrh	w0, [x1, x0]
-	cbz	w0, .L911
+	cbz	w0, .L926
 	mov	w0, w3
-	b	.L974
-.L893:
+	b	.L993
+.L910:
 	ldp	w1, w0, [x29, 184]
 	cmp	w1, w0
-	bne	.L887
+	bne	.L904
 	mov	w2, 1
 	add	x1, x29, 180
-	mov	w0, w23
+	mov	w0, w24
 	bl	log2phys
-.L887:
+.L904:
 	add	x25, x25, 32
-	b	.L886
-.L894:
+	b	.L903
+.L911:
 	ldr	w0, [x4, 8]
-	cmp	w23, w0
-	bne	.L895
+	cmp	w24, w0
+	bne	.L912
 	ldr	w0, [x4, 4]
 	str	w0, [x29, 136]
 	str	x4, [x29, 96]
 	uxtw	x1, w0
 	ldr	w0, [x28, #:lo12:.LANCHOR134]
 	bl	ftl_cmp_data_ver
-	cbz	w0, .L895
+	cbz	w0, .L912
 	ldp	w0, w1, [x29, 184]
 	ldr	x4, [x29, 96]
 	cmp	w0, w1
 	ldr	w1, [x29, 180]
-	bne	.L897
-.L971:
-	mov	w0, w23
+	bne	.L914
+.L992:
+	mov	w0, w24
 	bl	FtlReUsePrevPpa
-	b	.L895
-.L897:
+	b	.L912
+.L914:
 	cmp	w0, w1
-	beq	.L895
+	beq	.L912
 	cmn	w0, #1
-	beq	.L898
+	beq	.L915
 	ldr	x4, [x3, 16]
 	mov	w2, 0
 	str	w0, [x3, 4]
@@ -6894,64 +6940,70 @@ FtlRecoverySuperblock:
 	mov	x0, x3
 	bl	FlashReadPages
 	ldr	x4, [x29, 96]
-.L899:
+.L916:
 	ldr	x0, [x20, #:lo12:.LANCHOR103]
 	ldr	w0, [x0, x25]
 	cmn	w0, #1
-	beq	.L900
+	beq	.L917
 	ldr	x0, [x29, 104]
 	ldr	w3, [x4, 4]
 	mov	w1, w3
 	ldr	w0, [x0]
 	bl	ftl_cmp_data_ver
-	cbz	w0, .L900
+	cbz	w0, .L917
 	ldr	w0, [x29, 136]
 	mov	w1, w3
 	bl	ftl_cmp_data_ver
-	cbz	w0, .L895
-.L900:
+	cbz	w0, .L912
+.L917:
 	ldr	w1, [x29, 180]
-	b	.L971
-.L898:
+	b	.L992
+.L915:
 	str	w0, [x3]
-	b	.L899
-.L892:
+	b	.L916
+.L909:
 	ldp	w1, w0, [x29, 184]
 	cmp	w1, w0
-	beq	.L902
+	beq	.L919
+	cmn	w3, #1
+	beq	.L921
 	adrp	x0, .LANCHOR8
 	ldr	w0, [x0, #:lo12:.LANCHOR8]
 	cmp	w0, w3, lsr 10
-	bhi	.L904
-	cmn	w3, #1
-.L973:
-	bne	.L887
+	bhi	.L921
+	adrp	x0, .LC27
+	mov	w1, w3
+	add	x0, x0, :lo12:.LC27
+.L995:
+	bl	printf
+	b	.L904
+.L921:
 	mov	w2, 1
 	add	x1, x29, 188
-	mov	w0, w23
+	mov	w0, w24
 	bl	log2phys
 	ldr	w3, [x29, 184]
 	cmn	w3, #1
-	beq	.L902
+	beq	.L919
 	ldr	w0, [x29, 180]
 	cmp	w3, w0
-	beq	.L919
+	beq	.L934
 	lsr	w0, w3, 10
 	bl	P2V_block_in_plane
 	adrp	x1, .LANCHOR51
 	and	w0, w0, 65535
 	ldrh	w1, [x1, #:lo12:.LANCHOR51]
 	cmp	w1, w0
-	beq	.L909
+	beq	.L924
 	adrp	x1, .LANCHOR52
 	ldrh	w1, [x1, #:lo12:.LANCHOR52]
 	cmp	w1, w0
-	beq	.L909
+	beq	.L924
 	adrp	x1, .LANCHOR53
 	ldrh	w1, [x1, #:lo12:.LANCHOR53]
 	cmp	w1, w0
-	bne	.L902
-.L909:
+	bne	.L919
+.L924:
 	ldr	x0, [x20, #:lo12:.LANCHOR103]
 	mov	w2, 0
 	mov	w1, 1
@@ -6962,71 +7014,54 @@ FtlRecoverySuperblock:
 	ldr	x0, [x20, #:lo12:.LANCHOR103]
 	ldr	w0, [x0]
 	cmn	w0, #1
-	beq	.L902
+	beq	.L919
 	ldr	x4, [x29, 136]
 	mov	w0, w21
 	ldr	w1, [x4, 4]
 	bl	ftl_cmp_data_ver
-	cbnz	w0, .L902
+	cbnz	w0, .L919
 	mov	w2, 1
 	add	x1, x29, 184
-	mov	w0, w23
+	mov	w0, w24
 	bl	log2phys
-	b	.L902
-.L904:
-	ldr	x0, [x20, #:lo12:.LANCHOR103]
-	mov	w2, 0
-	mov	w1, 1
-	ldr	x4, [x0, 16]
-	str	w3, [x0, 4]
-	str	x4, [x29, 136]
-	bl	FlashReadPages
-	ldr	x4, [x29, 136]
-	ldr	w0, [x4, 8]
-	cmp	w23, w0
-	bne	.L887
-	ldrh	w1, [x4]
-	mov	w0, 61589
-	cmp	w1, w0
-	b	.L973
-.L911:
-	mov	w1, w23
-	adrp	x0, .LC24
-	add	x0, x0, :lo12:.LC24
-	bl	printf
-	b	.L887
-.L889:
+	b	.L919
+.L926:
+	adrp	x0, .LC28
+	mov	w1, w24
+	add	x0, x0, :lo12:.LC28
+	b	.L995
+.L906:
 	ldr	x0, [x29, 120]
 	ldr	w0, [x0]
 	cmp	w0, 31
-	bhi	.L912
+	bhi	.L927
 	adrp	x1, .LANCHOR158
 	add	x1, x1, :lo12:.LANCHOR158
 	str	w5, [x1, w0, uxtw 2]
 	add	w0, w0, 1
 	ldr	x1, [x29, 120]
 	str	w0, [x1]
-.L912:
+.L927:
 	ldrh	w0, [x19]
 	bl	decrement_vpc_count
 	ldr	w0, [x28, #:lo12:.LANCHOR134]
 	cmn	w0, #1
-	bne	.L913
-.L975:
+	bne	.L928
+.L994:
 	str	w21, [x28, #:lo12:.LANCHOR134]
-	b	.L887
-.L913:
+	b	.L904
+.L928:
 	cmp	w21, w0
-	bcs	.L887
-	b	.L975
-.L916:
+	bcs	.L904
+	b	.L994
+.L931:
 	add	w0, w0, 1
 	and	w0, w0, 65535
-	b	.L915
-.L888:
+	b	.L930
+.L905:
 	strb	w27, [x19, 6]
 	strh	w22, [x19, 2]
-	b	.L977
+	b	.L997
 	.size	FtlRecoverySuperblock, .-FtlRecoverySuperblock
 	.section	.text.ftl_check_vpc,"ax",@progbits
 	.align	2
@@ -7034,8 +7069,8 @@ FtlRecoverySuperblock:
 	.type	ftl_check_vpc, %function
 ftl_check_vpc:
 	stp	x29, x30, [sp, -112]!
-	adrp	x0, .LC25
-	add	x0, x0, :lo12:.LC25
+	adrp	x0, .LC29
+	add	x0, x0, :lo12:.LC29
 	add	x29, sp, 0
 	stp	x23, x24, [sp, 48]
 	adrp	x23, .LANCHOR152
@@ -7054,29 +7089,29 @@ ftl_check_vpc:
 	mov	w1, 0
 	mov	x0, x19
 	bl	ftl_memset
-.L979:
+.L999:
 	ldr	w0, [x23]
 	cmp	w22, w0
-	bcc	.L981
+	bcc	.L1001
 	adrp	x22, .LANCHOR5
-	adrp	x24, .LC26
+	adrp	x24, .LC30
 	add	x22, x22, :lo12:.LANCHOR5
 	add	x26, x20, :lo12:check_vpc_table
-	add	x24, x24, :lo12:.LC26
+	add	x24, x24, :lo12:.LC30
 	mov	w23, 0
 	mov	w19, 0
 	adrp	x25, .LANCHOR42
-.L982:
+.L1002:
 	ldrh	w0, [x22]
 	cmp	w0, w19
-	bhi	.L984
-	adrp	x0, .LANCHOR47
-	ldr	x19, [x0, #:lo12:.LANCHOR47]
-	cbz	x19, .L985
+	bhi	.L1004
+	adrp	x0, .LANCHOR46
+	ldr	x19, [x0, #:lo12:.LANCHOR46]
+	cbz	x19, .L1005
 	adrp	x0, .LANCHOR48
-	adrp	x25, .LC27
+	adrp	x25, .LC31
 	add	x20, x20, :lo12:check_vpc_table
-	add	x25, x25, :lo12:.LC27
+	add	x25, x25, :lo12:.LC31
 	ldrh	w26, [x0, #:lo12:.LANCHOR48]
 	adrp	x0, .LANCHOR40
 	mov	x24, x0
@@ -7090,17 +7125,17 @@ ftl_check_vpc:
 	movk	x1, 0xaaab, lsl 0
 	mul	x19, x19, x1
 	and	w19, w19, 65535
-.L986:
+.L1006:
 	cmp	w22, w26
-	bne	.L988
-.L985:
-	cbz	w23, .L978
+	bne	.L1008
+.L1005:
+	cbz	w23, .L998
 	adrp	x0, .LC1
-	mov	w2, 2389
+	mov	w2, 2383
 	add	x1, x21, :lo12:.LANCHOR159
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L978:
+.L998:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
@@ -7108,31 +7143,31 @@ ftl_check_vpc:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 112
 	ret
-.L981:
+.L1001:
 	mov	w2, 0
 	add	x1, x29, 108
 	mov	w0, w22
 	bl	log2phys
 	ldr	w0, [x29, 108]
 	cmn	w0, #1
-	beq	.L980
+	beq	.L1000
 	lsr	w0, w0, 10
 	bl	P2V_block_in_plane
 	and	x0, x0, 65535
 	ldrh	w1, [x19, x0, lsl 1]
 	add	w1, w1, 1
 	strh	w1, [x19, x0, lsl 1]
-.L980:
+.L1000:
 	add	w22, w22, 1
-	b	.L979
-.L984:
+	b	.L999
+.L1004:
 	ldr	x0, [x25, #:lo12:.LANCHOR42]
 	ubfiz	x28, x19, 1, 16
 	sxtw	x27, w19
 	ldrh	w2, [x0, x28]
 	ldrh	w3, [x26, x27, lsl 1]
 	cmp	w2, w3
-	beq	.L983
+	beq	.L1003
 	mov	w1, w19
 	mov	x0, x24
 	bl	printf
@@ -7140,34 +7175,34 @@ ftl_check_vpc:
 	mov	w1, 65535
 	ldrh	w0, [x0, x28]
 	cmp	w0, w1
-	beq	.L983
+	beq	.L1003
 	ldrh	w1, [x26, x27, lsl 1]
 	cmp	w1, w0
 	csinc	w23, w23, wzr, ls
-.L983:
+.L1003:
 	add	w19, w19, 1
 	and	w19, w19, 65535
-	b	.L982
-.L988:
+	b	.L1002
+.L1008:
 	ldr	x1, [x27, #:lo12:.LANCHOR42]
 	ubfiz	x0, x19, 1, 16
 	ldrh	w2, [x1, x0]
-	cbz	w2, .L987
+	cbz	w2, .L1007
 	ldrh	w3, [x20, w19, sxtw 1]
 	mov	w23, 1
 	mov	w1, w19
 	mov	x0, x25
 	bl	printf
-.L987:
+.L1007:
 	ldr	x0, [x24, #:lo12:.LANCHOR40]
 	umull	x19, w19, w28
 	ldrh	w19, [x0, x19]
 	mov	w0, 65535
 	cmp	w19, w0
-	beq	.L985
+	beq	.L1005
 	add	w22, w22, 1
 	and	w22, w22, 65535
-	b	.L986
+	b	.L1006
 	.size	ftl_check_vpc, .-ftl_check_vpc
 	.section	.text.ftl_scan_all_data,"ax",@progbits
 	.align	2
@@ -7175,9 +7210,9 @@ ftl_check_vpc:
 	.type	ftl_scan_all_data, %function
 ftl_scan_all_data:
 	sub	sp, sp, #96
-	adrp	x0, .LC28
+	adrp	x0, .LC32
 	mov	w1, 0
-	add	x0, x0, :lo12:.LC28
+	add	x0, x0, :lo12:.LC32
 	stp	x29, x30, [sp, 16]
 	add	x29, sp, 16
 	stp	x19, x20, [sp, 32]
@@ -7189,32 +7224,32 @@ ftl_scan_all_data:
 	add	x21, x21, :lo12:.LANCHOR152
 	str	x23, [sp, 64]
 	bl	printf
-.L1004:
+.L1024:
 	ldr	w0, [x21]
 	cmp	w19, w0
-	bcc	.L1010
+	bcc	.L1030
 	ldp	x19, x20, [sp, 32]
 	ldp	x21, x22, [sp, 48]
 	ldp	x29, x30, [sp, 16]
 	ldr	x23, [sp, 64]
 	add	sp, sp, 96
 	ret
-.L1010:
+.L1030:
 	mov	w2, 0
 	add	x1, x29, 76
 	mov	w0, w19
 	bl	log2phys
 	tst	x19, 2047
-	bne	.L1005
+	bne	.L1025
 	ldr	w2, [x29, 76]
-	adrp	x0, .LC29
+	adrp	x0, .LC33
 	mov	w1, w19
-	add	x0, x0, :lo12:.LC29
+	add	x0, x0, :lo12:.LC33
 	bl	printf
-.L1005:
+.L1025:
 	ldr	w1, [x29, 76]
 	cmn	w1, #1
-	beq	.L1007
+	beq	.L1027
 	add	x0, x20, :lo12:.LANCHOR138
 	str	wzr, [x20, #:lo12:.LANCHOR138]
 	mov	w2, 0
@@ -7231,25 +7266,25 @@ ftl_scan_all_data:
 	ldr	w0, [x20, #:lo12:.LANCHOR138]
 	cmp	w0, 256
 	ccmn	w0, #1, 4, ne
-	beq	.L1008
+	beq	.L1028
 	ldr	w0, [x23, 8]
 	cmp	w19, w0
-	beq	.L1007
-.L1008:
+	beq	.L1027
+.L1028:
 	ldp	x1, x0, [x22, 8]
 	ldr	w2, [x1, 4]
 	str	w2, [sp]
 	ldr	w2, [x22, 4]
 	ldp	w3, w4, [x0]
 	ldp	w5, w6, [x0, 8]
-	adrp	x0, .LC30
+	adrp	x0, .LC34
 	ldr	w7, [x1]
-	add	x0, x0, :lo12:.LC30
+	add	x0, x0, :lo12:.LC34
 	mov	w1, w19
 	bl	printf
-.L1007:
+.L1027:
 	add	w19, w19, 1
-	b	.L1004
+	b	.L1024
 	.size	ftl_scan_all_data, .-ftl_scan_all_data
 	.section	.text.FtlGcScanTempBlk,"ax",@progbits
 	.align	2
@@ -7259,37 +7294,37 @@ FtlGcScanTempBlk:
 	stp	x29, x30, [sp, -144]!
 	add	x29, sp, 0
 	stp	x25, x26, [sp, 64]
-	adrp	x26, .LANCHOR160
+	adrp	x25, .LANCHOR160
 	stp	x19, x20, [sp, 16]
 	mov	x19, x0
-	ldrh	w20, [x26, #:lo12:.LANCHOR160]
+	ldrh	w20, [x25, #:lo12:.LANCHOR160]
 	mov	w0, 65535
 	stp	x21, x22, [sp, 32]
 	stp	x23, x24, [sp, 48]
 	cmp	w20, w0
-	stp	x27, x28, [sp, 80]
-	beq	.L1033
-	cbnz	w20, .L1013
-.L1014:
+	str	x27, [sp, 80]
+	beq	.L1053
+	cbnz	w20, .L1033
+.L1034:
 	bl	FtlGcPageVarInit
-	b	.L1015
-.L1033:
+	b	.L1035
+.L1053:
 	mov	w20, 0
-.L1013:
+.L1033:
 	adrp	x0, .LANCHOR19
 	ldrh	w0, [x0, #:lo12:.LANCHOR19]
 	cmp	w0, w1
-	beq	.L1014
-.L1015:
-	adrp	x27, .LANCHOR152
-	add	x27, x27, :lo12:.LANCHOR152
-.L1016:
-	ldrh	w0, [x19]
-	mov	w23, 65535
+	beq	.L1034
+.L1035:
+	adrp	x26, .LANCHOR152
+	add	x26, x26, :lo12:.LANCHOR152
+.L1050:
+	ldrh	w1, [x19]
+	mov	w0, 65535
 	strb	wzr, [x19, 8]
-	cmp	w0, w23
-	beq	.L1017
-.L1032:
+	cmp	w1, w0
+	beq	.L1036
+.L1052:
 	adrp	x1, .LANCHOR64
 	adrp	x24, .LANCHOR103
 	add	x4, x19, 16
@@ -7297,6 +7332,7 @@ FtlGcScanTempBlk:
 	ldr	x5, [x1, #:lo12:.LANCHOR64]
 	adrp	x1, .LANCHOR23
 	ldr	x0, [x24, #:lo12:.LANCHOR103]
+	mov	w10, 65535
 	ldrh	w6, [x1, #:lo12:.LANCHOR23]
 	adrp	x1, .LANCHOR65
 	ldr	x7, [x1, #:lo12:.LANCHOR65]
@@ -7306,44 +7342,44 @@ FtlGcScanTempBlk:
 	ldrh	w1, [x1, #:lo12:.LANCHOR3]
 	add	x1, x1, 8
 	add	x1, x19, x1, lsl 1
-.L1018:
-	cmp	x4, x1
-	bne	.L1020
+.L1037:
+	cmp	x1, x4
+	bne	.L1039
 	mov	w1, w21
 	ubfiz	x21, x21, 5, 16
 	mov	x22, 0
 	mov	w2, 0
 	bl	FlashReadPages
-.L1021:
+.L1040:
 	cmp	x21, x22
-	bne	.L1031
+	bne	.L1051
 	adrp	x0, .LANCHOR19
 	add	w20, w20, 1
 	and	w20, w20, 65535
 	ldrh	w0, [x0, #:lo12:.LANCHOR19]
 	cmp	w0, w20
-	bhi	.L1032
-.L1017:
+	bhi	.L1052
+.L1036:
 	strh	w20, [x19, 2]
 	mov	w0, -1
 	strb	wzr, [x19, 6]
 	mov	w1, w20
-	strh	w0, [x26, #:lo12:.LANCHOR160]
+	strh	w0, [x25, #:lo12:.LANCHOR160]
 	mov	w2, 0
 	mov	x0, x19
 	bl	ftl_sb_update_avl_pages
 	mov	w0, -1
+	ldr	x27, [sp, 80]
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
 	ldp	x25, x26, [sp, 64]
-	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 144
 	ret
-.L1020:
+.L1039:
 	ldrh	w3, [x4]
-	cmp	w3, w23
-	beq	.L1019
+	cmp	w3, w10
+	beq	.L1038
 	ubfiz	x2, x21, 5, 16
 	orr	w3, w20, w3, lsl 10
 	add	x2, x0, x2
@@ -7358,24 +7394,25 @@ FtlGcScanTempBlk:
 	asr	w3, w3, 2
 	add	x3, x7, x3, sxtw 2
 	str	x3, [x2, 16]
-.L1019:
+.L1038:
 	add	x4, x4, 2
-	b	.L1018
-.L1031:
-	ldr	x1, [x24, #:lo12:.LANCHOR103]
-	add	x0, x1, x22
-	ldr	w1, [x1, x22]
-	ldr	w28, [x0, 4]
-	cbnz	w1, .L1022
-	ldr	x25, [x0, 16]
-	ldrh	w0, [x25]
-	cmp	w0, w23
-	beq	.L1022
-	ldr	w0, [x25, 8]
-	ldr	w1, [x27]
+	b	.L1037
+.L1051:
+	ldr	x0, [x24, #:lo12:.LANCHOR103]
+	add	x1, x0, x22
+	ldr	w0, [x0, x22]
+	ldr	w27, [x1, 4]
+	ldr	x23, [x1, 16]
+	cbnz	w0, .L1041
+	ldrh	w1, [x23]
+	mov	w0, 65535
+	cmp	w1, w0
+	beq	.L1063
+	ldr	w0, [x23, 8]
+	ldr	w1, [x26]
 	cmp	w0, w1
-	bls	.L1024
-.L1022:
+	bls	.L1043
+.L1063:
 	adrp	x0, .LANCHOR42
 	ldrh	w1, [x19]
 	mov	w20, 0
@@ -7384,26 +7421,30 @@ FtlGcScanTempBlk:
 	ldrh	w0, [x19]
 	bl	INSERT_FREE_LIST
 	mov	w0, -1
+	adrp	x1, .LANCHOR145
 	strh	w0, [x19]
+	strh	w0, [x1, #:lo12:.LANCHOR145]
 	bl	FtlGcPageVarInit
-	b	.L1016
-.L1024:
+	b	.L1050
+.L1043:
 	add	x1, x29, 108
 	mov	w2, 0
 	bl	log2phys
-	ldr	w0, [x25, 12]
+	ldr	w0, [x23, 12]
 	ldr	w1, [x29, 108]
 	cmp	w0, w1
-	beq	.L1026
-.L1027:
-	ldp	w2, w0, [x25, 8]
-	mov	w1, w28
+	beq	.L1045
+.L1047:
+	ldr	w2, [x23, 8]
+.L1064:
+	ldr	w0, [x23, 12]
+	mov	w1, w27
 	add	x22, x22, 32
 	bl	FtlGcUpdatePage
-	b	.L1021
-.L1026:
+	b	.L1040
+.L1045:
 	cmn	w0, #1
-	beq	.L1027
+	beq	.L1047
 	str	w0, [x29, 116]
 	adrp	x0, .LANCHOR110
 	mov	w2, 0
@@ -7422,22 +7463,25 @@ FtlGcScanTempBlk:
 	add	x2, x2, x22
 	mov	x0, 0
 	ubfiz	x1, x1, 9, 16
-.L1028:
+.L1048:
 	cmp	x0, x1
-	beq	.L1027
+	beq	.L1047
 	ldr	x4, [x2, 8]
 	ldr	w5, [x4, x0]
 	add	x0, x0, 4
 	add	x4, x3, x0
 	ldr	w4, [x4, -4]
 	cmp	w5, w4
-	beq	.L1028
+	beq	.L1048
 	ldrh	w1, [x19]
-	adrp	x0, .LC31
+	adrp	x0, .LC35
 	ldr	w2, [x29, 116]
-	add	x0, x0, :lo12:.LC31
+	add	x0, x0, :lo12:.LC35
 	bl	printf
-	b	.L1022
+	b	.L1063
+.L1041:
+	mov	w2, -1
+	b	.L1064
 	.size	FtlGcScanTempBlk, .-FtlGcScanTempBlk
 	.section	.text.FtlVendorPartWrite,"ax",@progbits
 	.align	2
@@ -7457,7 +7501,7 @@ FtlVendorPartWrite:
 	stp	x23, x24, [sp, 48]
 	stp	x25, x26, [sp, 64]
 	cmp	w1, w0
-	bhi	.L1051
+	bhi	.L1073
 	adrp	x0, .LANCHOR22
 	adrp	x25, .LANCHOR12
 	adrp	x26, .LANCHOR23
@@ -7467,9 +7511,9 @@ FtlVendorPartWrite:
 	add	x26, x26, :lo12:.LANCHOR23
 	mov	w23, 0
 	lsr	w21, w28, w21
-.L1045:
-	cbnz	w20, .L1050
-.L1043:
+.L1067:
+	cbnz	w20, .L1072
+.L1065:
 	mov	w0, w23
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -7478,7 +7522,7 @@ FtlVendorPartWrite:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 208
 	ret
-.L1050:
+.L1072:
 	ldrh	w1, [x25]
 	adrp	x0, .LANCHOR123
 	adrp	x27, .LANCHOR108
@@ -7491,9 +7535,9 @@ FtlVendorPartWrite:
 	and	w19, w19, 65535
 	cmp	w20, w19
 	csel	w19, w0, w19, cc
-	cbz	w2, .L1047
+	cbz	w2, .L1069
 	cmp	w19, w1
-	beq	.L1047
+	beq	.L1069
 	ldr	x0, [x27, #:lo12:.LANCHOR108]
 	str	x0, [x29, 120]
 	add	x0, x29, 144
@@ -7503,7 +7547,7 @@ FtlVendorPartWrite:
 	mov	w1, w2
 	add	x0, x29, 112
 	bl	FlashReadPages
-.L1048:
+.L1070:
 	lsl	w4, w19, 9
 	ldr	x0, [x27, #:lo12:.LANCHOR108]
 	lsl	w22, w22, 7
@@ -7524,16 +7568,16 @@ FtlVendorPartWrite:
 	ldr	w4, [x29, 108]
 	csinv	w23, w23, wzr, ne
 	add	x24, x24, x4, sxtw
-	b	.L1045
-.L1047:
+	b	.L1067
+.L1069:
 	ldrh	w2, [x26]
 	mov	w1, 0
 	ldr	x0, [x27, #:lo12:.LANCHOR108]
 	bl	ftl_memset
-	b	.L1048
-.L1051:
+	b	.L1070
+.L1073:
 	mov	w23, -1
-	b	.L1043
+	b	.L1065
 	.size	FtlVendorPartWrite, .-FtlVendorPartWrite
 	.section	.text.Ftl_save_ext_data,"ax",@progbits
 	.align	2
@@ -7546,7 +7590,7 @@ Ftl_save_ext_data:
 	mov	w0, 19539
 	movk	w0, 0x4654, lsl 16
 	cmp	w1, w0
-	bne	.L1056
+	bne	.L1078
 	mov	w0, 72
 	mov	w1, 1
 	movk	w0, 0x5000, lsl 16
@@ -7589,7 +7633,7 @@ Ftl_save_ext_data:
 	str	w0, [x2, 48]
 	mov	w0, 0
 	b	FtlVendorPartWrite
-.L1056:
+.L1078:
 	ret
 	.size	Ftl_save_ext_data, .-Ftl_save_ext_data
 	.section	.text.FtlEctTblFlush,"ax",@progbits
@@ -7600,20 +7644,20 @@ FtlEctTblFlush:
 	adrp	x2, .LANCHOR164
 	ldrh	w1, [x2, #:lo12:.LANCHOR164]
 	cmp	w1, 31
-	bhi	.L1062
+	bhi	.L1084
 	add	w1, w1, 1
 	strh	w1, [x2, #:lo12:.LANCHOR164]
 	mov	w1, 1
-.L1059:
+.L1081:
 	adrp	x2, .LANCHOR118
-	cbnz	w0, .L1060
+	cbnz	w0, .L1082
 	ldr	x0, [x2, #:lo12:.LANCHOR118]
 	ldr	w3, [x0, 20]
 	ldr	w0, [x0, 16]
 	add	w1, w1, w3
 	cmp	w0, w1
-	bcc	.L1064
-.L1060:
+	bcc	.L1086
+.L1082:
 	stp	x29, x30, [sp, -16]!
 	add	x29, sp, 0
 	ldr	x2, [x2, #:lo12:.LANCHOR118]
@@ -7636,10 +7680,10 @@ FtlEctTblFlush:
 	mov	w0, 0
 	ldp	x29, x30, [sp], 16
 	ret
-.L1062:
+.L1084:
 	mov	w1, 32
-	b	.L1059
-.L1064:
+	b	.L1081
+.L1086:
 	mov	w0, 0
 	ret
 	.size	FtlEctTblFlush, .-FtlEctTblFlush
@@ -7669,7 +7713,7 @@ FtlVendorPartRead:
 	stp	x25, x26, [sp, 64]
 	stp	x27, x28, [sp, 80]
 	cmp	w1, w0
-	bhi	.L1076
+	bhi	.L1098
 	adrp	x0, .LANCHOR22
 	mov	x25, x2
 	mov	w24, 0
@@ -7679,9 +7723,9 @@ FtlVendorPartRead:
 	add	x0, x0, :lo12:.LANCHOR12
 	str	x0, [x29, 104]
 	lsr	w20, w22, w20
-.L1069:
-	cbnz	w21, .L1075
-.L1067:
+.L1091:
+	cbnz	w21, .L1097
+.L1089:
 	mov	w0, w24
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -7690,7 +7734,7 @@ FtlVendorPartRead:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 208
 	ret
-.L1075:
+.L1097:
 	ldr	x0, [x27, #:lo12:.LANCHOR123]
 	ldr	w4, [x0, w20, uxtw 2]
 	ldr	x0, [x29, 104]
@@ -7703,7 +7747,7 @@ FtlVendorPartRead:
 	cmp	w21, w19
 	csel	w19, w0, w19, cc
 	lsl	w26, w19, 9
-	cbz	w4, .L1071
+	cbz	w4, .L1093
 	adrp	x28, .LANCHOR108
 	mov	w2, 1
 	str	w4, [x29, 96]
@@ -7723,12 +7767,12 @@ FtlVendorPartRead:
 	csinv	w24, w24, wzr, ne
 	ldr	w0, [x0, #:lo12:.LANCHOR138]
 	cmp	w0, 256
-	bne	.L1073
+	bne	.L1095
 	mov	w2, w4
 	mov	w1, w20
-	adrp	x0, .LC32
+	adrp	x0, .LC36
 	str	x28, [x29, 96]
-	add	x0, x0, :lo12:.LC32
+	add	x0, x0, :lo12:.LC36
 	bl	printf
 	ldr	x2, [x28, #:lo12:.LANCHOR108]
 	mov	w1, w20
@@ -7736,28 +7780,28 @@ FtlVendorPartRead:
 	add	x0, x0, :lo12:.LANCHOR161
 	bl	FtlMapWritePage
 	ldr	x5, [x29, 96]
-.L1073:
+.L1095:
 	ldr	x1, [x5, #:lo12:.LANCHOR108]
 	lsl	w23, w23, 7
 	mov	w2, w26
 	mov	x0, x25
 	add	x1, x1, x23, sxtw 2
 	bl	ftl_memcpy
-.L1074:
+.L1096:
 	add	w20, w20, 1
 	sub	w21, w21, w19
 	add	w22, w22, w19
 	add	x25, x25, x26, sxtw
-	b	.L1069
-.L1071:
+	b	.L1091
+.L1093:
 	mov	w2, w26
 	mov	w1, 0
 	mov	x0, x25
 	bl	ftl_memset
-	b	.L1074
-.L1076:
+	b	.L1096
+.L1098:
 	mov	w24, -1
-	b	.L1067
+	b	.L1089
 	.size	FtlVendorPartRead, .-FtlVendorPartRead
 	.section	.text.FtlLoadEctTbl,"ax",@progbits
 	.align	2
@@ -7778,18 +7822,18 @@ FtlLoadEctTbl:
 	mov	w0, 17221
 	movk	w0, 0x4254, lsl 16
 	cmp	w1, w0
-	beq	.L1079
-	adrp	x1, .LC33
-	adrp	x0, .LC34
-	add	x1, x1, :lo12:.LC33
-	add	x0, x0, :lo12:.LC34
+	beq	.L1101
+	adrp	x1, .LC37
+	adrp	x0, .LC38
+	add	x1, x1, :lo12:.LC37
+	add	x0, x0, :lo12:.LC38
 	bl	printf
 	ldr	x0, [x19, #:lo12:.LANCHOR118]
 	mov	w1, 0
 	ldrh	w2, [x20, #:lo12:.LANCHOR116]
 	lsl	w2, w2, 9
 	bl	ftl_memset
-.L1079:
+.L1101:
 	mov	w0, 0
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 32
@@ -7814,18 +7858,18 @@ Ftl_load_ext_data:
 	mov	w20, 19539
 	movk	w20, 0x4654, lsl 16
 	cmp	w0, w20
-	beq	.L1082
+	beq	.L1104
 	mov	w2, 512
 	mov	w1, 0
 	mov	x0, x21
 	bl	ftl_memset
 	str	w20, [x19, #:lo12:.LANCHOR135]
-.L1082:
+.L1104:
 	ldr	w1, [x19, #:lo12:.LANCHOR135]
 	add	x0, x19, :lo12:.LANCHOR135
 	cmp	w1, w20
 	adrp	x1, .LANCHOR91
-	bne	.L1083
+	bne	.L1105
 	adrp	x2, .LANCHOR162
 	ldr	w3, [x0, 88]
 	str	w3, [x2, #:lo12:.LANCHOR162]
@@ -7860,7 +7904,7 @@ Ftl_load_ext_data:
 	ldr	w2, [x0, 48]
 	adrp	x0, .LANCHOR93
 	str	w2, [x0, #:lo12:.LANCHOR93]
-.L1083:
+.L1105:
 	adrp	x0, .LANCHOR14
 	adrp	x2, .LANCHOR90
 	ldr	w1, [x1, #:lo12:.LANCHOR91]
@@ -7873,8 +7917,8 @@ Ftl_load_ext_data:
 	ldp	x29, x30, [sp], 48
 	ldrh	w1, [x1, #:lo12:.LANCHOR5]
 	udiv	w0, w0, w1
-	adrp	x1, .LANCHOR145
-	str	w0, [x1, #:lo12:.LANCHOR145]
+	adrp	x1, .LANCHOR143
+	str	w0, [x1, #:lo12:.LANCHOR143]
 	ret
 	.size	Ftl_load_ext_data, .-Ftl_load_ext_data
 	.section	.text.sftl_vendor_read,"ax",@progbits
@@ -7891,7 +7935,7 @@ sftl_vendor_read:
 	.type	FtlMapBlkWriteDump_data, %function
 FtlMapBlkWriteDump_data:
 	ldr	w1, [x0, 56]
-	cbz	w1, .L1086
+	cbz	w1, .L1108
 	stp	x29, x30, [sp, -80]!
 	add	x29, sp, 0
 	stp	x19, x20, [sp, 16]
@@ -7912,16 +7956,16 @@ FtlMapBlkWriteDump_data:
 	str	x24, [x21, 16]
 	str	wzr, [x19, 56]
 	ldr	x25, [x19, 40]
-	cbz	w0, .L1088
+	cbz	w0, .L1110
 	adrp	x1, .LANCHOR20
 	ldrh	w1, [x1, #:lo12:.LANCHOR20]
 	sub	w1, w1, #1
 	cmp	w0, w1
-	bge	.L1088
+	bge	.L1110
 	ldrh	w1, [x19]
 	mov	w2, 65535
 	cmp	w1, w2
-	beq	.L1088
+	beq	.L1110
 	ldr	x2, [x19, 16]
 	ubfiz	x1, x1, 1, 16
 	sub	w0, w0, #1
@@ -7934,16 +7978,16 @@ FtlMapBlkWriteDump_data:
 	bl	FlashReadPages
 	ldr	w0, [x23, #:lo12:.LANCHOR138]
 	cmn	w0, #1
-	beq	.L1088
+	beq	.L1110
 	ldrh	w1, [x24, 8]
 	ldr	x2, [x19, 40]
 	ubfiz	x0, x1, 2, 16
 	ldr	w2, [x2, x0]
 	ldr	w0, [x21, 4]
 	cmp	w2, w0
-	bne	.L1088
+	bne	.L1110
 	ldr	x2, [x21, 8]
-.L1100:
+.L1122:
 	mov	x0, x19
 	ldr	x25, [sp, 64]
 	ldp	x19, x20, [sp, 16]
@@ -7951,30 +7995,30 @@ FtlMapBlkWriteDump_data:
 	ldp	x23, x24, [sp, 48]
 	ldp	x29, x30, [sp], 80
 	b	FtlMapWritePage
-.L1088:
+.L1110:
 	sub	w20, w20, #1
 	and	w20, w20, 65535
 	ubfiz	x0, x20, 2, 16
 	ldr	w1, [x25, x0]
 	add	x0, x22, :lo12:.LANCHOR138
 	str	w1, [x0, 4]
-	cbz	w1, .L1089
+	cbz	w1, .L1111
 	mov	w2, 1
 	mov	w1, w2
 	bl	FlashReadPages
-.L1090:
+.L1112:
 	add	x22, x22, :lo12:.LANCHOR138
 	mov	w1, w20
 	ldr	x2, [x22, 8]
-	b	.L1100
-.L1089:
+	b	.L1122
+.L1111:
 	adrp	x1, .LANCHOR23
 	ldr	x0, [x0, 8]
 	ldrh	w2, [x1, #:lo12:.LANCHOR23]
 	mov	w1, 255
 	bl	ftl_memset
-	b	.L1090
-.L1086:
+	b	.L1112
+.L1108:
 	ret
 	.size	FtlMapBlkWriteDump_data, .-FtlMapBlkWriteDump_data
 	.section	.text.FtlVpcTblFlush,"ax",@progbits
@@ -8094,7 +8138,7 @@ FtlVpcTblFlush:
 	add	x24, x24, :lo12:.LANCHOR20
 	str	w0, [x29, 108]
 	str	x24, [x29, 96]
-.L1102:
+.L1124:
 	ldrh	w2, [x28, 2]
 	ldrh	w1, [x28]
 	ldr	x0, [x22, #:lo12:.LANCHOR106]
@@ -8106,7 +8150,7 @@ FtlVpcTblFlush:
 	ldrh	w0, [x24]
 	sub	w0, w0, #1
 	cmp	w2, w0
-	blt	.L1103
+	blt	.L1125
 	ldrh	w0, [x28, 4]
 	strh	wzr, [x28, 2]
 	strh	w1, [x28, 4]
@@ -8121,7 +8165,7 @@ FtlVpcTblFlush:
 	str	w2, [x19, 4]
 	strh	w0, [x27, 2]
 	str	w1, [x27, 4]
-.L1103:
+.L1125:
 	ldrh	w1, [x26, #:lo12:.LANCHOR23]
 	ldr	x0, [x22, #:lo12:.LANCHOR106]
 	bl	js_hash
@@ -8137,49 +8181,49 @@ FtlVpcTblFlush:
 	and	w0, w0, 65535
 	strh	w0, [x28, 2]
 	cmn	w1, #1
-	bne	.L1104
+	bne	.L1126
 	cmp	w0, 1
-	bne	.L1105
+	bne	.L1127
 	adrp	x1, .LANCHOR165
 	adrp	x0, .LC1
 	mov	w2, 1138
 	add	x1, x1, :lo12:.LANCHOR165
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1105:
+.L1127:
 	ldrh	w0, [x28, 2]
 	cmp	w0, 1
-	bne	.L1106
+	bne	.L1128
 	ldr	x0, [x29, 96]
 	ldrh	w0, [x0]
 	sub	w0, w0, #1
 	strh	w0, [x28, 2]
-.L1106:
+.L1128:
 	add	w20, w20, 1
 	and	w20, w20, 65535
 	cmp	w20, 3
-	bls	.L1102
+	bls	.L1124
 	add	x21, x21, :lo12:.LANCHOR138
-	adrp	x0, .LC35
+	adrp	x0, .LC39
 	mov	w2, w20
-	add	x0, x0, :lo12:.LC35
+	add	x0, x0, :lo12:.LC39
 	ldr	w1, [x21, 4]
 	bl	printf
-.L1108:
-	b	.L1108
-.L1104:
+.L1130:
+	b	.L1130
+.L1126:
 	cmp	w0, 1
-	beq	.L1102
+	beq	.L1124
 	cmp	w1, 256
-	beq	.L1102
+	beq	.L1124
 	ldr	w1, [x29, 108]
 	mov	w0, 65535
 	cmp	w1, w0
-	beq	.L1109
+	beq	.L1131
 	ldrh	w0, [x29, 108]
 	mov	w1, 1
 	bl	FtlFreeSysBlkQueueIn
-.L1109:
+.L1131:
 	ldp	x19, x20, [sp, 16]
 	mov	w0, 0
 	ldp	x21, x22, [sp, 32]
@@ -8212,14 +8256,14 @@ sftl_deinit:
 	adrp	x0, .LANCHOR166
 	ldr	w0, [x0, #:lo12:.LANCHOR166]
 	cmp	w0, 1
-	bne	.L1122
+	bne	.L1144
 	stp	x29, x30, [sp, -16]!
 	add	x29, sp, 0
 	bl	FtlSysFlush
 	mov	w0, 0
 	ldp	x29, x30, [sp], 16
 	ret
-.L1122:
+.L1144:
 	mov	w0, 0
 	ret
 	.size	sftl_deinit, .-sftl_deinit
@@ -8238,56 +8282,56 @@ FtlDiscard:
 	str	x23, [sp, 48]
 	ldr	w1, [x1, #:lo12:.LANCHOR34]
 	cmp	w2, w1
-	bhi	.L1133
+	bhi	.L1155
 	cmp	w19, 31
-	bhi	.L1127
-.L1141:
+	bhi	.L1149
+.L1163:
 	mov	w0, 0
-.L1125:
+.L1147:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldr	x23, [sp, 48]
 	ldp	x29, x30, [sp], 80
 	ret
-.L1127:
+.L1149:
 	adrp	x21, .LANCHOR12
 	ldrh	w1, [x21, #:lo12:.LANCHOR12]
 	udiv	w20, w0, w1
 	msub	w0, w1, w20, w0
 	ands	w0, w0, 65535
-	beq	.L1128
+	beq	.L1150
 	sub	w1, w1, w0
 	add	w20, w20, 1
 	cmp	w1, w19
 	csel	w1, w1, w19, ls
 	sub	w19, w19, w1, uxth
-.L1128:
+.L1150:
 	adrp	x22, .LANCHOR167
 	adrp	x23, .LANCHOR86
 	add	x22, x22, :lo12:.LANCHOR167
 	add	x23, x23, :lo12:.LANCHOR86
 	mov	w0, -1
 	str	w0, [x29, 76]
-.L1129:
+.L1151:
 	ldrh	w0, [x21, #:lo12:.LANCHOR12]
 	cmp	w19, w0
-	bcs	.L1131
+	bcs	.L1153
 	adrp	x0, .LANCHOR167
 	ldr	w1, [x0, #:lo12:.LANCHOR167]
 	cmp	w1, 32
-	bls	.L1141
+	bls	.L1163
 	str	wzr, [x0, #:lo12:.LANCHOR167]
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-	b	.L1141
-.L1131:
+	b	.L1163
+.L1153:
 	mov	w2, 0
 	add	x1, x29, 72
 	mov	w0, w20
 	bl	log2phys
 	ldr	w0, [x29, 72]
 	cmn	w0, #1
-	beq	.L1130
+	beq	.L1152
 	ldr	w0, [x22]
 	mov	w2, 1
 	add	x1, x29, 76
@@ -8302,14 +8346,14 @@ FtlDiscard:
 	lsr	w0, w0, 10
 	bl	P2V_block_in_plane
 	bl	decrement_vpc_count
-.L1130:
+.L1152:
 	ldrh	w0, [x21, #:lo12:.LANCHOR12]
 	add	w20, w20, 1
 	sub	w19, w19, w0
-	b	.L1129
-.L1133:
+	b	.L1151
+.L1155:
 	mov	w0, -1
-	b	.L1125
+	b	.L1147
 	.size	FtlDiscard, .-FtlDiscard
 	.section	.text.allocate_new_data_superblock,"ax",@progbits
 	.align	2
@@ -8325,25 +8369,25 @@ allocate_new_data_superblock:
 	adrp	x0, .LANCHOR5
 	ldrh	w0, [x0, #:lo12:.LANCHOR5]
 	cmp	w0, w19
-	bcs	.L1143
+	bcs	.L1165
 	adrp	x1, .LANCHOR168
 	adrp	x0, .LC1
-	mov	w2, 2760
+	mov	w2, 2755
 	add	x1, x1, :lo12:.LANCHOR168
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1143:
+.L1165:
 	mov	w0, 65535
 	cmp	w19, w0
-	beq	.L1144
+	beq	.L1166
 	adrp	x1, .LANCHOR42
 	ubfiz	x0, x19, 1, 16
 	ldr	x1, [x1, #:lo12:.LANCHOR42]
 	ldrh	w0, [x1, x0]
-	cbz	w0, .L1145
+	cbz	w0, .L1167
 	mov	w0, w19
 	bl	INSERT_DATA_LIST
-.L1144:
+.L1166:
 	adrp	x1, .LANCHOR131
 	mov	w0, 1
 	strb	w0, [x21, 8]
@@ -8351,20 +8395,20 @@ allocate_new_data_superblock:
 	ldrh	w0, [x1, #:lo12:.LANCHOR131]
 	mov	x20, x1
 	cmp	w0, w2
-	beq	.L1146
+	beq	.L1168
 	cmp	w19, w0
-	bne	.L1147
+	bne	.L1169
 	adrp	x2, .LANCHOR42
 	ubfiz	x1, x0, 1, 16
 	ldr	x2, [x2, #:lo12:.LANCHOR42]
 	ldrh	w1, [x2, x1]
-	cbz	w1, .L1148
-.L1147:
+	cbz	w1, .L1170
+.L1169:
 	bl	update_vpc_list
-.L1148:
+.L1170:
 	mov	w0, -1
 	strh	w0, [x20, #:lo12:.LANCHOR131]
-.L1146:
+.L1168:
 	mov	x0, x21
 	bl	allocate_data_superblock
 	bl	l2p_flush
@@ -8376,96 +8420,79 @@ allocate_new_data_superblock:
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 48
 	ret
-.L1145:
+.L1167:
 	mov	w0, w19
 	bl	INSERT_FREE_LIST
-	b	.L1144
+	b	.L1166
 	.size	allocate_new_data_superblock, .-allocate_new_data_superblock
 	.section	.text.FtlProgPages,"ax",@progbits
 	.align	2
 	.global	FtlProgPages
 	.type	FtlProgPages, %function
 FtlProgPages:
-	stp	x29, x30, [sp, -96]!
+	stp	x29, x30, [sp, -80]!
 	mov	w2, 0
 	add	x29, sp, 0
 	stp	x19, x20, [sp, 16]
-	mov	x19, x3
-	stp	x23, x24, [sp, 48]
-	add	x20, x0, 4
+	mov	x20, x3
 	stp	x21, x22, [sp, 32]
 	mov	w21, w1
-	str	x25, [sp, 64]
+	stp	x23, x24, [sp, 48]
 	ubfiz	x21, x21, 5, 32
+	mov	x22, x0
 	add	x21, x21, 4
-	adrp	x24, .LANCHOR19
 	ldrb	w3, [x3, 9]
-	adrp	x23, .LANCHOR135
-	add	x21, x0, x21
-	add	x24, x24, :lo12:.LANCHOR19
-	add	x23, x23, :lo12:.LANCHOR135
+	adrp	x23, .LC40
+	adrp	x24, .LANCHOR3
+	add	x19, x22, 4
+	add	x21, x22, x21
+	add	x23, x23, :lo12:.LC40
+	add	x24, x24, :lo12:.LANCHOR3
 	bl	FlashProgPages
-.L1154:
-	cmp	x20, x21
-	beq	.L1161
-	sub	x22, x20, #4
-	adrp	x25, .LANCHOR42
-	b	.L1162
-.L1157:
-	ldr	w0, [x20]
+.L1176:
+	cmp	x21, x19
+	beq	.L1182
+	sub	x22, x19, #4
+	b	.L1183
+.L1178:
+	ldr	w1, [x19]
+	mov	x0, x23
+	bl	printf
+	ldr	w0, [x19]
 	lsr	w0, w0, 10
 	bl	P2V_block_in_plane
-	ldrh	w1, [x19]
-	cmp	w1, w0, uxth
-	bne	.L1155
-	ldr	x2, [x25, #:lo12:.LANCHOR42]
-	ubfiz	x1, x1, 1, 16
-	ldrh	w3, [x19, 4]
-	ldrh	w0, [x2, x1]
-	sub	w0, w0, w3
-	strh	w0, [x2, x1]
-	strb	wzr, [x19, 6]
-	ldrh	w0, [x24]
-	strh	w0, [x19, 2]
-	strh	wzr, [x19, 4]
-.L1155:
-	ldrh	w0, [x19, 4]
-	cbnz	w0, .L1156
-	mov	x0, x19
+	bl	decrement_vpc_count
+	ldrh	w0, [x20, 4]
+	cbnz	w0, .L1177
+	mov	x0, x20
 	bl	allocate_new_data_superblock
-.L1156:
-	ldr	w0, [x23, 96]
-	add	w0, w0, 1
-	str	w0, [x23, 96]
-	ldr	w0, [x20]
-	lsr	w0, w0, 10
-	bl	FtlGcMarkBadPhyBlk
-	mov	x0, x19
+.L1177:
+	mov	x0, x20
 	bl	get_new_active_ppa
-	str	w0, [x20]
+	str	w0, [x19]
 	mov	w2, 0
-	str	w0, [x29, 92]
+	str	w0, [x29, 76]
 	mov	w1, 1
-	ldrb	w3, [x19, 9]
+	ldrb	w3, [x20, 9]
 	mov	x0, x22
 	bl	FlashProgPages
-.L1162:
-	ldr	w0, [x20, -4]
-	cmn	w0, #1
-	beq	.L1157
-	adrp	x0, .LANCHOR3
-	ldrb	w1, [x19, 6]
-	ldrh	w0, [x0, #:lo12:.LANCHOR3]
+.L1183:
+	ldr	w2, [x19, -4]
+	cmp	w2, 256
+	ccmn	w2, #1, 4, ne
+	beq	.L1178
+	ldrb	w1, [x20, 6]
+	ldrh	w0, [x24]
 	cmp	w1, w0
-	bcc	.L1158
+	bcc	.L1179
 	adrp	x1, .LANCHOR169
 	adrp	x0, .LC1
-	mov	w2, 960
+	mov	w2, 982
 	add	x1, x1, :lo12:.LANCHOR169
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1158:
-	add	x1, x29, 96
+.L1179:
+	add	x1, x29, 80
 	ldr	w0, [x22, 4]
 	mov	w2, 1
 	str	w0, [x1, -4]!
@@ -8478,40 +8505,39 @@ FtlProgPages:
 	and	w1, w0, 65535
 	mov	w22, w1
 	cmn	w3, #1
-	beq	.L1159
+	beq	.L1180
 	adrp	x2, .LANCHOR42
 	ubfiz	x0, x1, 1, 16
 	ldr	x2, [x2, #:lo12:.LANCHOR42]
 	ldrh	w0, [x2, x0]
-	cbnz	w0, .L1160
-	adrp	x0, .LC36
+	cbnz	w0, .L1181
+	adrp	x0, .LC41
 	mov	w2, 0
-	add	x0, x0, :lo12:.LC36
+	add	x0, x0, :lo12:.LC41
 	bl	printf
-.L1160:
+.L1181:
 	mov	w0, w22
 	bl	decrement_vpc_count
-.L1159:
-	add	x20, x20, 32
-	b	.L1154
-.L1161:
+.L1180:
+	add	x19, x19, 32
+	b	.L1176
+.L1182:
 	adrp	x0, .LANCHOR3
-	ldrb	w1, [x19, 6]
+	ldrb	w1, [x20, 6]
 	ldrh	w0, [x0, #:lo12:.LANCHOR3]
 	cmp	w1, w0
-	bcc	.L1153
+	bcc	.L1175
 	adrp	x1, .LANCHOR169
 	adrp	x0, .LC1
-	mov	w2, 975
+	mov	w2, 997
 	add	x1, x1, :lo12:.LANCHOR169
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1153:
+.L1175:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
-	ldr	x25, [sp, 64]
-	ldp	x29, x30, [sp], 96
+	ldp	x29, x30, [sp], 80
 	ret
 	.size	FtlProgPages, .-FtlProgPages
 	.section	.text.FtlGcFreeTempBlock,"ax",@progbits
@@ -8525,64 +8551,25 @@ FtlGcFreeTempBlock:
 	stp	x19, x20, [sp, 16]
 	adrp	x19, .LANCHOR53
 	stp	x21, x22, [sp, 32]
-	adrp	x21, .LANCHOR133
-	ldrh	w20, [x19, #:lo12:.LANCHOR53]
+	ldrh	w2, [x19, #:lo12:.LANCHOR53]
 	stp	x23, x24, [sp, 48]
 	stp	x25, x26, [sp, 64]
-	cmp	w20, w1
-	str	x27, [sp, 80]
-	beq	.L1169
+	cmp	w2, w1
+	stp	x27, x28, [sp, 80]
+	beq	.L1190
 	adrp	x1, .LANCHOR19
 	add	x0, x19, :lo12:.LANCHOR53
 	ldrh	w1, [x1, #:lo12:.LANCHOR19]
 	bl	FtlGcScanTempBlk
 	str	w0, [x29, 108]
-	cmn	w0, #1
-	beq	.L1169
-	adrp	x0, .LANCHOR43
-	ubfiz	x20, x20, 1, 16
-	ldr	x1, [x0, #:lo12:.LANCHOR43]
-	ldrh	w0, [x1, x20]
-	cmp	w0, 4
-	bls	.L1170
-	sub	w0, w0, #5
-	strh	w0, [x1, x20]
-	mov	w0, 1
-	bl	FtlEctTblFlush
-.L1170:
-	ldr	w0, [x21, #:lo12:.LANCHOR133]
-	cbnz	w0, .L1171
-	adrp	x0, .LANCHOR135
-	add	x0, x0, :lo12:.LANCHOR135
-	ldr	w1, [x0, 96]
-	add	w1, w1, 1
-	str	w1, [x0, 96]
-	ldr	w0, [x29, 108]
-	lsr	w0, w0, 10
-	bl	FtlBbmMapBadBlock
-	bl	FtlBbmTblFlush
-.L1171:
-	str	wzr, [x21, #:lo12:.LANCHOR133]
-	mov	w0, 1
-.L1168:
-	ldp	x19, x20, [sp, 16]
-	ldp	x21, x22, [sp, 32]
-	ldp	x23, x24, [sp, 48]
-	ldp	x25, x26, [sp, 64]
-	ldr	x27, [sp, 80]
-	ldp	x29, x30, [sp], 112
-	ret
-.L1169:
+.L1190:
+	adrp	x0, .LANCHOR133
 	ldrh	w2, [x19, #:lo12:.LANCHOR53]
 	mov	w1, 65535
-	str	wzr, [x21, #:lo12:.LANCHOR133]
-	add	x0, x19, :lo12:.LANCHOR53
+	str	wzr, [x0, #:lo12:.LANCHOR133]
 	cmp	w2, w1
-	bne	.L1173
-.L1188:
-	mov	w0, 0
-	b	.L1168
-.L1173:
+	add	x0, x19, :lo12:.LANCHOR53
+	beq	.L1192
 	ldrb	w1, [x0, 7]
 	adrp	x0, .LANCHOR19
 	adrp	x20, .LANCHOR70
@@ -8591,25 +8578,25 @@ FtlGcFreeTempBlock:
 	ldrh	w2, [x20, #:lo12:.LANCHOR70]
 	mul	w1, w1, w3
 	cmp	w2, w1
-	beq	.L1174
+	beq	.L1193
 	adrp	x1, .LANCHOR170
 	adrp	x0, .LC1
-	mov	w2, 162
+	mov	w2, 164
 	add	x1, x1, :lo12:.LANCHOR170
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1174:
+.L1193:
 	add	x0, x19, :lo12:.LANCHOR53
-	adrp	x23, .LANCHOR42
+	adrp	x22, .LANCHOR42
 	ldrh	w3, [x21, #:lo12:.LANCHOR19]
 	adrp	x25, .LANCHOR152
 	ldrh	w2, [x19, #:lo12:.LANCHOR53]
-	adrp	x26, .LANCHOR170
+	add	x26, x20, :lo12:.LANCHOR70
 	ldrb	w0, [x0, 7]
 	add	x25, x25, :lo12:.LANCHOR152
-	ldr	x1, [x23, #:lo12:.LANCHOR42]
-	add	x26, x26, :lo12:.LANCHOR170
+	ldr	x1, [x22, #:lo12:.LANCHOR42]
 	mov	w21, 0
+	adrp	x27, .LANCHOR71
 	mul	w0, w0, w3
 	strh	w0, [x1, x2, lsl 1]
 	adrp	x1, .LANCHOR84
@@ -8617,19 +8604,19 @@ FtlGcFreeTempBlock:
 	ldr	w2, [x1, #:lo12:.LANCHOR84]
 	add	w0, w0, w2
 	str	w0, [x1, #:lo12:.LANCHOR84]
-.L1175:
-	ldrh	w0, [x20, #:lo12:.LANCHOR70]
+.L1194:
+	ldrh	w0, [x26]
 	cmp	w0, w21
-	bhi	.L1179
+	bhi	.L1198
 	mov	w0, -1
 	bl	decrement_vpc_count
 	ldrh	w0, [x19, #:lo12:.LANCHOR53]
-	ldr	x2, [x23, #:lo12:.LANCHOR42]
+	ldr	x2, [x22, #:lo12:.LANCHOR42]
 	ubfiz	x1, x0, 1, 16
 	ldrh	w1, [x2, x1]
-	cbz	w1, .L1180
+	cbz	w1, .L1199
 	bl	INSERT_DATA_LIST
-.L1181:
+.L1200:
 	adrp	x0, .LANCHOR68
 	mov	w21, -1
 	strh	wzr, [x20, #:lo12:.LANCHOR70]
@@ -8637,66 +8624,69 @@ FtlGcFreeTempBlock:
 	strh	wzr, [x0, #:lo12:.LANCHOR68]
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-	adrp	x0, .LANCHOR144
-	strh	w21, [x0, #:lo12:.LANCHOR144]
+	adrp	x0, .LANCHOR145
+	strh	w21, [x0, #:lo12:.LANCHOR145]
 	adrp	x0, .LANCHOR48
 	ldrh	w1, [x0, #:lo12:.LANCHOR48]
 	adrp	x0, .LANCHOR171
 	ldrh	w0, [x0, #:lo12:.LANCHOR171]
 	add	w0, w0, w0, lsl 1
 	cmp	w1, w0, lsr 2
-	ble	.L1188
+	ble	.L1192
 	adrp	x0, .LANCHOR100
 	mov	w1, 20
 	strh	w1, [x0, #:lo12:.LANCHOR100]
-	b	.L1188
-.L1179:
-	adrp	x0, .LANCHOR71
+.L1192:
+	ldp	x19, x20, [sp, 16]
+	mov	w0, 0
+	ldp	x21, x22, [sp, 32]
+	ldp	x23, x24, [sp, 48]
+	ldp	x25, x26, [sp, 64]
+	ldp	x27, x28, [sp, 80]
+	ldp	x29, x30, [sp], 112
+	ret
+.L1198:
 	mov	w24, 12
-	ldr	x27, [x0, #:lo12:.LANCHOR71]
+	ldr	x28, [x27, #:lo12:.LANCHOR71]
+	ldr	w1, [x25]
 	umull	x24, w21, w24
-	ldr	w0, [x25]
-	add	x22, x27, x24
-	ldr	w1, [x22, 8]
-	cmp	w1, w0
-	bcc	.L1176
-	adrp	x0, .LC1
-	mov	w2, 168
-	mov	x1, x26
-	add	x0, x0, :lo12:.LC1
-	bl	printf
-.L1176:
-	ldr	w0, [x22, 8]
+	add	x23, x28, x24
+	ldr	w0, [x23, 8]
+	cmp	w0, w1
+	bcc	.L1195
+.L1203:
+	ldrh	w0, [x19, #:lo12:.LANCHOR53]
+	b	.L1204
+.L1195:
 	add	x1, x29, 108
 	mov	w2, 0
 	bl	log2phys
-	ldr	w0, [x27, x24]
+	ldr	w0, [x28, x24]
 	ldr	w1, [x29, 108]
 	cmp	w0, w1
-	bne	.L1177
+	bne	.L1197
 	lsr	w0, w0, 10
 	bl	P2V_block_in_plane
 	mov	w24, w0
-	ldr	w0, [x22, 8]
+	ldr	w0, [x23, 8]
 	mov	w2, 1
-	add	x1, x22, 4
+	add	x1, x23, 4
 	bl	log2phys
 	mov	w0, w24
-.L1187:
+.L1204:
 	bl	decrement_vpc_count
-.L1178:
+	b	.L1196
+.L1197:
+	ldr	w0, [x23, 4]
+	cmp	w1, w0
+	bne	.L1203
+.L1196:
 	add	w21, w21, 1
 	and	w21, w21, 65535
-	b	.L1175
-.L1177:
-	ldr	w0, [x22, 4]
-	cmp	w1, w0
-	beq	.L1178
-	ldrh	w0, [x19, #:lo12:.LANCHOR53]
-	b	.L1187
-.L1180:
+	b	.L1194
+.L1199:
 	bl	INSERT_FREE_LIST
-	b	.L1181
+	b	.L1200
 	.size	FtlGcFreeTempBlock, .-FtlGcFreeTempBlock
 	.section	.text.FtlGcPageRecovery,"ax",@progbits
 	.align	2
@@ -8715,7 +8705,7 @@ FtlGcPageRecovery:
 	ldrh	w1, [x19, 2]
 	ldrh	w0, [x20, #:lo12:.LANCHOR19]
 	cmp	w1, w0
-	bcc	.L1189
+	bcc	.L1205
 	adrp	x0, .LANCHOR129
 	add	x0, x0, :lo12:.LANCHOR129
 	bl	FtlMapBlkWriteDump_data
@@ -8723,7 +8713,7 @@ FtlGcPageRecovery:
 	bl	FtlGcFreeTempBlock
 	adrp	x0, .LANCHOR133
 	str	wzr, [x0, #:lo12:.LANCHOR133]
-.L1189:
+.L1205:
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
@@ -8775,59 +8765,44 @@ Ftl_gc_temp_data_write_back:
 	ldr	x0, [x20, #:lo12:.LANCHOR104]
 	bl	FlashProgPages
 	mov	w11, 0
-.L1195:
+.L1211:
 	ldr	w1, [x19]
 	cmp	w11, w1
-	bcc	.L1198
+	bcc	.L1214
 	ldr	x0, [x20, #:lo12:.LANCHOR104]
 	bl	FtlGcBufFree
 	str	wzr, [x19]
 	adrp	x0, .LANCHOR53+4
 	ldrh	w0, [x0, #:lo12:.LANCHOR53+4]
-	cbnz	w0, .L1199
+	cbnz	w0, .L1216
 	mov	w0, 1
 	bl	FtlGcFreeTempBlock
-	b	.L1201
-.L1198:
+	mov	w0, 1
+.L1210:
+	ldp	x19, x20, [sp, 16]
+	ldp	x29, x30, [sp], 32
+	ret
+.L1214:
 	ldr	x2, [x20, #:lo12:.LANCHOR104]
 	ubfiz	x0, x11, 5, 16
 	add	x1, x2, x0
 	ldr	w2, [x2, x0]
+	ldr	x3, [x1, 16]
 	cmn	w2, #1
-	bne	.L1196
-	adrp	x0, .LANCHOR53
-	adrp	x3, .LANCHOR42
-	ldrh	w4, [x0, #:lo12:.LANCHOR53]
-	ldr	x3, [x3, #:lo12:.LANCHOR42]
-	strh	wzr, [x3, x4, lsl 1]
-	strh	w2, [x0, #:lo12:.LANCHOR53]
-	adrp	x0, .LANCHOR135
-	add	x0, x0, :lo12:.LANCHOR135
-	ldr	w2, [x0, 96]
-	add	w2, w2, 1
-	str	w2, [x0, 96]
-	ldr	w0, [x1, 4]
-	lsr	w0, w0, 10
-	bl	FtlBbmMapBadBlock
-	bl	FtlBbmTblFlush
-	bl	FtlGcPageVarInit
-.L1201:
-	mov	w0, 1
-.L1194:
-	ldp	x19, x20, [sp, 16]
-	ldp	x29, x30, [sp], 32
-	ret
-.L1196:
-	ldr	x0, [x1, 16]
+	bne	.L1212
+.L1218:
 	ldr	w1, [x1, 4]
-	ldp	w2, w0, [x0, 8]
+	ldr	w0, [x3, 12]
 	bl	FtlGcUpdatePage
 	add	w11, w11, 1
 	and	w11, w11, 65535
-	b	.L1195
-.L1199:
+	b	.L1211
+.L1212:
+	ldr	w2, [x3, 8]
+	b	.L1218
+.L1216:
 	mov	w0, 0
-	b	.L1194
+	b	.L1210
 	.size	Ftl_gc_temp_data_write_back, .-Ftl_gc_temp_data_write_back
 	.section	.text.Ftl_get_new_temp_ppa,"ax",@progbits
 	.align	2
@@ -8842,11 +8817,11 @@ Ftl_get_new_temp_ppa:
 	mov	x19, x0
 	ldrh	w3, [x0, #:lo12:.LANCHOR53]
 	cmp	w3, w2
-	beq	.L1203
+	beq	.L1220
 	add	x1, x0, :lo12:.LANCHOR53
 	ldrh	w0, [x1, 4]
-	cbnz	w0, .L1204
-.L1203:
+	cbnz	w0, .L1221
+.L1220:
 	mov	w0, 0
 	bl	FtlGcFreeTempBlock
 	add	x0, x19, :lo12:.LANCHOR53
@@ -8860,7 +8835,7 @@ Ftl_get_new_temp_ppa:
 	mov	w0, 0
 	bl	FtlEctTblFlush
 	bl	FtlVpcTblFlush
-.L1204:
+.L1221:
 	add	x0, x19, :lo12:.LANCHOR53
 	ldr	x19, [sp, 16]
 	ldp	x29, x30, [sp], 32
@@ -8880,69 +8855,69 @@ rk_ftl_garbage_collect:
 	stp	x23, x24, [sp, 48]
 	stp	x25, x26, [sp, 64]
 	stp	x27, x28, [sp, 80]
-	cbnz	w1, .L1258
-	adrp	x1, .LANCHOR45
-	ldrh	w1, [x1, #:lo12:.LANCHOR45]
+	cbnz	w1, .L1280
+	adrp	x1, .LANCHOR44
+	ldrh	w1, [x1, #:lo12:.LANCHOR44]
 	cmp	w1, 47
-	bls	.L1258
+	bls	.L1280
 	adrp	x1, .LANCHOR73
 	mov	w4, 65535
 	ldrh	w3, [x1, #:lo12:.LANCHOR73]
 	cmp	w3, w4
-	beq	.L1208
+	beq	.L1225
 	adrp	x2, .LANCHOR72
 	ldrh	w5, [x2, #:lo12:.LANCHOR72]
 	cmp	w5, w4
-	bne	.L1208
+	bne	.L1225
 	strh	w3, [x2, #:lo12:.LANCHOR72]
 	mov	w2, -1
 	strh	w2, [x1, #:lo12:.LANCHOR73]
-.L1208:
-	cbnz	w0, .L1259
+.L1225:
+	cbnz	w0, .L1281
 	adrp	x1, .LANCHOR48
 	ldrh	w1, [x1, #:lo12:.LANCHOR48]
 	cmp	w1, 24
-	bhi	.L1260
+	bhi	.L1282
 	adrp	x2, .LANCHOR19
 	cmp	w1, 16
 	ldrh	w20, [x2, #:lo12:.LANCHOR19]
-	bls	.L1211
+	bls	.L1228
 	lsr	w20, w20, 5
-.L1210:
+.L1227:
 	adrp	x2, .LANCHOR100
 	ldrh	w3, [x2, #:lo12:.LANCHOR100]
 	cmp	w3, w1
 	mov	x3, x2
-	bcs	.L1214
+	bcs	.L1231
 	adrp	x1, .LANCHOR53
 	mov	w4, 65535
 	ldrh	w1, [x1, #:lo12:.LANCHOR53]
 	cmp	w1, w4
-	bne	.L1215
+	bne	.L1232
 	adrp	x4, .LANCHOR72
 	ldrh	w4, [x4, #:lo12:.LANCHOR72]
 	cmp	w4, w1
-	bne	.L1215
+	bne	.L1232
 	adrp	x0, .LANCHOR172
 	ldrh	w0, [x0, #:lo12:.LANCHOR172]
-	cbnz	w0, .L1216
+	cbnz	w0, .L1233
 	adrp	x1, .LANCHOR152
 	adrp	x4, .LANCHOR59
 	ldr	w1, [x1, #:lo12:.LANCHOR152]
 	ldr	w4, [x4, #:lo12:.LANCHOR59]
 	add	w1, w1, w1, lsl 1
 	cmp	w4, w1, lsr 2
-	bcs	.L1217
-.L1216:
+	bcs	.L1234
+.L1233:
 	adrp	x1, .LANCHOR171
 	ldrh	w1, [x1, #:lo12:.LANCHOR171]
 	add	w1, w1, w1, lsl 1
 	asr	w1, w1, 2
 	strh	w1, [x3, #:lo12:.LANCHOR100]
-.L1218:
+.L1235:
 	adrp	x1, .LANCHOR95
 	str	wzr, [x1, #:lo12:.LANCHOR95]
-.L1206:
+.L1223:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
@@ -8950,79 +8925,79 @@ rk_ftl_garbage_collect:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 176
 	ret
-.L1211:
+.L1228:
 	cmp	w1, 12
-	bls	.L1212
+	bls	.L1229
 	lsr	w20, w20, 4
-	b	.L1210
-.L1212:
+	b	.L1227
+.L1229:
 	cmp	w1, 8
-	bls	.L1210
+	bls	.L1227
 	lsr	w20, w20, 2
-	b	.L1210
-.L1260:
+	b	.L1227
+.L1282:
 	mov	w20, 1
-	b	.L1210
-.L1217:
+	b	.L1227
+.L1234:
 	mov	w1, 18
 	strh	w1, [x2, #:lo12:.LANCHOR100]
-	b	.L1218
-.L1215:
+	b	.L1235
+.L1232:
 	adrp	x1, .LANCHOR171
 	ldrh	w1, [x1, #:lo12:.LANCHOR171]
 	add	w1, w1, w1, lsl 1
 	asr	w1, w1, 2
 	strh	w1, [x3, #:lo12:.LANCHOR100]
-.L1214:
+.L1231:
 	adrp	x1, .LANCHOR74
 	ldrh	w1, [x1, #:lo12:.LANCHOR74]
-	cbz	w1, .L1209
+	cbz	w1, .L1226
 	add	w20, w20, 32
 	and	w20, w20, 65535
-.L1209:
-	adrp	x19, .LANCHOR144
+.L1226:
+	adrp	x19, .LANCHOR145
 	str	w0, [x29, 152]
 	mov	w0, 65535
-	ldrh	w2, [x19, #:lo12:.LANCHOR144]
+	ldrh	w2, [x19, #:lo12:.LANCHOR145]
 	cmp	w2, w0
-	bne	.L1221
+	bne	.L1238
 	adrp	x0, .LANCHOR72
 	ldrh	w1, [x0, #:lo12:.LANCHOR72]
 	cmp	w1, w2
-	beq	.L1222
+	beq	.L1239
 	adrp	x2, .LANCHOR42
 	ubfiz	x1, x1, 1, 16
 	ldr	x2, [x2, #:lo12:.LANCHOR42]
 	ldrh	w1, [x2, x1]
-	cbnz	w1, .L1223
+	cbnz	w1, .L1240
 	mov	w1, -1
 	strh	w1, [x0, #:lo12:.LANCHOR72]
-.L1223:
+.L1240:
 	ldrh	w1, [x0, #:lo12:.LANCHOR72]
-	strh	w1, [x19, #:lo12:.LANCHOR144]
+	strh	w1, [x19, #:lo12:.LANCHOR145]
 	mov	w1, -1
 	strh	w1, [x0, #:lo12:.LANCHOR72]
-.L1222:
-	add	x0, x19, :lo12:.LANCHOR144
+.L1239:
+	add	x0, x19, :lo12:.LANCHOR145
 	mov	w1, 65535
 	strb	wzr, [x0, 8]
-	ldrh	w0, [x19, #:lo12:.LANCHOR144]
+	ldrh	w0, [x19, #:lo12:.LANCHOR145]
 	cmp	w0, w1
-	beq	.L1221
+	beq	.L1238
 	bl	IsBlkInGcList
-	cbz	w0, .L1225
+	cbz	w0, .L1242
 	mov	w0, -1
-	strh	w0, [x19, #:lo12:.LANCHOR144]
-.L1225:
-	ldrh	w1, [x19, #:lo12:.LANCHOR144]
+	strh	w0, [x19, #:lo12:.LANCHOR145]
+.L1242:
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
 	mov	w0, 65535
-	add	x22, x19, :lo12:.LANCHOR144
+	add	x22, x19, :lo12:.LANCHOR145
 	cmp	w1, w0
-	beq	.L1221
+	beq	.L1238
 	mov	x0, x22
 	bl	make_superblock
 	adrp	x0, .LANCHOR173
-	ldrh	w1, [x19, #:lo12:.LANCHOR144]
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
 	strh	wzr, [x22, 2]
 	strh	wzr, [x0, #:lo12:.LANCHOR173]
 	adrp	x0, .LANCHOR42
@@ -9031,56 +9006,60 @@ rk_ftl_garbage_collect:
 	ldrh	w1, [x0, x1, lsl 1]
 	adrp	x0, .LANCHOR174
 	strh	w1, [x0, #:lo12:.LANCHOR174]
-.L1221:
+.L1238:
 	adrp	x1, .LANCHOR51
-	ldrh	w0, [x19, #:lo12:.LANCHOR144]
+	ldrh	w0, [x19, #:lo12:.LANCHOR145]
 	str	x1, [x29, 128]
 	ldrh	w2, [x1, #:lo12:.LANCHOR51]
 	cmp	w2, w0
-	beq	.L1226
+	beq	.L1243
 	adrp	x1, .LANCHOR52
 	ldrh	w1, [x1, #:lo12:.LANCHOR52]
 	cmp	w1, w0
-	bne	.L1227
-.L1226:
+	beq	.L1243
+	adrp	x1, .LANCHOR53
+	ldrh	w1, [x1, #:lo12:.LANCHOR53]
+	cmp	w1, w0
+	bne	.L1244
+.L1243:
 	mov	w0, -1
-	strh	w0, [x19, #:lo12:.LANCHOR144]
-.L1227:
+	strh	w0, [x19, #:lo12:.LANCHOR145]
+.L1244:
 	adrp	x25, .LANCHOR102
 	add	x26, x25, :lo12:.LANCHOR102
-.L1256:
-	ldrh	w1, [x19, #:lo12:.LANCHOR144]
+.L1278:
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
 	mov	w0, 65535
 	cmp	w1, w0
-	bne	.L1228
+	bne	.L1245
 	adrp	x0, .LANCHOR95
 	adrp	x22, .LANCHOR19
 	add	x22, x22, :lo12:.LANCHOR19
 	str	wzr, [x0, #:lo12:.LANCHOR95]
-.L1229:
+.L1246:
 	ldrh	w5, [x25, #:lo12:.LANCHOR102]
 	add	x7, x25, :lo12:.LANCHOR102
 	mov	w0, w5
 	bl	List_get_gc_head_node
 	and	w6, w0, 65535
-	strh	w6, [x19, #:lo12:.LANCHOR144]
+	strh	w6, [x19, #:lo12:.LANCHOR145]
 	mov	w0, 65535
 	cmp	w6, w0
-	bne	.L1230
+	bne	.L1247
 	strh	wzr, [x7]
 	mov	w0, 8
-	b	.L1206
-.L1259:
+	b	.L1223
+.L1281:
 	mov	w20, 1
-	b	.L1209
-.L1230:
+	b	.L1226
+.L1247:
 	mov	w0, w6
 	bl	IsBlkInGcList
 	add	w5, w5, 1
-	cbz	w0, .L1231
+	cbz	w0, .L1248
 	strh	w5, [x25, #:lo12:.LANCHOR102]
-	b	.L1229
-.L1231:
+	b	.L1246
+.L1248:
 	adrp	x23, .LANCHOR42
 	adrp	x4, .LANCHOR3
 	ldrh	w0, [x22]
@@ -9092,82 +9071,82 @@ rk_ftl_garbage_collect:
 	ldrh	w3, [x2, x1]
 	mul	w0, w0, w4
 	cmp	w3, w0, asr 1
-	bgt	.L1233
+	bgt	.L1250
 	cmp	w5, 48
-	bls	.L1234
+	bls	.L1251
 	cmp	w3, 8
-	bls	.L1234
+	bls	.L1251
 	adrp	x3, .LANCHOR68
 	ldrh	w3, [x3, #:lo12:.LANCHOR68]
 	cmp	w3, 35
-	bhi	.L1234
-.L1233:
+	bhi	.L1251
+.L1250:
 	strh	wzr, [x26]
-.L1234:
+.L1251:
 	ldrh	w1, [x2, x1]
 	cmp	w0, w1
-	bgt	.L1235
+	bgt	.L1252
 	ldrh	w0, [x26]
 	cmp	w0, 3
-	bhi	.L1235
+	bhi	.L1252
 	mov	w0, -1
 	strh	wzr, [x26]
-	strh	w0, [x19, #:lo12:.LANCHOR144]
-.L1286:
+	strh	w0, [x19, #:lo12:.LANCHOR145]
+.L1311:
 	adrp	x0, .LANCHOR172
 	ldrh	w0, [x0, #:lo12:.LANCHOR172]
-	b	.L1206
-.L1235:
-	cbnz	w1, .L1236
+	b	.L1223
+.L1252:
+	cbnz	w1, .L1253
 	mov	w0, -1
 	bl	decrement_vpc_count
 	ldrh	w0, [x26]
 	add	w0, w0, 1
 	strh	w0, [x26]
-	b	.L1229
-.L1236:
-	add	x0, x19, :lo12:.LANCHOR144
+	b	.L1246
+.L1253:
+	add	x0, x19, :lo12:.LANCHOR145
 	strb	wzr, [x0, 8]
 	ldr	x0, [x29, 128]
 	ldrh	w0, [x0, #:lo12:.LANCHOR51]
 	cmp	w0, w6
-	bne	.L1237
+	bne	.L1254
 	adrp	x1, .LANCHOR175
 	adrp	x0, .LC1
-	mov	w2, 700
+	mov	w2, 717
 	add	x1, x1, :lo12:.LANCHOR175
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1237:
+.L1254:
 	adrp	x0, .LANCHOR52
-	ldrh	w1, [x19, #:lo12:.LANCHOR144]
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
 	ldrh	w0, [x0, #:lo12:.LANCHOR52]
 	cmp	w1, w0
-	bne	.L1238
+	bne	.L1255
 	adrp	x1, .LANCHOR175
 	adrp	x0, .LC1
-	mov	w2, 701
+	mov	w2, 718
 	add	x1, x1, :lo12:.LANCHOR175
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1238:
+.L1255:
 	adrp	x0, .LANCHOR53
-	ldrh	w1, [x19, #:lo12:.LANCHOR144]
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
 	ldrh	w0, [x0, #:lo12:.LANCHOR53]
 	cmp	w1, w0
-	bne	.L1239
+	bne	.L1256
 	adrp	x1, .LANCHOR175
 	adrp	x0, .LC1
-	mov	w2, 702
+	mov	w2, 719
 	add	x1, x1, :lo12:.LANCHOR175
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1239:
-	add	x22, x19, :lo12:.LANCHOR144
+.L1256:
+	add	x22, x19, :lo12:.LANCHOR145
 	mov	x0, x22
 	bl	make_superblock
 	adrp	x0, .LANCHOR173
-	ldrh	w1, [x19, #:lo12:.LANCHOR144]
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
 	strh	wzr, [x0, #:lo12:.LANCHOR173]
 	ldr	x0, [x23, #:lo12:.LANCHOR42]
 	ldrh	w1, [x0, x1, lsl 1]
@@ -9175,7 +9154,7 @@ rk_ftl_garbage_collect:
 	strh	wzr, [x22, 2]
 	strh	w1, [x0, #:lo12:.LANCHOR174]
 	strb	wzr, [x22, 6]
-.L1228:
+.L1245:
 	mov	w0, 1
 	str	w0, [x21, #:lo12:.LANCHOR94]
 	adrp	x0, .LANCHOR19
@@ -9183,9 +9162,9 @@ rk_ftl_garbage_collect:
 	ldrh	w1, [x0, #:lo12:.LANCHOR19]
 	ldr	w0, [x29, 152]
 	str	w1, [x29, 156]
-	cbz	w0, .L1240
+	cbz	w0, .L1257
 	adrp	x0, .LANCHOR3
-	ldrh	w2, [x19, #:lo12:.LANCHOR144]
+	ldrh	w2, [x19, #:lo12:.LANCHOR145]
 	ldrh	w0, [x0, #:lo12:.LANCHOR3]
 	mul	w0, w0, w1
 	adrp	x1, .LANCHOR42
@@ -9196,24 +9175,24 @@ rk_ftl_garbage_collect:
 	sdiv	w0, w0, w1
 	add	w20, w20, w0
 	and	w20, w20, 65535
-.L1240:
-	add	x0, x19, :lo12:.LANCHOR144
+.L1257:
+	add	x0, x19, :lo12:.LANCHOR145
 	ldr	w2, [x29, 156]
 	ldrh	w0, [x0, 2]
 	add	w1, w0, w20
 	cmp	w1, w2
-	ble	.L1241
+	ble	.L1258
 	sub	w20, w2, w0
 	and	w20, w20, 65535
-.L1241:
+.L1258:
 	adrp	x0, .LANCHOR173
 	mov	w28, 0
 	add	x0, x0, :lo12:.LANCHOR173
 	str	x0, [x29, 144]
-.L1242:
+.L1259:
 	cmp	w20, w28, uxth
-	bls	.L1250
-	add	x1, x19, :lo12:.LANCHOR144
+	bls	.L1267
+	add	x1, x19, :lo12:.LANCHOR145
 	adrp	x0, .LANCHOR3
 	adrp	x23, .LANCHOR66
 	add	x1, x1, 16
@@ -9224,25 +9203,25 @@ rk_ftl_garbage_collect:
 	ldr	x0, [x23, #:lo12:.LANCHOR66]
 	mov	w6, 65535
 	add	w4, w4, w28
-	b	.L1251
-.L1244:
+	b	.L1268
+.L1261:
 	ldrh	w3, [x1]
 	cmp	w3, w6
-	beq	.L1243
+	beq	.L1260
 	ubfiz	x5, x22, 5, 16
 	add	w22, w22, 1
 	add	x5, x0, x5
 	and	w22, w22, 65535
 	orr	w3, w4, w3, lsl 10
 	str	w3, [x5, 4]
-.L1243:
+.L1260:
 	add	w2, w2, 1
 	add	x1, x1, 2
 	and	w2, w2, 65535
-.L1251:
+.L1268:
 	cmp	w2, w7
-	bne	.L1244
-	add	x1, x19, :lo12:.LANCHOR144
+	bne	.L1261
+	add	x1, x19, :lo12:.LANCHOR145
 	adrp	x24, .LANCHOR62
 	add	x24, x24, :lo12:.LANCHOR62
 	ldrb	w2, [x1, 8]
@@ -9251,45 +9230,45 @@ rk_ftl_garbage_collect:
 	ubfiz	x0, x22, 5, 16
 	mov	x22, 0
 	str	x0, [x29, 136]
-.L1245:
+.L1262:
 	ldr	x0, [x29, 136]
 	cmp	x22, x0
-	bne	.L1249
+	bne	.L1266
 	add	w28, w28, 1
-	b	.L1242
-.L1249:
+	b	.L1259
+.L1266:
 	ldr	x0, [x23, #:lo12:.LANCHOR66]
 	add	x1, x0, x22
 	ldr	w0, [x0, x22]
 	cmn	w0, #1
-	beq	.L1246
+	beq	.L1263
 	ldr	x27, [x1, 16]
 	mov	w0, 61589
 	ldrh	w1, [x27]
 	cmp	w1, w0
-	bne	.L1246
+	bne	.L1263
 	ldr	w4, [x27, 8]
 	cmn	w4, #1
-	bne	.L1247
+	bne	.L1264
 	str	w4, [x29, 112]
-	mov	w2, 736
+	mov	w2, 753
 	adrp	x1, .LANCHOR175
 	adrp	x0, .LC1
 	add	x1, x1, :lo12:.LANCHOR175
 	add	x0, x0, :lo12:.LC1
 	bl	printf
 	ldr	w4, [x29, 112]
-.L1247:
+.L1264:
 	mov	w2, 0
-	add	x1, x29, 172
+	add	x1, x29, 168
 	mov	w0, w4
 	bl	log2phys
 	ldr	x0, [x23, #:lo12:.LANCHOR66]
-	ldr	w1, [x29, 172]
+	ldr	w1, [x29, 168]
 	add	x0, x0, x22
 	ldr	w2, [x0, 4]
 	cmp	w2, w1
-	bne	.L1246
+	bne	.L1263
 	ldr	x1, [x29, 144]
 	adrp	x4, .LANCHOR104
 	ldr	x2, [x29, 144]
@@ -9316,7 +9295,7 @@ rk_ftl_garbage_collect:
 	str	x4, [x2, 8]
 	ldr	x4, [x0, 16]
 	str	x4, [x2, 16]
-	ldr	w2, [x29, 172]
+	ldr	w2, [x29, 168]
 	str	w2, [x27, 12]
 	adrp	x2, .LANCHOR53
 	add	x11, x2, :lo12:.LANCHOR53
@@ -9331,65 +9310,111 @@ rk_ftl_garbage_collect:
 	ldrb	w1, [x11, 7]
 	ldr	w0, [x24]
 	cmp	w1, w0
-	beq	.L1248
+	beq	.L1265
 	ldrh	w0, [x11, 4]
-	cbnz	w0, .L1246
-.L1248:
+	cbnz	w0, .L1263
+.L1265:
 	bl	Ftl_gc_temp_data_write_back
-	cbz	w0, .L1246
-.L1287:
+	cbz	w0, .L1263
+	add	x0, x19, :lo12:.LANCHOR145
+	mov	w1, -1
 	str	wzr, [x21, #:lo12:.LANCHOR94]
-	b	.L1286
-.L1246:
+	strh	w1, [x19, #:lo12:.LANCHOR145]
+	strh	wzr, [x0, 2]
+	b	.L1311
+.L1263:
 	add	x22, x22, 32
-	b	.L1245
-.L1250:
-	add	x1, x19, :lo12:.LANCHOR144
+	b	.L1262
+.L1267:
+	add	x1, x19, :lo12:.LANCHOR145
 	ldrh	w0, [x1, 2]
 	add	w20, w20, w0
 	ldr	w0, [x29, 156]
 	and	w20, w20, 65535
 	strh	w20, [x1, 2]
 	cmp	w0, w20
-	bhi	.L1252
+	bhi	.L1269
 	adrp	x0, .LANCHOR62
 	ldr	w0, [x0, #:lo12:.LANCHOR62]
-	cbz	w0, .L1253
+	cbz	w0, .L1270
 	bl	Ftl_gc_temp_data_write_back
-	cbnz	w0, .L1287
-.L1253:
+	cbz	w0, .L1270
+	str	wzr, [x21, #:lo12:.LANCHOR94]
+	b	.L1311
+.L1270:
 	adrp	x0, .LANCHOR173
 	ldrh	w0, [x0, #:lo12:.LANCHOR173]
-	cbnz	w0, .L1254
-	ldrh	w0, [x19, #:lo12:.LANCHOR144]
-	adrp	x1, .LANCHOR42
-	ldr	x1, [x1, #:lo12:.LANCHOR42]
-	lsl	x0, x0, 1
-	ldrh	w2, [x1, x0]
-	cbz	w2, .L1254
-	strh	wzr, [x1, x0]
-	ldrh	w0, [x19, #:lo12:.LANCHOR144]
+	cbnz	w0, .L1271
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
+	adrp	x20, .LANCHOR42
+	add	x0, x19, :lo12:.LANCHOR145
+	ldr	x3, [x20, #:lo12:.LANCHOR42]
+	ubfiz	x2, x1, 1, 16
+	ldrh	w4, [x3, x2]
+	cbz	w4, .L1271
+	adrp	x2, .LANCHOR174
+	adrp	x22, .LANCHOR152
+	add	x23, x22, :lo12:.LANCHOR152
+	mov	w24, 0
+	ldrh	w5, [x2, #:lo12:.LANCHOR174]
+	mov	w3, 0
+	ldrh	w2, [x0, 2]
+	adrp	x0, .LC42
+	add	x0, x0, :lo12:.LC42
+	bl	printf
+.L1272:
+	ldr	w0, [x23]
+	cmp	w24, w0
+	bcs	.L1274
+	mov	w2, 0
+	add	x1, x29, 172
+	mov	w0, w24
+	bl	log2phys
+	ldr	w3, [x29, 172]
+	cmn	w3, #1
+	beq	.L1273
+	lsr	w0, w3, 10
+	bl	P2V_block_in_plane
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
+	cmp	w1, w0, uxth
+	bne	.L1273
+	adrp	x0, .LC43
+	mov	w2, w3
+	mov	w1, w24
+	add	x0, x0, :lo12:.LC43
+	bl	printf
+.L1274:
+	ldr	w0, [x22, #:lo12:.LANCHOR152]
+	cmp	w24, w0
+	bcc	.L1271
+	ldrh	w1, [x19, #:lo12:.LANCHOR145]
+	ldr	x0, [x20, #:lo12:.LANCHOR42]
+	strh	wzr, [x0, x1, lsl 1]
+	ldrh	w0, [x19, #:lo12:.LANCHOR145]
 	bl	update_vpc_list
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-.L1254:
+.L1271:
 	mov	w0, -1
-	strh	w0, [x19, #:lo12:.LANCHOR144]
-.L1252:
+	strh	w0, [x19, #:lo12:.LANCHOR145]
+.L1269:
 	adrp	x0, .LANCHOR48
 	str	wzr, [x21, #:lo12:.LANCHOR94]
 	ldrh	w0, [x0, #:lo12:.LANCHOR48]
 	cmp	w0, 2
-	bhi	.L1255
+	bhi	.L1277
 	ldr	x0, [x29, 120]
 	ldrh	w20, [x0, #:lo12:.LANCHOR19]
-	b	.L1256
-.L1255:
+	b	.L1278
+.L1273:
+	add	w24, w24, 1
+	b	.L1272
+.L1277:
 	add	w0, w0, 1
-	b	.L1206
-.L1258:
+	b	.L1223
+.L1280:
 	mov	w0, 0
-	b	.L1206
+	b	.L1223
 	.size	rk_ftl_garbage_collect, .-rk_ftl_garbage_collect
 	.section	.text.FtlRead,"ax",@progbits
 	.align	2
@@ -9408,13 +9433,13 @@ FtlRead:
 	mov	w26, w2
 	stp	x21, x22, [sp, 32]
 	stp	x27, x28, [sp, 80]
-	bne	.L1289
+	bne	.L1313
 	mov	x2, x3
 	mov	w1, w26
 	add	w0, w19, 256
 	bl	FtlVendorPartRead
 	mov	w21, w0
-.L1288:
+.L1312:
 	mov	w0, w21
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -9423,18 +9448,18 @@ FtlRead:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 176
 	ret
-.L1289:
+.L1313:
 	add	w0, w1, w2
 	str	w0, [x29, 136]
 	adrp	x0, .LANCHOR34
 	add	w1, w1, w2
 	ldr	w0, [x0, #:lo12:.LANCHOR34]
 	cmp	w1, w0
-	bhi	.L1310
+	bhi	.L1334
 	adrp	x0, .LANCHOR166
 	ldr	w21, [x0, #:lo12:.LANCHOR166]
 	cmn	w21, #1
-	beq	.L1288
+	beq	.L1312
 	adrp	x22, .LANCHOR12
 	adrp	x25, .LANCHOR135
 	add	x25, x25, :lo12:.LANCHOR135
@@ -9462,47 +9487,47 @@ FtlRead:
 	ldr	w0, [x1, #:lo12:.LANCHOR89]
 	add	w0, w0, w2
 	str	w0, [x1, #:lo12:.LANCHOR89]
-.L1291:
+.L1315:
 	ldr	w0, [x29, 156]
-	cbnz	w0, .L1308
+	cbnz	w0, .L1332
 	adrp	x0, .LANCHOR74
 	ldrh	w0, [x0, #:lo12:.LANCHOR74]
-	cbnz	w0, .L1309
+	cbnz	w0, .L1333
 	adrp	x0, .LANCHOR48
 	ldrh	w0, [x0, #:lo12:.LANCHOR48]
 	cmp	w0, 31
-	bhi	.L1288
-.L1309:
+	bhi	.L1312
+.L1333:
 	mov	w1, 1
 	mov	w0, 0
 	bl	rk_ftl_garbage_collect
-	b	.L1288
-.L1308:
+	b	.L1312
+.L1332:
 	add	x1, x29, 172
 	mov	w2, 0
 	mov	w0, w20
 	bl	log2phys
 	ldr	w1, [x29, 172]
 	cmn	w1, #1
-	bne	.L1292
+	bne	.L1316
 	add	x5, x22, :lo12:.LANCHOR12
 	mov	w4, 0
-.L1293:
+.L1317:
 	ldrh	w0, [x5]
 	cmp	w4, w0
-	bcc	.L1295
-.L1296:
+	bcc	.L1319
+.L1320:
 	ldr	w0, [x29, 156]
 	add	w20, w20, 1
 	subs	w0, w0, #1
 	str	w0, [x29, 156]
-	beq	.L1300
+	beq	.L1324
 	adrp	x0, .LANCHOR3
 	ldrh	w0, [x0, #:lo12:.LANCHOR3]
 	cmp	w27, w0, lsl 2
-	bne	.L1291
-.L1300:
-	cbz	w27, .L1291
+	bne	.L1315
+.L1324:
+	cbz	w27, .L1315
 	ldr	x0, [x28, #:lo12:.LANCHOR103]
 	mov	w1, w27
 	mov	w2, 0
@@ -9521,57 +9546,57 @@ FtlRead:
 	str	x0, [x29, 104]
 	add	x0, x22, :lo12:.LANCHOR12
 	str	x0, [x29, 96]
-.L1307:
+.L1331:
 	ldr	x0, [x28, #:lo12:.LANCHOR103]
 	ldr	w2, [x29, 152]
 	add	x0, x0, x27
 	ldr	w1, [x0, 24]
 	cmp	w2, w1
-	bne	.L1302
+	bne	.L1326
 	ldr	x1, [x0, 8]
 	adrp	x0, .LANCHOR109
 	ldr	x0, [x0, #:lo12:.LANCHOR109]
 	cmp	x1, x0
-	bne	.L1303
+	bne	.L1327
 	ldr	x0, [x29, 128]
 	ldr	w2, [x29, 120]
 	add	x1, x1, x0
 	mov	x0, x23
-.L1321:
+.L1345:
 	bl	ftl_memcpy
-.L1303:
+.L1327:
 	ldr	x0, [x28, #:lo12:.LANCHOR103]
 	add	x0, x0, x27
 	ldr	x1, [x0, 16]
 	ldr	w2, [x0, 24]
 	ldr	w1, [x1, 8]
 	cmp	w2, w1
-	beq	.L1304
+	beq	.L1328
 	ldr	w1, [x25, 72]
 	add	w1, w1, 1
 	str	w1, [x25, 72]
-.L1304:
+.L1328:
 	ldr	w1, [x0]
 	cmn	w1, #1
-	bne	.L1305
+	bne	.L1329
 	ldr	w0, [x25, 72]
 	mov	w21, w1
 	add	w0, w0, 1
 	str	w0, [x25, 72]
-.L1306:
+.L1330:
 	ldr	x0, [x29, 104]
 	add	x27, x27, 32
 	cmp	x0, x27
-	bne	.L1307
+	bne	.L1331
 	mov	w27, 0
-	b	.L1291
-.L1295:
+	b	.L1315
+.L1319:
 	madd	w0, w20, w0, w4
 	cmp	w19, w0
-	bhi	.L1294
+	bhi	.L1318
 	ldr	w1, [x29, 136]
 	cmp	w1, w0
-	bls	.L1294
+	bls	.L1318
 	sub	w0, w0, w19
 	str	x5, [x29, 120]
 	lsl	w0, w0, 9
@@ -9582,17 +9607,17 @@ FtlRead:
 	bl	ftl_memset
 	ldr	w4, [x29, 128]
 	ldr	x5, [x29, 120]
-.L1294:
+.L1318:
 	add	w4, w4, 1
-	b	.L1293
-.L1292:
+	b	.L1317
+.L1316:
 	ldr	x2, [x28, #:lo12:.LANCHOR103]
 	ubfiz	x0, x27, 5, 32
 	add	x0, x2, x0
 	str	w1, [x0, 4]
 	ldr	w1, [x29, 152]
 	cmp	w20, w1
-	bne	.L1297
+	bne	.L1321
 	adrp	x1, .LANCHOR109
 	ldr	x1, [x1, #:lo12:.LANCHOR109]
 	str	x1, [x0, 8]
@@ -9605,9 +9630,9 @@ FtlRead:
 	csel	w2, w26, w2, ls
 	str	w2, [x29, 144]
 	cmp	w1, w2
-	bne	.L1298
+	bne	.L1322
 	str	x23, [x0, 8]
-.L1298:
+.L1322:
 	adrp	x1, .LANCHOR24
 	adrp	x2, .LANCHOR115
 	str	w20, [x0, 24]
@@ -9618,10 +9643,10 @@ FtlRead:
 	and	x1, x1, 4294967292
 	add	x1, x2, x1
 	str	x1, [x0, 16]
-	b	.L1296
-.L1297:
+	b	.L1320
+.L1321:
 	cmp	w20, w24
-	bne	.L1299
