diff --git a/BSP/linux-kernel/.48720.tmp b/BSP/linux-kernel/.48720.tmp
deleted file mode 100644
index 50eb84054..000000000
Binary files a/BSP/linux-kernel/.48720.tmp and /dev/null differ
diff --git a/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h b/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h
index 56e4dc412..4b869ab2c 100755
--- a/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h
+++ b/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h
@@ -945,7 +945,7 @@
 #define SF_IS_RELEASE                   ENABLE
 
 #define PHOTO_ISP_STAMP 				DISABLE
-#define SF_BASE_VERSION_FEA			"R2.3"
+#define SF_BASE_VERSION_FEA			"R6.0"
 #define SF_GPS_SUPPORT 					1
 #define SF_SEND_LIST_ITEM_LENGTH        15
 #define SF_4G_REGISTER_NETWORK_COUNT    230
diff --git a/code/application/source/cardv/SrcCode/System/SysMain.c b/code/application/source/cardv/SrcCode/System/SysMain.c
index 82d051e3a..a2b0c6e60 100644
--- a/code/application/source/cardv/SrcCode/System/SysMain.c
+++ b/code/application/source/cardv/SrcCode/System/SysMain.c
@@ -773,6 +773,8 @@ exit:
     {
         DBG_DUMP("LogFile_Close ...\n");
         LogFile_Close();
+        system("rm -rf /mnt/sd/LOG/*dummy*");//Clear intermediate files.
+		system("sync");
     }
     #endif
     #else
diff --git a/code/application/source/cardv/SrcCode/UIApp/Photo/UIAppPhoto_Exe.c b/code/application/source/cardv/SrcCode/UIApp/Photo/UIAppPhoto_Exe.c
index 4dd80a36a..c0740a58b 100755
--- a/code/application/source/cardv/SrcCode/UIApp/Photo/UIAppPhoto_Exe.c
+++ b/code/application/source/cardv/SrcCode/UIApp/Photo/UIAppPhoto_Exe.c
@@ -6818,22 +6818,22 @@ INT32 PhotoExe_Preview_SliceEncode_CB3(void* user_data)
 			FileSys_CloseFile(fp);
 #if HUNTING_CAMERA_MCU == ENABLE
 			char tmp2[64] = {'\0'};
-			UIMenuStoreInfo *puiPara = sf_ui_para_get();
+			//UIMenuStoreInfo *puiPara = sf_ui_para_get();
             memset(tmp, '\0', sizeof(tmp));
 			SF_FILE_TYPE_E enFileType = 0;
-            if(SF_CAM_MODE_PHOTO == puiPara->CamMode){
+            if(SF_CAM_MODE_PHOTO == sf_get_cammode_statu()){
                 enFileType = SF_FILE_TYPE_PIC_SMALL;
-            }else if(SF_CAM_MODE_PHOTO_VIDEO == puiPara->CamMode){
+            }else if(SF_CAM_MODE_PHOTO_VIDEO == sf_get_cammode_statu()){
                 enFileType = SF_FILE_TYPE_PIC_VIDEO;
             }
-            else if(SF_CAM_MODE_VIDEO2 == puiPara->CamMode){
+            else if(SF_CAM_MODE_VIDEO2 == sf_get_cammode_statu()){
                 enFileType = SF_FILE_TYPE_PIC_VIDEO;
             }
 			snprintf(tmp, sizeof(tmp), "%sW%s%s.JPG", SF_SEND_LIST_DIR, folder, number); /* DCF 8.3 naming rule */
 			snprintf(tmp2, sizeof(tmp2), "W%s%s.JPG", folder, number); /* DCF 8.3 naming rule */
 			DBG_DUMP("PHOTO THUMB %s \n %s\n", tmp, tmp2);
             sf_file_thumb_cfg_fill(tmp, tmp2, queue_ele_in->jpg_thumb_size, enFileType);
-            if((!sf_get_mode_flag()) || ((FALSE == sf_check_net_work_flag()) && (0 < sf_cardv_get_cq_signal()) && (SF_CAM_MODE_PHOTO == puiPara->CamMode)))
+            if((!sf_get_mode_flag()) || ((FALSE == sf_check_net_work_flag()) && (0 < sf_cardv_get_cq_signal()) && (SF_CAM_MODE_PHOTO == sf_get_cammode_statu())))
             {
                 if(SUCCESS == sf_share_mem_file_down(0, 0)){
 					sf_set_send_statu(TRUE);
diff --git a/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowMovie/UIFlowMovieEventCallback.c b/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowMovie/UIFlowMovieEventCallback.c
index 732b2e4ae..71338921e 100755
--- a/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowMovie/UIFlowMovieEventCallback.c
+++ b/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowMovie/UIFlowMovieEventCallback.c
@@ -707,9 +707,9 @@ static void UIFlowMovie_ScrOpen(lv_obj_t* obj)
 {
 	DBG_DUMP("%s\r\n", __func__);
 	
-	#if HUNTING_CAMERA_MCU == ENABLE	
-	UIMenuStoreInfo *puiPara = sf_ui_para_get();
-	#endif
+	// #if HUNTING_CAMERA_MCU == ENABLE	
+	// UIMenuStoreInfo *puiPara = sf_ui_para_get();
+	// #endif
 
 	set_indev_keypad_group(obj);
 
@@ -765,7 +765,7 @@ static void UIFlowMovie_ScrOpen(lv_obj_t* obj)
 	}
 	//#NT#2018/08/10#KCHong -end
 	#if HUNTING_CAMERA_MCU == ENABLE
-	if(puiPara->CamMode == SF_CAM_MODE_PHOTO_VIDEO || puiPara->CamMode == SF_CAM_MODE_VIDEO2)
+	if(sf_get_cammode_statu() == SF_CAM_MODE_PHOTO_VIDEO || sf_get_cammode_statu() == SF_CAM_MODE_VIDEO2)
 	#else
 	if(SysGetFlag(CamMode) == SF_CAM_MODE_PHOTO_VIDEO)
 	#endif 
@@ -1391,9 +1391,9 @@ void UIFlowMovie_KeyRelease(lv_obj_t* obj, uint32_t key)
 
 static void UIFlowMovie_NVTMSG(lv_obj_t* obj, const LV_USER_EVENT_NVTMSG_DATA* msg)
 {
-#if HUNTING_CAMERA_MCU == ENABLE
-	UIMenuStoreInfo *puiPara = sf_ui_para_get();
-#endif
+// #if HUNTING_CAMERA_MCU == ENABLE
+// 	UIMenuStoreInfo *puiPara = sf_ui_para_get();
+// #endif
 
 	switch(msg->event)
 	{
@@ -1414,7 +1414,7 @@ static void UIFlowMovie_NVTMSG(lv_obj_t* obj, const LV_USER_EVENT_NVTMSG_DATA* m
 		UIFlowMovie_REC_FINISH(obj,msg);
 		
 #if HUNTING_CAMERA_MCU == ENABLE		
-        if(puiPara->CamMode == SF_CAM_MODE_PHOTO_VIDEO || puiPara->CamMode == SF_CAM_MODE_VIDEO2){
+        if(sf_get_cammode_statu() == SF_CAM_MODE_PHOTO_VIDEO || sf_get_cammode_statu() == SF_CAM_MODE_VIDEO2){
             sf_set_phone_shot_status(PHONE_SHOT_STOP);
             if(sf_get_mode_flag())
             {
diff --git a/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowPhoto/UIFlowPhotoEventCallback.c b/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowPhoto/UIFlowPhotoEventCallback.c
index 09ddba1be..2f2b60d76 100755
--- a/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowPhoto/UIFlowPhotoEventCallback.c
+++ b/code/application/source/cardv/SrcCode/UIWnd/LVGL_SPORTCAM/UIFlowLVGL/UIFlowPhoto/UIFlowPhotoEventCallback.c
@@ -565,7 +565,7 @@ static void update_4g_module_icon(void)
 	{
 	    lv_obj_set_hidden(label_tips_scr_uiflowphoto, true);
 		// Update the icon.
-		printf("old signal = %d new signal = %d signal_level = %d\n", signal, signal_new, signal_level);
+		printf("old signal = %d new signal = %d signal_level = %d generation = %d\n", signal, signal_new, signal_level, sf_get_net_generation());
 		lv_obj_set_hidden(label_sim_scr_uiflowphoto, true);
 		signal_icon_hidden(searching_index);
 		signal_icon_hidden(signal);
diff --git a/code/application/source/sf_app/code/include/sf_file.h b/code/application/source/sf_app/code/include/sf_file.h
index 32a2dc9d9..1655ced1d 100755
--- a/code/application/source/sf_app/code/include/sf_file.h
+++ b/code/application/source/sf_app/code/include/sf_file.h
@@ -45,6 +45,7 @@ UINT8 sf_get_send_file_total(void);
 SINT32 sf_mem_upload_file_to_module(UINT32 MemPhotoAddr, UINT32 MemPhotosize);
 SINT32 sf_usr_mem_photo_ch(void);
 UINT8 sf_save_sd_log(void);
+void sf_log_error_code(char* buff);
 #ifdef __cplusplus
 #if __cplusplus
 }
diff --git a/code/application/source/sf_app/code/source/4gMng/sf_eg91_sim.c b/code/application/source/sf_app/code/source/4gMng/sf_eg91_sim.c
index dbdd40aee..3acbd8a7a 100755
--- a/code/application/source/sf_app/code/source/4gMng/sf_eg91_sim.c
+++ b/code/application/source/sf_app/code/source/4gMng/sf_eg91_sim.c
@@ -4532,6 +4532,8 @@ SINT32 sf_auto_net_reg(void)
 							SLOGE(gsmPara);
 							sprintf((char *)logStr, "AT+CGREG? Timeout,Error Code:0x%08X\n", ret);
 							SLOGE(logStr);
+                            SF_SPRINTF(logStr, "%x,", ret);
+                            sf_log_error_code(logStr);
 							goto SF_MODULE_END;
 						}
 					}
@@ -4699,6 +4701,8 @@ SINT32 sf_auto_net_reg(void)
 						SLOGE(gsmPara);
 						sprintf((char *)logStr, "Error Code:0x%08X\n", ret);
 						SLOGE(logStr);
+                        SF_SPRINTF(logStr, "%x,", ret);
+                        sf_log_error_code(logStr);
 						goto SF_MODULE_END;
 					}
 				}
@@ -4750,6 +4754,8 @@ SINT32 sf_auto_net_reg(void)
 							SLOGE(gsmPara);
 					        sprintf((char *)logStr, "Error Code:0x%08X\n", ret);
 							SLOGE(logStr);
+                            SF_SPRINTF(logStr, "%x,", ret);
+                            sf_log_error_code(logStr);
 							goto SF_MODULE_END;
 						}
 						else
@@ -4768,6 +4774,8 @@ SINT32 sf_auto_net_reg(void)
 						SLOGE(gsmPara);
 					    sprintf((char *)logStr, "Error Code:0x%08X\n", ret);
 						SLOGE(logStr);
+                        SF_SPRINTF(logStr, "%x,", ret);
+                        sf_log_error_code(logStr);
 						goto SF_MODULE_END;
 					}
 					else
diff --git a/code/application/source/sf_app/code/source/4gMng/sf_ftp.c b/code/application/source/sf_app/code/source/4gMng/sf_ftp.c
index e372ae237..e2b2a439f 100755
--- a/code/application/source/sf_app/code/source/4gMng/sf_ftp.c
+++ b/code/application/source/sf_app/code/source/4gMng/sf_ftp.c
@@ -970,6 +970,8 @@ SINT32 sf_pic_send_ftp(void)
                 //TIMEOUT
                 //pSifarPara->picSendTimeoutCount++;
                 printf("%s:%d err ftpFileName:%s filePath:%s picSendFailCount:%d sendThumbnailFailCount:%d\n", __FUNCTION__, __LINE__, ftpFileName[pic], filePath[pic],pSifarPara->picSendFailCount, pSifarPara->sendThumbnailFailCount);
+                SF_SPRINTF(logStr, "%x,", ret);
+                sf_log_error_code(logStr);
             }
             else {
                 if(!sf_get_mode_flag()){
@@ -1084,6 +1086,8 @@ SINT32 sf_video_send_ftp(void)
 		if(SF_SUCCESS != ret)
 		{
 			printf("%s:%d err ret: [0x%08X] ftpFileName:%s filePath:%s\n", __FUNCTION__, __LINE__, ret, ftpFileName, filePath);
+            SF_SPRINTF(logStr, "%x,", ret);
+            sf_log_error_code(logStr);
 		}
 	}
 
