Merge "dev: gcdb: add gcdb panel header for Truly 720p cmd mode" into lk.lnx.1.0-dev.1.0
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index cbe9dff..e12754b 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -1178,20 +1178,6 @@
 		aboot_save_boot_hash_mmc((uint32_t) image_addr, imagesize_actual);
 		#endif /* TZ_SAVE_KERNEL_HASH */
 
-#if VERIFIED_BOOT
-	if(boot_verify_get_state() == ORANGE)
-	{
-#if FBCON_DISPLAY_MSG
-		display_bootverify_menu(DISPLAY_MENU_ORANGE);
-		wait_for_users_action();
-#else
-		dprintf(CRITICAL,
-			"Your device has been unlocked and can't be trusted.\nWait for 5 seconds before proceeding\n");
-		mdelay(5000);
-#endif
-	}
-#endif
-
 #ifdef MDTP_SUPPORT
 		{
 			/* Verify MDTP lock.
@@ -1211,6 +1197,20 @@
 	}
 
 #if VERIFIED_BOOT
+	if(boot_verify_get_state() == ORANGE)
+	{
+#if FBCON_DISPLAY_MSG
+		display_bootverify_menu(DISPLAY_MENU_ORANGE);
+		wait_for_users_action();
+#else
+		dprintf(CRITICAL,
+			"Your device has been unlocked and can't be trusted.\nWait for 5 seconds before proceeding\n");
+		mdelay(5000);
+#endif
+	}
+#endif
+
+#if VERIFIED_BOOT
 #if !VBOOT_MOTA
 	// send root of trust
 	if(!send_rot_command((uint32_t)device.is_unlocked))
diff --git a/app/aboot/mdtp.c b/app/aboot/mdtp.c
index 21abc12..a2d52bf 100644
--- a/app/aboot/mdtp.c
+++ b/app/aboot/mdtp.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -42,6 +42,8 @@
 #include <image_verify.h>
 #include "scm.h"
 #include "mdtp.h"
+#include "mdtp_fs.h"
+
 
 #define DIP_ENCRYPT              (0)
 #define DIP_DECRYPT              (1)
@@ -50,6 +52,8 @@
 #define MDTP_MAJOR_VERSION (0)
 #define MDTP_MINOR_VERSION (2)
 
+#define MDTP_CORRECT_PIN_DELAY_MSEC (1000)
+
 /** Extract major version number from complete version. */
 #define MDTP_GET_MAJOR_VERSION(version) ((version) >> 16)
 
@@ -62,6 +66,7 @@
 
 int check_aboot_addr_range_overlap(uint32_t start, uint32_t size);
 int scm_random(uint32_t * rbuf, uint32_t  r_len);
+extern void mdelay(unsigned msecs);
 void free_mdtp_image(void);
 
 /********************************************************************************/
@@ -205,6 +210,12 @@
 
 	/* calculating the hash value using HW crypto */
 	target_crypto_init_params();
+
+	if(strcmp(name, "mdtp") == 0){
+		buf[0] = 0; // removes first byte
+		dprintf(INFO, "mdtp: verify_partition_single_hash: removes 1st byte\n");
+	}
+
 	hash_find(buf, size, digest, CRYPTO_AUTH_ALG_SHA256);
 
 	if (memcmp(digest, hash_table->hash, HASH_LEN))
@@ -380,6 +391,11 @@
 	return 0;
 }
 
+/* Display the recovery UI in case mdtp image is corrupted */
+static void display_mdtp_fail_recovery_ui(){
+	display_error_msg_mdtp();
+}
+
 /* Display the recovery UI to allow the user to enter the PIN and continue boot */
 static void display_recovery_ui(mdtp_cfg_t *mdtp_cfg)
 {
@@ -445,6 +461,7 @@
 	out:
 	display_image_on_screen();
 	free_mdtp_image();
+	mdelay(MDTP_CORRECT_PIN_DELAY_MSEC);
 }
 
 /* Verify the boot or recovery partitions using boot_verifier. */
@@ -550,6 +567,7 @@
 {
 	int i;
 	int verify_failure = 0;
+	int verify_temp_result = 0;
 	int ext_partition_verify_failure = 0;
 	uint32_t total_num_blocks;
 
@@ -575,6 +593,7 @@
 		{
 			for(i=0; i<MAX_PARTITIONS; i++)
 			{
+				verify_temp_result = 0;
 				if(dip->partition_cfg[i].lock_enabled && dip->partition_cfg[i].size)
 				{
 					total_num_blocks = ((dip->partition_cfg[i].size - 1) / MDTP_FWLOCK_BLOCK_SIZE);
@@ -587,12 +606,18 @@
 						break;
 					}
 
-					verify_failure |= (verify_partition(dip->partition_cfg[i].name,
+					verify_temp_result |= (verify_partition(dip->partition_cfg[i].name,
 							dip->partition_cfg[i].size,
 							dip->partition_cfg[i].hash_mode,
 							(dip->partition_cfg[i].verify_ratio * total_num_blocks) / 100,
 							dip->partition_cfg[i].hash_table,
 							dip->partition_cfg[i].force_verify_block) != 0);
+
+					if((verify_temp_result) && (strcmp("mdtp",dip->partition_cfg[i].name) == 0)){
+						*verify_result = VERIFY_MDTP_FAILED;
+					}
+
+					verify_failure |= verify_temp_result;
 				}
 			}
 
@@ -676,7 +701,13 @@
 	else if (verify_result  == VERIFY_SKIPPED)
 	{
 		dprintf(SPEW, "mdtp: validate_DIP_and_firmware: Verify skipped\n");
-	} else /* VERIFY_FAILED */
+	}
+	else if(verify_result  == VERIFY_MDTP_FAILED)
+	{
+		dprintf(CRITICAL, "mdtp: validate_DIP_and_firmware: ERROR, corrupted mdtp image\n");
+		display_mdtp_fail_recovery_ui();
+	}
+	else /* VERIFY_FAILED */
 	{
 		dprintf(CRITICAL, "mdtp: validate_DIP_and_firmware: ERROR, corrupted firmware\n");
 		display_recovery_ui(&mdtp_cfg);
@@ -690,6 +721,7 @@
 	return;
 }
 
+
 /********************************************************************************/
 
 /** Entry point of the MDTP Firmware Lock.
@@ -703,6 +735,10 @@
 	int ret;
 	bool enabled;
 
+	if(mdtp_fs_init() != 0){
+		dprintf(CRITICAL, "mdtp: mdtp_img: ERROR, image file could not be loaded\n");
+		display_error_msg_mdtp(); /* This will never return */
+	}
 	/* sets the default value of this global to be MDTP not activated */
 	is_mdtp_activated = 0;
 
diff --git a/app/aboot/mdtp.h b/app/aboot/mdtp.h
index 03e3b7c..88eff44 100644
--- a/app/aboot/mdtp.h
+++ b/app/aboot/mdtp.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -137,6 +137,7 @@
 	VERIFY_SKIPPED = 0,
 	VERIFY_OK,
 	VERIFY_FAILED,
+	VERIFY_MDTP_FAILED,
 } verify_result_t;
 
 /**
@@ -185,6 +186,15 @@
 void display_error_msg();
 
 /**
+ * display_error_msg_mdtp
+ *
+ * Display error message in case mdtp image corrupted and stop boot process.
+ *
+ * @return - None.
+ */
+void display_error_msg_mdtp();
+
+/**
  * mdtp_activated
  *
  * Indicates whether the MDTP is currently in ACTIVATED state.
diff --git a/app/aboot/mdtp_defs.c b/app/aboot/mdtp_defs.c
index d9eb903..b246e50 100644
--- a/app/aboot/mdtp_defs.c
+++ b/app/aboot/mdtp_defs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,42 +30,6 @@
 #include <compiler.h>
 #include "mdtp_defs.h"
 