+	bne	.L1323
 	ldrh	w2, [x22, #:lo12:.LANCHOR12]
 	adrp	x1, .LANCHOR110
 	ldr	w3, [x29, 136]
@@ -9631,25 +9656,25 @@ FtlRead:
 	sub	w3, w3, w1
 	str	w3, [x29, 140]
 	cmp	w2, w3
-	bne	.L1298
-.L1320:
+	bne	.L1322
+.L1344:
 	sub	w1, w1, w19
 	lsl	w1, w1, 9
 	add	x1, x23, x1
 	str	x1, [x0, 8]
-	b	.L1298
-.L1299:
+	b	.L1322
+.L1323:
 	ldrh	w1, [x22, #:lo12:.LANCHOR12]
 	mul	w1, w1, w20
-	b	.L1320
-.L1302:
+	b	.L1344
+.L1326:
 	cmp	w24, w1
-	bne	.L1303
+	bne	.L1327
 	ldr	x1, [x0, 8]
 	adrp	x0, .LANCHOR110
 	ldr	x0, [x0, #:lo12:.LANCHOR110]
 	cmp	x1, x0
-	bne	.L1303
+	bne	.L1327
 	ldr	x0, [x29, 96]
 	ldr	w2, [x29, 116]
 	ldrh	w0, [x0]
@@ -9657,18 +9682,18 @@ FtlRead:
 	sub	w0, w0, w19
 	lsl	w0, w0, 9
 	add	x0, x23, x0
-	b	.L1321
-.L1305:
+	b	.L1345
+.L1329:
 	cmp	w1, 256
-	bne	.L1306
+	bne	.L1330
 	ldr	w0, [x0, 4]
 	lsr	w0, w0, 10
 	bl	P2V_block_in_plane
 	bl	FtlGcRefreshBlock
-	b	.L1306
-.L1310:
+	b	.L1330
+.L1334:
 	mov	w21, -1
-	b	.L1288
+	b	.L1312
 	.size	FtlRead, .-FtlRead
 	.section	.text.sftl_read,"ax",@progbits
 	.align	2
@@ -9690,20 +9715,20 @@ FtlWrite:
 	and	w0, w0, 255
 	cmp	w0, 16
 	add	x29, sp, 0
-	stp	x21, x22, [sp, 32]
-	mov	w21, w1
+	stp	x23, x24, [sp, 48]
+	mov	w23, w1
 	stp	x25, x26, [sp, 64]
 	mov	x26, x3
 	stp	x19, x20, [sp, 16]
-	stp	x23, x24, [sp, 48]
+	stp	x21, x22, [sp, 32]
 	stp	x27, x28, [sp, 80]
-	str	w2, [x29, 164]
-	bne	.L1324
+	str	w2, [x29, 172]
+	bne	.L1348
 	add	w0, w1, 256
-	ldr	w1, [x29, 164]
+	ldr	w1, [x29, 172]
 	mov	x2, x3
 	bl	FtlVendorPartWrite
-.L1323:
+.L1347:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
@@ -9711,46 +9736,47 @@ FtlWrite:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 224
 	ret
-.L1324:
-	ldr	w0, [x29, 164]
+.L1348:
+	ldr	w0, [x29, 172]
 	add	w0, w1, w0
 	str	w0, [x29, 152]
 	adrp	x0, .LANCHOR34
 	ldr	w1, [x29, 152]
 	ldr	w0, [x0, #:lo12:.LANCHOR34]
 	cmp	w1, w0
-	bhi	.L1356
+	bhi	.L1380
 	adrp	x0, .LANCHOR166
 	ldr	w0, [x0, #:lo12:.LANCHOR166]
 	cmn	w0, #1
-	beq	.L1323
+	beq	.L1347
 	adrp	x0, .LANCHOR176
 	mov	w1, 2048
-	adrp	x22, .LANCHOR12
-	ldr	w2, [x29, 164]
+	ldr	w2, [x29, 152]
 	str	w1, [x0, #:lo12:.LANCHOR176]
-	ldr	w1, [x29, 152]
-	ldrh	w0, [x22, #:lo12:.LANCHOR12]
-	sub	w1, w1, #1
-	udiv	w25, w21, w0
-	udiv	w0, w1, w0
-	adrp	x1, .LANCHOR162
+	adrp	x1, .LANCHOR12
+	sub	w2, w2, #1
+	ldr	w3, [x29, 172]
+	ldrh	w0, [x1, #:lo12:.LANCHOR12]
+	str	x1, [x29, 160]
+	udiv	w25, w23, w0
+	udiv	w0, w2, w0
+	adrp	x2, .LANCHOR162
 	mov	w19, w25
 	str	w0, [x29, 144]
 	sub	w0, w0, w25
 	add	w24, w0, 1
 	str	w0, [x29, 140]
-	ldr	w0, [x1, #:lo12:.LANCHOR162]
-	add	w0, w0, w2
-	str	w0, [x1, #:lo12:.LANCHOR162]
-	adrp	x1, .LANCHOR85
-	ldr	w0, [x1, #:lo12:.LANCHOR85]
+	ldr	w0, [x2, #:lo12:.LANCHOR162]
+	add	w0, w0, w3
+	str	w0, [x2, #:lo12:.LANCHOR162]
+	adrp	x2, .LANCHOR85
+	ldr	w0, [x2, #:lo12:.LANCHOR85]
 	add	w0, w0, w24
-	str	w0, [x1, #:lo12:.LANCHOR85]
+	str	w0, [x2, #:lo12:.LANCHOR85]
 	adrp	x0, .LANCHOR51
 	add	x20, x0, :lo12:.LANCHOR51
-.L1326:
-	cbnz	w24, .L1351
+.L1350:
+	cbnz	w24, .L1375
 	ldr	w1, [x29, 140]
 	mov	w0, 0
 	bl	rk_ftl_garbage_collect
@@ -9758,11 +9784,11 @@ FtlWrite:
 	mov	x22, x0
 	ldrh	w1, [x0, #:lo12:.LANCHOR48]
 	cmp	w1, 5
-	bls	.L1352
-.L1354:
+	bls	.L1376
+.L1378:
 	mov	w0, 0
-	b	.L1323
-.L1351:
+	b	.L1347
+.L1375:
 	adrp	x0, .LANCHOR51
 	add	x0, x0, :lo12:.LANCHOR51
 	adrp	x1, .LANCHOR3
@@ -9770,19 +9796,19 @@ FtlWrite:
 	ldrb	w2, [x0, 6]
 	ldrh	w0, [x1, #:lo12:.LANCHOR3]
 	cmp	w2, w0
-	bcc	.L1327
+	bcc	.L1351
 	adrp	x1, .LANCHOR177
 	adrp	x0, .LC1
-	mov	w2, 1016
+	mov	w2, 1038
 	add	x1, x1, :lo12:.LANCHOR177
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1327:
+.L1351:
 	ldrh	w0, [x20, 4]
-	cbnz	w0, .L1328
+	cbnz	w0, .L1352
 	mov	x0, x20
 	bl	allocate_new_data_superblock
-.L1328:
+.L1352:
 	ldrb	w0, [x20, 7]
 	ldrh	w1, [x20, 4]
 	lsl	w0, w0, 2
@@ -9795,244 +9821,251 @@ FtlWrite:
 	ldr	x0, [x29, 112]
 	ldrh	w0, [x0, #:lo12:.LANCHOR3]
 	cmp	w1, w0
-	bcc	.L1329
+	bcc	.L1353
 	adrp	x1, .LANCHOR177
 	adrp	x0, .LC1
-	mov	w2, 1049
+	mov	w2, 1071
 	add	x1, x1, :lo12:.LANCHOR177
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1329:
+.L1353:
 	adrp	x0, .LANCHOR24
 	add	x0, x0, :lo12:.LANCHOR24
-	str	xzr, [x29, 168]
+	mov	x28, 0
 	str	x0, [x29, 104]
 	adrp	x0, .LANCHOR23
 	add	x0, x0, :lo12:.LANCHOR23
 	str	x0, [x29, 96]
-.L1330:
-	ldr	w1, [x29, 148]
+.L1354:
+	ldr	w0, [x29, 148]
+	mov	w22, w28
 	adrp	x27, .LANCHOR105
-	ldr	w23, [x29, 168]
-	cmp	w23, w1
-	bcc	.L1349
-	mov	x23, x1
-.L1331:
+	cmp	w28, w0
+	bcc	.L1373
+	mov	x22, x0
+.L1355:
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
 	mov	x3, x20
 	mov	w2, 0
-	mov	w1, w23
+	mov	w1, w22
 	bl	FtlProgPages
-	cmp	w24, w23
-	bcs	.L1350
+	cmp	w24, w22
+	bcs	.L1374
 	adrp	x1, .LANCHOR177
 	adrp	x0, .LC1
-	mov	w2, 1126
+	mov	w2, 1149
 	add	x1, x1, :lo12:.LANCHOR177
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1350:
-	sub	w24, w24, w23
-	b	.L1326
-.L1349:
+.L1374:
+	sub	w24, w24, w22
+	b	.L1350
+.L1373:
 	ldrh	w0, [x20, 4]
-	cbz	w0, .L1331
+	cbz	w0, .L1355
 	add	x1, x29, 188
 	mov	w2, 0
 	mov	w0, w19
 	bl	log2phys
 	mov	x0, x20
+	lsl	x21, x28, 5
 	bl	get_new_active_ppa
-	ldr	x1, [x29, 168]
-	lsl	x28, x1, 5
 	ldr	x1, [x27, #:lo12:.LANCHOR105]
-	add	x1, x1, x28
+	add	x1, x1, x21
 	str	w0, [x1, 4]
 	ldr	x0, [x29, 104]
 	str	w19, [x1, 24]
 	ldrh	w2, [x0]
-	mul	w23, w23, w2
-	and	x0, x23, 4294967292
+	mul	w22, w22, w2
+	and	x0, x22, 4294967292
 	str	x0, [x29, 128]
 	adrp	x0, .LANCHOR115
 	ldr	x3, [x29, 128]
 	ldr	x0, [x0, #:lo12:.LANCHOR115]
 	str	x0, [x29, 120]
-	add	x23, x0, x3
-	str	x23, [x1, 16]
-	mov	x0, x23
+	add	x22, x0, x3
+	str	x22, [x1, 16]
+	mov	x0, x22
 	mov	w1, 0
 	bl	ftl_memset
 	ldr	w0, [x29, 144]
 	cmp	w19, w25
 	ccmp	w19, w0, 4, ne
-	bne	.L1332
+	bne	.L1356
 	cmp	w19, w25
-	bne	.L1333
-	ldrh	w2, [x22, #:lo12:.LANCHOR12]
-	udiv	w0, w21, w2
-	msub	w0, w0, w2, w21
+	ldr	x0, [x29, 160]
+	bne	.L1357
+	ldrh	w2, [x0, #:lo12:.LANCHOR12]
+	udiv	w0, w23, w2
+	msub	w0, w0, w2, w23
 	str	w0, [x29, 156]
 	sub	w2, w2, w0
-	ldr	w0, [x29, 164]
+	ldr	w0, [x29, 172]
 	cmp	w2, w0
 	csel	w0, w2, w0, ls
-	str	w0, [x29, 160]
-.L1334:
-	ldrh	w0, [x22, #:lo12:.LANCHOR12]
-	ldr	w1, [x29, 160]
+	str	w0, [x29, 168]
+.L1358:
+	ldr	x0, [x29, 160]
+	ldr	w1, [x29, 168]
+	ldrh	w0, [x0, #:lo12:.LANCHOR12]
 	cmp	w1, w0
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
-	bne	.L1335
-	add	x3, x0, x28
+	bne	.L1359
+	add	x21, x0, x21
 	cmp	w19, w25
-	bne	.L1336
-	str	x26, [x3, 8]
-.L1337:
+	bne	.L1360
+	str	x26, [x21, 8]
+.L1361:
 	ldr	x0, [x29, 112]
 	ldrb	w1, [x20, 6]
 	ldrh	w0, [x0, #:lo12:.LANCHOR3]
 	cmp	w1, w0
-	bcc	.L1346
+	bcc	.L1370
 	adrp	x1, .LANCHOR177
 	adrp	x0, .LC1
-	mov	w2, 1117
+	mov	w2, 1140
 	add	x1, x1, :lo12:.LANCHOR177
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1346:
+.L1370:
 	ldp	x1, x2, [x29, 120]
 	mov	w0, -3947
+	add	x28, x28, 1
 	strh	w0, [x1, x2]
 	adrp	x1, .LANCHOR83
 	ldr	w0, [x1, #:lo12:.LANCHOR83]
-	stp	w0, w19, [x23, 4]
+	stp	w0, w19, [x22, 4]
 	add	w19, w19, 1
 	add	w0, w0, 1
 	cmn	w0, #1
 	csel	w0, w0, wzr, ne
 	str	w0, [x1, #:lo12:.LANCHOR83]
 	ldr	w0, [x29, 188]
-	str	w0, [x23, 12]
+	str	w0, [x22, 12]
 	ldrh	w0, [x20]
-	strh	w0, [x23, 2]
-	ldr	x0, [x29, 168]
-	add	x0, x0, 1
-	str	x0, [x29, 168]
-	b	.L1330
-.L1333:
+	strh	w0, [x22, 2]
+	b	.L1354
+.L1357:
+	ldrh	w2, [x0, #:lo12:.LANCHOR12]
 	ldr	w0, [x29, 152]
-	ldrh	w2, [x22, #:lo12:.LANCHOR12]
+	str	wzr, [x29, 156]
 	msub	w2, w19, w2, w0
 	and	w0, w2, 65535
-	stp	wzr, w0, [x29, 156]
-	b	.L1334
-.L1336:
-	ldr	w0, [x29, 160]
-.L1364:
+	str	w0, [x29, 168]
+	b	.L1358
+.L1360:
+	ldr	w0, [x29, 168]
+.L1388:
 	mul	w0, w0, w19
-	sub	w0, w0, w21
+	sub	w0, w0, w23
 	lsl	w0, w0, 9
 	add	x0, x26, x0
-	str	x0, [x3, 8]
-	b	.L1337
-.L1335:
-	add	x0, x0, x28
+	str	x0, [x21, 8]
+	b	.L1361
+.L1359:
+	add	x0, x0, x21
 	cmp	w19, w25
-	bne	.L1338
+	bne	.L1362
 	adrp	x1, .LANCHOR109
 	ldr	x1, [x1, #:lo12:.LANCHOR109]
-.L1363:
+.L1387:
 	str	x1, [x0, 8]
 	ldr	w0, [x29, 188]
 	cmn	w0, #1
-	beq	.L1340
+	beq	.L1364
 	str	w0, [x29, 196]
 	mov	w2, 0
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
 	str	w19, [x29, 216]
-	add	x0, x0, x28
+	add	x0, x0, x21
 	ldp	x1, x0, [x0, 8]
 	stp	x1, x0, [x29, 200]
 	mov	w1, 1
 	add	x0, x29, 192
 	bl	FlashReadPages
-	ldr	w0, [x29, 192]
-	cmn	w0, #1
-	bne	.L1341
+	ldr	w3, [x29, 192]
+	cmn	w3, #1
+	bne	.L1365
 	adrp	x0, .LANCHOR135
 	add	x0, x0, :lo12:.LANCHOR135
+	mov	w2, w19
 	ldr	w1, [x0, 72]
 	add	w1, w1, 1
 	str	w1, [x0, 72]
-.L1344:
-	ldr	w0, [x29, 160]
+	ldr	w1, [x22, 8]
+	adrp	x0, .LC44
+	add	x0, x0, :lo12:.LC44
+	bl	printf
+.L1368:
+	ldr	w0, [x29, 168]
 	cmp	w19, w25
 	lsl	w2, w0, 9
-	bne	.L1345
+	bne	.L1369
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
 	mov	x1, x26
-	add	x3, x0, x28
+	add	x21, x0, x21
 	ldr	w0, [x29, 156]
-	ldr	x3, [x3, 8]
+	ldr	x3, [x21, 8]
 	lsl	w0, w0, 9
 	add	x0, x3, x0
-.L1365:
+.L1389:
 	bl	ftl_memcpy
-	b	.L1337
-.L1338:
+	b	.L1361
+.L1362:
 	adrp	x1, .LANCHOR110
 	ldr	x1, [x1, #:lo12:.LANCHOR110]
-	b	.L1363
-.L1341:
-	ldr	w1, [x23, 8]
+	b	.L1387
+.L1365:
+	ldr	w1, [x22, 8]
 	cmp	w19, w1
-	beq	.L1343
+	beq	.L1367
 	adrp	x0, .LANCHOR135
 	add	x0, x0, :lo12:.LANCHOR135
 	ldr	w2, [x0, 72]
 	add	w2, w2, 1
 	str	w2, [x0, 72]
-	adrp	x0, .LC37
+	adrp	x0, .LC45
 	mov	w2, w19
-	add	x0, x0, :lo12:.LC37
+	add	x0, x0, :lo12:.LC45
 	bl	printf
-.L1343:
-	ldr	w0, [x23, 8]
+.L1367:
+	ldr	w0, [x22, 8]
 	cmp	w19, w0
-	beq	.L1344
-	mov	w2, 1102
+	beq	.L1368
+	mov	w2, 1125
 	adrp	x1, .LANCHOR177
 	adrp	x0, .LC1
 	add	x1, x1, :lo12:.LANCHOR177
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-	b	.L1344
-.L1340:
+	b	.L1368
+.L1364:
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
 	ldr	x1, [x29, 96]
-	add	x0, x0, x28
+	add	x0, x0, x21
 	ldrh	w2, [x1]
 	mov	w1, 0
 	ldr	x0, [x0, 8]
 	bl	ftl_memset
-	b	.L1344
-.L1345:
-	ldrh	w1, [x22, #:lo12:.LANCHOR12]
+	b	.L1368
+.L1369:
+	ldr	x0, [x29, 160]
+	ldrh	w1, [x0, #:lo12:.LANCHOR12]
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
-	add	x3, x0, x28
+	add	x21, x0, x21
 	mul	w1, w1, w19
-	sub	w1, w1, w21
-	ldr	x0, [x3, 8]
+	sub	w1, w1, w23
+	ldr	x0, [x21, 8]
 	lsl	w1, w1, 9
 	add	x1, x26, x1
-	b	.L1365
-.L1332:
+	b	.L1389
+.L1356:
 	ldr	x0, [x27, #:lo12:.LANCHOR105]
-	add	x3, x0, x28
-	ldrh	w0, [x22, #:lo12:.LANCHOR12]
-	b	.L1364
-.L1352:
+	add	x21, x0, x21
+	ldr	x0, [x29, 160]
+	ldrh	w0, [x0, #:lo12:.LANCHOR12]
+	b	.L1388
+.L1376:
 	adrp	x23, .LANCHOR72
 	adrp	x20, .LANCHOR101
 	adrp	x21, .LANCHOR100
@@ -10040,19 +10073,19 @@ FtlWrite:
 	add	x20, x20, :lo12:.LANCHOR101
 	add	x21, x21, :lo12:.LANCHOR100
 	mov	w19, 256
-.L1355:
-	adrp	x0, .LANCHOR144
+.L1379:
+	adrp	x0, .LANCHOR145
 	mov	w1, 65535
-	ldrh	w0, [x0, #:lo12:.LANCHOR144]
+	ldrh	w0, [x0, #:lo12:.LANCHOR145]
 	cmp	w0, w1
-	bne	.L1353
+	bne	.L1377
 	ldrh	w1, [x23]
 	cmp	w1, w0
-	bne	.L1353
+	bne	.L1377
 	mov	w0, 0
 	bl	List_get_gc_head_node
 	bl	FtlGcRefreshBlock
-.L1353:
+.L1377:
 	mov	w0, 128
 	mov	w1, 1
 	strh	w0, [x20]
@@ -10064,13 +10097,13 @@ FtlWrite:
 	bl	rk_ftl_garbage_collect
 	ldrh	w0, [x22, #:lo12:.LANCHOR48]
 	cmp	w0, 2
-	bhi	.L1354
+	bhi	.L1378
 	subs	w19, w19, #1
-	bne	.L1355
-	b	.L1354
-.L1356:
+	bne	.L1379
+	b	.L1378
+.L1380:
 	mov	w0, -1
-	b	.L1323
+	b	.L1347
 	.size	FtlWrite, .-FtlWrite
 	.section	.text.sftl_gc,"ax",@progbits
 	.align	2
@@ -10112,10 +10145,10 @@ FtlLoadSysInfo:
 	ldrh	w0, [x20, #:lo12:.LANCHOR139]
 	mov	w1, 65535
 	cmp	w0, w1
-	bne	.L1368
-.L1379:
+	bne	.L1392
+.L1403:
 	mov	w0, -1
-.L1367:
+.L1391:
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x23, x24, [sp, 48]
@@ -10123,7 +10156,7 @@ FtlLoadSysInfo:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 112
 	ret
-.L1368:
+.L1392:
 	add	x24, x20, :lo12:.LANCHOR139
 	mov	w1, 1
 	bl	FtlGetLastWrittenPage
@@ -10135,28 +10168,28 @@ FtlLoadSysInfo:
 	ldrsh	w24, [x20, #:lo12:.LANCHOR139]
 	add	x26, x26, :lo12:.LANCHOR23
 	add	x27, x27, :lo12:.LANCHOR178
-.L1370:
-	tbz	w28, #31, .L1376
+.L1394:
+	tbz	w28, #31, .L1400
 	adrp	x1, .LANCHOR178
 	adrp	x0, .LC1
 	mov	w2, 1465
 	add	x1, x1, :lo12:.LANCHOR178
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1375:
+.L1399:
 	adrp	x1, .LANCHOR23
 	ldrh	w0, [x21, #:lo12:.LANCHOR5]
 	ldrh	w1, [x1, #:lo12:.LANCHOR23]
 	add	x0, x0, 24
 	cmp	x1, x0, lsl 1
-	bcs	.L1378
+	bcs	.L1402
 	adrp	x1, .LANCHOR178
 	adrp	x0, .LC1
 	mov	w2, 1467
 	add	x1, x1, :lo12:.LANCHOR178
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1378:
+.L1402:
 	add	x24, x19, :lo12:.LANCHOR138
 	adrp	x19, .LANCHOR39
 	add	x22, x19, :lo12:.LANCHOR39
@@ -10185,7 +10218,7 @@ FtlLoadSysInfo:
 	mov	w0, 19539
 	movk	w0, 0x4654, lsl 16
 	cmp	w1, w0
-	bne	.L1379
+	bne	.L1403
 	add	x20, x20, :lo12:.LANCHOR139
 	adrp	x0, .LANCHOR10
 	ldrh	w1, [x22, 8]
@@ -10193,7 +10226,7 @@ FtlLoadSysInfo:
 	ldrh	w0, [x0, #:lo12:.LANCHOR10]
 	strh	w1, [x20, 6]
 	cmp	w2, w0
-	bne	.L1379
+	bne	.L1403
 	adrp	x0, .LANCHOR179
 	adrp	x2, .LANCHOR152
 	adrp	x3, .LANCHOR3
@@ -10218,18 +10251,18 @@ FtlLoadSysInfo:
 	udiv	w0, w0, w3
 	adrp	x3, .LANCHOR171
 	strh	w0, [x3, #:lo12:.LANCHOR171]
-	bls	.L1380
+	bls	.L1404
 	adrp	x1, .LANCHOR178
 	adrp	x0, .LC1
 	mov	w2, 1489
 	add	x1, x1, :lo12:.LANCHOR178
 	add	x0, x0, :lo12:.LC1
 	bl	printf
-.L1380:
+.L1404:
 	add	x4, x19, :lo12:.LANCHOR39
 	adrp	x0, .LANCHOR51
 	add	x2, x0, :lo12:.LANCHOR51
-	adrp	x5, .LANCHOR144
+	adrp	x5, .LANCHOR145
 	adrp	x20, .LANCHOR52
 	mov	x22, x5
 	ldrh	w1, [x4, 16]
@@ -10240,10 +10273,10 @@ FtlLoadSysInfo:
 	strb	w1, [x2, 6]
 	ldrb	w1, [x4, 11]
 	strb	w1, [x2, 8]
-	add	x1, x5, :lo12:.LANCHOR144
+	add	x1, x5, :lo12:.LANCHOR145
 	strh	w3, [x2, 2]
 	mov	w2, -1
-	strh	w2, [x5, #:lo12:.LANCHOR144]
+	strh	w2, [x5, #:lo12:.LANCHOR145]
 	add	x2, x20, :lo12:.LANCHOR52
 	strh	wzr, [x1, 2]
 	strb	wzr, [x1, 6]
@@ -10290,47 +10323,47 @@ FtlLoadSysInfo:
 	adrp	x1, .LANCHOR82
 	ldr	w4, [x1, #:lo12:.LANCHOR82]
 	cmp	w3, w4
-	bls	.L1381
+	bls	.L1405
 	str	w3, [x1, #:lo12:.LANCHOR82]
-.L1381:
+.L1405:
 	add	x19, x19, :lo12:.LANCHOR39
 	adrp	x1, .LANCHOR83
 	ldr	w3, [x1, #:lo12:.LANCHOR83]
 	ldr	w2, [x19, 36]
 	cmp	w2, w3
-	bls	.L1382
+	bls	.L1406
 	str	w2, [x1, #:lo12:.LANCHOR83]
-.L1382:
+.L1406:
 	mov	w1, 65535
 	cmp	w6, w1
-	beq	.L1383
+	beq	.L1407
 	add	x0, x0, :lo12:.LANCHOR51
 	bl	make_superblock
-.L1383:
+.L1407:
 	ldrh	w2, [x20, #:lo12:.LANCHOR52]
 	mov	w1, 65535
 	add	x0, x20, :lo12:.LANCHOR52
 	cmp	w2, w1
-	beq	.L1384
+	beq	.L1408
 	bl	make_superblock
-.L1384:
+.L1408:
 	ldrh	w2, [x21, #:lo12:.LANCHOR53]
 	mov	w1, 65535
 	add	x0, x21, :lo12:.LANCHOR53
 	cmp	w2, w1
-	beq	.L1385
+	beq	.L1409
 	bl	make_superblock
-.L1385:
-	ldrh	w2, [x22, #:lo12:.LANCHOR144]
+.L1409:
+	ldrh	w2, [x22, #:lo12:.LANCHOR145]
 	mov	w1, 65535
-	add	x0, x22, :lo12:.LANCHOR144
+	add	x0, x22, :lo12:.LANCHOR145
 	cmp	w2, w1
-	beq	.L1386
+	beq	.L1410
 	bl	make_superblock
-.L1386:
+.L1410:
 	mov	w0, 0
-	b	.L1367
-.L1376:
+	b	.L1391
+.L1400:
 	add	x3, x19, :lo12:.LANCHOR138
 	orr	w0, w28, w24, lsl 10
 	mov	w2, 1
@@ -10344,56 +10377,59 @@ FtlLoadSysInfo:
 	ldr	x3, [x29, 104]
 	ldr	x0, [x3, 16]
 	ldr	w8, [x0, 12]
-	cbz	w8, .L1371
+	cbz	w8, .L1395
+	ldr	w0, [x19, #:lo12:.LANCHOR138]
+	cmn	w0, #1
+	beq	.L1395
 	ldrh	w1, [x26]
 	ldr	x0, [x3, 8]
 	bl	js_hash
 	cmp	w8, w0
-	beq	.L1371
+	beq	.L1395
 	add	x10, x20, :lo12:.LANCHOR139
 	mov	w6, w0
 	mov	w5, w8
-	adrp	x0, .LC38
+	adrp	x0, .LC46
 	mov	w3, w28
 	mov	w2, w24
 	ldrh	w4, [x10, 4]
 	mov	x1, x27
-	add	x0, x0, :lo12:.LC38
+	add	x0, x0, :lo12:.LC46
 	str	x10, [x29, 104]
 	bl	printf
-	cbnz	w28, .L1372
+	cbnz	w28, .L1396
 	ldr	x10, [x29, 104]
 	ldrh	w0, [x10, 4]
 	cmp	w24, w0
-	beq	.L1372
+	beq	.L1396
 	sxth	w24, w0
 	adrp	x0, .LANCHOR20
 	ldrh	w7, [x0, #:lo12:.LANCHOR20]
 	sub	w7, w7, #1
-.L1395:
+.L1422:
 	sxth	w28, w7
-	b	.L1370
-.L1372:
+	b	.L1394
+.L1396:
 	mov	w0, -1
 	str	w0, [x19, #:lo12:.LANCHOR138]
-.L1371:
+.L1395:
 	ldr	w0, [x19, #:lo12:.LANCHOR138]
 	cmn	w0, #1
-	beq	.L1374
+	beq	.L1398
 	ldr	x0, [x22, #:lo12:.LANCHOR106]
 	mov	w1, 19539
 	movk	w1, 0x4654, lsl 16
 	ldr	w0, [x0]
 	cmp	w0, w1
-	bne	.L1374
+	bne	.L1398
 	ldr	x0, [x25, #:lo12:.LANCHOR114]
 	ldrh	w1, [x0]
 	mov	w0, 61604
 	cmp	w1, w0
-	beq	.L1375
-.L1374:
+	beq	.L1399
+.L1398:
 	sub	w7, w28, #1
-	b	.L1395
+	b	.L1422
 	.size	FtlLoadSysInfo, .-FtlLoadSysInfo
 	.section	.text.FtlMapTblRecovery,"ax",@progbits
 	.align	2
@@ -10442,21 +10478,21 @@ FtlMapTblRecovery:
 	add	x0, x26, :lo12:.LANCHOR20
 	str	w1, [x19, 56]
 	str	x0, [x29, 96]
-.L1397:
+.L1424:
 	ldr	w0, [x29, 152]
 	cmp	w20, w0
-	bge	.L1416
+	bge	.L1443
 	ldr	w0, [x29, 108]
 	sxtw	x28, w20
 	cmp	w20, w0
-	bne	.L1398
+	bne	.L1425
 	lsl	x0, x28, 1
 	mov	w1, 1
 	add	x26, x24, x0
 	adrp	x27, .LANCHOR23
 	add	x27, x27, :lo12:.LANCHOR23
-	mov	w22, 0
 	ldrh	w0, [x24, x0]
+	mov	w24, 0
 	bl	FtlGetLastWrittenPage
 	sxth	w1, w0
 	add	w0, w0, 1
@@ -10469,22 +10505,22 @@ FtlMapTblRecovery:
 	str	w0, [x19, 48]
 	add	x28, x28, :lo12:.LANCHOR180
 	ldr	x0, [x29, 128]
-	add	x24, x0, :lo12:.LANCHOR138
-.L1399:
+	add	x22, x0, :lo12:.LANCHOR138
+.L1426:
 	ldr	w0, [x29, 152]
-	cmp	w22, w0
-	ble	.L1402
-.L1416:
+	cmp	w24, w0
+	ble	.L1429
+.L1443:
 	mov	x0, x19
 	bl	ftl_free_no_use_map_blk
 	adrp	x0, .LANCHOR20
 	ldrh	w1, [x19, 2]
 	ldrh	w0, [x0, #:lo12:.LANCHOR20]
 	cmp	w1, w0
-	bne	.L1404
+	bne	.L1431
 	mov	x0, x19
 	bl	ftl_map_blk_alloc_new_blk
-.L1404:
+.L1431:
 	mov	x0, x19
 	bl	ftl_map_blk_gc
 	mov	x0, x19
@@ -10497,54 +10533,57 @@ FtlMapTblRecovery:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 160
 	ret
-.L1402:
+.L1429:
 	ldrh	w0, [x26]
 	mov	w2, 1
 	mov	w1, w2
-	orr	w0, w22, w0, lsl 10
-	str	w0, [x24, 4]
-	mov	x0, x24
+	orr	w0, w24, w0, lsl 10
+	str	w0, [x22, 4]
+	mov	x0, x22
 	bl	FlashReadPages
-	ldr	x0, [x24, 16]
+	ldr	x0, [x22, 16]
 	ldr	w0, [x0, 12]
 	str	w0, [x29, 156]
 	uxtw	x0, w0
-	cbz	w0, .L1400
+	cbz	w0, .L1427
+	ldr	w0, [x22]
+	cmn	w0, #1
+	beq	.L1427
 	ldrh	w1, [x27]
-	ldr	x0, [x24, 8]
+	ldr	x0, [x22, 8]
 	bl	js_hash
 	ldr	w1, [x29, 156]
 	cmp	w1, w0
-	beq	.L1400
+	beq	.L1427
 	mov	w5, w0
 	mov	x4, x1
-	mov	w3, w22
+	mov	w3, w24
 	mov	w2, w20
 	mov	x1, x28
-	adrp	x0, .LC39
-	add	x0, x0, :lo12:.LC39
+	adrp	x0, .LC47
+	add	x0, x0, :lo12:.LC47
 	bl	printf
 	mov	w0, -1
-	str	w0, [x24]
-.L1400:
-	ldr	w0, [x24]
+	str	w0, [x22]
+.L1427:
+	ldr	w0, [x22]
 	cmn	w0, #1
-	beq	.L1401
+	beq	.L1428
 	ldrh	w0, [x21, 8]
 	cmp	w25, w0
-	bls	.L1401
+	bls	.L1428
 	ldrh	w2, [x21]
 	ldrh	w1, [x19, 4]
 	cmp	w2, w1
-	bne	.L1401
+	bne	.L1428
 	ubfiz	x0, x0, 2, 16
-	ldr	w1, [x24, 4]
+	ldr	w1, [x22, 4]
 	str	w1, [x23, x0]
-.L1401:
-	add	w22, w22, 1
-	sxth	w22, w22
-	b	.L1399
-.L1398:
+.L1428:
+	add	w6, w24, 1
+	sxth	w24, w6
+	b	.L1426
+.L1425:
 	lsl	x2, x28, 1
 	ldr	x0, [x22, #:lo12:.LANCHOR106]
 	str	x0, [x27, 8]
@@ -10561,16 +10600,16 @@ FtlMapTblRecovery:
 	bl	FlashReadPages
 	ldr	w0, [x27]
 	cmn	w0, #1
-	beq	.L1418
+	beq	.L1445
 	ldrh	w1, [x21]
 	ldrh	w0, [x19, 4]
 	cmp	w1, w0
-	bne	.L1418
+	bne	.L1445
 	ldrh	w1, [x21, 8]
 	mov	w0, 64245
 	cmp	w1, w0
-	beq	.L1406
-.L1418:
+	beq	.L1433
+.L1445:
 	adrp	x0, .LANCHOR23
 	add	x0, x0, :lo12:.LANCHOR23
 	mov	w28, 0
@@ -10578,11 +10617,11 @@ FtlMapTblRecovery:
 	adrp	x0, .LANCHOR180
 	add	x0, x0, :lo12:.LANCHOR180
 	str	x0, [x29, 112]
-.L1407:
+.L1434:
 	ldr	x0, [x29, 96]
 	ldrh	w0, [x0]
 	cmp	w28, w0
-	bge	.L1414
+	bge	.L1441
 	ldr	x0, [x29, 136]
 	mov	w2, 1
 	mov	w1, w2
@@ -10595,69 +10634,72 @@ FtlMapTblRecovery:
 	ldr	w0, [x0, 12]
 	str	w0, [x29, 156]
 	uxtw	x0, w0
-	cbz	w0, .L1411
+	cbz	w0, .L1438
+	ldr	w0, [x27]
+	cmn	w0, #1
+	beq	.L1438
 	ldr	x0, [x29, 120]
 	ldrh	w1, [x0]
 	ldr	x0, [x27, 8]
 	bl	js_hash
 	ldr	w1, [x29, 156]
 	cmp	w1, w0
-	beq	.L1411
+	beq	.L1438
 	mov	x4, x1
 	ldr	x1, [x29, 112]
 	mov	w5, w0
 	mov	w3, w28
 	mov	w2, w20
-	adrp	x0, .LC40
-	add	x0, x0, :lo12:.LC40
+	adrp	x0, .LC48
+	add	x0, x0, :lo12:.LC48
 	bl	printf
 	mov	w0, -1
 	str	w0, [x27]
-.L1411:
+.L1438:
 	ldr	w0, [x27]
 	cmn	w0, #1
-	beq	.L1412
+	beq	.L1439
 	ldrh	w0, [x21, 8]
 	cmp	w25, w0
-	bls	.L1412
+	bls	.L1439
 	ldrh	w2, [x21]
 	ldrh	w1, [x19, 4]
 	cmp	w2, w1
-	bne	.L1412
+	bne	.L1439
 	ubfiz	x0, x0, 2, 16
 	ldr	w1, [x27, 4]
 	str	w1, [x23, x0]
-.L1412:
+.L1439:
 	add	w7, w28, 1
 	sxth	w28, w7
-	b	.L1407
-.L1406:
+	b	.L1434
+.L1433:
 	ldrh	w3, [x26, #:lo12:.LANCHOR20]
 	mov	w0, 0
 	ldr	x4, [x22, #:lo12:.LANCHOR106]
 	sub	w3, w3, #1
-.L1408:
+.L1435:
 	cmp	w0, w3
-	blt	.L1410
-.L1414:
+	blt	.L1437
+.L1441:
 	add	w20, w20, 1
 	sxth	w20, w20
-	b	.L1397
-.L1410:
+	b	.L1424
+.L1437:
 	lsl	w2, w0, 1
 	sxtw	x2, w2
 	lsl	x1, x2, 2
 	ldrh	w1, [x4, x1]
 	cmp	w25, w1
-	bls	.L1409
+	bls	.L1436
 	add	x2, x2, 1
 	ubfiz	x1, x1, 2, 16
 	ldr	w2, [x4, x2, lsl 2]
 	str	w2, [x23, x1]
-.L1409:
+.L1436:
 	add	w0, w0, 1
 	sxth	w0, w0
-	b	.L1408
+	b	.L1435
 	.size	FtlMapTblRecovery, .-FtlMapTblRecovery
 	.section	.text.FtlLoadVonderInfo,"ax",@progbits
 	.align	2
@@ -10731,20 +10773,20 @@ FtlSysBlkInit:
 	ldrh	w1, [x0, #:lo12:.LANCHOR139]
 	mov	w0, 65535
 	cmp	w1, w0
-	bne	.L1437
-.L1439:
+	bne	.L1470
+.L1472:
 	mov	w21, -1
-.L1436:
+.L1469:
 	mov	w0, w21
 	ldr	x23, [sp, 48]
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
 	ldp	x29, x30, [sp], 64
 	ret
-.L1437:
+.L1470:
 	bl	FtlLoadSysInfo
 	mov	w21, w0
-	cbnz	w0, .L1439
+	cbnz	w0, .L1472
 	bl	FtlLoadMapInfo
 	bl	FtlLoadVonderInfo
 	bl	Ftl_load_ext_data
@@ -10760,19 +10802,19 @@ FtlSysBlkInit:
 	ldr	x1, [x0, #:lo12:.LANCHOR55]
 	mov	w0, 0
 	add	x1, x1, 4
-.L1440:
+.L1473:
 	cmp	w0, w2
-	bge	.L1445
+	bge	.L1478
 	ldr	w3, [x1], 16
-	tbz	w3, #31, .L1441
-.L1445:
+	tbz	w3, #31, .L1474
+.L1478:
 	adrp	x3, .LANCHOR83
 	cmp	w0, w2
 	ldr	w1, [x3, #:lo12:.LANCHOR83]
 	add	w1, w1, 32
 	str	w1, [x3, #:lo12:.LANCHOR83]
-	bge	.L1447
-.L1442:
+	bge	.L1480
+.L1475:
 	adrp	x23, .LANCHOR51
 	add	x20, x23, :lo12:.LANCHOR51
 	mov	x0, x20
@@ -10811,17 +10853,17 @@ FtlSysBlkInit:
 	strh	w1, [x0, 30]
 	bl	l2p_flush
 	bl	FtlVpcTblFlush
-.L1449:
+.L1482:
 	bl	FtlVpcTblFlush
-	b	.L1436
-.L1441:
+	b	.L1469
+.L1474:
 	add	w0, w0, 1
-	b	.L1440
-.L1447:
+	b	.L1473
+.L1480:
 	ldrh	w0, [x19, #:lo12:.LANCHOR156]
-	cbnz	w0, .L1442
+	cbnz	w0, .L1475
 	bl	l2p_flush
-	b	.L1449
+	b	.L1482
 	.size	FtlSysBlkInit, .-FtlSysBlkInit
 	.section	.text.ftl_low_format,"ax",@progbits
 	.align	2
@@ -10834,17 +10876,19 @@ ftl_low_format:
 	stp	x23, x24, [sp, 48]
 	adrp	x24, .LANCHOR4
 	str	wzr, [x0, #:lo12:.LANCHOR83]
-	ldrh	w0, [x24, #:lo12:.LANCHOR4]
+	adrp	x0, .LANCHOR143
 	stp	x19, x20, [sp, 16]
 	adrp	x20, .LANCHOR82
+	str	wzr, [x0, #:lo12:.LANCHOR143]
+	ldrh	w0, [x24, #:lo12:.LANCHOR4]
 	stp	x21, x22, [sp, 32]
 	stp	x25, x26, [sp, 64]
 	str	wzr, [x20, #:lo12:.LANCHOR82]
 	bl	FtlFreeSysBlkQueueInit
 	bl	FtlLoadBbt
-	cbz	w0, .L1451
+	cbz	w0, .L1484
 	bl	FtlMakeBbt
-.L1451:
+.L1484:
 	adrp	x23, .LANCHOR12
 	adrp	x0, .LANCHOR109
 	mov	w6, 23752
@@ -10855,31 +10899,31 @@ ftl_low_format:
 	lsl	w1, w1, 7
 	ldr	x5, [x0, #:lo12:.LANCHOR110]
 	mov	w0, 0
-.L1452:
+.L1485:
 	cmp	w0, w1
-	blt	.L1453
+	blt	.L1486
 	adrp	x21, .LANCHOR5
 	adrp	x22, .LANCHOR6
 	add	x26, x22, :lo12:.LANCHOR6
 	mov	w19, 0
 	ldrh	w25, [x21, #:lo12:.LANCHOR5]
-.L1454:
+.L1487:
 	ldrh	w0, [x26]
 	cmp	w0, w25
-	bhi	.L1455
+	bhi	.L1488
 	adrp	x25, .LANCHOR3
 	sub	w1, w19, #2
 	ldrh	w0, [x25, #:lo12:.LANCHOR3]
 	cmp	w1, w0, lsl 1
-	bgt	.L1456
-.L1460:
+	bgt	.L1489
+.L1493:
 	add	x26, x21, :lo12:.LANCHOR5
 	mov	w19, 0
 	mov	w24, 0
-.L1457:
+.L1490:
 	ldrh	w0, [x26]
 	cmp	w0, w24
-	bhi	.L1461
+	bhi	.L1494
 	adrp	x0, .LANCHOR99
 	ldrh	w1, [x22, #:lo12:.LANCHOR6]
 	ldrh	w4, [x25, #:lo12:.LANCHOR3]
@@ -10896,28 +10940,28 @@ ftl_low_format:
 	mov	w6, 24
 	mul	w6, w4, w6
 	cmp	w19, w6
-	ble	.L1462
+	ble	.L1495
 	sub	w1, w1, w19
 	udiv	w1, w1, w4
 	str	w1, [x3, #:lo12:.LANCHOR152]
 	lsr	w1, w1, 5
 	add	w1, w1, 24
 	strh	w1, [x2, #:lo12:.LANCHOR171]
-.L1462:
+.L1495:
 	adrp	x1, .LANCHOR15
 	ldrh	w1, [x1, #:lo12:.LANCHOR15]
-	cbz	w1, .L1464
+	cbz	w1, .L1497
 	ldrh	w6, [x2, #:lo12:.LANCHOR171]
 	add	w6, w6, w1, lsr 1
 	strh	w6, [x2, #:lo12:.LANCHOR171]
 	mul	w6, w1, w4
 	cmp	w19, w6
-	bge	.L1464
+	bge	.L1497
 	add	w1, w1, 32
 	str	w5, [x3, #:lo12:.LANCHOR152]
 	add	w1, w0, w1
 	strh	w1, [x2, #:lo12:.LANCHOR171]
-.L1464:
+.L1497:
 	ldrh	w1, [x2, #:lo12:.LANCHOR171]
 	adrp	x25, .LANCHOR179
 	ldr	w0, [x3, #:lo12:.LANCHOR152]
@@ -10941,11 +10985,11 @@ ftl_low_format:
 	lsl	w2, w2, 1
 	bl	ftl_memset
 	adrp	x0, .LANCHOR59
-	adrp	x1, .LANCHOR144
+	adrp	x1, .LANCHOR145
 	ldrh	w2, [x21, #:lo12:.LANCHOR5]
 	str	wzr, [x0, #:lo12:.LANCHOR59]
-	add	x0, x1, :lo12:.LANCHOR144
-	strh	w23, [x1, #:lo12:.LANCHOR144]
+	add	x0, x1, :lo12:.LANCHOR145
+	strh	w23, [x1, #:lo12:.LANCHOR145]
 	mov	w1, 255
 	lsr	w2, w2, 3
 	strh	wzr, [x0, 2]
@@ -10961,20 +11005,20 @@ ftl_low_format:
 	ldr	x0, [x0, #:lo12:.LANCHOR1]
 	strb	wzr, [x19, 6]
 	bl	ftl_memset
-.L1466:
+.L1499:
 	mov	x0, x19
 	bl	make_superblock
 	ldrb	w1, [x19, 7]
 	ldrh	w0, [x19]
-	cbnz	w1, .L1467
+	cbnz	w1, .L1500
 	ldr	x1, [x24, #:lo12:.LANCHOR42]
 	ubfiz	x0, x0, 1, 16
 	strh	w23, [x1, x0]
 	ldrh	w0, [x19]
 	add	w0, w0, 1
 	strh	w0, [x19]
-	b	.L1466
-.L1453:
+	b	.L1499
+.L1486:
 	ubfiz	x3, x0, 2, 16
 	mvn	w2, w0
 	orr	w2, w0, w2, lsl 16
@@ -10982,8 +11026,8 @@ ftl_low_format:
 	and	w0, w0, 65535
 	str	w2, [x4, x3]
 	str	w6, [x5, x3]
-	b	.L1452
-.L1455:
+	b	.L1485
+.L1488:
 	mov	w0, w25
 	mov	w1, 1
 	add	w25, w25, 1
@@ -10991,8 +11035,8 @@ ftl_low_format:
 	add	w19, w19, w0
 	and	w25, w25, 65535
 	and	w19, w19, 65535
-	b	.L1454
-.L1456:
+	b	.L1487
+.L1489:
 	udiv	w0, w19, w0
 	adrp	x1, .LANCHOR31
 	ldr	w19, [x1, #:lo12:.LANCHOR31]
@@ -11002,17 +11046,17 @@ ftl_low_format:
 	add	x24, x22, :lo12:.LANCHOR6
 	bl	FtlFreeSysBlkQueueInit
 	ldrh	w19, [x21, #:lo12:.LANCHOR5]
-.L1458:
+.L1491:
 	ldrh	w0, [x24]
 	cmp	w0, w19
-	bls	.L1460
+	bls	.L1493
 	mov	w0, w19
 	add	w19, w19, 1
 	mov	w1, 1
 	and	w19, w19, 65535
 	bl	FtlLowFormatEraseBlock
-	b	.L1458
-.L1461:
+	b	.L1491
+.L1494:
 	mov	w0, w24
 	mov	w1, 0
 	add	w24, w24, 1
@@ -11020,8 +11064,8 @@ ftl_low_format:
 	add	w19, w19, w0
 	and	w24, w24, 65535
 	and	w19, w19, 65535
-	b	.L1457
-.L1467:
+	b	.L1490
+.L1500:
 	ldr	w1, [x20, #:lo12:.LANCHOR82]
 	ubfiz	x0, x0, 1, 16
 	str	w1, [x19, 12]
@@ -11041,20 +11085,20 @@ ftl_low_format:
 	mov	w1, 1
 	strb	wzr, [x0, 6]
 	strb	w1, [x0, 8]
-.L1468:
+.L1501:
 	mov	x0, x19
 	bl	make_superblock
 	ldrb	w1, [x19, 7]
 	ldrh	w0, [x19]
-	cbnz	w1, .L1469
+	cbnz	w1, .L1502
 	ldr	x1, [x24, #:lo12:.LANCHOR42]
 	ubfiz	x0, x0, 1, 16
 	strh	w23, [x1, x0]
 	ldrh	w0, [x19]
 	add	w0, w0, 1
 	strh	w0, [x19]
-	b	.L1468
-.L1469:
+	b	.L1501
+.L1502:
 	ldr	w1, [x20, #:lo12:.LANCHOR82]
 	ubfiz	x0, x0, 1, 16
 	str	w1, [x19, 12]
@@ -11080,11 +11124,11 @@ ftl_low_format:
 	str	w0, [x20, #:lo12:.LANCHOR82]
 	bl	FtlVpcTblFlush
 	bl	FtlSysBlkInit
-	cbnz	w0, .L1470
+	cbnz	w0, .L1503
 	adrp	x0, .LANCHOR166
 	mov	w1, 1
 	str	w1, [x0, #:lo12:.LANCHOR166]
-.L1470:
+.L1503:
 	mov	w0, 0
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -11099,8 +11143,8 @@ ftl_low_format:
 	.type	sftl_init, %function
 sftl_init:
 	stp	x29, x30, [sp, -32]!
-	adrp	x1, .LC41
-	add	x1, x1, :lo12:.LC41
+	adrp	x1, .LC49
+	add	x1, x1, :lo12:.LC49
 	mov	w0, -1
 	add	x29, sp, 0
 	stp	x19, x20, [sp, 16]
@@ -11108,8 +11152,8 @@ sftl_init:
 	adrp	x19, .LANCHOR181
 	add	x19, x19, :lo12:.LANCHOR181
 	str	w0, [x20, #:lo12:.LANCHOR166]
-	adrp	x0, .LC34
-	add	x0, x0, :lo12:.LC34
+	adrp	x0, .LC38
+	add	x0, x0, :lo12:.LC38
 	bl	printf
 	adrp	x0, .LANCHOR0
 	add	x0, x0, :lo12:.LANCHOR0
@@ -11119,34 +11163,21 @@ sftl_init:
 	adrp	x0, .LANCHOR4
 	ldrh	w0, [x0, #:lo12:.LANCHOR4]
 	bl	FtlFreeSysBlkQueueInit
-.L1476:
+.L1509:
 	bl	FtlLoadBbt
-	cbz	w0, .L1477
-.L1492:
+	cbz	w0, .L1510
+.L1520:
 	ldr	w0, [x19]
 	cmp	w0, 1
-	bne	.L1476
+	bne	.L1509
 	str	wzr, [x19]
 	bl	ftl_low_format
-	b	.L1476
-.L1477:
+	b	.L1509
+.L1510:
 	bl	FtlSysBlkInit
-	cbnz	w0, .L1492
-	mov	w0, 1
-	str	w0, [x20, #:lo12:.LANCHOR166]
-	adrp	x0, .LANCHOR48
-	ldrh	w0, [x0, #:lo12:.LANCHOR48]
-	cmp	w0, 15
-	bhi	.L1489
-	mov	w19, 8129
-.L1483:
+	cbnz	w0, .L1520
 	mov	w1, 1
-	mov	w0, 0
-	bl	rk_ftl_garbage_collect
-	subs	w19, w19, #1
-	bne	.L1483
-.L1489:
-	mov	w0, 0
+	str	w1, [x20, #:lo12:.LANCHOR166]
 	ldp	x19, x20, [sp, 16]
 	ldp	x29, x30, [sp], 32
 	ret
@@ -11167,17 +11198,17 @@ FtlWriteToIDB:
 	stp	x21, x22, [sp, 32]
 	adrp	x24, .LANCHOR182
 	stp	x27, x28, [sp, 80]
-	bls	.L1494
+	bls	.L1522
 	mov	w19, w0
 	cmp	w0, 575
-	bls	.L1495
-.L1494:
+	bls	.L1523
+.L1522:
 	ldr	w0, [x24, #:lo12:.LANCHOR182]
-	cbnz	w0, .L1496
-.L1561:
+	cbnz	w0, .L1524
+.L1589:
 	mov	w19, 0
-	b	.L1493
-.L1496:
+	b	.L1521
+.L1524:
 	adrp	x0, .LANCHOR183
 	str	x0, [x29, 120]
 	mov	w1, 35899
@@ -11185,7 +11216,7 @@ FtlWriteToIDB:
 	movk	w1, 0xfcdc, lsl 16
 	ldr	w2, [x23]
 	cmp	w2, w1
-	bne	.L1498
+	bne	.L1526
 	adrp	x21, .LANCHOR0
 	add	x0, x21, :lo12:.LANCHOR0
 	mov	w19, 65535
@@ -11194,9 +11225,9 @@ FtlWriteToIDB:
 	mov	x0, 262140
 	add	x2, x23, x0
 	mov	w0, 0
-.L1502:
+.L1530:
 	ldr	w4, [x2]
-	cbnz	w4, .L1499
+	cbnz	w4, .L1527
 	ldr	w4, [x23, w0, uxtw 2]
 	add	w0, w0, 1
 	str	w4, [x2], -4
@@ -11204,13 +11235,13 @@ FtlWriteToIDB:
 	sub	w19, w19, #1
 	csel	w0, w0, wzr, cc
 	cmp	w19, 4096
-	bne	.L1502
+	bne	.L1530
 	mov	w19, 512
-	b	.L1501
-.L1499:
+	b	.L1529
+.L1527:
 	add	w19, w19, 127
 	lsr	w19, w19, 7
-.L1501:
+.L1529:
 	add	w0, w19, 4
 	ubfiz	w1, w1, 2, 14
 	mov	w22, 0
@@ -11221,7 +11252,7 @@ FtlWriteToIDB:
 	str	w0, [x29, 136]
 	adrp	x0, .LANCHOR78
 	add	x20, x0, :lo12:.LANCHOR78
-.L1524:
+.L1552:
 	adrp	x26, .LANCHOR184
 	mov	w1, 0
 	mov	x2, 512
@@ -11234,27 +11265,27 @@ FtlWriteToIDB:
 	add	x0, x0, :lo12:.LANCHOR78
 	ldr	x1, [x0, 32]
 	mul	w25, w27, w22
-	cbz	x1, .L1532
+	cbz	x1, .L1560
 	ldr	x0, [x0, 40]
 	mov	w26, 6
 	cmp	x0, 0
 	mov	w0, 9
 	csel	w26, w26, w0, eq
-.L1503:
+.L1531:
 	ldr	x2, [x20, 8]
 	mov	w1, w25
 	mov	w0, 0
 	blr	x2
 	ldr	w0, [x29, 156]
 	cmp	w0, 1
-	beq	.L1504
+	beq	.L1532
 	ldr	x2, [x20, 8]
 	add	w1, w27, w25
 	mov	w0, 0
 	blr	x2
-.L1504:
+.L1532:
 	cmp	w26, 9
-	bne	.L1534
+	bne	.L1562
 	ldr	x0, [x29, 144]
 	mov	w2, 1024
 	mov	w1, 0
@@ -11279,7 +11310,7 @@ FtlWriteToIDB:
 	add	x0, x28, 12
 	bl	js_hash
 	str	w0, [x28, 8]
-.L1505:
+.L1533:
 	ldr	w0, [x29, 156]
 	mov	x6, x23
 	mul	w0, w0, w27
@@ -11287,22 +11318,22 @@ FtlWriteToIDB:
 	str	w0, [x29, 140]
 	add	w0, w25, 1
 	str	w0, [x29, 132]
-.L1506:
+.L1534:
 	ldr	w0, [x29, 140]
 	mov	w1, w27
 	cmp	w27, w0
-	bcs	.L1513
+	bcs	.L1541
 	cmp	w26, 9
-	bne	.L1507
+	bne	.L1535
 	ldr	w0, [x29, 132]
 	add	w0, w0, w1
-.L1560:
+.L1588:
 	str	w0, [x29, 160]
 	mov	w0, 61424
 	str	w0, [x29, 164]
 	cmp	w1, 0
 	ccmp	w26, 9, 0, eq
-	bne	.L1509
+	bne	.L1537
 	ldr	x1, [x20, 32]
 	mov	w0, 70
 	str	x6, [x29, 104]
@@ -11322,8 +11353,8 @@ FtlWriteToIDB:
 	ldr	w1, [x29, 112]
 	ldr	x6, [x29, 104]
 	cmn	w1, #1
-	bne	.L1510
-.L1513:
+	bne	.L1538
+.L1541:
 	ldr	x0, [x29, 144]
 	ldr	x26, [x0, #:lo12:.LANCHOR184]
 	add	x0, x21, :lo12:.LANCHOR0
@@ -11332,21 +11363,21 @@ FtlWriteToIDB:
 	mul	w1, w0, w22
 	str	w1, [x29, 140]
 	ldr	x1, [x20, 32]
-	cbnz	x1, .L1511
+	cbnz	x1, .L1539
 	mov	w25, 6
-.L1512:
+.L1540:
 	ldr	w1, [x29, 156]
 	mov	x27, 0
 	mul	w0, w1, w0
 	str	w0, [x29, 132]
-.L1515:
+.L1543:
 	ldr	w0, [x29, 132]
 	mov	w1, w27
 	cmp	w27, w0
-	bcs	.L1519
+	bcs	.L1547
 	cmp	w27, 0
 	ccmp	w25, 9, 0, eq
-	bne	.L1516
+	bne	.L1544
 	ldr	x1, [x20, 32]
 	mov	w0, 70
 	blr	x1
@@ -11370,34 +11401,34 @@ FtlWriteToIDB:
 	mov	w1, 18766
 	movk	w1, 0x464e, lsl 16
 	cmp	w0, w1
-	beq	.L1517
-.L1519:
+	beq	.L1545
+.L1547:
 	ldr	x0, [x29, 144]
 	mov	x2, x23
 	mov	x1, 0
 	ldr	x0, [x0, #:lo12:.LANCHOR184]
-.L1518:
+.L1546:
 	ldr	w3, [x29, 136]
 	mov	w26, w1
 	cmp	w1, w3
-	bcc	.L1522
+	bcc	.L1550
 	ldr	w0, [x29, 152]
 	add	w0, w0, 1
 	str	w0, [x29, 152]
 	cmp	w0, 5
-	bls	.L1521
-	b	.L1525
-.L1532:
+	bls	.L1549
+	b	.L1553
+.L1560:
 	mov	w26, 6
-	b	.L1503
-.L1534:
+	b	.L1531
+.L1562:
 	mov	x28, 0
-	b	.L1505
-.L1507:
+	b	.L1533
+.L1535:
 	add	w0, w1, w25
 	lsl	w0, w0, 2
-	b	.L1560
-.L1509:
+	b	.L1588
+.L1537:
 	ldr	x7, [x20, 16]
 	add	x3, x29, 160
 	mov	x2, x6
@@ -11406,20 +11437,20 @@ FtlWriteToIDB:
 	str	x6, [x29, 112]
 	blr	x7
 	cmn	w0, #1
-	beq	.L1513
+	beq	.L1541
 	ldr	x6, [x29, 112]
 	add	x6, x6, 2048
-.L1510:
+.L1538:
 	add	x27, x27, 1
-	b	.L1506
-.L1511:
+	b	.L1534
+.L1539:
 	ldr	x1, [x20, 40]
 	mov	w25, 6
 	cmp	x1, 0
 	mov	w1, 9
 	csel	w25, w25, w1, eq
-	b	.L1512
-.L1516:
+	b	.L1540
+.L1544:
 	ldr	x6, [x20, 24]
 	add	x3, x29, 160
 	ldr	w0, [x29, 140]
@@ -11428,16 +11459,16 @@ FtlWriteToIDB:
 	mov	w0, 0
 	blr	x6
 	cmn	w0, #1
-	beq	.L1519
+	beq	.L1547
 	ldr	w0, [x29, 164]
 	mov	w1, 61424
 	cmp	w0, w1
-	bne	.L1519
+	bne	.L1547
 	add	x26, x26, 2048
-.L1517:
+.L1545:
 	add	x27, x27, 1
-	b	.L1515
-.L1522:
+	b	.L1543
+.L1550:
 	mov	x25, x2
 	ldr	w4, [x0, x1, lsl 2]
 	lsl	x27, x1, 2
@@ -11445,7 +11476,7 @@ FtlWriteToIDB:
 	add	x1, x1, 1
 	ldr	w3, [x25]
 	cmp	w4, w3
-	beq	.L1518
+	beq	.L1546
 	mov	x2, 512
 	mov	w1, 0
 	bl	memset
@@ -11455,8 +11486,8 @@ FtlWriteToIDB:
 	mov	w4, w26
 	ldr	x0, [x0, #:lo12:.LANCHOR184]
 	ldr	w2, [x0, x27]
-	adrp	x0, .LC42
-	add	x0, x0, :lo12:.LC42
+	adrp	x0, .LC50
+	add	x0, x0, :lo12:.LC50
 	bl	printf
 	add	x0, x21, :lo12:.LANCHOR0
 	ldr	x2, [x20, 8]
@@ -11464,16 +11495,16 @@ FtlWriteToIDB:
 	mov	w0, 0
 	mul	w1, w1, w22
 	blr	x2
-.L1521:
+.L1549:
 	ldr	w0, [x29, 156]
 	add	w22, w22, w0
 	cmp	w22, 15
-	bls	.L1524
+	bls	.L1552
 	ldr	w0, [x29, 152]
-	cbnz	w0, .L1525
-.L1498:
+	cbnz	w0, .L1553
+.L1526:
 	mov	w19, -1
-.L1525:
+.L1553:
 	ldr	x0, [x29, 120]
 	str	wzr, [x24, #:lo12:.LANCHOR182]
 	ldr	x0, [x0, #:lo12:.LANCHOR183]
@@ -11481,7 +11512,7 @@ FtlWriteToIDB:
 	adrp	x0, .LANCHOR184
 	ldr	x0, [x0, #:lo12:.LANCHOR184]
 	bl	free
-.L1493:
+.L1521:
 	mov	w0, w19
 	ldp	x19, x20, [sp, 16]
 	ldp	x21, x22, [sp, 32]
@@ -11490,11 +11521,11 @@ FtlWriteToIDB:
 	ldp	x27, x28, [sp, 80]
 	ldp	x29, x30, [sp], 224
 	ret
-.L1495:
+.L1523:
 	mov	w21, w1
 	mov	x22, x2
 	cmp	w0, 64
-	bne	.L1526
+	bne	.L1554
 	adrp	x20, .LANCHOR183
 	mov	w0, 262144
 	bl	ftl_malloc
@@ -11505,55 +11536,55 @@ FtlWriteToIDB:
 	adrp	x0, .LANCHOR184
 	str	x1, [x0, #:lo12:.LANCHOR184]
 	ldr	x0, [x20, #:lo12:.LANCHOR183]
-	cbz	x0, .L1527
-	cbz	x1, .L1527
+	cbz	x0, .L1555
+	cbz	x1, .L1555
 	mov	w1, 1
 	mov	w2, 262144
 	str	w1, [x24, #:lo12:.LANCHOR182]
 	mov	w1, 0
 	bl	ftl_memset
-.L1526:
+.L1554:
 	ldr	w0, [x24, #:lo12:.LANCHOR182]
-	cbz	w0, .L1561
+	cbz	w0, .L1589
 	adrp	x0, .LANCHOR183
 	cmp	w19, 63
 	ldr	x1, [x0, #:lo12:.LANCHOR183]
-	bhi	.L1529
+	bhi	.L1557
 	mov	w0, 64
 	sub	w19, w0, w19
 	sub	w21, w21, w19
 	ubfiz	x19, x19, 9, 25
 	add	x22, x22, x19
 	mov	x20, x1
-.L1530:
+.L1558:
 	cmp	w25, 575
-	bls	.L1531
+	bls	.L1559
 	sub	w21, w21, w23
 	sub	w21, w21, #446
-.L1531:
+.L1559:
 	mov	w4, w21
 	mov	x3, x20
 	mov	w2, 262144
-	adrp	x0, .LC44
-	add	x0, x0, :lo12:.LC44
+	adrp	x0, .LC52
+	add	x0, x0, :lo12:.LC52
 	bl	printf
 	lsl	w2, w21, 9
 	mov	x1, x22
 	mov	x0, x20
 	bl	ftl_memcpy
-	b	.L1561
-.L1527:
+	b	.L1589
+.L1555:
 	adrp	x1, .LANCHOR185
-	adrp	x0, .LC43
+	adrp	x0, .LC51
 	add	x1, x1, :lo12:.LANCHOR185
-	add	x0, x0, :lo12:.LC43
+	add	x0, x0, :lo12:.LC51
 	bl	printf
-	b	.L1526
-.L1529:
+	b	.L1554
+.L1557:
 	lsl	w20, w19, 7
 	sub	w20, w20, #8192
 	add	x20, x1, x20, lsl 2
-	b	.L1530
+	b	.L1558
 	.size	FtlWriteToIDB, .-FtlWriteToIDB
 	.section	.text.sftl_write,"ax",@progbits
 	.align	2
@@ -12218,7 +12249,7 @@ g_gc_skip_write_count:
 	.zero	4
 	.section	.bss.g_gc_superblock,"aw",@nobits
 	.align	3
-	.set	.LANCHOR144,. + 0
+	.set	.LANCHOR145,. + 0
 	.type	g_gc_superblock, %object
 	.size	g_gc_superblock, 48
 g_gc_superblock:
@@ -12281,7 +12312,7 @@ g_nand_phy_info:
 	.zero	24
 	.section	.bss.g_num_data_superblocks,"aw",@nobits
 	.align	1
-	.set	.LANCHOR45,. + 0
+	.set	.LANCHOR44,. + 0
 	.type	g_num_data_superblocks, %object
 	.size	g_num_data_superblocks, 2
 g_num_data_superblocks:
@@ -12344,7 +12375,7 @@ g_tmp_data_superblock_id:
 	.zero	2
 	.section	.bss.g_totle_avg_erase_count,"aw",@nobits
 	.align	2
-	.set	.LANCHOR145,. + 0
+	.set	.LANCHOR143,. + 0
 	.type	g_totle_avg_erase_count, %object
 	.size	g_totle_avg_erase_count, 4
 g_totle_avg_erase_count:
@@ -12532,21 +12563,21 @@ p_data_block_list_table:
 	.zero	8
 	.section	.bss.p_data_block_list_tail,"aw",@nobits
 	.align	3
-	.set	.LANCHOR44,. + 0
+	.set	.LANCHOR43,. + 0
 	.type	p_data_block_list_tail, %object
 	.size	p_data_block_list_tail, 8
 p_data_block_list_tail:
 	.zero	8
 	.section	.bss.p_erase_count_table,"aw",@nobits
 	.align	3
-	.set	.LANCHOR43,. + 0
+	.set	.LANCHOR47,. + 0
 	.type	p_erase_count_table, %object
 	.size	p_erase_count_table, 8
 p_erase_count_table:
 	.zero	8
 	.section	.bss.p_free_data_block_list_head,"aw",@nobits
 	.align	3
-	.set	.LANCHOR47,. + 0
+	.set	.LANCHOR46,. + 0
 	.type	p_free_data_block_list_head, %object
 	.size	p_free_data_block_list_head, 8
 p_free_data_block_list_head:
@@ -12816,345 +12847,363 @@ power_up_flag:
 .LC8:
 	.string	"not free: w: s:"
 	.section	.rodata.FlashProgPages.str1.1,"aMS",@progbits,1
-.LC11:
+.LC14:
 	.string	"prog read error: = %x\n"
-.LC12:
+.LC15:
+	.string	"prog read REFRESH: = %x\n"
+.LC16:
 	.string	"prog read s error: = %x %x %x\n"
-.LC13:
+.LC17:
 	.string	"prog read d error: = %x %x %x\n"
+	.section	.rodata.FlashReadPages.str1.1,"aMS",@progbits,1
+.LC11:
+	.string	"FlashReadPages %x %x error_ecc_bits %d\n"
+.LC12:
+	.string	"data:"
+.LC13:
+	.string	"spare:"
 	.section	.rodata.FtlBbmMapBadBlock.str1.1,"aMS",@progbits,1
 .LC0:
 	.string	"phyBlk = 0x%x die = %d block_in_die = 0x%x 0x%8x\n"
 	.section	.rodata.FtlBbmTblFlush.str1.1,"aMS",@progbits,1
-.LC14:
+.LC18:
 	.string	"FtlBbmTblFlush id=%x,page=%x,previd=%x cnt=%d\n"
-.LC15:
+.LC19:
 	.string	"FtlBbmTblFlush error:%x\n"
-.LC16:
+.LC20:
 	.string	"FtlBbmTblFlush error = %x error count = %d\n"
 	.section	.rodata.FtlFreeSysBlkQueueOut.str1.1,"aMS",@progbits,1
 .LC9:
 	.string	"FtlFreeSysBlkQueueOut = %x, free count = %d, error\n"
 	.section	.rodata.FtlGcScanTempBlk.str1.1,"aMS",@progbits,1
-.LC31:
+.LC35:
 	.string	"FtlGcScanTempBlk Error ID %x %x!!!!!!! \n"
 	.section	.rodata.FtlLoadEctTbl.str1.1,"aMS",@progbits,1
-.LC33:
+.LC37:
 	.string	"no ect"
-.LC34:
+.LC38:
 	.string	"%s\n"
 	.section	.rodata.FtlLoadSysInfo.str1.1,"aMS",@progbits,1
-.LC38:
+.LC46:
 	.string	"%s hash error this.id =%x page =%x pre_id =%x hash =%x hash_r =%x\n"
 	.section	.rodata.FtlMapTblRecovery.str1.1,"aMS",@progbits,1
-.LC39:
+.LC47:
 	.string	"%s last blk_id =%x page =%x hash error hash =%x hash_r =%x\n"
-.LC40:
+.LC48:
 	.string	"%s scan blk_id =%x page =%x hash error hash =%x hash_r =%x\n"
 	.section	.rodata.FtlMapWritePage.str1.1,"aMS",@progbits,1
-.LC18:
+.LC22:
 	.string	"FtlMapWritePage error = %x \n"
-.LC19:
+.LC23:
 	.string	"FtlMapWritePage error = %x error count = %d\n"
 	.section	.rodata.FtlProgPages.str1.1,"aMS",@progbits,1
-.LC36:
+.LC40:
+	.string	"FtlProgPages error %x = %d\n"
+.LC41:
 	.string	"Ftlwrite decrement_vpc_count %x = %d\n"
 	.section	.rodata.FtlRecoverySuperblock.str1.1,"aMS",@progbits,1
-.LC24:
+.LC27:
+	.string	"data prev_ppa = %x error...................\n"
+.LC28:
 	.string	"spuer block %x vpn is 0\n "
 	.section	.rodata.FtlVendorPartRead.str1.1,"aMS",@progbits,1
-.LC32:
+.LC36:
 	.string	"FtlVendorPartRead refresh = %x phyAddr = %x\n"
 	.section	.rodata.FtlVpcTblFlush.str1.1,"aMS",@progbits,1
-.LC35:
+.LC39:
 	.string	"FtlVpcTblFlush error = %x error count = %d\n"
 	.section	.rodata.FtlWrite.str1.1,"aMS",@progbits,1
-.LC37:
+.LC44:
+	.string	"FtlWrite: ecc error:%x %x %x\n"
+.LC45:
 	.string	"FtlWrite: lpa error:%x %x\n"
 	.section	.rodata.FtlWriteToIDB.str1.1,"aMS",@progbits,1
-.LC42:
+.LC50:
 	.string	"write_idblock fail! %x %x %x %x\n"
-.LC43:
+.LC51:
 	.string	"%s idb buffer alloc fail\n"
-.LC44:
+.LC52:
 	.string	"%p %x %p %x\n"
 	.section	.rodata.INSERT_DATA_LIST.str1.1,"aMS",@progbits,1
 .LC1:
 	.string	"\n!!!!! error @ func:%s - line:%d\n"
-	.section	.rodata.__func__.6241,"a",@progbits
+	.section	.rodata.__func__.6243,"a",@progbits
 	.align	3
 	.set	.LANCHOR169,. + 0
-	.type	__func__.6241, %object
-	.size	__func__.6241, 13
-__func__.6241:
+	.type	__func__.6243, %object
+	.size	__func__.6243, 13
+__func__.6243:
 	.string	"FtlProgPages"
-	.section	.rodata.__func__.6269,"a",@progbits
+	.section	.rodata.__func__.6271,"a",@progbits
 	.align	3
 	.set	.LANCHOR177,. + 0
-	.type	__func__.6269, %object
-	.size	__func__.6269, 9
-__func__.6269:
+	.type	__func__.6271, %object
+	.size	__func__.6271, 9
+__func__.6271:
 	.string	"FtlWrite"
-	.section	.rodata.__func__.6344,"a",@progbits
+	.section	.rodata.__func__.6346,"a",@progbits
 	.align	3
 	.set	.LANCHOR128,. + 0
-	.type	__func__.6344, %object
-	.size	__func__.6344, 14
-__func__.6344:
+	.type	__func__.6346, %object
+	.size	__func__.6346, 14
+__func__.6346:
 	.string	"FtlBbt2Bitmap"
-	.section	.rodata.__func__.6379,"a",@progbits
+	.section	.rodata.__func__.6381,"a",@progbits
 	.align	3
 	.set	.LANCHOR141,. + 0
-	.type	__func__.6379, %object
-	.size	__func__.6379, 11
-__func__.6379:
+	.type	__func__.6381, %object
+	.size	__func__.6381, 11
+__func__.6381:
 	.string	"FtlLoadBbt"
-	.section	.rodata.__func__.6494,"a",@progbits
+	.section	.rodata.__func__.6496,"a",@progbits
 	.align	3
 	.set	.LANCHOR49,. + 0
-	.type	__func__.6494, %object
-	.size	__func__.6494, 17
-__func__.6494:
+	.type	__func__.6496, %object
+	.size	__func__.6496, 17
+__func__.6496:
 	.string	"INSERT_FREE_LIST"
-	.section	.rodata.__func__.6499,"a",@progbits
+	.section	.rodata.__func__.6501,"a",@progbits
 	.align	3
-	.set	.LANCHOR46,. + 0
-	.type	__func__.6499, %object
-	.size	__func__.6499, 17
-__func__.6499:
+	.set	.LANCHOR45,. + 0
+	.type	__func__.6501, %object
+	.size	__func__.6501, 17
+__func__.6501:
 	.string	"INSERT_DATA_LIST"
-	.section	.rodata.__func__.6530,"a",@progbits
+	.section	.rodata.__func__.6532,"a",@progbits
 	.align	3
 	.set	.LANCHOR50,. + 0
-	.type	__func__.6530, %object
-	.size	__func__.6530, 17
-__func__.6530:
+	.type	__func__.6532, %object
+	.size	__func__.6532, 17
+__func__.6532:
 	.string	"List_remove_node"
-	.section	.rodata.__func__.6562,"a",@progbits
+	.section	.rodata.__func__.6564,"a",@progbits
 	.align	3
 	.set	.LANCHOR54,. + 0
-	.type	__func__.6562, %object
-	.size	__func__.6562, 22
-__func__.6562:
+	.type	__func__.6564, %object
+	.size	__func__.6564, 22
+__func__.6564:
 	.string	"List_update_data_list"
-	.section	.rodata.__func__.6571,"a",@progbits
+	.section	.rodata.__func__.6573,"a",@progbits
 	.align	3
 	.set	.LANCHOR150,. + 0
-	.type	__func__.6571, %object
-	.size	__func__.6571, 16
-__func__.6571:
+	.type	__func__.6573, %object
+	.size	__func__.6573, 16
+__func__.6573:
 	.string	"load_l2p_region"
-	.section	.rodata.__func__.6604,"a",@progbits
+	.section	.rodata.__func__.6606,"a",@progbits
 	.align	3
 	.set	.LANCHOR81,. + 0
-	.type	__func__.6604, %object
-	.size	__func__.6604, 26
-__func__.6604:
+	.type	__func__.6606, %object
+	.size	__func__.6606, 26
+__func__.6606:
 	.string	"ftl_map_blk_alloc_new_blk"
-	.section	.rodata.__func__.6615,"a",@progbits
+	.section	.rodata.__func__.6617,"a",@progbits
 	.align	3
 	.set	.LANCHOR151,. + 0
-	.type	__func__.6615, %object
-	.size	__func__.6615, 15
-__func__.6615:
+	.type	__func__.6617, %object
+	.size	__func__.6617, 15
+__func__.6617:
 	.string	"ftl_map_blk_gc"
-	.section	.rodata.__func__.6630,"a",@progbits
+	.section	.rodata.__func__.6632,"a",@progbits
 	.align	3
 	.set	.LANCHOR148,. + 0
-	.type	__func__.6630, %object
-	.size	__func__.6630, 31
-__func__.6630:
+	.type	__func__.6632, %object
+	.size	__func__.6632, 31
+__func__.6632:
 	.string	"Ftl_write_map_blk_to_last_page"
-	.section	.rodata.__func__.6644,"a",@progbits
+	.section	.rodata.__func__.6646,"a",@progbits
 	.align	3
 	.set	.LANCHOR149,. + 0
-	.type	__func__.6644, %object
-	.size	__func__.6644, 16
-__func__.6644:
+	.type	__func__.6646, %object
+	.size	__func__.6646, 16
+__func__.6646:
 	.string	"FtlMapWritePage"
-	.section	.rodata.__func__.6669,"a",@progbits
+	.section	.rodata.__func__.6671,"a",@progbits
 	.align	3
 	.set	.LANCHOR57,. + 0
-	.type	__func__.6669, %object
-	.size	__func__.6669, 22
-__func__.6669:
+	.type	__func__.6671, %object
+	.size	__func__.6671, 22
+__func__.6671:
 	.string	"select_l2p_ram_region"
-	.section	.rodata.__func__.6686,"a",@progbits
+	.section	.rodata.__func__.6688,"a",@progbits
 	.align	3
 	.set	.LANCHOR153,. + 0
-	.type	__func__.6686, %object
-	.size	__func__.6686, 9
-__func__.6686:
+	.type	__func__.6688, %object
+	.size	__func__.6688, 9
+__func__.6688:
 	.string	"log2phys"
-	.section	.rodata.__func__.6750,"a",@progbits
+	.section	.rodata.__func__.6752,"a",@progbits
 	.align	3
 	.set	.LANCHOR165,. + 0
-	.type	__func__.6750, %object
-	.size	__func__.6750, 15
-__func__.6750:
+	.type	__func__.6752, %object
+	.size	__func__.6752, 15
+__func__.6752:
 	.string	"FtlVpcTblFlush"
-	.section	.rodata.__func__.6772,"a",@progbits
+	.section	.rodata.__func__.6774,"a",@progbits
 	.align	3
 	.set	.LANCHOR140,. + 0
-	.type	__func__.6772, %object
-	.size	__func__.6772, 14
-__func__.6772:
+	.type	__func__.6774, %object
+	.size	__func__.6774, 14
+__func__.6774:
 	.string	"FtlScanSysBlk"
-	.section	.rodata.__func__.6828,"a",@progbits
+	.section	.rodata.__func__.6830,"a",@progbits
 	.align	3
 	.set	.LANCHOR178,. + 0
-	.type	__func__.6828, %object
-	.size	__func__.6828, 15
-__func__.6828:
+	.type	__func__.6830, %object
+	.size	__func__.6830, 15
+__func__.6830:
 	.string	"FtlLoadSysInfo"
-	.section	.rodata.__func__.6850,"a",@progbits
+	.section	.rodata.__func__.6852,"a",@progbits
 	.align	3
 	.set	.LANCHOR180,. + 0
-	.type	__func__.6850, %object
-	.size	__func__.6850, 18
-__func__.6850:
+	.type	__func__.6852, %object
+	.size	__func__.6852, 18
+__func__.6852:
 	.string	"FtlMapTblRecovery"
-	.section	.rodata.__func__.6896,"a",@progbits
+	.section	.rodata.__func__.6898,"a",@progbits
 	.align	3
 	.set	.LANCHOR154,. + 0
-	.type	__func__.6896, %object
-	.size	__func__.6896, 16
-__func__.6896:
+	.type	__func__.6898, %object
+	.size	__func__.6898, 16
+__func__.6898:
 	.string	"FtlReUsePrevPpa"
-	.section	.rodata.__func__.6930,"a",@progbits
+	.section	.rodata.__func__.6932,"a",@progbits
 	.align	3
 	.set	.LANCHOR155,. + 0
-	.type	__func__.6930, %object
-	.size	__func__.6930, 22
-__func__.6930:
+	.type	__func__.6932, %object
+	.size	__func__.6932, 22
+__func__.6932:
 	.string	"FtlRecoverySuperblock"
-	.section	.rodata.__func__.6987,"a",@progbits
+	.section	.rodata.__func__.6989,"a",@progbits
 	.align	3
 	.set	.LANCHOR60,. + 0
-	.type	__func__.6987, %object
-	.size	__func__.6987, 16
-__func__.6987:
+	.type	__func__.6989, %object
+	.size	__func__.6989, 16
+__func__.6989:
 	.string	"make_superblock"
-	.section	.rodata.__func__.7008,"a",@progbits
+	.section	.rodata.__func__.7010,"a",@progbits
 	.align	3
 	.set	.LANCHOR136,. + 0
-	.type	__func__.7008, %object
-	.size	__func__.7008, 18
-__func__.7008:
+	.type	__func__.7010, %object
+	.size	__func__.7010, 18
+__func__.7010:
 	.string	"SupperBlkListInit"
-	.section	.rodata.__func__.7035,"a",@progbits
+	.section	.rodata.__func__.7037,"a",@progbits
 	.align	3
 	.set	.LANCHOR159,. + 0
-	.type	__func__.7035, %object
-	.size	__func__.7035, 14
-__func__.7035:
+	.type	__func__.7037, %object
+	.size	__func__.7037, 14
+__func__.7037:
 	.string	"ftl_check_vpc"
-	.section	.rodata.__func__.7100,"a",@progbits
+	.section	.rodata.__func__.7102,"a",@progbits
 	.align	3
-	.set	.LANCHOR143,. + 0
-	.type	__func__.7100, %object
-	.size	__func__.7100, 25
-__func__.7100:
+	.set	.LANCHOR144,. + 0
+	.type	__func__.7102, %object
+	.size	__func__.7102, 25
+__func__.7102:
 	.string	"allocate_data_superblock"
-	.section	.rodata.__func__.7121,"a",@progbits
+	.section	.rodata.__func__.7123,"a",@progbits
 	.align	3
 	.set	.LANCHOR168,. + 0
-	.type	__func__.7121, %object
-	.size	__func__.7121, 29
-__func__.7121:
+	.type	__func__.7123, %object
+	.size	__func__.7123, 29
+__func__.7123:
 	.string	"allocate_new_data_superblock"
-	.section	.rodata.__func__.7128,"a",@progbits
+	.section	.rodata.__func__.7130,"a",@progbits
 	.align	3
 	.set	.LANCHOR61,. + 0
-	.type	__func__.7128, %object
-	.size	__func__.7128, 19
-__func__.7128:
+	.type	__func__.7130, %object
+	.size	__func__.7130, 19
+__func__.7130:
 	.string	"get_new_active_ppa"
-	.section	.rodata.__func__.7141,"a",@progbits
+	.section	.rodata.__func__.7143,"a",@progbits
 	.align	3
 	.set	.LANCHOR146,. + 0
-	.type	__func__.7141, %object
-	.size	__func__.7141, 16
-__func__.7141:
+	.type	__func__.7143, %object
+	.size	__func__.7143, 16
+__func__.7143:
 	.string	"update_vpc_list"
-	.section	.rodata.__func__.7148,"a",@progbits
+	.section	.rodata.__func__.7150,"a",@progbits
 	.align	3
 	.set	.LANCHOR147,. + 0
-	.type	__func__.7148, %object
-	.size	__func__.7148, 20
-__func__.7148:
+	.type	__func__.7150, %object
+	.size	__func__.7150, 20
+__func__.7150:
 	.string	"decrement_vpc_count"
-	.section	.rodata.__func__.7218,"a",@progbits
+	.section	.rodata.__func__.7220,"a",@progbits
 	.align	3
 	.set	.LANCHOR170,. + 0
-	.type	__func__.7218, %object
-	.size	__func__.7218, 19
-__func__.7218:
+	.type	__func__.7220, %object
+	.size	__func__.7220, 19
+__func__.7220:
 	.string	"FtlGcFreeTempBlock"
-	.section	.rodata.__func__.7316,"a",@progbits
+	.section	.rodata.__func__.7319,"a",@progbits
 	.align	3
 	.set	.LANCHOR175,. + 0
-	.type	__func__.7316, %object
-	.size	__func__.7316, 23
-__func__.7316:
+	.type	__func__.7319, %object
+	.size	__func__.7319, 23
+__func__.7319:
 	.string	"rk_ftl_garbage_collect"
-	.section	.rodata.__func__.7578,"a",@progbits
+	.section	.rodata.__func__.7591,"a",@progbits
 	.align	3
 	.set	.LANCHOR137,. + 0
-	.type	__func__.7578, %object
-	.size	__func__.7578, 15
-__func__.7578:
+	.type	__func__.7591, %object
+	.size	__func__.7591, 15
+__func__.7591:
 	.string	"FlashReadPages"
-	.section	.rodata.__func__.7597,"a",@progbits
+	.section	.rodata.__func__.7610,"a",@progbits
 	.align	3
 	.set	.LANCHOR142,. + 0
-	.type	__func__.7597, %object
-	.size	__func__.7597, 15
-__func__.7597:
+	.type	__func__.7610, %object
+	.size	__func__.7610, 15
+__func__.7610:
 	.string	"FlashProgPages"
-	.section	.rodata.__func__.7621,"a",@progbits
+	.section	.rodata.__func__.7634,"a",@progbits
 	.align	3
 	.set	.LANCHOR77,. + 0
-	.type	__func__.7621, %object
-	.size	__func__.7621, 17
-__func__.7621:
+	.type	__func__.7634, %object
+	.size	__func__.7634, 17
+__func__.7634:
 	.string	"FlashEraseBlocks"
-	.section	.rodata.__func__.7736,"a",@progbits
+	.section	.rodata.__func__.7749,"a",@progbits
 	.align	3
 	.set	.LANCHOR185,. + 0
-	.type	__func__.7736, %object
-	.size	__func__.7736, 14
-__func__.7736:
+	.type	__func__.7749, %object
+	.size	__func__.7749, 14
+__func__.7749:
 	.string	"FtlWriteToIDB"
 	.section	.rodata.decrement_vpc_count.str1.1,"aMS",@progbits,1
-.LC17:
+.LC21:
 	.string	"decrement_vpc_count %x = %d\n"
 	.section	.rodata.ftl_check_vpc.str1.1,"aMS",@progbits,1
-.LC25:
+.LC29:
 	.string	"...%s enter...\n"
-.LC26:
+.LC30:
 	.string	"FtlCheckVpc2 %x = %x  %x\n"
-.LC27:
+.LC31:
 	.string	"free blk vpc error %x = %x  %x\n"
 	.section	.rodata.ftl_map_blk_alloc_new_blk.str1.1,"aMS",@progbits,1
 .LC10:
 	.string	"FtlFreeSysBlkQueueOut = %x, free count = %d\n"
 	.section	.rodata.ftl_scan_all_data.str1.1,"aMS",@progbits,1
-.LC28:
+.LC32:
 	.string	"ftl_scan_all_data = %x\n"
-.LC29:
+.LC33:
 	.string	"scan lpa = %x ppa= %x\n"
-.LC30:
+.LC34:
 	.string	"lba = %x,addr= %x,spare= %x %x %x %x data=%x %x\n"
 	.section	.rodata.load_l2p_region.str1.1,"aMS",@progbits,1
-.LC20:
+.LC24:
 	.string	"region_id = %x phyAddr = %x\n"
-.LC21:
-	.string	"spare:"
-.LC22:
+.LC25:
 	.string	"map_ppn:"
-.LC23:
+.LC26:
 	.string	"load_l2p_region refresh = %x phyAddr = %x\n"
+	.section	.rodata.rk_ftl_garbage_collect.str1.1,"aMS",@progbits,1
+.LC42:
+	.string	"g_gc_superblock_free %x %x %x %x %x\n"
+.LC43:
+	.string	"lpa=%x, ppa=%x\n"
 	.section	.rodata.rknand_print_hex.str1.1,"aMS",@progbits,1
 .LC2:
 	.string	"%s 0x%x:"
@@ -13165,6 +13214,6 @@ __func__.7736:
 .LC5:
 	.string	"\n"
 	.section	.rodata.sftl_init.str1.1,"aMS",@progbits,1
-.LC41:
-	.string	"SFTL version: 5.0.50 20181227"
+.LC49:
+	.string	"SFTL version: 5.0.50 20190215"
 	.hidden	free
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 6613935254..896bcac61c 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -1742,18 +1742,19 @@ static void cb_flashing(struct usb_ep *ep, struct usb_request *req)
 static void cb_oem_perm_attr(void)
 {
 #ifdef CONFIG_RK_AVB_LIBAVB_USER
+#ifndef CONFIG_ROCKCHIP_PRELOADER_PUB_KEY
 	sha256_context ctx;
 	uint8_t digest[SHA256_SUM_LEN] = {0};
 	uint8_t digest_temp[SHA256_SUM_LEN] = {0};
 	uint8_t perm_attr_temp[PERM_ATTR_TOTAL_SIZE] = {0};
 	uint8_t flag = 0;
-
+#endif
 	if (PERM_ATTR_TOTAL_SIZE != download_bytes) {
 		printf("Permanent attribute size is not equal!\n");
 		fastboot_tx_write_str("FAILincorrect perm attribute size");
 		return;
 	}
-
+#ifndef CONFIG_ROCKCHIP_PRELOADER_PUB_KEY
 	if (rk_avb_read_perm_attr_flag(&flag)) {
 		printf("rk_avb_read_perm_attr_flag error!\n");
 		fastboot_tx_write_str("FAILperm attr read failed");
@@ -1793,7 +1794,7 @@ static void cb_oem_perm_attr(void)
 			return;
 		}
 	}
-
+#endif
 	if (rk_avb_write_permanent_attributes((uint8_t *)
 					      CONFIG_FASTBOOT_BUF_ADDR,
 					      download_bytes)) {
@@ -1804,7 +1805,7 @@ static void cb_oem_perm_attr(void)
 		fastboot_tx_write_str("FAILperm attr write failed");
 		return;
 	}
-
+#ifndef CONFIG_ROCKCHIP_PRELOADER_PUB_KEY
 	memset(digest, 0, SHA256_SUM_LEN);
 	sha256_starts(&ctx);
 	sha256_update(&ctx, (const uint8_t *)CONFIG_FASTBOOT_BUF_ADDR,
@@ -1829,7 +1830,7 @@ static void cb_oem_perm_attr(void)
 			return;
 		}
 	}
-
+#endif
 	if (rk_avb_write_perm_attr_flag(PERM_ATTR_SUCCESS_FLAG)) {
 		fastboot_tx_write_str("FAILperm attr flag write failure");
 		return;
@@ -1841,6 +1842,27 @@ static void cb_oem_perm_attr(void)
 #endif
 }
 
