diff --git a/AndroidBoot.mk b/AndroidBoot.mk
index 89cbfd0..5f31a90 100644
--- a/AndroidBoot.mk
+++ b/AndroidBoot.mk
@@ -55,6 +55,12 @@
   ENABLE_DISPLAY := ENABLE_DISPLAY=1
 endif
 
+ifeq ($(KASLRSEED_SUPPORT),true)
+  ENABLE_KASLRSEED := ENABLE_KASLRSEED=1
+else
+  ENABLE_KASLRSEED := ENABLE_KASLRSEED=0
+endif
+
 ifeq (1,$(filter 1,$(shell echo "$$(( $(PLATFORM_SDK_VERSION) >= 24 ))" )))
   OSVERSION_IN_BOOTIMAGE := OSVERSION_IN_BOOTIMAGE=1
   ENABLE_VB_ATTEST := ENABLE_VB_ATTEST=1
@@ -95,7 +101,7 @@
 # ELF binary for ABOOT
 TARGET_ABOOT_ELF := $(PRODUCT_OUT)/aboot.elf
 $(TARGET_ABOOT_ELF): ABOOT_CLEAN | $(ABOOT_OUT)
-	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(ABOOT_OUT) $(BOOTLOADER_PLATFORM) $(EMMC_BOOT) $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE)
+	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(ABOOT_OUT) $(BOOTLOADER_PLATFORM) $(EMMC_BOOT) $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_KASLRSEED) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE)
 
 # NAND variant output
 TARGET_NAND_BOOTLOADER := $(PRODUCT_OUT)/appsboot.mbn
@@ -124,7 +130,7 @@
 
 # Top level for eMMC variant targets
 $(TARGET_EMMC_BOOTLOADER): emmc_appsbootldr_clean | $(EMMC_BOOTLOADER_OUT) $(INSTALLED_KEYSTOREIMAGE_TARGET)
-	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(EMMC_BOOTLOADER_OUT) $(BOOTLOADER_PLATFORM) EMMC_BOOT=1 $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE) $(ENABLE_BG_SUPPORT)
+	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(EMMC_BOOTLOADER_OUT) $(BOOTLOADER_PLATFORM) EMMC_BOOT=1 $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_KASLRSEED) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE) $(ENABLE_BG_SUPPORT)
 
 # Keep build NAND & eMMC as default for targets still using TARGET_BOOTLOADER
 TARGET_BOOTLOADER := $(PRODUCT_OUT)/EMMCBOOT.MBN
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index df71a56..4fbda79 100755
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -1011,12 +1011,7 @@
 		return 0;
 }
 
-#define ROUND_TO_PAGE(x,y) (((x) + (y)) & (~(y)))
-
 BUF_DMA_ALIGN(buf, BOOT_IMG_MAX_PAGE_SIZE); //Equal to max-supported pagesize
-#if DEVICE_TREE
-BUF_DMA_ALIGN(dt_buf, BOOT_IMG_MAX_PAGE_SIZE);
-#endif
 
 static void verify_signed_bootimg(uint32_t bootimg_addr, uint32_t bootimg_size)
 {
@@ -1701,6 +1696,7 @@
 	        }
 	}
 
+	/* Read boot.img header from flash */
 	if (flash_read(ptn, offset, buf, page_size)) {
 		dprintf(CRITICAL, "ERROR: Cannot read boot image header\n");
 		return -1;
@@ -1782,38 +1778,41 @@
 	}
 #endif
 
+	/* Read full boot.img from flash */
+	dprintf(INFO, "Loading (%s) image (%d): start\n",
+		(!boot_into_recovery ? "boot" : "recovery"),imagesize_actual);
+	bs_set_timestamp(BS_KERNEL_LOAD_START);
+
+	if (UINT_MAX - page_size < imagesize_actual)
+	{
+		dprintf(CRITICAL,"Integer overflow detected in bootimage header fields %u %s\n", __LINE__,__func__);
+		return -1;
+	}
+
+	/*Check the availability of RAM before reading boot image + max signature length from flash*/
+	if (target_get_max_flash_size() < (imagesize_actual + page_size))
+	{
+		dprintf(CRITICAL, "bootimage  size is greater than DDR can hold\n");
+		return -1;
+	}
+
+	offset = page_size;
+	/* Read image without signature and header */
+	if (flash_read(ptn, offset, (void *)(image_addr + offset), imagesize_actual - page_size))
+	{
+		dprintf(CRITICAL, "ERROR: Cannot read boot image\n");
+			return -1;
+	}
+
+	dprintf(INFO, "Loading (%s) image (%d): done\n",
+		(!boot_into_recovery ? "boot" : "recovery"), imagesize_actual);
+	bs_set_timestamp(BS_KERNEL_LOAD_DONE);
+
 	/* Authenticate Kernel */
 	if(target_use_signed_kernel() && (!device.is_unlocked))
 	{
-		dprintf(INFO, "Loading (%s) image (%d): start\n",
-			(!boot_into_recovery ? "boot" : "recovery"),imagesize_actual);
-		bs_set_timestamp(BS_KERNEL_LOAD_START);
-
-		if (UINT_MAX - page_size < imagesize_actual)
-		{
-			dprintf(CRITICAL,"Integer overflow detected in bootimage header fields %u %s\n", __LINE__,__func__);
-			return -1;
-		}
-
-		/*Check the availability of RAM before reading boot image + max signature length from flash*/
-		if (target_get_max_flash_size() < (imagesize_actual + page_size))
-		{
-			dprintf(CRITICAL, "bootimage  size is greater than DDR can hold\n");
-			return -1;
-		}
-		offset = page_size;
-		/* Read image without signature and header*/
-		if (flash_read(ptn, offset, (void *)(image_addr + offset), imagesize_actual - page_size))
-		{
-			dprintf(CRITICAL, "ERROR: Cannot read boot image\n");
-				return -1;
-		}
-
-		dprintf(INFO, "Loading (%s) image (%d): done\n",
-			(!boot_into_recovery ? "boot" : "recovery"), imagesize_actual);
-		bs_set_timestamp(BS_KERNEL_LOAD_DONE);
-
 		offset = imagesize_actual;
+
 		/* Read signature */
 		if (flash_read(ptn, offset, (void *)(image_addr + offset), page_size))
 		{
@@ -1822,59 +1821,74 @@
 		}
 
