Merge "project: mdm9607: Define the Signed_Kernel flag" into lk.lnx.1.0-dev.1.0
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 18733d6..892ec72 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -190,6 +190,8 @@
 
 static unsigned page_size = 0;
 static unsigned page_mask = 0;
+static unsigned mmc_blocksize = 0;
+static unsigned mmc_blocksize_mask = 0;
 static char ffbm_mode_string[FFBM_MODE_BUF_SIZE];
 static bool boot_into_ffbm;
 static char *target_boot_params = NULL;
@@ -817,7 +819,7 @@
  * start: Start of the memory region
  * size: Size of the memory region
  */
-int check_aboot_addr_range_overlap(uint32_t start, uint32_t size)
+int check_aboot_addr_range_overlap(uintptr_t start, uint32_t size)
 {
 	/* Check for boundary conditions. */
 	if ((UINT_MAX - start) < size)
@@ -1126,7 +1128,7 @@
 	boot_verifier_init();
 #endif
 
-	if (check_aboot_addr_range_overlap((uint32_t) image_addr, imagesize_actual))
+	if (check_aboot_addr_range_overlap((uintptr_t) image_addr, imagesize_actual))
 	{
 		dprintf(CRITICAL, "Boot image buffer address overlaps with aboot addresses.\n");
 		return -1;
@@ -1146,6 +1148,12 @@
 			(!boot_into_recovery ? "boot" : "recovery"),imagesize_actual);
 	bs_set_timestamp(BS_KERNEL_LOAD_START);
 
+	if ((target_get_max_flash_size() - page_size) < imagesize_actual)
+	{
+		dprintf(CRITICAL, "booimage  size is greater than DDR can hold\n");
+		return -1;
+	}
+
 	/* Read image without signature */
 	if (mmc_read(ptn + offset, (void *)image_addr, imagesize_actual))
 	{
@@ -1171,7 +1179,7 @@
 	if((target_use_signed_kernel() && (!device.is_unlocked)) || is_test_mode_enabled())
 	{
 		offset = imagesize_actual;
-		if (check_aboot_addr_range_overlap((uint32_t)image_addr + offset, page_size))
+		if (check_aboot_addr_range_overlap((uintptr_t)image_addr + offset, page_size))
 		{
 			dprintf(CRITICAL, "Signature read buffer address overlaps with aboot addresses.\n");
 			return -1;
@@ -2305,7 +2313,12 @@
 		}
 	}
 
-	mdtp_activated(&is_mdtp_activated);
+	/* If mdtp state cannot be validate, block fastboot boot*/
+	if(mdtp_activated(&is_mdtp_activated)){
+		dprintf(CRITICAL, "mdtp_activated cannot validate state.\n");
+		dprintf(CRITICAL, "Can not proceed with fastboot boot command.\n");
+		goto boot_failed;
+	}
 	if(is_mdtp_activated){
 		dprintf(CRITICAL, "fastboot boot command is not available.\n");
 		goto boot_failed;
@@ -2622,7 +2635,7 @@
 			}
 
 			size = partition_get_size(index);
-			if (ROUND_TO_PAGE(sz,511) > size) {
+			if (ROUND_TO_PAGE(sz, mmc_blocksize_mask) > size) {
 				fastboot_fail("size too large");
 				return;
 			}
@@ -2641,8 +2654,49 @@
 	int i, images;
 	meta_header_t *meta_header;
 	img_header_entry_t *img_header_entry;
+	/*End of the image address*/
+	uintptr_t data_end;
+
+	if( (UINT_MAX - sz) > (uintptr_t)data )
+		data_end  = (uintptr_t)data + sz;
+	else
+	{
+		fastboot_fail("Cannot  flash: image header corrupt");
+		return;
+	}
+
+	if( data_end < ((uintptr_t)data + sizeof(meta_header_t)))
+	{
+		fastboot_fail("Cannot  flash: image header corrupt");
+		return;
+	}
+
+	/* If device is locked:
+	 * Forbid to flash image to avoid the device to bypass the image
+	 * which with "any" name other than bootloader. Because it maybe
+	 * a meta package of all partitions.
+	 */
+#if VERIFIED_BOOT
+	if (target_build_variant_user()) {
+		if (!device.is_unlocked) {
+			fastboot_fail("Device is locked, meta image flashing is not allowed");
+			return;
+		}
+#if !VBOOT_MOTA
+		if(!device.is_unlock_critical) {
+			fastboot_fail("Device is critical locked, Meta image flashing is not allowed");
+			return;
+		}
+#endif
+	}
+#endif
 
 	meta_header = (meta_header_t*) data;
+	if( data_end < ((uintptr_t)data + meta_header->img_hdr_sz))
+	{
+		fastboot_fail("Cannot  flash: image header corrupt");
+		return;
+	}
 	img_header_entry = (img_header_entry_t*) (data+sizeof(meta_header_t));
 
 	images = meta_header->img_hdr_sz / sizeof(img_header_entry_t);
@@ -2654,6 +2708,13 @@
 			(img_header_entry[i].size == 0))
 			break;
 
+		if( data_end < ((uintptr_t)data + img_header_entry[i].start_offset
+						+ img_header_entry[i].size) )
+		{
+			fastboot_fail("Cannot  flash: image size mismatch");
+			break;
+		}
+
 		cmd_flash_mmc_img(img_header_entry[i].ptn_name,
 					(void *) data + img_header_entry[i].start_offset,
 					img_header_entry[i].size);
@@ -2836,6 +2897,7 @@
 
 			if (data_end < (uintptr_t)data + sizeof(uint32_t)) {
 				fastboot_fail("buffer overreads occured due to invalid sparse header");
+				free(fill_buf);
 				return;
 			}
 			fill_val = *(uint32_t *)data;
@@ -2846,12 +2908,20 @@
 				fill_buf[i] = fill_val;
 			}
 
+			if(total_blocks > (UINT_MAX - chunk_header->chunk_sz))
+			{
+				fastboot_fail("bogus size for chunk FILL type");
+				free(fill_buf);
+				return;
+			}
+
 			for (i = 0; i < chunk_header->chunk_sz; i++)
 			{
 				/* Make sure that the data written to partition does not exceed partition size */
 				if ((uint64_t)total_blocks * (uint64_t)sparse_header->blk_sz + sparse_header->blk_sz > size)
 				{
 					fastboot_fail("Chunk data size for fill type exceeds partition size");
+					free(fill_buf);
 					return;
 				}
 
@@ -3668,6 +3738,8 @@
 	{
 		page_size = mmc_page_size();
 		page_mask = page_size - 1;
+		mmc_blocksize = mmc_get_device_blocksize();
+		mmc_blocksize_mask = mmc_blocksize - 1;
 	}
 	else
 	{
diff --git a/app/aboot/mdtp.c b/app/aboot/mdtp.c
index a38092e..f02eae9 100644
--- a/app/aboot/mdtp.c
+++ b/app/aboot/mdtp.c
@@ -72,7 +72,7 @@
 uint32_t g_mdtp_version = (((MDTP_MAJOR_VERSION << 16) & 0xFFFF0000) | (MDTP_MINOR_VERSION & 0x0000FFFF));
 static int is_mdtp_activated = -1;
 
-int check_aboot_addr_range_overlap(uint32_t start, uint32_t size);
+extern int check_aboot_addr_range_overlap(uintptr_t start, uint32_t size);
 int scm_random(uint32_t * rbuf, uint32_t  r_len);
 extern void mdelay(unsigned msecs);
 void free_mdtp_image(void);
@@ -272,7 +272,7 @@
 