+static void cb_oem_perm_attr_rsa_cer(void)
+{
+#ifdef CONFIG_RK_AVB_LIBAVB_USER
+	if (download_bytes != 256) {
+		printf("Permanent attribute rsahash size is not equal!\n");
+		fastboot_tx_write_str("FAILperm attribute rsahash size error");
+		return;
+	}
+
+	if (rk_avb_set_perm_attr_cer((uint8_t *)CONFIG_FASTBOOT_BUF_ADDR,
+				     download_bytes)) {
+		fastboot_tx_write_str("FAILSet perm attr cer fail!");
+		return;
+	}
+
+	fastboot_tx_write_str("OKAY");
+#else
+	fastboot_tx_write_str("FAILnot implemented");
+#endif
+}
+
 static void cb_oem(struct usb_ep *ep, struct usb_request *req)
 {
 	char *cmd = req->buf;
@@ -2078,6 +2100,8 @@ static void cb_oem(struct usb_ep *ep, struct usb_request *req)
 #endif
 	} else if (strncmp("fuse at-perm-attr", cmd + 4, 16) == 0) {
 		cb_oem_perm_attr();
+	} else if (strncmp("fuse at-rsa-perm-attr", cmd + 4, 25) == 0) {
+		cb_oem_perm_attr_rsa_cer();
 	} else if (strncmp("fuse at-bootloader-vboot-key", cmd + 4, 27) == 0) {
 #ifdef CONFIG_RK_AVB_LIBAVB_USER
 		sha256_context ctx;
diff --git a/drivers/usb/phy/rockchip_usb2_phy.c b/drivers/usb/phy/rockchip_usb2_phy.c
index bafe3cdf85..31efee297a 100644
--- a/drivers/usb/phy/rockchip_usb2_phy.c
+++ b/drivers/usb/phy/rockchip_usb2_phy.c
@@ -9,6 +9,7 @@
 #include <asm/io.h>
 #include <dm.h>
 #include <fdtdec.h>
+#include <fdt_support.h>
 #include <syscon.h>
 