-struct mdtp_ui_defs mdtp_ui_defs_default = {
-        // Image dimensions
-        1412,     // error_msg_width;
-        212,      // error_msg_height;
-        1364,     // main_text_width;
-        288,      // main_text_height;
-        180,      // pin_digit_width;
-        180,      // pin_digit_height;
-        644,      // ok_button_width;
-        158,      // ok_button_height;
-        1384,     // digits_instructions_width;
-        166,      // digits_instructions_height;
-        920,      // pin_instructions_width;
-        204,      // pin_instructions_height;
-
-        // Image offsets
-        0x1000,   // error_msg_offset;
-        0xDD000,  // initial_delay_offset;
-        0x1FD000, // enter_pin_offset;
-        0x31D000, // invalid_pin_offset;
-        0x43D000, // pin_digit_0_offset;
-        0x18000,  // pin_digits_offset;
-        0x52D000, // pin_selected_digit_0_offset;
-        0x61D000, // ok_button_offset;
-        0x668000, // selected_ok_button_offset;
-        0x6B3000, // digits_instructions_offset;
-        0x75C000, // pin_instructions_offset;
-
-        //Display settings
-        12        // mdtp_digit_space;
-};
-
-__WEAK struct mdtp_ui_defs mdtp_get_target_ui_defs()
-{
-    return mdtp_ui_defs_default;
-}
 
 __WEAK int mdtp_get_target_efuse(struct mdtp_target_efuse* target_efuse)
 {
diff --git a/app/aboot/mdtp_defs.h b/app/aboot/mdtp_defs.h
index 9fe05ae..b5551ce 100644
--- a/app/aboot/mdtp_defs.h
+++ b/app/aboot/mdtp_defs.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,44 +29,10 @@
 
 #include <stdlib.h>
 
-struct mdtp_ui_defs {
-
-    // Image dimensions
-    uint32_t error_msg_width;
-    uint32_t error_msg_height;
-    uint32_t main_text_width;
-    uint32_t main_text_height;
-    uint32_t pin_digit_width;
-    uint32_t pin_digit_height;
-    uint32_t ok_button_width;
-    uint32_t ok_button_height;
-    uint32_t digits_instructions_width;
-    uint32_t digits_instructions_height;
-    uint32_t pin_instructions_width;
-    uint32_t pin_instructions_height;
-
-    // Image offsets
-    uint32_t error_msg_offset;
-    uint32_t initial_delay_offset;
-    uint32_t enter_pin_offset;
-    uint32_t invalid_pin_offset;
-    uint32_t pin_digit_0_offset;
-    uint32_t pin_digits_offset;
-    uint32_t pin_selected_digit_0_offset;
-    uint32_t ok_button_offset;
-    uint32_t selected_ok_button_offset;
-    uint32_t digits_instructions_offset;
-    uint32_t pin_instructions_offset;
-
-    //Display settings
-    uint32_t digit_space;
-};
-
 struct mdtp_target_efuse {
     uint32_t address;
     uint32_t start;
 };
 
-struct mdtp_ui_defs mdtp_get_target_ui_defs();
 
 int mdtp_get_target_efuse(struct mdtp_target_efuse* target_efuse);
diff --git a/app/aboot/mdtp_fs.c b/app/aboot/mdtp_fs.c
new file mode 100644
index 0000000..b848c7a
--- /dev/null
+++ b/app/aboot/mdtp_fs.c
@@ -0,0 +1,115 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <debug.h>
+#include <dev/fbcon.h>
+#include <target.h>
+#include <mmc.h>
+#include <partition_parser.h>
+#include <string.h>
+#include "mdtp.h"
+#include "mdtp_fs.h"
+
+/*---------------------------------------------------------
+ * Global Variables
+ *-------------------------------------------------------*/
+static mdtp_image_t mdtp_img;
+
+/*---------------------------------------------------------
+ * External Functions
+ *-------------------------------------------------------*/
+
+uint32_t get_image_offset(mdtp_image_id_t img){
+	return mdtp_img.meta_data.image_params[img].offset;
+}
+
+uint32_t get_image_width(mdtp_image_id_t img){
+	return mdtp_img.meta_data.image_params[img].width;
+}
+
+uint32_t get_image_height(mdtp_image_id_t img){
+	return mdtp_img.meta_data.image_params[img].height;
+}
+
+uint32_t mdtp_fs_get_param(mdtp_parameter_id_t param){
+	return mdtp_img.meta_data.params[param];
+}
+
+
+int mdtp_fs_init(){
+	int index = INVALID_PTN;
+	unsigned long long ptn = 0;
+	int i = 0;
+	uint32_t block_size = mmc_get_device_blocksize();
+
+	index = partition_get_index("mdtp");
+	if (index == 0) {
+		dprintf(CRITICAL, "ERROR: mdtp Partition table not found\n");
+		return 1;
+	}
+
+	ptn = partition_get_offset(index);
+	mmc_set_lun(partition_get_lun(index));
+
+	if (ptn == 0) {
+		dprintf(CRITICAL, "ERROR: mdtp Partition invalid\n");
+		return 1;
+	}
+
+	for(i = 0; i< MAX_PARAMS; i++) {
+		mdtp_img.meta_data.params[i] = -1; //Initiate params for errors check
+	}
+
+	uint8_t *base = memalign(block_size, ROUNDUP(MDTP_HEADER_LEN, block_size));
+	if (!base) {
+		dprintf(CRITICAL, "ERROR: mdtp malloc failed\n");
+		return 1;
+	}
+
+	// read image meta data
+	if (mmc_read(ptn, (void*)base, MDTP_HEADER_LEN)) {
+		dprintf(CRITICAL, "ERROR: mdtp meta data read failed\n");
+		free(base);
+		return 1;
+	}
+
+	uint32_t params_size = MAX_PARAMS * sizeof(uint32_t);
+	uint32_t images_params_size = MAX_IMAGES*sizeof(mdtp_image_params_t);
+	memscpy(mdtp_img.meta_data.params, sizeof(mdtp_img.meta_data.params), base, params_size);
+	memscpy(mdtp_img.meta_data.image_params, META_DATA_PARTITION_LEN,
+			base + sizeof(mdtp_img.meta_data.params), images_params_size);
+
+	dprintf(INFO, "mdtp: mdtp_img loaded\n");
+
+	free(base);
+	return 0;
+}
+
diff --git a/app/aboot/mdtp_fs.h b/app/aboot/mdtp_fs.h
new file mode 100644
index 0000000..33ddf55
--- /dev/null
+++ b/app/aboot/mdtp_fs.h
@@ -0,0 +1,110 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *   * Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above
+ *     copyright notice, this list of conditions and the following
+ *     disclaimer in the documentation and/or other materials provided
+ *     with the distribution.
+ *   * Neither the name of The Linux Foundation nor the names of its
+ *     contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MDTP_FS_H
+#define MDTP_FS_H
+
+#define MAX_IMAGES					(40)
+#define MDTP_HEADER_LEN 			(4096)
+#define META_DATA_PARTITION_LEN		(2048)
+#define MAX_PARAMS 					(512)
+/*
+MDTP header layout:
+-The mdtp_img header is a fixed length of 4096 Bytes.
+-The mdtp_img header is devided into 2 partitions:
+	1.MDTP parameters (eFuse, digit-space, etc..)
+	2.Images meta-data (offset, width, height)
+-Each partition size is 2048 Bytes.
+-Each parameter is 4 Bytes long, 512 params MAX.
+-Each meta-data part (offset/width/height) is 4 Bytes long.
+*/
+
+
+/* Standalone parameters */
+typedef struct mdtp_image_params {
+	uint32_t offset;
+	uint32_t width;
+	uint32_t height;
+} mdtp_image_params_t;
+
+/* Image parameters */
+typedef struct mdtp_meta_data {
+	uint32_t params[MAX_PARAMS];
+	mdtp_image_params_t image_params[MAX_IMAGES];
+} mdtp_meta_data_t;
+
+/*To make sure the header len is exactly MDTP_HEADER */
+typedef union mdtp_image {
+	mdtp_meta_data_t meta_data;
+	uint8_t header[MDTP_HEADER_LEN];
+} mdtp_image_t;
+
+
+typedef enum{ACCEPTEDIT_TEXT = 0, ALERT_MESSAGE = 1, BTN_OK_OFF = 2,
+	BTN_OK_ON = 3, MAINTEXT_5SECONDS = 4, MAINTEXT_ENTERPIN = 5,
+	MAINTEXT_INCORRECTPIN = 6, PINTEXT = 7,
+	PIN_SELECTED_0 = 8, PIN_SELECTED_1 = 9, PIN_SELECTED_2 = 10, PIN_SELECTED_3 = 11,
+	PIN_SELECTED_4 = 12, PIN_SELECTED_5 = 13, PIN_SELECTED_6 = 14,
+	PIN_SELECTED_7  = 15, PIN_SELECTED_8 = 16, PIN_SELECTED_9 = 17,
+	PIN_UNSELECTED_0 = 18, PIN_UNSELECTED_1 = 19, PIN_UNSELECTED_2 = 20,
+	PIN_UNSELECTED_3 = 21, PIN_UNSELECTED_4 = 22, PIN_UNSELECTED_5 = 23,
+	PIN_UNSELECTED_6 = 24, PIN_UNSELECTED_7 = 25,
+	PIN_UNSELECTED_8 = 26, PIN_UNSELECTED_9 = 27} mdtp_image_id_t;
+
+typedef enum {VIRTUAL_FUSE = 0, DIGIT_SPACE = 1} mdtp_parameter_id_t ;
+
+/*---------------------------------------------------------
+ * External Functions
+ *-------------------------------------------------------*/
+
+/**
+ * Returns an image offset
+ */
+uint32_t get_image_offset(mdtp_image_id_t img);
+
+/**
+ * Returns an image width
+ */
+uint32_t get_image_width(mdtp_image_id_t img);
+
+/**
+ * Returns an image height
+ */
+uint32_t get_image_height(mdtp_image_id_t img);
+
+/**
+ * returns a parameter value
+ */
+uint32_t mdtp_fs_get_param(mdtp_parameter_id_t  param);
+
+/**
+ * Loads MDTP image meta data from EMMC
+ */
+int mdtp_fs_init();
+
+#endif /* MDTP_FS_H */
diff --git a/app/aboot/mdtp_fuse.c b/app/aboot/mdtp_fuse.c
index 7f67661..439fb73 100644
--- a/app/aboot/mdtp_fuse.c
+++ b/app/aboot/mdtp_fuse.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,7 +28,6 @@
 