 	/* initiating parameters for hash calculation using HW crypto */
 	target_crypto_init_params();
-	if (check_aboot_addr_range_overlap((uint32_t)buf, ROUNDUP(MDTP_FWLOCK_BLOCK_SIZE, block_size)))
+	if (check_aboot_addr_range_overlap((uintptr_t)buf, ROUNDUP(MDTP_FWLOCK_BLOCK_SIZE, block_size)))
 	{
 		dprintf(CRITICAL, "mdtp: verify_partition_block_hash: %s: image buffer address overlaps with aboot addresses.\n", name);
 		return -1;
@@ -338,7 +338,7 @@
 						uint32_t verify_ratio)
 {
 	if (size == 0 || size > (uint64_t)MDTP_FWLOCK_BLOCK_SIZE * (uint64_t)MAX_BLOCKS ||
-		hash_mode >= MDTP_FWLOCK_MODE_SIZE || verify_ratio > 100)
+		hash_mode > MDTP_FWLOCK_MODE_FILES || verify_ratio > 100)
 	{
 		dprintf(CRITICAL, "mdtp: validate_partition_params: error, size=%llu, hash_mode=%d, verify_ratio=%d\n",
 			size, hash_mode, verify_ratio);
@@ -410,7 +410,7 @@
 	uint32_t pin_length = 0;
 	char entered_pin[MDTP_PIN_LEN+1] = {0};
 	uint32_t i;
-	char pin_mismatch = 0;
+	int pin_mismatch = -1;
 
 	if (mdtp_cfg->enable_local_pin_authentication)
 	{
@@ -434,12 +434,14 @@
 		// (with INVALID_PIN_DELAY_MSECONDS after each failed attempt)
 		while (1)
 		{
+			pin_mismatch = pin_length;
 			get_pin_from_user(entered_pin, pin_length);
 
 			// Go over the entire PIN in any case, to prevent side-channel attacks
 			for (i=0; i<pin_length; i++)
 			{
-				pin_mismatch |= mdtp_cfg->mdtp_pin.mdtp_pin[i] ^ entered_pin[i];
+				// If current digit match, reduce 1 from pin_mismatch
+				pin_mismatch -= (((mdtp_cfg->mdtp_pin.mdtp_pin[i] ^ entered_pin[i]) == 0) ? 1 : 0);
 			}
 
 			if (0 == pin_mismatch)
@@ -455,8 +457,6 @@
 				// for INVALID_PIN_DELAY_MSECONDS), and allow the user to try again
 				dprintf(CRITICAL, "mdtp: display_recovery_ui: ERROR, invalid PIN\n");
 				display_invalid_pin_msg();
-
-				pin_mismatch = 0;
 			}
 		}
 	}
@@ -514,7 +514,7 @@
 		/* 3) Signature may or may not be at the end of the image. Read the signature if needed. */
 		if (!ext_partition->sig_avail)
 		{
-			if (check_aboot_addr_range_overlap((uint32_t)(ext_partition->image_addr + ext_partition->image_size), ext_partition->page_size))
+			if (check_aboot_addr_range_overlap((uintptr_t)(ext_partition->image_addr + ext_partition->image_size), ext_partition->page_size))
 			{
 				dprintf(CRITICAL, "ERROR: Signature read buffer address overlaps with aboot addresses.\n");
 				return -1;
@@ -879,13 +879,18 @@
 	if (dip == NULL)
 	{
 		dprintf(CRITICAL, "mdtp: mdtp_tzbsp_disallow_cipher_DIP: ERROR, cannot allocate DIP\n");
-		return;
+		/* Could not allocate DIP - stop device from booting */
+		display_error_msg(); /* This will never return */
 	}
 
 	/* Disallow the CIPHER_DIP SCM by calling it MAX_CIPHER_DIP_SCM_CALLS times */
 	for (i=0; i<MAX_CIPHER_DIP_SCM_CALLS; i++)
 	{
-		mdtp_tzbsp_enc_hash_DIP(dip, dip);
+		if(mdtp_tzbsp_enc_hash_DIP(dip, dip) != 0)
+		{
+			/* Couldn't disallowd CIPHER_DIP SCM - stop device from booting */
+			display_error_msg(); /* This will never return */
+		}
 	}
 
 	free(dip);
diff --git a/app/aboot/recovery.c b/app/aboot/recovery.c
index 96441e2..8aa4a8c 100644
--- a/app/aboot/recovery.c
+++ b/app/aboot/recovery.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -654,7 +654,7 @@
 		retval = -1;
 		goto cleanup;
 	}
-	ffbm_page_buffer = (char*)malloc(page_size);
+	ffbm_page_buffer = (char*)memalign(CACHE_LINE, page_size);
 	if (!ffbm_page_buffer)
 	{
 		dprintf(CRITICAL, "Failed to alloc buffer for ffbm cookie\n");
diff --git a/dev/gcdb/display/include/panel.h b/dev/gcdb/display/include/panel.h
index 11f471c..3a83bce 100755
--- a/dev/gcdb/display/include/panel.h
+++ b/dev/gcdb/display/include/panel.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -217,6 +217,7 @@
 	uint32_t bpc;		/* target bpc, byte per component */
 	uint32_t slice_per_pkt;
 	uint32_t block_prediction;
+	uint32_t scr_rev;
 };
 
