Since char is unsigned on arm64, this test currently fails. It seems
better to use unsigned anyway, since 0xff is written into the string at
the start. Update the terminator-assert to use a character instead of a
byte.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Changes in v6:
- Re-introduce
Changes in v2:
- Use '\0' instead of 0
test/print_ut.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
The cache-flush function is incorrect which causes a crash in the
remoteproc tests with arm64.
Fix both problems by using map_sysmem() to convert an address to a
pointer and map_to_sysmem() to convert a pointer to an address.
Also update the image-loader's cache-flushing logic.
Signed-off-by: Simon Glass <sjg@chromium.org>
Fixes: 3286d223fd7 ("sandbox: implement invalidate_icache_all()")
Acked-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Changes in v6:
- Re-introduce
Changes in v2:
- Drop message about EFI_LOADER
arch/sandbox/cpu/cache.c | 8 +++++++-
drivers/remoteproc/rproc-elf-loader.c | 18 +++++++++++-------
lib/efi_loader/efi_image_loader.c | 3 ++-
3 files changed, 20 insertions(+), 9 deletions(-)
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Patch resolves two kind of bugs, one of which is vulnerability related
to KASLR.
=== Issue briefly ===
Working with FDT (via non-relocated gd::fdt_blob) from inside bootm
command may lead to the reading the garbage instead of FDT nodes. And
this can result in various side-effects depending on DTS nodes, being
parsed during bootm.
But below is my specific story how I faced with this issue due to
MESON_RNG probing failure.
=== Bugs description ===
1) Bug is revealed on:
* configuration below
* U-boot 2024.10 - f919c3a889f ("Prepare v2024.10")
It seems, the following patch is a trigger:
ea955eea4f ("fdt: automatically add /chosen/kaslr-seed if DM_RNG is enabled")
Generally, CONFIG_OF_EMBED=y & CONFIG_RNG_MESON=y are the most
valuable ones for reproducing the issue.
```
CONFIG_ARCH_FIXUP_FDT_MEMORY=y
CONFIG_CMD_FDT=y
CONFIG_DEFAULT_FDT_FILE=""
CONFIG_FDT_64BIT=y
CONFIG_OF_BOARD_SETUP=y
CONFIG_OF_CONTROL=y
CONFIG_OF_EMBED=y
CONFIG_OF_LIBFDT_ASSUME_MASK=0x0
CONFIG_OF_LIBFDT_OVERLAY=y
CONFIG_OF_LIBFDT=y
CONFIG_OF_LIST="meson-axg-our-device-name"
CONFIG_OF_REAL=y
CONFIG_OF_TRANSLATE=y
CONFIG_SUPPORT_OF_CONTROL=y
CONFIG_SYS_FDT_PAD=0x3000
CONFIG_TOOLS_OF_LIBFDT=y
CONFIG_DM_RNG=y
CONFIG_RNG_MESON=y
```
2) Due to CONFIG_OF_EMBED, the DTS is embedded into U-boot ELF and
accessible via __dtb_dt_begin symbol.
On early boot stage (board_f.c) the fdtdec_setup() is called only
once before U-boot's relocation into top of RAM. fdtdec_setup()
initializes gd::fdt_blob for FDTSRC_EMBED case:
```
gd->fdt_blob = dtb_dt_embedded();
gd->fdt_src = FDTSRC_EMBED;
```
3) Then reloc_fdt() is called in board_f.c
But due to CONFIG_OF_EMBED=y the reloc_fdt() does not update
gd::fdt_blob value (strictly speaking, it is impossible for
CONFIG_OF_EMBED=y, because U-boot ELF has not been relocated yet
at this moment).
As a result after relocation we get fdt_blob, pointing to DTS address
before relocation:
```
# bdinfo
<...>
relocaddr = 0x000000000fedf000
reloc off = 0x000000000eedf000
<...>
fdt_blob = 0x010ce6c0 << points to __dtb_dt_begin before relocation
new_fdt = 0x0000000000000000 << empty erroneously
fdt_size = 0x0000000000000000 << zero erroneously
```
4) During bootm command (according to our ITS-config file) the Linux
is loaded into 0x01080000 (which is very close to fdt_blob addr
0x010ce6c0).
```
## Loading kernel from FIT Image at 04000000 ...
Trying 'kernel' kernel subimage
<...>
Load Address: 0x01080000
```
So Linux image overwrites the gd::fdt_blob memory location
in RAM (0x010ce6c0).