 #include <debug.h>
 #include <target.h>
-#include <mmc.h>
 #include <partition_parser.h>
 #include <string.h>
 #include <stdlib.h>
@@ -36,6 +35,7 @@
 #include "mdtp.h"
 #include "mdtp_defs.h"
 #include "scm.h"
+#include "mdtp_fs.h"
 
 #define MAX_METADATA_SIZE       (0x1000)
 
@@ -105,45 +105,18 @@
 
 /**
  * Read the Firmware Lock Metadata from EMMC
- *
  * @param metadata - Read a metadata block holding eFuse emulation from MDTP partition.
- *
  * @return - negative value for an error, 0 for success.
  */
 static int read_metadata(metadata_t *metadata)
 {
-	unsigned long long ptn = 0;
-	uint32_t actual_size;
-	int index = INVALID_PTN;
-	uint32_t block_size = mmc_get_device_blocksize();
-	unsigned char *buf = (unsigned char *)target_get_scratch_address() + MDTP_SCRATCH_OFFSET;
-
-	index = partition_get_index("mdtp");
-	ptn = partition_get_offset(index);
-
-	if(ptn == 0)
-	{
+	int eFuse = mdtp_fs_get_param(VIRTUAL_FUSE);
+	if(eFuse == -1){ //Error initiating eFuse
+		dprintf(CRITICAL, "mdtp: eFuse reading error\n");
 		return -1;
 	}
-
-	actual_size = ROUNDUP(sizeof(metadata_t), block_size);
-
-	if (actual_size > MAX_METADATA_SIZE)
-	{
-		dprintf(CRITICAL, "mdtp: read_metadata: ERROR, meta data size %d too big\n", actual_size);
-		return -1;
-	}
-
-	if(mmc_read(ptn, (void *)buf, actual_size))
-	{
-		dprintf(CRITICAL, "mdtp: read_metadata: ERROR, cannot read mdtp info\n");
-		return -1;
-	}
-
-	memscpy((uint8_t*)metadata, sizeof(metadata_t), (uint8_t*)(buf), MAX_METADATA_SIZE);
-
-	dprintf(INFO, "mdtp: read_metadata: SUCCESS, read %d bytes\n", actual_size);
-
+	metadata->eFuses.mask = (uint8_t)eFuse;
+	dprintf(INFO, "mdtp: read_metadata: SUCCESS \n");
 	return 0;
 }
 
diff --git a/app/aboot/mdtp_ui.c b/app/aboot/mdtp_ui.c
index 924c4fe..f03b818 100644
--- a/app/aboot/mdtp_ui.c
+++ b/app/aboot/mdtp_ui.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -35,6 +35,8 @@
 #include <string.h>
 #include "mdtp.h"
 #include "mdtp_defs.h"
+#include "mdtp_fs.h"
+#include <display_menu.h>
 
 // Image releative locations
 #define ERROR_MESSAGE_RELATIVE_Y_LOCATION   (0.18)
@@ -75,7 +77,6 @@
 static struct mdtp_fbimage *g_mdtp_header = NULL;
 static struct fbcon_config *fb_config = NULL;
 
-struct mdtp_ui_defs mdtp_ui_defs_data;
 
 /*----------------------------------------------------------------------------
  * Local Functions
@@ -257,10 +258,9 @@
 
     if (fb_config)
 	{
-        uint32_t x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.error_msg_width,fb_config->width);
+        uint32_t x = CENTER_IMAGE_ON_X_AXIS(get_image_width(ALERT_MESSAGE),fb_config->width);
 		uint32_t y = ((fb_config->height)*ERROR_MESSAGE_RELATIVE_Y_LOCATION);
-
-        fbimg = mdtp_read_mmc_image(mdtp_ui_defs_data.error_msg_offset, mdtp_ui_defs_data.error_msg_width, mdtp_ui_defs_data.error_msg_height);
+        fbimg = mdtp_read_mmc_image(get_image_offset(ALERT_MESSAGE),get_image_width(ALERT_MESSAGE), get_image_height(ALERT_MESSAGE));
         if (NULL == fbimg)
         {
             dprintf(CRITICAL,"ERROR: failed to read error image from mmc\n");
@@ -309,10 +309,9 @@
  */
 static void display_initial_delay()
 {
-    uint32_t x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.main_text_width,fb_config->width);
+	uint32_t x = CENTER_IMAGE_ON_X_AXIS(get_image_width(MAINTEXT_5SECONDS),fb_config->width);
 	uint32_t y = (fb_config->height)*MAIN_TEXT_RELATIVE_Y_LOCATION;
-
-	display_image(mdtp_ui_defs_data.initial_delay_offset, mdtp_ui_defs_data.main_text_width, mdtp_ui_defs_data.main_text_height, x, y);
+	display_image(get_image_offset(MAINTEXT_5SECONDS), get_image_width(MAINTEXT_5SECONDS), get_image_height(MAINTEXT_5SECONDS), x, y);
 }
 