 struct topology_config {
diff --git a/dev/gcdb/display/include/panel_lead_fl10802_fwvga_video.h b/dev/gcdb/display/include/panel_lead_fl10802_fwvga_video.h
new file mode 100644
index 0000000..121dccb
--- /dev/null
+++ b/dev/gcdb/display/include/panel_lead_fl10802_fwvga_video.h
@@ -0,0 +1,296 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials provided
+ *    with the distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef _PANEL_LEAD_FL10802_FWVGA_VIDEO_H_
+#define _PANEL_LEAD_FL10802_FWVGA_VIDEO_H_
+/*---------------------------------------------------------------------------*/
+/* HEADER files                                                              */
+/*---------------------------------------------------------------------------*/
+#include "panel.h"
+
+/*---------------------------------------------------------------------------*/
+/* Panel configuration                                                       */
+/*---------------------------------------------------------------------------*/
+static struct panel_config lead_fl10802_fwvga_video_panel_data = {
+	"qcom,mdss_dsi_lead_fl10802_fwvga_video", "dsi:0:", "qcom,mdss-dsi-panel",
+	10, 0, "DISPLAY_1", 0, 0, 60, 0, 0, 0, 1, 7000, 0, 0, 0, 0, 0, 0, NULL
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel resolution                                                          */
+/*---------------------------------------------------------------------------*/
+static struct panel_resolution lead_fl10802_fwvga_video_panel_res = {
+	480, 854, 94, 84, 60, 0, 18, 12, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel color information                                                   */
+/*---------------------------------------------------------------------------*/
+static struct color_info lead_fl10802_fwvga_video_color = {
+	24, 0, 0xff, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel on/off command information                                          */
+/*---------------------------------------------------------------------------*/
+static char lead_fl10802_fwvga_video_on_cmd0[] = {
+	0x04, 0x00, 0x29, 0xc0,
+	0xb9, 0xf1, 0x08, 0x01,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd1[] = {
+	0x08, 0x00, 0x29, 0xc0,
+	0xb1, 0x22, 0x1a, 0x1a,
+	0x87, 0x30, 0x01, 0xab,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd2[] = {
+	0x02, 0x00, 0x29, 0xc0,
+	0xb2, 0x22, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd3[] = {
+	0x09, 0x00, 0x29, 0xc0,
+	0xb3, 0x01, 0x00, 0x06,
+	0x06, 0x18, 0x13, 0x39,
+	0x35, 0xff, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd4[] = {
+	0x12, 0x00, 0x29, 0xc0,
+	0xba, 0x31, 0x00, 0x44,
+	0x25, 0x91, 0x0a, 0x00,
+	0x00, 0xc1, 0x00, 0x00,
+	0x00, 0x0d, 0x02, 0x4f,
+	0xb9, 0xee, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd5[] = {
+	0x06, 0x00, 0x29, 0xc0,
+	0xe3, 0x09, 0x09, 0x03,
+	0x03, 0x00, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd6[] = {
+	0x02, 0x00, 0x29, 0xc0,
+	0xb4, 0x00, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd7[] = {
+	0x03, 0x00, 0x29, 0xc0,
+	0xb5, 0x07, 0x07, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd8[] = {
+	0x03, 0x00, 0x29, 0xc0,
+	0xb6, 0x32, 0x32, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd9[] = {
+	0x03, 0x00, 0x29, 0xc0,
+	0xb8, 0x64, 0x22, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd10[] = {
+	0x02, 0x00, 0x29, 0xc0,
+	0xc7, 0xa0, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd11[] = {
+	0x03, 0x00, 0x29, 0xc0,
+	0xc8, 0x10, 0x00, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd12[] = {
+	0x02, 0x00, 0x29, 0xc0,
+	0xcc, 0x00, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd13[] = {
+	0x02, 0x00, 0x29, 0xc0,
+	0xbc, 0x47, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd14[] = {
+	0x34, 0x00, 0x29, 0xc0,
+	0xe9, 0x00, 0x00, 0x09,
+	0x03, 0x65, 0x0a, 0x8a,
+	0x10, 0x01, 0x00, 0x37,
+	0x0d, 0x0a, 0x8a, 0x37,
+	0x00, 0x00, 0x18, 0x00,
+	0x00, 0x00, 0x25, 0x09,
+	0x80, 0x40, 0x00, 0x42,
+	0x60, 0x00, 0x00, 0x00,
+	0x09, 0x81, 0x50, 0x01,
+	0x53, 0x70, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd15[] = {
+	0x13, 0x00, 0x29, 0xc0,
+	0xea, 0x94, 0x00, 0x00,
+	0x00, 0x08, 0x95, 0x10,
+	0x07, 0x35, 0x10, 0x00,
+	0x00, 0x00, 0x08, 0x94,
+	0x00, 0x06, 0x24, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd16[] = {
+	0x23, 0x00, 0x29, 0xc0,
+	0xe0, 0x00, 0x00, 0x11,
+	0x0f, 0x10, 0x2a, 0x26,
+	0x34, 0x0c, 0x0f, 0x10,
+	0x14, 0x17, 0x14, 0x16,
+	0x13, 0x17, 0x00, 0x00,
+	0x11, 0x0f, 0x10, 0x2a,
+	0x26, 0x34, 0x0c, 0x0f,
+	0x10, 0x14, 0x17, 0x14,
+	0x16, 0x13, 0x17, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd17[]= {
+	0x02, 0x00, 0x39, 0xc0,
+	0x51, 0x00, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd18[]= {
+	0x02, 0x00, 0x39, 0xc0,
+	0x53, 0x24, 0xff, 0xff,
+};
+
+static char lead_fl10802_fwvga_video_on_cmd19[] = {
+	0x11, 0x00, 0x05, 0x80
+};
+
+static char lead_fl10802_fwvga_video_on_cmd20[] = {
+	0x29, 0x00, 0x05, 0x80
+};
+
+static char lead_fl10802_fwvga_video_on_cmd21[] = {
+	0x02, 0x00, 0x39, 0xc0,
+	0x51, 0x80, 0xff, 0xff,
+};
+
+static struct mipi_dsi_cmd lead_fl10802_fwvga_video_on_command[] = {
+	{sizeof(lead_fl10802_fwvga_video_on_cmd0), lead_fl10802_fwvga_video_on_cmd0, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd1), lead_fl10802_fwvga_video_on_cmd1, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd2), lead_fl10802_fwvga_video_on_cmd2, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd3), lead_fl10802_fwvga_video_on_cmd3, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd4), lead_fl10802_fwvga_video_on_cmd4, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd5), lead_fl10802_fwvga_video_on_cmd5, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd6), lead_fl10802_fwvga_video_on_cmd6, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd7), lead_fl10802_fwvga_video_on_cmd7, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd8), lead_fl10802_fwvga_video_on_cmd8, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd9), lead_fl10802_fwvga_video_on_cmd9, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd10), lead_fl10802_fwvga_video_on_cmd10, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd11), lead_fl10802_fwvga_video_on_cmd11, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd12), lead_fl10802_fwvga_video_on_cmd12, 0x05},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd13), lead_fl10802_fwvga_video_on_cmd13, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd14), lead_fl10802_fwvga_video_on_cmd14, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd15), lead_fl10802_fwvga_video_on_cmd15, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd16), lead_fl10802_fwvga_video_on_cmd16, 0x05},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd17), lead_fl10802_fwvga_video_on_cmd17, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd18), lead_fl10802_fwvga_video_on_cmd18, 0x00},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd19), lead_fl10802_fwvga_video_on_cmd19, 0x78},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd20), lead_fl10802_fwvga_video_on_cmd20, 0x78},
+	{sizeof(lead_fl10802_fwvga_video_on_cmd21), lead_fl10802_fwvga_video_on_cmd21, 0x00},
+};
+
+#define LEAD_FL10802_FWVGA_VIDEO_ON_COMMAND 22
+
+static char lead_fl10802_fwvga_video_off_cmd0[] = {
+	0x28, 0x00, 0x05, 0x80
+};
+
+static char lead_fl10802_fwvga_video_off_cmd1[] = {
+	0x10, 0x00, 0x05, 0x80
+};
+
+static struct mipi_dsi_cmd lead_fl10802_fwvga_video_off_command[] = {
+	{0x4, lead_fl10802_fwvga_video_off_cmd0, 0x32},
+	{0x4, lead_fl10802_fwvga_video_off_cmd1, 0x78}
+};
+
+#define LEAD_FL10802_FWVGA_VIDEO_OFF_COMMAND 2
+
+static struct command_state lead_fl10802_fwvga_video_state = {
+	0, 1
+};
+
+/*---------------------------------------------------------------------------*/
+/* Command mode panel information                                            */
+/*---------------------------------------------------------------------------*/
+static struct commandpanel_info lead_fl10802_fwvga_video_command_panel = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Video mode panel information                                              */
+/*---------------------------------------------------------------------------*/
+static struct videopanel_info lead_fl10802_fwvga_video_video_panel = {
+	1, 0, 0, 0, 1, 1, 2, 0, 0x9
+};
+
+/*---------------------------------------------------------------------------*/
+/* Lane configuration                                                        */
+/*---------------------------------------------------------------------------*/
+static struct lane_configuration lead_fl10802_fwvga_video_lane_config = {
+	2, 0, 1, 1, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel timing                                                              */
+/*---------------------------------------------------------------------------*/
+static const uint32_t lead_fl10802_fwvga_video_timings[] = {
+	0x87, 0x1c, 0x12, 0x00, 0x42, 0x44, 0x18, 0x20, 0x17, 0x03, 0x04, 0x00
+};
+
+static struct panel_timing lead_fl10802_fwvga_video_timing_info = {
+	0, 4, 0x04, 0x1b
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel reset sequence                                                      */
+/*---------------------------------------------------------------------------*/
+static struct panel_reset_sequence lead_fl10802_fwvga_video_reset_seq = {
+	{1, 0, 1, }, {20, 10, 20, }, 2
+};
+
+/*---------------------------------------------------------------------------*/
+/* Backlight setting                                                         */
+/*---------------------------------------------------------------------------*/
+static struct backlight lead_fl10802_fwvga_video_backlight = {
+  BL_DCS, 1, 255, 100, 2, "PMIC_8941"
+};
+
+#define LEAD_FL10802_FWVGA_VIDEO_SIGNATURE 0xFFFF
+
+#endif /*_PANEL_LEAD_FL10802_FWVGA_VIDEO_H_*/
diff --git a/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_cmd.h b/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_cmd.h
index 2e8f306..6320c60 100644
--- a/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_cmd.h
+++ b/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_cmd.h
@@ -333,7 +333,7 @@
 /* DSC									     */
 /*---------------------------------------------------------------------------*/
 struct dsc_parameters nt35597_wqxga_dsc_cmd_params0 = {
-	1, 0, 0, 16, 720, 8, 8, 2, 1
+	1, 1, 0, 16, 720, 8, 8, 2, 1, 0
 };
 