5) Issue:
Hence any manipulation with DTS (say, via FDT API) inside
implementation of bootm command leads to accessing the fdt_blob area
with garbage, that can lead to two situations:
5.1) Abort.
Call to fdt_off_dt_struct() from fdt_next_tag() :: fdt_offset_ptr()::
fdt_offset_ptr_() returns with garbage, that leads to tagp value
being out of RAM top addr (256 Mb in our board), causing the abort:
```
Boot cmd: bootm 0x4000000#boot_evt1
bootm_run_states()
<...>
image_setup_libfdt()
fdt_chosen()
fdt_kaslrseed()
uclass_get_device()
uclass_get_device_tail()
device_probe()
device_of_to_plat()
meson_rng_of_to_plat()
clk_get_by_name_optional()
clk_get_by_name()
clk_get_by_name_nodev()
ofnode_stringlist_search()
fdt_stringlist_search()
fdt_getprop()
fdt_get_property_namelen_()
fdt_first_property_offset()
fdt_check_node_offset_()
fdt_next_tag():
```
tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
```
fdt_next_tag() tagp:0x22890766
fdt_next_tag() ram_top:0x10000000 (tagp OUT of RAM)
"Synchronous Abort" handler, esr 0x96000010, far 0x22890766
elr: 000000000108be24 lr : 000000000108be24 (reloc)
elr: 000000000ff6fe24 lr : 000000000ff6fe24
x0 : 0000000000000041 x1 : 0000000000000000
x2 : 000000000ff3b57c x3 : 0000000000000012
x4 : 000000000ded2ad5 x5 : 0000000000000020
x6 : 00000000ffffffe8 x7 : 000000000ded2f40
x8 : 00000000ffffffd8 x9 : 000000000000000d
x10: 0000000000000006 x11: 000000000001869f
x12: 000000000fffffff x13: 000000000fffffff
x14: 0000000000000000 x15: 000000000ded2abb
x16: 000000000ff3b080 x17: 0000000000000001
x18: 000000000ded3dc0 x19: 0000000022890766
x20: 00000000010cb0f0 x21: 00000000000015e4
x22: 000000000ff8f4d8 x23: 000000000000000b
x24: 000000000ded2fbc x25: 000000000ffe2000
x22: 000000000ff8f4d8 x23: 000000000000000b
x24: 000000000ded2fbc x25: 000000000ffe2000
x26: 000000000ffe2000 x27: 000000000000000b
x28: 000000000ff9cf2d x29: 000000000ded2f40
Code: aa1603e1 91197484 52801742 94004de8 (b9400276)
```
5.2) Vulnerability situation "KASLR is disabled".
Almost the same as in (5.1), but 2 situations happen (depending on
the value of garbage):
* call to fdt_offset_ptr_() :: fdt_off_dt_struct(fdt)
returns not so big garbage, leading to tagp, being inside RAM.
* or calculations of absoffset inside fdt_offset_ptr() leads to
failure of the one of if() conditions with NULL as retval.
Result is fdt_next_tag() interprets the tagp as FDT_END. And we are
returning from our callstack via functions' error paths, leading to
"No RNG device" and "KASLR disabled due to lack of seed":
```
fdt_kaslrseed()
uclass_get_device()
<...>
device_probe()
device_of_to_plat()
meson_rng_of_to_plat()
clk_get_by_name()
clk_get_by_name_nodev()
<...>
fdt_stringlist_search()
fdt_getprop()
fdt_get_property_namelen_()
fdt_first_property_offset()
fdt_check_node_offset_()
fdt_next_tag():
```
tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
```
fdt_next_tag() tagp:0000000001890677
fdt_next_tag() ram_top:0x10000000 (tagp is inside RAM)
uclass_get_device_tail():486 device_probe() ret:-22
No RNG device
Starting kernel ...
[ 0.000000] Linux version 6.9.12
[ 0.000000] KASLR disabled due to lack of seed
```
Signed-off-by: Evgeny Bachinin <EABachinin@salutedevices.com>
This breaks chromebook_coral which says:
Video: No video mode configured in FSP!
This reverts commit 2e9313179a846b581c0fc3f6a49e19f3d343efa8.
Signed-off-by: Simon Glass <sjg@chromium.org>
A recent lwip change stopped binman's init from working, so it is not
possible to read nodes from the image description anymore.
Correct this by dropping the offending line.