 #include "../gadget/dwc2_udc_otg_priv.h"
@@ -93,7 +94,9 @@ static int otg_phy_parse(struct dwc2_udc *dev)
 	/* Find the usb_otg node */
 	node = fdt_node_offset_by_compatible(blob, -1, "snps,dwc2");
 
+#if defined(CONFIG_ROCKCHIP_RK3288)
 retry:
+#endif
 	if (node > 0) {
 		reg = fdt_getprop(blob, node, "reg", NULL);
 		if (!reg)
diff --git a/drivers/video/drm/rockchip_display.c b/drivers/video/drm/rockchip_display.c
index d5bf157274..65378c6db4 100644
--- a/drivers/video/drm/rockchip_display.c
+++ b/drivers/video/drm/rockchip_display.c
@@ -45,6 +45,7 @@
  **********************************************************************/
 
 #define RK_BLK_SIZE 512
+#define BMP_PROCESSED_FLAG 8399
 
 DECLARE_GLOBAL_DATA_PTR;
 static LIST_HEAD(rockchip_display_list);
@@ -465,8 +466,6 @@ bool drm_mode_is_420(const struct drm_display_info *display,
 static int display_get_timing(struct display_state *state)
 {
 	struct connector_state *conn_state = &state->conn_state;
-	const struct rockchip_connector *conn = conn_state->connector;
-	const struct rockchip_connector_funcs *conn_funcs = conn->funcs;
 	struct drm_display_mode *mode = &conn_state->mode;
 	const struct drm_display_mode *m;
 	struct panel_state *panel_state = &state->panel_state;
@@ -485,18 +484,6 @@ static int display_get_timing(struct display_state *state)
 		goto done;
 	}
 
-	if (conn_funcs->get_edid && !conn_funcs->get_edid(state)) {
-		int panel_bits_per_colourp;
-
-		if (!edid_get_drm_mode((void *)&conn_state->edid,
-				     sizeof(conn_state->edid), mode,
-				     &panel_bits_per_colourp)) {
-			printf("Using display timing from edid\n");
-			edid_print_info((void *)&conn_state->edid);
-			goto done;
-		}
-	}
-
 	printf("failed to find display timing\n");
 	return -ENODEV;
 done:
@@ -524,6 +511,7 @@ static int display_init(struct display_state *state)
 	struct rockchip_crtc *crtc = crtc_state->crtc;
 	const struct rockchip_crtc_funcs *crtc_funcs = crtc->funcs;
 	struct drm_display_mode *mode = &conn_state->mode;
+	int bpc;
 	int ret = 0;
 	static bool __print_once = false;
 
@@ -576,13 +564,9 @@ static int display_init(struct display_state *state)
 			goto deinit;
 	}
 
-	if (conn_funcs->get_timing) {
-		ret = conn_funcs->get_timing(state);
-	} else if (panel_state->panel) {
+	if (panel_state->panel) {
 		ret = display_get_timing(state);
 	} else if (conn_state->bridge) {
-		int bpc;
-
 		ret = video_bridge_read_edid(conn_state->bridge->dev,
 					     conn_state->edid, EDID_SIZE);
 		if (ret > 0) {
@@ -591,6 +575,17 @@ static int display_init(struct display_state *state)
 			if (!ret)
 				edid_print_info((void *)&conn_state->edid);
 		}
+	} else if (conn_funcs->get_timing) {
+		ret = conn_funcs->get_timing(state);
+	} else if (conn_funcs->get_edid) {
+		ret = conn_funcs->get_edid(state);
+		if (!ret) {
+			ret = edid_get_drm_mode((void *)&conn_state->edid,
+						sizeof(conn_state->edid), mode,
+						&bpc);
+			if (!ret)
+				edid_print_info((void *)&conn_state->edid);
+		}
 	}
 
 	if (ret)
@@ -929,6 +924,7 @@ static int load_bmp_logo(struct logo_info *logo, const char *bmp_name)
 	void *dst = NULL, *pdst;
 	int size, len;
 	int ret = 0;
+	int reserved = 0;
 
 	if (!logo || !bmp_name)
 		return -EINVAL;
@@ -954,6 +950,9 @@ static int load_bmp_logo(struct logo_info *logo, const char *bmp_name)
 	logo->bpp = get_unaligned_le16(&header->bit_count);
 	logo->width = get_unaligned_le32(&header->width);
 	logo->height = get_unaligned_le32(&header->height);
+	reserved = get_unaligned_le32(&header->reserved);
+	if (logo->height < 0)
+	    logo->height = -logo->height;
 	size = get_unaligned_le32(&header->file_size);
 	if (!can_direct_logo(logo->bpp)) {
 		if (size > MEMORY_POOL_SIZE) {
@@ -1001,7 +1000,10 @@ static int load_bmp_logo(struct logo_info *logo, const char *bmp_name)
 		logo->ymirror = 0;
 	} else {
 		logo->offset = get_unaligned_le32(&header->data_offset);
-		logo->ymirror = 1;
+		if (reserved == BMP_PROCESSED_FLAG)
+			logo->ymirror = 0;
+		else
+			logo->ymirror = 1;
 	}
 	logo->mem = dst;
 
diff --git a/drivers/video/drm/rockchip_display.h b/drivers/video/drm/rockchip_display.h
index 1c72aa966f..cc719b8aac 100644
--- a/drivers/video/drm/rockchip_display.h
+++ b/drivers/video/drm/rockchip_display.h
@@ -129,7 +129,7 @@ struct logo_info {
 	bool ymirror;
 	u32 offset;
 	u32 width;
-	u32 height;
+	int height;
 	u32 bpp;
 };
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fc46b6774d..629b6523a2 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -78,4 +78,10 @@ config WDT_ORION
 	   Select this to enable Orion watchdog timer, which can be found on some
 	   Marvell Armada chips.
 
+config ROCKCHIP_WATCHDOG
+	bool "Rockchip watchdog"
+	depends on WDT && ARCH_ROCKCHIP
+	help
+	  Say Y here to enable Rockchip watchdog driver.
+
 endmenu
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index ab6a6b79e1..8504408958 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -22,3 +22,6 @@ obj-$(CONFIG_WDT_ASPEED) += ast_wdt.o
 obj-$(CONFIG_WDT_BCM6345) += bcm6345_wdt.o
 obj-$(CONFIG_BCM2835_WDT)       += bcm2835_wdt.o
 obj-$(CONFIG_WDT_ORION) += orion_wdt.o
+ifeq ($(CONFIG_SPL_BUILD)$(CONFIG_TPL_BUILD),)
+obj-$(CONFIG_ROCKCHIP_WATCHDOG) += rockchip_wdt.o
+endif
diff --git a/drivers/watchdog/rockchip_wdt.c b/drivers/watchdog/rockchip_wdt.c
new file mode 100644
index 0000000000..f2962d9d32
--- /dev/null
+++ b/drivers/watchdog/rockchip_wdt.c
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2019 Rockchip Electronics Co., Ltd
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <asm/io.h>
+#include <asm/utils.h>
+#include <clk.h>
+#include <dm.h>
+#include <reset.h>
+#include <wdt.h>
+
+#define WDT_CR			0x00
+#define WDT_TORR		0x04
+#define WDT_CRR			0x0C
+#define WDT_EN_MASK		0x01
+#define WDT_MODE_MASK		0x02
+#define WDT_CRR_RESTART_VAL	0x76
+
+DECLARE_GLOBAL_DATA_PTR;
+
+struct rockchip_wdt_priv {
+	void __iomem *base;
+	struct clk clk;
+	unsigned long rate;
+	struct reset_ctl rst;
+};
+
+/*
+ * Set the watchdog time interval.
+ * Counter is 32 bit.
+ */
+static int rockchip_wdt_settimeout(u64 timeout,
+				   struct rockchip_wdt_priv *priv)
+{
+	signed int i;
+
+	/* calculate the timeout range value */
+	i = log_2_n_round_up(timeout * priv->rate / 1000) - 16;
+	if (i > 15)
+		i = 15;
+	if (i < 0)
+		i = 0;
+
+	writel((i | (i << 4)), priv->base + WDT_TORR);
+
+	return 0;
+}
+
+static void rockchip_wdt_enable(struct rockchip_wdt_priv *priv)
+{
+	u32 val = readl(priv->base + WDT_CR);
+
+	/* Disable interrupt mode; always perform system reset. */
+	val &= ~WDT_MODE_MASK;
+	/* Enable watchdog. */
+	val |= WDT_EN_MASK;
+
+	writel(val, priv->base + WDT_CR);
+}
+
+static unsigned int rockchip_wdt_is_enabled(struct rockchip_wdt_priv *priv)
+{
+	unsigned long val;
+
+	val = readl(priv->base + WDT_CR);
+
+	return val & WDT_EN_MASK;
+}
+
+static int rockchip_wdt_reset(struct udevice *dev)
+{
+	struct rockchip_wdt_priv *priv = dev_get_priv(dev);
+
+	if (rockchip_wdt_is_enabled(priv))
+		/* restart the watchdog counter */
+		writel(WDT_CRR_RESTART_VAL, priv->base + WDT_CRR);
+
+	return 0;
+}
+
+static int rockchip_wdt_start(struct udevice *dev, u64 timeout, ulong flags)
+{
+	struct rockchip_wdt_priv *priv = dev_get_priv(dev);
+
+	printf("Rockchip watchdog timeout: %lld sec\n", timeout / 1000);
+
+	reset_deassert(&priv->rst);
+
+	rockchip_wdt_reset(dev);
+	rockchip_wdt_settimeout(timeout, priv);
+	rockchip_wdt_enable(priv);
+	rockchip_wdt_reset(dev);
+
+	return 0;
+}
+
+static int rockchip_wdt_stop(struct udevice *dev)
+{
+	struct rockchip_wdt_priv *priv = dev_get_priv(dev);
+
+	reset_assert(&priv->rst);
+	reset_deassert(&priv->rst);
+
+	printf("Rockchip watchdog stop\n");
+
+	return 0;
+}
+
+static const struct wdt_ops rockchip_wdt_ops = {
+	.start = rockchip_wdt_start,
+	.reset = rockchip_wdt_reset,
+	.stop = rockchip_wdt_stop,
+};
+
+static int rockchip_wdt_ofdata_to_platdata(struct udevice *dev)
+{
+	struct rockchip_wdt_priv *priv = dev_get_priv(dev);
+
+	priv->base = dev_read_addr_ptr(dev);
+	if (!priv->base)
+		return -ENOENT;
+
+	return 0;
+}
+
+static int rockchip_wdt_probe(struct udevice *dev)
+{
+	struct rockchip_wdt_priv *priv = dev_get_priv(dev);
+	int ret;
+
+	ret = reset_get_by_name(dev, "reset", &priv->rst);
+	if (ret) {
+		pr_err("reset_get_by_name(reset) failed: %d\n", ret);
+		return ret;
+	}
+
+	ret = clk_get_by_index(dev, 0, &priv->clk);
+	if (ret < 0)
+		return ret;
+
+	/* Need clk framework support */
+	priv->rate = clk_get_rate(&priv->clk);
+	if (priv->rate < 0)
+		return -EINVAL;
+
+	return 0;
+}
+
+static const struct udevice_id rockchip_wdt_ids[] = {
+	{ .compatible = "snps,dw-wdt" },
+	{}
+};
+
+U_BOOT_DRIVER(rockchip_wdt) = {
+	.name = "rockchip_wdt",
+	.id = UCLASS_WDT,
+	.of_match = rockchip_wdt_ids,
+	.probe = rockchip_wdt_probe,
+	.priv_auto_alloc_size = sizeof(struct rockchip_wdt_priv),
+	.ofdata_to_platdata = rockchip_wdt_ofdata_to_platdata,
+	.ops = &rockchip_wdt_ops,
+};
diff --git a/include/amp.h b/include/amp.h
new file mode 100644
index 0000000000..629dcdcd04
--- /dev/null
+++ b/include/amp.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier:     GPL-2.0+ */
+/*
+ * (C) Copyright 2019 Rockchip Electronics Co., Ltd
+ */
+
+#ifndef _AMP_H_
+#define _AMP_H_
+
+#include <dm.h>
+
+struct dm_amp_ops {
+	int (*cpu_on)(struct udevice *dev);
+};
+
+struct dm_amp_uclass_platdata {
+	const char *desc;
+	const char *partition;
+	u32 cpu;		/* cpu mpidr */
+	u32 aarch;
+	u32 load;
+	u32 entry;
+	u32 reserved_mem[2];	/* [0]: start, [1]: size */
+};
+
+int amp_bind_children(struct udevice *dev, const char *drv_name);
+int amp_cpus_on(void);
+int amp_cpu_on(u32 cpu);
+
+#endif	/* _AMP_H_ */
diff --git a/include/android_avb/avb_ab_flow.h b/include/android_avb/avb_ab_flow.h
index 0ba5ccd47c..152901b7c7 100755
--- a/include/android_avb/avb_ab_flow.h
+++ b/include/android_avb/avb_ab_flow.h
@@ -1,277 +1,278 @@
-/*

- * Copyright (C) 2016 The Android Open Source Project

- *

- * Permission is hereby granted, free of charge, to any person

- * obtaining a copy of this software and associated documentation

- * files (the "Software"), to deal in the Software without

- * restriction, including without limitation the rights to use, copy,

- * modify, merge, publish, distribute, sublicense, and/or sell copies

- * of the Software, and to permit persons to whom the Software is

- * furnished to do so, subject to the following conditions:

- *

- * The above copyright notice and this permission notice shall be

- * included in all copies or substantial portions of the Software.

- *

- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

- * SOFTWARE.

- */

-

-/*

-#if !defined(AVB_INSIDE_LIBAVB_AB_H) && !defined(AVB_COMPILATION)

-#error \

-    "Never include this file directly, include libavb_ab/libavb_ab.h instead."

-#endif

-*/

-

-#ifndef AVB_AB_FLOW_H_

-#define AVB_AB_FLOW_H_

-

-#include <android_avb/avb_ab_ops.h>

-

-#ifdef __cplusplus

-extern "C" {

-#endif

-

-/* Magic for the A/B struct when serialized. */

-#define AVB_AB_MAGIC "\0AB0"

-#define AVB_AB_MAGIC_LEN 4

-

-/* Versioning for the on-disk A/B metadata - keep in sync with avbtool. */

-#define AVB_AB_MAJOR_VERSION 1

-#define AVB_AB_MINOR_VERSION 0

-

-/* Size of AvbABData struct. */

-#define AVB_AB_DATA_SIZE 32

-

-/* Maximum values for slot data */

-#define AVB_AB_MAX_PRIORITY 15

-#define AVB_AB_MAX_TRIES_REMAINING 7

-

-/* Struct used for recording per-slot metadata.

- *

- * When serialized, data is stored in network byte-order.

- */

-typedef struct AvbABSlotData {

-  /* Slot priority. Valid values range from 0 to AVB_AB_MAX_PRIORITY,

-   * both inclusive with 1 being the lowest and AVB_AB_MAX_PRIORITY

-   * being the highest. The special value 0 is used to indicate the

-   * slot is unbootable.

-   */

-  uint8_t priority;

-

-  /* Number of times left attempting to boot this slot ranging from 0

-   * to AVB_AB_MAX_TRIES_REMAINING.

-   */

-  uint8_t tries_remaining;

-

-  /* Non-zero if this slot has booted successfully, 0 otherwise. */

-  uint8_t successful_boot;

-

-  /* Reserved for future use. */

-  uint8_t reserved[1];

-} AVB_ATTR_PACKED AvbABSlotData;

-

-/* Struct used for recording A/B metadata.

- *

- * When serialized, data is stored in network byte-order.

- */

-typedef struct AvbABData {

-  /* Magic number used for identification - see AVB_AB_MAGIC. */

-  uint8_t magic[AVB_AB_MAGIC_LEN];

-

-  /* Version of on-disk struct - see AVB_AB_{MAJOR,MINOR}_VERSION. */

-  uint8_t version_major;

-  uint8_t version_minor;

-

-  /* Padding to ensure |slots| field start eight bytes in. */

-  uint8_t reserved1[2];

-

-  /* Per-slot metadata. */

-  AvbABSlotData slots[2];

-

-  /* Reserved for future use. */

-  uint8_t reserved2[12];

-

-  /* CRC32 of all 28 bytes preceding this field. */

-  uint32_t crc32;

-} AVB_ATTR_PACKED AvbABData;

-

-/* Copies |src| to |dest|, byte-swapping fields in the

- * process. Returns false if the data is invalid (e.g. wrong magic,

- * wrong CRC32 etc.), true otherwise.

- */

-bool avb_ab_data_verify_and_byteswap(const AvbABData* src, AvbABData* dest);

-

-/* Copies |src| to |dest|, byte-swapping fields in the process. Also

- * updates the |crc32| field in |dest|.

- */

-void avb_ab_data_update_crc_and_byteswap(const AvbABData* src, AvbABData* dest);

-

-/* Initializes |data| such that it has two slots and both slots have

- * maximum tries remaining. The CRC is not set.

- */

-void avb_ab_data_init(AvbABData* data);

-

-/* Reads A/B metadata from the 'misc' partition using |ops|. Returned

- * data is properly byteswapped. Returns AVB_IO_RESULT_OK on

- * success, error code otherwise.

- *

- * If the data read from disk is invalid (e.g. wrong magic or CRC

- * checksum failure), the metadata will be reset using

- * avb_ab_data_init() and then written to disk.

- */

-AvbIOResult avb_ab_data_read(AvbABOps* ab_ops, AvbABData* data);

-

-/* Writes A/B metadata to the 'misc' partition using |ops|. This will

- * byteswap and update the CRC as needed. Returns AVB_IO_RESULT_OK on

- * success, error code otherwise.

- */

-AvbIOResult avb_ab_data_write(AvbABOps* ab_ops, const AvbABData* data);

-

-/* Return codes used in avb_ab_flow(), see that function for

- * documentation of each value.

- */

-typedef enum {

-  AVB_AB_FLOW_RESULT_OK,

-  AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR,

-  AVB_AB_FLOW_RESULT_ERROR_OOM,

-  AVB_AB_FLOW_RESULT_ERROR_IO,

-  AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS,

-  AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT

-} AvbABFlowResult;

-

-/* Get a textual representation of |result|. */

-const char* avb_ab_flow_result_to_string(AvbABFlowResult result);

-

-/* High-level function to select a slot to boot. The following

- * algorithm is used:

- *

- * 1. A/B metadata is loaded and validated using the

- * read_ab_metadata() operation. Typically this means it's read from

- * the 'misc' partition and if it's invalid then it's reset using

- * avb_ab_data_init() and this reset metadata is returned.

- *

- * 2. All bootable slots listed in the A/B metadata are verified using

- * avb_slot_verify(). If a slot is invalid or if it fails verification

- * (and AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR is not set, see

- * below), it will be marked as unbootable in the A/B metadata and the

- * metadata will be saved to disk before returning.

- *

- * 3. If there are no bootable slots, the value

- * AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS is returned.

- *

- * 4. For each bootable slot, the Stored Rollback Indexes are updated

- * such that for each rollback index location, the Stored Rollback

- * Index is the largest number smaller than or equal to the Rollback

- * Index of each slot.

- *

- * 5. The bootable slot with the highest priority is selected and

- * returned in |out_data|. If this slot is already marked as

- * successful, the A/B metadata is not modified. However, if the slot

- * is not marked as bootable its |tries_remaining| count is

- * decremented and the A/B metadata is saved to disk before returning.

- * In either case the value AVB_AB_FLOW_RESULT_OK is returning.

- *

- * The partitions to load is given in |requested_partitions| as a

- * NULL-terminated array of NUL-terminated strings. Typically the

- * |requested_partitions| array only contains a single item for the

- * boot partition, 'boot'.

- *

- * If the device is unlocked (and _only_ if it's unlocked), the

- * AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR flag should be set

- * in the |flags| parameter. This will allow considering slots as

- * verified even when avb_slot_verify() returns

- * AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED,

- * AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION, or

- * AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX for the slot in

- * question.

- *

- * Note that neither androidboot.slot_suffix nor androidboot.slot are

- * set in the |cmdline| field in |AvbSlotVerifyData| - you will have

- * to pass these yourself.

- *

- * If a slot was selected and it verified then AVB_AB_FLOW_RESULT_OK

- * is returned.

- *

- * If a slot was selected but it didn't verify then

- * AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR is returned. This can

- * only happen when the AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR

- * flag is set.

- *

- * If an I/O operation - such as loading/saving metadata or checking

- * rollback indexes - fail, the value AVB_AB_FLOW_RESULT_ERROR_IO is

- * returned.

- *

- * If memory allocation fails, AVB_AB_FLOW_RESULT_ERROR_OOM is

- * returned.

- *

- * If invalid arguments are passed,

- * AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT is returned. For example

- * this can happen if using AVB_HASHTREE_ERROR_MODE_LOGGING without

- * AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR.

- *

- * Reasonable behavior for handling AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS

- * is to initiate device repair (which is device-dependent).

- */

-AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,

-                            const char* const* requested_partitions,

-                            AvbSlotVerifyFlags flags,

-                            AvbHashtreeErrorMode hashtree_error_mode,

-                            AvbSlotVerifyData** out_data);

-

-/* Marks the slot with the given slot number as active. Returns

- * AVB_IO_RESULT_OK on success, error code otherwise.

- *

- * This function is typically used by the OS updater when completing

- * an update. It can also used by the firmware for implementing the

- * "set_active" command.

- */

-AvbIOResult avb_ab_mark_slot_active(AvbABOps* ab_ops, unsigned int slot_number);

-

-/* Marks the slot with the given slot number as unbootable. Returns

- * AVB_IO_RESULT_OK on success, error code otherwise.

- *

- * This function is typically used by the OS updater before writing to

- * a slot.

- */

-AvbIOResult avb_ab_mark_slot_unbootable(AvbABOps* ab_ops,

-                                        unsigned int slot_number);

-

-/* Marks the slot with the given slot number as having booted

- * successfully. Returns AVB_IO_RESULT_OK on success, error code

- * otherwise.

- *

- * Calling this on an unbootable slot is an error - AVB_IO_RESULT_OK

- * will be returned yet the function will have no side-effects.

- *

- * This function is typically used by the OS updater after having

- * confirmed that the slot works as intended.

- */

-AvbIOResult avb_ab_mark_slot_successful(AvbABOps* ab_ops,

-                                        unsigned int slot_number);

-

-/*

- * Load metadata.

- */

-AvbIOResult load_metadata(AvbABOps* ab_ops,

-			  AvbABData* ab_data,

-			  AvbABData* ab_data_orig);

-

-/* Writes A/B metadata to disk only if it has changed - returns

- * AVB_IO_RESULT_OK on success, error code otherwise.