 /* 1LM + 1 DSC_ENC */
diff --git a/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_video.h b/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_video.h
index f1f5247..af9fe14 100644
--- a/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_video.h
+++ b/dev/gcdb/display/include/panel_nt35597_wqxga_dsc_video.h
@@ -320,7 +320,7 @@
 /* DSC									     */
 /*---------------------------------------------------------------------------*/
 struct dsc_parameters nt35597_wqxga_dsc_video_params0 = {
-	1, 0, 0, 16, 720, 8, 8, 2, 1
+	1, 1, 0, 16, 720, 8, 8, 2, 1, 0
 };
 
 /* 1LM + 1 DSC_ENC */
diff --git a/dev/gcdb/display/panel_display.c b/dev/gcdb/display/panel_display.c
index b4084ad..2973de8 100755
--- a/dev/gcdb/display/panel_display.c
+++ b/dev/gcdb/display/panel_display.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -270,6 +270,7 @@
 
 		dsc->major = dsc_params->major;
 		dsc->minor = dsc_params->minor;
+		dsc->scr_rev = dsc_params->scr_rev;
 		dsc->pps_id = dsc_params->pps_id;
 		dsc->slice_height = dsc_params->slice_height;
 		dsc->slice_width = dsc_params->slice_width;
diff --git a/include/platform.h b/include/platform.h
index f3f970b..dd23381 100644
--- a/include/platform.h
+++ b/include/platform.h
@@ -66,7 +66,7 @@
 int platform_is_msm8909();
 int platform_is_msm8992();
 int platform_is_msm8937();
-int platform_is_msmgold();
+int platform_is_msm8917();
 uint32_t platform_get_apcs_ipc_base();
 int platform_is_msm8952();
 int platform_is_msm8953();
diff --git a/platform/msm8952/msm8952-clock.c b/platform/msm8952/msm8952-clock.c
index ea142d7..d6c029f 100644
--- a/platform/msm8952/msm8952-clock.c
+++ b/platform/msm8952/msm8952-clock.c
@@ -650,7 +650,7 @@
 			msm8976_v_1_1_sdcc_clock_modify();
 	}
 
-	if (platform_is_msm8937() || platform_is_msmgold())
+	if (platform_is_msm8937() || platform_is_msm8917())
 		msm8937_clock_override();
 
 	clk_init(msm_clocks_8952, ARRAY_SIZE(msm_clocks_8952));
diff --git a/platform/msm8952/platform.c b/platform/msm8952/platform.c
index 1851c22..251bbb9 100644
--- a/platform/msm8952/platform.c
+++ b/platform/msm8952/platform.c
@@ -177,17 +177,17 @@
 	return 256;
 }
 
-int platform_is_msmgold()
+int platform_is_msm8917()
 {
 	uint32_t platform = board_platform_id();
 	uint32_t ret = 0;
 
 	switch(platform)
 	{
-		case MSMGOLD:
-		case MSMGOLD2:
-		case MSMGOLD3:
-		case APQGOLD:
+		case MSM8917:
+		case MSM8217:
+		case MSM8617:
+		case APQ8017:
 			ret = 1;
 			break;
 		default:
@@ -255,7 +255,7 @@
 
 uint32_t platform_get_tz_app_add()
 {
-	if(platform_is_msm8937())
+	if(platform_is_msm8937() || platform_is_msm8917())
 		return APP_REGION_ADDR_8937;
 	else
 		return APP_REGION_ADDR_8952;
@@ -263,7 +263,7 @@
 
 uint32_t platform_get_tz_app_size()
 {
-	if(platform_is_msm8937())
+	if(platform_is_msm8937() || platform_is_msm8917())
 		return APP_REGION_SIZE_8937;
 	else
 		return APP_REGION_SIZE_8952;
@@ -271,7 +271,7 @@
 
 uint32_t platform_get_apcs_ipc_base()
 {
-	if(platform_is_msmgold())
+	if(platform_is_msm8917())
 		return APCS_ALIAS1_IPC_INTERRUPT_1;
 	else
 		return APCS_ALIAS0_IPC_INTERRUPT_2;
diff --git a/platform/msm8953/platform.c b/platform/msm8953/platform.c
index cd39620..2e275b8 100644
--- a/platform/msm8953/platform.c
+++ b/platform/msm8953/platform.c
@@ -154,6 +154,11 @@
 	return phys_addr;
 }
 
+uint32_t platform_get_max_periph()
+{
+        return 256;
+}
+
 /* DYNAMIC SMEM REGION feature enables LK to dynamically
  * read the SMEM addr info from TCSR_TZ_WONCE register.
  * The first word read, if indicates a MAGIC number, then
diff --git a/platform/msm_shared/dev_tree.c b/platform/msm_shared/dev_tree.c
index 40c24a4..6a73826 100755
--- a/platform/msm_shared/dev_tree.c
+++ b/platform/msm_shared/dev_tree.c
@@ -58,7 +58,7 @@
 /* TODO: This function needs to be moved to target layer to check violations
  * against all the other regions as well.
  */
-extern int check_aboot_addr_range_overlap(uint32_t start, uint32_t size);
+extern int check_aboot_addr_range_overlap(uintptr_t start, uint32_t size);
 
 int fdt_check_header_ext(const void *fdt)
 {
@@ -486,11 +486,6 @@
 			break;
 		dtb_size = fdt_totalsize(&dtb_hdr);
 
-		if (check_aboot_addr_range_overlap((uint32_t)tags, dtb_size)) {
-			dprintf(CRITICAL, "Tags addresses overlap with aboot addresses.\n");
-			return NULL;
-		}
-
 		dev_tree_compatible(dtb, dtb_size, dt_entry_queue);
 