@@ -1130,6 +1134,8 @@ SINT32 sf_ftp_dailyreport_send(void)
 		if(SF_SUCCESS != ret)
 		{
 			printf("%s:%d err ret: [0x%08X] filePath:%s\n", __FUNCTION__, __LINE__, ret, filePath);
+            SF_SPRINTF(logStr, "%x,", ret);
+            sf_log_error_code(logStr);
 		}else {
 			DailyReportFtpSendSucess = 1;
             pSifarPara->picSendCount = 0;
@@ -1147,6 +1153,7 @@ SINT32 sf_ftp_dailyreport_send(void)
             pSifarPara->videoSendFailCount = 0;
             pSifarPara->videoSendSucessCount = 0;
             pSifarPara->SendlowPowerWarnCnt = 0;
+            sf_file_remove(SF_ERROR_CODE);
 		}
         sf_dailyReport_set();
 	}
@@ -1513,6 +1520,11 @@ SINT32 sf_camera_ota_ftp(void)
             }
             sf_set_fw_update(0);
         }
+        else
+        {
+            SF_SPRINTF(logStr, "%x,", ret);
+            sf_log_error_code(logStr);
+        }
     }
 
     MLOGD(" end ret:[0x%08X]\n", ret);
@@ -1645,6 +1657,8 @@ SINT32 sf_concentrated_ftp_send(void)
                         goto SF_CONCENTRATED_MODULE_REBOOT;
                     }
                     timeoutCnt++;
+                    SF_SPRINTF(logStr, "%x,", ret1);
+                    sf_log_error_code(logStr);
                     goto SF_CONCENTRATED_END;
                 }
                 else {
@@ -1825,6 +1839,8 @@ SINT32 sf_hd_ftp_send(void)
                         goto SF_HD_MODULE_REBOOT;
                     }
                     timeoutCnt++;
+                    SF_SPRINTF(logStr, "%x,", ret1);
+                    sf_log_error_code(logStr);
                     goto SF_HD_END;
                 }
                 else {
@@ -2056,6 +2072,8 @@ SINT32 sf_video_ftp_send(void)
                         goto SF_VIDEO_MODULE_REBOOT;
                     }
                     timeoutCnt++;
+                    SF_SPRINTF(logStr, "%x,", ret1);
+                    sf_log_error_code(logStr);
                     goto SF_VIDEO_END;
                 }
                 else {
@@ -2172,6 +2190,8 @@ SINT32 sf_log_send_ftp(void)
             if(SF_SUCCESS != ret)
             {
                 printf("%s:%d err ret: [0x%08X] filePath:%s\n", __FUNCTION__, __LINE__, ret, filePath);
+                SF_SPRINTF(logStr, "%x,", ret);
+                sf_log_error_code(logStr);
             }
         }
     }
@@ -2230,6 +2250,8 @@ SINT32 sf_low_power_warn_send_ftp(void)
     if(SF_SUCCESS != ret)
     {
         printf("%s:%d err ret: [0x%08X] filePath:%s\n", __FUNCTION__, __LINE__, ret, filePath);
+        SF_SPRINTF(logStr, "%x,", ret);
+        sf_log_error_code(logStr);
     }else {
         pSifarPara->SendlowPowerWarnCnt++;
     }
@@ -2285,6 +2307,8 @@ SINT32 sf_gps_send_ftp(void)
             if(SF_SUCCESS != ret)
             {
                 printf("%s:%d err ret: [0x%08X] filePath:%s\n", __FUNCTION__, __LINE__, ret, filePath);
+                SF_SPRINTF(logStr, "%x,", ret);
+                sf_log_error_code(logStr);
             }
             else {
                 //GPS send success,add gps send flag
@@ -3075,6 +3099,8 @@ SINT32 sf_card_log_send_ftp(void)
             if(SF_SUCCESS != ret)
             {
                 printf("%s:%d err ret: [0x%08X] filePath:%s\n", __FUNCTION__, __LINE__, ret, filePath);
+                SF_SPRINTF(logStr, "%x,", ret);
+                sf_log_error_code(logStr);
             }
             else {
 
diff --git a/code/application/source/sf_app/code/source/fileMng/sf_file.c b/code/application/source/sf_app/code/source/fileMng/sf_file.c
index 85e1c2710..83874c1a1 100755
--- a/code/application/source/sf_app/code/source/fileMng/sf_file.c
+++ b/code/application/source/sf_app/code/source/fileMng/sf_file.c
@@ -956,7 +956,7 @@ UINT32 sf_create_dailyreport_file(void)
     }
     //sf_create_thumb_dir();
 
-    if(pPara->CamNameSwitch)
+    if(SF_CAMID_ON == pPara->CamNameSwitch)
     {
         SF_STRCPY(cameraID, pPara->CamNameStr);
     }
@@ -1059,7 +1059,7 @@ UINT32 sf_create_dailyreport_file(void)
     }
     else if(temp == SF_POWER_TYPE_LI_POLYER)
     {
-        sprintf(str, "Custom");
+        sprintf(str, "Lith Pack");
     }
     else
     {
@@ -1301,23 +1301,23 @@ UINT32 sf_create_dailyreport_file(void)
 
         if(sf_file_IsExsit(SF_ERROR_CODE) == SF_TRUE){
             size = sf_get_file_size((UINT8 *)SF_ERROR_CODE);
-        }
-        fd1 = open(SF_ERROR_CODE, O_APPEND | O_WRONLY, S_IRUSR | S_IWUSR);
-        if(fd1)
-        {
-            //size = sp5kFsFileSizeGet(fd1);
-            buf = malloc(size);
-
-            if (buf)
+            fd1 = open(SF_ERROR_CODE, O_RDONLY, S_IRUSR | S_IWUSR);
+            if(fd1)
             {
-                read(fd1, buf, size-1);
-                printf("error code size=%d\n",size);
-                write(fd, buf, size-1);
-                write(fd, (UINT8 *)"\r\n", SF_STRLEN("\r\n"));
-                free(buf);
-            }
+                //size = sp5kFsFileSizeGet(fd1);
+                buf = malloc(size);
 
-            close(fd1);
+                if (buf)
+                {
+                    read(fd1, buf, size-1);
+                    printf("error code size=%d\n",size);
+                    write(fd, buf, size-1);
+                    write(fd, (UINT8 *)"\r\n", SF_STRLEN("\r\n"));
+                    free(buf);
+                }
+
+                close(fd1);
+            }
         }
 
         szTmpsize=SF_STRLEN(cfgTmp);
@@ -1881,6 +1881,30 @@ UINT8 sf_save_sd_log(void)
     return ret;
 }
 
+/*************************************************
+  Function:    sf_log_error_code
+  Description: save error code
+  Input:  error code
+  Output: N/A
+  Return: N/A
+  Others: N/A
+*************************************************/
+void sf_log_error_code(char* buff)
+{
+    UINT32 fd = 0;
+
+    if(sf_in_card_exist())
+    {
+        fd = open(SF_ERROR_CODE, O_WRONLY | O_CREAT);
+        if(fd)
+        {
+            lseek(fd, 0, SEEK_END);
+            write(fd, buff, strlen(buff));
+            close(fd);
+            system("sync");
+        }
+    }
+}
 #ifdef __cplusplus
 #if __cplusplus
 }
diff --git a/code/application/source/sf_app/code/source/sf_blue/src/sf_blue_hal.c b/code/application/source/sf_app/code/source/sf_blue/src/sf_blue_hal.c
index b9505fae9..c65baae4b 100644
--- a/code/application/source/sf_app/code/source/sf_blue/src/sf_blue_hal.c
+++ b/code/application/source/sf_app/code/source/sf_blue/src/sf_blue_hal.c
@@ -170,7 +170,7 @@ static void *sf_bluetooth_piscan_task(void *arg)
     
     system("dbus-daemon --system");
     usleep(200 * 1000);
-    system("bluetoothd -d -n -C &");
+    system("bluetoothd -n -C &");
     for (i = 0; i < 40; i++) {
         if (access("/tmp/blue_status_ready", F_OK) == 0) {
             printf("blue status ready\r\n");
diff --git a/code/application/source/sf_app/code/source/systemMng/sf_commu_mcu_reg.c b/code/application/source/sf_app/code/source/systemMng/sf_commu_mcu_reg.c
index 38036be30..7834cd807 100755
--- a/code/application/source/sf_app/code/source/systemMng/sf_commu_mcu_reg.c
+++ b/code/application/source/sf_app/code/source/systemMng/sf_commu_mcu_reg.c
@@ -1250,11 +1250,16 @@ void sf_set_sim_insert(INT32 sim)
 }
 void sf_set_gps_status(const short status)
 {
+    static short ModeFlag = -1;
     SF_MESSAGE_BUF_S stMessageBuf = {0};
-    stMessageBuf.arg2 = status;
-    stMessageBuf.arg1 = SF_PARA_CMD_GPS_STATUS;
-    stMessageBuf.cmdId = CMD_PARA;
-    sf_com_message_send_to_cardv(&stMessageBuf);
+    if(ModeFlag != status)
+    {
+        ModeFlag = status;
+        stMessageBuf.arg2 = status;
+        stMessageBuf.arg1 = SF_PARA_CMD_GPS_STATUS;
+        stMessageBuf.cmdId = CMD_PARA;
+        sf_com_message_send_to_cardv(&stMessageBuf);
+    }
 }
 void sf_set_usb_init(int flag)
 {
diff --git a/code/application/source/sf_app/code/source/wifi/sf_wifi_svr.c b/code/application/source/sf_app/code/source/wifi/sf_wifi_svr.c
index b0f1e1125..0924259d5 100755
--- a/code/application/source/sf_app/code/source/wifi/sf_wifi_svr.c
+++ b/code/application/source/sf_app/code/source/wifi/sf_wifi_svr.c
@@ -1400,28 +1400,28 @@ SINT32 sf_svr_packet_proc(SINT32 fd, UINT8  *pAppData, UINT16 dataLen)
 							{
 								puiPara->CamMode = SF_CAM_MODE_PHOTO;
 							}
-                            
-                            int iCurrMode = System_GetState(SYS_STATE_CURRMODE);
-                            int iNextMode = PRIMARY_MODE_PHOTO;
 
-                            if((puiPara->CamMode == SF_CAM_MODE_PHOTO) || (puiPara->CamMode == SF_CAM_MODE_PHOTO_VIDEO) || (puiPara->CamMode == SF_CAM_MODE_VIDEO2))
-                            {
-                                iNextMode = PRIMARY_MODE_PHOTO;
-                            }
-                            else if(puiPara->CamMode == SF_CAM_MODE_VIDEO)
-                            {
-                                iNextMode = PRIMARY_MODE_MOVIE;
-                            }
-                            else
-                            {
-                                iNextMode = PRIMARY_MODE_PHOTO;
-                            }
-                            if(iNextMode != iCurrMode)
-                            {
-                        		UI_SetData(FL_PreMode, iCurrMode);
-                        		UI_SetData(FL_NextMode, iNextMode);
-                        		Ux_PostEvent(NVTEVT_SYSTEM_MODE, 1, iNextMode);
-                            }
+                            // int iCurrMode = System_GetState(SYS_STATE_CURRMODE);
+                            // int iNextMode = PRIMARY_MODE_PHOTO;
+
+                            // if((puiPara->CamMode == SF_CAM_MODE_PHOTO) || (puiPara->CamMode == SF_CAM_MODE_PHOTO_VIDEO) || (puiPara->CamMode == SF_CAM_MODE_VIDEO2))
+                            // {
+                            //     iNextMode = PRIMARY_MODE_PHOTO;
+                            // }
+                            // else if(puiPara->CamMode == SF_CAM_MODE_VIDEO)
+                            // {
+                            //     iNextMode = PRIMARY_MODE_MOVIE;
+                            // }
+                            // else
+                            // {
+                            //     iNextMode = PRIMARY_MODE_PHOTO;
+                            // }
+                            // if((iNextMode != iCurrMode) && ((TRUE != sf_is_preview())))
+                            // {
+                        	// 	UI_SetData(FL_PreMode, iCurrMode);
+                        	// 	UI_SetData(FL_NextMode, iNextMode);
+                        	// 	Ux_PostEvent(NVTEVT_SYSTEM_MODE, 1, iNextMode);
+                            // }
                             