 		verify_signed_bootimg((uint32_t)image_addr, imagesize_actual);
-
-		/* Move kernel and ramdisk to correct address */
-		memmove((void*) hdr->kernel_addr, (char*) (image_addr + page_size), hdr->kernel_size);
-		memmove((void*) hdr->ramdisk_addr, (char*) (image_addr + page_size + kernel_actual), hdr->ramdisk_size);
-#if DEVICE_TREE
-		if(dt_size != 0) {
-
-			dt_table_offset = ((uint32_t)image_addr + page_size + kernel_actual + ramdisk_actual + second_actual);
-
-			table = (struct dt_table*) dt_table_offset;
-
-			if (dev_tree_validate(table, hdr->page_size, &dt_hdr_size) != 0){
-				dprintf(CRITICAL, "ERROR: Cannot validate Device Tree Table \n");
-				return -1;
-			}
-
-			/* Its Error if, dt_hdr_size (table->num_entries * dt_entry size + Dev_Tree Header)
-			goes beyound hdr->dt_size*/
-			if (dt_hdr_size > ROUND_TO_PAGE(dt_size, hdr->page_size)) {
-				dprintf(CRITICAL, "ERROR: Invalid Device Tree size \n");
-				return -1;
-			}
-
-			/* Find index of device tree within device tree table */
-			if(dev_tree_get_entry_info(table, &dt_entry) != 0){
-				dprintf(CRITICAL, "ERROR: Getting device tree address failed\n");
-				return -1;
-			}
-
-			/* Validate and Read device device tree in the "tags_add */
-			if (check_aboot_addr_range_overlap(hdr->tags_addr, dt_entry.size) ||
-				check_ddr_addr_range_bound(hdr->tags_addr, dt_entry.size)){
-				dprintf(CRITICAL, "Device tree addresses are not valid.\n");
-				return -1;
-			}
-
-			if(dt_entry.offset > (UINT_MAX - dt_entry.size)) {
-				dprintf(CRITICAL, "ERROR: Device tree contents are Invalid\n");
-				return -1;
-			}
-
-			/* Ensure we are not overshooting dt_size with the dt_entry selected */
-			if ((dt_entry.offset + dt_entry.size) > dt_size) {
-				dprintf(CRITICAL, "ERROR: Device tree contents are Invalid\n");
-				return -1;
-			}
-
-			best_match_dt_addr = (unsigned char *)table + dt_entry.offset;
-			dtb_size = dt_entry.size;
-			memmove((void *)hdr->tags_addr, (char *)best_match_dt_addr, dtb_size);
+	}
+	offset = page_size;
+	if(hdr->second_size != 0) {
+		if (UINT_MAX - offset < second_actual)
+		{
+			dprintf(CRITICAL, "ERROR: Integer overflow in boot image header %s\t%d\n",__func__,__LINE__);
+			return -1;
 		}
-#endif
+		offset += second_actual;
+		/* Second image loading not implemented. */
+		ASSERT(0);
+	}
 