- */

-AvbIOResult save_metadata_if_changed(AvbABOps* ab_ops,

-				     AvbABData* ab_data,

-				     AvbABData* ab_data_orig);

-

-#ifdef __cplusplus

-}

-#endif

-

-#endif /* AVB_AB_FLOW_H_ */

+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/*
+#if !defined(AVB_INSIDE_LIBAVB_AB_H) && !defined(AVB_COMPILATION)
+#error \
+    "Never include this file directly, include libavb_ab/libavb_ab.h instead."
+#endif
+*/
+
+#ifndef AVB_AB_FLOW_H_
+#define AVB_AB_FLOW_H_
+
+#include <android_avb/avb_ab_ops.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Magic for the A/B struct when serialized. */
+#define AVB_AB_MAGIC "\0AB0"
+#define AVB_AB_MAGIC_LEN 4
+
+/* Versioning for the on-disk A/B metadata - keep in sync with avbtool. */
+#define AVB_AB_MAJOR_VERSION 1
+#define AVB_AB_MINOR_VERSION 0
+
+/* Size of AvbABData struct. */
+#define AVB_AB_DATA_SIZE 32
+
+/* Maximum values for slot data */
+#define AVB_AB_MAX_PRIORITY 15
+#define AVB_AB_MAX_TRIES_REMAINING 7
+
+/* Struct used for recording per-slot metadata.
+ *
+ * When serialized, data is stored in network byte-order.
+ */
+typedef struct AvbABSlotData {
+  /* Slot priority. Valid values range from 0 to AVB_AB_MAX_PRIORITY,
+   * both inclusive with 1 being the lowest and AVB_AB_MAX_PRIORITY
+   * being the highest. The special value 0 is used to indicate the
+   * slot is unbootable.
+   */
+  uint8_t priority;
+
+  /* Number of times left attempting to boot this slot ranging from 0
+   * to AVB_AB_MAX_TRIES_REMAINING.
+   */
+  uint8_t tries_remaining;
+
+  /* Non-zero if this slot has booted successfully, 0 otherwise. */
+  uint8_t successful_boot;
+
+  /* Reserved for future use. */
+  uint8_t reserved[1];
+} AVB_ATTR_PACKED AvbABSlotData;
+
+/* Struct used for recording A/B metadata.
+ *
+ * When serialized, data is stored in network byte-order.
+ */
+typedef struct AvbABData {
+  /* Magic number used for identification - see AVB_AB_MAGIC. */
+  uint8_t magic[AVB_AB_MAGIC_LEN];
+
+  /* Version of on-disk struct - see AVB_AB_{MAJOR,MINOR}_VERSION. */
+  uint8_t version_major;
+  uint8_t version_minor;
+
+  /* Padding to ensure |slots| field start eight bytes in. */
+  uint8_t reserved1[2];
+
+  /* Per-slot metadata. */
+  AvbABSlotData slots[2];
+
+  /* Reserved for future use. */
+  uint8_t last_boot;
+  uint8_t reserved2[11];
+
+  /* CRC32 of all 28 bytes preceding this field. */
+  uint32_t crc32;
+} AVB_ATTR_PACKED AvbABData;
+
+/* Copies |src| to |dest|, byte-swapping fields in the
+ * process. Returns false if the data is invalid (e.g. wrong magic,
+ * wrong CRC32 etc.), true otherwise.
+ */
+bool avb_ab_data_verify_and_byteswap(const AvbABData* src, AvbABData* dest);
+
+/* Copies |src| to |dest|, byte-swapping fields in the process. Also
+ * updates the |crc32| field in |dest|.
+ */
+void avb_ab_data_update_crc_and_byteswap(const AvbABData* src, AvbABData* dest);
+
+/* Initializes |data| such that it has two slots and both slots have
+ * maximum tries remaining. The CRC is not set.
+ */
+void avb_ab_data_init(AvbABData* data);
+
+/* Reads A/B metadata from the 'misc' partition using |ops|. Returned
+ * data is properly byteswapped. Returns AVB_IO_RESULT_OK on
+ * success, error code otherwise.
+ *
+ * If the data read from disk is invalid (e.g. wrong magic or CRC
+ * checksum failure), the metadata will be reset using
+ * avb_ab_data_init() and then written to disk.
+ */
+AvbIOResult avb_ab_data_read(AvbABOps* ab_ops, AvbABData* data);
+
+/* Writes A/B metadata to the 'misc' partition using |ops|. This will
+ * byteswap and update the CRC as needed. Returns AVB_IO_RESULT_OK on
+ * success, error code otherwise.
+ */
+AvbIOResult avb_ab_data_write(AvbABOps* ab_ops, const AvbABData* data);
+
+/* Return codes used in avb_ab_flow(), see that function for
+ * documentation of each value.
+ */
+typedef enum {
+  AVB_AB_FLOW_RESULT_OK,
+  AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR,
+  AVB_AB_FLOW_RESULT_ERROR_OOM,
+  AVB_AB_FLOW_RESULT_ERROR_IO,
+  AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS,
+  AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT
+} AvbABFlowResult;
+
+/* Get a textual representation of |result|. */
+const char* avb_ab_flow_result_to_string(AvbABFlowResult result);
+
+/* High-level function to select a slot to boot. The following
+ * algorithm is used:
+ *
+ * 1. A/B metadata is loaded and validated using the
+ * read_ab_metadata() operation. Typically this means it's read from
+ * the 'misc' partition and if it's invalid then it's reset using
+ * avb_ab_data_init() and this reset metadata is returned.
+ *
+ * 2. All bootable slots listed in the A/B metadata are verified using
+ * avb_slot_verify(). If a slot is invalid or if it fails verification
+ * (and AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR is not set, see
+ * below), it will be marked as unbootable in the A/B metadata and the
+ * metadata will be saved to disk before returning.
+ *
+ * 3. If there are no bootable slots, the value
+ * AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS is returned.
+ *
+ * 4. For each bootable slot, the Stored Rollback Indexes are updated
+ * such that for each rollback index location, the Stored Rollback
+ * Index is the largest number smaller than or equal to the Rollback
+ * Index of each slot.
+ *
+ * 5. The bootable slot with the highest priority is selected and
+ * returned in |out_data|. If this slot is already marked as
+ * successful, the A/B metadata is not modified. However, if the slot
+ * is not marked as bootable its |tries_remaining| count is
+ * decremented and the A/B metadata is saved to disk before returning.
+ * In either case the value AVB_AB_FLOW_RESULT_OK is returning.
+ *
+ * The partitions to load is given in |requested_partitions| as a
+ * NULL-terminated array of NUL-terminated strings. Typically the
+ * |requested_partitions| array only contains a single item for the
+ * boot partition, 'boot'.
+ *
+ * If the device is unlocked (and _only_ if it's unlocked), the
+ * AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR flag should be set
+ * in the |flags| parameter. This will allow considering slots as
+ * verified even when avb_slot_verify() returns
+ * AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED,
+ * AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION, or
+ * AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX for the slot in
+ * question.
+ *
+ * Note that neither androidboot.slot_suffix nor androidboot.slot are
+ * set in the |cmdline| field in |AvbSlotVerifyData| - you will have
+ * to pass these yourself.
+ *
+ * If a slot was selected and it verified then AVB_AB_FLOW_RESULT_OK
+ * is returned.
+ *
+ * If a slot was selected but it didn't verify then
+ * AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR is returned. This can
+ * only happen when the AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR
+ * flag is set.
+ *
+ * If an I/O operation - such as loading/saving metadata or checking
+ * rollback indexes - fail, the value AVB_AB_FLOW_RESULT_ERROR_IO is
+ * returned.
+ *
+ * If memory allocation fails, AVB_AB_FLOW_RESULT_ERROR_OOM is
+ * returned.
+ *
+ * If invalid arguments are passed,
+ * AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT is returned. For example
+ * this can happen if using AVB_HASHTREE_ERROR_MODE_LOGGING without
+ * AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR.
+ *
+ * Reasonable behavior for handling AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS
+ * is to initiate device repair (which is device-dependent).
+ */
+AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
+                            const char* const* requested_partitions,
+                            AvbSlotVerifyFlags flags,
+                            AvbHashtreeErrorMode hashtree_error_mode,
+                            AvbSlotVerifyData** out_data);
+
+/* Marks the slot with the given slot number as active. Returns
+ * AVB_IO_RESULT_OK on success, error code otherwise.
+ *
+ * This function is typically used by the OS updater when completing
+ * an update. It can also used by the firmware for implementing the
+ * "set_active" command.
+ */
+AvbIOResult avb_ab_mark_slot_active(AvbABOps* ab_ops, unsigned int slot_number);
+
+/* Marks the slot with the given slot number as unbootable. Returns
+ * AVB_IO_RESULT_OK on success, error code otherwise.
+ *
+ * This function is typically used by the OS updater before writing to
+ * a slot.
+ */
+AvbIOResult avb_ab_mark_slot_unbootable(AvbABOps* ab_ops,
+                                        unsigned int slot_number);
+
+/* Marks the slot with the given slot number as having booted
+ * successfully. Returns AVB_IO_RESULT_OK on success, error code
+ * otherwise.
+ *
+ * Calling this on an unbootable slot is an error - AVB_IO_RESULT_OK
+ * will be returned yet the function will have no side-effects.
+ *
+ * This function is typically used by the OS updater after having
+ * confirmed that the slot works as intended.
+ */
+AvbIOResult avb_ab_mark_slot_successful(AvbABOps* ab_ops,
+                                        unsigned int slot_number);
+
+/*
+ * Load metadata.
+ */
+AvbIOResult load_metadata(AvbABOps* ab_ops,
+			  AvbABData* ab_data,
+			  AvbABData* ab_data_orig);
+
+/* Writes A/B metadata to disk only if it has changed - returns
+ * AVB_IO_RESULT_OK on success, error code otherwise.
+ */
+AvbIOResult save_metadata_if_changed(AvbABOps* ab_ops,
+				     AvbABData* ab_data,
+				     AvbABData* ab_data_orig);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* AVB_AB_FLOW_H_ */
diff --git a/include/android_avb/rk_avb_ops_user.h b/include/android_avb/rk_avb_ops_user.h
index 0a70e7096b..441856c33c 100644
--- a/include/android_avb/rk_avb_ops_user.h
+++ b/include/android_avb/rk_avb_ops_user.h
@@ -30,6 +30,13 @@ extern "C" {
 #define RPMB_BASE_ADDR		(64*1024/256)
 #define UBOOT_RB_INDEX_OFFSET 24
 #define TRUST_RB_INDEX_OFFSET 28
+#define ROCHCHIP_RSA_PARAMETER_SIZE 64
+
+struct rk_pub_key {
+	u_int32_t rsa_n[ROCHCHIP_RSA_PARAMETER_SIZE];
+	u_int32_t rsa_e[ROCHCHIP_RSA_PARAMETER_SIZE];
+	u_int32_t rsa_c[ROCHCHIP_RSA_PARAMETER_SIZE];
+};
 
 /**
  * Provided to fastboot to read how many slot in this system.
@@ -267,6 +274,38 @@ int rk_auth_unlock(void *buffer, char *out_is_trusted);
  */
 int rk_generate_unlock_challenge(void *buffer, uint32_t *challenge_len);
 
+/**
+ * Get last boot slot
+ *
+ * @return 0 is slot A; 1 is slot B; -1 is error
+ */
+int rk_get_lastboot(void);
+
+/**
+ * Get permanent attribute certificate
+ *
+ * @param cer: certificate data
+ *
+ * @param size: certificate size
+ */
+int rk_avb_get_perm_attr_cer(uint8_t *cer, uint32_t size);
+
+/**
+ * Set permanent attribute certificate
+ *
+ * @param cer: certificate data
+ *
+ * @param size: certificate size
+ */
+int rk_avb_set_perm_attr_cer(uint8_t *cer, uint32_t size);
+
+/**
+ * Get public key
+ *
+ * @param pub_key: public key data
+ */
+int rk_avb_get_pub_key(struct rk_pub_key *pub_key);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/bidram.h b/include/bidram.h
new file mode 100644
index 0000000000..3b39d442fd
--- /dev/null
+++ b/include/bidram.h
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier:     GPL-2.0+ */
+/*
+ * (C) Copyright 2019 Rockchip Electronics Co., Ltd
+ */
+
+#ifndef _BIDRAM_H
+#define _BIDRAM_H
+
+#include <memblk.h>
+
+typedef struct memblock *(*parse_fn_t)(int *);
+
+struct bidram {
+	struct lmb lmb;
+	struct list_head reserved_head;
+	bool has_init;
+};
+
+/**
+ * bidram_initr() - Initial bidram after relocation.
+ *
+ * @return 0 on success, otherwise error
+ */
+int bidram_initr(void);
+
+/**
+ * bidram_get_ram_size() - Initial bidram and get ram size.
+ *
+ * @parse_fn: function to parse ddr memory regions
+ *
+ * @return ram size, 0 on success, otherwise the effect ram size.
+ */
+phys_size_t bidram_get_ram_size(void);
+
+/**
+ * bidram_gen_gd_bi_dram() - Update gd->bd->bi_dram[] according to bidram state.
+ */
+void bidram_gen_gd_bi_dram(void);
+
+/**
+ * bidram_reserve() - Reserve bidram region
+ *
+ * @id: memblk id
+ * @base: region base address
+ * @size: region size
+ *
+ * @return 0 on success, otherwise error
+ */
+int bidram_reserve(enum memblk_id id, phys_addr_t base, phys_size_t size);
+
+/**
+ * bidram_reserve_by_name() - Reserve bidram region by name
+ *
+ * @name: region name
+ * @base: region base address
+ * @size: region size
+ *
+ * @return 0 on success, otherwise error
+ */
+int bidram_reserve_by_name(const char *name, phys_addr_t base, phys_size_t size);
+
+/**
+ * bidram_dump_all() - Dump all bidram stat
+ */
+void bidram_dump(void);
+
+/**
+ * board_bidram_parse_fn() - Weak function for board to implement
+ */
+parse_fn_t board_bidram_parse_fn(void);
+
+/**
+ * board_bidram_reserve() - Weak function for board to implement
+ *
+ * @bidram: global bidram point, ignored
+ *
+ * @return 0 on success, otherwise error
+ */
+int board_bidram_reserve(struct bidram *bidram);
+
+#endif /* _BIDRAM_H */
diff --git a/include/boot_rkimg.h b/include/boot_rkimg.h
index e88375159f..795ad62901 100644
--- a/include/boot_rkimg.h
+++ b/include/boot_rkimg.h
@@ -29,6 +29,9 @@ enum _boot_mode {
 
 int rockchip_get_boot_mode(void);
 int boot_rockchip_image(struct blk_desc *dev, disk_partition_t *boot_part);
+int read_rockchip_image(struct blk_desc *dev_desc,
+			disk_partition_t *part_info, void *dst);
+
 struct blk_desc *rockchip_get_bootdev(void);
 
 /*
diff --git a/include/configs/evb_px5.h b/include/configs/evb_px5.h
index 4160187d50..b6866b5f0d 100644
--- a/include/configs/evb_px5.h
+++ b/include/configs/evb_px5.h
@@ -10,5 +10,6 @@
 #include <configs/rk3368_common.h>
 
 #define CONFIG_CONSOLE_SCROLL_LINES	10
+#define CONFIG_SYS_MMC_ENV_DEV 0
 
 #endif
diff --git a/include/configs/rk3368_common.h b/include/configs/rk3368_common.h
index e7f4178f0c..5ef4a3b9f2 100644
--- a/include/configs/rk3368_common.h
+++ b/include/configs/rk3368_common.h
@@ -15,7 +15,7 @@
 #include <linux/sizes.h>
 
 #define CONFIG_SYS_SDRAM_BASE		0
-#define SDRAM_MAX_SIZE			0xff000000
+#define SDRAM_MAX_SIZE			0xfe000000
 #define CONFIG_BAUDRATE			115200
 #define CONFIG_SYS_MALLOC_LEN		(192 << 20)
 #define CONFIG_SYS_CBSIZE		1024
@@ -28,9 +28,10 @@
 
 #define CONFIG_SPL_FRAMEWORK
 #define CONFIG_SPL_TEXT_BASE            0x00000000
-#define CONFIG_SPL_MAX_SIZE             0x40000
+#define CONFIG_SPL_MAX_SIZE             0x60000
 #define CONFIG_SPL_BSS_START_ADDR       0x400000
 #define CONFIG_SPL_BSS_MAX_SIZE         0x20000
+#define CONFIG_SPL_STACK		0x00188000
 
 #define GICD_BASE			0xffB71000
 #define GICC_BASE			0xffB72000
diff --git a/include/configs/rv1108_common.h b/include/configs/rv1108_common.h
index 44cd4e3f6f..0463f236b8 100644
--- a/include/configs/rv1108_common.h
+++ b/include/configs/rv1108_common.h
@@ -22,7 +22,7 @@
 /* SPL support */
 #define CONFIG_SPL_STACK		0x10080700
 #define CONFIG_SPL_TEXT_BASE		0x10080800
-#define CONFIG_SPL_MAX_SIZE		0x1700
+#define CONFIG_SPL_MAX_SIZE		0x4000
 
 /* BSS setup */
 #define CONFIG_SPL_BSS_MAX_SIZE		0x100
diff --git a/include/console.h b/include/console.h
index d72c8cdf35..3af98a622a 100644
--- a/include/console.h
+++ b/include/console.h
@@ -12,6 +12,8 @@ extern char console_buffer[];
 
 #define CONSOLE_EVT_CTRL_B	0x02
 #define CONSOLE_EVT_CTRL_D	0x04
+#define CONSOLE_EVT_CTRL_F	0x06
+#define CONSOLE_EVT_CTRL_M	0x0D
 
 /* common/console.c */
 int console_init_f(void);	/* Before relocation; uses the serial  stuff */
diff --git a/include/dm/uclass-id.h b/include/dm/uclass-id.h
index 70910f319e..b51b9873f2 100644
--- a/include/dm/uclass-id.h
+++ b/include/dm/uclass-id.h
@@ -31,6 +31,7 @@ enum uclass_id {
 	UCLASS_BLK,		/* Block device */
 	UCLASS_CLK,		/* Clock source, e.g. used by peripherals */
 	UCLASS_CPU,		/* CPU, typically part of an SoC */
+	UCLASS_AMP,		/* Asymmetric Multi-Processing */
 	UCLASS_CODEC,		/* audio codec */
 	UCLASS_CROS_EC,		/* Chrome OS EC */
 	UCLASS_DISPLAY,		/* Display (e.g. DisplayPort, HDMI) */
diff --git a/include/dt-bindings/clock/rk1808-cru.h b/include/dt-bindings/clock/rk1808-cru.h
index 3dd5c76d52..994896d111 100644
--- a/include/dt-bindings/clock/rk1808-cru.h
+++ b/include/dt-bindings/clock/rk1808-cru.h
@@ -111,6 +111,7 @@
 #define SCLK_MIPIDSIPHY_REF	110
 #define SCLK_PCIEPHY_REF	111
 #define SCLK_RTC32K_FRAC	112
+#define SCLK_32K_IOE		113
 
 /* aclk gates */
 #define ACLK_GIC_PRE		145
diff --git a/include/image.h b/include/image.h
index 8daffcceee..11c65292ba 100644
--- a/include/image.h
+++ b/include/image.h
@@ -693,6 +693,8 @@ int boot_get_fdt(int flag, int argc, char * const argv[], uint8_t arch,
 void boot_fdt_add_mem_rsv_regions(struct lmb *lmb, void *fdt_blob);
 #ifdef CONFIG_SYSMEM
 int boot_fdt_add_sysmem_rsv_regions(void *fdt_blob);
+#else
+static inline int boot_fdt_add_sysmem_rsv_regions(void *fdt_blob) { return 0; }
 #endif
 int boot_relocate_fdt(struct lmb *lmb, char **of_flat_tree, ulong *of_size);
 
diff --git a/include/irq-platform.h b/include/irq-platform.h
index b07d576057..5ae9e973b1 100644
--- a/include/irq-platform.h
+++ b/include/irq-platform.h
@@ -104,7 +104,8 @@
 #define GPIO_BANK_NUM			4
 #define GPIO_BANK_PINS			32
 
-#define IRQ_TIMER1			79
+#define IRQ_TIMER0			98
+#define IRQ_TIMER1			99
 #define IRQ_PWM				110
 #define IRQ_GPIO0			113
 #define IRQ_GPIO1			114
diff --git a/include/key.h b/include/key.h
index f85e1f3164..c9e11bd874 100644
--- a/include/key.h
+++ b/include/key.h
@@ -18,49 +18,43 @@ enum {
 	GPIO_KEY  = 0x2,
 };
 
-enum key_state {
+enum key_event {
 	KEY_PRESS_NONE,	/* press without release */
 	KEY_PRESS_DOWN,	/* press -> release */
 	KEY_PRESS_LONG_DOWN,
 	KEY_NOT_EXIST,
 };
 
-struct input_key {
-	struct udevice *parent;
-	struct list_head link;
+struct dm_key_uclass_platdata {
 	const char *name;
 	bool pre_reloc;
 	u32 code;
 	u8 type;
 
 	/* ADC key */
-	u32 adcval;
-	u32 vref;
 	u8 channel;
+	u32 adcval;
+	u32 min;
+	u32 max;
 
 	/* GPIO key */
 	u32 irq;
+	u32 gpios[2];
 	struct gpio_desc gpio;
 
-	/* Event */
-	u64 up_t;
-	u64 down_t;
-};
-
-struct dm_key_ops {
-	const char *name;
+	u64 rise_ms;
+	u64 fall_ms;
 };
 
 /* Use it instead of get_timer() in key interrupt handler */
 uint64_t key_timer(uint64_t base);
 
-/* Reister you key to dm key framework */
-void key_add(struct input_key *key);
-
 /* Confirm if your key value is a press event */
 int key_is_pressed(int keyval);
 
 /* Read key */
 int key_read(int code);
 
+int key_bind_children(struct udevice *dev, const char *drv_name);
+
 #endif
diff --git a/include/lmb.h b/include/lmb.h
index 6b6959fd86..ece2a54e5b 100644
--- a/include/lmb.h
+++ b/include/lmb.h
@@ -11,7 +11,7 @@
  * SPDX-License-Identifier:	GPL-2.0+
  */
 
-#define MAX_LMB_REGIONS 8
+#define MAX_LMB_REGIONS 16
 
 struct lmb_property {
 	phys_addr_t base;
diff --git a/include/memblk.h b/include/memblk.h
new file mode 100644
index 0000000000..bba5de000e
--- /dev/null
+++ b/include/memblk.h
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier:     GPL-2.0+ */
+/*
+ * (C) Copyright 2019 Rockchip Electronics Co., Ltd
+ */
+
+#ifndef _MEMBLK_H
+#define _MEMBLK_H
+
+enum memblk_id {
+	MEMBLK_ID_UNK,
+
+	/* Preloader */
+	MEMBLK_ID_ATF,
+	MEMBLK_ID_OPTEE,
+	MEMBLK_ID_SHM,
+
+	/* U-Boot self */
+	MEMBLK_ID_UBOOT,
+	MEMBLK_ID_STACK,
+	MEMBLK_ID_FASTBOOT,
+
+	/* Image */
+	MEMBLK_ID_RAMDISK,
+	MEMBLK_ID_FDT,
+	MEMBLK_ID_FDT_DTBO,
+	MEMBLK_ID_FDT_AOSP,
+	MEMBLK_ID_KERNEL,
+	MEMBLK_ID_ANDROID,
+
+	/* Other */
+	MEMBLK_ID_BY_NAME,
+	MEMBLK_ID_FDT_RESV,
+	MEMBLK_ID_DEMO,
+	MEMBLK_ID_MAX,
+};
+
+struct memblk_attr {
+	const char *name;
+	const char *alias[2];
+	u32 flags;
+};
+
+struct memblock {
+	phys_addr_t base;
+	phys_size_t size;
+	struct memblk_attr attr;
+	struct list_head node;
+};
+
+extern const struct memblk_attr *mem_attr;
+
+#define SIZE_MB(len)		((len) >> 20)
+#define SIZE_KB(len)		(((len) % (1 << 20)) >> 10)
+
+#define M_ATTR_NONE		0
+/* Over-Flow-Check for region tail */
+#define M_ATTR_OFC		(1 << 0)
+/* Over-Flow-Check for region Head, only for U-Boot stack */
+#define M_ATTR_HOFC		(1 << 1)
+/* Memory can be overlap by fdt reserved memory */
+#define M_ATTR_OVERLAP		(1 << 2)
+
+#endif /* _MEMBLK_H */
diff --git a/include/optee_include/OpteeClientInterface.h b/include/optee_include/OpteeClientInterface.h
index c2e6f90c8f..b99229ee90 100644
--- a/include/optee_include/OpteeClientInterface.h
+++ b/include/optee_include/OpteeClientInterface.h
@@ -14,7 +14,7 @@
 #define ATTEST_UUID_SIZE     (ATAP_HEX_UUID_LEN+1)
 #define ATTEST_CA_OUT_SIZE     256
 
-void test_optee(void);
+uint32_t test_optee(void);
 uint32_t trusty_read_rollback_index(uint32_t slot, uint64_t *value);
 uint32_t trusty_write_rollback_index(uint32_t slot, uint64_t value);
 uint32_t trusty_read_permanent_attributes(uint8_t *attributes, uint32_t size);
diff --git a/include/optee_include/OpteeClientMem.h b/include/optee_include/OpteeClientMem.h
index ba85f829c3..1b9affbf36 100644
--- a/include/optee_include/OpteeClientMem.h
+++ b/include/optee_include/OpteeClientMem.h
@@ -9,7 +9,7 @@
 
 #include <linux/types.h>
 
-void OpteeClientMemInit(void);
+int OpteeClientMemInit(void);
 
 void *OpteeClientMemAlloc(uint32_t length);
 
diff --git a/include/optee_include/OpteeClientRkFs-v2.h b/include/optee_include/OpteeClientRkFs-v2.h
index a8ee4d6c5b..57138a07dd 100644
--- a/include/optee_include/OpteeClientRkFs-v2.h
+++ b/include/optee_include/OpteeClientRkFs-v2.h
@@ -70,6 +70,7 @@ int tee_supp_rk_fs_init(void);
 
 int tee_supp_rk_fs_process(size_t num_params,
 			struct tee_ioctl_param *params);
-void OpteeClientRkFsInit(void);
+int OpteeClientRkFsInit(void);
+int check_security_exist(int print_flag);
 
 #endif
diff --git a/include/optee_include/OpteeClientRkFs.h b/include/optee_include/OpteeClientRkFs.h
index d7f68bc277..d70c118c75 100644
--- a/include/optee_include/OpteeClientRkFs.h
+++ b/include/optee_include/OpteeClientRkFs.h
@@ -33,6 +33,8 @@ int tee_supp_rk_fs_init(void);
 
 int tee_supp_rk_fs_process(void *cmd, uint32_t cmd_size);
 
-void OpteeClientRkFsInit(void);
+int OpteeClientRkFsInit(void);
+
+int check_security_exist(int print_flag);
 
 #endif
diff --git a/include/power/rk8xx_pmic.h b/include/power/rk8xx_pmic.h
index daeebb9665..80bf923732 100644
--- a/include/power/rk8xx_pmic.h
+++ b/include/power/rk8xx_pmic.h
@@ -211,6 +211,7 @@ enum {
 
 #define RK8XX_ON_SOURCE		0xae
 #define RK8XX_OFF_SOURCE	0xaf
+#define RK817_BUCK4_CMIN	0xc6
 #define RK817_ON_SOURCE		0xf5
 #define RK817_OFF_SOURCE	0xf6
 
diff --git a/include/rk_timer_irq.h b/include/rk_timer_irq.h
index 46133016b3..6de549e281 100644
--- a/include/rk_timer_irq.h
+++ b/include/rk_timer_irq.h
@@ -36,8 +36,13 @@
 #define TIMER_BASE		(0xFF1C0000 + 0x20)	/* TIMER 1 */
 #define TIMER_IRQ		IRQ_TIMER1
 #elif defined(CONFIG_ROCKCHIP_RK3368)
-#define TIMER_BASE		(0xFF810000 + 0x20)	/* TIMER 1 */
-#define TIMER_IRQ		IRQ_TIMER1
+/*
+ * Use timer0 and never change, because timer0 will be used in charge animation
+ * driver to support auto wakeup when system suspend. If core poweroff, PMU only
+ * support timer0(not all timer) as wakeup source.
+ */
+#define TIMER_BASE		(0xFF810000 + 0x00)	/* TIMER 0 */
+#define TIMER_IRQ		IRQ_TIMER0
 #elif defined(CONFIG_ROCKCHIP_RK3399)
 #define TIMER_BASE		(0xFF850000 + 0x20)	/* TIMER 1 */
 #define TIMER_IRQ		IRQ_TIMER1
diff --git a/include/sysmem.h b/include/sysmem.h
index 58de824968..0a5d807f82 100644
--- a/include/sysmem.h
+++ b/include/sysmem.h
@@ -6,12 +6,7 @@
 #ifndef _SYSMEM_H
 #define _SYSMEM_H
 
-#include <asm/types.h>
-
-#define	MAX_SYSMEM_REGIONS		64
-
-#undef	MAX_LMB_REGIONS
-#define	MAX_LMB_REGIONS			MAX_SYSMEM_REGIONS
+#include <memblk.h>
 
 /*
  * CONFIG_SYS_FDT_PAD default value is sync with bootm framework in:
@@ -21,96 +16,84 @@
 #define CONFIG_SYS_FDT_PAD		0x3000
 #endif
 
-struct sysmem_property {
-	const char *name;
-	phys_addr_t base;
-	phys_size_t size;
-	struct list_head node;
-};
-
 struct sysmem {
 	struct lmb lmb;
 	struct list_head allocated_head;
-	struct list_head reserved_head;
 	ulong allocated_cnt;
-	bool has_init;
+	bool has_initf;
+	bool has_initr;
 };
 
+#ifdef CONFIG_SYSMEM
 /**
- * sysmem_init() - Sysmem initialization
+ * sysmem_has_init() - Is sysmem initialized
  *
- * @return 0 on success, otherwise error
+ * @return true or false
  */
-int sysmem_init(void);
+bool sysmem_has_init(void);
 
 /**
- * sysmem_add() - Add sysmem region
- *
- * @base: region base address
- * @size: region size
+ * sysmem_init() - Sysmem initialization
  *
  * @return 0 on success, otherwise error
  */
-int sysmem_add(phys_addr_t base, phys_size_t size);
+int sysmem_init(void);
 
 /**
- * sysmem_reserve() - Reserve sysmem region
- *
- * @name: region name
- * @base: region base address
- * @size: region size
+ * sysmem_initr() - Sysmem initialization after relocation
  *
  * @return 0 on success, otherwise error
  */
-int sysmem_reserve(const char *name, phys_addr_t base, phys_size_t size);
+int sysmem_initr(void);
 
 /**
  * sysmem_alloc() - Alloc sysmem region at anywhere
  *
- * @name: region name
+ * @id: memblk id
  * @size: region size
  *
  * @return NULL on error, otherwise the allocated region address ptr
  */
-void *sysmem_alloc(const char *name, phys_size_t size);
+void *sysmem_alloc(enum memblk_id id, phys_size_t size);
 
 /**
- * sysmem_alloc_align() - Alloc sysmem region at anywhere with addr align down
+ * sysmem_alloc_base() - Alloc sysmem region at the expect addr
  *
- * @name: region name
+ * @id: memblk id
+ * @base: region base
  * @size: region size
- * @align: region base address align (down)
  *
  * @return NULL on error, otherwise the allocated region address ptr
  */
-void *sysmem_alloc_align(const char *name, phys_size_t size, ulong align);
+void *sysmem_alloc_base(enum memblk_id id, phys_addr_t base, phys_size_t size);
 
 /**
- * sysmem_alloc_base() - Alloc sysmem region at the expect addr
+ * sysmem_alloc_base_by_name() - Alloc sysmem region at the expect addr by name
  *
- * @name: region name
+ * @name: memblk name
  * @base: region base
  * @size: region size
  *
  * @return NULL on error, otherwise the allocated region address ptr
  */
-void *sysmem_alloc_base(const char *name, phys_addr_t base, phys_size_t size);
+void *sysmem_alloc_base_by_name(const char *name,
+				phys_addr_t base, phys_size_t size);
 
 /**
- * sysmem_alloc_align_base() - Alloc sysmem region at the expect addr with align down
+ * sysmem_fdt_reserve_alloc_base() - Alloc sysmem region at the expect addr by name,
+ *				     called only for reserve memory from fdt.
  *
- * @name: region name
+ * @name: memblk name
  * @base: region base
  * @size: region size
- * @align: region base address align (down)
  *
  * @return NULL on error, otherwise the allocated region address ptr
  */
-void *sysmem_alloc_align_base(const char *name, phys_addr_t base,
-			      phys_size_t size, ulong align);
+void *sysmem_fdt_reserve_alloc_base(const char *name,
+				    phys_addr_t base, phys_size_t size);
 
 /**
- * sysmem_free() - Free sysmem region
+ * sysmem_free() - Free allocated sysmem region
  *
  * @base: region base
  *
@@ -119,23 +102,11 @@ void *sysmem_alloc_align_base(const char *name, phys_addr_t base,
 int sysmem_free(phys_addr_t base);
 
 /**
- * sysmem_check() - Check sysmem regions
- *
- * @return 0 on okay, otherwise something wrong
- */
-int sysmem_check(void);
-
-/**
- * sysmem_dump_all() - Dump all sysmem stat
+ * sysmem_dump() - Dump all sysmem region state and check overflow
  */
 void sysmem_dump(void);
 
 /**
- * sysmem_dump_check() - Dump all sysmem stat and check overflow
- */
-int sysmem_dump_check(void);
-
-/**
  * board_sysmem_reserve() - Weak function for board to implement
  *
  * @sysmem: global sysmem point, ignored
@@ -143,14 +114,29 @@ int sysmem_dump_check(void);
  * @return 0 on success, otherwise error
  */
 int board_sysmem_reserve(struct sysmem *sysmem);
-
-/**
- * arch_sysmem_reserve() - Weak function for arch to implement
- *
- * @sysmem: global sysmem point, ignored
- *
- * @return 0 on success, otherwise error
- */
-int arch_sysmem_reserve(struct sysmem *sysmem);
-
+#else
+static inline bool sysmem_has_init(void) { return false; }
+static inline int sysmem_init(void) { return 0; }
+static inline int sysmem_initr(void) { return 0; }
+static inline int sysmem_free(phys_addr_t base) { return 0; }
+static inline void sysmem_dump(void) {}
+__weak int board_sysmem_reserve(struct sysmem *sysmem) { return 0; }
+static inline void *sysmem_alloc_base(enum memblk_id id,
+				      phys_addr_t base, phys_size_t size)
+{
+	return (void *)base;
+}
+static inline void *sysmem_alloc_base_by_name(const char *name,
+					      phys_addr_t base,
+					      phys_size_t size)
+{
+	return (void *)base;
+}
+static inline void *sysmem_fdt_reserve_alloc_base(const char *name,
+						  phys_addr_t base,
+						  phys_size_t size)
+{
+	return (void *)base;
+}
+#endif /* CONFIG_SYSMEM */
 #endif /* _SYSMEM_H */
diff --git a/lib/Kconfig b/lib/Kconfig
index 0699984837..c1aca36303 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -105,6 +105,12 @@ config SYSMEM
 	help
 	  This enables support for system permanent memory management.
 
+config BIDRAM
+	bool "GD board bi_dram[] memory management"
+	default y
+	help
+	  This enables support for GD board bi_dram[] memory management.
+
 source lib/dhry/Kconfig
 
 menu "Security support"
diff --git a/lib/Makefile b/lib/Makefile
index e417c794df..30f195b66f 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -31,6 +31,7 @@ obj-y += initcall.o
 obj-$(CONFIG_LMB) += lmb.o
 ifdef CONFIG_LMB
 obj-$(CONFIG_SYSMEM) += sysmem.o
+obj-$(CONFIG_BIDRAM) += bidram.o
 endif
 obj-y += ldiv.o
 obj-$(CONFIG_LZ4) += lz4_wrapper.o
diff --git a/lib/avb/libavb/avb_sysdeps_posix.c b/lib/avb/libavb/avb_sysdeps_posix.c
index 638ce9867a..413ac776eb 100755
--- a/lib/avb/libavb/avb_sysdeps_posix.c
+++ b/lib/avb/libavb/avb_sysdeps_posix.c
@@ -1,90 +1,90 @@
-/*

- * Copyright (C) 2016 The Android Open Source Project

- *

- * Permission is hereby granted, free of charge, to any person

- * obtaining a copy of this software and associated documentation

- * files (the "Software"), to deal in the Software without

- * restriction, including without limitation the rights to use, copy,

- * modify, merge, publish, distribute, sublicense, and/or sell copies

- * of the Software, and to permit persons to whom the Software is

- * furnished to do so, subject to the following conditions:

- *

- * The above copyright notice and this permission notice shall be

- * included in all copies or substantial portions of the Software.

- *

- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

- * SOFTWARE.

- */

-

-#include <stdio.h>

-#include <common.h>

-#include <stdarg.h>

-#include <stdlib.h>

-#include <malloc.h>

-#include <errno.h>

-#include <asm/io.h>

-

-#include <android_avb/avb_sysdeps.h>

-

-void abort(void)

-{

-	

-}

-int avb_memcmp(const void* src1, const void* src2, size_t n) {

-  return memcmp(src1, src2, n);

-}

-

-void* avb_memcpy(void* dest, const void* src, size_t n) {

-  return memcpy(dest, src, n);

-}

-

-void* avb_memset(void* dest, const int c, size_t n) {

-  return memset(dest, c, n);

-}

-

-int avb_strcmp(const char* s1, const char* s2) {

-  return strcmp(s1, s2);

-}

-

-size_t avb_strlen(const char* str) {

-  return strlen(str);

-}

-

-void avb_abort(void) {

-  abort();

-}

-

-void avb_print(const char* message) {

-  fprintf(stderr, "%s", message);

-}

-

-void avb_printv(const char* message, ...) {

-  va_list ap;

-  const char* m;

-

-  va_start(ap, message);

-  for (m = message; m != NULL; m = va_arg(ap, const char*)) {

-    fprintf(stderr, "%s", m);

-  }

-  va_end(ap);

-}

-

-void* avb_malloc_(size_t size) {

-  return malloc(size);

-}

-

-void avb_free(void* ptr) {

-  free(ptr);

-}

-

-uint32_t avb_div_by_10(uint64_t* dividend) {

-  uint32_t rem = (uint32_t)(*dividend % 10);

-  *dividend /= 10;

-  return rem;

-}

+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <stdio.h>
+#include <common.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <malloc.h>
+#include <errno.h>
+#include <asm/io.h>
+
+#include <android_avb/avb_sysdeps.h>
+
+void abort(void)
+{
+	
+}
+int avb_memcmp(const void* src1, const void* src2, size_t n) {
+  return memcmp(src1, src2, n);
+}
+
+void* avb_memcpy(void* dest, const void* src, size_t n) {
+  return memcpy(dest, src, n);
+}
+
+void* avb_memset(void* dest, const int c, size_t n) {
+  return memset(dest, c, n);
+}
+
+int avb_strcmp(const char* s1, const char* s2) {
+  return strcmp(s1, s2);
+}
+
+size_t avb_strlen(const char* str) {
+  return strlen(str);
+}
+
+void avb_abort(void) {
+  abort();
+}
+
+void avb_print(const char* message) {
+  printf("%s", message);
+}
+
+void avb_printv(const char* message, ...) {
+  va_list ap;
+  const char* m;
+
+  va_start(ap, message);
+  for (m = message; m != NULL; m = va_arg(ap, const char*)) {
+    printf("%s", m);
+  }
+  va_end(ap);
+}
+
+void* avb_malloc_(size_t size) {
+  return malloc(size);
+}
+
+void avb_free(void* ptr) {
+  free(ptr);
+}
+
+uint32_t avb_div_by_10(uint64_t* dividend) {
+  uint32_t rem = (uint32_t)(*dividend % 10);
+  *dividend /= 10;
+  return rem;
+}
diff --git a/lib/avb/libavb_ab/avb_ab_flow.c b/lib/avb/libavb_ab/avb_ab_flow.c
index 7ed1ab9107..c84131d6c3 100755
--- a/lib/avb/libavb_ab/avb_ab_flow.c
+++ b/lib/avb/libavb_ab/avb_ab_flow.c
@@ -1,531 +1,532 @@
-/*

- * Copyright (C) 2016 The Android Open Source Project

- *

- * Permission is hereby granted, free of charge, to any person

- * obtaining a copy of this software and associated documentation

- * files (the "Software"), to deal in the Software without

- * restriction, including without limitation the rights to use, copy,

- * modify, merge, publish, distribute, sublicense, and/or sell copies

- * of the Software, and to permit persons to whom the Software is

- * furnished to do so, subject to the following conditions:

- *

- * The above copyright notice and this permission notice shall be

- * included in all copies or substantial portions of the Software.

- *

- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

- * SOFTWARE.

- */

-

-#include <android_avb/avb_ab_flow.h>

-

-bool avb_ab_data_verify_and_byteswap(const AvbABData* src, AvbABData* dest) {

-  /* Ensure magic is correct. */

-  if (avb_safe_memcmp(src->magic, AVB_AB_MAGIC, AVB_AB_MAGIC_LEN) != 0) {

-    avb_error("Magic is incorrect.\n");

-    return false;

-  }

-

-  avb_memcpy(dest, src, sizeof(AvbABData));

-  dest->crc32 = avb_be32toh(dest->crc32);

-

-  /* Ensure we don't attempt to access any fields if the major version

-   * is not supported.

-   */

-  if (dest->version_major > AVB_AB_MAJOR_VERSION) {

-    avb_error("No support for given major version.\n");

-    return false;

-  }

-

-  /* Bail if CRC32 doesn't match. */

-  if (dest->crc32 !=

-      avb_crc32((const uint8_t*)dest, sizeof(AvbABData) - sizeof(uint32_t))) {

-    avb_error("CRC32 does not match.\n");

-    return false;

-  }

-

-  return true;

-}

-

-void avb_ab_data_update_crc_and_byteswap(const AvbABData* src,

-                                         AvbABData* dest) {

-  avb_memcpy(dest, src, sizeof(AvbABData));

-  dest->crc32 = avb_htobe32(

-      avb_crc32((const uint8_t*)dest, sizeof(AvbABData) - sizeof(uint32_t)));

-}

-

-void avb_ab_data_init(AvbABData* data) {

-  avb_memset(data, '\0', sizeof(AvbABData));

-  avb_memcpy(data->magic, AVB_AB_MAGIC, AVB_AB_MAGIC_LEN);

-  data->version_major = AVB_AB_MAJOR_VERSION;

-  data->version_minor = AVB_AB_MINOR_VERSION;

-  data->slots[0].priority = AVB_AB_MAX_PRIORITY;

-  data->slots[0].tries_remaining = AVB_AB_MAX_TRIES_REMAINING;

-  data->slots[0].successful_boot = 0;

-  data->slots[1].priority = AVB_AB_MAX_PRIORITY - 1;

-  data->slots[1].tries_remaining = AVB_AB_MAX_TRIES_REMAINING;

-  data->slots[1].successful_boot = 0;

-}

-

-/* The AvbABData struct is stored 2048 bytes into the 'misc' partition

- * following the 'struct bootloader_message' field. The struct is

- * compatible with the guidelines in bootable/recovery/bootloader.h -

- * e.g. it is stored in the |slot_suffix| field, starts with a

- * NUL-byte, and is 32 bytes long.

- */

-#define AB_METADATA_MISC_PARTITION_OFFSET 2048

-

-AvbIOResult avb_ab_data_read(AvbABOps* ab_ops, AvbABData* data) {

-  AvbOps* ops = ab_ops->ops;

-  AvbABData serialized;

-  AvbIOResult io_ret;

-  size_t num_bytes_read;

-

-  io_ret = ops->read_from_partition(ops,

-                                    "misc",

-                                    AB_METADATA_MISC_PARTITION_OFFSET,

-                                    sizeof(AvbABData),

-                                    &serialized,

-                                    &num_bytes_read);

-  if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

-    return AVB_IO_RESULT_ERROR_OOM;

-  } else if (io_ret != AVB_IO_RESULT_OK ||

-             num_bytes_read != sizeof(AvbABData)) {

-    avb_error("Error reading A/B metadata.\n");

-    return AVB_IO_RESULT_ERROR_IO;

-  }

-

-  if (!avb_ab_data_verify_and_byteswap(&serialized, data)) {

-    avb_error(

-        "Error validating A/B metadata from disk. "

-        "Resetting and writing new A/B metadata to disk.\n");

-    avb_ab_data_init(data);

-    return avb_ab_data_write(ab_ops, data);

-  }

-

-  return AVB_IO_RESULT_OK;

-}

-

-AvbIOResult avb_ab_data_write(AvbABOps* ab_ops, const AvbABData* data) {

-  AvbOps* ops = ab_ops->ops;

-  AvbABData serialized;

-  AvbIOResult io_ret;

-

-  avb_ab_data_update_crc_and_byteswap(data, &serialized);

-  io_ret = ops->write_to_partition(ops,

-                                   "misc",

-                                   AB_METADATA_MISC_PARTITION_OFFSET,

-                                   sizeof(AvbABData),

-                                   &serialized);

-  if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

-    return AVB_IO_RESULT_ERROR_OOM;

-  } else if (io_ret != AVB_IO_RESULT_OK) {

-    avb_error("Error writing A/B metadata.\n");

-    return AVB_IO_RESULT_ERROR_IO;

-  }

-  return AVB_IO_RESULT_OK;

-}

-

-static bool slot_is_bootable(AvbABSlotData* slot) {

-  return slot->priority > 0 &&

-         (slot->successful_boot || (slot->tries_remaining > 0));

-}

-

-static void slot_set_unbootable(AvbABSlotData* slot) {

-  slot->priority = 0;

-  slot->tries_remaining = 0;

-  slot->successful_boot = 0;

-}

-

-/* Ensure all unbootable and/or illegal states are marked as the

- * canonical 'unbootable' state, e.g. priority=0, tries_remaining=0,

- * and successful_boot=0.

- */

-static void slot_normalize(AvbABSlotData* slot) {

-  if (slot->priority > 0) {

-    if (slot->tries_remaining == 0 && !slot->successful_boot) {

-      /* We've exhausted all tries -> unbootable. */

-      slot_set_unbootable(slot);

-    }

-    if (slot->tries_remaining > 0 && slot->successful_boot) {

-      /* Illegal state - avb_ab_mark_slot_successful() will clear

-       * tries_remaining when setting successful_boot.

-       */

-      slot_set_unbootable(slot);

-    }

-  } else {

-    slot_set_unbootable(slot);

-  }

-}

-

-static const char* slot_suffixes[2] = {"_a", "_b"};

-

-/* Helper function to load metadata - returns AVB_IO_RESULT_OK on

- * success, error code otherwise.

- */

-AvbIOResult load_metadata(AvbABOps* ab_ops,

-                                 AvbABData* ab_data,

-                                 AvbABData* ab_data_orig) {

-  AvbIOResult io_ret;

-

-  io_ret = ab_ops->read_ab_metadata(ab_ops, ab_data);

-  if (io_ret != AVB_IO_RESULT_OK) {

-    avb_error("I/O error while loading A/B metadata.\n");

-    return io_ret;

-  }

-  *ab_data_orig = *ab_data;

-

-  /* Ensure data is normalized, e.g. illegal states will be marked as

-   * unbootable and all unbootable states are represented with

-   * (priority=0, tries_remaining=0, successful_boot=0).

-   */

-  slot_normalize(&ab_data->slots[0]);

-  slot_normalize(&ab_data->slots[1]);

-  return AVB_IO_RESULT_OK;

-}

-

-/* Writes A/B metadata to disk only if it has changed - returns

- * AVB_IO_RESULT_OK on success, error code otherwise.

- */

-AvbIOResult save_metadata_if_changed(AvbABOps* ab_ops,

-                                            AvbABData* ab_data,

-                                            AvbABData* ab_data_orig) {

-  if (avb_safe_memcmp(ab_data, ab_data_orig, sizeof(AvbABData)) != 0) {

-    avb_debug("Writing A/B metadata to disk.\n");

-    return ab_ops->write_ab_metadata(ab_ops, ab_data);

-  }

-  return AVB_IO_RESULT_OK;

-}

-

-AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,

-                            const char* const* requested_partitions,

-                            AvbSlotVerifyFlags flags,

-                            AvbHashtreeErrorMode hashtree_error_mode,

-                            AvbSlotVerifyData** out_data) {

-  AvbOps* ops = ab_ops->ops;

-  AvbSlotVerifyData* slot_data[2] = {NULL, NULL};

-  AvbSlotVerifyData* data = NULL;

-  AvbABFlowResult ret;

-  AvbABData ab_data, ab_data_orig;

-  size_t slot_index_to_boot, n;

-  AvbIOResult io_ret;

-  bool saw_and_allowed_verification_error = false;

-

-  io_ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);

-  if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

-    ret = AVB_AB_FLOW_RESULT_ERROR_OOM;

-    goto out;

-  } else if (io_ret != AVB_IO_RESULT_OK) {

-    ret = AVB_AB_FLOW_RESULT_ERROR_IO;

-    goto out;

-  }

-

-  /* Validate all bootable slots. */

-  for (n = 0; n < 2; n++) {

-    if (slot_is_bootable(&ab_data.slots[n])) {

-      AvbSlotVerifyResult verify_result;

-      bool set_slot_unbootable = false;

-

-      verify_result = avb_slot_verify(ops,

-                                      requested_partitions,

-                                      slot_suffixes[n],

-                                      flags,

-                                      hashtree_error_mode,

-                                      &slot_data[n]);

-      switch (verify_result) {

-        case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:

-          ret = AVB_AB_FLOW_RESULT_ERROR_OOM;

-          goto out;

-

-        case AVB_SLOT_VERIFY_RESULT_ERROR_IO:

-          ret = AVB_AB_FLOW_RESULT_ERROR_IO;

-          goto out;

-

-        case AVB_SLOT_VERIFY_RESULT_OK:

-          break;

-

-        case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:

-        case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:

-          /* Even with AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR

-           * these mean game over.

-           */

-          set_slot_unbootable = true;

-          break;

-

-        /* explicit fallthrough. */

-        case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:

-        case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:

-        case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:

-          if (flags & AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR) {

-            /* Do nothing since we allow this. */

-            avb_debugv("Allowing slot ",

-                       slot_suffixes[n],

-                       " which verified "

-                       "with result ",

-                       avb_slot_verify_result_to_string(verify_result),

-                       " because "

-                       "AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR "

-                       "is set.\n",

-                       NULL);

-            saw_and_allowed_verification_error = true;

-          } else {

-            set_slot_unbootable = true;

-          }

-          break;

-

-        case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_ARGUMENT:

-          ret = AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT;

-          goto out;

-          /* Do not add a 'default:' case here because of -Wswitch. */

-      }

-

-      if (set_slot_unbootable) {

-        avb_errorv("Error verifying slot ",

-                   slot_suffixes[n],

-                   " with result ",

-                   avb_slot_verify_result_to_string(verify_result),

-                   " - setting unbootable.\n",

-                   NULL);

-        slot_set_unbootable(&ab_data.slots[n]);

-      }

-    }

-  }

-

-  if (slot_is_bootable(&ab_data.slots[0]) &&

-      slot_is_bootable(&ab_data.slots[1])) {

-    if (ab_data.slots[1].priority > ab_data.slots[0].priority) {

-      slot_index_to_boot = 1;

-    } else {

-      slot_index_to_boot = 0;

-    }

-  } else if (slot_is_bootable(&ab_data.slots[0])) {

-    slot_index_to_boot = 0;

-  } else if (slot_is_bootable(&ab_data.slots[1])) {

-    slot_index_to_boot = 1;

-  } else {

-    /* No bootable slots! */

-    avb_error("No bootable slots found.\n");

-    ret = AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS;

-    goto out;

-  }

-

-  /* Update stored rollback index such that the stored rollback index

-   * is the largest value supporting all currently bootable slots. Do

-   * this for every rollback index location.

-   */

-  for (n = 0; n < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS; n++) {

-    uint64_t rollback_index_value = 0;

-

-    if (slot_data[0] != NULL && slot_data[1] != NULL) {

-      uint64_t a_rollback_index = slot_data[0]->rollback_indexes[n];

-      uint64_t b_rollback_index = slot_data[1]->rollback_indexes[n];

-      rollback_index_value =

-          (a_rollback_index < b_rollback_index ? a_rollback_index

-                                               : b_rollback_index);

-    } else if (slot_data[0] != NULL) {

-      rollback_index_value = slot_data[0]->rollback_indexes[n];

-    } else if (slot_data[1] != NULL) {

-      rollback_index_value = slot_data[1]->rollback_indexes[n];

-    }

-

-    if (rollback_index_value != 0) {

-      uint64_t current_rollback_index_value;

-      io_ret = ops->read_rollback_index(ops, n, &current_rollback_index_value);

-      if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

-        ret = AVB_AB_FLOW_RESULT_ERROR_OOM;

-        goto out;

-      } else if (io_ret != AVB_IO_RESULT_OK) {

-        avb_error("Error getting rollback index for slot.\n");

-        ret = AVB_AB_FLOW_RESULT_ERROR_IO;

-        goto out;

-      }

-      if (current_rollback_index_value != rollback_index_value) {

-        io_ret = ops->write_rollback_index(ops, n, rollback_index_value);

-        if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

-          ret = AVB_AB_FLOW_RESULT_ERROR_OOM;

-          goto out;

-        } else if (io_ret != AVB_IO_RESULT_OK) {

-          avb_error("Error setting stored rollback index.\n");

-          ret = AVB_AB_FLOW_RESULT_ERROR_IO;

-          goto out;

-        }

-      }

-    }

-  }

-

-  /* Finally, select this slot. */

-  avb_assert(slot_data[slot_index_to_boot] != NULL);

-  data = slot_data[slot_index_to_boot];

-  slot_data[slot_index_to_boot] = NULL;

-  if (saw_and_allowed_verification_error) {

-    avb_assert(flags & AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR);

-    ret = AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR;

-  } else {

-    ret = AVB_AB_FLOW_RESULT_OK;

-  }

-

-  /* ... and decrement tries remaining, if applicable. */

-  if (!ab_data.slots[slot_index_to_boot].successful_boot &&

-      ab_data.slots[slot_index_to_boot].tries_remaining > 0) {

-    ab_data.slots[slot_index_to_boot].tries_remaining -= 1;

-  }

-

-out:

-  io_ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);

-  if (io_ret != AVB_IO_RESULT_OK) {

-    if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

-      ret = AVB_AB_FLOW_RESULT_ERROR_OOM;

-    } else {

-      ret = AVB_AB_FLOW_RESULT_ERROR_IO;

-    }

-    if (data != NULL) {

-      avb_slot_verify_data_free(data);

-      data = NULL;

-    }

-  }

-

-  for (n = 0; n < 2; n++) {

-    if (slot_data[n] != NULL) {

-      avb_slot_verify_data_free(slot_data[n]);

-    }

-  }

-

-  if (out_data != NULL) {

-    *out_data = data;

-  } else {

-    if (data != NULL) {

-      avb_slot_verify_data_free(data);

-    }

-  }

-

-  return ret;

-}

-

-AvbIOResult avb_ab_mark_slot_active(AvbABOps* ab_ops,

-                                    unsigned int slot_number) {

-  AvbABData ab_data, ab_data_orig;

-  unsigned int other_slot_number;

-  AvbIOResult ret;

-

-  avb_assert(slot_number < 2);

-

-  ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);

-  if (ret != AVB_IO_RESULT_OK) {

-    goto out;

-  }

-

-  /* Make requested slot top priority, unsuccessful, and with max tries. */

-  ab_data.slots[slot_number].priority = AVB_AB_MAX_PRIORITY;

-  ab_data.slots[slot_number].tries_remaining = AVB_AB_MAX_TRIES_REMAINING;

-  ab_data.slots[slot_number].successful_boot = 0;

-

-  /* Ensure other slot doesn't have as high a priority. */

-  other_slot_number = 1 - slot_number;

-  if (ab_data.slots[other_slot_number].priority == AVB_AB_MAX_PRIORITY) {

-    ab_data.slots[other_slot_number].priority = AVB_AB_MAX_PRIORITY - 1;

-  }

-

-  ret = AVB_IO_RESULT_OK;

-

-out:

-  if (ret == AVB_IO_RESULT_OK) {

-    ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);

-  }

-  return ret;

-}

-

-AvbIOResult avb_ab_mark_slot_unbootable(AvbABOps* ab_ops,

-                                        unsigned int slot_number) {

-  AvbABData ab_data, ab_data_orig;

-  AvbIOResult ret;

-

-  avb_assert(slot_number < 2);

-

-  ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);

-  if (ret != AVB_IO_RESULT_OK) {

-    goto out;

-  }

-

-  slot_set_unbootable(&ab_data.slots[slot_number]);

-

-  ret = AVB_IO_RESULT_OK;

-

-out:

-  if (ret == AVB_IO_RESULT_OK) {

-    ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);

-  }

-  return ret;

-}

-

-AvbIOResult avb_ab_mark_slot_successful(AvbABOps* ab_ops,

-                                        unsigned int slot_number) {

-  AvbABData ab_data, ab_data_orig;

-  AvbIOResult ret;

-

-  avb_assert(slot_number < 2);

-

-  ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);

-  if (ret != AVB_IO_RESULT_OK) {

-    goto out;

-  }

-

-  if (!slot_is_bootable(&ab_data.slots[slot_number])) {

-    avb_error("Cannot mark unbootable slot as successful.\n");

-    ret = AVB_IO_RESULT_OK;

-    goto out;

-  }

-

-  ab_data.slots[slot_number].tries_remaining = 0;

-  ab_data.slots[slot_number].successful_boot = 1;

-

-  ret = AVB_IO_RESULT_OK;

-

-out:

-  if (ret == AVB_IO_RESULT_OK) {

-    ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);

-  }

-  return ret;

-}

-

-const char* avb_ab_flow_result_to_string(AvbABFlowResult result) {

-  const char* ret = NULL;

-

-  switch (result) {

-    case AVB_AB_FLOW_RESULT_OK:

-      ret = "OK";

-      break;

-

-    case AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR:

-      ret = "OK_WITH_VERIFICATION_ERROR";

-      break;

-

-    case AVB_AB_FLOW_RESULT_ERROR_OOM:

-      ret = "ERROR_OOM";

-      break;

-

-    case AVB_AB_FLOW_RESULT_ERROR_IO:

-      ret = "ERROR_IO";

-      break;

-

-    case AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS:

-      ret = "ERROR_NO_BOOTABLE_SLOTS";

-      break;

-

-    case AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT:

-      ret = "ERROR_INVALID_ARGUMENT";

-      break;

-      /* Do not add a 'default:' case here because of -Wswitch. */

-  }

-

-  if (ret == NULL) {

-    avb_error("Unknown AvbABFlowResult value.\n");

-    ret = "(unknown)";

-  }

-

-  return ret;