                     		Save_MenuInfo();
                             //sf_set_cam_mode(puiPara->CamMode);
diff --git a/code/lib/source/sifar/code/source/common/sf_common.c b/code/lib/source/sifar/code/source/common/sf_common.c
index 2b63c91ca..8cce8ce65 100755
--- a/code/lib/source/sifar/code/source/common/sf_common.c
+++ b/code/lib/source/sifar/code/source/common/sf_common.c
@@ -3410,6 +3410,7 @@ UINT8 sf_get_net_generation(void)
 
 void sf_set_net_generation(UINT8 value)
 {
+    //MLOGI("netGeneration:%d value:%d\n",netGeneration, value);
 	if((value >= SF_NET_NO) && (value <= SF_NET_4G))
 	{
 		netGeneration = value;
diff --git a/loader/Project/Model/Loader565_Data/Release/LD98565A.bin b/loader/Project/Model/Loader565_Data/Release/LD98565A.bin
index 996880349..30d3e9869 100755
Binary files a/loader/Project/Model/Loader565_Data/Release/LD98565A.bin and b/loader/Project/Model/Loader565_Data/Release/LD98565A.bin differ
diff --git a/loader/Project/Model/Loader565_Data/Release/Loader565.axf b/loader/Project/Model/Loader565_Data/Release/Loader565.axf
index 5ce3f205d..d21d95bd5 100755
Binary files a/loader/Project/Model/Loader565_Data/Release/Loader565.axf and b/loader/Project/Model/Loader565_Data/Release/Loader565.axf differ
diff --git a/loader/Project/Model/Loader565_Data/Release/Loader565.sym b/loader/Project/Model/Loader565_Data/Release/Loader565.sym
index 2111672ba..30aec962a 100644
--- a/loader/Project/Model/Loader565_Data/Release/Loader565.sym
+++ b/loader/Project/Model/Loader565_Data/Release/Loader565.sym
@@ -6,237 +6,240 @@
 01000000 T _loader_exec_compres_start
 01000000 t prj_isFastbootKeyPressed
 01000010 t prj_checkCardExist
-01000024 t prj_isSpecialKeyPressed
-010000ec T debug_disable_msg
-010000f8 T prj_main
-010001f8 T gpio_getPin
-01000220 T Dec2HexStr
-01000258 T Dec2HexStr2Bytes
-010002b8 T utl_memset
-01000312 T utl_memcpy
-01000388 T strlen
-0100039c T strnlen
-010003b6 T strncpy
-010003d2 T strncmp
-010003f6 T strchr
-01000412 T memcmp
-01000432 T strcmp
-0100044c T memchr
-010004e0 t bl_decompress_rtos
-01000508 t bl_get_partition_fdt_offset.part.1
-01000564 t bl_load_rtos_from_non_nvtpack.isra.4.constprop.14
-01000650 t bl_get_fdt_nvt_memory_cfg_property.constprop.16
-010006bc t bl_get_fdt_cfg
-01000818 t bl_update_loader_flag
-010008d8 t bl_entry_boot
-0100096c t bl_boot_teeos
-010009b4 t bl_get_fdt_partition_property
-01000a04 t bl_get_partition
-01000b00 t bl_load_uboot_from_flash
-01000cb4 T bl_flash_open
-01000d3c T bl_chk_valid_all_in_one
-01000d60 T bl_chk_fdt
-01000e34 T bl_chk_uboot
-01000e5c t bl_load_uboot_from_all_in_one
-01000f80 T bl_copy_fdt_to_fdt_addr
-01000fc8 t bl_load_fdt_from_flash.constprop.10
-01001068 T bl_boot_uboot
-0100115c T bl_process_all_in_one
-0100140c T bl_read_rtos_addr
-0100142c T bl_mainFlow
-01001f4c T loader_setUpdateFwName
-01001f60 T loader_setUpdateLdrName
-01001f74 T loader_setRunFwName
-01001f88 T loader_setVersion
-01001f98 T loader_installSpecialKeyCB
-01001fa8 T loader_installCardDetectCB
-01001fb8 T loader_installFastbootKeyCB
-01001fc8 T loader_setStorageIntType
-01001fdc t nvtpack_get_uitron_offset
-01002050 T nvtpack_calc_nvt_sum
-01002074 T nvtpack_getver
-010020fc T nvtpack_verify
-010021ec T nvtpack_get_partition
-010022cc t cpu_l2_cache_wait_sync_done
-010022e0 T cpu_invalidateDCacheBlock
-01002334 T cpu_cleanDCacheBlock
-01002378 T cpu_cleanInvalidateDCache
-01002398 T CPUflushReadCache
-010023d6 T CPUflushWriteCache
-01002400 T fdt_check_header
-01002450 T fdt_offset_ptr
-01002480 T fdt_next_tag
-0100252c T _fdt_check_node_offset
-01002554 T _fdt_check_prop_offset
-0100257c T fdt_next_node
-010025f0 T fdt_first_subnode
-0100261e T fdt_next_subnode
-01002654 t _fdt_offset_ptr
-01002670 t _fdt_mem_rsv
-0100268c t _nextprop
-010026c4 T fdt_string
-010026d2 T fdt_num_mem_rsv
-010026f8 T fdt_subnode_offset_namelen
-01002780 T fdt_subnode_offset
-0100279e T fdt_get_name
-010027e0 T fdt_first_property_offset
-010027f8 T fdt_next_property_offset
-01002810 T fdt_get_property_by_offset
-01002840 T fdt_get_property_namelen
-010028b4 T fdt_get_property
-010028e0 T fdt_getprop_namelen
-010028f8 T fdt_getprop_by_offset
-01002920 T fdt_getprop
-0100294c T fdt_get_alias_namelen
-0100297c T fdt_path_offset
-01002a0c T fdt_check_full
-01002ad8 t SMHostSendCommand
-01002af4 t flash_close
-01002b2c t flash_getBlockSize
-01002b36 t flash_setReservedAreaMaxBlockNumber
-01002b3c t flash_getTotalSize
-01002b4c t flash_installAccessCB
-01002b5c t flash_installIdentifyCB
-01002b6c t flash_setConfig
-01002b88 t flash_setFrequency
-01002c08 t SMHostGetStatus.constprop.3
-01002c24 t spiflash_getStatus
-01002c68 t spiflash_waitReady
-01002cac t spi_nor_send_cmd
-01002cd8 t spiflash_enableWriteLatch
-01002ce4 t sm_card_host_setup_address_cycle.constprop.5
-01002cfc t spiFlash_eraseSector
-01002d60 t spiflash_setStatus
-01002da4 t flash_setReservedBadBlockNumber
-01002dac t flash_open
-01003104 t flash_readSectors
-010033d4 t spiFlash_write
-0100360c t flash_writePartition
-01003634 t flash_writeSectors
-01003648 T nor_get_storage_object
-0100365c t SDHostGetStatus
-01003684 t SDHostDataCommand
-0100372c t SDHostSimpleCommand
-010037ac t CardReadSector
-0100386c T card_open
-01003ad0 T card_close
-01003af0 T card_get_type
-01003af8 T dma_get_dram_capacity
-01003b20 T quary_secure_boot
-01003b5c t fat_getclusterstatus
-01003c80 t fat_getnextcluster
-01003db8 t fat_getmaxclusternumber
-01003de4 t fat_getnextdir_entry
-01003e1c t fat_getfirstdir_entry
-01003e44 t fat_getdir_sectornumber
-01003e74 T fat_regfilesystem
-01003e98 T fat_internal_mount_partition
-01004200 T fat_internal_initFAT
-0100429c T fat_internal_open_rootfile
-01004540 T fat_internal_read_rootfile
-010045dc T fat_internal_close_rootfile
-010045fc T fat_initFAT
-01004614 T fat_open_rootfile
-0100462c T fat_read_rootfile
-01004644 T fat_close_rootfile
-01004658 T atoi
-01004684 T __aeabi_uidiv
-01004684 T __udivsi3
-01004684 t .udivsi3_skip_div0_test
-01004870 T __aeabi_uidivmod
-01004890 T __aeabi_idiv
-01004890 T __divsi3
-01004898 t .divsi3_skip_div0_test
-01004ab0 T __aeabi_idivmod
-01004ad0 W __aeabi_idiv0
-01004ad0 W __aeabi_ldiv0
-01004ad4 T __aeabi_uldivmod
-01004b10 T __popcountsi2
-01004b58 T __udivmoddi4
-01004c80 t __debug_err_var_veneer
-01004c88 t __rom_efuse_read_from_thumb
-01004c90 t __fLib_PutSerialChar_veneer
-01004c98 t __utl_get_bootsrc_veneer
-01004ca0 t __CPUInvalidateICacheAll_veneer
-01004ca8 t __debug_err_veneer
-01004cb0 t __debug_msg_var_from_arm
-01004cb8 t __rom_LZ_Uncompress_from_thumb
-01004cc0 t __UTL_getDrvTmpBufferAddress_from_thumb
-01004cc8 t __set_usb_suspend_veneer
-01004cd0 t __fLib_PutSerialStr_veneer
-01004cd8 t __UTL_setDrvTmpBufferAddress_from_thumb
-01004ce0 t __utl_is_sram_fw_from_thumb
-01004ce8 t __cpu_cleanInvalidateDCacheAll_veneer
-01004cf0 t __timer_delay_veneer
-01004cf8 t __debug_msg_veneer
-01004d00 T _loader_exec_compres_end
-01005834 r GUID_FW2
-01005844 r GUID_FW
-01005854 r GUID_RES
-01005ae0 T load_dram_scan
-01005ae0 T _loader_dram_text_start_base
-01005b40 t __debug_msg_veneer
-01005b48 D _image_general_var_base
-01005b48 D _loader_data_start_base
-01005b48 D _load_general_var_base
-01005b48 d ota_sts.4474
-01005b4c d nodeoffset.5194
-01005b50 d nodeoffset_nvt_memory_cfg.5117
-01005b54 d RWErrorMsg
-01005b64 d g_uiStartBlkUpdateFW
-01005b68 d UPDATE_LOADER_NAME
-01005b75 d UPDATE_FW_NAME
-01005b82 d RUN_FW_NAME
-01005b8f d LoaderErrorMsg
-01005ba5 d FWErrorMsg
-01005bb7 d RECOVERY_FW_NAME
-01005bc4 d guiSpiClkDiv
-01005bc8 D spi_nor
-01005c00 d uiBufAddr
-01005c04 D _image_general_var_limit
-01005c40 B gStr
-01005c40 B _image_general_zi_zi_base
-01005c50 b gStorageIntType
-01005c54 b g_dram_partition
-01005cd4 b g_uiVersion
-01005cd8 B int_strg_obj
-01005ce0 b g_emb_uboot
-01005d00 B rom_lzma_inflate
-01005d04 b g_is_flash_open
-01005d08 b g_emb_teeos
-01005d28 b g_rtos_load_addr
-01005d2c b g_rtos_target_addr
-01005d30 b g_rtos_size
-01005d38 b g_emb_rtos
-01005d58 b g_emb_sys
-01005d78 b gRecoveryTriggerCallBack
-01005d7c b gSpecialKeyCallBack
-01005d80 b gCardDetectCallBack
-01005d84 b gFastbootKeyCallBack
-01005d88 B BaseOfStack
-01005d8c B TopOfStack
-01005d90 B lzma_temp_buffer
-01015d90 b uiSpiFlashSize
-01015d94 b gSpiProgramCallBack
-01015d98 b gSpiIdentifyCallBack
-01015d9c b bQuadConfigured
-01015da0 b uiQuadReadType
-01015da4 b bSupportEWSR
-01015da5 b bDualRead
-01015da8 b b_support_RDCR