 		/* goto the next device tree if any */
@@ -521,6 +516,10 @@
 	}
 
 	if(bestmatch_tag) {
+		if (check_aboot_addr_range_overlap((uintptr_t)tags, bestmatch_tag_size)) {
+			dprintf(CRITICAL, "Tags addresses overlap with aboot addresses.\n");
+			return NULL;
+		}
 		memcpy(tags, bestmatch_tag, bestmatch_tag_size);
 		/* clear out the old DTB magic so kernel doesn't find it */
 		*((uint32_t *)(kernel + app_dtb_offset)) = 0;
diff --git a/platform/msm_shared/display_menu.c b/platform/msm_shared/display_menu.c
index c955e1b..fb4e0a8 100644
--- a/platform/msm_shared/display_menu.c
+++ b/platform/msm_shared/display_menu.c
@@ -94,7 +94,8 @@
 		[0] = "START\n",
 		[1] = "Restart bootloader\n",
 		[2] = "Recovery mode\n",
-		[3] = "Power off\n"};
+		[3] = "Power off\n",
+		[4] = "Boot to FFBM\n"};
 
 static int big_factor = 2;
 static int common_factor = 1;
@@ -362,6 +363,7 @@
 			msg_type = FBCON_RED_MSG;
 			break;
 		case 3:
+		case 4:
 			msg_type = FBCON_COMMON_MSG;
 			break;
 	}
diff --git a/platform/msm_shared/include/mdp5.h b/platform/msm_shared/include/mdp5.h
index 05cd121..2a72772 100644
--- a/platform/msm_shared/include/mdp5.h
+++ b/platform/msm_shared/include/mdp5.h
@@ -95,7 +95,7 @@
 #define MDSS_MDP_HW_REV_112    MDSS_MDP_REV(1, 12, 0) /* 8952 v1.0 */
 #define MDSS_MDP_HW_REV_114    MDSS_MDP_REV(1, 14, 0) /* 8937 v1.0 */
 #define MDSS_MDP_HW_REV_116    MDSS_MDP_REV(1, 16, 0) /* msm8953 */
-#define MDSS_MDP_HW_REV_115    MDSS_MDP_REV(1, 15, 0) /* msmgold v1.0 */
+#define MDSS_MDP_HW_REV_115    MDSS_MDP_REV(1, 15, 0) /* msm8917 v1.0 */
 #define MDSS_MDP_HW_REV_200    MDSS_MDP_REV(2, 0, 0) /* 8092 v1.0 */
 
 #define MDSS_MAX_LINE_BUF_WIDTH 2048
diff --git a/platform/msm_shared/include/menu_keys_detect.h b/platform/msm_shared/include/menu_keys_detect.h
index 2d51aa1..4f904c4 100644
--- a/platform/msm_shared/include/menu_keys_detect.h
+++ b/platform/msm_shared/include/menu_keys_detect.h
@@ -37,6 +37,7 @@
 	BACK,
 
 	CONTINUE,
+	FFBM,
 };
 
 enum keys_option {
diff --git a/platform/msm_shared/include/msm_panel.h b/platform/msm_shared/include/msm_panel.h
index 7ea7805..4c44cc4 100644
--- a/platform/msm_shared/include/msm_panel.h
+++ b/platform/msm_shared/include/msm_panel.h
@@ -148,6 +148,7 @@
 
 	int major;
 	int minor;
+	int scr_rev;
 	int pps_id;
 
 	int pic_height;
diff --git a/platform/msm_shared/menu_keys_detect.c b/platform/msm_shared/menu_keys_detect.c
index d3bc107..7430329 100644
--- a/platform/msm_shared/menu_keys_detect.c
+++ b/platform/msm_shared/menu_keys_detect.c
@@ -88,6 +88,7 @@
 		[1] = FASTBOOT,
 		[2] = RECOVER,
 		[3] = POWEROFF,
+		[4] = FFBM,
 };
 
 static uint32_t unlock_index_action[] = {
@@ -111,6 +112,7 @@
 
 static void update_device_status(struct select_msg_info* msg_info, int reason)
 {
+	char ffbm_page_buffer[FFBM_MODE_BUF_SIZE];
 	fbcon_clear();
 	switch (reason) {
 		case RECOVER:
@@ -150,6 +152,12 @@
 			before_time = current_time();
 
 			break;
+		case FFBM:
+			snprintf(ffbm_page_buffer, sizeof(ffbm_page_buffer), "ffbm-00");
+			write_misc(0, ffbm_page_buffer, sizeof(ffbm_page_buffer));
+
+			reboot_device(0);
+			break;
 	}
 }
 
diff --git a/platform/msm_shared/mipi_dsc.c b/platform/msm_shared/mipi_dsc.c
index a4ee313..c581855 100644
--- a/platform/msm_shared/mipi_dsc.c
+++ b/platform/msm_shared/mipi_dsc.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2106, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -41,10 +41,14 @@
  */
 static char dsc_rc_buf_thresh[] = {0x0e, 0x1c, 0x2a, 0x38, 0x46, 0x54,
 		0x62, 0x69, 0x70, 0x77, 0x79, 0x7b, 0x7d, 0x7e};
-static char dsc_rc_range_min_qp[] = {0, 0, 1, 1, 3, 3, 3, 3, 3, 3, 5,
+static char dsc_rc_range_min_qp_1_1[] = {0, 0, 1, 1, 3, 3, 3, 3, 3, 3, 5,
 				5, 5, 7, 13};
-static char dsc_rc_range_max_qp[] = {4, 4, 5, 6, 7, 7, 7, 8, 9, 10, 11,
+static char dsc_rc_range_min_qp_1_1_scr1[] = {0, 0, 1, 1, 3, 3, 3, 3, 3, 3, 5,
+				5, 5, 9, 12};
+static char dsc_rc_range_max_qp_1_1[] = {4, 4, 5, 6, 7, 7, 7, 8, 9, 10, 11,
 			 12, 13, 13, 15};
+static char dsc_rc_range_max_qp_1_1_scr1[] = {4, 4, 5, 6, 7, 7, 7, 8, 9, 10, 10,
+			 11, 11, 12, 13};
 static char dsc_rc_range_bpg_offset[] = {2, 0, 0, -2, -4, -6, -8, -8,
 			-8, -10, -10, -12, -12, -12, -12};
 
@@ -66,79 +70,73 @@
 	*bp++ = 0xc0;	/* last + long pkt */
 
 	/* pps payload */
-	*bp++ = ((dsc->major << 4) | dsc->minor);	/* pps0 */
-	*bp++ = dsc->pps_id;				/* pps1 */
+	*bp++ = (((dsc->major & 0xf) << 4) | (dsc->minor & 0xf));	/* pps0 */
+	*bp++ = (dsc->pps_id & 0xff);		/* pps1 */
 	bp++;					/* pps2, reserved */
 
 	data = dsc->line_buf_depth & 0x0f;
-	data |= (dsc->bpc << 4);
+	data |= ((dsc->bpc & 0xf) << 4);
 	*bp++ = data;				 /* pps3 */
 
 	bpp = dsc->bpp;
 	bpp <<= 4;	/* 4 fraction bits */
 	data = (bpp >> 8);
 	data &= 0x03;		/* upper two bits */
-	data |= (dsc->block_pred_enable << 5);
-	data |= (dsc->convert_rgb << 4);
-	data |= (dsc->enable_422 << 3);
-	data |= (dsc->vbr_enable << 2);
+	data |= ((dsc->block_pred_enable & 0x1) << 5);
+	data |= ((dsc->convert_rgb & 0x1) << 4);
+	data |= ((dsc->enable_422 & 0x1) << 3);
+	data |= ((dsc->vbr_enable & 0x1) << 2);
 	*bp++ = data;				/* pps4 */
 	*bp++ = bpp;				/* pps5 */
 