 /**
@@ -320,10 +319,9 @@
  */
 static void display_enter_pin()
 {
-    uint32_t x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.main_text_width,fb_config->width);
+	uint32_t x = CENTER_IMAGE_ON_X_AXIS(get_image_width(MAINTEXT_ENTERPIN),fb_config->width);
 	uint32_t y = (fb_config->height)*MAIN_TEXT_RELATIVE_Y_LOCATION;
-
-	display_image(mdtp_ui_defs_data.enter_pin_offset, mdtp_ui_defs_data.main_text_width, mdtp_ui_defs_data.main_text_height, x, y);
+	display_image(get_image_offset(MAINTEXT_ENTERPIN), get_image_width(MAINTEXT_ENTERPIN), get_image_height(MAINTEXT_ENTERPIN), x, y);
 }
 
 /**
@@ -331,10 +329,10 @@
  */
 static void display_invalid_pin()
 {
-    uint32_t x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.main_text_width,fb_config->width);
+    uint32_t x = CENTER_IMAGE_ON_X_AXIS(get_image_width(MAINTEXT_INCORRECTPIN),fb_config->width);
 	uint32_t y = (fb_config->height)*MAIN_TEXT_RELATIVE_Y_LOCATION;
 
-	display_image(mdtp_ui_defs_data.invalid_pin_offset, mdtp_ui_defs_data.main_text_width, mdtp_ui_defs_data.main_text_height, x, y);
+	display_image(get_image_offset(MAINTEXT_INCORRECTPIN), get_image_width(MAINTEXT_INCORRECTPIN), get_image_height(MAINTEXT_INCORRECTPIN), x, y);
 }
 
 /**
@@ -342,10 +340,10 @@
  */
 static void display_digits_instructions()
 {
-    uint32_t x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.digits_instructions_width,fb_config->width);
+    uint32_t x = CENTER_IMAGE_ON_X_AXIS(get_image_width(PINTEXT),fb_config->width);
 	uint32_t y = (fb_config->height)*PIN_TEXT_RELATIVE_Y_LOCATION;
 
-	display_image(mdtp_ui_defs_data.digits_instructions_offset, mdtp_ui_defs_data.digits_instructions_width, mdtp_ui_defs_data.digits_instructions_height, x, y);
+	display_image(get_image_offset(PINTEXT), get_image_width(PINTEXT), get_image_height(PINTEXT), x, y);
 }
 
 /**
@@ -354,8 +352,7 @@
 static void clear_digits_instructions()
 {
     uint32_t y = (fb_config->height)*PIN_TEXT_RELATIVE_Y_LOCATION;
-
-    fbcon_clear_section(y, mdtp_ui_defs_data.digits_instructions_height);
+    fbcon_clear_section(y, get_image_height(PINTEXT));
 }
 
 /**
@@ -363,8 +360,8 @@
  */
 static void display_digit(uint32_t x, uint32_t y, uint32_t digit)
 {
-    display_image(mdtp_ui_defs_data.pin_digit_0_offset + digit*mdtp_ui_defs_data.pin_digits_offset,
-            mdtp_ui_defs_data.pin_digit_width, mdtp_ui_defs_data.pin_digit_height, x, y);
+    display_image(get_image_offset(PIN_UNSELECTED_0 + digit),
+    get_image_width(PIN_UNSELECTED_0 + digit), get_image_height(PIN_UNSELECTED_0 + digit), x, y);
 }
 
 /**
@@ -372,8 +369,9 @@
  */
 static void display_selected_digit(uint32_t x, uint32_t y, uint32_t digit)
 {
-    display_image(mdtp_ui_defs_data.pin_selected_digit_0_offset + digit*mdtp_ui_defs_data.pin_digits_offset,
-			mdtp_ui_defs_data.pin_digit_width, mdtp_ui_defs_data.pin_digit_height, x, y);
+	display_image(get_image_offset(PIN_SELECTED_0 + digit),
+			get_image_width(PIN_SELECTED_0 + digit),
+			get_image_height(PIN_SELECTED_0 + digit), x, y);
 }
 
 /**
@@ -381,10 +379,10 @@
  */
 static void display_ok_button()
 {
-    uint32_t ok_x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.ok_button_width,fb_config->width);
+    uint32_t ok_x = CENTER_IMAGE_ON_X_AXIS(get_image_width(BTN_OK_OFF),fb_config->width);
 	uint32_t ok_y = (fb_config->height)*OK_BUTTON_RELATIVE_Y_LOCATION;
 
-	display_image(mdtp_ui_defs_data.ok_button_offset, mdtp_ui_defs_data.ok_button_width, mdtp_ui_defs_data.ok_button_height, ok_x, ok_y);
+	display_image(get_image_offset(BTN_OK_OFF), get_image_width(BTN_OK_OFF),get_image_height(BTN_OK_OFF), ok_x, ok_y);
 }
 
 /**
@@ -392,21 +390,22 @@
  */
 static void display_selected_ok_button()
 {
-    uint32_t ok_x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.ok_button_width,fb_config->width);
+    uint32_t ok_x = CENTER_IMAGE_ON_X_AXIS(get_image_width(BTN_OK_ON),fb_config->width);
 	uint32_t ok_y = (fb_config->height)*OK_BUTTON_RELATIVE_Y_LOCATION;
 
-	display_image(mdtp_ui_defs_data.selected_ok_button_offset, mdtp_ui_defs_data.ok_button_width, mdtp_ui_defs_data.ok_button_height,  ok_x, ok_y);
+	display_image(get_image_offset(BTN_OK_ON), get_image_width(BTN_OK_ON), get_image_height(BTN_OK_ON),  ok_x, ok_y);
 }
 
+
 /**
  * Display the instructions for the OK button.
  */
 static void display_pin_instructions()
 {
-    uint32_t x = CENTER_IMAGE_ON_X_AXIS(mdtp_ui_defs_data.pin_instructions_width,fb_config->width);
+    uint32_t x = CENTER_IMAGE_ON_X_AXIS(get_image_width(ACCEPTEDIT_TEXT),fb_config->width);
 	uint32_t y = (fb_config->height)*OK_TEXT_RELATIVE_Y_LOCATION;
 
-	display_image(mdtp_ui_defs_data.pin_instructions_offset, mdtp_ui_defs_data.pin_instructions_width, mdtp_ui_defs_data.pin_instructions_height, x, y);
+	display_image(get_image_offset(ACCEPTEDIT_TEXT), get_image_width(ACCEPTEDIT_TEXT), get_image_height(ACCEPTEDIT_TEXT), x, y);
 }
 
 /**
@@ -416,7 +415,7 @@
 {
     uint32_t y = (fb_config->height)*OK_TEXT_RELATIVE_Y_LOCATION;
 
-	fbcon_clear_section(y, mdtp_ui_defs_data.pin_instructions_height);
+	fbcon_clear_section(y,get_image_height(ACCEPTEDIT_TEXT));
 }
 
 /**
@@ -426,7 +425,6 @@
 {
 	fb_config = fbcon_display();
 	alloc_mdtp_image();
-	mdtp_ui_defs_data = mdtp_get_target_ui_defs();
 }
 
 /**
@@ -451,12 +449,12 @@
 
 		g_pin_frames_y_location = ((fb_config->height)*PIN_RELATIVE_Y_LOCATION);
 