-01015dac b bQuadEnabled
-01015db0 b SDContext
-01015dc0 b FileSys
-01015f80 b vBitMapBuf
-01016780 b ui32FATPages
-01016784 b RootFileHandle
-010167c0 b TempBuf
-010169c0 b uiBufSize
-010169c4 b dbg_count
-010169c8 b gFatAccessCallBack
-01016a00 b vFatBuf
-01036a00 B emuCommonBuf
-01036a14 B currentPtr
+01000024 t prj_issfSpecialKeyPressed
+01000050 t prj_isSpecialKeyPressed
+01000118 T debug_disable_msg
+01000124 T prj_main
+01000230 T gpio_getPin
+01000258 T Dec2HexStr
+01000290 T Dec2HexStr2Bytes
+010002f0 T utl_memset
+0100034a T utl_memcpy
+010003c0 T strlen
+010003d4 T strnlen
+010003ee T strncpy
+0100040a T strncmp
+0100042e T strchr
+0100044a T memcmp
+0100046a T strcmp
+01000484 T memchr
+01000518 t bl_decompress_rtos
+01000540 t bl_get_partition_fdt_offset.part.1
+0100059c t bl_load_rtos_from_non_nvtpack.isra.4.constprop.14
+01000688 t bl_get_fdt_nvt_memory_cfg_property.constprop.16
+010006f4 t bl_get_fdt_cfg
+01000850 t bl_update_loader_flag
+01000910 t bl_entry_boot
+010009a4 t bl_boot_teeos
+010009ec t bl_get_fdt_partition_property
+01000a3c t bl_get_partition
+01000b38 t bl_load_uboot_from_flash
+01000cec T bl_flash_open
+01000d74 T bl_chk_valid_all_in_one
+01000d98 T bl_chk_fdt
+01000e6c T bl_chk_uboot
+01000e94 t bl_load_uboot_from_all_in_one
+01000fb8 T bl_copy_fdt_to_fdt_addr
+01001000 t bl_load_fdt_from_flash.constprop.10
+010010a0 T bl_boot_uboot
+01001194 T bl_process_all_in_one
+01001444 T bl_read_rtos_addr
+01001464 T bl_mainFlow
+01001f9c T loader_setUpdateFwName
+01001fb0 T loader_setUpdateLdrName
+01001fc4 T loader_setRunFwName
+01001fd8 T loader_setVersion
+01001fe8 T loader_installSpecialKeyCB
+01001ff8 T loader_installsfSpecialKeyCB
+01002008 T loader_installCardDetectCB
+01002018 T loader_installFastbootKeyCB
+01002028 T loader_setStorageIntType
+0100203c t nvtpack_get_uitron_offset
+010020b0 T nvtpack_calc_nvt_sum
+010020d4 T nvtpack_getver
+0100215c T nvtpack_verify
+0100224c T nvtpack_get_partition
+0100232c t cpu_l2_cache_wait_sync_done
+01002340 T cpu_invalidateDCacheBlock
+01002394 T cpu_cleanDCacheBlock
+010023d8 T cpu_cleanInvalidateDCache
+010023f8 T CPUflushReadCache
+01002436 T CPUflushWriteCache
+01002460 T fdt_check_header
+010024b0 T fdt_offset_ptr
+010024e0 T fdt_next_tag
+0100258c T _fdt_check_node_offset
+010025b4 T _fdt_check_prop_offset
+010025dc T fdt_next_node
+01002650 T fdt_first_subnode
+0100267e T fdt_next_subnode
+010026b4 t _fdt_offset_ptr
+010026d0 t _fdt_mem_rsv
+010026ec t _nextprop
+01002724 T fdt_string
+01002732 T fdt_num_mem_rsv
+01002758 T fdt_subnode_offset_namelen
+010027e0 T fdt_subnode_offset
+010027fe T fdt_get_name
+01002840 T fdt_first_property_offset
+01002858 T fdt_next_property_offset
+01002870 T fdt_get_property_by_offset
+010028a0 T fdt_get_property_namelen
+01002914 T fdt_get_property
+01002940 T fdt_getprop_namelen
+01002958 T fdt_getprop_by_offset
+01002980 T fdt_getprop
+010029ac T fdt_get_alias_namelen
+010029dc T fdt_path_offset
+01002a6c T fdt_check_full
+01002b38 t SMHostSendCommand
+01002b54 t flash_close
+01002b8c t flash_getBlockSize
+01002b96 t flash_setReservedAreaMaxBlockNumber
+01002b9c t flash_getTotalSize
+01002bac t flash_installAccessCB
+01002bbc t flash_installIdentifyCB
+01002bcc t flash_setConfig
+01002be8 t flash_setFrequency
+01002c68 t SMHostGetStatus.constprop.3
+01002c84 t spiflash_getStatus
+01002cc8 t spiflash_waitReady
+01002d0c t spi_nor_send_cmd
+01002d38 t spiflash_enableWriteLatch
+01002d44 t sm_card_host_setup_address_cycle.constprop.5
+01002d5c t spiFlash_eraseSector
+01002dc0 t spiflash_setStatus
+01002e04 t flash_setReservedBadBlockNumber
+01002e0c t flash_open
+01003164 t flash_readSectors
+01003434 t spiFlash_write
+0100366c t flash_writePartition
+01003694 t flash_writeSectors
+010036a8 T nor_get_storage_object
+010036bc t SDHostGetStatus
+010036e4 t SDHostDataCommand
+0100378c t SDHostSimpleCommand
+0100380c t CardReadSector
+010038cc T card_open
+01003b30 T card_close
+01003b50 T card_get_type
+01003b58 T dma_get_dram_capacity
+01003b80 T quary_secure_boot
+01003bbc t fat_getclusterstatus
+01003ce0 t fat_getnextcluster
+01003e18 t fat_getmaxclusternumber
+01003e44 t fat_getnextdir_entry
+01003e7c t fat_getfirstdir_entry
+01003ea4 t fat_getdir_sectornumber
+01003ed4 T fat_regfilesystem
+01003ef8 T fat_internal_mount_partition
+01004260 T fat_internal_initFAT
+010042fc T fat_internal_open_rootfile
+010045a0 T fat_internal_read_rootfile
+0100463c T fat_internal_close_rootfile
+0100465c T fat_initFAT
+01004674 T fat_open_rootfile
+0100468c T fat_read_rootfile
+010046a4 T fat_close_rootfile
+010046b8 T atoi
+010046e4 T __aeabi_uidiv
+010046e4 T __udivsi3
+010046e4 t .udivsi3_skip_div0_test
+010048d0 T __aeabi_uidivmod
+010048f0 T __aeabi_idiv
+010048f0 T __divsi3
+010048f8 t .divsi3_skip_div0_test
+01004b10 T __aeabi_idivmod
+01004b30 W __aeabi_idiv0
+01004b30 W __aeabi_ldiv0
+01004b34 T __aeabi_uldivmod
+01004b70 T __popcountsi2
+01004bb8 T __udivmoddi4
+01004ce0 t __debug_err_var_veneer
+01004ce8 t __rom_efuse_read_from_thumb
+01004cf0 t __cpu_cleanInvalidateDCacheAll_veneer
+01004cf8 t __debug_msg_var_from_arm
+01004d00 t __CPUInvalidateICacheAll_veneer
+01004d08 t __debug_msg_veneer
+01004d10 t __rom_LZ_Uncompress_from_thumb
+01004d18 t __utl_is_sram_fw_from_thumb
+01004d20 t __set_usb_suspend_veneer
+01004d28 t __utl_get_bootsrc_veneer
+01004d30 t __debug_err_veneer
+01004d38 t __UTL_getDrvTmpBufferAddress_from_thumb
+01004d40 t __timer_delay_veneer
+01004d48 t __fLib_PutSerialStr_veneer
+01004d50 t __UTL_setDrvTmpBufferAddress_from_thumb
+01004d58 t __fLib_PutSerialChar_veneer
+01004d60 T _loader_exec_compres_end
+01005894 r GUID_FW2
+010058a4 r GUID_FW
+010058b4 r GUID_RES
+01005b40 T load_dram_scan
+01005b40 T _loader_dram_text_start_base
+01005ba0 t __debug_msg_veneer
+01005ba8 D _image_general_var_base
+01005ba8 D _loader_data_start_base
+01005ba8 D _load_general_var_base
+01005ba8 d ota_sts.4476
+01005bac d nodeoffset.5197
+01005bb0 d nodeoffset_nvt_memory_cfg.5120
+01005bb4 d RWErrorMsg
+01005bc4 d g_uiStartBlkUpdateFW
+01005bc8 d UPDATE_LOADER_NAME
+01005bd5 d UPDATE_FW_NAME
+01005be2 d RUN_FW_NAME
+01005bef d LoaderErrorMsg
+01005c05 d FWErrorMsg
+01005c17 d RECOVERY_FW_NAME
+01005c24 d guiSpiClkDiv
+01005c28 D spi_nor
+01005c60 d uiBufAddr
+01005c64 D _image_general_var_limit
+01005c80 B gStr
+01005c80 B _image_general_zi_zi_base
+01005c90 b gStorageIntType
+01005c94 b g_dram_partition
+01005d14 b g_uiVersion
+01005d18 B int_strg_obj
+01005d20 b g_emb_uboot
+01005d40 B rom_lzma_inflate
+01005d44 b g_is_flash_open
+01005d48 b g_emb_teeos
+01005d68 b g_rtos_load_addr
+01005d6c b g_rtos_target_addr
+01005d70 b g_rtos_size
+01005d78 b g_emb_rtos
+01005d98 b gsfSpecialKeyCallBack
+01005da0 b g_emb_sys
+01005dc0 b gRecoveryTriggerCallBack
+01005dc4 b gSpecialKeyCallBack
+01005dc8 b gCardDetectCallBack
+01005dcc b gFastbootKeyCallBack
+01005dd0 B BaseOfStack
+01005dd4 B TopOfStack
+01005dd8 B lzma_temp_buffer
+01015dd8 b uiSpiFlashSize
+01015ddc b gSpiProgramCallBack
+01015de0 b gSpiIdentifyCallBack
+01015de4 b bQuadConfigured
+01015de8 b uiQuadReadType
+01015dec b bSupportEWSR
+01015ded b bDualRead
+01015df0 b b_support_RDCR
+01015df4 b bQuadEnabled
+01015df8 b SDContext
+01015e00 b FileSys
+01015fc0 b vBitMapBuf
+010167c0 b ui32FATPages
+010167c4 b RootFileHandle
+01016800 b TempBuf
+01016a00 b uiBufSize
+01016a04 b dbg_count
+01016a08 b gFatAccessCallBack
+01016a40 b vFatBuf
+01036a40 B emuCommonBuf
+01036a54 B currentPtr
 01038000 B _ttb
 0103c000 B _ttb_lv2
 0103c400 A __common_base
@@ -371,10 +374,10 @@ f07c2450 T fLib_PutSerialChar
 f07c246c T fLib_PutSerialStr
 f07c2480 T debug_msg
 f07c248a T debug_msg_var
-f07c24b8 t __CPUflushReadCache_veneer
-f07c24c0 t __bl_mainFlow_veneer
+f07c24b8 t __bl_mainFlow_veneer
+f07c24c0 t __CPUflushReadCache_veneer
 f07c24c8 t __bl_read_rtos_addr_veneer
 f07c24d0 t __Dec2HexStr_veneer
 f07c24d8 A _loader_exec_compress_load_cpu_addr
 f07c24d8 T _loader_exec_end_base
-f07c7fb8 A _loader_dram_text_cpu_addr
+f07c8018 A _loader_dram_text_cpu_addr
diff --git a/loader/Project/Model/Loader565_Data/Release/Loader565.txt b/loader/Project/Model/Loader565_Data/Release/Loader565.txt
index 1f105ca5e..a9a825527 100644
--- a/loader/Project/Model/Loader565_Data/Release/Loader565.txt
+++ b/loader/Project/Model/Loader565_Data/Release/Loader565.txt
@@ -6,14 +6,14 @@ EXEC_P, HAS_SYMS, D_PAGED
 start address 0xf07c0028
 