-	*bp++ = (dsc->pic_height >> 8);		/* pps6 */
+	*bp++ = ((dsc->pic_height >> 8) & 0xff); /* pps6 */
 	*bp++ = (dsc->pic_height & 0x0ff);	/* pps7 */
-	*bp++ = (dsc->pic_width >> 8);		/* pps8 */
+	*bp++ = ((dsc->pic_width >> 8) & 0xff);	/* pps8 */
 	*bp++ = (dsc->pic_width & 0x0ff);	/* pps9 */
 
-	*bp++ = (dsc->slice_height >> 8);	/* pps10 */
+	*bp++ = ((dsc->slice_height >> 8) & 0xff);/* pps10 */
 	*bp++ = (dsc->slice_height & 0x0ff);	/* pps11 */
-	*bp++ = (dsc->slice_width >> 8);	/* pps12 */
+	*bp++ = ((dsc->slice_width >> 8) & 0xff); /* pps12 */
 	*bp++ = (dsc->slice_width & 0x0ff);	/* pps13 */
 
-	*bp++ = (dsc->chunk_size >> 8);		/* pps14 */
+	*bp++ = ((dsc->chunk_size >> 8) & 0xff);/* pps14 */
 	*bp++ = (dsc->chunk_size & 0x0ff);	/* pps15 */
 
-	data = dsc->initial_xmit_delay >> 8;
-	data &= 0x03;
-	*bp++ = data;				/* pps16, bit 0, 1 */
-	*bp++ = dsc->initial_xmit_delay;	/* pps17 */
+	*bp++ = (dsc->initial_xmit_delay >> 8) & 0x3; /* pps16, bit 0, 1 */
+	*bp++ = (dsc->initial_xmit_delay & 0xff);/* pps17 */
 
-	*bp++ = (dsc->initial_dec_delay >> 8);	/* pps18 */
-	*bp++ = dsc->initial_dec_delay;		/* pps19 */
+	*bp++ = ((dsc->initial_dec_delay >> 8) & 0xff);	/* pps18 */
+	*bp++ = (dsc->initial_dec_delay & 0xff);/* pps19 */
 
 	bp++;					/* pps20, reserved */
 
 	*bp++ = (dsc->initial_scale_value & 0x3f); /* pps21 */
 
-	data = (dsc->scale_increment_interval >> 8);
-	data &= 0x0f;
-	*bp++ =  data;				/* pps22 */
-	*bp++ = dsc->scale_increment_interval;	/* pps23 */
+	*bp++ = ((dsc->scale_increment_interval >> 8) & 0xff); /* pps22 */
+	*bp++ = (dsc->scale_increment_interval & 0xff);	/* pps23 */
 
-	data = (dsc->scale_decrement_interval >> 8);
-	data &= 0x0f;
-	*bp++ = data;				/* pps24 */
+	*bp++ = ((dsc->scale_decrement_interval >> 8) & 0xf); /* pps24 */
 	*bp++ = (dsc->scale_decrement_interval & 0x0ff);/* pps25 */
 
 	bp++;			/* pps26, reserved */
 
 	*bp++ = (dsc->first_line_bpg_offset & 0x1f);/* pps27 */
 
-	*bp++ = (dsc->nfl_bpg_offset >> 8);	/* pps28 */
+	*bp++ = ((dsc->nfl_bpg_offset >> 8) & 0xff);/* pps28 */
 	*bp++ = (dsc->nfl_bpg_offset & 0x0ff);	/* pps29 */
-	*bp++ = (dsc->slice_bpg_offset >> 8);	/* pps30 */
+	*bp++ = ((dsc->slice_bpg_offset >> 8) & 0xff);/* pps30 */
 	*bp++ = (dsc->slice_bpg_offset & 0x0ff);/* pps31 */
 
-	*bp++ = (dsc->initial_offset >> 8);	/* pps32 */
+	*bp++ = ((dsc->initial_offset >> 8) & 0xff);/* pps32 */
 	*bp++ = (dsc->initial_offset & 0x0ff);	/* pps33 */
 
-	*bp++ = (dsc->final_offset >> 8);	/* pps34 */
+	*bp++ = ((dsc->final_offset >> 8) & 0xff);/* pps34 */
 	*bp++ = (dsc->final_offset & 0x0ff);	/* pps35 */
 
 	*bp++ = (dsc->min_qp_flatness & 0x1f);	/* pps36 */
 	*bp++ = (dsc->max_qp_flatness & 0x1f);	/* pps37 */
 
-	*bp++ = (dsc->rc_model_size >> 8);	/* pps38 */
+	*bp++ = ((dsc->rc_model_size >> 8) & 0xff);/* pps38 */
 	*bp++ = (dsc->rc_model_size & 0x0ff);	/* pps39 */
 
 	*bp++ = (dsc->edge_factor & 0x0f);	/* pps40 */
@@ -146,12 +144,12 @@
 	*bp++ = (dsc->quant_incr_limit0 & 0x1f);	/* pps41 */
 	*bp++ = (dsc->quant_incr_limit1 & 0x1f);	/* pps42 */
 
-	data = (dsc->tgt_offset_hi << 4);
+	data = ((dsc->tgt_offset_hi & 0xf) << 4);
 	data |= (dsc->tgt_offset_lo & 0x0f);
 	*bp++ = data;				/* pps43 */
 
 	for (i = 0; i < 14; i++)
-		*bp++ = dsc->buf_thresh[i];	/* pps44 - pps57 */
+		*bp++ = (dsc->buf_thresh[i] & 0xff);/* pps44 - pps57 */
 
 	for (i = 0; i < 15; i++) {		/* pps58 - pps87 */
 		data = (dsc->range_min_qp[i] & 0x1f); /* 5 bits */
@@ -196,10 +194,16 @@
 	int data;
 	int final_value, final_scale;
 	int slice_per_line, bytes_in_slice, total_bytes;
+	int version;
 
 	dsc = &pinfo->dsc;
+	version = (((dsc->major & 0xf) << 4) | (dsc->minor & 0xf));
+
 	dsc->rc_model_size = 8192;	/* rate_buffer_size */
-	dsc->first_line_bpg_offset = 12;
+	if (version == 0x11 && dsc->scr_rev == 0x1)
+		dsc->first_line_bpg_offset = 15;
+	else
+		dsc->first_line_bpg_offset = 12;
 	dsc->min_qp_flatness = 3;
 	dsc->max_qp_flatness = 12;
 	dsc->line_buf_depth = 9;
@@ -211,8 +215,13 @@
 	dsc->tgt_offset_lo = 3;
 
 	dsc->buf_thresh = dsc_rc_buf_thresh;
-	dsc->range_min_qp = dsc_rc_range_min_qp;
-	dsc->range_max_qp = dsc_rc_range_max_qp;
+	if (version == 0x11 && dsc->scr_rev == 0x1) {
+		dsc->range_min_qp = dsc_rc_range_min_qp_1_1_scr1;
+		dsc->range_max_qp = dsc_rc_range_max_qp_1_1_scr1;
+	} else {
+		dsc->range_min_qp = dsc_rc_range_min_qp_1_1;
+		dsc->range_max_qp = dsc_rc_range_max_qp_1_1;
+	}
 	dsc->range_bpg_offset = dsc_rc_range_bpg_offset;
 
 	dsc->pic_width = pinfo->xres;
diff --git a/platform/msm_shared/qusb2_phy.c b/platform/msm_shared/qusb2_phy.c
index c682727..93c4f53 100644
--- a/platform/msm_shared/qusb2_phy.c
+++ b/platform/msm_shared/qusb2_phy.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -49,6 +49,11 @@
 	return 0;
 }
 