Signed-off-by: Simon Glass <sjg@chromium.org>
Fixes: 4d4d7838127 net: lwip: add TFTP support and tftpboot command
It doesn't make sense for these files to have the x bit set. It was,
probably accidentally, added in:
Fixes: 2c494e62c31a (arm: dts: Stratix10: Add QSPI node)
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
The '?' that is used in the sed expression that determines MK_ARCH
is part of the extended regular expression syntax, but the default
behaviour of sed as specified by POSIX is to use only basic regular
expression syntax. Use the equivalent '\{0,1\}' instead as
suggested by the OpenBSD re_format(7) man page.
Fixes: 04b1d84221d5 ("Makefile: fix empty MK_ARCH when using ccache")
Signed-off-by: Mark Kettenis <kettenis@openbsd.org>
Reviewed-by: Marek Vasut <marex@denx.de>
Tested-by: Quentin Schulz <quentin.schulz@cherry.de>
Commit 356011f7ac25 ("lwip: fix code style issues") has inadvertently
broken the support for the legacy syntax:
=> wget 192.168.0.16:test.bin
invalid uri, no file path
Invalid URL. Use http(s)://
The reason is two calls to strncpy() were replaced by strlcpy() without
paying attention to the fact that they are not equivalent in the present
case. Since we are using a character counter (n) and since we do not
depend on having a properly null-terminated string at each step in the
parsing, strlcpy() is not justified and strncpy() is the right tool for
the job. So use it again.
Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
This reverts commit ("commit a68c9ac5d8af ("efi_memory: do not add
U-Boot memory to the memory map").
This code was removed when the EFI subsystem started using LMB calls for
the reservations. In hindsight it unearthed two problems.
The e820 code is adding u-boot memory as EfiReservedMemory while it
should look at what LMB added and decide instead of blindly overwriting
it. The reason this worked is that we marked that code properly late,
when the EFI came up. But now with the LMB changes, the EFI map gets
added first and the e820 code overwrites it.
The second problem is that we never mark SetVirtualAddressMap as runtime
code, which we should according to the spec. Until we fix this the
current hack can't go away, at least for architectures that *need* to
call SVAM.
More specifically x86 currently requires SVAM and sets the NX bit for
pages not marked as *_CODE. So unless we do that late, it will crash
trying to execute from non-executable memory. It's also worth noting
that x86 calls SVAM late in the boot, so this will work until someone
decides to overwrite/use BootServicesCode from the OS.
Notably arm64 disables it explicitly if the VA space is > 48bits, so
doesn't suffer from any of these problems.
This doesn't really deserve a fixes tag, since it brings back a hack to
remedy a situation that was wrong long before that commit, but in case
anyone hits the same bug ...
Simon sent the original revert in the link, but we need a proper
justification for it.
Link: https://lore.kernel.org/u-boot/20241112131830.576864-1-sjg@chromium.org/
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reported-by: Simon Glass <sjg@chromium.org>
CI: https://source.denx.de/u-boot/custodians/u-boot-imx/-/pipelines/23643
- Make DRAM coding GPIOs available before relocation on Data Modul
i.MX8M Mini/Plus eDM SBC because the DRAM configuration GPIO straps
must be accessible in SPL and before relocation because the GPIOs are
sampled both in U-Boot SPL as well as early on in U-Boot proper.
- Pick safe DRAM size on failure on Data Modul i.MX8M Mini/Plus eDM SBC
instead of failing with hang() or panic().
- Replace YModem with SDP on Data Modul i.MX8M Mini eDM SBC SPL since
SDP is much more flexible.
- Deduplicate Data Modul i.MX8M eDM SBC defconfigs.
- Perform plain boot in altbootcmd on Data Modul i.MX8M Mini/Plus eDM
SBC.
When a timeout occurs while executing a command a 'Boot fail' message is
written and testing is stopped. The user is left in the dark about the
failure cause.
! _pytest.outcomes.Exit: Boot fail: Marking connection bad - no other tests will run !
Add the executed command to the message.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
When a timeout occurs while executing a command a 'Lab failure' message is
written and testing is stopped. The user is left in the dark about the
failure cause.
! _pytest.outcomes.Exit: Lab failure: Marking connection bad - no other tests will run !
Add the word 'Timeout' and the executed command to the message.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Add a small utility for displaying some information about U-Boot and the
hardware it's running on in a similar fashion to the popular neofetch
tool for Linux [1].
While the output is meant to be useful, it should also be pleasing to
look at and perhaps entertaining. The ufetch command aims to bring this
to U-Boot, featuring a colorful ASCII art version of the U-Boot logo.