 Program Header:
-0x70000001 off    0x00024d00 vaddr 0x01004d00 paddr 0x000071d8 align 2**2
+0x70000001 off    0x00024d60 vaddr 0x01004d60 paddr 0x00007238 align 2**2
          filesz 0x00000008 memsz 0x00000008 flags r--
     LOAD off    0x00010000 vaddr 0xf07c0000 paddr 0x00000000 align 2**16
          filesz 0x000024d8 memsz 0x000024d8 flags rwx
     LOAD off    0x00020000 vaddr 0x01000000 paddr 0x000024d8 align 2**16
-         filesz 0x00005c08 memsz 0x00005c08 flags rwx
-    LOAD off    0x00025c40 vaddr 0x01005c40 paddr 0x00008140 align 2**16
-         filesz 0x00000000 memsz 0x001767c0 flags rw-
+         filesz 0x00005c68 memsz 0x00005c68 flags rwx
+    LOAD off    0x00025c80 vaddr 0x01005c80 paddr 0x00008180 align 2**16
+         filesz 0x00000000 memsz 0x00176780 flags rw-
 private flags = 5000200: [Version5 EABI] [soft-float ABI]
 
 Sections:
@@ -30,39 +30,39 @@ Idx Name          Size      VMA       LMA       File off  Algn
                   CONTENTS, ALLOC, LOAD, READONLY, CODE
   5 .LOADER_EXEC  00000388  f07c2150  00002150  00012150  2**3
                   CONTENTS, ALLOC, LOAD, READONLY, CODE
-  6 .text         00004d00  01000000  000024d8  00020000  2**3
+  6 .text         00004d60  01000000  000024d8  00020000  2**3
                   CONTENTS, ALLOC, LOAD, READONLY, CODE
-  7 .ARM.exidx    00000008  01004d00  000071d8  00024d00  2**2
+  7 .ARM.exidx    00000008  01004d60  00007238  00024d60  2**2
                   CONTENTS, ALLOC, LOAD, READONLY, DATA
-  8 .rodata       00000dd8  01004d08  000071e0  00024d08  2**2
+  8 .rodata       00000dd8  01004d68  00007240  00024d68  2**2
                   CONTENTS, ALLOC, LOAD, READONLY, DATA
-  9 .dram_text    00000068  01005ae0  00007fb8  00025ae0  2**3
+  9 .dram_text    00000068  01005b40  00008018  00025b40  2**3
                   CONTENTS, ALLOC, LOAD, READONLY, CODE
- 10 .data         000000bc  01005b48  00008020  00025b48  2**2
+ 10 .data         000000bc  01005ba8  00008080  00025ba8  2**2
                   CONTENTS, ALLOC, LOAD, DATA
- 11 .dummy        00000004  01005c04  000080dc  00025c04  2**0
+ 11 .dummy        00000004  01005c64  0000813c  00025c64  2**0
                   CONTENTS, ALLOC, LOAD, DATA
- 12 .bss          000367c0  01005c40  00008140  00025c40  2**6
+ 12 .bss          00036780  01005c80  00008180  00025c80  2**6
                   ALLOC
- 13 .loader_heap  00140000  0103c400  0003e900  00025c40  2**0
+ 13 .loader_heap  00140000  0103c400  0003e900  00025c80  2**0
                   ALLOC
- 14 .comment      00000074  00000000  00000000  00025c08  2**0
+ 14 .comment      00000074  00000000  00000000  00025c68  2**0
                   CONTENTS, READONLY
- 15 .ARM.attributes 00000037  00000000  00000000  00025c7c  2**0
+ 15 .ARM.attributes 00000037  00000000  00000000  00025cdc  2**0
                   CONTENTS, READONLY
- 16 .debug_frame  000000c0  00000000  00000000  00025cb4  2**2
+ 16 .debug_frame  000000c0  00000000  00000000  00025d14  2**2
                   CONTENTS, READONLY, DEBUGGING
- 17 .debug_line   00000d87  00000000  00000000  00025d74  2**0
+ 17 .debug_line   00000d87  00000000  00000000  00025dd4  2**0
                   CONTENTS, READONLY, DEBUGGING
- 18 .debug_info   000029b1  00000000  00000000  00026afb  2**0
+ 18 .debug_info   000029b1  00000000  00000000  00026b5b  2**0
                   CONTENTS, READONLY, DEBUGGING
- 19 .debug_abbrev 00000475  00000000  00000000  000294ac  2**0
+ 19 .debug_abbrev 00000475  00000000  00000000  0002950c  2**0
                   CONTENTS, READONLY, DEBUGGING
- 20 .debug_aranges 000000c0  00000000  00000000  00029928  2**3
+ 20 .debug_aranges 000000c0  00000000  00000000  00029988  2**3
                   CONTENTS, READONLY, DEBUGGING
- 21 .debug_loc    000001df  00000000  00000000  000299e8  2**0
+ 21 .debug_loc    000001df  00000000  00000000  00029a48  2**0
                   CONTENTS, READONLY, DEBUGGING
- 22 .debug_str    0000120b  00000000  00000000  00029bc7  2**0
+ 22 .debug_str    0000120b  00000000  00000000  00029c27  2**0
                   CONTENTS, READONLY, DEBUGGING
 SYMBOL TABLE:
 f07c0000 l    d  .BOOT_EXEC	00000000 .BOOT_EXEC
@@ -72,12 +72,12 @@ f07c0500 l    d  .LOADER_CORE2_ENTRY_PROGRAM	00000000 .LOADER_CORE2_ENTRY_PROGRA
 f07c0600 l    d  .LOADER_REMAP	00000000 .LOADER_REMAP
 f07c2150 l    d  .LOADER_EXEC	00000000 .LOADER_EXEC
 01000000 l    d  .text	00000000 .text
-01004d00 l    d  .ARM.exidx	00000000 .ARM.exidx
-01004d08 l    d  .rodata	00000000 .rodata
-01005ae0 l    d  .dram_text	00000000 .dram_text
-01005b48 l    d  .data	00000000 .data
-01005c04 l    d  .dummy	00000000 .dummy
-01005c40 l    d  .bss	00000000 .bss
+01004d60 l    d  .ARM.exidx	00000000 .ARM.exidx
+01004d68 l    d  .rodata	00000000 .rodata
+01005b40 l    d  .dram_text	00000000 .dram_text
+01005ba8 l    d  .data	00000000 .data
+01005c64 l    d  .dummy	00000000 .dummy
+01005c80 l    d  .bss	00000000 .bss
 0103c400 l    d  .loader_heap	00000000 .loader_heap
 00000000 l    d  .comment	00000000 .comment
 00000000 l    d  .ARM.attributes	00000000 .ARM.attributes
@@ -147,129 +147,131 @@ f07c1e3c l     O .LOADER_REMAP	00000004 m_console
 00000000 l    df *ABS*	00000000 rtc.c
 00000000 l    df *ABS*	00000000 Timer.c
 00000000 l    df *ABS*	00000000 Cache.c
-010022cc l     F .text	00000014 cpu_l2_cache_wait_sync_done
+0100232c l     F .text	00000014 cpu_l2_cache_wait_sync_done
 00000000 l    df *ABS*	00000000 prj_main.c
 01000000 l     F .text	00000010 prj_isFastbootKeyPressed
 01000010 l     F .text	00000012 prj_checkCardExist
-01000024 l     F .text	000000c8 prj_isSpecialKeyPressed
-01005b48 l     O .data	00000004 ota_sts.4474
+01000024 l     F .text	0000002c prj_issfSpecialKeyPressed
+01000050 l     F .text	000000c8 prj_isSpecialKeyPressed
+01005ba8 l     O .data	00000004 ota_sts.4476
 00000000 l    df *ABS*	00000000 gpio.c
 00000000 l    df *ABS*	00000000 utility.c
 00000000 l    df *ABS*	00000000 string.c
 00000000 l    df *ABS*	00000000 bl_func.c
-010004e0 l     F .text	00000026 bl_decompress_rtos
-01000508 l     F .text	0000005c bl_get_partition_fdt_offset.part.1
-01000564 l     F .text	000000ec bl_load_rtos_from_non_nvtpack.isra.4.constprop.14
-01000650 l     F .text	0000006c bl_get_fdt_nvt_memory_cfg_property.constprop.16
-010006bc l     F .text	0000015c bl_get_fdt_cfg
-01000818 l     F .text	000000c0 bl_update_loader_flag
-010008d8 l     F .text	00000094 bl_entry_boot
-0100096c l     F .text	00000048 bl_boot_teeos
-010009b4 l     F .text	00000050 bl_get_fdt_partition_property
-01000a04 l     F .text	000000fc bl_get_partition
-01000b00 l     F .text	000001b4 bl_load_uboot_from_flash
-01000e5c l     F .text	00000124 bl_load_uboot_from_all_in_one
-01000fc8 l     F .text	000000a0 bl_load_fdt_from_flash.constprop.10
-01005b4c l     O .data	00000004 nodeoffset.5194
-01005b50 l     O .data	00000004 nodeoffset_nvt_memory_cfg.5117
-01005b54 l     O .data	0000000e RWErrorMsg
-01005b64 l     O .data	00000004 g_uiStartBlkUpdateFW
-01005b68 l     O .data	0000000d UPDATE_LOADER_NAME
-01005b75 l     O .data	0000000d UPDATE_FW_NAME
-01005b82 l     O .data	0000000d RUN_FW_NAME
-01005b8f l     O .data	00000016 LoaderErrorMsg
-01005ba5 l     O .data	00000012 FWErrorMsg
-01005bb7 l     O .data	0000000d RECOVERY_FW_NAME
-01005c50 l     O .bss	00000001 gStorageIntType
-01005c54 l     O .bss	00000080 g_dram_partition
-01005cd4 l     O .bss	00000004 g_uiVersion
-01005ce0 l     O .bss	00000020 g_emb_uboot
-01005d04 l     O .bss	00000001 g_is_flash_open
-01005d08 l     O .bss	00000020 g_emb_teeos
-01005d28 l     O .bss	00000004 g_rtos_load_addr
-01005d2c l     O .bss	00000004 g_rtos_target_addr
-01005d30 l     O .bss	00000004 g_rtos_size
-01005d38 l     O .bss	00000020 g_emb_rtos
-01005d58 l     O .bss	00000020 g_emb_sys
-01005d78 l     O .bss	00000004 gRecoveryTriggerCallBack
-01005d7c l     O .bss	00000004 gSpecialKeyCallBack
-01005d80 l     O .bss	00000004 gCardDetectCallBack
-01005d84 l     O .bss	00000004 gFastbootKeyCallBack
+01000518 l     F .text	00000026 bl_decompress_rtos
+01000540 l     F .text	0000005c bl_get_partition_fdt_offset.part.1
+0100059c l     F .text	000000ec bl_load_rtos_from_non_nvtpack.isra.4.constprop.14
+01000688 l     F .text	0000006c bl_get_fdt_nvt_memory_cfg_property.constprop.16
+010006f4 l     F .text	0000015c bl_get_fdt_cfg
+01000850 l     F .text	000000c0 bl_update_loader_flag
+01000910 l     F .text	00000094 bl_entry_boot
+010009a4 l     F .text	00000048 bl_boot_teeos
+010009ec l     F .text	00000050 bl_get_fdt_partition_property
+01000a3c l     F .text	000000fc bl_get_partition
+01000b38 l     F .text	000001b4 bl_load_uboot_from_flash
+01000e94 l     F .text	00000124 bl_load_uboot_from_all_in_one
+01001000 l     F .text	000000a0 bl_load_fdt_from_flash.constprop.10
+01005bac l     O .data	00000004 nodeoffset.5197
+01005bb0 l     O .data	00000004 nodeoffset_nvt_memory_cfg.5120
+01005bb4 l     O .data	0000000e RWErrorMsg
+01005bc4 l     O .data	00000004 g_uiStartBlkUpdateFW
+01005bc8 l     O .data	0000000d UPDATE_LOADER_NAME
+01005bd5 l     O .data	0000000d UPDATE_FW_NAME
+01005be2 l     O .data	0000000d RUN_FW_NAME
+01005bef l     O .data	00000016 LoaderErrorMsg
+01005c05 l     O .data	00000012 FWErrorMsg
+01005c17 l     O .data	0000000d RECOVERY_FW_NAME
+01005c90 l     O .bss	00000001 gStorageIntType
+01005c94 l     O .bss	00000080 g_dram_partition
+01005d14 l     O .bss	00000004 g_uiVersion
+01005d20 l     O .bss	00000020 g_emb_uboot