+__WEAK int platform_is_msm8953()
+{
+	return 0;
+}
+
 void qusb2_phy_reset(void)
 {
 	uint32_t val;
@@ -75,7 +80,7 @@
 	/* set CLAMP_N_EN and stay with disabled USB PHY */
 	writel(0x23, QUSB2PHY_PORT_POWERDOWN);
 
-	if (platform_is_msm8996() || platform_is_mdmcalifornium())
+	if (platform_is_msm8996() || platform_is_mdmcalifornium() || platform_is_msm8953())
 	{
 		writel(0xF8, QUSB2PHY_PORT_TUNE1);
 		/* Upper nibble of tune2 register should be updated based on the fuse value.
diff --git a/platform/msm_shared/rpmb/rpmb_emmc.c b/platform/msm_shared/rpmb/rpmb_emmc.c
index 7250505..dbf7664 100644
--- a/platform/msm_shared/rpmb/rpmb_emmc.c
+++ b/platform/msm_shared/rpmb/rpmb_emmc.c
@@ -150,7 +150,7 @@
 
 int rpmb_read_emmc(struct mmc_device *dev, uint32_t *req_buf, uint32_t blk_cnt, uint32_t *resp_buf, uint32_t *resp_len)
 {
-	struct mmc_command cmd[3] = {{0}, {0}, {0}};
+	struct mmc_command cmd[3] = {{0},{0},{0}};
 	int ret = 0;
 	struct rpmb_frame *result = (struct rpmb_frame *)resp_buf;
 
diff --git a/platform/msm_shared/smem.h b/platform/msm_shared/smem.h
index c4e9699..d2e67d8 100644
--- a/platform/msm_shared/smem.h
+++ b/platform/msm_shared/smem.h
@@ -448,12 +448,12 @@
 	MSM8937 = 294,
 	APQ8037 = 295,
 	MSM8996L = 302,
-	MSMGOLD = 303,
+	MSM8917  = 303,
 	APQ8053 = 304,
 	MSM8996SG = 305,
-	APQGOLD = 307,
-	MSMGOLD2 = 308,
-	MSMGOLD3 = 309,
+	APQ8017 = 307,
+	MSM8217 = 308,
+	MSM8617 = 309,
 	MSM8996AU = 310,
 	APQ8096AU = 311,
 	APQ8096SG = 312,
diff --git a/project/msm8953.mk b/project/msm8953.mk
index 9787a5a..9582017 100644
--- a/project/msm8953.mk
+++ b/project/msm8953.mk
@@ -102,8 +102,10 @@
 #Enable the external reboot functions
 ENABLE_REBOOT_MODULE := 1
 
+ifeq ($(VERIFIED_BOOT),1)
 #Enable MDTP feature
 ENABLE_MDTP_SUPPORT := 1
+endif
 
 ifeq ($(ENABLE_MDTP_SUPPORT),1)
 DEFINES += MDTP_SUPPORT=1
diff --git a/project/msm8996.mk b/project/msm8996.mk
index 5978add..50ec0b7 100644
--- a/project/msm8996.mk
+++ b/project/msm8996.mk
@@ -92,7 +92,9 @@
 DEFINES += ENABLE_PARTIAL_GOODS_SUPPORT=1
 endif
 
+ifeq ($(VERIFIED_BOOT),1)
 ENABLE_MDTP_SUPPORT := 1
+endif
 
 ifeq ($(ENABLE_MDTP_SUPPORT),1)
 DEFINES += MDTP_SUPPORT=1
diff --git a/target/init.c b/target/init.c
index 728402d..ba2e608 100644
--- a/target/init.c
+++ b/target/init.c
@@ -270,10 +270,10 @@
 			break;
 		case MSM8937:
 		case APQ8037:
-		case MSMGOLD:
-		case MSMGOLD2:
-		case MSMGOLD3:
-		case APQGOLD:
+		case MSM8917:
+		case MSM8217:
+		case MSM8617:
+		case APQ8017:
 		case MSM8953:
 		case APQ8053:
 			config->vib_type = VIB_LRA_TYPE;
diff --git a/target/msm8952/init.c b/target/msm8952/init.c
index 43e1b2e..3262b61 100644
--- a/target/msm8952/init.c
+++ b/target/msm8952/init.c
@@ -78,6 +78,7 @@
 #define TLMM_VOL_UP_BTN_GPIO    85
 #define TLMM_VOL_UP_BTN_GPIO_8956 113
 #define TLMM_VOL_UP_BTN_GPIO_8937 91
+#define TLMM_VOL_DOWN_BTN_GPIO    128
 
 #define FASTBOOT_MODE           0x77665500
 #define RECOVERY_MODE           0x77665502
@@ -91,6 +92,7 @@
 #define CE_READ_PIPE_LOCK_GRP   0
 #define CE_WRITE_PIPE_LOCK_GRP  0
 #define CE_ARRAY_SIZE           20
+#define SUB_TYPE_SKUT           0x0A
 
 struct mmc_device *dev;
 
@@ -185,7 +187,7 @@
 
 	if(platform_is_msm8956())
 		vol_up_gpio = TLMM_VOL_UP_BTN_GPIO_8956;
-	else if(platform_is_msm8937() || platform_is_msmgold())
+	else if(platform_is_msm8937() || platform_is_msm8917())
 		vol_up_gpio = TLMM_VOL_UP_BTN_GPIO_8937;
 	else
 		vol_up_gpio = TLMM_VOL_UP_BTN_GPIO;
@@ -209,8 +211,29 @@
 /* Return 1 if vol_down pressed */
 uint32_t target_volume_down()
 {
-	/* Volume down button tied in with PMIC RESIN. */
-	return pm8x41_resin_status();
+	static  bool vol_down_key_init = false;
+
+	if ((board_hardware_id() == HW_PLATFORM_QRD) &&
+			(board_hardware_subtype() == SUB_TYPE_SKUT)) {
+		uint32_t status = 0;
+
+		if (!vol_down_key_init) {
+			gpio_tlmm_config(TLMM_VOL_DOWN_BTN_GPIO, 0, GPIO_INPUT, GPIO_PULL_UP,
+				 GPIO_2MA, GPIO_ENABLE);
+			/* Wait for the gpio config to take effect - debounce time */
+			thread_sleep(10);
+			vol_down_key_init = true;
+		}
+
+		/* Get status of GPIO */
+		status = gpio_status(TLMM_VOL_DOWN_BTN_GPIO);
+
+		/* Active low signal. */
+		return !status;
+	} else {
+		/* Volume down button tied in with PMIC RESIN. */
+		return pm8x41_resin_status();
+	}
 }
 
 uint32_t target_is_pwrkey_pon_reason()
@@ -263,7 +286,7 @@
 
 	spmi_init(PMIC_ARB_CHANNEL_NUM, PMIC_ARB_OWNER_ID);
 