+	/* Move kernel and ramdisk to correct address */
+	memmove((void*) hdr->kernel_addr, (char*) (image_addr + page_size), hdr->kernel_size);
+	memmove((void*) hdr->ramdisk_addr, (char*) (image_addr + page_size + kernel_actual), hdr->ramdisk_size);
+
+#if DEVICE_TREE
+	if(dt_size != 0) {
+
+		dt_table_offset = ((uint32_t)image_addr + page_size + kernel_actual + ramdisk_actual + second_actual);
+
+		table = (struct dt_table*) dt_table_offset;
+
+		if (dev_tree_validate(table, hdr->page_size, &dt_hdr_size) != 0) {
+			dprintf(CRITICAL, "ERROR: Cannot validate Device Tree Table \n");
+			return -1;
+		}
+
+		/* Its Error if, dt_hdr_size (table->num_entries * dt_entry size + Dev_Tree Header)
+		goes beyound hdr->dt_size*/
+		if (dt_hdr_size > ROUND_TO_PAGE(dt_size,hdr->page_size)) {
+			dprintf(CRITICAL, "ERROR: Invalid Device Tree size \n");
+			return -1;
+		}
+
+		/* Find index of device tree within device tree table */
+		if(dev_tree_get_entry_info(table, &dt_entry) != 0){
+			dprintf(CRITICAL, "ERROR: Getting device tree address failed\n");
+			return -1;
+		}
+
+		/* Validate and Read device device tree in the "tags_add */
+		if (check_aboot_addr_range_overlap(hdr->tags_addr, dt_entry.size) ||
+			check_ddr_addr_range_bound(hdr->tags_addr, dt_entry.size))
+		{
+			dprintf(CRITICAL, "Device tree addresses are not valid.\n");
+			return -1;
+		}
+
+		if(dt_entry.offset > (UINT_MAX - dt_entry.size)) {
+			dprintf(CRITICAL, "ERROR: Device tree contents are Invalid\n");
+			return -1;
+		}
+
+		/* Ensure we are not overshooting dt_size with the dt_entry selected */
+		if ((dt_entry.offset + dt_entry.size) > dt_size) {
+			dprintf(CRITICAL, "ERROR: Device tree contents are Invalid\n");
+			return -1;
+		}
+
+		best_match_dt_addr = (unsigned char *)table + dt_entry.offset;
+		dtb_size = dt_entry.size;
+		memmove((void *)hdr->tags_addr, (char *)best_match_dt_addr, dtb_size);
+	}
+#endif
+	if(target_use_signed_kernel() && (!device.is_unlocked))
+	{
 		/* Make sure everything from scratch address is read before next step!*/
 		if(device.is_tampered)
 		{
@@ -1884,121 +1898,7 @@
 		set_tamper_flag(device.is_tampered);
 #endif
 	}
-	else
-	{
-		dprintf(INFO, "Loading (%s) image (%d): start\n",
-				(!boot_into_recovery ? "boot" : "recovery"), kernel_actual + ramdisk_actual);
 
-		bs_set_timestamp(BS_KERNEL_LOAD_START);
-
-		offset = page_size;
-		if (UINT_MAX - offset < kernel_actual)
-		{
-			dprintf(CRITICAL, "ERROR: Integer overflow in boot image header %s\t%d\n",__func__,__LINE__);
-			return -1;
-		}
-		if (flash_read(ptn, offset, (void *)hdr->kernel_addr, kernel_actual)) {
-			dprintf(CRITICAL, "ERROR: Cannot read kernel image\n");
-			return -1;
-		}
-		offset += kernel_actual;
-		if (UINT_MAX - offset < ramdisk_actual)
-		{
-			dprintf(CRITICAL, "ERROR: Integer overflow in boot image header %s\t%d\n",__func__,__LINE__);
-			return -1;
-		}
-		if (flash_read(ptn, offset, (void *)hdr->ramdisk_addr, ramdisk_actual)) {
-			dprintf(CRITICAL, "ERROR: Cannot read ramdisk image\n");
-			return -1;
-		}
-
-		offset += ramdisk_actual;
-
-		dprintf(INFO, "Loading (%s) image (%d): done\n",
-				(!boot_into_recovery ? "boot" : "recovery"), kernel_actual + ramdisk_actual);
-
-		bs_set_timestamp(BS_KERNEL_LOAD_DONE);
-
-		if(hdr->second_size != 0) {
-			if (UINT_MAX - offset < second_actual)
-			{
-				dprintf(CRITICAL, "ERROR: Integer overflow in boot image header %s\t%d\n",__func__,__LINE__);
-				return -1;
-			}
-			offset += second_actual;
-			/* Second image loading not implemented. */
-			ASSERT(0);
-		}
-
-#if DEVICE_TREE
-		if(dt_size != 0) {
-
-			/* Read the device tree table into buffer */
-			if(flash_read(ptn, offset, (void *) dt_buf, page_size)) {
-				dprintf(CRITICAL, "ERROR: Cannot read the Device Tree Table\n");
-				return -1;
-			}
-
-			table = (struct dt_table*) dt_buf;
-
-			if (dev_tree_validate(table, hdr->page_size, &dt_hdr_size) != 0) {
-				dprintf(CRITICAL, "ERROR: Cannot validate Device Tree Table \n");
-				return -1;
-			}
-
-			/* Its Error if, dt_hdr_size (table->num_entries * dt_entry size + Dev_Tree Header)
-			goes beyound hdr->dt_size*/
-			if (dt_hdr_size > ROUND_TO_PAGE(dt_size,hdr->page_size)) {
-				dprintf(CRITICAL, "ERROR: Invalid Device Tree size \n");
-				return -1;
-			}
-
-			table = (void *) target_get_scratch_address();
-			/*Check the availability of RAM before reading boot image + max signature length from flash*/
-			if (target_get_max_flash_size() < dt_actual)
-			{
-				dprintf(CRITICAL, "ERROR: dt_image size is greater than DDR can hold\n");
-				return -1;
-			}
-
-			/* Read the entire device tree table into buffer */
-			if(flash_read(ptn, offset, (void *)table, dt_actual)) {
-				dprintf(CRITICAL, "ERROR: Cannot read the Device Tree Table\n");
-				return -1;
-			}
-
-			/* Find index of device tree within device tree table */
-			if(dev_tree_get_entry_info(table, &dt_entry) != 0){
-				dprintf(CRITICAL, "ERROR: Getting device tree address failed\n");
-				return -1;
-			}
-
-			/* Validate and Read device device tree in the "tags_add */
-			if (check_aboot_addr_range_overlap(hdr->tags_addr, dt_entry.size) ||
-				check_ddr_addr_range_bound(hdr->tags_addr, dt_entry.size))
-			{
-				dprintf(CRITICAL, "Device tree addresses are not valid.\n");
-				return -1;
-			}
-
-			if(dt_entry.offset > (UINT_MAX - dt_entry.size)) {
-				dprintf(CRITICAL, "ERROR: Device tree contents are Invalid\n");
-				return -1;
-			}
-
-			/* Ensure we are not overshooting dt_size with the dt_entry selected */
-			if ((dt_entry.offset + dt_entry.size) > dt_size) {
-				dprintf(CRITICAL, "ERROR: Device tree contents are Invalid\n");
-				return -1;
-			}
-
-			best_match_dt_addr = (unsigned char *)table + dt_entry.offset;
-			dtb_size = dt_entry.size;
-			memmove((void *)hdr->tags_addr, (char *)best_match_dt_addr, dtb_size);
-		}
-#endif
-
-	}
 continue_boot:
 