+01005d44 l     O .bss	00000001 g_is_flash_open
+01005d48 l     O .bss	00000020 g_emb_teeos
+01005d68 l     O .bss	00000004 g_rtos_load_addr
+01005d6c l     O .bss	00000004 g_rtos_target_addr
+01005d70 l     O .bss	00000004 g_rtos_size
+01005d78 l     O .bss	00000020 g_emb_rtos
+01005d98 l     O .bss	00000004 gsfSpecialKeyCallBack
+01005da0 l     O .bss	00000020 g_emb_sys
+01005dc0 l     O .bss	00000004 gRecoveryTriggerCallBack
+01005dc4 l     O .bss	00000004 gSpecialKeyCallBack
+01005dc8 l     O .bss	00000004 gCardDetectCallBack
+01005dcc l     O .bss	00000004 gFastbootKeyCallBack
 00000000 l    df *ABS*	00000000 nvtpack.c
-01001fdc l     F .text	00000074 nvtpack_get_uitron_offset
-01005834 l     O .rodata	00000010 GUID_FW2
-01005844 l     O .rodata	00000010 GUID_FW
-01005854 l     O .rodata	00000010 GUID_RES
+0100203c l     F .text	00000074 nvtpack_get_uitron_offset
+01005894 l     O .rodata	00000010 GUID_FW2
+010058a4 l     O .rodata	00000010 GUID_FW
+010058b4 l     O .rodata	00000010 GUID_RES
 00000000 l    df *ABS*	00000000 fdt.c
 00000000 l    df *ABS*	00000000 fdt_ro.c
-01002654 l     F .text	0000001c _fdt_offset_ptr
-01002670 l     F .text	0000001c _fdt_mem_rsv
-0100268c l     F .text	00000038 _nextprop
+010026b4 l     F .text	0000001c _fdt_offset_ptr
+010026d0 l     F .text	0000001c _fdt_mem_rsv
+010026ec l     F .text	00000038 _nextprop
 00000000 l    df *ABS*	00000000 spi.c
-01002ad8 l     F .text	0000001c SMHostSendCommand
-01002af4 l     F .text	00000038 flash_close
-01002b2c l     F .text	0000000a flash_getBlockSize
-01002b36 l     F .text	00000006 flash_setReservedAreaMaxBlockNumber
-01002b3c l     F .text	00000010 flash_getTotalSize
-01002b4c l     F .text	00000010 flash_installAccessCB
-01002b5c l     F .text	00000010 flash_installIdentifyCB
-01002b6c l     F .text	0000001c flash_setConfig
-01002b88 l     F .text	00000080 flash_setFrequency
-01002c08 l     F .text	0000001c SMHostGetStatus.constprop.3
-01002c24 l     F .text	00000044 spiflash_getStatus
-01002c68 l     F .text	00000044 spiflash_waitReady
-01002cac l     F .text	0000002c spi_nor_send_cmd
-01002cd8 l     F .text	0000000c spiflash_enableWriteLatch
-01002ce4 l     F .text	00000018 sm_card_host_setup_address_cycle.constprop.5
-01002cfc l     F .text	00000064 spiFlash_eraseSector
-01002d60 l     F .text	00000044 spiflash_setStatus
-01002da4 l     F .text	00000006 flash_setReservedBadBlockNumber
-01002dac l     F .text	00000358 flash_open
-01003104 l     F .text	000002d0 flash_readSectors
-010033d4 l     F .text	00000238 spiFlash_write
-0100360c l     F .text	00000028 flash_writePartition
-01003634 l     F .text	00000012 flash_writeSectors
-01005bc4 l     O .data	00000004 guiSpiClkDiv
-01015d90 l     O .bss	00000004 uiSpiFlashSize
-01015d94 l     O .bss	00000004 gSpiProgramCallBack
-01015d98 l     O .bss	00000004 gSpiIdentifyCallBack
-01015d9c l     O .bss	00000001 bQuadConfigured
-01015da0 l     O .bss	00000004 uiQuadReadType
-01015da4 l     O .bss	00000001 bSupportEWSR
-01015da5 l     O .bss	00000001 bDualRead
-01015da8 l     O .bss	00000004 b_support_RDCR
-01015dac l     O .bss	00000001 bQuadEnabled
+01002b38 l     F .text	0000001c SMHostSendCommand
+01002b54 l     F .text	00000038 flash_close
+01002b8c l     F .text	0000000a flash_getBlockSize
+01002b96 l     F .text	00000006 flash_setReservedAreaMaxBlockNumber
+01002b9c l     F .text	00000010 flash_getTotalSize
+01002bac l     F .text	00000010 flash_installAccessCB
+01002bbc l     F .text	00000010 flash_installIdentifyCB
+01002bcc l     F .text	0000001c flash_setConfig
+01002be8 l     F .text	00000080 flash_setFrequency
+01002c68 l     F .text	0000001c SMHostGetStatus.constprop.3
+01002c84 l     F .text	00000044 spiflash_getStatus
+01002cc8 l     F .text	00000044 spiflash_waitReady
+01002d0c l     F .text	0000002c spi_nor_send_cmd
+01002d38 l     F .text	0000000c spiflash_enableWriteLatch
+01002d44 l     F .text	00000018 sm_card_host_setup_address_cycle.constprop.5
+01002d5c l     F .text	00000064 spiFlash_eraseSector
+01002dc0 l     F .text	00000044 spiflash_setStatus
+01002e04 l     F .text	00000006 flash_setReservedBadBlockNumber
+01002e0c l     F .text	00000358 flash_open
+01003164 l     F .text	000002d0 flash_readSectors
+01003434 l     F .text	00000238 spiFlash_write
+0100366c l     F .text	00000028 flash_writePartition
+01003694 l     F .text	00000012 flash_writeSectors
+01005c24 l     O .data	00000004 guiSpiClkDiv
+01015dd8 l     O .bss	00000004 uiSpiFlashSize
+01015ddc l     O .bss	00000004 gSpiProgramCallBack
+01015de0 l     O .bss	00000004 gSpiIdentifyCallBack
+01015de4 l     O .bss	00000001 bQuadConfigured
+01015de8 l     O .bss	00000004 uiQuadReadType
+01015dec l     O .bss	00000001 bSupportEWSR
+01015ded l     O .bss	00000001 bDualRead
+01015df0 l     O .bss	00000004 b_support_RDCR
+01015df4 l     O .bss	00000001 bQuadEnabled
 00000000 l    df *ABS*	00000000 SDIO1.c
-0100365c l     F .text	00000028 SDHostGetStatus
-01003684 l     F .text	000000a8 SDHostDataCommand
-0100372c l     F .text	00000080 SDHostSimpleCommand
-010037ac l     F .text	000000c0 CardReadSector
-01015db0 l     O .bss	00000008 SDContext
+010036bc l     F .text	00000028 SDHostGetStatus
+010036e4 l     F .text	000000a8 SDHostDataCommand
+0100378c l     F .text	00000080 SDHostSimpleCommand
+0100380c l     F .text	000000c0 CardReadSector
+01015df8 l     O .bss	00000008 SDContext
 00000000 l    df *ABS*	00000000 cc.c
 00000000 l    df *ABS*	00000000 efuse.c
 00000000 l    df *ABS*	00000000 fat.c
-01003b5c l     F .text	00000124 fat_getclusterstatus
-01003c80 l     F .text	00000138 fat_getnextcluster
-01003db8 l     F .text	0000002c fat_getmaxclusternumber
-01003de4 l     F .text	00000038 fat_getnextdir_entry
-01003e1c l     F .text	00000028 fat_getfirstdir_entry
-01003e44 l     F .text	00000030 fat_getdir_sectornumber
-01016a00 l     O .bss	00020000 vFatBuf
-01005c00 l     O .data	00000004 uiBufAddr
-01015dc0 l     O .bss	00000198 FileSys
-01015f80 l     O .bss	00000800 vBitMapBuf
-01016780 l     O .bss	00000004 ui32FATPages
-01016784 l     O .bss	00000014 RootFileHandle
-010167c0 l     O .bss	00000200 TempBuf
-010169c0 l     O .bss	00000004 uiBufSize
-010169c4 l     O .bss	00000004 dbg_count
-010169c8 l     O .bss	00000004 gFatAccessCallBack
+01003bbc l     F .text	00000124 fat_getclusterstatus
+01003ce0 l     F .text	00000138 fat_getnextcluster
+01003e18 l     F .text	0000002c fat_getmaxclusternumber
+01003e44 l     F .text	00000038 fat_getnextdir_entry
+01003e7c l     F .text	00000028 fat_getfirstdir_entry
+01003ea4 l     F .text	00000030 fat_getdir_sectornumber
+01016a40 l     O .bss	00020000 vFatBuf
+01005c60 l     O .data	00000004 uiBufAddr
+01015e00 l     O .bss	00000198 FileSys
+01015fc0 l     O .bss	00000800 vBitMapBuf
+010167c0 l     O .bss	00000004 ui32FATPages
+010167c4 l     O .bss	00000014 RootFileHandle
+01016800 l     O .bss	00000200 TempBuf
+01016a00 l     O .bss	00000004 uiBufSize
+01016a04 l     O .bss	00000004 dbg_count
+01016a08 l     O .bss	00000004 gFatAccessCallBack
 00000000 l    df *ABS*	00000000 stdlib.c
 00000000 l    df *ABS*	00000000 _udivsi3.o
-01004684 l       .text	00000000 .udivsi3_skip_div0_test
+010046e4 l       .text	00000000 .udivsi3_skip_div0_test
 00000000 l       *ABS*	00000000 shift
 00000000 l    df *ABS*	00000000 _divsi3.o
-01004898 l       .text	00000000 .divsi3_skip_div0_test
+010048f8 l       .text	00000000 .divsi3_skip_div0_test
 00000000 l       *ABS*	00000000 shift
 00000000 l    df *ABS*	00000000 _dvmd_tls.o
 00000000 l    df *ABS*	00000000 _aeabi_uldivmod.o
@@ -277,238 +279,239 @@ f07c1e3c l     O .LOADER_REMAP	00000004 m_console
 00000000 l    df *ABS*	00000000 libgcc2.c
 00000000 l    df *ABS*	00000000 boot_load.c
 00000000 l    df *ABS*	00000000 
-f07c8020 l       *ABS*	00000000 _loader_data_cpu_addr
+f07c8080 l       *ABS*	00000000 _loader_data_cpu_addr
 f07c2150 l       *ABS*	00000000 _loader_exec_cpu_addr
 f07c2150 l       .LOADER_EXEC	00000000 _loader_exec_start_base
-01004c80 l     F .text	00000008 __debug_err_var_veneer
-01004c88 l     F .text	00000008 __rom_efuse_read_from_thumb
-01004c90 l     F .text	00000008 __fLib_PutSerialChar_veneer
-01004c98 l     F .text	00000008 __utl_get_bootsrc_veneer
-01004ca0 l     F .text	00000008 __CPUInvalidateICacheAll_veneer
-01004ca8 l     F .text	00000008 __debug_err_veneer
-01004cb0 l     F .text	00000008 __debug_msg_var_from_arm
-01004cb8 l     F .text	00000008 __rom_LZ_Uncompress_from_thumb
-01004cc0 l     F .text	00000008 __UTL_getDrvTmpBufferAddress_from_thumb
-01004cc8 l     F .text	00000008 __set_usb_suspend_veneer
-01004cd0 l     F .text	00000008 __fLib_PutSerialStr_veneer
-01004cd8 l     F .text	00000008 __UTL_setDrvTmpBufferAddress_from_thumb
-01004ce0 l     F .text	00000008 __utl_is_sram_fw_from_thumb
-01004ce8 l     F .text	00000008 __cpu_cleanInvalidateDCacheAll_veneer
-01004cf0 l     F .text	00000008 __timer_delay_veneer
-01004cf8 l     F .text	00000008 __debug_msg_veneer
-01005b40 l     F .dram_text	00000008 __debug_msg_veneer
-f07c24b8 l     F .LOADER_EXEC	00000008 __CPUflushReadCache_veneer
-f07c24c0 l     F .LOADER_EXEC	00000008 __bl_mainFlow_veneer
+01004ce0 l     F .text	00000008 __debug_err_var_veneer
+01004ce8 l     F .text	00000008 __rom_efuse_read_from_thumb
+01004cf0 l     F .text	00000008 __cpu_cleanInvalidateDCacheAll_veneer
+01004cf8 l     F .text	00000008 __debug_msg_var_from_arm
+01004d00 l     F .text	00000008 __CPUInvalidateICacheAll_veneer
+01004d08 l     F .text	00000008 __debug_msg_veneer