[1]: https://en.wikipedia.org/wiki/Neofetch
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Tested-by: Mattijs Korpershoek <mkorpershoek@baylibre.com> # vim3
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8560-QRD
Acked-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Tested-by: Tony Dinh <mibodhi@gmail.com>
Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
We don't need the fallback anymore. Remove the code which uses these
files.
Signed-off-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
We don't need the fallback anymore. As a first step to removing it,
drop the try...except clauses and unindent the code.
This produces a large diff but there are no other code changes.
Signed-off-by: Simon Glass <sjg@chromium.org>
Like for test_fs, no need to mess with loop mounts.
Tweaks to reduce diff (keep mnt variable):
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Simon Glass <sjg@chromium.org>
Add a parameter to indicate the size of the image to build.
Signed-off-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Since no mounting happens anymore, rename the "mnt"
directory to "scratch" and the related variables.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Signed-off-by: Simon Glass <sjg@chromium.org>
There is no need to mount the filesystem on the host side.
All filesystem tools offer some way to fill the fs without mounting.
So, create the content on the host side, create and fill the fs
without mounting.
No more sudo or guestmount needed.
This new approach works because the tests don't care about user IDs
and no device files are needed.
If user IDs start to matter it's still possible to use wrapper
tools like fakeroot in future while filling the fs.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Simon Glass <sjg@chromium.org>
Tested-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Since net_test_wget() is testing a command and is in test/cmd it should
be in the 'cmd' test suite, not 'lib'.
Saving and restoring the values of the environment variables that the
test manipulates is necessary to avoid a regression when running the
whole ut test suite. A minimal reproducer is:
$ ./u-boot -T -c "ut cmd net_test_wget; ut dm dm_test_eth_act" | \
grep -E "(Test:|Failures:)"
Reported-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
While I had thought this commit was a cherry-pick from upstream, it is
not. And so, this is not allowed here.
This reverts commit dfe5f16a33453b742a66cabc8ea9a52a33279810.
Signed-off-by: Tom Rini <trini@konsulko.com>
Update the tcminit value to string and number both as per commit
342ccba5586a ("arm64: zynqmp: Fix tcminit mode value based on argv") and
also adds negative cases based on invalid command sequences.
Signed-off-by: Love Kumar <love.kumar@amd.com>
Link: https://lore.kernel.org/r/48f75577f6735a0d14105658e89b625d45537bb1.1731672024.git.love.kumar@amd.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
As the flash reset is handled in spi nor core, removing the
flash reset functionality. As the configuration like tristate
and hysterisis need to be enabled by the cdo. Handle the flash
reset only for mini u-boot case.
Rename the "cadence_qspi_versal_flash_reset" to generic name
"cadence_qspi_flash_reset" as this can be used by other platforms
as well.
Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@amd.com>
Link: https://lore.kernel.org/r/20241108063537.13180-1-venkatesh.abbarapu@amd.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
USB host support on ZYNQMP KRIA SOM needs onboard USB
hub driver for handling reset GPIO and for i2c initialization
sequence.
Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/20241126041238.1969723-1-venkatesh.abbarapu@amd.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
Enable PCIe/NVMe support on Data Modul i.MX8M Mini eDM SBC. Except for
the configuration options which are enabled, add slight adjustment
to board u-boot.dtsi, which is necessary as there is currently no
driver for the I2C PCIe clock generator. Since the generator is
strapped to be always on, it is possible to supplant the generator
functionality by fixed-clock.
Signed-off-by: Marek Vasut <marex@denx.de>
The YModem support in SPL was never really used on this device,
the SDP support is much more convenient on i.MX8M Mini based
hardware. Replace the YModem support with SDP support.
The SDP can be utilized by forcing the board into SDP boot mode
by grounding test point right next to silkscreen label U30, and
then by using mfgtools 'uuu -brun spl flash.bin' once the device
enumerates on host system USB bus. The SDP capable USB port is
available on the USB micro-B port on the base board.
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Deduplicate defconfigs for all Data Modul i.MX8M eDM SBC systems by factoring
out the common parts into generic imx8m_data_modul.config and including
those using the #include <configs/...> preprocessor macro in the current
set of board specific defconfigs. The preprocessor macro is applicable
to defconfigs as well.
This introduces no functional change, the resulting .config is almost
identical for all Data Modul i.MX8M eDM SBC systems, except for slight
alignment in DEBUG_UART and SYS_PBSIZE.
Signed-off-by: Marek Vasut <marex@denx.de>
The current A/B switching preparatory altbootcmd is confusing
to users, replace it with plain 'run bootcmd' which can be
replaced by proper A/B switching altbootcmd when the matching
updater is added on top of the platform. By default, keep the
boot counter incrementing, but do not do any A/B partition
switching.