-}

+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <android_avb/avb_ab_flow.h>
+
+bool avb_ab_data_verify_and_byteswap(const AvbABData* src, AvbABData* dest) {
+  /* Ensure magic is correct. */
+  if (avb_safe_memcmp(src->magic, AVB_AB_MAGIC, AVB_AB_MAGIC_LEN) != 0) {
+    avb_error("Magic is incorrect.\n");
+    return false;
+  }
+
+  avb_memcpy(dest, src, sizeof(AvbABData));
+  dest->crc32 = avb_be32toh(dest->crc32);
+
+  /* Ensure we don't attempt to access any fields if the major version
+   * is not supported.
+   */
+  if (dest->version_major > AVB_AB_MAJOR_VERSION) {
+    avb_error("No support for given major version.\n");
+    return false;
+  }
+
+  /* Bail if CRC32 doesn't match. */
+  if (dest->crc32 !=
+      avb_crc32((const uint8_t*)dest, sizeof(AvbABData) - sizeof(uint32_t))) {
+    avb_error("CRC32 does not match.\n");
+    return false;
+  }
+
+  return true;
+}
+
+void avb_ab_data_update_crc_and_byteswap(const AvbABData* src,
+                                         AvbABData* dest) {
+  avb_memcpy(dest, src, sizeof(AvbABData));
+  dest->crc32 = avb_htobe32(
+      avb_crc32((const uint8_t*)dest, sizeof(AvbABData) - sizeof(uint32_t)));
+}
+
+void avb_ab_data_init(AvbABData* data) {
+  avb_memset(data, '\0', sizeof(AvbABData));
+  avb_memcpy(data->magic, AVB_AB_MAGIC, AVB_AB_MAGIC_LEN);
+  data->version_major = AVB_AB_MAJOR_VERSION;
+  data->version_minor = AVB_AB_MINOR_VERSION;
+  data->last_boot = 0;
+  data->slots[0].priority = AVB_AB_MAX_PRIORITY;
+  data->slots[0].tries_remaining = AVB_AB_MAX_TRIES_REMAINING;
+  data->slots[0].successful_boot = 0;
+  data->slots[1].priority = AVB_AB_MAX_PRIORITY - 1;
+  data->slots[1].tries_remaining = AVB_AB_MAX_TRIES_REMAINING;
+  data->slots[1].successful_boot = 0;
+}
+
+/* The AvbABData struct is stored 2048 bytes into the 'misc' partition
+ * following the 'struct bootloader_message' field. The struct is
+ * compatible with the guidelines in bootable/recovery/bootloader.h -
+ * e.g. it is stored in the |slot_suffix| field, starts with a
+ * NUL-byte, and is 32 bytes long.
+ */
+#define AB_METADATA_MISC_PARTITION_OFFSET 2048
+
+AvbIOResult avb_ab_data_read(AvbABOps* ab_ops, AvbABData* data) {
+  AvbOps* ops = ab_ops->ops;
+  AvbABData serialized;
+  AvbIOResult io_ret;
+  size_t num_bytes_read;
+
+  io_ret = ops->read_from_partition(ops,
+                                    "misc",
+                                    AB_METADATA_MISC_PARTITION_OFFSET,
+                                    sizeof(AvbABData),
+                                    &serialized,
+                                    &num_bytes_read);
+  if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+    return AVB_IO_RESULT_ERROR_OOM;
+  } else if (io_ret != AVB_IO_RESULT_OK ||
+             num_bytes_read != sizeof(AvbABData)) {
+    avb_error("Error reading A/B metadata.\n");
+    return AVB_IO_RESULT_ERROR_IO;
+  }
+
+  if (!avb_ab_data_verify_and_byteswap(&serialized, data)) {
+    avb_error(
+        "Error validating A/B metadata from disk. "
+        "Resetting and writing new A/B metadata to disk.\n");
+    avb_ab_data_init(data);
+    return avb_ab_data_write(ab_ops, data);
+  }
+
+  return AVB_IO_RESULT_OK;
+}
+
+AvbIOResult avb_ab_data_write(AvbABOps* ab_ops, const AvbABData* data) {
+  AvbOps* ops = ab_ops->ops;
+  AvbABData serialized;
+  AvbIOResult io_ret;
+
+  avb_ab_data_update_crc_and_byteswap(data, &serialized);
+  io_ret = ops->write_to_partition(ops,
+                                   "misc",
+                                   AB_METADATA_MISC_PARTITION_OFFSET,
+                                   sizeof(AvbABData),
+                                   &serialized);
+  if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+    return AVB_IO_RESULT_ERROR_OOM;
+  } else if (io_ret != AVB_IO_RESULT_OK) {
+    avb_error("Error writing A/B metadata.\n");
+    return AVB_IO_RESULT_ERROR_IO;
+  }
+  return AVB_IO_RESULT_OK;
+}
+
+static bool slot_is_bootable(AvbABSlotData* slot) {
+  return slot->priority > 0 &&
+         (slot->successful_boot || (slot->tries_remaining > 0));
+}
+
+static void slot_set_unbootable(AvbABSlotData* slot) {
+  slot->priority = 0;
+  slot->tries_remaining = 0;
+  slot->successful_boot = 0;
+}
+
+/* Ensure all unbootable and/or illegal states are marked as the
+ * canonical 'unbootable' state, e.g. priority=0, tries_remaining=0,
+ * and successful_boot=0.
+ */
+static void slot_normalize(AvbABSlotData* slot) {
+  if (slot->priority > 0) {
+    if (slot->tries_remaining == 0 && !slot->successful_boot) {
+      /* We've exhausted all tries -> unbootable. */
+      slot_set_unbootable(slot);
+    }
+    if (slot->tries_remaining > 0 && slot->successful_boot) {
+      /* Illegal state - avb_ab_mark_slot_successful() will clear
+       * tries_remaining when setting successful_boot.
+       */
+      slot_set_unbootable(slot);
+    }
+  } else {
+    slot_set_unbootable(slot);
+  }
+}
+
+static const char* slot_suffixes[2] = {"_a", "_b"};
+
+/* Helper function to load metadata - returns AVB_IO_RESULT_OK on
+ * success, error code otherwise.
+ */
+AvbIOResult load_metadata(AvbABOps* ab_ops,
+                                 AvbABData* ab_data,
+                                 AvbABData* ab_data_orig) {
+  AvbIOResult io_ret;
+
+  io_ret = ab_ops->read_ab_metadata(ab_ops, ab_data);
+  if (io_ret != AVB_IO_RESULT_OK) {
+    avb_error("I/O error while loading A/B metadata.\n");
+    return io_ret;
+  }
+  *ab_data_orig = *ab_data;
+
+  /* Ensure data is normalized, e.g. illegal states will be marked as
+   * unbootable and all unbootable states are represented with
+   * (priority=0, tries_remaining=0, successful_boot=0).
+   */
+  slot_normalize(&ab_data->slots[0]);
+  slot_normalize(&ab_data->slots[1]);
+  return AVB_IO_RESULT_OK;
+}
+
+/* Writes A/B metadata to disk only if it has changed - returns
+ * AVB_IO_RESULT_OK on success, error code otherwise.
+ */
+AvbIOResult save_metadata_if_changed(AvbABOps* ab_ops,
+                                            AvbABData* ab_data,
+                                            AvbABData* ab_data_orig) {
+  if (avb_safe_memcmp(ab_data, ab_data_orig, sizeof(AvbABData)) != 0) {
+    avb_debug("Writing A/B metadata to disk.\n");
+    return ab_ops->write_ab_metadata(ab_ops, ab_data);
+  }
+  return AVB_IO_RESULT_OK;
+}
+
+AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
+                            const char* const* requested_partitions,
+                            AvbSlotVerifyFlags flags,
+                            AvbHashtreeErrorMode hashtree_error_mode,
+                            AvbSlotVerifyData** out_data) {
+  AvbOps* ops = ab_ops->ops;
+  AvbSlotVerifyData* slot_data[2] = {NULL, NULL};
+  AvbSlotVerifyData* data = NULL;
+  AvbABFlowResult ret;
+  AvbABData ab_data, ab_data_orig;
+  size_t slot_index_to_boot, n;
+  AvbIOResult io_ret;
+  bool saw_and_allowed_verification_error = false;
+
+  io_ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);
+  if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+    ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
+    goto out;
+  } else if (io_ret != AVB_IO_RESULT_OK) {
+    ret = AVB_AB_FLOW_RESULT_ERROR_IO;
+    goto out;
+  }
+
+  /* Validate all bootable slots. */
+  for (n = 0; n < 2; n++) {
+    if (slot_is_bootable(&ab_data.slots[n])) {
+      AvbSlotVerifyResult verify_result;
+      bool set_slot_unbootable = false;
+
+      verify_result = avb_slot_verify(ops,
+                                      requested_partitions,
+                                      slot_suffixes[n],
+                                      flags,
+                                      hashtree_error_mode,
+                                      &slot_data[n]);
+      switch (verify_result) {
+        case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:
+          ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
+          goto out;
+
+        case AVB_SLOT_VERIFY_RESULT_ERROR_IO:
+          ret = AVB_AB_FLOW_RESULT_ERROR_IO;
+          goto out;
+
+        case AVB_SLOT_VERIFY_RESULT_OK:
+          break;
+
+        case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
+        case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
+          /* Even with AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR
+           * these mean game over.
+           */
+          set_slot_unbootable = true;
+          break;
+
+        /* explicit fallthrough. */
+        case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
+        case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:
+        case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
+          if (flags & AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR) {
+            /* Do nothing since we allow this. */
+            avb_debugv("Allowing slot ",
+                       slot_suffixes[n],
+                       " which verified "
+                       "with result ",
+                       avb_slot_verify_result_to_string(verify_result),
+                       " because "
+                       "AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR "
+                       "is set.\n",
+                       NULL);
+            saw_and_allowed_verification_error = true;
+          } else {
+            set_slot_unbootable = true;
+          }
+          break;
+
+        case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_ARGUMENT:
+          ret = AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT;
+          goto out;
+          /* Do not add a 'default:' case here because of -Wswitch. */
+      }
+
+      if (set_slot_unbootable) {
+        avb_errorv("Error verifying slot ",
+                   slot_suffixes[n],
+                   " with result ",
+                   avb_slot_verify_result_to_string(verify_result),
+                   " - setting unbootable.\n",
+                   NULL);
+        slot_set_unbootable(&ab_data.slots[n]);
+      }
+    }
+  }
+
+  if (slot_is_bootable(&ab_data.slots[0]) &&
+      slot_is_bootable(&ab_data.slots[1])) {
+    if (ab_data.slots[1].priority > ab_data.slots[0].priority) {
+      slot_index_to_boot = 1;
+    } else {
+      slot_index_to_boot = 0;
+    }
+  } else if (slot_is_bootable(&ab_data.slots[0])) {
+    slot_index_to_boot = 0;
+  } else if (slot_is_bootable(&ab_data.slots[1])) {
+    slot_index_to_boot = 1;
+  } else {
+    /* No bootable slots! */
+    avb_error("No bootable slots found.\n");
+    ret = AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS;
+    goto out;
+  }
+
+  /* Update stored rollback index such that the stored rollback index
+   * is the largest value supporting all currently bootable slots. Do
+   * this for every rollback index location.
+   */
+  for (n = 0; n < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS; n++) {
+    uint64_t rollback_index_value = 0;
+
+    if (slot_data[0] != NULL && slot_data[1] != NULL) {
+      uint64_t a_rollback_index = slot_data[0]->rollback_indexes[n];
+      uint64_t b_rollback_index = slot_data[1]->rollback_indexes[n];
+      rollback_index_value =
+          (a_rollback_index < b_rollback_index ? a_rollback_index
+                                               : b_rollback_index);
+    } else if (slot_data[0] != NULL) {
+      rollback_index_value = slot_data[0]->rollback_indexes[n];
+    } else if (slot_data[1] != NULL) {
+      rollback_index_value = slot_data[1]->rollback_indexes[n];
+    }
+
+    if (rollback_index_value != 0) {
+      uint64_t current_rollback_index_value;
+      io_ret = ops->read_rollback_index(ops, n, &current_rollback_index_value);
+      if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+        ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
+        goto out;
+      } else if (io_ret != AVB_IO_RESULT_OK) {
+        avb_error("Error getting rollback index for slot.\n");
+        ret = AVB_AB_FLOW_RESULT_ERROR_IO;
+        goto out;
+      }
+      if (current_rollback_index_value != rollback_index_value) {
+        io_ret = ops->write_rollback_index(ops, n, rollback_index_value);
+        if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+          ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
+          goto out;
+        } else if (io_ret != AVB_IO_RESULT_OK) {
+          avb_error("Error setting stored rollback index.\n");
+          ret = AVB_AB_FLOW_RESULT_ERROR_IO;
+          goto out;
+        }
+      }
+    }
+  }
+
+  /* Finally, select this slot. */
+  avb_assert(slot_data[slot_index_to_boot] != NULL);
+  data = slot_data[slot_index_to_boot];
+  slot_data[slot_index_to_boot] = NULL;
+  if (saw_and_allowed_verification_error) {
+    avb_assert(flags & AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR);
+    ret = AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR;
+  } else {
+    ret = AVB_AB_FLOW_RESULT_OK;
+  }
+
+  /* ... and decrement tries remaining, if applicable. */
+  if (!ab_data.slots[slot_index_to_boot].successful_boot &&
+      ab_data.slots[slot_index_to_boot].tries_remaining > 0) {
+    ab_data.slots[slot_index_to_boot].tries_remaining -= 1;
+  }
+
+out:
+  io_ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);
+  if (io_ret != AVB_IO_RESULT_OK) {
+    if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+      ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
+    } else {
+      ret = AVB_AB_FLOW_RESULT_ERROR_IO;
+    }
+    if (data != NULL) {
+      avb_slot_verify_data_free(data);
+      data = NULL;
+    }
+  }
+
+  for (n = 0; n < 2; n++) {
+    if (slot_data[n] != NULL) {
+      avb_slot_verify_data_free(slot_data[n]);
+    }
+  }
+
+  if (out_data != NULL) {
+    *out_data = data;
+  } else {
+    if (data != NULL) {
+      avb_slot_verify_data_free(data);
+    }
+  }
+
+  return ret;
+}
+
+AvbIOResult avb_ab_mark_slot_active(AvbABOps* ab_ops,
+                                    unsigned int slot_number) {
+  AvbABData ab_data, ab_data_orig;
+  unsigned int other_slot_number;
+  AvbIOResult ret;
+
+  avb_assert(slot_number < 2);
+
+  ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);
+  if (ret != AVB_IO_RESULT_OK) {
+    goto out;
+  }
+
+  /* Make requested slot top priority, unsuccessful, and with max tries. */
+  ab_data.slots[slot_number].priority = AVB_AB_MAX_PRIORITY;
+  ab_data.slots[slot_number].tries_remaining = AVB_AB_MAX_TRIES_REMAINING;
+  ab_data.slots[slot_number].successful_boot = 0;
+
+  /* Ensure other slot doesn't have as high a priority. */
+  other_slot_number = 1 - slot_number;
+  if (ab_data.slots[other_slot_number].priority == AVB_AB_MAX_PRIORITY) {
+    ab_data.slots[other_slot_number].priority = AVB_AB_MAX_PRIORITY - 1;
+  }
+
+  ret = AVB_IO_RESULT_OK;
+
+out:
+  if (ret == AVB_IO_RESULT_OK) {
+    ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);
+  }
+  return ret;
+}
+
+AvbIOResult avb_ab_mark_slot_unbootable(AvbABOps* ab_ops,
+                                        unsigned int slot_number) {
+  AvbABData ab_data, ab_data_orig;
+  AvbIOResult ret;
+
+  avb_assert(slot_number < 2);
+
+  ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);
+  if (ret != AVB_IO_RESULT_OK) {
+    goto out;
+  }
+
+  slot_set_unbootable(&ab_data.slots[slot_number]);
+
+  ret = AVB_IO_RESULT_OK;
+
+out:
+  if (ret == AVB_IO_RESULT_OK) {
+    ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);
+  }
+  return ret;
+}
+
+AvbIOResult avb_ab_mark_slot_successful(AvbABOps* ab_ops,
+                                        unsigned int slot_number) {
+  AvbABData ab_data, ab_data_orig;
+  AvbIOResult ret;
+
+  avb_assert(slot_number < 2);
+
+  ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);
+  if (ret != AVB_IO_RESULT_OK) {
+    goto out;
+  }
+
+  if (!slot_is_bootable(&ab_data.slots[slot_number])) {
+    avb_error("Cannot mark unbootable slot as successful.\n");
+    ret = AVB_IO_RESULT_OK;
+    goto out;
+  }
+
+  ab_data.slots[slot_number].tries_remaining = 0;
+  ab_data.slots[slot_number].successful_boot = 1;
+
+  ret = AVB_IO_RESULT_OK;
+
+out:
+  if (ret == AVB_IO_RESULT_OK) {
+    ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);
+  }
+  return ret;
+}
+
+const char* avb_ab_flow_result_to_string(AvbABFlowResult result) {
+  const char* ret = NULL;
+
+  switch (result) {
+    case AVB_AB_FLOW_RESULT_OK:
+      ret = "OK";
+      break;
+
+    case AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR:
+      ret = "OK_WITH_VERIFICATION_ERROR";
+      break;
+
+    case AVB_AB_FLOW_RESULT_ERROR_OOM:
+      ret = "ERROR_OOM";
+      break;
+
+    case AVB_AB_FLOW_RESULT_ERROR_IO:
+      ret = "ERROR_IO";
+      break;
+
+    case AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS:
+      ret = "ERROR_NO_BOOTABLE_SLOTS";
+      break;
+
+    case AVB_AB_FLOW_RESULT_ERROR_INVALID_ARGUMENT:
+      ret = "ERROR_INVALID_ARGUMENT";
+      break;
+      /* Do not add a 'default:' case here because of -Wswitch. */
+  }
+
+  if (ret == NULL) {
+    avb_error("Unknown AvbABFlowResult value.\n");
+    ret = "(unknown)";
+  }
+
+  return ret;
+}
diff --git a/lib/avb/libavb_atx/avb_atx_validate.c b/lib/avb/libavb_atx/avb_atx_validate.c
index 74a34fd0fd..9695d1b17a 100755..100644
--- a/lib/avb/libavb_atx/avb_atx_validate.c
+++ b/lib/avb/libavb_atx/avb_atx_validate.c
@@ -1,401 +1,473 @@
-/*

- * Copyright (C) 2016 The Android Open Source Project

- *

- * Permission is hereby granted, free of charge, to any person

- * obtaining a copy of this software and associated documentation

- * files (the "Software"), to deal in the Software without

- * restriction, including without limitation the rights to use, copy,

- * modify, merge, publish, distribute, sublicense, and/or sell copies

- * of the Software, and to permit persons to whom the Software is

- * furnished to do so, subject to the following conditions:

- *

- * The above copyright notice and this permission notice shall be

- * included in all copies or substantial portions of the Software.

- *

- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

- * SOFTWARE.

- */

-

-#include <android_avb/avb_atx_validate.h>

-

-#include <android_avb/avb_rsa.h>

-#include <android_avb/avb_sha.h>

-#include <android_avb/avb_sysdeps.h>

-#include <android_avb/avb_util.h>

-

-/* The most recent unlock challenge generated. */

-static uint8_t last_unlock_challenge[AVB_ATX_UNLOCK_CHALLENGE_SIZE];

-

-/* Computes the SHA256 |hash| of |length| bytes of |data|. */

-static void sha256(const uint8_t* data,

-                   uint32_t length,

-                   uint8_t hash[AVB_SHA256_DIGEST_SIZE]) {

-  AvbSHA256Ctx context;

-  avb_sha256_init(&context);

-  avb_sha256_update(&context, data, length);

-  uint8_t* tmp = avb_sha256_final(&context);

-  avb_memcpy(hash, tmp, AVB_SHA256_DIGEST_SIZE);

-}

-

-/* Computes the SHA512 |hash| of |length| bytes of |data|. */

-static void sha512(const uint8_t* data,

-                   uint32_t length,

-                   uint8_t hash[AVB_SHA512_DIGEST_SIZE]) {

-  AvbSHA512Ctx context;

-  avb_sha512_init(&context);

-  avb_sha512_update(&context, data, length);

-  uint8_t* tmp = avb_sha512_final(&context);

-  avb_memcpy(hash, tmp, AVB_SHA512_DIGEST_SIZE);

-}

-

-/* Computes the SHA256 |hash| of a NUL-terminated |str|. */

-static void sha256_str(const char* str, uint8_t hash[AVB_SHA256_DIGEST_SIZE]) {

-  sha256((const uint8_t*)str, avb_strlen(str), hash);

-}

-

-/* Verifies structure and |expected_hash| of permanent |attributes|. */

-static bool verify_permanent_attributes(

-    const AvbAtxPermanentAttributes* attributes,

-    const uint8_t expected_hash[AVB_SHA256_DIGEST_SIZE]) {

-  uint8_t hash[AVB_SHA256_DIGEST_SIZE];

-

-  if (attributes->version != 1) {

-    avb_error("Unsupported permanent attributes version.\n");

-    return false;

-  }

-  sha256((const uint8_t*)attributes, sizeof(AvbAtxPermanentAttributes), hash);

-  if (0 != avb_safe_memcmp(hash, expected_hash, AVB_SHA256_DIGEST_SIZE)) {

-    avb_error("Invalid permanent attributes.\n");

-    return false;

-  }

-  return true;

-}

-

-/* Verifies the format, key version, usage, and signature of a certificate. */

-static bool verify_certificate(

-    const AvbAtxCertificate* certificate,

-    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],

-    uint64_t minimum_key_version,

-    const uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE]) {

-  const AvbAlgorithmData* algorithm_data;

-  uint8_t certificate_hash[AVB_SHA512_DIGEST_SIZE];

-

-  if (certificate->signed_data.version != 1) {

-    avb_error("Unsupported certificate format.\n");

-    return false;

-  }

-  algorithm_data = avb_get_algorithm_data(AVB_ALGORITHM_TYPE_SHA512_RSA4096);

-  sha512((const uint8_t*)&certificate->signed_data,

-         sizeof(AvbAtxCertificateSignedData),

-         certificate_hash);

-  if (!avb_rsa_verify(authority,

-                      AVB_ATX_PUBLIC_KEY_SIZE,

-                      certificate->signature,

-                      AVB_RSA4096_NUM_BYTES,

-                      certificate_hash,

-                      AVB_SHA512_DIGEST_SIZE,

-                      algorithm_data->padding,

-                      algorithm_data->padding_len)) {

-    avb_error("Invalid certificate signature.\n");

-    return false;

-  }

-  if (certificate->signed_data.key_version < minimum_key_version) {

-    avb_error("Key rollback detected.\n");

-    return false;

-  }

-  if (0 != avb_safe_memcmp(certificate->signed_data.usage,

-                           expected_usage,

-                           AVB_SHA256_DIGEST_SIZE)) {

-    avb_error("Invalid certificate usage.\n");

-    return false;

-  }

-  return true;

-}

-

-/* Verifies signature and fields of a PIK certificate. */

-static bool verify_pik_certificate(

-    const AvbAtxCertificate* certificate,

-    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],

-    uint64_t minimum_version) {

-  uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE];

-

-  sha256_str("com.google.android.things.vboot.ca", expected_usage);

-  if (!verify_certificate(

-          certificate, authority, minimum_version, expected_usage)) {

-    avb_error("Invalid PIK certificate.\n");

-    return false;

-  }

-  return true;

-}

-

-/* Verifies signature and fields of a PSK certificate. */

-static bool verify_psk_certificate(

-    const AvbAtxCertificate* certificate,

-    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],

-    uint64_t minimum_version,

-    const uint8_t product_id[AVB_ATX_PRODUCT_ID_SIZE]) {

-  uint8_t expected_subject[AVB_SHA256_DIGEST_SIZE];

-  uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE];

-

-  sha256_str("com.google.android.things.vboot", expected_usage);

-  if (!verify_certificate(

-          certificate, authority, minimum_version, expected_usage)) {

-    avb_error("Invalid PSK certificate.\n");

-    return false;

-  }

-  sha256(product_id, AVB_ATX_PRODUCT_ID_SIZE, expected_subject);

-  if (0 != avb_safe_memcmp(certificate->signed_data.subject,

-                           expected_subject,

-                           AVB_SHA256_DIGEST_SIZE)) {

-    avb_error("PSK: Product ID mismatch.\n");

-    return false;

-  }

-  return true;

-}

-

-/* Verifies signature and fields of a PUK certificate. */

-static bool verify_puk_certificate(

-    const AvbAtxCertificate* certificate,

-    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],

-    uint64_t minimum_version,

-    const uint8_t product_id[AVB_ATX_PRODUCT_ID_SIZE]) {

-  uint8_t expected_subject[AVB_SHA256_DIGEST_SIZE];

-  uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE];

-

-  sha256_str("com.google.android.things.vboot.unlock", expected_usage);

-  if (!verify_certificate(

-          certificate, authority, minimum_version, expected_usage)) {

-    avb_error("Invalid PUK certificate.\n");

-    return false;

-  }

-  sha256(product_id, AVB_ATX_PRODUCT_ID_SIZE, expected_subject);

-  if (0 != avb_safe_memcmp(certificate->signed_data.subject,

-                           expected_subject,

-                           AVB_SHA256_DIGEST_SIZE)) {

-    avb_error("PUK: Product ID mismatch.\n");

-    return false;

-  }

-  return true;

-}

-

-AvbIOResult avb_atx_validate_vbmeta_public_key(

-    AvbOps* ops,

-    const uint8_t* public_key_data,

-    size_t public_key_length,

-    const uint8_t* public_key_metadata,

-    size_t public_key_metadata_length,

-    bool* out_is_trusted) {

-  AvbIOResult result = AVB_IO_RESULT_OK;

-  AvbAtxPermanentAttributes permanent_attributes;

-  uint8_t permanent_attributes_hash[AVB_SHA256_DIGEST_SIZE];

-  AvbAtxPublicKeyMetadata metadata;

-  uint64_t minimum_version;

-

-  /* Be pessimistic so we can exit early without having to remember to clear.

-   */

-  *out_is_trusted = false;

-

-  /* Read and verify permanent attributes. */

-  result = ops->atx_ops->read_permanent_attributes(ops->atx_ops,

-                                                   &permanent_attributes);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read permanent attributes.\n");

-    return result;

-  }

-  result = ops->atx_ops->read_permanent_attributes_hash(

-      ops->atx_ops, permanent_attributes_hash);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read permanent attributes hash.\n");

-    return result;

-  }

-  if (!verify_permanent_attributes(&permanent_attributes,

-                                   permanent_attributes_hash)) {

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Sanity check public key metadata. */

-  if (public_key_metadata_length != sizeof(AvbAtxPublicKeyMetadata)) {

-    avb_error("Invalid public key metadata.\n");

-    return AVB_IO_RESULT_OK;

-  }

-  avb_memcpy(&metadata, public_key_metadata, sizeof(AvbAtxPublicKeyMetadata));

-  if (metadata.version != 1) {

-    avb_error("Unsupported public key metadata.\n");

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Verify the PIK certificate. */

-  result = ops->read_rollback_index(

-      ops, AVB_ATX_PIK_VERSION_LOCATION, &minimum_version);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read PIK minimum version.\n");

-    return result;

-  }

-  if (!verify_pik_certificate(&metadata.product_intermediate_key_certificate,

-                              permanent_attributes.product_root_public_key,

-                              minimum_version)) {

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Verify the PSK certificate. */

-  result = ops->read_rollback_index(

-      ops, AVB_ATX_PSK_VERSION_LOCATION, &minimum_version);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read PSK minimum version.\n");

-    return result;

-  }

-  if (!verify_psk_certificate(

-          &metadata.product_signing_key_certificate,

-          metadata.product_intermediate_key_certificate.signed_data.public_key,

-          minimum_version,

-          permanent_attributes.product_id)) {

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Verify the PSK is the same key that verified vbmeta. */

-  if (public_key_length != AVB_ATX_PUBLIC_KEY_SIZE) {

-    avb_error("Public key length mismatch.\n");

-    return AVB_IO_RESULT_OK;

-  }

-  if (0 != avb_safe_memcmp(

-               metadata.product_signing_key_certificate.signed_data.public_key,

-               public_key_data,

-               AVB_ATX_PUBLIC_KEY_SIZE)) {

-    avb_error("Public key mismatch.\n");

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Report the key versions used during verification. */

-  ops->atx_ops->set_key_version(

-      ops->atx_ops,

-      AVB_ATX_PIK_VERSION_LOCATION,

-      metadata.product_intermediate_key_certificate.signed_data.key_version);

-  ops->atx_ops->set_key_version(

-      ops->atx_ops,

-      AVB_ATX_PSK_VERSION_LOCATION,

-      metadata.product_signing_key_certificate.signed_data.key_version);

-

-  *out_is_trusted = true;

-  return AVB_IO_RESULT_OK;

-}

-

-AvbIOResult avb_atx_generate_unlock_challenge(

-    AvbAtxOps* atx_ops, AvbAtxUnlockChallenge* out_unlock_challenge) {

-  AvbIOResult result = AVB_IO_RESULT_OK;

-  AvbAtxPermanentAttributes permanent_attributes;

-

-  /* We need the permanent attributes to compute the product_id_hash. */

-  result = atx_ops->read_permanent_attributes(atx_ops, &permanent_attributes);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read permanent attributes.\n");

-    return result;

-  }

-  result = atx_ops->get_random(

-      atx_ops, AVB_ATX_UNLOCK_CHALLENGE_SIZE, last_unlock_challenge);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to generate random challenge.\n");

-    return result;

-  }

-  out_unlock_challenge->version = 1;

-  sha256(permanent_attributes.product_id,

-         AVB_ATX_PRODUCT_ID_SIZE,

-         out_unlock_challenge->product_id_hash);

-  avb_memcpy(out_unlock_challenge->challenge,

-             last_unlock_challenge,

-             AVB_ATX_UNLOCK_CHALLENGE_SIZE);

-  return result;

-}

-

-AvbIOResult avb_atx_validate_unlock_credential(

-    AvbAtxOps* atx_ops,

-    const AvbAtxUnlockCredential* unlock_credential,

-    bool* out_is_trusted) {

-  AvbIOResult result = AVB_IO_RESULT_OK;

-  AvbAtxPermanentAttributes permanent_attributes;

-  uint8_t permanent_attributes_hash[AVB_SHA256_DIGEST_SIZE];

-  uint64_t minimum_version;

-  const AvbAlgorithmData* algorithm_data;

-  uint8_t challenge_hash[AVB_SHA512_DIGEST_SIZE];

-

-  /* Be pessimistic so we can exit early without having to remember to clear.

-   */

-  *out_is_trusted = false;

-

-  /* Sanity check the credential. */

-  if (unlock_credential->version != 1) {

-    avb_error("Unsupported unlock credential format.\n");

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Read and verify permanent attributes. */

-  result = atx_ops->read_permanent_attributes(atx_ops, &permanent_attributes);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read permanent attributes.\n");

-    return result;

-  }

-  result = atx_ops->read_permanent_attributes_hash(atx_ops,

-                                                   permanent_attributes_hash);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read permanent attributes hash.\n");

-    return result;

-  }

-  if (!verify_permanent_attributes(&permanent_attributes,

-                                   permanent_attributes_hash)) {

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Verify the PIK certificate. */

-  result = atx_ops->ops->read_rollback_index(

-      atx_ops->ops, AVB_ATX_PIK_VERSION_LOCATION, &minimum_version);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read PIK minimum version.\n");

-    return result;

-  }

-  if (!verify_pik_certificate(

-          &unlock_credential->product_intermediate_key_certificate,

-          permanent_attributes.product_root_public_key,

-          minimum_version)) {

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Verify the PUK certificate. The minimum version is shared with the PSK. */

-  result = atx_ops->ops->read_rollback_index(

-      atx_ops->ops, AVB_ATX_PSK_VERSION_LOCATION, &minimum_version);

-  if (result != AVB_IO_RESULT_OK) {

-    avb_error("Failed to read PSK minimum version.\n");

-    return result;

-  }

-  if (!verify_puk_certificate(

-          &unlock_credential->product_unlock_key_certificate,

-          unlock_credential->product_intermediate_key_certificate.signed_data

-              .public_key,

-          minimum_version,

-          permanent_attributes.product_id)) {

-    return AVB_IO_RESULT_OK;

-  }

-

-  /* Verify the challenge signature. */

-  algorithm_data = avb_get_algorithm_data(AVB_ALGORITHM_TYPE_SHA512_RSA4096);

-  sha512(last_unlock_challenge, AVB_ATX_UNLOCK_CHALLENGE_SIZE, challenge_hash);

-  if (!avb_rsa_verify(unlock_credential->product_unlock_key_certificate

-                          .signed_data.public_key,

-                      AVB_ATX_PUBLIC_KEY_SIZE,

-                      unlock_credential->challenge_signature,

-                      AVB_RSA4096_NUM_BYTES,

-                      challenge_hash,

-                      AVB_SHA512_DIGEST_SIZE,

-                      algorithm_data->padding,

-                      algorithm_data->padding_len)) {

-    avb_error("Invalid unlock challenge signature.\n");

-    return AVB_IO_RESULT_OK;

-  }

-

-  *out_is_trusted = true;

-  return AVB_IO_RESULT_OK;

-}

+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <android_avb/avb_atx_validate.h>
+
+#include <android_avb/avb_rsa.h>
+#include <android_avb/avb_sha.h>
+#include <android_avb/avb_sysdeps.h>
+#include <android_avb/avb_util.h>
+#include <android_avb/avb_ops_user.h>
+#include <android_avb/rk_avb_ops_user.h>
+#include <malloc.h>
+#include <common.h>
+#ifdef CONFIG_CRYPTO_ROCKCHIP
+#include <rockchip_crypto/rockchip_crypto.h>
+#endif
+
+/* The most recent unlock challenge generated. */
+static uint8_t last_unlock_challenge[AVB_ATX_UNLOCK_CHALLENGE_SIZE];
+
+/* Computes the SHA256 |hash| of |length| bytes of |data|. */
+static void sha256(const uint8_t* data,
+                   uint32_t length,
+                   uint8_t hash[AVB_SHA256_DIGEST_SIZE]) {
+  AvbSHA256Ctx context;
+  avb_sha256_init(&context);
+  avb_sha256_update(&context, data, length);
+  uint8_t* tmp = avb_sha256_final(&context);
+  avb_memcpy(hash, tmp, AVB_SHA256_DIGEST_SIZE);
+}
+
+/* Computes the SHA512 |hash| of |length| bytes of |data|. */
+static void sha512(const uint8_t* data,
+                   uint32_t length,
+                   uint8_t hash[AVB_SHA512_DIGEST_SIZE]) {
+  AvbSHA512Ctx context;
+  avb_sha512_init(&context);
+  avb_sha512_update(&context, data, length);
+  uint8_t* tmp = avb_sha512_final(&context);
+  avb_memcpy(hash, tmp, AVB_SHA512_DIGEST_SIZE);
+}
+
+/* Computes the SHA256 |hash| of a NUL-terminated |str|. */
+static void sha256_str(const char* str, uint8_t hash[AVB_SHA256_DIGEST_SIZE]) {
+  sha256((const uint8_t*)str, avb_strlen(str), hash);
+}
+
+/* Verifies structure and |expected_hash| of permanent |attributes|. */
+static bool verify_permanent_attributes(
+    const AvbAtxPermanentAttributes* attributes,
+    const uint8_t expected_hash[AVB_SHA256_DIGEST_SIZE]) {
+  uint8_t hash[AVB_SHA256_DIGEST_SIZE];
+#ifdef CONFIG_ROCKCHIP_PRELOADER_PUB_KEY
+#ifdef CONFIG_CRYPTO_ROCKCHIP
+  struct rk_pub_key pub_key;
+  int i;
+  uint8_t rsa_hash[256] = {0};
+  uint8_t rsa_hash_revert[256] = {0};
+  unsigned int rsaResult_temp[8];
+  unsigned char rsaResult[32] = {0};
+  char *temp;
+  struct rk_crypto_desc crypto_desc;
+  int ret = 0;
+
+  if (rk_crypto_probe())
+    return false;
+
+  memset(&pub_key, 0, sizeof(struct rk_pub_key));
+  ret = rk_avb_get_pub_key(&pub_key);
+  if (ret)
+    return false;
+
+  ret = rk_avb_get_perm_attr_cer(rsa_hash, 256);
+  if (ret) {
+    avb_error("get_perm_attr_cer error\n");
+    return false;
+  }
+
+  for (i = 0; i < 256; i++)
+    rsa_hash_revert[255-i] = rsa_hash[i];
+
+  ret = get_rk_crypto_desc(&crypto_desc);
+  if (ret) {
+    avb_error("get_rk_crypto_desc error\n");
+    return false;
+  }
+
+  ret = rk_crypto_rsa_init(&crypto_desc);
+  if (ret) {
+    avb_error("rk_crypto_rsa_init error\n");
+    return false;
+  }
+
+  ret = rk_crypto_rsa_start(&crypto_desc, (u32 *)(rsa_hash_revert),
+                            pub_key.rsa_n, pub_key.rsa_e, pub_key.rsa_c);
+  if (ret) {
+    avb_error("rk_crypto_rsa_start error\n");
+    return false;
+  }
+
+  ret = rk_crypto_rsa_end(&crypto_desc, rsaResult_temp);
+  if (ret) {
+    avb_error("rk_crypto_rsa_end error\n");
+    return false;
+  }
+
+  temp = (char *)rsaResult_temp;
+  for (i = 0; i < 32; i++)
+    rsaResult[31-i] = temp[i];
+
+  sha256((const uint8_t*)attributes, sizeof(AvbAtxPermanentAttributes), hash);
+  if (memcmp((void*)rsaResult, (void*)hash, 32) == 0)
+    return true;
+
+  return false;
+#endif
+#else
+  if (attributes->version != 1) {
+    avb_error("Unsupported permanent attributes version.\n");
+    return false;
+  }
+  sha256((const uint8_t*)attributes, sizeof(AvbAtxPermanentAttributes), hash);
+  if (0 != avb_safe_memcmp(hash, expected_hash, AVB_SHA256_DIGEST_SIZE)) {
+    avb_error("Invalid permanent attributes.\n");
+    return false;
+  }
+  return true;
+#endif
+}
+
+/* Verifies the format, key version, usage, and signature of a certificate. */
+static bool verify_certificate(
+    const AvbAtxCertificate* certificate,
+    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],
+    uint64_t minimum_key_version,
+    const uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE]) {
+  const AvbAlgorithmData* algorithm_data;
+  uint8_t certificate_hash[AVB_SHA512_DIGEST_SIZE];
+
+  if (certificate->signed_data.version != 1) {
+    avb_error("Unsupported certificate format.\n");
+    return false;
+  }
+  algorithm_data = avb_get_algorithm_data(AVB_ALGORITHM_TYPE_SHA512_RSA4096);
+  sha512((const uint8_t*)&certificate->signed_data,
+         sizeof(AvbAtxCertificateSignedData),
+         certificate_hash);
+  if (!avb_rsa_verify(authority,
+                      AVB_ATX_PUBLIC_KEY_SIZE,
+                      certificate->signature,
+                      AVB_RSA4096_NUM_BYTES,
+                      certificate_hash,
+                      AVB_SHA512_DIGEST_SIZE,
+                      algorithm_data->padding,
+                      algorithm_data->padding_len)) {
+    avb_error("Invalid certificate signature.\n");
+    return false;
+  }
+  if (certificate->signed_data.key_version < minimum_key_version) {
+    avb_error("Key rollback detected.\n");
+    return false;
+  }
+  if (0 != avb_safe_memcmp(certificate->signed_data.usage,
+                           expected_usage,
+                           AVB_SHA256_DIGEST_SIZE)) {
+    avb_error("Invalid certificate usage.\n");
+    return false;
+  }
+  return true;
+}
+
+/* Verifies signature and fields of a PIK certificate. */
+static bool verify_pik_certificate(
+    const AvbAtxCertificate* certificate,
+    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],
+    uint64_t minimum_version) {
+  uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE];
+
+  sha256_str("com.google.android.things.vboot.ca", expected_usage);
+  if (!verify_certificate(
+          certificate, authority, minimum_version, expected_usage)) {
+    avb_error("Invalid PIK certificate.\n");
+    return false;
+  }
+  return true;
+}
+
+/* Verifies signature and fields of a PSK certificate. */
+static bool verify_psk_certificate(
+    const AvbAtxCertificate* certificate,
+    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],
+    uint64_t minimum_version,
+    const uint8_t product_id[AVB_ATX_PRODUCT_ID_SIZE]) {
+  uint8_t expected_subject[AVB_SHA256_DIGEST_SIZE];
+  uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE];
+
+  sha256_str("com.google.android.things.vboot", expected_usage);
+  if (!verify_certificate(
+          certificate, authority, minimum_version, expected_usage)) {
+    avb_error("Invalid PSK certificate.\n");
+    return false;
+  }
+  sha256(product_id, AVB_ATX_PRODUCT_ID_SIZE, expected_subject);
+  if (0 != avb_safe_memcmp(certificate->signed_data.subject,
+                           expected_subject,
+                           AVB_SHA256_DIGEST_SIZE)) {
+    avb_error("PSK: Product ID mismatch.\n");
+    return false;
+  }
+  return true;
+}
+
+/* Verifies signature and fields of a PUK certificate. */
+static bool verify_puk_certificate(
+    const AvbAtxCertificate* certificate,
+    const uint8_t authority[AVB_ATX_PUBLIC_KEY_SIZE],
+    uint64_t minimum_version,
+    const uint8_t product_id[AVB_ATX_PRODUCT_ID_SIZE]) {
+  uint8_t expected_subject[AVB_SHA256_DIGEST_SIZE];
+  uint8_t expected_usage[AVB_SHA256_DIGEST_SIZE];
+
+  sha256_str("com.google.android.things.vboot.unlock", expected_usage);
+  if (!verify_certificate(
+          certificate, authority, minimum_version, expected_usage)) {
+    avb_error("Invalid PUK certificate.\n");
+    return false;
+  }
+  sha256(product_id, AVB_ATX_PRODUCT_ID_SIZE, expected_subject);
+  if (0 != avb_safe_memcmp(certificate->signed_data.subject,
+                           expected_subject,
+                           AVB_SHA256_DIGEST_SIZE)) {
+    avb_error("PUK: Product ID mismatch.\n");
+    return false;
+  }
+  return true;
+}
+
+AvbIOResult avb_atx_validate_vbmeta_public_key(
+    AvbOps* ops,
+    const uint8_t* public_key_data,
+    size_t public_key_length,
+    const uint8_t* public_key_metadata,
+    size_t public_key_metadata_length,
+    bool* out_is_trusted) {
+  AvbIOResult result = AVB_IO_RESULT_OK;
+  AvbAtxPermanentAttributes permanent_attributes;
+  uint8_t permanent_attributes_hash[AVB_SHA256_DIGEST_SIZE];
+  AvbAtxPublicKeyMetadata metadata;
+  uint64_t minimum_version;
+
+  /* Be pessimistic so we can exit early without having to remember to clear.
+   */
+  *out_is_trusted = false;
+
+  /* Read and verify permanent attributes. */
+  result = ops->atx_ops->read_permanent_attributes(ops->atx_ops,
+                                                   &permanent_attributes);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read permanent attributes.\n");
+    return result;
+  }
+  result = ops->atx_ops->read_permanent_attributes_hash(
+      ops->atx_ops, permanent_attributes_hash);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read permanent attributes hash.\n");
+    return result;
+  }
+  if (!verify_permanent_attributes(&permanent_attributes,
+                                   permanent_attributes_hash)) {
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Sanity check public key metadata. */
+  if (public_key_metadata_length != sizeof(AvbAtxPublicKeyMetadata)) {
+    avb_error("Invalid public key metadata.\n");
+    return AVB_IO_RESULT_OK;
+  }
+  avb_memcpy(&metadata, public_key_metadata, sizeof(AvbAtxPublicKeyMetadata));
+  if (metadata.version != 1) {
+    avb_error("Unsupported public key metadata.\n");
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Verify the PIK certificate. */
+  result = ops->read_rollback_index(
+      ops, AVB_ATX_PIK_VERSION_LOCATION, &minimum_version);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read PIK minimum version.\n");
+    return result;
+  }
+  if (!verify_pik_certificate(&metadata.product_intermediate_key_certificate,
+                              permanent_attributes.product_root_public_key,
+                              minimum_version)) {
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Verify the PSK certificate. */
+  result = ops->read_rollback_index(
+      ops, AVB_ATX_PSK_VERSION_LOCATION, &minimum_version);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read PSK minimum version.\n");
+    return result;
+  }
+  if (!verify_psk_certificate(
+          &metadata.product_signing_key_certificate,
+          metadata.product_intermediate_key_certificate.signed_data.public_key,
+          minimum_version,
+          permanent_attributes.product_id)) {
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Verify the PSK is the same key that verified vbmeta. */
+  if (public_key_length != AVB_ATX_PUBLIC_KEY_SIZE) {
+    avb_error("Public key length mismatch.\n");
+    return AVB_IO_RESULT_OK;
+  }
+  if (0 != avb_safe_memcmp(
+               metadata.product_signing_key_certificate.signed_data.public_key,
+               public_key_data,
+               AVB_ATX_PUBLIC_KEY_SIZE)) {
+    avb_error("Public key mismatch.\n");
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Report the key versions used during verification. */
+  ops->atx_ops->set_key_version(
+      ops->atx_ops,
+      AVB_ATX_PIK_VERSION_LOCATION,
+      metadata.product_intermediate_key_certificate.signed_data.key_version);
+  ops->atx_ops->set_key_version(
+      ops->atx_ops,
+      AVB_ATX_PSK_VERSION_LOCATION,
+      metadata.product_signing_key_certificate.signed_data.key_version);
+
+  *out_is_trusted = true;
+  return AVB_IO_RESULT_OK;
+}
+
+AvbIOResult avb_atx_generate_unlock_challenge(
+    AvbAtxOps* atx_ops, AvbAtxUnlockChallenge* out_unlock_challenge) {
+  AvbIOResult result = AVB_IO_RESULT_OK;
+  AvbAtxPermanentAttributes permanent_attributes;
+
+  /* We need the permanent attributes to compute the product_id_hash. */
+  result = atx_ops->read_permanent_attributes(atx_ops, &permanent_attributes);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read permanent attributes.\n");
+    return result;
+  }
+  result = atx_ops->get_random(
+      atx_ops, AVB_ATX_UNLOCK_CHALLENGE_SIZE, last_unlock_challenge);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to generate random challenge.\n");
+    return result;
+  }
+  out_unlock_challenge->version = 1;
+  sha256(permanent_attributes.product_id,
+         AVB_ATX_PRODUCT_ID_SIZE,
+         out_unlock_challenge->product_id_hash);
+  avb_memcpy(out_unlock_challenge->challenge,
+             last_unlock_challenge,
+             AVB_ATX_UNLOCK_CHALLENGE_SIZE);
+  return result;
+}
+
+AvbIOResult avb_atx_validate_unlock_credential(
+    AvbAtxOps* atx_ops,
+    const AvbAtxUnlockCredential* unlock_credential,
+    bool* out_is_trusted) {
+  AvbIOResult result = AVB_IO_RESULT_OK;
+  AvbAtxPermanentAttributes permanent_attributes;
+  uint8_t permanent_attributes_hash[AVB_SHA256_DIGEST_SIZE];
+  uint64_t minimum_version;
+  const AvbAlgorithmData* algorithm_data;
+  uint8_t challenge_hash[AVB_SHA512_DIGEST_SIZE];
+
+  /* Be pessimistic so we can exit early without having to remember to clear.
+   */
+  *out_is_trusted = false;
+
+  /* Sanity check the credential. */
+  if (unlock_credential->version != 1) {
+    avb_error("Unsupported unlock credential format.\n");
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Read and verify permanent attributes. */
+  result = atx_ops->read_permanent_attributes(atx_ops, &permanent_attributes);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read permanent attributes.\n");
+    return result;
+  }
+  result = atx_ops->read_permanent_attributes_hash(atx_ops,
+                                                   permanent_attributes_hash);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read permanent attributes hash.\n");
+    return result;
+  }
+  if (!verify_permanent_attributes(&permanent_attributes,
+                                   permanent_attributes_hash)) {
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Verify the PIK certificate. */
+  result = atx_ops->ops->read_rollback_index(
+      atx_ops->ops, AVB_ATX_PIK_VERSION_LOCATION, &minimum_version);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read PIK minimum version.\n");
+    return result;
+  }
+  if (!verify_pik_certificate(
+          &unlock_credential->product_intermediate_key_certificate,
+          permanent_attributes.product_root_public_key,
+          minimum_version)) {
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Verify the PUK certificate. The minimum version is shared with the PSK. */
+  result = atx_ops->ops->read_rollback_index(
+      atx_ops->ops, AVB_ATX_PSK_VERSION_LOCATION, &minimum_version);
+  if (result != AVB_IO_RESULT_OK) {
+    avb_error("Failed to read PSK minimum version.\n");
+    return result;
+  }
+  if (!verify_puk_certificate(
+          &unlock_credential->product_unlock_key_certificate,
+          unlock_credential->product_intermediate_key_certificate.signed_data
+              .public_key,
+          minimum_version,
+          permanent_attributes.product_id)) {
+    return AVB_IO_RESULT_OK;
+  }
+
+  /* Verify the challenge signature. */
+  algorithm_data = avb_get_algorithm_data(AVB_ALGORITHM_TYPE_SHA512_RSA4096);
+  sha512(last_unlock_challenge, AVB_ATX_UNLOCK_CHALLENGE_SIZE, challenge_hash);
+  if (!avb_rsa_verify(unlock_credential->product_unlock_key_certificate
+                          .signed_data.public_key,
+                      AVB_ATX_PUBLIC_KEY_SIZE,
+                      unlock_credential->challenge_signature,
+                      AVB_RSA4096_NUM_BYTES,
+                      challenge_hash,
+                      AVB_SHA512_DIGEST_SIZE,
+                      algorithm_data->padding,
+                      algorithm_data->padding_len)) {
+    avb_error("Invalid unlock challenge signature.\n");
+    return AVB_IO_RESULT_OK;
+  }
+
+  *out_is_trusted = true;
+  return AVB_IO_RESULT_OK;
+}
diff --git a/lib/avb/libavb_user/Kconfig b/lib/avb/libavb_user/Kconfig
index c9a8da265a..6a5a307d4a 100755
--- a/lib/avb/libavb_user/Kconfig
+++ b/lib/avb/libavb_user/Kconfig
@@ -7,15 +7,16 @@ config AVB_LIBAVB_USER
 	  to fastboot and kernel.
 
 config AVB_VBMETA_PUBLIC_KEY_VALIDATE
-        bool "Support vbmeta public key validate"
-        depends on AVB_LIBAVB_USER
-        help
-          support vbmeta public key validate, system bootflow would be
-          uninterruptale when it is enabled:
-            - only allow "boot_android" as bootcmd;
-            - enter rockusb or fastboot when boot failed;
-            - not allow ctrl+c to enter hush;
-          only the CONFIG_BOOTDELAY can interrupt the bootflow.
+	bool "Support vbmeta public key validate"
+	depends on AVB_LIBAVB_USER
+	select CONSOLE_DISABLE_CTRLC
+	help
+	  support vbmeta public key validate, system bootflow would be
+	  uninterruptale when it is enabled:
+	    - only allow "boot_android" as bootcmd;
+	    - enter rockusb or fastboot when boot failed;
+	    - not allow ctrl+c to enter hush;
+	  only the CONFIG_BOOTDELAY can interrupt the bootflow.
 
 config SPL_AVB_LIBAVB_USER
 	bool "Android AVB read/write hardware for spl"
diff --git a/lib/avb/libavb_user/avb_ops_user.c b/lib/avb/libavb_user/avb_ops_user.c
index ba20a41fc8..9d4db76340 100644
--- a/lib/avb/libavb_user/avb_ops_user.c
+++ b/lib/avb/libavb_user/avb_ops_user.c
@@ -354,6 +354,7 @@ AvbIOResult avb_read_perm_attr(AvbAtxOps *atx_ops,
 AvbIOResult avb_read_perm_attr_hash(AvbAtxOps *atx_ops,
 				    uint8_t hash[AVB_SHA256_DIGEST_SIZE])
 {
+#ifndef CONFIG_ROCKCHIP_PRELOADER_PUB_KEY
 #ifdef CONFIG_OPTEE_CLIENT
 	if (trusty_read_attribute_hash((uint32_t *)hash,
 				       AVB_SHA256_DIGEST_SIZE / 4))
@@ -362,6 +363,7 @@ AvbIOResult avb_read_perm_attr_hash(AvbAtxOps *atx_ops,
 	avb_error("Please open the macro!\n");
 	return -1;
 #endif
+#endif
 	return AVB_IO_RESULT_OK;
 }
 
diff --git a/lib/avb/rk_avb_user/Kconfig b/lib/avb/rk_avb_user/Kconfig
index b183bfcc72..eb324616bd 100755
--- a/lib/avb/rk_avb_user/Kconfig
+++ b/lib/avb/rk_avb_user/Kconfig
@@ -20,3 +20,10 @@ config TPL_RK_AVB_LIBAVB_USER
 	  This config support the android things system to
 	  read/write hardware image, like vbmeta, misc, and
 	  so on. And it can provide some a/b and avb information
+
+config ROCKCHIP_PRELOADER_PUB_KEY
+	bool "Rockchip AVB use pre-loader public key"
+	depends on AVB_LIBAVB_USER
+	select CRYPTO_ROCKCHIP
+	help
+	  Use pre-loader public key to decode in avb.
diff --git a/lib/avb/rk_avb_user/rk_avb_ops_user.c b/lib/avb/rk_avb_user/rk_avb_ops_user.c
index b58a81fe95..f14ff8ad22 100644
--- a/lib/avb/rk_avb_user/rk_avb_ops_user.c
+++ b/lib/avb/rk_avb_user/rk_avb_ops_user.c
@@ -24,8 +24,45 @@
 #include <android_avb/avb_atx_validate.h>
 #include <android_avb/rk_avb_ops_user.h>
 #include <boot_rkimg.h>
+#include <asm/arch/rk_atags.h>
 