-		uint32_t total_pin_length = pin_length*mdtp_ui_defs_data.pin_digit_width + mdtp_ui_defs_data.digit_space*(pin_length - 1);
+		uint32_t total_pin_length = pin_length*get_image_width(PIN_UNSELECTED_0) + mdtp_fs_get_param(DIGIT_SPACE)*(pin_length - 1);
 		uint32_t complete_pin_centered = (fb_config->width - total_pin_length)/2;
 
 		for (uint32_t i=0; i<pin_length; i++)
 		{
-			g_pin_frames_x_location[i] = complete_pin_centered + i*(mdtp_ui_defs_data.digit_space+mdtp_ui_defs_data.pin_digit_width);
+			g_pin_frames_x_location[i] = complete_pin_centered + i*(mdtp_fs_get_param(DIGIT_SPACE) + get_image_width(PIN_UNSELECTED_0));
 		}
 
 		for (uint32_t i=0; i<pin_length; i++)
@@ -603,3 +601,28 @@
 	for(;;);
 }
 
+/**
+ *  Display error message in case mdtp image is corrupted and stop boot process.
+ */
+void display_error_msg_mdtp()
+{
+	int big_factor = 8; // Font size
+	char* str = "Device unable to boot";
+	char* str2 = "\nError - mdtp image is corrupted\n";
+	fbcon_clear();
+	while(*str != 0) {
+		fbcon_putc_factor(*str++, FBCON_COMMON_MSG, big_factor);
+	}
+	fbcon_draw_line(FBCON_COMMON_MSG);
+	while(*str2 != 0) {
+		fbcon_putc_factor(*str2++, FBCON_COMMON_MSG, big_factor);
+	}
+	fbcon_draw_line(FBCON_COMMON_MSG);
+
+	// Invalid state. Nothing to be done but contacting the OEM.
+	// Stop boot process.
+	dprintf(CRITICAL,"ERROR: blocking boot process - mdtp image corrupted\n");
+	for(;;);
+
+}
+
diff --git a/app/aboot/rules.mk b/app/aboot/rules.mk
index 09a5152..68e1c9b 100644
--- a/app/aboot/rules.mk
+++ b/app/aboot/rules.mk
@@ -21,5 +21,6 @@
 	$(LOCAL_DIR)/mdtp.o \
 	$(LOCAL_DIR)/mdtp_ui.o \
 	$(LOCAL_DIR)/mdtp_fuse.o \
-	$(LOCAL_DIR)/mdtp_defs.o
+	$(LOCAL_DIR)/mdtp_defs.o \
+	$(LOCAL_DIR)/mdtp_fs.o
 endif
diff --git a/dev/gcdb/display/fastboot_oem_display.h b/dev/gcdb/display/fastboot_oem_display.h
index 26873ed..aaccf0e 100644
--- a/dev/gcdb/display/fastboot_oem_display.h
+++ b/dev/gcdb/display/fastboot_oem_display.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -94,6 +94,8 @@
 	{"r63417_1080p_video", "qcom,mdss_dsi_r63417_1080p_video", false},
 	{"samsung_wxga_video", "qcom,mdss_dsi_samsung_wxga_video", false},
 	{"sharp_1080p_cmd", "qcom,mdss_dsi_sharp_1080p_cmd", false},
+	{"sharp_4k_dsc_video", "qcom,mdss_dsi_sharp_4k_dsc_video", true},
+	{"sharp_4k_dsc_cmd", "qcom,mdss_dsi_sharp_4k_dsc_cmd", true},
 	{"sharp_qhd_video", "qcom,mdss_dsi_sharp_qhd_video", false},
 	{"sharp_wqxga_dualdsi_video", "qcom,mdss_dsi_sharp_wqxga_video", true},
 	{"ssd2080m_720p_video", "qcom,mdss_dsi_ssd2080m_720p_video", false},
diff --git a/dev/gcdb/display/include/panel_hx8394f_720p_video.h b/dev/gcdb/display/include/panel_hx8394f_720p_video.h
index 37425a0..f607946 100644
--- a/dev/gcdb/display/include/panel_hx8394f_720p_video.h
+++ b/dev/gcdb/display/include/panel_hx8394f_720p_video.h
@@ -66,14 +66,14 @@
 static char hx8394f_720p_video_on_cmd1[] = {
 	0x07, 0x00, 0x39, 0xC0,
 	0xBA, 0x63, 0x03, 0x68,
-	0x6B, 0xB2, 0xc0, 0xFF,
+	0x6B, 0xB2, 0xC0, 0xFF,
 };
 
 static char hx8394f_720p_video_on_cmd2[] = {
 	0x0B, 0x00, 0x39, 0xC0,
 	0xB1, 0x50, 0x12, 0x72,
-	0x09, 0x33, 0x54, 0x81,
-	0x31, 0x69, 0x2F, 0xFF,
+	0x09, 0x33, 0x54, 0xB1,
+	0x31, 0x6B, 0x2F, 0xFF,
 };
 
 static char hx8394f_720p_video_on_cmd3[] = {
@@ -84,12 +84,12 @@
 
 static char hx8394f_720p_video_on_cmd4[] = {
 	0x16, 0x00, 0x39, 0xC0,
-	0xB4, 0x6C, 0x6D, 0x6C,
-	0x6A, 0x6C, 0x6D, 0x01,
-	0x05, 0xFF, 0x77, 0x00,
-	0x3F, 0x6C, 0x6D, 0x6C,
-	0x6D, 0x6C, 0x6D, 0x01,
-	0x01, 0xFF, 0xFF, 0xFF,
+	0xB4, 0x73, 0x74, 0x73,
+	0x74, 0x73, 0x74, 0x01,
+	0x0C, 0x86, 0x75, 0x00,
+	0x3F, 0x73, 0x74, 0x73,
+	0x74, 0x73, 0x74, 0x01,
+	0x0C, 0x86, 0xFF, 0xFF,
 };
 
 static char hx8394f_720p_video_on_cmd5[] = {
@@ -102,7 +102,7 @@
 	0x15, 0x06, 0x05, 0x06,
 	0x47, 0x44, 0x0A, 0x0A,
 	0x4B, 0x10, 0x07, 0x07,
-	0x0e, 0x40, 0xFF, 0xFF,
+	0x0E, 0x40, 0xFF, 0xFF,
 };
 
 static char hx8394f_720p_video_on_cmd6[] = {
@@ -152,13 +152,13 @@
 	0x70, 0x6F, 0x76, 0x86,
 	0x89, 0x8D, 0x99, 0x9A,
 	0x95, 0xA1, 0xB0, 0x57,
-	0x55, 0x58, 0x5C, 0x5e,
+	0x55, 0x58, 0x5C, 0x5E,
 	0x64, 0x6B, 0x7F, 0xFF,
 };
 
 static char hx8394f_720p_video_on_cmd9[] = {
 	0x03, 0x00, 0x39, 0xC0,
-	0xC0, 0x1F, 0x73, 0xFF,
+	0xC0, 0x1F, 0x31, 0xFF,
 };
 
 static char hx8394f_720p_video_on_cmd10[] = {
@@ -170,21 +170,57 @@
 };
 
 static char hx8394f_720p_video_on_cmd12[] = {
-	0x05, 0x00, 0x39, 0xC0,
-	0xC7, 0x00, 0xC0, 0x00,
-	0xC0, 0xFF, 0xFF, 0xFF,
+	0xBD, 0x02, 0x15, 0x80
 };
 
 static char hx8394f_720p_video_on_cmd13[] = {
+	0x0D, 0x00, 0x39, 0xC0,
+	0xD8, 0xFF, 0xFF, 0xFF,
+	0xFF, 0xFF, 0xFF, 0xFF,
+	0xFF, 0xFF, 0xFF, 0xFF,
+	0xFF, 0xFF, 0xFF, 0xFF,
+};
+
+static char hx8394f_720p_video_on_cmd14[] = {
+	0xBD, 0x00, 0x15, 0x80
+};
+
+static char hx8394f_720p_video_on_cmd15[] = {
+	0xBD, 0x01, 0x15, 0x80
+};
+
+static char hx8394f_720p_video_on_cmd16[] = {
+	0xB1, 0x00, 0x15, 0x80
+};
+
+static char hx8394f_720p_video_on_cmd17[] = {
+	0xBD, 0x00, 0x15, 0x80
+};
+
+static char hx8394f_720p_video_on_cmd18[] = {
+	0x08, 0x00, 0x39, 0xC0,
+	0xBF, 0x40, 0x81, 0x50,
+	0x00, 0x1A, 0xFC, 0x01,
+};
+
+static char hx8394f_720p_video_on_cmd19[] = {
 	0x03, 0x00, 0x39, 0xC0,
 	0xB6, 0x7D, 0x7D, 0xFF,
 };
 