Signed-off-by: Marek Vasut <marex@denx.de>
In case gpio_request_list_by_name_nodev() in board dmo_get_memcfg()
returns error code, pick a safe default DRAM configuration instead
of bailing out with some sort of hang() or panic(). The BIT(2)|BIT(0)
strap option is the lowest known option of 2 GiB , use that.
Signed-off-by: Marek Vasut <marex@denx.de>
The DRAM configuration GPIO straps must be accessible in SPL and before
relocation because the GPIOs are sampled both in U-Boot SPL as well as early
on in U-Boot proper. The already present bootph-pre-ram DT property made the
GPIO controllers available in SPL, but not early on in U-Boot proper, which
made gpio_request_list_by_name_nodev() in board dmo_get_memcfg() fail. Add
missing bootph-some-ram DT property to all GPIO controllers which are
referenced in dmo,ram-coding-gpios DT property to make those GPIO
controllers available early in U-Boot proper as well.
Fixes: 8c103c33fb14 ("dm: dts: Convert driver model tags to use new schema")
Signed-off-by: Marek Vasut <marex@denx.de>
Always probing pmecc in the generic nand controller probe function and
bailing out if pmecc is missing, prevents the driver to be usable for
SoCs which do not have a pmecc hardware ecc engine like older sam9 SoCs,
for example at91sam9g20. Tested on sam9x60 that the call, which the
comment was moved to, is sufficient to probe the pmecc.
Signed-off-by: Alexander Dahl <ada@thorsis.com>
The bad CRC error message has transposed characters, which render the
output useless:
"bad CRC at record 213: #08x, not #08x" instead of
"bad CRC at record 213: #00000000, not #4be31f4d"
Fix the error message.
Signed-off-by: Benedikt Spranger <b.spranger@linutronix.de>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
A NULL pointer argument to %s causes a NULL pointer dereference in the
fixed width numerical printout code, since p is overwritten with NULL.
In case of %s width is 0. Check width before dereferencing the pointer.
Signed-off-by: Benedikt Spranger <b.spranger@linutronix.de>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
CI: https://source.denx.de/u-boot/custodians/u-boot-nand-flash/-/pipelines/23584
Remove device specific nand driver files as they are now replaced by a
common driver bcmbca_nand.c
Make use of OF_UPSTREAM which uses Linux dts.
Implement a minimal set of defconfig options to enable basic NAND
functionality. Tested on:
47622
63146
63158
63178
6813
Set parameter_page_big_endian to zero for bcmbca.
Update log level messages so that more critical messages can be logged
to console and help the troubleshooting with field devices.
Currently, the PCI subsystem selects the small "region 2" (which starts at 0x7000000)
as bus_addr/phys_addr. As a consequence, the BAR0 on PCIe video card cannot be initialized,
because it simply doesn't fit into 0x1000000 bytes size of "region 2".
U-Boot should use "region 1" instead (the one which starts at 0x60090000), because
it has much bigger size (0xFF70000), and easily accomodates BAR0 of the video card.
Linux kernel also uses 0x60090000 as bus_start/phys_start.
Signed-off-by: Yuri Zaporozhets <yuriz@vodafonemail.de>
Reviewed-by: Leo Yu-Chi Liang <ycliang@andestech.com>
To restore MMC boot, enable SPL_SYS_MMCSD_RAW_MODE and recover
SYS_MMCSD_RAW_MODE_U_BOOT_USE_PARTITION and
SYS_MMCSD_RAW_MODE_U_BOOT_PARTITION.
Fixes: 2a00d73d081 ("spl: mmc: Try to clean up raw-mode options")
Signed-off-by: Andreas Schwab <schwab@suse.de>
Reviewed-by: Leo Yu-Chi Liang <ycliang@andestech.com>
With the move from script based booting to using bootmeth a lot of
environment variables have changed. To always use the default environment
it is recommendable to erase the environment stored in the SPI flash.
This can be done with the 'env erase' sub-command.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Leo Yu-Chi Liang <ycliang@andestech.com>
If BIOSEMU is compiled for RISC-V (SiFive Unmatched board) and the function
dm_pci_run_vga_bios() is executed, U-Boot stops with error message saying
that the SPL malloc pool is too small. So increase the default pool size
when both BIOSEMU and RISCV parameters are set.
Signed-off-by: Yuri Zaporozhets <yuriz@qrv-systems.net>
Reviewed-by: Leo Yu-Chi Liang <ycliang@andestech.com>