 /* rk used */
+int rk_avb_get_pub_key(struct rk_pub_key *pub_key)
+{
+	struct tag *t = NULL;
+
+	t = atags_get_tag(ATAG_PUB_KEY);
+	if (!t)
+		return -1;
+
+	memcpy(pub_key, t->u.pub_key.data, sizeof(struct rk_pub_key));
+
+	return 0;
+}
+int rk_avb_get_perm_attr_cer(uint8_t *cer, uint32_t size)
+{
+#ifdef CONFIG_OPTEE_CLIENT
+	if (trusty_read_permanent_attributes_cer((uint8_t *)cer, size))
+		return -EIO;
+
+	return 0;
+#else
+	return -1;
+#endif
+}
+
+int rk_avb_set_perm_attr_cer(uint8_t *cer, uint32_t size)
+{
+#ifdef CONFIG_OPTEE_CLIENT
+	if (trusty_write_permanent_attributes_cer((uint8_t *)cer, size))
+		return -EIO;
+
+	return 0;
+#else
+	return -1;
+#endif
+}
+
 int rk_avb_read_slot_count(char *slot_count)
 {
 	*slot_count = SLOT_NUM;
@@ -117,8 +154,14 @@ int rk_avb_get_current_slot(char *select_slot)
 	}
 
 	if (rk_avb_ab_slot_select(ops->ab_ops, select_slot) != 0) {
-		printf("get_current_slot error!\n");
-		ret = -1;
+		printf("###There is no bootable slot, bring up last_boot!###\n");
+		if (rk_get_lastboot() == 1)
+			memcpy(select_slot, "_b", 2);
+		else if(rk_get_lastboot() == 0)
+			memcpy(select_slot, "_a", 2);
+		else
+			return -1;
+		ret = 0;
 	}
 
 	avb_ops_user_free(ops);
@@ -697,3 +740,30 @@ int rk_generate_unlock_challenge(void *buffer, uint32_t *challenge_len)
 	else
 		return -1;
 }
+
+int rk_get_lastboot(void)
+{
+
+	AvbIOResult io_ret = AVB_IO_RESULT_OK;
+	AvbABData ab_data;
+	int lastboot = -1;
+	AvbOps* ops;
+
+	ops = avb_ops_user_new();
+	if (ops == NULL) {
+		printf("avb_ops_user_new() failed!\n");
+		return -1;
+	}
+
+	io_ret = ops->ab_ops->read_ab_metadata(ops->ab_ops, &ab_data);
+	if (io_ret != AVB_IO_RESULT_OK) {
+		avb_error("I/O error while loading A/B metadata.\n");
+		goto out;
+	}
+
+	lastboot = ab_data.last_boot;
+out:
+	avb_ops_user_free(ops);
+
+	return lastboot;
+}
diff --git a/lib/bidram.c b/lib/bidram.c
new file mode 100644
index 0000000000..b6859150fd
--- /dev/null
+++ b/lib/bidram.c
@@ -0,0 +1,445 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Fuzhou Rockchip Electronics Co., Ltd
+ */
+
+#include <common.h>
+#include <lmb.h>
+#include <bidram.h>
+#include <malloc.h>
+#include <sysmem.h>
+#include <asm/io.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#define MAX_BAD_MEMBLK		8
+
+#define BIDRAM_R(fmt, args...)	printf(fmt, ##args)
+#define BIDRAM_I(fmt, args...)	printf("Bidram: "fmt, ##args)
+#define BIDRAM_W(fmt, args...)	printf("Bidram Warn: "fmt, ##args)
+#define BIDRAM_E(fmt, args...)	printf("Bidram Error: "fmt, ##args)
+#define BIDRAM_D(fmt, args...)	 debug("Bidram Debug: "fmt, ##args)
+
+struct bidram plat_bidram __section(".data") = { .has_init = false, };
+
+static int bidram_has_init(void)
+{
+	if (!plat_bidram.has_init) {
+		BIDRAM_E("Framework is not initialized\n");
+		return 0;
+	}
+
+	return 1;
+}
+
+void bidram_dump(void)
+{
+	struct bidram *bidram = &plat_bidram;
+	struct lmb *lmb = &bidram->lmb;
+	struct memblock *mem;
+	struct list_head *node;
+	ulong memory_size = 0;
+	ulong reserved_size = 0;
+	ulong i;
+
+	if (!bidram_has_init())
+		return;
+
+	printf("\n\nbidram_dump_all:\n");
+
+	/* Memory pool */
+	printf("    --------------------------------------------------------------------\n");
+	for (i = 0; i < lmb->memory.cnt; i++) {
+		memory_size += lmb->memory.region[i].size;
+		printf("    memory.rgn[%ld].addr     = 0x%08lx - 0x%08lx (size: 0x%08lx)\n", i,
+		       (ulong)lmb->memory.region[i].base,
+		       (ulong)lmb->memory.region[i].base +
+		       (ulong)lmb->memory.region[i].size,
+		       (ulong)lmb->memory.region[i].size);
+	}
+	printf("\n    memory.total	   = 0x%08lx (%ld MiB. %ld KiB)\n",
+	       (ulong)memory_size,
+	       SIZE_MB((ulong)memory_size),
+	       SIZE_KB((ulong)memory_size));
+
+	/* Reserved */
+	i = 0;
+	printf("    --------------------------------------------------------------------\n");
+	list_for_each(node, &bidram->reserved_head) {
+		mem = list_entry(node, struct memblock, node);
+		reserved_size += mem->size;
+		printf("    reserved.rgn[%ld].name   = \"%s\"\n", i, mem->attr.name);
+		printf("		   .addr   = 0x%08lx - 0x%08lx (size: 0x%08lx)\n",
+		       (ulong)mem->base, (ulong)mem->base + (ulong)mem->size,
+		       (ulong)mem->size);
+		i++;
+	}
+	printf("\n    reserved.total	   = 0x%08lx (%ld MiB. %ld KiB)\n",
+	       (ulong)reserved_size,
+	       SIZE_MB((ulong)reserved_size),
+	       SIZE_KB((ulong)reserved_size));
+
+	/* LMB core reserved */
+	printf("    --------------------------------------------------------------------\n");
+	reserved_size = 0;
+	for (i = 0; i < lmb->reserved.cnt; i++) {
+		reserved_size += lmb->reserved.region[i].size;
+		printf("    LMB.reserved[%ld].addr   = 0x%08lx - 0x%08lx (size: 0x%08lx)\n", i,
+		       (ulong)lmb->reserved.region[i].base,
+		       (ulong)lmb->reserved.region[i].base +
+		       (ulong)lmb->reserved.region[i].size,
+		       (ulong)lmb->reserved.region[i].size);
+	}
+
+	printf("\n    reserved.core.total	   = 0x%08lx (%ld MiB. %ld KiB)\n",
+	       (ulong)reserved_size,
+	       SIZE_MB((ulong)reserved_size),
+	       SIZE_KB((ulong)reserved_size));
+	printf("    --------------------------------------------------------------------\n\n");
+}
+
+static int bidram_add(phys_addr_t base, phys_size_t size)
+{
+	struct bidram *bidram = &plat_bidram;
+	int ret;
+
+	if (!bidram_has_init())
+		return -ENOSYS;
+
+	if (!size)
+		return -EINVAL;
+
+	ret = lmb_add(&bidram->lmb, base, size);
+	if (ret < 0)
+		BIDRAM_E("Failed to add bidram at 0x%08lx - 0x%08lx\n",
+			 (ulong)base, (ulong)(base + size));
+
+	return (ret >= 0) ? 0 : ret;
+}
+
+void bidram_gen_gd_bi_dram(void)
+{
+	struct lmb *lmb = &plat_bidram.lmb;
+	struct lmb_property *mem_rgn = lmb->memory.region;
+	struct lmb_property *res_rgn = lmb->reserved.region;
+	int rsv_cnt = lmb->reserved.cnt;
+	int i, idx = 0;
+
+	if (!gd || !gd->bd) {
+		BIDRAM_D("Ignore bi dram bank update\n");
+		return;
+	}
+
+	/*
+	 * LBM default init:
+	 *		lmb->reserved.cnt = 1;
+	 *		lmb->reserved.region[0].base = 0;
+	 *		lmb->reserved.region[0].size = 0;
+	 *
+	 * Here handle that: there is the only one dram bank available.
+	 */
+	if (rsv_cnt == 1 && !res_rgn[0].base && !res_rgn[0].size) {
+		gd->bd->bi_dram[0].start = mem_rgn[0].base;
+		gd->bd->bi_dram[0].size = mem_rgn[0].size;
+		goto done;
+	}
+
+	/* If reserved rgn is not from sdram start */
+	if (res_rgn[0].base != mem_rgn[0].base) {
+		gd->bd->bi_dram[idx].start = mem_rgn[0].base;
+		gd->bd->bi_dram[idx].size  = res_rgn[0].base -
+					     gd->bd->bi_dram[idx].start;
+		idx++;
+	}
+
+	/*
+	 * Note: If reserved rgn is not from sdram start, idx=1 now, otherwise 0.
+	 */
+	for (i = 0; i < rsv_cnt; i++, idx++) {
+		if (res_rgn[i].base + res_rgn[i].size >= gd->ram_top)
+			goto done;
+
+		gd->bd->bi_dram[idx].start = res_rgn[i].base + res_rgn[i].size;
+		if (i + 1 < rsv_cnt)
+			gd->bd->bi_dram[idx].size = res_rgn[i + 1].base -
+					    gd->bd->bi_dram[idx].start;
+		else
+			gd->bd->bi_dram[idx].size = gd->ram_top -
+					    gd->bd->bi_dram[idx].start;
+	}
+done:
+	for (i = 0; i < idx; i++) {
+		BIDRAM_D("gd bi_dram[%d]: start=0x%08lx, end=0x%08lx\n",
+			 i, (ulong)gd->bd->bi_dram[i].start,
+			 (ulong)gd->bd->bi_dram[i].start +
+			 (ulong)gd->bd->bi_dram[i].size);
+	}
+}
+
+static int bidram_is_overlap(phys_addr_t base1, phys_size_t size1,
+			     phys_addr_t base2, phys_size_t size2)
+{
+	return ((base1 < (base2 + size2)) && (base2 < (base1 + size1)));
+}
+
+static int bidram_core_reserve(enum memblk_id id, const char *mem_name,
+			       phys_addr_t base, phys_size_t size)
+{
+	struct bidram *bidram = &plat_bidram;
+	struct memblk_attr attr;
+	struct memblock *mem;
+	struct list_head *node;
+	const char *name;
+	int ret;
+
+	if (!bidram_has_init())
+		return -ENOSYS;
+
+	if (id == MEMBLK_ID_BY_NAME) {
+		if (!mem_name) {
+			BIDRAM_E("NULL name for reserve bidram\n");
+			return -EINVAL;
+		} else {
+			name = mem_name;
+		}
+	} else {
+		if (id > MEMBLK_ID_UNK && id < MEMBLK_ID_MAX) {
+			attr = mem_attr[id];
+			name = attr.name;
+		} else {
+			BIDRAM_E("Unsupport memblk id %d for reserve bidram\n", id);
+			return -EINVAL;
+		}
+	}
+
+	if (!name) {
+		BIDRAM_E("NULL name for reserved bidram\n");
+		return -EINVAL;
+	}
+
+	if (!size)
+		return 0;
+
+	/* Check overlap */
+	list_for_each(node, &bidram->reserved_head) {
+		mem = list_entry(node, struct memblock, node);
+		BIDRAM_D("Has reserved: %s 0x%08lx - 0x%08lx\n",
+			 mem->attr.name, (ulong)mem->base,
+			 (ulong)(mem->base + mem->size));
+		if (!strcmp(mem->attr.name, name)) {
+			BIDRAM_E("Failed to double reserve for existence \"%s\"\n", name);
+			return -EEXIST;
+		} else if (bidram_is_overlap(mem->base, mem->size, base, size)) {
+			BIDRAM_D("\"%s\" (0x%08lx - 0x%08lx) reserve is "
+				 "overlap with existence \"%s\" (0x%08lx - "
+				 "0x%08lx)\n",
+				 name, (ulong)base, (ulong)(base + size), mem->attr.name,
+				 (ulong)mem->base, (ulong)(mem->base + mem->size));
+		}
+	}
+
+	BIDRAM_D("Reserve: \"%s\" 0x%08lx - 0x%08lx\n",
+		 name, (ulong)base, (ulong)(base + size));
+
+	ret = lmb_reserve(&bidram->lmb, base, size);
+	if (ret >= 0) {
+		mem = malloc(sizeof(*mem));
+		if (!mem) {
+			BIDRAM_E("No memory for \"%s\" reserve bidram\n", name);
+			return -ENOMEM;
+		}
+
+#ifdef CONFIG_SYSMEM
+		/* Sync to sysmem */
+		if (sysmem_has_init()) {
+			void *paddr;
+
+			if (id == MEMBLK_ID_BY_NAME)
+				paddr = sysmem_alloc_base_by_name(name, base, size);
+			else
+				paddr = sysmem_alloc_base(id, base, size);
+			if (!paddr) {
+				BIDRAM_E("Sync \"%s\" to sysmem failed\n", name);
+				return -ENOMEM;
+			}
+		}
+#endif
+		mem->base = base;
+		mem->size = size;
+		if (id == MEMBLK_ID_BY_NAME) {
+			mem->attr.name = name;
+			mem->attr.flags = 0;
+		} else {
+			mem->attr = attr;
+		}
+		list_add_tail(&mem->node, &bidram->reserved_head);
+	} else {
+		BIDRAM_E("Failed to reserve \"%s\" 0x%08lx - 0x%08lx\n",
+			 name, (ulong)base, (ulong)(base + size));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int bidram_reserve(enum memblk_id id, phys_addr_t base, phys_size_t size)
+{
+	int ret;
+
+	ret = bidram_core_reserve(id, NULL, base, size);
+	if (!ret)
+		bidram_gen_gd_bi_dram();
+	else
+		bidram_dump();
+
+	return ret;
+}
+
+int bidram_reserve_by_name(const char *name,
+			   phys_addr_t base, phys_size_t size)
+{
+	int ret;
+
+	ret = bidram_core_reserve(MEMBLK_ID_BY_NAME, name, base, size);
+	if (!ret)
+		bidram_gen_gd_bi_dram();
+	else
+		bidram_dump();
+
+	return ret;
+}
+
+int bidram_initr(void)
+{
+	return !bidram_get_ram_size();
+}
+
+phys_size_t bidram_get_ram_size(void)
+{
+	struct bidram *bidram = &plat_bidram;
+	struct memblock bad[MAX_BAD_MEMBLK];
+	struct memblock *list;
+	phys_size_t ram_addr_end = CONFIG_SYS_SDRAM_BASE;
+	phys_addr_t end_addr;
+	parse_fn_t parse_fn;
+	int i, count, ret;
+	int bad_cnt = 0;
+	char bad_name[12];
+
+	parse_fn = board_bidram_parse_fn();
+	if (!parse_fn) {
+		BIDRAM_E("Can't find dram parse fn\n");
+		return 0;
+	}
+
+	list = parse_fn(&count);
+	if (!list) {
+		BIDRAM_E("Can't get dram banks\n");
+		return 0;
+	}
+
+	if (count > CONFIG_NR_DRAM_BANKS) {
+		BIDRAM_E("Too many dram banks, %d is over max: %d\n",
+			 count, CONFIG_NR_DRAM_BANKS);
+		return 0;
+	}
+
+	/* Initial plat_bidram */
+	lmb_init(&bidram->lmb);
+	INIT_LIST_HEAD(&bidram->reserved_head);
+	bidram->has_init = true;
+
+	/* Initial memory pool */
+	for (i = 0; i < count; i++) {
+		BIDRAM_D("Add bank[%d] start=0x%08lx, end=0x%08lx\n",
+			 i, (ulong)list[i].base,
+			 (ulong)list[i].base + (ulong)list[i].size);
+
+		if (!list[i].size)
+			continue;
+
+		/* We assume the last block gives the ram addr end */
+		if (i == count - 1) {
+			ram_addr_end = list[i].base + list[i].size;
+			ret = bidram_add(CONFIG_SYS_SDRAM_BASE,
+					 ram_addr_end - CONFIG_SYS_SDRAM_BASE);
+			if (ret) {
+				BIDRAM_E("Failed to add bidram from bi_dram[%d]\n", i);
+				return 0;
+			}
+		}
+
+		/* This is a bad dram bank? record it */
+		if (i > 0) {
+			end_addr = list[i - 1].base + list[i - 1].size;
+
+			if (list[i].base != end_addr) {
+				snprintf(bad_name, 12, "%s%d", "BAD_RAM.", i - 1);
+				bad[bad_cnt].attr.name = strdup(bad_name);
+				bad[bad_cnt].base = end_addr;
+				bad[bad_cnt].size = list[i].base - end_addr;
+				bad_cnt++;
+				if (bad_cnt > MAX_BAD_MEMBLK) {
+					BIDRAM_E("Too many bad memory blocks\n");
+					return 0;
+				}
+			}
+		}
+	}
+
+	/* Reserve bad dram bank after bidram_add(), treat as reserved region */
+	for (i = 0; i < bad_cnt; i++) {
+		if (gd->flags & GD_FLG_RELOC)
+			BIDRAM_R("Bad memblk%d: 0x%08lx - 0x%08lx\n",
+				 i, (ulong)bad[i].base,
+				 (ulong)bad[i].base + (ulong)bad[i].size);
+
+		ret = bidram_reserve_by_name(bad[i].attr.name,
+					     bad[i].base, bad[i].size);
+		if (ret) {
+			BIDRAM_E("Failed to add bad memblk[%d]\n", i);
+			return 0;
+		}
+	}
+
+	/* Reserved for board */
+	ret = board_bidram_reserve(bidram);
+	if (ret) {
+		BIDRAM_E("Failed to reserve bidram for board\n");
+		return 0;
+	}
+
+	BIDRAM_D("DRAM size: 0x%08lx\n",
+		 (ulong)ram_addr_end - CONFIG_SYS_SDRAM_BASE);
+
+#ifdef DEBUG
+	bidram_dump();
+#endif
+
+	return (ram_addr_end - CONFIG_SYS_SDRAM_BASE);
+}
+
+__weak parse_fn_t board_bidram_parse_fn(void)
+{
+	/* please define platform specific board_bidram_parse_fn() */
+	return NULL;
+}
+
+__weak int board_bidram_reserve(struct bidram *bidram)
+{
+	/* please define platform specific board_bidram_reserve() */
+	return 0;
+}
+
+static int do_dump_bidram(cmd_tbl_t *cmdtp, int flag,
+			  int argc, char *const argv[])
+{
+	bidram_dump();
+	return 0;
+}
+
+U_BOOT_CMD(
+	dump_bidram, 1, 1, do_dump_bidram,
+	"Dump bidram layout",
+	""
+);
diff --git a/lib/fdtdec.c b/lib/fdtdec.c
index d06dbdf10b..863d6142e7 100644
--- a/lib/fdtdec.c
+++ b/lib/fdtdec.c
@@ -92,16 +92,6 @@ fdt_addr_t fdtdec_get_addr_size_fixed(const void *blob, int node,
 
 	debug("%s: %s: ", __func__, prop_name);
 
-	if (na > (sizeof(fdt_addr_t) / sizeof(fdt32_t))) {
-		debug("(na too large for fdt_addr_t type)\n");
-		return FDT_ADDR_T_NONE;
-	}
-
-	if (ns > (sizeof(fdt_size_t) / sizeof(fdt32_t))) {
-		debug("(ns too large for fdt_size_t type)\n");
-		return FDT_ADDR_T_NONE;
-	}
-
 	prop = fdt_getprop(blob, node, prop_name, &len);
 	if (!prop) {
 		debug("(not found)\n");
diff --git a/lib/optee_clientApi/OpteeClientApiLib.c b/lib/optee_clientApi/OpteeClientApiLib.c
index a2f8c12ab4..01f24ddb3e 100644
--- a/lib/optee_clientApi/OpteeClientApiLib.c
+++ b/lib/optee_clientApi/OpteeClientApiLib.c
@@ -17,11 +17,18 @@ TEEC_Result OpteeClientApiLibInitialize(void)
 {
 	TEEC_Result status = TEEC_SUCCESS;
 
-	OpteeClientMemInit();
-
-	OpteeClientRkFsInit();
+	status = OpteeClientMemInit();
+	if (status != TEEC_SUCCESS) {
+		printf("OpteeClientMemInit fail!");
+		return status;
+	}
+	status = OpteeClientRkFsInit();
+	if (status != TEEC_SUCCESS) {
+		printf("OpteeClientRkFsInit fail!");
+		return status;
+	}
 
-	return status;
+	return TEEC_SUCCESS;
 }
 
 /*
diff --git a/lib/optee_clientApi/OpteeClientInterface.c b/lib/optee_clientApi/OpteeClientInterface.c
index d2d5c758f4..c2f931ecc3 100644
--- a/lib/optee_clientApi/OpteeClientInterface.c
+++ b/lib/optee_clientApi/OpteeClientInterface.c
@@ -15,7 +15,7 @@
 
 #define	BOOT_FROM_EMMC	(1 << 1)
 
-void test_optee(void)
+uint32_t test_optee(void)
 {
 	TEEC_Result TeecResult;
 	TEEC_Context TeecContext;
@@ -29,13 +29,16 @@ void test_optee(void)
 	dev_desc = rockchip_get_bootdev();
 	if (!dev_desc) {
 		printf("%s: dev_desc is NULL!\n", __func__);
-		return;
+		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -54,6 +57,8 @@ void test_optee(void)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -61,6 +66,8 @@ void test_optee(void)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "filename_test", SharedMem0.size);
 
@@ -70,6 +77,8 @@ void test_optee(void)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memset(SharedMem1.buffer, 'a', SharedMem1.size);
 
@@ -89,16 +98,14 @@ void test_optee(void)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
-
 	TEEC_CloseSession(&TeecSession);
-
 	TEEC_FinalizeContext(&TeecContext);
-
-	debug("testmm end\n");
-	debug("TeecResult %x\n", TeecResult);
+	return TeecResult;
 }
 
 static uint8_t b2hs_add_base(uint8_t in)
@@ -146,10 +153,14 @@ uint32_t trusty_read_rollback_index(uint32_t slot, uint64_t *value)
 	}
 
 	b2hs((uint8_t *)&slot, hs, 4, 9);
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -167,8 +178,9 @@ uint32_t trusty_read_rollback_index(uint32_t slot, uint64_t *value)
 				TEEC_LOGIN_PUBLIC,
 				NULL,
 				&TeecOperation,
-
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -176,6 +188,8 @@ uint32_t trusty_read_rollback_index(uint32_t slot, uint64_t *value)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, hs, SharedMem0.size);
 
@@ -185,6 +199,8 @@ uint32_t trusty_read_rollback_index(uint32_t slot, uint64_t *value)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -203,15 +219,12 @@ uint32_t trusty_read_rollback_index(uint32_t slot, uint64_t *value)
 					&ErrorOrigin);
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy((char *)value, SharedMem1.buffer, SharedMem1.size);
-
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
-
 	TEEC_CloseSession(&TeecSession);
-
 	TEEC_FinalizeContext(&TeecContext);
 
-	debug("testmm end\n");
 	return TeecResult;
 }
 
@@ -234,9 +247,13 @@ uint32_t trusty_write_rollback_index(uint32_t slot, uint64_t value)
 	}
 
 	b2hs((uint8_t *)&slot, hs, 4, 9);
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -255,6 +272,8 @@ uint32_t trusty_write_rollback_index(uint32_t slot, uint64_t value)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -262,6 +281,8 @@ uint32_t trusty_write_rollback_index(uint32_t slot, uint64_t value)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, hs, SharedMem0.size);
 
@@ -271,6 +292,8 @@ uint32_t trusty_write_rollback_index(uint32_t slot, uint64_t value)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem1.buffer, (char *)&value, SharedMem1.size);
 
@@ -290,16 +313,14 @@ uint32_t trusty_write_rollback_index(uint32_t slot, uint64_t value)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
-
 	TEEC_CloseSession(&TeecSession);
-
 	TEEC_FinalizeContext(&TeecContext);
 
-	debug("testmm end\n");
-
 	return TeecResult;
 }
 
@@ -320,10 +341,13 @@ uint32_t trusty_read_permanent_attributes(uint8_t *attributes, uint32_t size)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -342,6 +366,8 @@ uint32_t trusty_read_permanent_attributes(uint8_t *attributes, uint32_t size)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -349,6 +375,8 @@ uint32_t trusty_read_permanent_attributes(uint8_t *attributes, uint32_t size)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "attributes", SharedMem0.size);
 
@@ -358,6 +386,8 @@ uint32_t trusty_read_permanent_attributes(uint8_t *attributes, uint32_t size)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -377,11 +407,11 @@ uint32_t trusty_read_permanent_attributes(uint8_t *attributes, uint32_t size)
 					&ErrorOrigin);
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(attributes, SharedMem1.buffer, SharedMem1.size);
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -403,10 +433,13 @@ uint32_t trusty_write_permanent_attributes(uint8_t *attributes, uint32_t size)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -425,6 +458,8 @@ uint32_t trusty_write_permanent_attributes(uint8_t *attributes, uint32_t size)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -432,6 +467,8 @@ uint32_t trusty_write_permanent_attributes(uint8_t *attributes, uint32_t size)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "attributes", SharedMem0.size);
 
@@ -441,6 +478,8 @@ uint32_t trusty_write_permanent_attributes(uint8_t *attributes, uint32_t size)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem1.buffer, attributes, SharedMem1.size);
 
@@ -460,12 +499,13 @@ uint32_t trusty_write_permanent_attributes(uint8_t *attributes, uint32_t size)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -489,9 +529,14 @@ uint32_t trusty_read_permanent_attributes_cer(uint8_t *attributes,
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
+
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
+
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						    TEEC_NONE,
 						    TEEC_NONE,
@@ -510,18 +555,24 @@ uint32_t trusty_read_permanent_attributes_cer(uint8_t *attributes,
 				      NULL,
 				      &TeecOperation,
 				      &ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
 	SharedMem0.size = sizeof("rsacer");
 	SharedMem0.flags = 0;
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 	memcpy(SharedMem0.buffer, "rsacer", SharedMem0.size);
 	TEEC_SharedMemory SharedMem1 = {0};
 
 	SharedMem1.size = size;
 	SharedMem1.flags = 0;
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
 	TeecOperation.params[1].tmpref.buffer = SharedMem1.buffer;
@@ -537,11 +588,11 @@ uint32_t trusty_read_permanent_attributes_cer(uint8_t *attributes,
 					&ErrorOrigin);
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(attributes, SharedMem1.buffer, SharedMem1.size);
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -565,9 +616,14 @@ uint32_t trusty_write_permanent_attributes_cer(uint8_t *attributes,
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
+
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
+
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						    TEEC_NONE,
 						    TEEC_NONE,
@@ -586,18 +642,24 @@ uint32_t trusty_write_permanent_attributes_cer(uint8_t *attributes,
 				      NULL,
 				      &TeecOperation,
 				      &ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
 	SharedMem0.size = sizeof("rsacer");
 	SharedMem0.flags = 0;
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 	memcpy(SharedMem0.buffer, "rsacer", SharedMem0.size);
 	TEEC_SharedMemory SharedMem1 = {0};
 
 	SharedMem1.size = size;
 	SharedMem1.flags = 0;
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 	memcpy(SharedMem1.buffer, attributes, SharedMem1.size);
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -612,12 +674,13 @@ uint32_t trusty_write_permanent_attributes_cer(uint8_t *attributes,
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -639,10 +702,13 @@ uint32_t trusty_read_lock_state(uint8_t *lock_state)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -661,6 +727,8 @@ uint32_t trusty_read_lock_state(uint8_t *lock_state)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -668,6 +736,8 @@ uint32_t trusty_read_lock_state(uint8_t *lock_state)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "lock_state", SharedMem0.size);
 
@@ -677,6 +747,8 @@ uint32_t trusty_read_lock_state(uint8_t *lock_state)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -696,11 +768,11 @@ uint32_t trusty_read_lock_state(uint8_t *lock_state)
 					&ErrorOrigin);
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(lock_state, SharedMem1.buffer, SharedMem1.size);
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -722,10 +794,13 @@ uint32_t trusty_write_lock_state(uint8_t lock_state)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -744,6 +819,8 @@ uint32_t trusty_write_lock_state(uint8_t lock_state)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -751,6 +828,8 @@ uint32_t trusty_write_lock_state(uint8_t lock_state)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "lock_state", SharedMem0.size);
 
@@ -760,6 +839,8 @@ uint32_t trusty_write_lock_state(uint8_t lock_state)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem1.buffer, &lock_state, SharedMem1.size);
 
@@ -779,12 +860,13 @@ uint32_t trusty_write_lock_state(uint8_t lock_state)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -806,10 +888,13 @@ uint32_t trusty_read_flash_lock_state(uint8_t *flash_lock_state)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -828,6 +913,8 @@ uint32_t trusty_read_flash_lock_state(uint8_t *flash_lock_state)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -835,6 +922,8 @@ uint32_t trusty_read_flash_lock_state(uint8_t *flash_lock_state)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "flash_lock_state", SharedMem0.size);
 
@@ -844,6 +933,8 @@ uint32_t trusty_read_flash_lock_state(uint8_t *flash_lock_state)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -863,11 +954,11 @@ uint32_t trusty_read_flash_lock_state(uint8_t *flash_lock_state)
 					&ErrorOrigin);
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(flash_lock_state, SharedMem1.buffer, SharedMem1.size);
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -890,10 +981,13 @@ uint32_t trusty_write_flash_lock_state(uint8_t flash_lock_state)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -912,6 +1006,8 @@ uint32_t trusty_write_flash_lock_state(uint8_t flash_lock_state)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -919,6 +1015,8 @@ uint32_t trusty_write_flash_lock_state(uint8_t flash_lock_state)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "flash_lock_state", SharedMem0.size);
 
@@ -928,6 +1026,8 @@ uint32_t trusty_write_flash_lock_state(uint8_t flash_lock_state)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem1.buffer, &flash_lock_state, SharedMem1.size);
 
@@ -947,7 +1047,9 @@ uint32_t trusty_write_flash_lock_state(uint8_t flash_lock_state)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
@@ -969,9 +1071,13 @@ uint32_t trusty_read_attribute_hash(uint32_t *buf, uint32_t length)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -980,6 +1086,8 @@ uint32_t trusty_read_attribute_hash(uint32_t *buf, uint32_t length)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -987,6 +1095,8 @@ uint32_t trusty_read_attribute_hash(uint32_t *buf, uint32_t length)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -1003,7 +1113,7 @@ uint32_t trusty_read_attribute_hash(uint32_t *buf, uint32_t length)
 
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(buf, SharedMem0.buffer, SharedMem0.size);
-
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
@@ -1023,9 +1133,13 @@ uint32_t trusty_write_attribute_hash(uint32_t *buf, uint32_t length)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -1034,6 +1148,8 @@ uint32_t trusty_write_attribute_hash(uint32_t *buf, uint32_t length)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1041,6 +1157,8 @@ uint32_t trusty_write_attribute_hash(uint32_t *buf, uint32_t length)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, buf, SharedMem0.size);
 
@@ -1056,7 +1174,9 @@ uint32_t trusty_write_attribute_hash(uint32_t *buf, uint32_t length)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
@@ -1075,9 +1195,13 @@ uint32_t notify_optee_rpmb_ta(void)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -1086,6 +1210,8 @@ uint32_t notify_optee_rpmb_ta(void)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_NONE,
 						TEEC_NONE,
@@ -1096,7 +1222,9 @@ uint32_t notify_optee_rpmb_ta(void)
 					2,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
 
@@ -1115,9 +1243,13 @@ uint32_t notify_optee_efuse_ta(void)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -1126,6 +1258,8 @@ uint32_t notify_optee_efuse_ta(void)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_NONE,
 						TEEC_NONE,
@@ -1136,7 +1270,9 @@ uint32_t notify_optee_efuse_ta(void)
 					2,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
 
@@ -1163,9 +1299,13 @@ uint32_t trusty_read_vbootkey_hash(uint32_t *buf, uint32_t length)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -1174,6 +1314,8 @@ uint32_t trusty_read_vbootkey_hash(uint32_t *buf, uint32_t length)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1181,6 +1323,8 @@ uint32_t trusty_read_vbootkey_hash(uint32_t *buf, uint32_t length)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -1197,7 +1341,7 @@ uint32_t trusty_read_vbootkey_hash(uint32_t *buf, uint32_t length)
 
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(buf, SharedMem0.buffer, SharedMem0.size);
-
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
@@ -1216,9 +1360,13 @@ uint32_t trusty_write_vbootkey_hash(uint32_t *buf, uint32_t length)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -1227,6 +1375,8 @@ uint32_t trusty_write_vbootkey_hash(uint32_t *buf, uint32_t length)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1234,6 +1384,8 @@ uint32_t trusty_write_vbootkey_hash(uint32_t *buf, uint32_t length)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, buf, SharedMem0.size);
 
@@ -1249,7 +1401,9 @@ uint32_t trusty_write_vbootkey_hash(uint32_t *buf, uint32_t length)
 					4,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
@@ -1270,9 +1424,13 @@ uint32_t trusty_read_vbootkey_enable_flag(uint8_t *flag)
 	TEEC_UUID *TeecUuid = &tempuuid;
 	TEEC_Operation TeecOperation = {0};
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_OpenSession(&TeecContext,
 				&TeecSession,
@@ -1281,6 +1439,8 @@ uint32_t trusty_read_vbootkey_enable_flag(uint8_t *flag)
 				NULL,
 				NULL,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1288,6 +1448,8 @@ uint32_t trusty_read_vbootkey_enable_flag(uint8_t *flag)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -1307,7 +1469,7 @@ uint32_t trusty_read_vbootkey_enable_flag(uint8_t *flag)
 		if (bootflag == 0x000000FF)
 			*flag = 1;
 	}
-
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
@@ -1332,10 +1494,13 @@ uint32_t trusty_read_permanent_attributes_flag(uint8_t *attributes)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -1354,6 +1519,8 @@ uint32_t trusty_read_permanent_attributes_flag(uint8_t *attributes)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1361,6 +1528,8 @@ uint32_t trusty_read_permanent_attributes_flag(uint8_t *attributes)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "attributes_flag", SharedMem0.size);
 
@@ -1370,6 +1539,8 @@ uint32_t trusty_read_permanent_attributes_flag(uint8_t *attributes)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -1388,11 +1559,11 @@ uint32_t trusty_read_permanent_attributes_flag(uint8_t *attributes)
 					&ErrorOrigin);
 	if (TeecResult == TEEC_SUCCESS)
 		memcpy(attributes, SharedMem1.buffer, SharedMem1.size);
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -1414,10 +1585,13 @@ uint32_t trusty_write_permanent_attributes_flag(uint8_t attributes)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	debug("testmm start\n");
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -1436,6 +1610,8 @@ uint32_t trusty_write_permanent_attributes_flag(uint8_t attributes)
 				NULL,
 				&TeecOperation,
 				&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1443,6 +1619,8 @@ uint32_t trusty_write_permanent_attributes_flag(uint8_t attributes)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, "attributes_flag", SharedMem0.size);
 
@@ -1452,6 +1630,8 @@ uint32_t trusty_write_permanent_attributes_flag(uint8_t attributes)
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem1.buffer, (char *)&attributes, SharedMem1.size);
 
@@ -1470,12 +1650,13 @@ uint32_t trusty_write_permanent_attributes_flag(uint8_t attributes)
 					1,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
 	TEEC_CloseSession(&TeecSession);
 	TEEC_FinalizeContext(&TeecContext);
-	debug("testmm end\n");
 
 	return TeecResult;
 }
@@ -1500,9 +1681,13 @@ uint32_t trusty_attest_dh(uint8_t *dh, uint32_t *dh_size)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -1521,6 +1706,8 @@ uint32_t trusty_attest_dh(uint8_t *dh, uint32_t *dh_size)
 				      NULL,
 					&TeecOperation,
 				      &ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1528,6 +1715,8 @@ uint32_t trusty_attest_dh(uint8_t *dh, uint32_t *dh_size)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -1541,14 +1730,15 @@ uint32_t trusty_attest_dh(uint8_t *dh, uint32_t *dh_size)
 					143,
 					&TeecOperation,
 					&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	*dh_size = TeecOperation.params[0].tmpref.size;
 	memcpy(dh, SharedMem0.buffer, SharedMem0.size);
-
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
-
 	TEEC_CloseSession(&TeecSession);
-	TeecResult = TEEC_FinalizeContext(&TeecContext);
+	TEEC_FinalizeContext(&TeecContext);
 
 	return TeecResult;
 }
@@ -1573,9 +1763,13 @@ uint32_t trusty_attest_uuid(uint8_t *uuid, uint32_t *uuid_size)
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -1594,6 +1788,8 @@ uint32_t trusty_attest_uuid(uint8_t *uuid, uint32_t *uuid_size)
 				      NULL,
 					&TeecOperation,
 				      &ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1601,6 +1797,8 @@ uint32_t trusty_attest_uuid(uint8_t *uuid, uint32_t *uuid_size)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[0].tmpref.buffer = SharedMem0.buffer;
 	TeecOperation.params[0].tmpref.size = SharedMem0.size;
@@ -1614,14 +1812,15 @@ uint32_t trusty_attest_uuid(uint8_t *uuid, uint32_t *uuid_size)
 					144,
 					&TeecOperation,
 					&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	*uuid_size = TeecOperation.params[0].tmpref.size;
 	memcpy(uuid, SharedMem0.buffer, SharedMem0.size);
-
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
-
 	TEEC_CloseSession(&TeecSession);
-	TeecResult = TEEC_FinalizeContext(&TeecContext);
+	TEEC_FinalizeContext(&TeecContext);
 
 	return TeecResult;
 }
@@ -1636,8 +1835,6 @@ uint32_t trusty_attest_get_ca(uint8_t *operation_start,
 	TEEC_Session TeecSession;
 	uint32_t ErrorOrigin;
 
-	OpteeClientApiLibInitialize();
-
 	TEEC_UUID tempuuid = { 0x258be795, 0xf9ca, 0x40e6,
 				{ 0xa8, 0x69, 0x9c, 0xe6,
 				  0x88, 0x6c, 0x5d, 0x5d
@@ -1653,9 +1850,13 @@ uint32_t trusty_attest_get_ca(uint8_t *operation_start,
 		return -TEEC_ERROR_GENERIC;
 	}
 
-	OpteeClientApiLibInitialize();
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -1674,6 +1875,8 @@ uint32_t trusty_attest_get_ca(uint8_t *operation_start,
 				      NULL,
 					&TeecOperation,
 				      &ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1681,6 +1884,8 @@ uint32_t trusty_attest_get_ca(uint8_t *operation_start,
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, operation_start, SharedMem0.size);
 
@@ -1693,6 +1898,8 @@ uint32_t trusty_attest_get_ca(uint8_t *operation_start,
 	SharedMem1.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem1);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	TeecOperation.params[1].tmpref.buffer = SharedMem1.buffer;
 	TeecOperation.params[1].tmpref.size = SharedMem1.size;
@@ -1706,11 +1913,16 @@ uint32_t trusty_attest_get_ca(uint8_t *operation_start,
 					145,
 					&TeecOperation,
 					&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	*out_len = TeecOperation.params[1].tmpref.size;
 	memcpy(out, SharedMem1.buffer, SharedMem1.size);
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
 	TEEC_ReleaseSharedMemory(&SharedMem1);
+	TEEC_CloseSession(&TeecSession);
+	TEEC_FinalizeContext(&TeecContext);
 
 	return TeecResult;
 }
@@ -1734,8 +1946,13 @@ uint32_t trusty_attest_set_ca(uint8_t *ca_response, uint32_t *ca_response_size)
 		printf("%s: dev_desc is NULL!\n", __func__);
 		return -TEEC_ERROR_GENERIC;
 	}
+	TeecResult = OpteeClientApiLibInitialize();
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecResult = TEEC_InitializeContext(NULL, &TeecContext);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TeecOperation.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INPUT,
 						TEEC_NONE,
@@ -1754,6 +1971,8 @@ uint32_t trusty_attest_set_ca(uint8_t *ca_response, uint32_t *ca_response_size)
 					NULL,
 					&TeecOperation,
 					&ErrorOrigin);
+	if (TeecResult != TEEC_SUCCESS)
+		return TeecResult;
 
 	TEEC_SharedMemory SharedMem0 = {0};
 
@@ -1761,6 +1980,8 @@ uint32_t trusty_attest_set_ca(uint8_t *ca_response, uint32_t *ca_response_size)
 	SharedMem0.flags = 0;
 
 	TeecResult = TEEC_AllocateSharedMemory(&TeecContext, &SharedMem0);
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
 
 	memcpy(SharedMem0.buffer, ca_response, SharedMem0.size);
 
@@ -1776,11 +1997,12 @@ uint32_t trusty_attest_set_ca(uint8_t *ca_response, uint32_t *ca_response_size)
 					146,
 					&TeecOperation,
 					&ErrorOrigin);
-
+	if (TeecResult != TEEC_SUCCESS)
+		goto exit;
+exit:
 	TEEC_ReleaseSharedMemory(&SharedMem0);
-
 	TEEC_CloseSession(&TeecSession);
-	TeecResult = TEEC_FinalizeContext(&TeecContext);
+	TEEC_FinalizeContext(&TeecContext);
 
 	return TeecResult;
 }
diff --git a/lib/optee_clientApi/OpteeClientMem.c b/lib/optee_clientApi/OpteeClientMem.c
index cec5b50c3b..d290567d83 100644
--- a/lib/optee_clientApi/OpteeClientMem.c
+++ b/lib/optee_clientApi/OpteeClientMem.c
@@ -14,7 +14,7 @@
 
 void *my_mem_start;
 uint32_t my_count;
-uint8_t *my_flag;
+uint8_t *my_flag = NULL;
 typedef struct {
 	void *addrBlock;
 	uint32_t sizeBlock;
@@ -22,14 +22,25 @@ typedef struct {
 } ALLOC_FLAG;
 ALLOC_FLAG alloc_flags[50];
 
-void my_malloc_init(void *start, uint32_t size)
+int my_malloc_init(void *start, uint32_t size)
 {
+	if (start == NULL || size == 0) {
+		printf("malloc init fail!");
+		return -1;
+	}
 	memset(start, 0, size);
 	my_mem_start = start;
 	my_count = size/4096;
-	my_flag = malloc(size/4096);
+	if (my_flag == NULL) {
+		my_flag = malloc(size/4096);
+		if (my_flag == NULL) {
+			printf("malloc fail!");
+			return -1;
+		}
+	}
 	memset(my_flag, 0, size/4096);
 	memset(alloc_flags, 0, 50 * sizeof(ALLOC_FLAG));
+	return 0;
 }
 
 void write_usedblock(void *addr, uint32_t size)
@@ -75,7 +86,8 @@ void *my_malloc(uint32_t size)
 	uint32_t i, j, k, num;
 
 	num = (size - 1) / 4096 + 1;
-
+	if (my_count < num)
+		return 0;
 	for (i = 0; i < my_count - num; i++) {
 		if (*(my_flag + i) == 0) {
 			for (j = 0; j < num; j++) {
@@ -127,7 +139,7 @@ void my_free(void *ptr)
  * Initlialize the memory component, for example providing the
  * containing drivers handle.
  */
-void OpteeClientMemInit(void)
+int OpteeClientMemInit(void)
 {
 	ARM_SMC_ARGS ArmSmcArgs = {0};
 
@@ -143,7 +155,7 @@ void OpteeClientMemInit(void)
 	debug("get share memory, arg0=0x%x arg1=0x%x arg2=0x%x arg3=0x%x\n",
 	      ArmSmcArgs.Arg0, ArmSmcArgs.Arg1, ArmSmcArgs.Arg2, ArmSmcArgs.Arg3);
 
-	my_malloc_init((void *)(size_t)ArmSmcArgs.Arg1, ArmSmcArgs.Arg2);
+	return my_malloc_init((void *)(size_t)ArmSmcArgs.Arg1, ArmSmcArgs.Arg2);
 }
 
 /*
diff --git a/lib/optee_clientApi/OpteeClientRPC.c b/lib/optee_clientApi/OpteeClientRPC.c
index 919e89fac1..c2ddbc381d 100644
--- a/lib/optee_clientApi/OpteeClientRPC.c
+++ b/lib/optee_clientApi/OpteeClientRPC.c
@@ -504,6 +504,11 @@ TEEC_Result OpteeRpcCmdFs(t_teesmc32_arg *TeeSmc32Arg)
 	TEEC_Result TeecResult = TEEC_SUCCESS;
 	t_teesmc32_param *TeeSmc32Param;
 
+	if (check_security_exist(0) < 0) {
+		printf("security partition not exist! unable to use RK FS!\n");
+		return TEEC_ERROR_GENERIC;
+	}
+
 	TeeSmc32Param = TEESMC32_GET_PARAMS(TeeSmc32Arg);
 #ifdef CONFIG_OPTEE_V1
 	TeecResult = tee_supp_rk_fs_process((void *)(size_t)TeeSmc32Param[0].u.memref.buf_ptr,
diff --git a/lib/optee_clientApi/OpteeClientRkFs-v2.c b/lib/optee_clientApi/OpteeClientRkFs-v2.c
index 18be31a61f..ce826d25d5 100644
--- a/lib/optee_clientApi/OpteeClientRkFs-v2.c
+++ b/lib/optee_clientApi/OpteeClientRkFs-v2.c
@@ -98,7 +98,10 @@
  *	- 512 byte section used refs [128]
  *		- 1 byte = 2 flag
  *	- 895 * 512 byte data	[129 - 1023]
- *	------------------------------
+ *	------ RKSS Backup Structure --------
+ *	- 512 byte backup header  [1024]
+ *		- 1 * rkss_backup_verification + 31 * rkss_backup_info
+ *	- 255 * 512 byte backup data [1025 - 1279]
  *
  */
 #define RKSS_DATA_SECTION_COUNT		1024
@@ -107,6 +110,26 @@
 #define RKSS_EACH_FILEFOLDER_COUNT	4		/* 504 / 126 = 4*/
 #define RKSS_NAME_MAX_LENGTH		117		/* 116 char + "\0"*/
 #define RKSS_USEDFLAGS_INDEX		RKSS_PARTITION_TABLE_COUNT
+#define RKSS_BACKUP_INDEX		RKSS_DATA_SECTION_COUNT
+#define RKSS_BACKUP_COUNT		256
+
+#define RKSS_BACKUP_VERSION		(unsigned int)0x1
+#define RKSS_BACKUP_ENABLE		(unsigned int)0x55667788
+#define RKSS_BACKUP_USEDFLAG		(unsigned int)0xAABBCCDD
+
+struct rkss_backup_verification {
+	unsigned int backup_version;
+	unsigned int backup_count;
+	unsigned int reserve;
+	unsigned int backup_enable;
+};
+
+struct rkss_backup_info {
+	unsigned int backup_index;
+	unsigned int backup_num;
+	unsigned int backup_data_index;
+	unsigned int backup_usedflag;
+};
 
 #define RK_FS_R    0x1
 #define RK_FS_W    0x2
@@ -151,48 +174,290 @@ static int dir_seek;
 
 static struct blk_desc *dev_desc = NULL;
 static disk_partition_t part_info;
-static int rkss_read_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
-{
-	unsigned long ret;
 
-	if (dev_desc == NULL) {
+int check_security_exist(int print_flag)
+{
+	if (!dev_desc) {
 		dev_desc = rockchip_get_bootdev();
 		if (!dev_desc) {
 			printf("%s: Could not find device\n", __func__);
 			return -1;
 		}
 
-		if (part_get_info_by_name(dev_desc, "security", &part_info) < 0) {
+		if (part_get_info_by_name(dev_desc,
+					  "security", &part_info) < 0) {
 			dev_desc = NULL;
-			printf("Could not find security partition\n");
+			if (print_flag != 0)
+				printf("Could not find security partition\n");
 			return -1;
 		}
 	}
-	ret = blk_dread(dev_desc, part_info.start + index, num, data);
-	if (ret != num) {
-		printf("blk_dread fail\n");
+	return 0;
+}
+
+/*
+ * action1:
+ * rkss_begin_commit	set enable flag
+ * rkss_backup_sections	backup data
+ * blk_dwrite
+ * rkss_finish_commit	clear enable flag, clear backup data
+ * reboot
+ * rkss_resume	not find enable flag, do nothing
+ *
+ * action2:
+ * rkss_begin_commit	set enable flag
+ * rkss_backup_sections	backup data
+ * power off when blk_dwrite
+ *
+ * power on
+ * rkss_resume	find enable flag, resume all backup data
+ */
+static int rkss_begin_commit(void)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	struct rkss_backup_verification p;
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	debug("%s\n", __func__);
+	p.backup_version = RKSS_BACKUP_VERSION;
+	p.backup_enable = RKSS_BACKUP_ENABLE;
+	p.backup_count = 0;
+
+	memset(data, 0, sizeof(data));
+	memcpy(data, &p, sizeof(p));
+
+	ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dwrite fail\n");
 		return -1;
 	}
 	return 0;
 }
 
-static int rkss_write_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
+static int rkss_finish_commit(void)
 {
+	unsigned char data[RKSS_DATA_LEN];
 	unsigned long ret;
 
-	if (dev_desc == NULL) {
-		dev_desc = rockchip_get_bootdev();
-		if (!dev_desc) {
-			printf("%s: Could not find device\n", __func__);
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	debug("%s\n", __func__);
+	memset(data, 0, sizeof(data));
+
+	ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dwrite fail\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int rkss_backup_sections(unsigned long index, unsigned int num)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	unsigned char *backup_data = NULL;
+	struct rkss_backup_verification p;
+	struct rkss_backup_info info_last, info_current;
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	ret = blk_dread(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dread fail\n");
+		return -1;
+	}
+
+	memcpy(&p, data, sizeof(p));
+	if (p.backup_version == RKSS_BACKUP_VERSION &&
+	    p.backup_enable == RKSS_BACKUP_ENABLE) {
+		if (p.backup_count == 0) {
+			info_current.backup_usedflag = RKSS_BACKUP_USEDFLAG;
+			info_current.backup_index = index;
+			info_current.backup_num = num;
+			info_current.backup_data_index = RKSS_BACKUP_INDEX + 1;
+		} else {
+			memcpy(&info_last, data + sizeof(p) +
+			       (p.backup_count - 1) * sizeof(info_last),
+			       sizeof(info_last));
+			info_current.backup_usedflag = RKSS_BACKUP_USEDFLAG;
+			info_current.backup_index = index;
+			info_current.backup_num = num;
+			info_current.backup_data_index =
+				info_last.backup_data_index +
+				info_last.backup_num;
+		}
+		if ((info_current.backup_data_index + info_current.backup_num) >
+			(RKSS_BACKUP_INDEX + RKSS_BACKUP_COUNT)) {
+			printf("Not enough backup sections!");
+			goto error;
+		}
+		debug("%s index=0x%lx num=0x%x backup_data_index=0x%x\n",
+		      __func__, index, num, info_current.backup_data_index);
+
+		backup_data = malloc(num * RKSS_DATA_LEN);
+		if (!backup_data) {
+			printf("malloc backup_data fail\n");
+			goto error;
+		}
+
+		ret = blk_dread(dev_desc, index, num, backup_data);
+		if (ret != num) {
+			printf("blk_dread fail\n");
 			return -1;
 		}
 
-		if (part_get_info_by_name(dev_desc, "security", &part_info) < 0) {
-			dev_desc = NULL;
-			printf("Could not find security partition\n");
+		ret = blk_dwrite(dev_desc, info_current.backup_data_index,
+				 num, backup_data);
+		if (ret != num) {
+			printf("blk_dwrite fail\n");
 			return -1;
 		}
+		free(backup_data);
+		backup_data = NULL;
+
+		p.backup_count += 1;
+
+		memcpy(data, &p, sizeof(p));
+		memcpy(data + sizeof(p) +
+		       (p.backup_count - 1) * sizeof(info_current),
+		       &info_current, sizeof(info_current));
+
+		ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+		if (ret != 1) {
+			printf("blk_dwrite fail\n");
+			return -1;
+		}
+	}
+
+	return 0;
+error:
+	if (backup_data)
+		free(backup_data);
+	return -1;
+}
+
+static int rkss_resume(void)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	unsigned char *backup_data = NULL;
+	struct rkss_backup_verification p;
+	struct rkss_backup_info info_current;
+	unsigned int i;
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	ret = blk_dread(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dread fail\n");
+		return -1;
+	}
+
+	memcpy(&p, data, sizeof(p));
+	if (p.backup_version == RKSS_BACKUP_VERSION &&
+	    p.backup_enable == RKSS_BACKUP_ENABLE) {
+		for (i = p.backup_count; i > 0; i--) {
+			memcpy(&info_current, data + sizeof(p) + (i - 1) *
+			       sizeof(info_current), sizeof(info_current));
+
+			if (info_current.backup_usedflag ==
+			    RKSS_BACKUP_USEDFLAG) {
+				debug("rkss_resume backup_index=0x%x \
+				      backup_num=0x%x \
+				      info_current.backup_data_index=0x%x\n",
+				      info_current.backup_index,
+				      info_current.backup_num,
+				      info_current.backup_data_index);
+				if ((info_current.backup_data_index +
+				    info_current.backup_num) >
+				    (RKSS_BACKUP_INDEX + RKSS_BACKUP_COUNT)) {
+					printf("backup sections error!");
+					goto error;
+				}
+				if ((info_current.backup_index +
+				    info_current.backup_num) >
+				    RKSS_DATA_SECTION_COUNT) {
+					printf("original sections error!");
+					goto error;
+				}
+				backup_data = malloc(info_current.backup_num *
+						     RKSS_DATA_LEN);
+				if (!backup_data) {
+					printf("malloc backup_data fail\n");
+					goto error;
+				}
+
+				ret = blk_dread(dev_desc,
+						info_current.backup_data_index,
+						info_current.backup_num,
+						backup_data);
+				if (ret != info_current.backup_num) {
+					printf("blk_dread fail\n");
+					return -1;
+				}
+
+				ret = blk_dwrite(dev_desc,
+						 info_current.backup_index,
+						 info_current.backup_num,
+						 backup_data);
+				if (ret != info_current.backup_num) {
+					printf("blk_dwrite fail\n");
+					return -1;
+				}
+				free(backup_data);
+				backup_data = NULL;
+			}
+		}
+	}
+	memset(data, 0, sizeof(data));
+	ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dwrite fail\n");
+		return -1;
 	}
+	return 0;
+error:
+	if (backup_data)
+		free(backup_data);
+	return -1;
+}
+
+static int rkss_read_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
+{
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	ret = blk_dread(dev_desc, part_info.start + index, num, data);
+	if (ret != num) {
+		printf("blk_dread fail\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int rkss_write_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
+{
+	unsigned long ret;
+	int result;
+
+	result = rkss_backup_sections(index, num);
+	if (result < 0) {
+		printf("rkss_backup_sections fail\n");
+		return -1;
+	}
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
 	ret = blk_dwrite(dev_desc, part_info.start + index, num, data);
 	if (ret != num) {
 		printf("blk_dwrite fail\n");
@@ -205,19 +470,9 @@ static int rkss_read_patition_tables(unsigned char *data)
 {
 	unsigned long ret;
 
-	if (dev_desc == NULL) {
-		dev_desc = rockchip_get_bootdev();
-		if (!dev_desc) {
-			printf("%s: Could not find device\n", __func__);
-			return -1;
-		}
+	if (check_security_exist(1) < 0)
+		return -1;
 
-		if (part_get_info_by_name(dev_desc, "security", &part_info) < 0) {
-			dev_desc = NULL;
-			printf("Could not find security partition\n");
-			return -1;
-		}
-	}
 	ret = blk_dread(dev_desc, part_info.start, RKSS_PARTITION_TABLE_COUNT, data);
 	if (ret != RKSS_PARTITION_TABLE_COUNT) {
 		printf("blk_dread fail\n");
@@ -764,6 +1019,11 @@ static TEEC_Result ree_fs_new_create(size_t num_params,
 	/* file open flags: O_RDWR | O_CREAT | O_TRUNC
 	 * if file exists, we must remove it first.
 	 */
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
 
 	filename = (char *)(size_t)params[1].u.memref.shm_id;
 	debug("params[1].u.memref.shm_id = 0x%llx params[1].u.memref.shm_offs = 0x%llx\n",
@@ -812,6 +1072,12 @@ static TEEC_Result ree_fs_new_create(size_t num_params,
 	debug("ree_fs_new_create ! %s, fd: %d.\n", filename, fd);
 
 	params[2].u.value.a = fd;
+
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 	return TEEC_SUCCESS;
 }
 
@@ -886,6 +1152,12 @@ static TEEC_Result ree_fs_new_write(size_t num_params,
 	int section_num;
 	uint8_t *file_data=0, *temp_file_data=0;
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	fd = params[0].u.value.b;
 	offs = params[0].u.value.c;
 
@@ -970,6 +1242,11 @@ out:
 		free(temp_file_data);
 		temp_file_data = 0;
 	}
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 
 	return TEEC_SUCCESS;
 }
@@ -983,6 +1260,12 @@ static TEEC_Result ree_fs_new_truncate(size_t num_params,
 	struct rkss_file_info p = {0};
 	unsigned int section_num_old, section_num_new;
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	fd = params[0].u.value.b;
 	len = params[0].u.value.c;
 
@@ -1010,6 +1293,11 @@ static TEEC_Result ree_fs_new_truncate(size_t num_params,
 		printf("ree_fs_new_truncate: write ptable error!\n");
 		return TEEC_ERROR_GENERIC;
 	}
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 
 	return TEEC_SUCCESS;
 }
@@ -1021,6 +1309,12 @@ static TEEC_Result ree_fs_new_remove(size_t num_params,
 	struct rkss_file_info p = {0};
 	int ret, fd, num;
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	debug("params[1].u.memref.shm_id = 0x%llx params[1].u.memref.shm_offs = 0x%llx\n",
 		params[1].u.memref.shm_id, params[1].u.memref.shm_offs);
 
@@ -1057,6 +1351,11 @@ static TEEC_Result ree_fs_new_remove(size_t num_params,
 	rkss_dump_ptable();
 	rkss_dump_usedflags();
 #endif
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 
 	return TEEC_SUCCESS;
 }
@@ -1069,6 +1368,12 @@ static TEEC_Result ree_fs_new_rename(size_t num_params,
 	struct rkss_file_info p = {0};
 	int ret;
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	old_fname = (char *)(size_t)params[1].u.memref.shm_id;
 	debug("params[1].u.memref.shm_id = 0x%llx params[1].u.memref.shm_offs = 0x%llx\n",
 		params[1].u.memref.shm_id, params[1].u.memref.shm_offs);
@@ -1101,6 +1406,11 @@ static TEEC_Result ree_fs_new_rename(size_t num_params,
 		printf("write ptable error!\n");
 		return TEEC_ERROR_GENERIC;
 	}
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 
 	return TEEC_SUCCESS;
 }
@@ -1186,6 +1496,15 @@ int tee_supp_rk_fs_init(void)
 	struct rk_secure_storage rkss = {0};
 	unsigned char *table_data;
 
+	if (check_security_exist(0) < 0)
+		return 0;
+
+	ret = rkss_resume();
+	if (ret < 0) {
+		printf("rkss_resume failed!");
+		return TEEC_ERROR_GENERIC;
+	}
+
 	/* clean secure storage*/
 #ifdef DEBUG_CLEAN_RKSS
 	int i = 0;
@@ -1196,6 +1515,11 @@ int tee_supp_rk_fs_init(void)
 		printf("cleaned [%d]", i);
 	}
 #endif
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return TEEC_ERROR_GENERIC;
+	}
 
 	table_data = malloc(RKSS_DATA_LEN * RKSS_PARTITION_TABLE_COUNT);
 	if (table_data == NULL) {
@@ -1230,13 +1554,20 @@ int tee_supp_rk_fs_init(void)
 	rkss_dump_ptable();
 	rkss_dump_usedflags();
 #endif
+
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return TEEC_ERROR_GENERIC;
+	}
+
 	return TEEC_SUCCESS;
 }
 
-void OpteeClientRkFsInit(void)
+int OpteeClientRkFsInit(void)
 {
 	debug(" OpteeClientRkFsInit\n");
-	tee_supp_rk_fs_init();
+	return tee_supp_rk_fs_init();
 }
 bool tee_supp_param_is_value(struct tee_ioctl_param *param)
 {
diff --git a/lib/optee_clientApi/OpteeClientRkFs.c b/lib/optee_clientApi/OpteeClientRkFs.c
index 55dec3e212..68c59554e8 100644
--- a/lib/optee_clientApi/OpteeClientRkFs.c
+++ b/lib/optee_clientApi/OpteeClientRkFs.c
@@ -99,7 +99,10 @@
  *	- 512 byte section used refs [128]
  *		- 1 byte = 2 flag
  *	- 895 * 512 byte data	[129 - 1023]
- *	------------------------------
+ *	------ RKSS Backup Structure --------
+ *	- 512 byte backup header  [1024]
+ *		- 1 * rkss_backup_verification + 31 * rkss_backup_info
+ *	- 255 * 512 byte backup data [1025 - 1279]
  *
  */
 #define RKSS_DATA_SECTION_COUNT		1024
@@ -108,6 +111,26 @@
 #define RKSS_EACH_FILEFOLDER_COUNT	4		// 504 / 126 = 4
 #define RKSS_NAME_MAX_LENGTH		117		// 116 char + "\0"
 #define RKSS_USEDFLAGS_INDEX		RKSS_PARTITION_TABLE_COUNT
+#define RKSS_BACKUP_INDEX		RKSS_DATA_SECTION_COUNT
+#define RKSS_BACKUP_COUNT		256
+
+#define RKSS_BACKUP_VERSION		(unsigned int)0x1
+#define RKSS_BACKUP_ENABLE		(unsigned int)0x55667788
+#define RKSS_BACKUP_USEDFLAG		(unsigned int)0xAABBCCDD
+
+struct rkss_backup_verification {
+	unsigned int backup_version;
+	unsigned int backup_count;
+	unsigned int reserve;
+	unsigned int backup_enable;
+};
+
+struct rkss_backup_info {
+	unsigned int backup_index;
+	unsigned int backup_num;
+	unsigned int backup_data_index;
+	unsigned int backup_usedflag;
+};
 
 typedef struct rkss_file_info
 {
@@ -163,23 +186,268 @@ extern unsigned long blk_dwrite(struct blk_desc *block_dev, lbaint_t start,
 
 static struct blk_desc *dev_desc = NULL;
 static disk_partition_t part_info;
-static int rkss_read_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
-{
-	unsigned long ret;
 