-static char hx8394f_720p_video_on_cmd14[] = {
+static char hx8394f_720p_video_on_cmd20[] = {
 	0x11, 0x00, 0x05, 0x80
 };
 
-static char hx8394f_720p_video_on_cmd15[] = {
+static char hx8394f_720p_video_on_cmd21[] = {
+	0x0D, 0x00, 0x39, 0xC0,
+	0xB2, 0x00, 0x80, 0x64,
+	0x0E, 0x0D, 0x2F, 0x00,
+	0x00, 0x00, 0x00, 0xC0,
+	0x18, 0xFF, 0xFF, 0xFF,
+};
+
+static char hx8394f_720p_video_on_cmd22[] = {
 	0x29, 0x00, 0x05, 0x80
 };
 
@@ -201,13 +237,20 @@
 	{0x8, hx8394f_720p_video_on_cmd9, 0x00},
 	{0x4, hx8394f_720p_video_on_cmd10, 0x00},
 	{0x4, hx8394f_720p_video_on_cmd11, 0x00},
-	{0xc, hx8394f_720p_video_on_cmd12, 0x00},
-	{0x8, hx8394f_720p_video_on_cmd13, 0x00},
-	{0x4, hx8394f_720p_video_on_cmd14, 0x96},
-	{0x4, hx8394f_720p_video_on_cmd15, 0x32}
+	{0x4, hx8394f_720p_video_on_cmd12, 0x00},
+	{0x14, hx8394f_720p_video_on_cmd13, 0x00},
+	{0x4, hx8394f_720p_video_on_cmd14, 0x00},
+	{0x4, hx8394f_720p_video_on_cmd15, 0x00},
+	{0x4, hx8394f_720p_video_on_cmd16, 0x00},
+	{0x4, hx8394f_720p_video_on_cmd17, 0x00},
+	{0xc, hx8394f_720p_video_on_cmd18, 0x00},
+	{0x8, hx8394f_720p_video_on_cmd19, 0x00},
+	{0x4, hx8394f_720p_video_on_cmd20, 0x78},
+	{0x14, hx8394f_720p_video_on_cmd21, 0x00},
+	{0x4, hx8394f_720p_video_on_cmd22, 0x14}
 };
 
-#define HX8394F_720P_VIDEO_ON_COMMAND 16
+#define HX8394F_720P_VIDEO_ON_COMMAND 23
 
 static char hx8394f_720p_videooff_cmd0[] = {
 	0x28, 0x00, 0x05, 0x80
diff --git a/dev/gcdb/display/include/panel_truly_1080p_video.h b/dev/gcdb/display/include/panel_truly_1080p_video.h
index 9b8a52b..46417c6 100755
--- a/dev/gcdb/display/include/panel_truly_1080p_video.h
+++ b/dev/gcdb/display/include/panel_truly_1080p_video.h
@@ -302,7 +302,7 @@
 /* Dynamic fps supported frequencies by panel                                */
 /*---------------------------------------------------------------------------*/
 static const struct dfps_panel_info truly_1080p_video_dfps = {
-	1, 3, {48, 54, 60}
+	1, 10, {48, 49, 50, 51, 52, 54, 56, 57, 58, 60}
 };
 
 /*---------------------------------------------------------------------------*/
diff --git a/dev/qpnp_wled/include/qpnp_wled.h b/dev/qpnp_wled/include/qpnp_wled.h
index 3f03703..64e85e0 100644
--- a/dev/qpnp_wled/include/qpnp_wled.h
+++ b/dev/qpnp_wled/include/qpnp_wled.h
@@ -168,7 +168,11 @@
 #define QPNP_WLED_SEC_ACCESS_REG(b)            (b + 0xD0)
 #define QPNP_WLED_SEC_UNLOCK                   0xA5
 
+#if TARGET_MAX_WLED_STRINGS
+#define QPNP_WLED_MAX_STRINGS                  TARGET_MAX_WLED_STRINGS
+#else
 #define QPNP_WLED_MAX_STRINGS                  4
+#endif
 #define WLED_MAX_LEVEL_511                     511
 #define WLED_MAX_LEVEL_4095                    4095
 #define QPNP_WLED_RAMP_DLY_MS                  20
diff --git a/platform/msm_shared/boot_verifier.c b/platform/msm_shared/boot_verifier.c
index 941bdaf..9c80839 100644
--- a/platform/msm_shared/boot_verifier.c
+++ b/platform/msm_shared/boot_verifier.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -418,6 +418,18 @@
 			// Send hash of key from OEM KEYSTORE + Boot device state
 			n = BN_num_bytes(oem_keystore->mykeybag->mykey->key_material->n);
 			e = BN_num_bytes(oem_keystore->mykeybag->mykey->key_material->e);
+			/*this assumes a valid acceptable range for RSA, including 4096 bits of modulo n. */
+			if (n<0 || n>1024)
+			{
+				dprintf(CRITICAL, "Invalid n value from key_material\n");
+				ASSERT(0);
+			}
+			/* e can assumes 3,5,17,257,65537 as valid values, which should be 1 byte long only, we accept 2 bytes or 16 bits long */
+			if( e < 0 || e >16)
+			{
+				dprintf(CRITICAL, "Invalid e value from key_material\n");
+				ASSERT(0);
+			}
 			len_oem_rsa = n + e;
 			if(!(input = malloc(len_oem_rsa)))
 			{
@@ -440,6 +452,18 @@
 			// Send hash of key from certificate in boot image + boot device state
 			n = BN_num_bytes(rsa_from_cert->n);
 			e = BN_num_bytes(rsa_from_cert->e);
+			/*this assumes a valid acceptable range for RSA, including 4096 bits of modulo n. */
+			if (n<0 || n>1024)
+			{
+				dprintf(CRITICAL, "Invalid n value from rsa_from_cert\n");
+				ASSERT(0);
+			}
+			/* e can assumes 3,5,17,257,65537 as valid values, which should be 1 byte long only, we accept 2 bytes or 16 bits long */
+			if( e < 0 || e >16)
+			{
+				dprintf(CRITICAL, "Invalid e value from rsa_from_cert\n");
+				ASSERT(0);
+			}
 			len_from_cert = n + e;
 			if(!(input = malloc(len_from_cert)))
 			{
diff --git a/platform/msm_shared/flash-ubi.c b/platform/msm_shared/flash-ubi.c
index d9c5cc0..010f61e 100644
--- a/platform/msm_shared/flash-ubi.c
+++ b/platform/msm_shared/flash-ubi.c
@@ -816,7 +816,8 @@
 	int num_pages;
 	int ret;
 	int bad_blocks_cnt = 0;
-	int fmsb_peb = 0;
+	uint32_t fmsb_peb = UINT_MAX;
+	int is_fmsb_peb_valid = 0;
 
 	si = scan_partition(ptn);
 	if (!si) {
@@ -867,8 +868,10 @@
 		else
 			size -= block_size;
 