-	if(platform_is_msm8937() || platform_is_msmgold())
+	if(platform_is_msm8937() || platform_is_msm8917())
 	{
 		uint8_t pmi_rev = 0;
 		uint32_t pmi_type = 0;
@@ -375,16 +398,16 @@
 	case MSM8956:
 	case MSM8976:
 	case MSM8937:
-	case MSMGOLD:
-	case MSMGOLD2:
-	case MSMGOLD3:
+	case MSM8917:
+	case MSM8217:
+	case MSM8617:
 		board->baseband = BASEBAND_MSM;
 		break;
 	case APQ8052:
 	case APQ8056:
 	case APQ8076:
 	case APQ8037:
-	case APQGOLD:
+	case APQ8017:
 		board->baseband = BASEBAND_APQ;
 		break;
 	default:
diff --git a/target/msm8952/mdtp_defs.c b/target/msm8952/mdtp_defs.c
index a1ef897..4e15ea8 100644
--- a/target/msm8952/mdtp_defs.c
+++ b/target/msm8952/mdtp_defs.c
@@ -58,7 +58,7 @@
         target_efuse->address = MDTP_EFUSE_ADDRESS_MSM8952;
         target_efuse->start = MDTP_EFUSE_START_MSM8952;
     }
-    else if (platform_is_msm8937() || platform_is_msmgold())
+    else if (platform_is_msm8937() || platform_is_msm8917())
     {
         target_efuse->address = MDTP_EFUSE_ADDRESS_MSM8937;
         target_efuse->start = MDTP_EFUSE_START_MSM8937;
diff --git a/target/msm8952/oem_panel.c b/target/msm8952/oem_panel.c
index 3da5af1..e01dfd0 100755
--- a/target/msm8952/oem_panel.c
+++ b/target/msm8952/oem_panel.c
@@ -62,6 +62,7 @@
 #include "include/panel_truly_720p_video.h"
 #include "include/panel_truly_wuxga_video.h"
 #include "include/panel_truly_720p_cmd.h"
+#include "include/panel_lead_fl10802_fwvga_video.h"
 
 /*---------------------------------------------------------------------------*/
 /* static panel selection variable                                           */
@@ -84,6 +85,7 @@
 	TRULY_720P_VIDEO_PANEL,
 	TRULY_WUXGA_VIDEO_PANEL,
 	TRULY_720P_CMD_PANEL,
+	LEAD_FL10802_FWVGA_VIDEO_PANEL,
 	UNKNOWN_PANEL
 };
 
@@ -113,6 +115,7 @@
 	{"truly_720p_video", TRULY_720P_VIDEO_PANEL},
 	{"truly_wuxga_video", TRULY_WUXGA_VIDEO_PANEL},
 	{"truly_720p_cmd", TRULY_720P_CMD_PANEL},
+	{"lead_fl10802_fwvga_video", LEAD_FL10802_FWVGA_VIDEO_PANEL},
 };
 
 static uint32_t panel_id;
@@ -678,6 +681,33 @@
 		pinfo->mipi.signature 	= TRULY_720P_CMD_SIGNATURE;
 		pinfo->mipi.tx_eot_append = true;
 		break;
+	case LEAD_FL10802_FWVGA_VIDEO_PANEL:
+		panelstruct->paneldata = &lead_fl10802_fwvga_video_panel_data;
+		panelstruct->panelres = &lead_fl10802_fwvga_video_panel_res;
+		panelstruct->color = &lead_fl10802_fwvga_video_color;
+		panelstruct->videopanel = &lead_fl10802_fwvga_video_video_panel;
+		panelstruct->commandpanel
+				= &lead_fl10802_fwvga_video_command_panel;
+		panelstruct->state = &lead_fl10802_fwvga_video_state;
+		panelstruct->laneconfig = &lead_fl10802_fwvga_video_lane_config;
+		panelstruct->paneltiminginfo
+				= &lead_fl10802_fwvga_video_timing_info;
+		panelstruct->panelresetseq
+				= &lead_fl10802_fwvga_video_reset_seq;
+		panelstruct->backlightinfo
+				= &lead_fl10802_fwvga_video_backlight;
+		pinfo->mipi.panel_on_cmds
+				= lead_fl10802_fwvga_video_on_command;
+		pinfo->mipi.num_of_panel_on_cmds
+				= LEAD_FL10802_FWVGA_VIDEO_ON_COMMAND;
+		pinfo->mipi.panel_off_cmds
+				= lead_fl10802_fwvga_video_off_command;
+		pinfo->mipi.num_of_panel_off_cmds
+				= LEAD_FL10802_FWVGA_VIDEO_OFF_COMMAND;
+		memcpy(phy_db->timing,
+				lead_fl10802_fwvga_video_timings, TIMING_SIZE);
+		pinfo->mipi.signature = LEAD_FL10802_FWVGA_VIDEO_SIGNATURE;
+		break;
 	case UNKNOWN_PANEL:
 	default:
 		memset(panelstruct, 0, sizeof(struct panel_struct));
@@ -738,7 +768,7 @@
 	case HW_PLATFORM_MTP:
 		if (platform_is_msm8956())
 			panel_id = NT35597_WQXGA_DUALDSI_VIDEO_PANEL;
-		else if (platform_is_msmgold())
+        else if (platform_is_msm8917())
 			panel_id = TRULY_720P_VIDEO_PANEL;
 		else
 			panel_id = TRULY_1080P_VIDEO_PANEL;
@@ -747,7 +777,7 @@
 	case HW_PLATFORM_RCM:
 		if (platform_is_msm8956())
 			panel_id = NT35597_WQXGA_DUALDSI_VIDEO_PANEL;
-		else if (platform_is_msmgold())
+        else if (platform_is_msm8917())
 			panel_id = TRULY_720P_VIDEO_PANEL;
 		else
 			panel_id = TRULY_1080P_VIDEO_PANEL;
@@ -793,8 +823,11 @@
 					return PANEL_TYPE_UNKNOWN;
 			}
 			auto_pan_loop++;
-		} else if (platform_is_msmgold()) {
-			panel_id = HX8394F_720P_VIDEO_PANEL;
+		} else if (platform_is_msm8917()) {
+			if (hw_subtype == 0x0A) /* TMO target */
+				panel_id = LEAD_FL10802_FWVGA_VIDEO_PANEL;
+			else
+				panel_id = HX8394F_720P_VIDEO_PANEL;
 		}
 
 		break;
diff --git a/target/msm8952/target_display.c b/target/msm8952/target_display.c
index 1e5b796..6749bf8 100644
--- a/target/msm8952/target_display.c
+++ b/target/msm8952/target_display.c
@@ -311,7 +311,7 @@
 	pll_data->vco_delay = VCO_DELAY_USEC;
 
 	/* SSC parameters */
-	if (platform_is_msm8937() || platform_is_msmgold()) {
+	if (platform_is_msm8937() || platform_is_msm8917()) {
 		pll_data->ssc_en = true;
 		pll_data->is_center_spread = false;
 		pll_data->ssc_freq = 30000;
@@ -372,7 +372,7 @@
 		reset_gpio.pin_id = 60;
 		bkl_gpio.pin_id = 98;
 		enable_gpio.pin_id = 99;
-	} else if (platform_is_msmgold()) {
+	} else if (platform_is_msm8917()) {
 		reset_gpio.pin_id = 60;
 		bkl_gpio.pin_id = 98;
 		pinfo->mipi.use_enable_gpio = 0;
@@ -515,7 +515,7 @@
 int target_display_get_base_offset(uint32_t base)
 {
 	if(platform_is_msm8956() || platform_is_msm8937() ||
-			platform_is_msmgold()) {
+			platform_is_msm8917()) {
 		if (base == MIPI_DSI0_BASE)
 			return DSI0_BASE_ADJUST;
 		else if (base == DSI0_PHY_BASE)