-	if (dev_desc == NULL) {
+int check_security_exist(int print_flag)
+{
+	if (!dev_desc) {
 		dev_desc = rockchip_get_bootdev();
 		if (!dev_desc) {
 			printf("%s: Could not find device\n", __func__);
 			return -1;
 		}
 
-		if (part_get_info_by_name(dev_desc, "security", &part_info) < 0) {
+		if (part_get_info_by_name(dev_desc,
+					  "security", &part_info) < 0) {
 			dev_desc = NULL;
-			printf("Could not find security partition\n");
+			if (print_flag != 0)
+				printf("Could not find security partition\n");
+			return -1;
+		}
+	}
+	return 0;
+}
+
+/*
+ * action1:
+ * rkss_begin_commit	set enable flag
+ * rkss_backup_sections	backup data
+ * blk_dwrite
+ * rkss_finish_commit	clear enable flag, clear backup data
+ * reboot
+ * rkss_resume	not find enable flag, do nothing
+ *
+ * action2:
+ * rkss_begin_commit	set enable flag
+ * rkss_backup_sections	backup data
+ * power off when blk_dwrite
+ *
+ * power on
+ * rkss_resume	find enable flag, resume all backup data
+ */
+static int rkss_begin_commit(void)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	struct rkss_backup_verification p;
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	debug("%s\n", __func__);
+	p.backup_version = RKSS_BACKUP_VERSION;
+	p.backup_enable = RKSS_BACKUP_ENABLE;
+	p.backup_count = 0;
+
+	memset(data, 0, sizeof(data));
+	memcpy(data, &p, sizeof(p));
+
+	ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dwrite fail\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int rkss_finish_commit(void)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	debug("%s\n", __func__);
+	memset(data, 0, sizeof(data));
+
+	ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dwrite fail\n");
+		return -1;
+	}
+	return 0;
+}
+
+static int rkss_backup_sections(unsigned long index, unsigned int num)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	unsigned char *backup_data = NULL;
+	struct rkss_backup_verification p;
+	struct rkss_backup_info info_last, info_current;
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	ret = blk_dread(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dread fail\n");
+		return -1;
+	}
+
+	memcpy(&p, data, sizeof(p));
+	if (p.backup_version == RKSS_BACKUP_VERSION &&
+	    p.backup_enable == RKSS_BACKUP_ENABLE) {
+		if (p.backup_count == 0) {
+			info_current.backup_usedflag = RKSS_BACKUP_USEDFLAG;
+			info_current.backup_index = index;
+			info_current.backup_num = num;
+			info_current.backup_data_index = RKSS_BACKUP_INDEX + 1;
+		} else {
+			memcpy(&info_last,
+			       data + sizeof(p) + (p.backup_count - 1) *
+			       sizeof(info_last), sizeof(info_last));
+			info_current.backup_usedflag = RKSS_BACKUP_USEDFLAG;
+			info_current.backup_index = index;
+			info_current.backup_num = num;
+			info_current.backup_data_index =
+				info_last.backup_data_index +
+				info_last.backup_num;
+		}
+		if ((info_current.backup_data_index + info_current.backup_num) >
+			(RKSS_BACKUP_INDEX + RKSS_BACKUP_COUNT)) {
+			printf("Not enough backup sections!");
+			goto error;
+		}
+		debug("%s index=0x%lx num=0x%x backup_data_index=0x%x\n",
+		      __func__, index, num, info_current.backup_data_index);
+
+		backup_data = malloc(num * RKSS_DATA_LEN);
+		if (!backup_data) {
+			printf("malloc backup_data fail\n");
+			goto error;
+		}
+
+		ret = blk_dread(dev_desc, index, num, backup_data);
+		if (ret != num) {
+			printf("blk_dread fail\n");
+			return -1;
+		}
+
+		ret = blk_dwrite(dev_desc, info_current.backup_data_index,
+				 num, backup_data);
+		if (ret != num) {
+			printf("blk_dwrite fail\n");
+			return -1;
+		}
+		free(backup_data);
+		backup_data = NULL;
+
+		p.backup_count += 1;
+
+		memcpy(data, &p, sizeof(p));
+		memcpy(data + sizeof(p) +
+		       (p.backup_count - 1) * sizeof(info_current),
+		       &info_current, sizeof(info_current));
+
+		ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+		if (ret != 1) {
+			printf("blk_dwrite fail\n");
 			return -1;
 		}
 	}
+
+	return 0;
+error:
+	if (backup_data)
+		free(backup_data);
+	return -1;
+}
+
+static int rkss_resume(void)
+{
+	unsigned char data[RKSS_DATA_LEN];
+	unsigned char *backup_data = NULL;
+	struct rkss_backup_verification p;
+	struct rkss_backup_info info_current;
+	unsigned int i;
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
+	ret = blk_dread(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dread fail\n");
+		return -1;
+	}
+
+	memcpy(&p, data, sizeof(p));
+	if (p.backup_version == RKSS_BACKUP_VERSION &&
+	    p.backup_enable == RKSS_BACKUP_ENABLE) {
+		for (i = p.backup_count; i > 0; i--) {
+			memcpy(&info_current, data + sizeof(p) + (i - 1) *
+			       sizeof(info_current), sizeof(info_current));
+
+			if (info_current.backup_usedflag ==
+			    RKSS_BACKUP_USEDFLAG) {
+				debug("rkss_resume backup_index=0x%x \
+				      backup_num=0x%x \
+				      info_current.backup_data_index=0x%x\n",
+				      info_current.backup_index,
+				      info_current.backup_num,
+				      info_current.backup_data_index);
+				if ((info_current.backup_data_index +
+				     info_current.backup_num) >
+				    (RKSS_BACKUP_INDEX + RKSS_BACKUP_COUNT)) {
+					printf("backup sections error!");
+					goto error;
+				}
+				if ((info_current.backup_index +
+				     info_current.backup_num) >
+				    RKSS_DATA_SECTION_COUNT) {
+					printf("original sections error!");
+					goto error;
+				}
+				backup_data = malloc(info_current.backup_num *
+						     RKSS_DATA_LEN);
+				if (!backup_data) {
+					printf("malloc backup_data fail\n");
+					goto error;
+				}
+
+				ret = blk_dread(dev_desc,
+						info_current.backup_data_index,
+						info_current.backup_num,
+						backup_data);
+				if (ret != info_current.backup_num) {
+					printf("blk_dread fail\n");
+					return -1;
+				}
+
+				ret = blk_dwrite(dev_desc,
+						 info_current.backup_index,
+						 info_current.backup_num,
+						 backup_data);
+				if (ret != info_current.backup_num) {
+					printf("blk_dwrite fail\n");
+					return -1;
+				}
+				free(backup_data);
+				backup_data = NULL;
+			}
+		}
+	}
+	memset(data, 0, sizeof(data));
+	ret = blk_dwrite(dev_desc, RKSS_BACKUP_INDEX, 1, data);
+	if (ret != 1) {
+		printf("blk_dwrite fail\n");
+		return -1;
+	}
+	return 0;
+error:
+	if (backup_data)
+		free(backup_data);
+	return -1;
+}
+
+static int rkss_read_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
+{
+	unsigned long ret;
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
 	ret = blk_dread(dev_desc, part_info.start + index, num, data);
 	if (ret != num) {
 		printf("blk_dread fail\n");
@@ -196,20 +464,17 @@ static int rkss_read_section(struct rk_secure_storage *rkss)
 static int rkss_write_multi_sections(unsigned char *data, unsigned long index, unsigned int num)
 {
 	unsigned long ret;
+	int result;
 
-	if (dev_desc == NULL) {
-		dev_desc = rockchip_get_bootdev();
-		if (!dev_desc) {
-			printf("%s: Could not find device\n", __func__);
-			return -1;
-		}
-
-		if (part_get_info_by_name(dev_desc, "security", &part_info) < 0) {
-			dev_desc = NULL;
-			printf("Could not find security partition\n");
-			return -1;
-		}
+	result = rkss_backup_sections(index, num);
+	if (result < 0) {
+		printf("rkss_backup_sections fail\n");
+		return -1;
 	}
+
+	if (check_security_exist(1) < 0)
+		return -1;
+
 	ret = blk_dwrite(dev_desc, part_info.start + index, num, data);
 	if (ret != num) {
 		printf("blk_dwrite fail\n");
@@ -227,19 +492,9 @@ static int rkss_read_patition_tables(unsigned char *data)
 {
 	unsigned long ret;
 
-	if (dev_desc == NULL) {
-		dev_desc = rockchip_get_bootdev();
-		if (!dev_desc) {
-			printf("%s: Could not find device\n", __func__);
-			return -1;
-		}
+	if (check_security_exist(1) < 0)
+		return -1;
 
-		if (part_get_info_by_name(dev_desc, "security", &part_info) < 0) {
-			dev_desc = NULL;
-			printf("Could not find security partition\n");
-			return -1;
-		}
-	}
 	ret = blk_dread(dev_desc, part_info.start, RKSS_PARTITION_TABLE_COUNT, data);
 	if (ret != RKSS_PARTITION_TABLE_COUNT) {
 		printf("blk_dread fail\n");
@@ -549,7 +804,7 @@ static int rkss_get_dirs_by_name(char* filename)
 				{
 					char *file = p->name + strlen(filename) + 1;
 					char *subdir = strtok(file, "/");
-					printf("found: %s", subdir);
+					debug("found: %s", subdir);
 					strcpy(dir_cache[dir_num], subdir);
 					++dir_num;
 				}
@@ -801,6 +1056,12 @@ static int tee_fs_open(struct tee_fs_rpc *fsrpc)
 		}
 	}
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	if (make_newfile)
 	{
 		if (CHECKFLAG(fsrpc->flags, TEE_FS_O_CREAT))
@@ -830,6 +1091,12 @@ static int tee_fs_open(struct tee_fs_rpc *fsrpc)
 	debug("tee_fs_open ! %s , fd:%d, flag: %x, len: %d\n",
 			filename, fsrpc->fd, fsrpc->flags, fsrpc->len);
 
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
+
 	return fsrpc->fd;
 }
 
@@ -901,6 +1168,12 @@ static int tee_fs_write(struct tee_fs_rpc *fsrpc)
 		return -1;
 	}
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	p.size = fsrpc->len;
 	int num = fsrpc->len / RKSS_DATA_LEN + 1;
 	p.index = rkss_get_empty_section_from_usedflags(num);
@@ -930,6 +1203,13 @@ static int tee_fs_write(struct tee_fs_rpc *fsrpc)
 #ifdef DEBUG_RKFSS
 	rkss_dump_usedflags();
 #endif
+
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
+
 	return fsrpc->len;
 }
 
@@ -982,6 +1262,12 @@ static int tee_fs_unlink(struct tee_fs_rpc *fsrpc)
 
 	debug("tee_fs_unlink ! %s fd:%d index:%d size:%d\n", filename, fd, p.index, p.size);
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	/* decrease ref from usedflags */
 	int num = p.size / RKSS_DATA_LEN + 1;
 	ret = rkss_decref_multi_usedflags_sections(p.index, num);
@@ -1004,6 +1290,12 @@ static int tee_fs_unlink(struct tee_fs_rpc *fsrpc)
 	rkss_dump_ptable();
 #endif
 
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
+
 	return 0;
 }
 
@@ -1024,11 +1316,16 @@ static int tee_fs_link(struct tee_fs_rpc *fsrpc)
 
 	struct rkss_file_info p_check = {0};
 	ret = rkss_get_fileinfo_by_name(newfilename, &p_check);
-	if (!ret)
+	if (ret >= 0)
 	{
 		printf("file exist ! %s.\n", newfilename);
 		return -1;
 	}
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
 
 	struct rkss_file_info p_new = {0};
 	memcpy(&p_new, &p_old, sizeof(struct rkss_file_info));
@@ -1051,6 +1348,11 @@ static int tee_fs_link(struct tee_fs_rpc *fsrpc)
 #ifdef DEBUG_RKFSS
 	rkss_dump_ptable();
 #endif
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 
 	return 0;
 }
@@ -1069,6 +1371,12 @@ static int tee_fs_rename(struct tee_fs_rpc *fsrpc)
 		return -1;
 	}
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	strcpy(p.name, newnames);
 
 	ret = rkss_write_back_ptable(ret, &p);
@@ -1078,6 +1386,12 @@ static int tee_fs_rename(struct tee_fs_rpc *fsrpc)
 		return -1;
 	}
 
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
+
 	return 0;
 }
 
@@ -1097,6 +1411,11 @@ static int tee_fs_truncate(struct tee_fs_rpc *fsrpc)
 		printf("fd unvailable!\n");
 		return -1;
 	}
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
 
 	p.size = fsrpc->arg;
 	ret = rkss_write_back_ptable(fsrpc->fd, &p);
@@ -1105,6 +1424,11 @@ static int tee_fs_truncate(struct tee_fs_rpc *fsrpc)
 		printf("tee_fs_write: write ptable error!\n");
 		return -1;
 	}
+	ret = rkss_finish_commit();
+	if (ret < 0) {
+		printf("rkss_finish_commit failed!");
+		return -1;
+	}
 	return 0;
 }
 
@@ -1142,12 +1466,12 @@ static int tee_fs_closedir(struct tee_fs_rpc *fsrpc)
 static int tee_fs_readdir(struct tee_fs_rpc *fsrpc)
 {
 	char *dirname = (char *)(fsrpc + 1);
-	printf("seek/num:%d/%d\n", dir_seek, dir_num);
+	debug("seek/num:%d/%d\n", dir_seek, dir_num);
 	if (dir_seek == dir_num)
 	{
 		dirname = NULL;
 		fsrpc->len = 0;
-		printf("tee_fs_readdir: END\n");
+		debug("tee_fs_readdir: END\n");
 		return -1;
 	}
 
@@ -1220,6 +1544,16 @@ int tee_supp_rk_fs_init(void)
 
 	__maybe_unused int i = 0;
 	unsigned char *table_data;
+	int ret;
+
+	if (check_security_exist(0) < 0)
+		return 0;
+
+	ret = rkss_resume();
+	if (ret < 0) {
+		printf("rkss_resume failed!");
+		return -1;
+	}
 #ifdef DEBUG_CLEAN_RKSS // clean secure storage
 	for (i = 0; i < RKSS_DATA_SECTION_COUNT; i++)
 	{
@@ -1231,13 +1565,19 @@ int tee_supp_rk_fs_init(void)
 	}
 #endif
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	// Verify Partition Table
 	table_data = malloc(RKSS_DATA_LEN * RKSS_PARTITION_TABLE_COUNT);
 	if (table_data == NULL) {
 		printf("malloc table_data fail\n");
 		return -1;
 	}
-	int ret = rkss_read_patition_tables(table_data);
+	ret = rkss_read_patition_tables(table_data);
 	if (ret < 0) {
 		printf("rkss_read_patition_tables fail ! ret: %d.\n", ret);
 		free(table_data);
@@ -1275,12 +1615,18 @@ int tee_supp_rk_fs_init(void)
 	rkss_dump_usedflags();
 #endif
 
+	ret = rkss_begin_commit();
+	if (ret < 0) {
+		printf("rkss_begin_commit failed!");
+		return -1;
+	}
+
 	return 0;
 }
-void OpteeClientRkFsInit(void)
+int OpteeClientRkFsInit(void)
 {
 	debug(" OpteeClientRkFsInit\n");
-	tee_supp_rk_fs_init();
+	return tee_supp_rk_fs_init();
 }
 
 static int rkss_step = 0;
diff --git a/lib/sysmem.c b/lib/sysmem.c
index 2549de95f2..952a5e1894 100644
--- a/lib/sysmem.c
+++ b/lib/sysmem.c
@@ -15,45 +15,38 @@ DECLARE_GLOBAL_DATA_PTR;
 #define SYSMEM_ALLOC_ANYWHERE	0
 #define SYSMEM_ALLOC_NO_ALIGN	1
 
-#ifndef CONFIG_SYS_STACK_SIZE
-#define CONFIG_SYS_STACK_SIZE	SZ_2M
-#endif
-
-#define SIZE_MB(len)		((len) >> 20)
-#define SIZE_KB(len)		(((len) % (1 << 20)) >> 10)
-
 #define SYSMEM_I(fmt, args...)	printf("Sysmem: "fmt, ##args)
 #define SYSMEM_W(fmt, args...)	printf("Sysmem Warn: "fmt, ##args)
 #define SYSMEM_E(fmt, args...)	printf("Sysmem Error: "fmt, ##args)
 #define SYSMEM_D(fmt, args...)	 debug("Sysmem Debug: "fmt, ##args)
 
-static struct sysmem plat_sysmem;	/* Global for platform */
-
-struct sysmem_check {
+struct memcheck {
 	uint32_t magic;
 };
 
-static int sysmem_has_init(void)
-{
-	if (!plat_sysmem.has_init) {
-		SYSMEM_E("Framework is not initialized\n");
-		return 0;
-	}
+/* Global for platform, must in data section */
+struct sysmem plat_sysmem __section(".data") = {
+	.has_initf = false,
+	.has_initr = false,
+};
 
-	return 1;
+bool sysmem_has_init(void)
+{
+	return gd->flags & GD_FLG_RELOC ?
+	       plat_sysmem.has_initr : plat_sysmem.has_initf;
 }
 
 void sysmem_dump(void)
 {
-#ifdef DEBUG
 	struct sysmem *sysmem = &plat_sysmem;
 	struct lmb *lmb = &sysmem->lmb;
-	struct sysmem_property *prop;
-	struct sysmem_check *check;
+	struct memblock *mem;
+	struct memcheck *check;
 	struct list_head *node;
 	ulong memory_size = 0;
 	ulong reserved_size = 0;
 	ulong allocated_size = 0;
+	bool overflow = false;
 	ulong i;
 
 	if (!sysmem_has_init())
@@ -62,12 +55,13 @@ void sysmem_dump(void)
 	printf("\nsysmem_dump_all:\n");
 
 	/* Memory pool */
-	printf("    ------------------------------------------------------\n");
+	printf("    --------------------------------------------------------------------\n");
 	for (i = 0; i < lmb->memory.cnt; i++) {
 		memory_size += lmb->memory.region[i].size;
-		printf("    memory.rgn[%ld].base     = 0x%08lx\n", i,
-		       (ulong)lmb->memory.region[i].base);
-		printf("		 .size     = 0x%08lx\n",
+		printf("    memory.rgn[%ld].addr     = 0x%08lx - 0x%08lx (size: 0x%08lx)\n", i,
+		       (ulong)lmb->memory.region[i].base,
+		       (ulong)lmb->memory.region[i].base +
+		       (ulong)lmb->memory.region[i].size,
 		       (ulong)lmb->memory.region[i].size);
 	}
 	printf("\n    memory.total	   = 0x%08lx (%ld MiB. %ld KiB)\n",
@@ -75,54 +69,48 @@ void sysmem_dump(void)
 	       SIZE_MB((ulong)memory_size),
 	       SIZE_KB((ulong)memory_size));
 
-	/* Reserved */
-	i = 0;
-	printf("    ------------------------------------------------------\n");
-	list_for_each(node, &sysmem->reserved_head) {
-		prop = list_entry(node, struct sysmem_property, node);
-		reserved_size += prop->size;
-		printf("    reserved.rgn[%ld].name   = \"%s\"\n", i, prop->name);
-		printf("		   .base   = 0x%08lx\n",
-		       (ulong)prop->base);
-		printf("		   .size   = 0x%08lx\n",
-		       (ulong)prop->size);
-		i++;
-	}
-	printf("\n    reserved.total	   = 0x%08lx (%ld MiB. %ld KiB)\n",
-	       (ulong)reserved_size,
-	       SIZE_MB((ulong)reserved_size),
-	       SIZE_KB((ulong)reserved_size));
-
 	/* Allocated */
 	i = 0;
-	printf("    ------------------------------------------------------\n");
+	printf("    --------------------------------------------------------------------\n");
 	list_for_each(node, &sysmem->allocated_head) {
-		prop = list_entry(node, struct sysmem_property, node);
-		allocated_size += prop->size;
-		check = (struct sysmem_check *)
-				(prop->base + prop->size - sizeof(*check));
-		printf("    allocated.rgn[%ld].name  = \"%s\"%s\n",
-		       i, prop->name,
-		       check->magic != SYSMEM_MAGIC ? "	(Overflow)" : "");
-		printf("		    .base  = 0x%08lx\n",
-		       (ulong)prop->base);
-		printf("		    .size  = 0x%08lx\n",
-		       (ulong)prop->size);
+		mem = list_entry(node, struct memblock, node);
+		allocated_size += mem->size;
+		if (mem->attr.flags & M_ATTR_OFC) {
+			check = (struct memcheck *)
+				(mem->base + mem->size - sizeof(*check));
+			overflow = (check->magic != SYSMEM_MAGIC);
+		} else if (mem->attr.flags & M_ATTR_HOFC) {
+			check = (struct memcheck *)
+				(mem->base - sizeof(*check));
+			overflow = (check->magic != SYSMEM_MAGIC);
+		} else {
+			overflow = false;
+		}
+
+		printf("    allocated.rgn[%ld].name  = \"%s\" %s\n",
+		       i, mem->attr.name, overflow ? "	   <Overflow!>" : "");
+		printf("		    .addr  = 0x%08lx - 0x%08lx (size: 0x%08lx)\n",
+		       (ulong)mem->base, (ulong)(mem->base + mem->size),
+		       (ulong)mem->size);
 		i++;
 	}
+
+	printf("\n    malloc_r: %d MiB, malloc_f: %d KiB\n",
+	       SIZE_MB(CONFIG_SYS_MALLOC_LEN), SIZE_KB(CONFIG_SYS_MALLOC_F_LEN));
 	printf("\n    allocated.total	   = 0x%08lx (%ld MiB. %ld KiB)\n",
 	       (ulong)allocated_size,
 	       SIZE_MB((ulong)allocated_size),
 	       SIZE_KB((ulong)allocated_size));
 
 	/* LMB core reserved */
-	printf("    ------------------------------------------------------\n");
+	printf("    --------------------------------------------------------------------\n");
 	reserved_size = 0;
 	for (i = 0; i < lmb->reserved.cnt; i++) {
 		reserved_size += lmb->reserved.region[i].size;
-		printf("    LMB.reserved[%ld].base   = 0x%08lx\n", i,
-		       (ulong)lmb->reserved.region[i].base);
-		printf("		   .size   = 0x%08lx\n",
+		printf("    LMB.reserved[%ld].addr   = 0x%08lx - 0x%08lx (size: 0x%08lx)\n", i,
+		       (ulong)lmb->reserved.region[i].base,
+		       (ulong)lmb->reserved.region[i].base +
+		       (ulong)lmb->reserved.region[i].size,
 		       (ulong)lmb->reserved.region[i].size);
 	}
 
@@ -130,167 +118,179 @@ void sysmem_dump(void)
 	       (ulong)reserved_size,
 	       SIZE_MB((ulong)reserved_size),
 	       SIZE_KB((ulong)reserved_size));
-	printf("    ------------------------------------------------------\n\n");
-#endif
-}
-
-int sysmem_check(void)
-{
-	struct sysmem *sysmem = &plat_sysmem;
-	struct sysmem_property *prop;
-	struct sysmem_check *check;
-	struct list_head *node;
-	int ret = 0;
-
-	if (!sysmem_has_init())
-		return -ENOSYS;
-
-	/* Check allocated */
-	list_for_each(node, &sysmem->allocated_head) {
-		prop = list_entry(node, struct sysmem_property, node);
-		check = (struct sysmem_check *)
-				(prop->base + prop->size - sizeof(*check));
-		if (check->magic != SYSMEM_MAGIC) {
-			ret = -EOVERFLOW;
-			SYSMEM_E("\"%s\" (base=0x%08lx, size=0x%lx) is Overflow!\n",
-				 prop->name, (ulong)prop->base, (ulong)prop->size);
-		}
-	}
-
-	/* Check stack */
-	check = (struct sysmem_check *)(gd->start_addr_sp - CONFIG_SYS_STACK_SIZE);
-	if (check->magic != SYSMEM_MAGIC) {
-		ret = -EOVERFLOW;
-		SYSMEM_E("Runtime stack is Overflow!\n");
-	}
-
-	return ret;
-}
-
-int sysmem_dump_check(void)
-{
-	sysmem_dump();
-
-	return sysmem_check();
+	printf("    --------------------------------------------------------------------\n\n");
 }
 
-static int sysmem_is_overlap(phys_addr_t base1, phys_size_t size1,
-			     phys_addr_t base2, phys_size_t size2)
+static inline int sysmem_is_overlap(phys_addr_t base1, phys_size_t size1,
+				    phys_addr_t base2, phys_size_t size2)
 {
 	return ((base1 < (base2 + size2)) && (base2 < (base1 + size1)));
 }
 
-int sysmem_add(phys_addr_t base, phys_size_t size)
+static int sysmem_add(phys_addr_t base, phys_size_t size)
 {
 	struct sysmem *sysmem = &plat_sysmem;
 	int ret;
 
-	if (!sysmem_has_init())
-		return -ENOSYS;
+	if (!size)
+		return -EINVAL;
 
 	ret = lmb_add(&sysmem->lmb, base, size);
 	if (ret < 0)
-		SYSMEM_E("Failed to add sysmem at 0x%lx for 0x%lx size\n",
+		SYSMEM_E("Failed to add sysmem at 0x%08lx for 0x%08lx size\n",
 			 (ulong)base, (ulong)size);
 
 	return (ret >= 0) ? 0 : ret;
 }
 
-int sysmem_reserve(const char *name, phys_addr_t base, phys_size_t size)
+static const char *sysmem_alias2name(const char *name, int *id)
 {
-	struct sysmem *sysmem = &plat_sysmem;
-	struct sysmem_property *prop;
-	struct list_head *node;
-	int ret = 0;
-
-	if (!sysmem_has_init())
-		return -ENOSYS;
+	const char *alias;
+	int n, i, j;
+	int match = 0;
+
+	for (i = 0; i < MEMBLK_ID_MAX; i++) {
+		/* Pirmary name */
+		if (mem_attr[i].name && !strcasecmp(mem_attr[i].name, name)) {
+			match = 1;
+			goto finish;
+		}
 
-	if (!name) {
-		SYSMEM_E("NULL name for reserved sysmem\n");
-		return -EINVAL;
-	}
+		/* Alias name */
+		alias = mem_attr[i].alias[0];
+		if (!alias)
+			continue;
 
-	/* Check overlap */
-	list_for_each(node, &sysmem->reserved_head) {
-		prop = list_entry(node, struct sysmem_property, node);
-		if (!strcmp(prop->name, name)) {
-			SYSMEM_E("Failed to double reserve for existence \"%s\"\n", name);
-			return -EEXIST;
-		} else if (sysmem_is_overlap(prop->base, prop->size, base, size)) {
-			SYSMEM_D("\"%s\" (base=0x%08lx, size=0x%lx) reserve is "
-				 "overlap with existence \"%s\" (base=0x%08lx, size=0x%lx)\n",
-				 name, (ulong)base, (ulong)size, prop->name,
-				 (ulong)prop->base, (ulong)prop->size);
+		n = ARRAY_SIZE(mem_attr[i].alias);
+		for (j = 0; j < n; j++, alias++) {
+			if (alias && !strcasecmp(alias, name)) {
+				match = 1;
+				goto finish;
+			}
 		}
 	}
 
-	ret = lmb_reserve(&sysmem->lmb, base, size);
-	if (ret >= 0) {
-		prop = malloc(sizeof(*prop));
-		if (!prop) {
-			SYSMEM_E("No memory for \"%s\" reserve sysmem\n", name);
-			return -ENOMEM;
-		}
-
-		prop->name = name;
-		prop->base = base;
-		prop->size = size;
-		list_add_tail(&prop->node, &sysmem->reserved_head);
-	} else {
-		SYSMEM_E("Failed to reserve \"%s\" at 0x%lx\n", name, (ulong)base);
-		return -EINVAL;
+finish:
+	if (match) {
+		*id = i;
+		return mem_attr[i].name;
 	}
 
-	return 0;
+	return name;
 }
 
-void *sysmem_alloc_align_base(const char *name,
-			      phys_addr_t base,
-			      phys_size_t size,
-			      ulong align)
+static void *sysmem_alloc_align_base(enum memblk_id id,
+				     const char *mem_name,
+				     phys_addr_t base,
+				     phys_size_t size,
+				     ulong align)
 {
 	struct sysmem *sysmem = &plat_sysmem;
-	struct sysmem_property *prop;
-	struct sysmem_check *check;
+	struct memblk_attr attr;
+	struct memblock *mem;
+	struct memcheck *check;
 	struct list_head *node;
+	const char *name;
 	phys_addr_t paddr;
 	phys_addr_t alloc_base;
 	phys_size_t alloc_size;
+	phys_addr_t bank_base;
+	phys_size_t bank_size;
+	bool req_overlap = false; /* Only for kernel reserved-memory */
+	int i;
 
 	if (!sysmem_has_init())
 		return NULL;
 
-	if (!name) {
-		SYSMEM_E("NULL name for alloc sysmem\n");
+	if (id == MEMBLK_ID_BY_NAME || id == MEMBLK_ID_FDT_RESV) {
+		if (!mem_name) {
+			SYSMEM_E("NULL name for alloc sysmem\n");
+			return NULL;
+		} else if (id == MEMBLK_ID_FDT_RESV) {
+			for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
+				if (!gd->bd->bi_dram[i].size)
+					continue;
+
+				bank_base = gd->bd->bi_dram[i].start;
+				bank_size = gd->bd->bi_dram[i].size;
+				if (sysmem_is_overlap(base, size,
+						      bank_base, bank_size)) {
+					req_overlap = true;
+					break;
+				}
+			}
+
+			if (!req_overlap)
+				return (void *)base;
+		}
+		name = sysmem_alias2name(mem_name, (int *)&id);
+		attr = mem_attr[id];
+		if (!attr.name)
+			attr.name = strdup(name);
+	} else if (id > MEMBLK_ID_UNK && id < MEMBLK_ID_MAX) {
+		attr = mem_attr[id];
+		name = attr.name;
+	} else {
+		SYSMEM_E("Unsupport memblk id %d for alloc sysmem\n", id);
+		return NULL;
+	}
+
+	if (!size) {
+		SYSMEM_E("\"%s\" size is 0 for alloc sysmem\n", name);
 		return NULL;
 	}
 
 	if (!IS_ALIGNED(base, 4)) {
-		SYSMEM_E("\"%s\" base=0x%08lx is not 4-byte aligned\n", name, (ulong)base);
+		SYSMEM_E("\"%s\" base=0x%08lx is not 4-byte aligned\n",
+			 name, (ulong)base);
 		return NULL;
 	}
 
 	/* Must be 4-byte aligned */
 	size = ALIGN(size, 4);
 
+	SYSMEM_D("Enter alloc: \"%s\" 0x%08lx - 0x%08lx\n",
+		 name, (ulong)base, (ulong)(base + size));
+
 	/* Already allocated ? */
 	list_for_each(node, &sysmem->allocated_head) {
-		prop = list_entry(node, struct sysmem_property, node);
-		if (!strcmp(prop->name, name)) {
+		mem = list_entry(node, struct memblock, node);
+		SYSMEM_D("Has allcated: %s, 0x%08lx - 0x%08lx\n",
+			 mem->attr.name, (ulong)mem->base,
+			 (ulong)(mem->base + mem->size));
+		if (!strcmp(mem->attr.name, name)) {
+			if (mem->base <= base && mem->size >= size)
+				return (void *)base;
+
 			SYSMEM_E("Failed to double alloc for existence \"%s\"\n", name);
 			return NULL;
-		} else if (sysmem_is_overlap(prop->base, prop->size, base, size)) {
-			SYSMEM_E("\"%s\" (base=0x%08lx, size=0x%lx) alloc is "
-				 "overlap with existence \"%s\" (base=0x%08lx, size=0x%lx)\n",
-				 name, (ulong)base, (ulong)size,
-				 prop->name, (ulong)prop->base,
-				 (ulong)prop->size);
+		} else if (sysmem_is_overlap(mem->base, mem->size, base, size)) {
+			if (req_overlap && mem->attr.flags & M_ATTR_OVERLAP) {
+				if (lmb_reserve(&sysmem->lmb, base, size))
+					SYSMEM_E("Failed to overlap alloc \"%s\" "
+						 "at 0x%08lx - 0x%08lx\n",
+						 name, (ulong)base,
+						 (ulong)(base + size));
+				return (void *)base;
+			}
+
+			SYSMEM_E("\"%s\" (0x%08lx - 0x%08lx) alloc is "
+				 "overlap with existence \"%s\" (0x%08lx - "
+				 "0x%08lx)\n",
+				 name, (ulong)base, (ulong)(base + size),
+				 mem->attr.name, (ulong)mem->base,
+				 (ulong)(mem->base + mem->size));
 			return NULL;
 		}
 	}
 
-	alloc_size = size + sizeof(*check);
+	/* Add overflow check magic ? */
+	if (attr.flags & M_ATTR_OFC)
+		alloc_size = size + sizeof(*check);
+	else
+		alloc_size = size;
+
+	/* Alloc anywhere ? */
 	if (base == SYSMEM_ALLOC_ANYWHERE)
 		alloc_base = base;
 	else
@@ -298,127 +298,170 @@ void *sysmem_alloc_align_base(const char *name,
 
 	paddr = lmb_alloc_base(&sysmem->lmb, alloc_size, align, alloc_base);
 	if (paddr) {
-		if  ((paddr == base) || (base == SYSMEM_ALLOC_ANYWHERE)) {
-			prop = malloc(sizeof(*prop));
-			if (!prop) {
+		if ((paddr == base) || (base == SYSMEM_ALLOC_ANYWHERE)) {
+			mem = malloc(sizeof(*mem));
+			if (!mem) {
 				SYSMEM_E("No memory for \"%s\" alloc sysmem\n", name);
 				return NULL;
 			}
 
-			prop->name = name;
-			prop->base = paddr;
-			prop->size = alloc_size;
+			mem->base = paddr;
+			mem->size = alloc_size;
+			mem->attr = attr;
 			sysmem->allocated_cnt++;
-
-			check = (struct sysmem_check *)(paddr + size);
-			check->magic = SYSMEM_MAGIC;
-
-			list_add_tail(&prop->node, &sysmem->allocated_head);
+			list_add_tail(&mem->node, &sysmem->allocated_head);
+
+			if (mem->attr.flags & M_ATTR_OFC) {
+				check = (struct memcheck *)(paddr + size);
+				check->magic = SYSMEM_MAGIC;
+			} else if (mem->attr.flags & M_ATTR_HOFC) {
+				check = (struct memcheck *)(paddr - sizeof(*check));
+				check->magic = SYSMEM_MAGIC;
+			}
 		} else {
-			SYSMEM_E("Failed to alloc \"%s\" at expect 0x%lx but "
-				 "alloc at 0x%lx\n",
-				 name, (ulong)base, (ulong)paddr);
+			SYSMEM_E("Failed to alloc \"%s\" expect at 0x%08lx - 0x%08lx "
+				 "but at 0x%08lx - x%08lx\n",
+				 name, (ulong)base, (ulong)(base + size),
+				 (ulong)paddr, (ulong)(paddr + size));
+			if (lmb_free(&sysmem->lmb, paddr, alloc_size))
+				SYSMEM_E("Failed to free \"%s\"\n", name);
+
 			return NULL;
 		}
 	} else {
-		SYSMEM_E("Failed to alloc \"%s\" at 0x%lx\n", name, (ulong)base);
+		SYSMEM_E("Failed to alloc \"%s\" at 0x%08lx - 0x%08lx\n",
+			 name, (ulong)base, (ulong)(base + size));
 	}
 
-	SYSMEM_D("Alloc: \"%s\", paddr=0x%lx, size=0x%lx, align=0x%x, anywhere=%d\n",
+	SYSMEM_D("Exit alloc: \"%s\", paddr=0x%08lx, size=0x%08lx, align=0x%x, anywhere=%d\n",
 		 name, (ulong)paddr, (ulong)size, (u32)align, !base);
 
 	return (void *)paddr;
 }
 
-void *sysmem_alloc_align(const char *name, phys_size_t size, ulong align)
+void *sysmem_alloc_base(enum memblk_id id, phys_addr_t base, phys_size_t size)
 {
-	return sysmem_alloc_align_base(name,
-				       SYSMEM_ALLOC_ANYWHERE,
-				       size,
-				       align);
+	void *paddr;
+
+	paddr = sysmem_alloc_align_base(id,
+					NULL,
+					base,
+					size,
+					SYSMEM_ALLOC_NO_ALIGN);
+	if (!paddr)
+		sysmem_dump();
+
+	return paddr;
 }
 
-void *sysmem_alloc_base(const char *name, phys_addr_t base, phys_size_t size)
+void *sysmem_alloc_base_by_name(const char *name,
+				phys_addr_t base, phys_size_t size)
 {
-	return sysmem_alloc_align_base(name,
-				       base,
-				       size,
-				       SYSMEM_ALLOC_NO_ALIGN);
+	void *paddr;
+
+	paddr = sysmem_alloc_align_base(MEMBLK_ID_BY_NAME,
+					name,
+					base,
+					size,
+					SYSMEM_ALLOC_NO_ALIGN);
+	if (!paddr)
+		sysmem_dump();
+
+	return paddr;
 }
 
-void *sysmem_alloc(const char *name, phys_size_t size)
+void *sysmem_fdt_reserve_alloc_base(const char *name,
+				    phys_addr_t base, phys_size_t size)
 {
-	return sysmem_alloc_align_base(name,
-				       SYSMEM_ALLOC_ANYWHERE,
-				       size,
-				       SYSMEM_ALLOC_NO_ALIGN);
+	void *paddr;
+
+	paddr = sysmem_alloc_align_base(MEMBLK_ID_FDT_RESV,
+					name,
+					base,
+					size,
+					SYSMEM_ALLOC_NO_ALIGN);
+	if (!paddr)
+		sysmem_dump();
+
+	return paddr;
 }
 
 int sysmem_free(phys_addr_t base)
 {
 	struct sysmem *sysmem = &plat_sysmem;
-	struct sysmem_property *prop;
+	struct memblock *mem;
 	struct list_head *node;
-	int found = 0;
-	int ret;
+	int ret, found = 0;
 
 	if (!sysmem_has_init())
 		return -ENOSYS;
 
 	/* Find existence */
 	list_for_each(node, &sysmem->allocated_head) {
-		prop = list_entry(node, struct sysmem_property, node);
-		if (prop->base == base) {
+		mem = list_entry(node, struct memblock, node);
+		if (mem->base == base) {
 			found = 1;
 			break;
 		}
 	}
 
 	if (!found) {
-		SYSMEM_E("Failed to free no allocated sysmem at 0x%lx\n", (ulong)base);
+		SYSMEM_E("Failed to free no allocated sysmem at 0x%08lx\n",
+			 (ulong)base);
 		return -EINVAL;
 	}
 
-	ret = lmb_free(&sysmem->lmb, prop->base, prop->size);
+	ret = lmb_free(&sysmem->lmb, mem->base, mem->size);
 	if (ret >= 0) {
-		SYSMEM_D("Free: \"%s\", paddr=0x%lx, size=0x%lx\n",
-			 prop->name, (ulong)prop->base, (ulong)prop->size);
+		SYSMEM_D("Free: \"%s\" 0x%08lx - 0x%08lx\n",
+			 mem->attr.name, (ulong)mem->base,
+			 (ulong)(mem->base + mem->size));
 		sysmem->allocated_cnt--;
-		list_del(&prop->node);
-		free(prop);
+		list_del(&mem->node);
+		free(mem);
 	} else {
-		SYSMEM_E("Failed to free \"%s\" at 0x%lx\n", prop->name, (ulong)base);
+		SYSMEM_E("Failed to free \"%s\" at 0x%08lx\n",
+			 mem->attr.name, (ulong)base);
 	}
 
 	return (ret >= 0) ? 0 : ret;
 }
 
+int sysmem_initr(void)
+{
+	return sysmem_init();
+}
+
 int sysmem_init(void)
 {
 	struct sysmem *sysmem = &plat_sysmem;
-	struct sysmem_check *check;
 	phys_addr_t mem_start;
 	phys_size_t mem_size;
 	int ret;
 
-	SYSMEM_I("init\n");
-
 	lmb_init(&sysmem->lmb);
 	INIT_LIST_HEAD(&sysmem->allocated_head);
-	INIT_LIST_HEAD(&sysmem->reserved_head);
 	sysmem->allocated_cnt = 0;
-	sysmem->has_init = true;
+	if (gd->flags & GD_FLG_RELOC) {
+		sysmem->has_initr = true;
+	} else {
+		SYSMEM_I("init\n");
+		sysmem->has_initf = true;
+	}
 
 	/* Add all available system memory */
 #ifdef CONFIG_NR_DRAM_BANKS
 	int i;
 
 	for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
+		if (!gd->bd->bi_dram[i].size)
+			continue;
+
 		ret = sysmem_add(gd->bd->bi_dram[i].start,
 				 gd->bd->bi_dram[i].size);
 		if (ret) {
 			SYSMEM_E("Failed to add sysmem from bi_dram[%d]\n", i);
-			return ret;
+			goto fail;
 		}
 	}
 #else
@@ -427,39 +470,44 @@ int sysmem_init(void)
 	ret = sysmem_add(mem_start, mem_size);
 	if (ret) {
 		SYSMEM_E("Failed to add sysmem from bootm_low/size\n");
-		return ret;
+		goto fail;
 	}
 #endif
-
-	/* Reserved for arch */
-	ret = arch_sysmem_reserve(sysmem);
-	if (ret) {
-		SYSMEM_E("Failed to reserve sysmem for arch\n");
-		return ret;
-	}
-
 	/* Reserved for board */
 	ret = board_sysmem_reserve(sysmem);
 	if (ret) {
 		SYSMEM_E("Failed to reserve sysmem for board\n");
-		return ret;
+		goto fail;
 	}
 
-	/* Reserved for U-boot framework 'reserve_xxx()' */
-	mem_start = gd->start_addr_sp - CONFIG_SYS_STACK_SIZE;
+	/* Reserved for U-boot framework: 'reserve_xxx()' */
+	mem_start = gd->start_addr_sp;
 	mem_size = gd->ram_top - mem_start;
-	check = (struct sysmem_check *)mem_start;
-	check->magic = SYSMEM_MAGIC;
-
-	ret = sysmem_reserve("U-Boot", mem_start, mem_size);
-	if (ret) {
+	if (!sysmem_alloc_base(MEMBLK_ID_UBOOT, mem_start, mem_size)) {
 		SYSMEM_E("Failed to reserve sysmem for U-Boot framework\n");
-		return ret;
+		ret = -ENOMEM;
+		goto fail;
 	}
 
-	sysmem_dump();
+	/* Reserved for U-Boot stack */
+	mem_start = gd->start_addr_sp - CONFIG_SYS_STACK_SIZE;
+	mem_size = CONFIG_SYS_STACK_SIZE;
+	if (!sysmem_alloc_base(MEMBLK_ID_STACK, mem_start, mem_size)) {
+		SYSMEM_E("Failed to reserve sysmem for stack\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
 
 	return 0;
+
+fail:
+	if (ret && !(gd->flags & GD_FLG_RELOC)) {
+		sysmem_dump();
+		SYSMEM_W("Maybe malloc size %d MiB is too large?\n\n",
+			 SIZE_MB(CONFIG_SYS_MALLOC_LEN));
+	}
+
+	return ret;
 }
 
 __weak int board_sysmem_reserve(struct sysmem *sysmem)
@@ -468,8 +516,15 @@ __weak int board_sysmem_reserve(struct sysmem *sysmem)
 	return 0;
 }
 
-__weak int arch_sysmem_reserve(struct sysmem *sysmem)
+static int do_dump_sysmem(cmd_tbl_t *cmdtp, int flag,
+			  int argc, char *const argv[])
 {
-	/* please define platform specific arch_sysmem_reserve() */
+	sysmem_dump();
 	return 0;
 }
+
+U_BOOT_CMD(
+	dump_sysmem, 1, 1, do_dump_sysmem,
+	"Dump sysmem layout",
+	""
+);
diff --git a/make.sh b/make.sh
index fd9780c237..da072205b9 100755
--- a/make.sh
+++ b/make.sh
@@ -324,7 +324,7 @@ select_chip_info()
 	#  - PX30, PX3SE
 	#  - RK????, RK????X
 	#  - RV????
-	local chip_reg='^CONFIG_ROCKCHIP_[R,P][X,V,K][0-9ESX]{2,5}'
+	local chip_reg='^CONFIG_ROCKCHIP_[R,P][X,V,K][0-9ESX]{1,5}'
 	count=`egrep -c ${chip_reg} ${OUTDIR}/.config`
 	# Obtain the matching only
 	RKCHIP=`egrep -o ${chip_reg} ${OUTDIR}/.config`
@@ -345,6 +345,8 @@ select_chip_info()
 			&& RKCHIP=RK3326
 		grep '^CONFIG_ROCKCHIP_RK3128X=y' ${OUTDIR}/.config >/dev/null \
 			&& RKCHIP=RK3128X
+		grep '^CONFIG_ROCKCHIP_PX5=y' ${OUTDIR}/.config >/dev/null \
+			&& RKCHIP=PX5
 		grep '^CONFIG_ROCKCHIP_RK3399PRO=y' ${OUTDIR}/.config >/dev/null \
 			&& RKCHIP=RK3399PRO
 	else
@@ -502,9 +504,29 @@ debug_command()
 
 pack_uboot_image()
 {
-	local UBOOT_LOAD_ADDR
+	local UBOOT_LOAD_ADDR UBOOT_MAX_KB UBOOT_KB HEAD_KB=2
 
+	# Check file size
+	UBOOT_KB=`ls -l u-boot.bin | awk '{print $5}'`
+	if [ "$PLATFORM_UBOOT_IMG_SIZE" = "" ]; then
+		UBOOT_MAX_KB=1046528
+	else
+		UBOOT_MAX_KB=`echo $PLATFORM_UBOOT_IMG_SIZE | awk '{print strtonum($2)}'`
+		UBOOT_MAX_KB=$(((UBOOT_MAX_KB-HEAD_KB)*1024))
+	fi
+
+	if [ $UBOOT_KB -gt $UBOOT_MAX_KB ]; then
+		echo
+		echo "ERROR: pack uboot failed! u-boot.bin actual: $UBOOT_KB bytes, max limit: $UBOOT_MAX_KB bytes"
+		exit 1
+	fi
+
+	# Pack image
 	UBOOT_LOAD_ADDR=`sed -n "/CONFIG_SYS_TEXT_BASE=/s/CONFIG_SYS_TEXT_BASE=//p" ${OUTDIR}/include/autoconf.mk|tr -d '\r'`
+	if [ ! $UBOOT_LOAD_ADDR ]; then
+		UBOOT_LOAD_ADDR=`sed -n "/CONFIG_SYS_TEXT_BASE=/s/CONFIG_SYS_TEXT_BASE=//p" ${OUTDIR}/.config|tr -d '\r'`
+	fi
+
 	${RKTOOLS}/loaderimage --pack --uboot ${OUTDIR}/u-boot.bin uboot.img ${UBOOT_LOAD_ADDR} ${PLATFORM_UBOOT_IMG_SIZE}
 
 	# Delete u-boot.img and u-boot-dtb.img, which makes users not be confused with final uboot.img
@@ -521,17 +543,17 @@ pack_uboot_image()
 
 pack_loader_image()
 {
-	local mode=$1 files ini
+	local mode=$1 files ini=${RKBIN}/RKBOOT/${RKCHIP_LOADER}MINIALL.ini
 
-	if [ ! -f ${RKBIN}/RKBOOT/${RKCHIP_LOADER}MINIALL.ini ]; then
-		echo "pack loader failed! Can't find: ${RKBIN}/RKBOOT/${RKCHIP_LOADER}MINIALL.ini"
+	if [ ! -f $ini ]; then
+		echo "pack loader failed! Can't find: $ini"
 		return
 	fi
 
 	cd ${RKBIN}
 
 	if [ "${mode}" = 'all' ]; then
-		files=`ls ${RKBIN}/RKBOOT/${RKCHIP_LOADER}*MINIALL*.ini`
+		files=`ls ${RKBIN}/RKBOOT/${RKCHIP_LOADER}MINIALL*.ini`
 		for ini in $files
 		do
 			if [ -f "$ini" ]; then
@@ -540,8 +562,8 @@ pack_loader_image()
 			fi
 		done
 	else
-		${RKTOOLS}/boot_merger ${BIN_PATH_FIXUP} ${RKBIN}/RKBOOT/${RKCHIP_LOADER}MINIALL.ini
-		echo "pack loader okay! Input: ${RKBIN}/RKBOOT/${RKCHIP_LOADER}MINIALL.ini"
+		${RKTOOLS}/boot_merger ${BIN_PATH_FIXUP} $ini
+		echo "pack loader okay! Input: $ini"
 	fi
 
 	cd - && mv ${RKBIN}/*_loader_*.bin ./
@@ -586,16 +608,10 @@ pack_trust_image()
 		TOS=$(echo ${TOS} | sed "s/tools\/rk_tools\//\.\//g")
 		TOS_TA=$(echo ${TOS_TA} | sed "s/tools\/rk_tools\//\.\//g")
 
-		if [ x$TOS_TA != x -a x$TOS != x ]; then
-			${RKTOOLS}/loaderimage --pack --trustos ${RKBIN}/${TOS} ./trust.img ${TEE_LOAD_ADDR} ${PLATFORM_TRUST_IMG_SIZE}
-			${RKTOOLS}/loaderimage --pack --trustos ${RKBIN}/${TOS_TA} ./trust_with_ta.img ${TEE_LOAD_ADDR} ${PLATFORM_TRUST_IMG_SIZE}
-			echo "Both trust.img and trust_with_ta.img are ready"
-		elif [ $TOS ]; then
-			${RKTOOLS}/loaderimage --pack --trustos ${RKBIN}/${TOS} ./trust.img ${TEE_LOAD_ADDR} ${PLATFORM_TRUST_IMG_SIZE}
-			echo "trust.img is ready"
-		elif [ $TOS_TA ]; then
+		if [ $TOS_TA ]; then
 			${RKTOOLS}/loaderimage --pack --trustos ${RKBIN}/${TOS_TA} ./trust.img ${TEE_LOAD_ADDR} ${PLATFORM_TRUST_IMG_SIZE}
-			echo "trust.img with ta is ready"
+		elif [ $TOS ]; then
+			${RKTOOLS}/loaderimage --pack --trustos ${RKBIN}/${TOS}    ./trust.img ${TEE_LOAD_ADDR} ${PLATFORM_TRUST_IMG_SIZE}
 		else
 			echo "Can't find any tee bin"
 			exit 1
diff --git a/scripts/mkkrnlimg b/scripts/mkkrnlimg
new file mode 100755
index 0000000000..f8601d3ee0
--- /dev/null
+++ b/scripts/mkkrnlimg
diff --git a/scripts/stacktrace.sh b/scripts/stacktrace.sh
index cb0383254d..39699499ef 100755
--- a/scripts/stacktrace.sh
+++ b/scripts/stacktrace.sh
@@ -41,13 +41,17 @@ do
 	cat u-boot.sym | sort |
 	awk -v foffset=$f_offset_hex '/\.text/ {
 		if (strtonum("0x"$1) > '$frame_pc_str') {
-			printf("%s+0x%s/0x%x\n", fname, foffset, fsize);
+			printf("%s+0x%s/0x%x      ", fname, foffset, fsize);
 			exit
 		}
 		fname=$NF;
 		fsize=strtonum("0x"$5);
 		fpc=strtonum("0x"$1);
 	}'
+
+	func_path=`./make.sh $frame_pc_str | awk '{ print $1 }' | sed -n "/home/p"`
+	func_path=`echo ${func_path##*boot/}`
+	echo $func_path
 done
 echo
 
diff --git a/tools/rockchip/boot_merger.c b/tools/rockchip/boot_merger.c
index fd8916e2ba..923bdb75ba 100644
--- a/tools/rockchip/boot_merger.c
+++ b/tools/rockchip/boot_merger.c
@@ -141,6 +141,11 @@ static inline void fixPath(char *path)
 			strcpy(tmp, end);
 			/* Terminate, so path can be dest for strcat() */
 			*start = '\0';
+			strcat(path, gNewPath);
+			strcat(path, tmp);
+		} else {
+			strcpy(tmp, path);
+			strcpy(path, gNewPath);
 			strcat(path, tmp);
 		}
 	}
@@ -308,7 +313,6 @@ static bool parseOut(FILE *file)
 	}
 	if (fscanf(file, OPT_OUT_PATH "=%[^\r^\n]", gOpts.outPath) != 1)
 		return false;
-	fixPath(gOpts.outPath);
 	printf("out:%s\n", gOpts.outPath);
 	return true;
 }
diff --git a/tools/rockchip/loaderimage.c b/tools/rockchip/loaderimage.c
index 1a98f72de9..534dd05149 100644
--- a/tools/rockchip/loaderimage.c
+++ b/tools/rockchip/loaderimage.c
@@ -229,7 +229,7 @@ int main(int argc, char *argv[])
 		fseek(fi, 0, SEEK_END);
 		size = ftell(fi);
 		fseek(fi, 0, SEEK_SET);
-		printf("pack file size: %d \n", size);
+		printf("pack file size: %d(%d KB)\n", size, size / 1024);
 		if (size > max_size - sizeof(second_loader_hdr)) {
 			perror(file_out);
 			exit(EXIT_FAILURE);
diff --git a/tools/rockchip/trust_merger.c b/tools/rockchip/trust_merger.c
index b481321973..81e4da8a9b 100644
--- a/tools/rockchip/trust_merger.c
+++ b/tools/rockchip/trust_merger.c
@@ -102,6 +102,11 @@ static inline void fixPath(char *path)
 			strcpy(tmp, end);
 			/* Terminate, so path can be dest for strcat() */
 			*start = '\0';
+			strcat(path, gNewPath);
+			strcat(path, tmp);
+		} else {
+			strcpy(tmp, path);
+			strcpy(path, gNewPath);
 			strcat(path, tmp);
 		}
 	}
@@ -210,7 +215,6 @@ static bool parseOut(FILE *file)
 	}
 	if (fscanf(file, OPT_OUT_PATH "=%[^\r^\n]", gOpts.outPath) != 1)
 		return false;
-	fixPath(gOpts.outPath);
 	printf("out:%s\n", gOpts.outPath);
 
 	return true;