-		if (fastmap_present(img_peb))
+		if (fastmap_present(img_peb)) {
 			fmsb_peb = curr_peb;
+			is_fmsb_peb_valid = 1;
+		}
 		img_peb += flash_block_size();
 		curr_peb++;
 	}
@@ -891,9 +894,10 @@
 	 * we need to invalidate the flashed fastmap since it isn't accurate
 	 * anymore.
 	 */
-	if (bad_blocks_cnt && fmsb_peb) {
-		dprintf(CRITICAL, "flash_ubi_img: invalidate fmsb\n");
-		ret = ubi_erase_peb(ptn->start + 2, si, ptn->start);
+	if (bad_blocks_cnt && (is_fmsb_peb_valid == 1)) {
+		dprintf(CRITICAL, "flash_ubi_img: invalidate fmsb (fmsb_peb = %u)\n",
+			fmsb_peb);
+		ret = ubi_erase_peb(fmsb_peb, si, ptn->start);
 	}
 
 out:
diff --git a/platform/msm_shared/mipi_dsi_autopll_thulium.c b/platform/msm_shared/mipi_dsi_autopll_thulium.c
index 83354b6..ffb1310 100644
--- a/platform/msm_shared/mipi_dsi_autopll_thulium.c
+++ b/platform/msm_shared/mipi_dsi_autopll_thulium.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -116,10 +116,7 @@
 	pdb->out.plllock_cmp = (uint32_t)pll_comp_val;
 
 	pdb->out.pll_txclk_en = 1;
-	if (board_soc_version() == 0x10000)
-		pdb->out.cmn_ldo_cntrl = 0x1c;
-	else
-		pdb->out.cmn_ldo_cntrl = 0x3c;
+	pdb->out.cmn_ldo_cntrl = 0x3c;
 }
 
 static uint32_t mdss_mdp_pll_kvco_slop(uint32_t vrate)
diff --git a/platform/msm_shared/shutdown_detect.c b/platform/msm_shared/shutdown_detect.c
index 9bde63d..d574b8d 100644
--- a/platform/msm_shared/shutdown_detect.c
+++ b/platform/msm_shared/shutdown_detect.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -38,9 +38,12 @@
 #include <platform.h>
 #include <target.h>
 
-/* sleep clock is 32.768 khz, 0x8000 count per second */
+/*
+ * Sleep clock is 32.768 khz, 0x8000 count per second.
+ * Set long press wait time to 500ms to benefit boot time.
+ */
 #define MPM_SLEEP_TIMETICK_COUNT    0x8000
-#define PWRKEY_LONG_PRESS_COUNT     0xC000
+#define PWRKEY_LONG_PRESS_COUNT     0x4000
 #define QPNP_DEFAULT_TIMEOUT        250
 #define PWRKEY_DETECT_FREQUENCY     50
 
diff --git a/project/msm8952.mk b/project/msm8952.mk
index 41f6e92..09971c6 100644
--- a/project/msm8952.mk
+++ b/project/msm8952.mk
@@ -41,6 +41,7 @@
 DEFINES += CRYPTO_BAM=1
 DEFINES += SPMI_CORE_V2=1
 DEFINES += ABOOT_IGNORE_BOOT_HEADER_ADDRS=1
+DEFINES += TARGET_MAX_WLED_STRINGS=1
 
 DEFINES += BAM_V170=1
 
diff --git a/project/msmtitanium.mk b/project/msmtitanium.mk
index 5574e49..d213104 100644
--- a/project/msmtitanium.mk
+++ b/project/msmtitanium.mk
@@ -89,6 +89,9 @@
 
 CFLAGS += -Werror
 
+#enable user force reset feature
+DEFINES += USER_FORCE_RESET_SUPPORT=1
+
 # Reset USB clock from target code
 DEFINES += USB_RESET_FROM_CLK=1
 
@@ -98,3 +101,10 @@
 
 #Enable the external reboot functions
 ENABLE_REBOOT_MODULE := 1
+
+#Enable MDTP feature
+ENABLE_MDTP_SUPPORT := 1
+
+ifeq ($(ENABLE_MDTP_SUPPORT),1)
+DEFINES += MDTP_SUPPORT=1
+endif
diff --git a/target/init.c b/target/init.c
index d8d8073..ca64cd1 100644
--- a/target/init.c
+++ b/target/init.c
@@ -274,9 +274,12 @@
 		case MSMGOLD2:
 		case MSMGOLD3:
 		case APQGOLD:
+		case MSMTITANIUM:
+		case APQTITANIUM:
 			config->vib_type = VIB_LRA_TYPE;
 			config->hap_rate_cfg1 = QPNP_HAP_RATE_CFG1_41;
 			config->hap_rate_cfg2 = QPNP_HAP_RATE_CFG2_03;
+			break;
 		default:
 			dprintf(CRITICAL,"Unsupported platform id\n");
 			break;
diff --git a/target/msm8952/mdtp_defs.c b/target/msm8952/mdtp_defs.c
index 4518b06..51de785 100644
--- a/target/msm8952/mdtp_defs.c
+++ b/target/msm8952/mdtp_defs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -39,42 +39,6 @@
 #define MDTP_EFUSE_ADDRESS_MSM8937  0x000A43B0  // QFPROM_CORR_SPARE_REG18_ROW0_LSB_ADDR
 #define MDTP_EFUSE_START_MSM8937    0
 
-struct mdtp_ui_defs mdtp_ui_defs_msm8952 = {
-        // Image dimensions
-        952,      // error_msg_width;
-        143,      // error_msg_height;
-        920,      // main_text_width;
-        194,      // main_text_height;
-        120,      // pin_digit_width;
-        120,      // pin_digit_height;
-        432,      // ok_button_width;
-        106,      // ok_button_height;
-        932,      // digits_instructions_width;
-        112,      // digits_instructions_height;
-        620,      // pin_instructions_width;
-        137,      // pin_instructions_height;
-
-        // Image offsets
-        0x1000,   // error_msg_offset;
-        0x65000,  // initial_delay_offset;
-        0xE8000,  // enter_pin_offset;
-        0x16B000, // invalid_pin_offset;
-        0x1EE000, // pin_digit_0_offset;
-        0xB000,   // pin_digits_offset;
-        0x25C000, // pin_selected_digit_0_offset;
-        0x2CA000, // ok_button_offset;
-        0x2EC000, // selected_ok_button_offset;
-        0x30E000, // digits_instructions_offset;
-        0x35B000, // pin_instructions_offset;
-
-        //Display settings
-        8         // digit_space;
-};
-
-struct mdtp_ui_defs mdtp_get_target_ui_defs()
-{
-    return mdtp_ui_defs_msm8952;
-}
 
 int mdtp_get_target_efuse(struct mdtp_target_efuse* target_efuse)
 {
diff --git a/target/msm8952/oem_panel.c b/target/msm8952/oem_panel.c
index d990f45..fe7b8f2 100755
--- a/target/msm8952/oem_panel.c
+++ b/target/msm8952/oem_panel.c
@@ -763,6 +763,8 @@
 					return PANEL_TYPE_UNKNOWN;
 			}
 			auto_pan_loop++;
+		} else if (platform_is_msmgold()) {
+			panel_id = HX8394F_720P_VIDEO_PANEL;
 		}
 
 		break;
diff --git a/target/msm8994/mdtp_defs.c b/target/msm8994/mdtp_defs.c
index 65fb596..ce9e352 100644
--- a/target/msm8994/mdtp_defs.c
+++ b/target/msm8994/mdtp_defs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -32,42 +32,6 @@
 #define MDTP_EFUSE_ADDRESS_MSM8994  0xFC4BC1F8  // QFPROM_CORR_SPARE_REG19_LSB_ADDR
 #define MDTP_EFUSE_START_MSM8994    16
 