 	/* TODO: create/pass atags to kernel */
diff --git a/app/aboot/fastboot.c b/app/aboot/fastboot.c
index d82f3e5..d605efb 100644
--- a/app/aboot/fastboot.c
+++ b/app/aboot/fastboot.c
@@ -720,7 +720,7 @@
 	fastboot_register("upload", cmd_upload);
 	fastboot_publish("version", "0.5");
 
-	thr = thread_create("fastboot", fastboot_handler, 0, DEFAULT_PRIORITY, 4096);
+	thr = thread_create("fastboot", fastboot_handler, 0, DEFAULT_PRIORITY, DEFAULT_STACK_SIZE);
 	if (!thr)
 	{
 		goto fail_alloc_in;
diff --git a/app/aboot/mdtp.c b/app/aboot/mdtp.c
index 136fab5..05f7998 100644
--- a/app/aboot/mdtp.c
+++ b/app/aboot/mdtp.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -74,7 +74,6 @@
 static int is_mdtp_activated = -1;
 
 extern int check_aboot_addr_range_overlap(uintptr_t start, uint32_t size);
-int scm_random(uint32_t * rbuf, uint32_t  r_len);
 void free_mdtp_image(void);
 
 /********************************************************************************/
@@ -282,7 +281,7 @@
 	{
 		if (*force_verify_block == 0)
 		{
-			if(scm_random((uint32_t *)&rand_int, sizeof(rand_int)))
+			if(scm_random((uintptr_t *)&rand_int, sizeof(rand_int)))
 			{
 				dprintf(CRITICAL,"mdtp: scm_call for random failed\n");
 				return -1;
diff --git a/app/aboot/mdtp.h b/app/aboot/mdtp.h
index adb3878..4e6fa73 100644
--- a/app/aboot/mdtp.h
+++ b/app/aboot/mdtp.h
@@ -40,7 +40,6 @@
 #define INITIAL_DELAY_MSECONDS      5000
 #define INVALID_PIN_DELAY_MSECONDS  5000
 
-#define ROUND_TO_PAGE(x,y) (((x) + (y)) & (~(y)))
 #define MDTP_FWLOCK_BLOCK_SIZE          (1024*1024*16)
 #define MDTP_FWLOCK_MAX_FILES           (100)
 #define MDTP_FWLOCK_MAX_FILE_NAME_LEN   (100)
diff --git a/app/aboot/mdtp_fs.c b/app/aboot/mdtp_fs.c
index 39f456a..1c1ea44 100644
--- a/app/aboot/mdtp_fs.c
+++ b/app/aboot/mdtp_fs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -147,7 +147,7 @@
 	}
 
 	image_sets_num = mdtp_fs_get_param(IMAGE_SETS_NUM);
-	if (image_sets_num < 1) {
+	if ( (image_sets_num < 1) || (image_sets_num >= MAX_IMAGES) ) {
 		dprintf(CRITICAL, "ERROR: invalid number of image sets: %d\n", image_sets_num);
 		return -1;
 	}
diff --git a/app/aboot/recovery.c b/app/aboot/recovery.c
index cecfb27..a4048ab 100644
--- a/app/aboot/recovery.c
+++ b/app/aboot/recovery.c
@@ -43,14 +43,13 @@
 #include <partition_parser.h>
 #include <mmc.h>
 #include <malloc.h>
-
+#include <stdlib.h>
 #include "recovery.h"
 #include "bootimg.h"
 #include "smem.h"
 