+01004d10 l     F .text	00000008 __rom_LZ_Uncompress_from_thumb
+01004d18 l     F .text	00000008 __utl_is_sram_fw_from_thumb
+01004d20 l     F .text	00000008 __set_usb_suspend_veneer
+01004d28 l     F .text	00000008 __utl_get_bootsrc_veneer
+01004d30 l     F .text	00000008 __debug_err_veneer
+01004d38 l     F .text	00000008 __UTL_getDrvTmpBufferAddress_from_thumb
+01004d40 l     F .text	00000008 __timer_delay_veneer
+01004d48 l     F .text	00000008 __fLib_PutSerialStr_veneer
+01004d50 l     F .text	00000008 __UTL_setDrvTmpBufferAddress_from_thumb
+01004d58 l     F .text	00000008 __fLib_PutSerialChar_veneer
+01005ba0 l     F .dram_text	00000008 __debug_msg_veneer
+f07c24b8 l     F .LOADER_EXEC	00000008 __bl_mainFlow_veneer
+f07c24c0 l     F .LOADER_EXEC	00000008 __CPUflushReadCache_veneer
 f07c24c8 l     F .LOADER_EXEC	00000008 __bl_read_rtos_addr_veneer
 f07c24d0 l     F .LOADER_EXEC	00000008 __Dec2HexStr_veneer
 f07c2100 l     F .LOADER_REMAP	00000008 ____popcountsi2_veneer
 f07c2108 l     F .LOADER_REMAP	00000008 __Dec2HexStr_veneer
 f07c20ec g     F .LOADER_REMAP	00000010 utl_get_chipversion
-0100462c g     F .text	00000018 fat_read_rootfile
+0100468c g     F .text	00000018 fat_read_rootfile
 f07c2068 g     F .LOADER_REMAP	00000034 utl_dram_protect_enable
 f07c2450 g     F .LOADER_EXEC	0000001c fLib_PutSerialChar
-01002450 g     F .text	0000002e fdt_offset_ptr
-01000e34 g     F .text	00000028 bl_chk_uboot
+010024b0 g     F .text	0000002e fdt_offset_ptr
+01000e6c g     F .text	00000028 bl_chk_uboot
 000000bc g       *ABS*	00000000 _loader_data_size
 f07c0d2c g     F .LOADER_REMAP	00000044 disable_rom_wdt
 f07c2308 g     F .LOADER_EXEC	00000018 timer_delay
-01003648 g     F .text	00000014 nor_get_storage_object
+010036a8 g     F .text	00000014 nor_get_storage_object
 f07c1b20 g     F .LOADER_REMAP	00000024 set_usb_suspend
-01001fa8 g     F .text	00000010 loader_installCardDetectCB
+01002008 g     F .text	00000010 loader_installCardDetectCB
 01000000 g       .text	00000000 _loader_exec_compres_start
-010028e0 g     F .text	00000018 fdt_getprop_namelen
-010027e0 g     F .text	00000018 fdt_first_property_offset
+01002940 g     F .text	00000018 fdt_getprop_namelen
+01002840 g     F .text	00000018 fdt_first_property_offset
 f07c1fc8 g     F .LOADER_REMAP	000000a0 utl_test_checksum
 f07c0b50 g       .LOADER_REMAP	00000000 _load_vector_exp_table_end_base
-010022e0 g     F .text	00000054 cpu_invalidateDCacheBlock
+01002340 g     F .text	00000054 cpu_invalidateDCacheBlock
 0103c400 g       *ABS*	00000000 __common_base
-010028b4 g     F .text	0000002c fdt_get_property
-0100297c g     F .text	0000008e fdt_path_offset
-01005d90 g     O .bss	00010000 lzma_temp_buffer
-01001f88 g     F .text	00000010 loader_setVersion
+01002914 g     F .text	0000002c fdt_get_property
+010029dc g     F .text	0000008e fdt_path_offset
+01005dd8 g     O .bss	00010000 lzma_temp_buffer
+01001fd8 g     F .text	00000010 loader_setVersion
 f07c0944 g     F .LOADER_REMAP	00000000 rom_debug_msg_err
 f07c0030 g       .LOADER_CONFIGRAM	00000000 _load_LOADER_CONFIGRAM_start_base
 f07c0300 g     O .LOADER_CONFIGRAM2	00000068 g_dma_config_setting
-01001f60 g     F .text	00000014 loader_setUpdateLdrName
+01001fb0 g     F .text	00000014 loader_setUpdateLdrName
 f07c1d48 g     F .LOADER_REMAP	00000030 uart_getChar_polling
 00000068 g       *ABS*	00000000 _loader_dram_text_size
-01003af0 g     F .text	00000008 card_get_type
+01003b50 g     F .text	00000008 card_get_type
 f07c0500 g       .LOADER_CORE2_ENTRY_PROGRAM	00000000 _load_core2_entry_program_start_base
 0103c400 g       *ABS*	00000000 __common_limit
-01036a14 g     O .bss	00000004 currentPtr
+01036a54 g     O .bss	00000004 currentPtr
 f07c2320 g     F .LOADER_EXEC	00000018 CPUInvalidateICacheAll
-010045dc g     F .text	00000020 fat_internal_close_rootfile
+0100463c g     F .text	00000020 fat_internal_close_rootfile
 f07c2254 g     F .LOADER_EXEC	0000005c rtc_chkS3boot_init
 f07c1bf8 g     O .LOADER_REMAP	0000000c uart1_obj
-01003b20 g     F .text	0000003c quary_secure_boot
+01003b80 g     F .text	0000003c quary_secure_boot
 f07c22b0 g     F .LOADER_EXEC	00000020 rtc_chkS3boot_wait_init
 f07c0070 g       .LOADER_CONFIGRAM	00000000 _load_LOADER_CONFIGRAM_end_base
-01004ad4 g     F .text	00000000 .hidden __aeabi_uldivmod
-01004684 g     F .text	000001ec .hidden __udivsi3
+01004b34 g     F .text	00000000 .hidden __aeabi_uldivmod
+010046e4 g     F .text	000001ec .hidden __udivsi3
 f07c2480 g     F .LOADER_EXEC	0000000a debug_msg
 f07c1e7c g     F .LOADER_REMAP	00000018 debug_err
 f07c248a g     F .LOADER_EXEC	0000002a debug_msg_var
-01000258 g     F .text	00000060 Dec2HexStr2Bytes
-01002334 g     F .text	00000044 cpu_cleanDCacheBlock
-010026f8 g     F .text	00000088 fdt_subnode_offset_namelen
-01004b58 g     F .text	00000128 .hidden __udivmoddi4
-010001f8 g     F .text	00000026 gpio_getPin
-01001068 g     F .text	000000f4 bl_boot_uboot
-010026d2 g     F .text	00000026 fdt_num_mem_rsv
+01000290 g     F .text	00000060 Dec2HexStr2Bytes
+01002394 g     F .text	00000044 cpu_cleanDCacheBlock
+01002758 g     F .text	00000088 fdt_subnode_offset_namelen
+01004bb8 g     F .text	00000128 .hidden __udivmoddi4
+01000230 g     F .text	00000026 gpio_getPin
+010010a0 g     F .text	000000f4 bl_boot_uboot
+01002732 g     F .text	00000026 fdt_num_mem_rsv
 f07c0958 g     F .LOADER_REMAP	00000000 rom_LZ_Uncompress
-01002810 g     F .text	00000030 fdt_get_property_by_offset
+01002870 g     F .text	00000030 fdt_get_property_by_offset
 f07c1c3c g     F .LOADER_REMAP	0000001c serial2_putc
-01000d60 g     F .text	000000d4 bl_chk_fdt
-01001fb8 g     F .text	00000010 loader_installFastbootKeyCB
-01000f80 g     F .text	00000048 bl_copy_fdt_to_fdt_addr
+01000d98 g     F .text	000000d4 bl_chk_fdt
+01002018 g     F .text	00000010 loader_installFastbootKeyCB
+01000fb8 g     F .text	00000048 bl_copy_fdt_to_fdt_addr
 f07c0070 g     O .LOADER_CONFIGRAM	00000020 LoaderInternalInfo
 f07c1f4c g     F .LOADER_REMAP	00000018 UTL_setDrvTmpBufferAddress
 f07c0600 g       .LOADER_REMAP	00000000 _load_LOADER_REMAP_start_base
-01005b48 g       .data	00000000 _load_general_var_base
+01005ba8 g       .data	00000000 _load_general_var_base
 f07c1e68 g     F .LOADER_REMAP	00000014 debug_set_console
 f07c1e94 g     F .LOADER_REMAP	00000038 debug_err_var
-0100039c g     F .text	0000001a strnlen
-010000ec g     F .text	0000000c debug_disable_msg
-01002920 g     F .text	0000002c fdt_getprop
+010003d4 g     F .text	0000001a strnlen
+01000118 g     F .text	0000000c debug_disable_msg
+01002980 g     F .text	0000002c fdt_getprop
 f07c0b48 g       .LOADER_REMAP	00000000 EXP_Handler
-01036a00 g     O .bss	00000014 emuCommonBuf
+01036a40 g     O .bss	00000014 emuCommonBuf
 f07c1c74 g     F .LOADER_REMAP	0000005c uart_openSystemUART
-01001fc8 g     F .text	00000014 loader_setStorageIntType
-0100386c g     F .text	00000264 card_open
+01002028 g     F .text	00000014 loader_setStorageIntType
+010038cc g     F .text	00000264 card_open
 0103c400 g       .loader_heap	00000000 _image_load_reset_zi_base
-01005d8c g     O .bss	00000004 TopOfStack
-01004b10 g     F .text	00000048 .hidden __popcountsi2
-010002b8 g     F .text	0000005a utl_memset
-01005ae0 g       .dram_text	00000000 _loader_dram_text_start_base
-01004890 g     F .text	00000000 .hidden __aeabi_idiv
-01002554 g     F .text	00000028 _fdt_check_prop_offset
-0100115c g     F .text	000002b0 bl_process_all_in_one
+01005dd4 g     O .bss	00000004 TopOfStack
+01004b70 g     F .text	00000048 .hidden __popcountsi2
+010002f0 g     F .text	0000005a utl_memset
+01005b40 g       .dram_text	00000000 _loader_dram_text_start_base
+010048f0 g     F .text	00000000 .hidden __aeabi_idiv
+010025b4 g     F .text	00000028 _fdt_check_prop_offset
+01001194 g     F .text	000002b0 bl_process_all_in_one
 f07c0028 g       .BOOT_EXEC	00000000 __start
-0100429c g     F .text	000002a4 fat_internal_open_rootfile
-01002780 g     F .text	0000001e fdt_subnode_offset
-01001f74 g     F .text	00000014 loader_setRunFwName
-0100044c g     F .text	00000094 memchr
-01002a0c g     F .text	000000cc fdt_check_full
+010042fc g     F .text	000002a4 fat_internal_open_rootfile
+010027e0 g     F .text	0000001e fdt_subnode_offset
+01001fc4 g     F .text	00000014 loader_setRunFwName
+01000484 g     F .text	00000094 memchr
+01002a6c g     F .text	000000cc fdt_check_full
 f07c05e8 g       .LOADER_CORE2_ENTRY_PROGRAM	00000000 _load_core2_entry_program_end_base
 f07c0b48 g       .LOADER_REMAP	00000000 _load_LOADER_REMAP_end_base
-0100142c g     F .text	00000b20 bl_mainFlow
-0100261e g     F .text	00000036 fdt_next_subnode
+01001464 g     F .text	00000b38 bl_mainFlow
+0100267e g     F .text	00000036 fdt_next_subnode
 f07c002c g       .BOOT_EXEC	00000000 _load_BOOT_EXEC_end_base
 f07c1c04 g     F .LOADER_REMAP	0000001c serial_putc
 f07c0368 g     O .LOADER_CONFIGRAM2	00000068 g_dma_config_setting_2
-01003e98 g     F .text	00000368 fat_internal_mount_partition
-010003d2 g     F .text	00000024 strncmp
-01001f4c g     F .text	00000014 loader_setUpdateFwName
-01005ae0 g     F .dram_text	0000005c load_dram_scan
-010003b6 g     F .text	0000001c strncpy
+01003ef8 g     F .text	00000368 fat_internal_mount_partition
+0100040a g     F .text	00000024 strncmp
+01001f9c g     F .text	00000014 loader_setUpdateFwName
+01005b40 g     F .dram_text	0000005c load_dram_scan
+010003ee g     F .text	0000001c strncpy