-struct mdtp_ui_defs mdtp_ui_defs_msm8994 = {
-        // Image dimensions
-        1412,     // error_msg_width;
-        212,      // error_msg_height;
-        1364,     // main_text_width;
-        288,      // main_text_height;
-        180,      // pin_digit_width;
-        180,      // pin_digit_height;
-        644,      // ok_button_width;
-        158,      // ok_button_height;
-        1384,     // digits_instructions_width;
-        166,      // digits_instructions_height;
-        920,      // pin_instructions_width;
-        204,      // pin_instructions_height;
-
-        // Image offsets
-        0x1000,   // error_msg_offset;
-        0xDD000,  // initial_delay_offset;
-        0x1FD000, // enter_pin_offset;
-        0x31D000, // invalid_pin_offset;
-        0x43D000, // pin_digit_0_offset;
-        0x18000,  // pin_digits_offset;
-        0x52D000, // pin_selected_digit_0_offset;
-        0x61D000, // ok_button_offset;
-        0x668000, // selected_ok_button_offset;
-        0x6B3000, // digits_instructions_offset;
-        0x75C000, // pin_instructions_offset;
-
-        //Display settings
-        12        // digit_space;
-};
-
-struct mdtp_ui_defs mdtp_get_target_ui_defs()
-{
-    return mdtp_ui_defs_msm8994;
-}
 
 int mdtp_get_target_efuse(struct mdtp_target_efuse* target_efuse)
 {
diff --git a/target/msm8996/mdtp_defs.c b/target/msm8996/mdtp_defs.c
index 195da03..d07d34d 100644
--- a/target/msm8996/mdtp_defs.c
+++ b/target/msm8996/mdtp_defs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -32,42 +32,7 @@
 #define MDTP_EFUSE_ADDRESS_MSM8996  0x00070178  // QFPROM_CORR_ANTI_ROLLBACK_3_LSB_ADDR
 #define MDTP_EFUSE_START_MSM8996    0
 
-struct mdtp_ui_defs mdtp_ui_defs_msm8996 = {
-        // Image dimensions
-        1412,     // error_msg_width;
-        212,      // error_msg_height;
-        1364,     // main_text_width;
-        288,      // main_text_height;
-        180,      // pin_digit_width;
-        180,      // pin_digit_height;
-        644,      // ok_button_width;
-        158,      // ok_button_height;
-        1384,     // digits_instructions_width;
-        166,      // digits_instructions_height;
-        920,      // pin_instructions_width;
-        204,      // pin_instructions_height;
 
-        // Image offsets
-        0x1000,   // error_msg_offset;
-        0xDD000,  // initial_delay_offset;
-        0x1FD000, // enter_pin_offset;
-        0x31D000, // invalid_pin_offset;
-        0x43D000, // pin_digit_0_offset;
-        0x18000,  // pin_digits_offset;
-        0x52D000, // pin_selected_digit_0_offset;
-        0x61D000, // ok_button_offset;
-        0x668000, // selected_ok_button_offset;
-        0x6B3000, // digits_instructions_offset;
-        0x75C000, // pin_instructions_offset;
-
-        //Display settings
-        12        // digit_space;
-};
-
-struct mdtp_ui_defs mdtp_get_target_ui_defs()
-{
-    return mdtp_ui_defs_msm8996;
-}
 
 int mdtp_get_target_efuse(struct mdtp_target_efuse* target_efuse)
 {
diff --git a/target/msmtitanium/init.c b/target/msmtitanium/init.c
index 952b33f..9d53acd 100644
--- a/target/msmtitanium/init.c
+++ b/target/msmtitanium/init.c
@@ -348,12 +348,16 @@
 	return _emmc_recovery_init();
 }
 
+#define SMBCHG_USB_RT_STS 0x21310
+#define USBIN_UV_RT_STS BIT(0)
 unsigned target_pause_for_battery_charge(void)
 {
 	uint8_t pon_reason = pm8x41_get_pon_reason();
 	uint8_t is_cold_boot = pm8x41_get_is_cold_boot();
-	dprintf(INFO, "%s : pon_reason is %d cold_boot:%d\n", __func__,
-		pon_reason, is_cold_boot);
+	bool usb_present_sts = !(USBIN_UV_RT_STS &
+				pm8x41_reg_read(SMBCHG_USB_RT_STS));
+	dprintf(INFO, "%s : pon_reason is:0x%x cold_boot:%d usb_sts:%d\n", __func__,
+		pon_reason, is_cold_boot, usb_present_sts);
 	/* In case of fastboot reboot,adb reboot or if we see the power key
 	* pressed we do not want go into charger mode.
 	* fastboot reboot is warm boot with PON hard reset bit not set
@@ -362,7 +366,7 @@
 	if (is_cold_boot &&
 			(!(pon_reason & HARD_RST)) &&
 			(!(pon_reason & KPDPWR_N)) &&
-			((pon_reason & USB_CHG) || (pon_reason & DC_CHG) || (pon_reason & CBLPWR_N)))
+			usb_present_sts)
 		return 1;
 	else
 		return 0;
diff --git a/target/msmtitanium/mdtp_defs.c b/target/msmtitanium/mdtp_defs.c
new file mode 100644
index 0000000..b8dea09
--- /dev/null
+++ b/target/msmtitanium/mdtp_defs.c
@@ -0,0 +1,48 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation, Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "mdtp_defs.h"
+
+#define MDTP_EFUSE_ADDRESS_MSM8953  0x000A4418  // QFPROM_CORR_SPARE_REG18_LSB
+#define MDTP_EFUSE_START_MSM8953    0
+
+
+int mdtp_get_target_efuse(struct mdtp_target_efuse* target_efuse)
+{
+    if (target_efuse == NULL)
+    {
+        dprintf(CRITICAL, "mdtp: mdtp_get_target_efuse: ERROR, target_efuse is NULL\n");
+        return -1;
+    }
+
+    target_efuse->address = MDTP_EFUSE_ADDRESS_MSM8953;
+    target_efuse->start = MDTP_EFUSE_START_MSM8953;
+
+    return 0;
+}
diff --git a/target/msmtitanium/rules.mk b/target/msmtitanium/rules.mk
index fe575b6..2a9eea6 100644
--- a/target/msmtitanium/rules.mk
+++ b/target/msmtitanium/rules.mk
@@ -1,8 +1,13 @@
 LOCAL_DIR := $(GET_LOCAL_DIR)
 
 INCLUDES += -I$(LOCAL_DIR)/include -I$(LK_TOP_DIR)/platform/msm_shared
+
 INCLUDES += -I$(LK_TOP_DIR)/dev/gcdb/display -I$(LK_TOP_DIR)/dev/gcdb/display/include
 
+ifeq ($(ENABLE_MDTP_SUPPORT),1)
+INCLUDES += -I$(LK_TOP_DIR)/app/aboot
+endif
+
 PLATFORM := msmtitanium
 
 MEMBASE := 0x8F600000 # SDRAM
@@ -32,7 +37,6 @@
 	BASE_ADDR=$(BASE_ADDR) \
 	SCRATCH_ADDR=$(SCRATCH_ADDR)
 
-
 OBJS += \
 	$(LOCAL_DIR)/init.o \
 	$(LOCAL_DIR)/meminfo.o \
@@ -42,3 +46,8 @@
 OBJS += \
 	$(LOCAL_DIR)/regulator.o
 endif
+
+ifeq ($(ENABLE_MDTP_SUPPORT),1)
+OBJS += \
+	$(LOCAL_DIR)/mdtp_defs.o
+endif