 #define BOOT_FLAGS	1
 #define UPDATE_STATUS	2
-#define ROUND_TO_PAGE(x,y) (((x) + (y)) & (~(y)))
 
 static const int MISC_PAGES = 3;			// number of pages to save
 static const int MISC_COMMAND_PAGE = 1;		// bootloader command is this page
diff --git a/arch/arm/crt0.S b/arch/arm/crt0.S
index be6d4d6..51c9a2e 100644
--- a/arch/arm/crt0.S
+++ b/arch/arm/crt0.S
@@ -191,5 +191,5 @@
 	 * dynamically allocated stack, so we don't need it for very long
 	 */
 abort_stack:
-	.skip 2048
+	.skip 4096
 abort_stack_top:
diff --git a/dev/pmic/pm8x41/include/pm8x41.h b/dev/pmic/pm8x41/include/pm8x41.h
index 2e0a270..5b1c20e 100644
--- a/dev/pmic/pm8x41/include/pm8x41.h
+++ b/dev/pmic/pm8x41/include/pm8x41.h
@@ -229,6 +229,7 @@
 int pm8x41_ldo_control(struct pm8x41_ldo *ldo, uint8_t enable);
 uint8_t pm8x41_get_pmic_rev();
 uint8_t pm8x41_get_pon_reason();
+uint8_t pm660_get_pon_reason();
 uint8_t pm8950_get_pon_reason();
 uint8_t pm8x41_get_pon_poff_reason1();
 uint8_t pm8x41_get_pon_poff_reason2();
@@ -237,6 +238,7 @@
 void pm8x41_enable_mpp(struct pm8x41_mpp *mpp, enum mpp_en_ctl enable);
 void pm8x41_enable_mvs(struct pm8x41_mvs *mvs, enum mvs_en_ctl enable);
 uint8_t pm8x41_get_is_cold_boot();
+uint8_t pm660_get_is_cold_boot();
 void pm8x41_diff_clock_ctrl(uint8_t enable);
 void pm8x41_clear_pmic_watchdog(void);
 void pm8x41_lnbb_clock_ctrl(uint8_t enable);
diff --git a/dev/pmic/pm8x41/include/pm8x41_hw.h b/dev/pmic/pm8x41/include/pm8x41_hw.h
index 6484a10..d213582 100644
--- a/dev/pmic/pm8x41/include/pm8x41_hw.h
+++ b/dev/pmic/pm8x41/include/pm8x41_hw.h
@@ -69,6 +69,8 @@
 
 /* PON Peripheral registers */
 #define PON_PON_REASON1                       0x808
+#define PM660_PON_REASON1                     0x8C0
+#define PM660_PON_WARMBOOT_STATUS1            0x8C2
 #define PON_WARMBOOT_STATUS1                  0x80A
 #define PON_WARMBOOT_STATUS2                  0x80B
 #define PON_POFF_REASON1                      0x80C
diff --git a/dev/pmic/pm8x41/pm8x41.c b/dev/pmic/pm8x41/pm8x41.c
index 51a0f96..0c389eb 100644
--- a/dev/pmic/pm8x41/pm8x41.c
+++ b/dev/pmic/pm8x41/pm8x41.c
@@ -581,6 +581,11 @@
 	return REG_READ(REVID_REVISION4);
 }
 
+uint8_t pm660_get_pon_reason()
+{
+	return REG_READ(PM660_PON_REASON1);
+}
+
 uint8_t pm8x41_get_pon_reason()
 {
 	return REG_READ(PON_PON_REASON1);
@@ -631,6 +636,15 @@
 	REG_WRITE(((mpp->base + MPP_MODE_CTL) + (mpp_slave_id << 16)), mpp->mode | (MPP_DIGITAL_OUTPUT << MPP_MODE_CTL_MODE_SHIFT));
 }
 
+uint8_t pm660_get_is_cold_boot()
+{
+	if (REG_READ(PM660_PON_WARMBOOT_STATUS1)) {
+		dprintf(INFO,"%s: Warm boot\n", __func__);
+		return 0;
+	}
+	return 1;
+}
+
 uint8_t pm8x41_get_is_cold_boot()
 {
 	if (REG_READ(PON_WARMBOOT_STATUS1) || REG_READ(PON_WARMBOOT_STATUS2)) {
diff --git a/include/kernel/thread.h b/include/kernel/thread.h
index 6c25712..5f8b42b 100644
--- a/include/kernel/thread.h
+++ b/include/kernel/thread.h
@@ -92,8 +92,8 @@
 #define DEFAULT_PRIORITY (NUM_PRIORITIES / 2)
 #define HIGH_PRIORITY ((NUM_PRIORITIES / 4) * 3)
 
-/* stack size */
-#define DEFAULT_STACK_SIZE 8192
+/* stack size  - 12kb per thread (12 * 1024) */
+#define DEFAULT_STACK_SIZE 12288
 
 /* functions */
 void thread_init_early(void);
diff --git a/include/stdlib.h b/include/stdlib.h
index 22dcf4c..de63213 100644
--- a/include/stdlib.h
+++ b/include/stdlib.h
@@ -49,6 +49,9 @@
 #define ROUNDUP(a, b) (((a) + ((b)-1)) & ~((b)-1))
 #define ROUNDDOWN(a, b) ((a) & ~((b)-1))
 