 f07c0090 g       .LOADER_CONFIGRAM	00000000 _load_LOADER_CONFIGRAM_FREQ_PARAM_end_base
 f07c091c g     F .LOADER_REMAP	00000000 rom_debug_msg
-01004200 g     F .text	0000009c fat_internal_initFAT
+01004260 g     F .text	0000009c fat_internal_initFAT
 0103c400 g       .loader_heap	00000000 _loader_heap_base
 f07c20d8 g     F .LOADER_REMAP	00000014 utl_get_bootsrc
 f07c0d70 g     F .LOADER_REMAP	0000001c rom_memcpy
-01000412 g     F .text	00000020 memcmp
-010027f8 g     F .text	00000018 fdt_next_property_offset
+0100044a g     F .text	00000020 memcmp
+01002858 g     F .text	00000018 fdt_next_property_offset
 f07c24d8 g       .LOADER_EXEC	00000000 _loader_exec_end_base
-01004ad0  w    F .text	00000004 .hidden __aeabi_ldiv0
-01003e74 g     F .text	00000024 fat_regfilesystem
-01002840 g     F .text	00000074 fdt_get_property_namelen
-01003ad0 g     F .text	00000020 card_close
+01004b30  w    F .text	00000004 .hidden __aeabi_ldiv0
+01003ed4 g     F .text	00000024 fat_regfilesystem
+010028a0 g     F .text	00000074 fdt_get_property_namelen
+01003b30 g     F .text	00000020 card_close
 0103c400 g       .loader_heap	00000000 _image_load_reset_length
 f07c22d0 g     F .LOADER_EXEC	00000038 rtc_chkS3boot
 f07c2380 g     F .LOADER_EXEC	00000048 _cache_invalidate_data_cache_all
 f07c0000 g       .BOOT_EXEC	00000000 _load_BOOT_EXEC_start_base
-01001f98 g     F .text	00000010 loader_installSpecialKeyCB
-f07c7fb8 g       *ABS*	00000000 _loader_dram_text_cpu_addr
+01001fe8 g     F .text	00000010 loader_installSpecialKeyCB
+f07c8018 g       *ABS*	00000000 _loader_dram_text_cpu_addr
 f07c0368 g       .LOADER_CONFIGRAM2	00000000 config_dram1_tbl_2_start_base
 f07c2150 g     F .LOADER_EXEC	00000104 main
 f07c096c g     F .LOADER_REMAP	00000000 rom_Dec2HexStr
-01002074 g     F .text	00000088 nvtpack_getver
-0100252c g     F .text	00000028 _fdt_check_node_offset
-01002050 g     F .text	00000022 nvtpack_calc_nvt_sum
+010020d4 g     F .text	00000088 nvtpack_getver
+0100258c g     F .text	00000028 _fdt_check_node_offset
+010020b0 g     F .text	00000022 nvtpack_calc_nvt_sum
 f07c1c20 g     F .LOADER_REMAP	0000001c serial2_getc
-01004684 g     F .text	00000000 .hidden __aeabi_uidiv
+010046e4 g     F .text	00000000 .hidden __aeabi_uidiv
 f07c1df4 g     F .LOADER_REMAP	00000018 uart_getBinary
-010045fc g     F .text	00000018 fat_initFAT
-01004644 g     F .text	00000014 fat_close_rootfile
+0100465c g     F .text	00000018 fat_initFAT
+010046a4 g     F .text	00000014 fat_close_rootfile
 f07c1f38 g     O .LOADER_REMAP	00000004 g_uiDrvTmpBuffer
-01002398 g     F .text	0000003e CPUflushReadCache
+010023f8 g     F .text	0000003e CPUflushReadCache
 f07c1d3c g     F .LOADER_REMAP	0000000a serial2_init
-01005b48 g       .data	00000000 _loader_data_start_base
+01005ba8 g       .data	00000000 _loader_data_start_base
 f07c23e2 g     F .LOADER_EXEC	0000004e _cache_clean_invalidate_d_cache_All
-01004890 g     F .text	00000220 .hidden __divsi3
+010048f0 g     F .text	00000220 .hidden __divsi3
 f07c0030 g     O .LOADER_CONFIGRAM	00000040 ConfigRamTab
 f07c0070 g       .LOADER_CONFIGRAM	00000000 _load_LOADER_CONFIGRAM_FREQ_PARAM_start_base
-01005c40 g       .bss	00000000 _image_general_zi_zi_base
-01000432 g     F .text	0000001a strcmp
+01005c80 g       .bss	00000000 _image_general_zi_zi_base
+0100046a g     F .text	0000001a strcmp
 f07c0d8c g     F .LOADER_REMAP	00000d94 config_dma
 f07c1cd0 g     F .LOADER_REMAP	0000000a serial_init
-0100140c g     F .text	00000020 bl_read_rtos_addr
+01001444 g     F .text	00000020 bl_read_rtos_addr
 f07c1ecc g     F .LOADER_REMAP	0000006c debug_dump_addr
 0117c400 g       .loader_heap	00000000 _stack_start
-01002378 g     F .text	00000020 cpu_cleanInvalidateDCache
+010023d8 g     F .text	00000020 cpu_cleanInvalidateDCache
 f07c2338 g     F .LOADER_EXEC	00000048 _cache_clean_d_cache_all
 f07c24d8 g       *ABS*	00000000 _loader_exec_compress_load_cpu_addr
 f07c1bec g     O .LOADER_REMAP	0000000c uart0_obj
-01002400 g     F .text	00000050 fdt_check_header
+01002460 g     F .text	00000050 fdt_check_header
 f07c1d98 g     F .LOADER_REMAP	0000005c uart_getStr_polling
 f07c246c g     F .LOADER_EXEC	00000014 fLib_PutSerialStr
-010021ec g     F .text	000000e0 nvtpack_get_partition
-0100279e g     F .text	00000042 fdt_get_name
-010023d6 g     F .text	0000002a CPUflushWriteCache
+0100224c g     F .text	000000e0 nvtpack_get_partition
+010027fe g     F .text	00000042 fdt_get_name
+01002436 g     F .text	0000002a CPUflushWriteCache
 01038000 g       .bss	00000000 _ttb
 f07c1e0c g     F .LOADER_REMAP	00000030 get_uart_object
-010025f0 g     F .text	0000002e fdt_first_subnode
-01005c04 g       .data	00000000 _image_general_var_limit
+01002650 g     F .text	0000002e fdt_first_subnode
+01005c64 g       .data	00000000 _image_general_var_limit
 f07c0908 g     F .LOADER_REMAP	00000000 rom_efuse_read
 f07c1cdc g     F .LOADER_REMAP	00000060 uart_openSystemUART2
-01000312 g     F .text	00000076 utl_memcpy
+0100034a g     F .text	00000076 utl_memcpy
 0103c400 g       .loader_heap	00000000 _image_load_reset_base
 f07c1fa8 g     F .LOADER_REMAP	00000020 utl_is_sram_fw
-0100257c g     F .text	00000074 fdt_next_node
-01004870 g     F .text	00000020 .hidden __aeabi_uidivmod
+010025dc g     F .text	00000074 fdt_next_node
+010048d0 g     F .text	00000020 .hidden __aeabi_uidivmod
 f07c23c8 g     F .LOADER_EXEC	0000001a cpu_invalidateDCacheAll
 000024d8 g       *ABS*	00000000 _loader_exec_compress_load_base
 01000000 g       .text	00000000 _internal_strg_param_start
-01005bc8 g     O .data	00000038 spi_nor
-01000cb4 g     F .text	00000088 bl_flash_open
-01003af8 g     F .text	00000028 dma_get_dram_capacity
+01005c28 g     O .data	00000038 spi_nor
+01000cec g     F .text	00000088 bl_flash_open
+01003b58 g     F .text	00000028 dma_get_dram_capacity
 f07c209c g     F .LOADER_REMAP	00000018 utl_dram_protect_disable
-01004614 g     F .text	00000018 fat_open_rootfile
-01005c40 g     O .bss	00000009 gStr
-010000f8 g     F .text	00000100 prj_main
+01004674 g     F .text	00000018 fat_open_rootfile
+01005c80 g     O .bss	00000009 gStr
+01000124 g     F .text	0000010c prj_main
 f07c1c58 g     F .LOADER_REMAP	0000001c serial_getc
-010026c4 g     F .text	0000000e fdt_string
+01002724 g     F .text	0000000e fdt_string
 f07c1f3c g     F .LOADER_REMAP	00000010 bitCount
 f07c2430 g     F .LOADER_EXEC	0000001e cpu_cleanInvalidateDCacheAll
 0103c400 g       .loader_heap	00000000 _load_load_reset_base
 f07c0638 g       .LOADER_REMAP	00000000 start
-01002480 g     F .text	000000ac fdt_next_tag
-01004658 g     F .text	0000002c atoi
-01004ad0  w    F .text	00000004 .hidden __aeabi_idiv0
-0100294c g     F .text	00000030 fdt_get_alias_namelen
+010024e0 g     F .text	000000ac fdt_next_tag
+010046b8 g     F .text	0000002c atoi
+01004b30  w    F .text	00000004 .hidden __aeabi_idiv0
+010029ac g     F .text	00000030 fdt_get_alias_namelen
 0103c000 g       .bss	00000000 _ttb_lv2
 f07c1d78 g     F .LOADER_REMAP	00000020 uart_chkChar
 f07c1f7c g     F .LOADER_REMAP	0000002c UTL_canUpdateSecKey
 00000388 g       *ABS*	00000000 _loader_exec_size
 f07c1f64 g     F .LOADER_REMAP	00000018 UTL_getDrvTmpBufferAddress
-01000388 g     F .text	00000014 strlen
-01005cd8 g     O .bss	00000004 int_strg_obj
-01000220 g     F .text	00000038 Dec2HexStr
+010003c0 g     F .text	00000014 strlen
+01005d18 g     O .bss	00000004 int_strg_obj
+01000258 g     F .text	00000038 Dec2HexStr
 f07c0930 g     F .LOADER_REMAP	00000000 rom_debug_msg_var
-010003f6 g     F .text	0000001c strchr
-01005d00 g     O .bss	00000004 rom_lzma_inflate
-01004540 g     F .text	0000009c fat_internal_read_rootfile
-01004d00 g       .text	00000000 _loader_exec_compres_end
+0100042e g     F .text	0000001c strchr
+01005d40 g     O .bss	00000004 rom_lzma_inflate
+010045a0 g     F .text	0000009c fat_internal_read_rootfile
+01004d60 g       .text	00000000 _loader_exec_compres_end
 f07c20b4 g     F .LOADER_REMAP	00000024 utl_dram_protect_check
-01004ab0 g     F .text	00000020 .hidden __aeabi_idivmod
-010028f8 g     F .text	00000028 fdt_getprop_by_offset
+01004b10 g     F .text	00000020 .hidden __aeabi_idivmod
+01002958 g     F .text	00000028 fdt_getprop_by_offset
 0103c400 g       .loader_heap	00000000 _image_load_reset_zi_limit
-01000d3c g     F .text	00000024 bl_chk_valid_all_in_one
-01005b48 g       .data	00000000 _image_general_var_base
+01000d74 g     F .text	00000024 bl_chk_valid_all_in_one
+01005ba8 g       .data	00000000 _image_general_var_base
 0103c400 g       *ABS*	00000000 _image_general_zi_zi_limit
-01005d88 g     O .bss	00000004 BaseOfStack
+01005dd0 g     O .bss	00000004 BaseOfStack
 f07c0b48 g       .LOADER_REMAP	00000000 _load_vector_exp_table_start_base
-010020fc g     F .text	000000f0 nvtpack_verify
+01001ff8 g     F .text	00000010 loader_installsfSpecialKeyCB
+0100215c g     F .text	000000f0 nvtpack_verify
 
 
diff --git a/rtos/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h b/rtos/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h
index 83cfbec13..058fb0aad 100755
--- a/rtos/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h
+++ b/rtos/code/application/source/cardv/SrcCode/PrjCfg_HUNTING_S550.h
@@ -957,7 +957,7 @@
 #define SF_IQ_TEST						DISABLE
 #define HW_S530                         DISABLE
 #define PHOTO_ISP_STAMP 				DISABLE
-#define SF_BASE_VERSION_FEA			"R2.3"
+#define SF_BASE_VERSION_FEA			"R6.0"
 #define SF_GPS_SUPPORT 					0
 #define SF_SEND_LIST_ITEM_LENGTH        15
 #define SF_4G_REGISTER_NETWORK_COUNT    230