+/* Macro returns UINT_MAX in case of overflow */
+#define ROUND_TO_PAGE(x,y) ((ROUNDUP((x),((y)+1)) < (x))?UINT_MAX:ROUNDUP((x),((y)+1)))
+
 /* allocate a buffer on the stack aligned and padded to the cpu's cache line size */
 #define STACKBUF_DMA_ALIGN(var, size) \
 	uint8_t __##var[(size) + CACHE_LINE] __attribute__((aligned(CACHE_LINE))); uint8_t *var = (uint8_t *)(ROUNDUP((addr_t)__##var, CACHE_LINE))
diff --git a/include/target.h b/include/target.h
index 2963b2d..772c424 100644
--- a/include/target.h
+++ b/include/target.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2008 Travis Geiselbrecht
  *
- * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining
  * a copy of this software and associated documentation files
@@ -98,6 +98,7 @@
 int target_cont_splash_screen(void);
 bool target_build_variant_user();
 void pmic_reset_configure(uint8_t reset_type);
+bool is_display_disabled(void);
 
 struct qmp_reg *target_get_qmp_settings();
 int target_get_qmp_regsize();
diff --git a/makefile b/makefile
index f4e7c19..f52f698 100644
--- a/makefile
+++ b/makefile
@@ -141,6 +141,13 @@
   DEFINES += USE_LE_SYSTEMD=0
 endif
 
+#Enable kaslr seed support
+ifeq ($(ENABLE_KASLRSEED),1)
+  DEFINES += ENABLE_KASLRSEED_SUPPORT=1
+else
+  DEFINES += ENABLE_KASLRSEED_SUPPORT=0
+endif
+
 # these need to be filled out by the project/target/platform rules.mk files
 TARGET :=
 PLATFORM :=
diff --git a/platform/msm8909/gpio.c b/platform/msm8909/gpio.c
index 6ec4e33..7621bb8 100644
--- a/platform/msm8909/gpio.c
+++ b/platform/msm8909/gpio.c
@@ -31,6 +31,7 @@
 #include <platform/iomap.h>
 #include <platform/gpio.h>
 #include <blsp_qup.h>
+#include <smem.h>
 
 void gpio_tlmm_config(uint32_t gpio, uint8_t func,
 			uint8_t dir, uint8_t pull,
@@ -54,13 +55,26 @@
 /* Configure gpio for blsp uart 2 */
 void gpio_config_uart_dm(uint8_t id)
 {
-	/* configure rx gpio */
-	gpio_tlmm_config(5, 2, GPIO_INPUT, GPIO_NO_PULL,
+	if (board_hardware_subtype() == HW_PLATFORM_SUBTYPE_8909_PM660_V1)
+	{
+		/* configure rx gpio */
+		gpio_tlmm_config(21, 3, GPIO_INPUT, GPIO_NO_PULL,
 				GPIO_8MA, GPIO_DISABLE);
 
-	/* configure tx gpio */
-	gpio_tlmm_config(4, 2, GPIO_OUTPUT, GPIO_NO_PULL,
+		/* configure tx gpio */
+		gpio_tlmm_config(20, 3, GPIO_OUTPUT, GPIO_NO_PULL,
 				GPIO_8MA, GPIO_DISABLE);
+	}
+	else
+	{
+		/* configure rx gpio */
+		gpio_tlmm_config(5, 2, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_8MA, GPIO_DISABLE);
+
+		/* configure tx gpio */
+		gpio_tlmm_config(4, 2, GPIO_OUTPUT, GPIO_NO_PULL,
+				GPIO_8MA, GPIO_DISABLE);
+	}
 }
 
 uint32_t gpio_status(uint32_t gpio)
diff --git a/platform/msm8909/include/platform/iomap.h b/platform/msm8909/include/platform/iomap.h
index 9b59657..4361afd 100644
--- a/platform/msm8909/include/platform/iomap.h
+++ b/platform/msm8909/include/platform/iomap.h
@@ -249,6 +249,8 @@
 #define MDP_INTR_STATUS             REG_MDP(0x00054)
 
 #define MDP_CGC_EN                  REG_MDP(0x100)
+#define MDP_AUTOREFRESH_CONFIG_P    REG_MDP(0x34C)
+#define MDP_SYNC_CONFIG_0           REG_MDP(0x300)
 
 #define SOFT_RESET                  0x118
 #define CLK_CTRL                    0x11C
@@ -293,6 +295,9 @@
 #define BOOT_CONFIG_OFFSET          0x0000602C
 #define BOOT_CONFIG_REG             (SEC_CTRL_CORE_BASE + BOOT_CONFIG_OFFSET)
 
+/* For Reading efuse entries to check whether mdp needs to be disabled or not */
+#define EFUSE_OFFSET		    0x00000044
+
 #define SECURITY_CONTROL_CORE_FEATURE_CONFIG0    0x0005E004
 /* EBI2 */
 #define TLMM_EBI2_EMMC_GPIO_CFG     (TLMM_BASE_ADDR + 0x00111000)
diff --git a/platform/msm8909/msm8909-clock.c b/platform/msm8909/msm8909-clock.c
index da7e222..04a7a42 100644
--- a/platform/msm8909/msm8909-clock.c
+++ b/platform/msm8909/msm8909-clock.c
@@ -283,6 +283,35 @@
 	},
 };
 
+static struct rcg_clk blsp1_uart2_apps_clk_src =
+{
+	.cmd_reg      = (uint32_t *) BLSP1_UART2_APPS_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) BLSP1_UART2_APPS_CFG_RCGR,
+	.m_reg        = (uint32_t *) BLSP1_UART2_APPS_M,
+	.n_reg        = (uint32_t *) BLSP1_UART2_APPS_N,
+	.d_reg        = (uint32_t *) BLSP1_UART2_APPS_D,
+
+	.set_rate     = clock_lib2_rcg_set_rate_mnd,
+	.freq_tbl     = ftbl_gcc_blsp1_2_uart1_6_apps_clk,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "blsp1_uart2_apps_clk",
+		.ops      = &clk_ops_rcg_mnd,
+	},
+};
+
+static struct branch_clk gcc_blsp1_uart2_apps_clk =
+{
+	.cbcr_reg     = (uint32_t *) BLSP1_UART2_APPS_CBCR,
+	.parent       = &blsp1_uart2_apps_clk_src.c,
+
+	.c = {
+		.dbg_name = "gcc_blsp1_uart2_apps_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
 static struct vote_clk gcc_blsp1_ahb_clk = {
 	.cbcr_reg     = (uint32_t *) BLSP1_AHB_CBCR,
 	.vote_reg     = (uint32_t *) APCS_CLOCK_BRANCH_ENA_VOTE,
@@ -294,6 +323,7 @@
 	},
 };
 
+
 /* USB Clocks */
 static struct clk_freq_tbl ftbl_gcc_usb_hs_system_clk[] =
 {
@@ -659,6 +689,10 @@
 	CLK_LOOKUP("uart1_iface_clk", gcc_blsp1_ahb_clk.c),
 	CLK_LOOKUP("uart1_core_clk",  gcc_blsp1_uart1_apps_clk.c),
 
+	CLK_LOOKUP("uart2_iface_clk", gcc_blsp1_ahb_clk.c),
+	CLK_LOOKUP("uart2_core_clk",  gcc_blsp1_uart2_apps_clk.c),
+
+
 	CLK_LOOKUP("usb_iface_clk",  gcc_usb_hs_ahb_clk.c),
 	CLK_LOOKUP("usb_core_clk",   gcc_usb_hs_system_clk.c),
 
diff --git a/platform/msm_shared/crypto5_eng.c b/platform/msm_shared/crypto5_eng.c
index 933d30b..b7c9e7b 100644
--- a/platform/msm_shared/crypto5_eng.c
+++ b/platform/msm_shared/crypto5_eng.c
@@ -361,16 +361,18 @@
 	crypto_SHA1_ctx *sha1_ctx = (crypto_SHA1_ctx *) ctx_ptr;
 	uint32_t i = 0;
 	uint32_t iv_len = 0;
-	uint32_t *auth_iv = sha1_ctx->auth_iv;
+	uint32_t *auth_iv = NULL;
 	uint32_t seg_cfg_val;
 
 	if(auth_alg == CRYPTO_AUTH_ALG_SHA1)
 	{
 		iv_len = SHA1_INIT_VECTOR_SIZE;
+		auth_iv = sha1_ctx->auth_iv;
 	}
 	else if(auth_alg == CRYPTO_AUTH_ALG_SHA256)
 	{
 		iv_len = SHA256_INIT_VECTOR_SIZE;
+		auth_iv = sha256_ctx->auth_iv;
 	}
 
 	seg_cfg_val = crypto5_get_sha_cfg(ctx_ptr, auth_alg);
diff --git a/platform/msm_shared/dev_tree.c b/platform/msm_shared/dev_tree.c
index 1cf358a..ecff926 100644
--- a/platform/msm_shared/dev_tree.c
+++ b/platform/msm_shared/dev_tree.c
@@ -41,6 +41,7 @@
 #include <partial_goods.h>
 #include <boot_device.h>
 #include <platform.h>
+#include <scm.h>
 
 #define BOOT_DEV_MAX_LEN        64
 #define NODE_PROPERTY_MAX_LEN   64
@@ -1308,6 +1309,9 @@
 {
 	int ret = 0;
 	uint32_t offset;
+#if ENABLE_KASLRSEED_SUPPORT
+	uintptr_t kaslrseed;
+#endif
 
 	/* Check the device tree header */
 	ret = fdt_check_header(fdt) || fdt_check_header_ext(fdt);
@@ -1368,6 +1372,19 @@
 		}
 	}
 
+#if ENABLE_KASLRSEED_SUPPORT
+	if (!scm_random(&kaslrseed, sizeof(kaslrseed))) {
+		/* Adding Kaslr Seed to the chosen node */
+		ret = fdt_appendprop_u64 (fdt, offset, (const char *)"kaslr-seed", (uint64_t)kaslrseed);
+		if (ret)
+			dprintf(CRITICAL, "ERROR: Cannot update chosen node [kaslr-seed] - 0x%x\n", ret);
+		else
+			dprintf(CRITICAL, "kaslr-Seed is added to chosen node\n");
+	} else {
+		dprintf(CRITICAL, "ERROR: Cannot generate Kaslr Seed\n");
+	}
+#endif
+
 	if (ramdisk_size) {
 		/* Adding the initrd-start to the chosen node */
 		ret = fdt_setprop_u32(fdt, offset, "linux,initrd-start",
diff --git a/platform/msm_shared/display_menu.c b/platform/msm_shared/display_menu.c
index 4942567..391e5ff 100644
--- a/platform/msm_shared/display_menu.c
+++ b/platform/msm_shared/display_menu.c
@@ -130,6 +130,8 @@
 
 void wait_for_users_action()
 {
+	if (is_display_disabled())
+		return;
 	/* Waiting for exit menu keys detection if there is no any usr action
 	 * otherwise it will do the action base on the keys detection thread
 	 */
@@ -141,6 +143,9 @@
 	struct select_msg_info *select_msg;
 	select_msg = &msg_info;
 
+	if (is_display_disabled())
+		return;
+
 	mutex_acquire(&select_msg->msg_lock);
 	select_msg->info.is_exit = true;
 	mutex_release(&select_msg->msg_lock);
@@ -476,6 +481,9 @@
 	struct select_msg_info *unlock_menu_msg_info;
 	unlock_menu_msg_info = &msg_info;
 
+	if (is_display_disabled())
+		return;
+
 	set_message_factor();
 
 	msg_lock_init();
@@ -497,6 +505,9 @@
 	struct select_msg_info *fastboot_menu_msg_info;
 	fastboot_menu_msg_info = &msg_info;
 
+	if (is_display_disabled())
+		return;
+
 	set_message_factor();
 
 	msg_lock_init();
@@ -524,6 +535,9 @@
 	struct select_msg_info *bootverify_menu_msg_info;
 	bootverify_menu_msg_info = &msg_info;
 
+	if (is_display_disabled())
+		return;
+
 	set_message_factor();
 
 	msg_lock_init();
diff --git a/platform/msm_shared/include/mdp3.h b/platform/msm_shared/include/mdp3.h
index 183800a..aede553 100644
--- a/platform/msm_shared/include/mdp3.h
+++ b/platform/msm_shared/include/mdp3.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011, 2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011, 2014, 2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,11 +29,36 @@
 
 #include <dev/fbcon.h>
 #include <msm_panel.h>
+#include <platform/iomap.h>
+#include <smem.h>
 
 //TODO: Make a global PASS / FAIL define
 #define PASS                        0
 #define FAIL                        1
 
+#define EFUSE_ENTRY(addr,off,s, m, sh,id) \
+{\
+	.start_address =addr,\
+	.offset = off, \
+	.size   = s,\
+	.mask   = m,\
+	.shift  = sh,\
+	.board_id = id \
+}
+
+struct mdp_efuse_data {
+	uint32_t start_address;
+	uint32_t offset;
+	uint32_t size;
+	uint32_t mask;
+	uint32_t shift;
+	uint32_t board_id;
+};
+
+static struct mdp_efuse_data efuse_data[]= {
+        EFUSE_ENTRY(SEC_CTRL_CORE_BASE, EFUSE_OFFSET, 4, 0x20000000, 0x1D, APQ8009),
+};
+
 int mdp_setup_dma_p_video_mode(unsigned short disp_width,
 			       unsigned short disp_height,
 			       unsigned short img_width,
@@ -58,3 +83,5 @@
 int mdp_edp_config(struct msm_panel_info *pinfo, struct fbcon_config *fb);
 int mdp_edp_on(struct msm_panel_info *pinfo);
 int mdp_edp_off(void);
+bool display_efuse_check(void);
+void efuse_display_enable(char *pbuf, uint16_t buf_size);
diff --git a/platform/msm_shared/include/scm.h b/platform/msm_shared/include/scm.h
index 128d14b..8c482a4 100644
--- a/platform/msm_shared/include/scm.h
+++ b/platform/msm_shared/include/scm.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -402,6 +402,7 @@
 int restore_secure_cfg(uint32_t id);
 
 void scm_elexec_call(paddr_t kernel_entry, paddr_t dtb_offset);
+int scm_random(uintptr_t * rbuf, uint32_t  r_len);
 uintptr_t get_canary();
 /* API to configure XPU violations as fatal */
 int scm_xpu_err_fatal_init();
diff --git a/platform/msm_shared/mdp3.c b/platform/msm_shared/mdp3.c
index 8c59bae..b9169c1 100644
--- a/platform/msm_shared/mdp3.c
+++ b/platform/msm_shared/mdp3.c
@@ -163,7 +163,12 @@
 	int ret = 0;
 	unsigned short pack_pattern = 0x21;
 	unsigned char ystride = 3;
+	unsigned int sync_cfg;
 	unsigned long long panic_config = 0;
+	const uint32_t vsync_hz = 19200000; /* Vsync Clock 19.2 HMz */
+	/* Auto refresh fps = Panel fps / frame num */
+	/* Auto refresh frame num = 60/10 = 6fps */
+	const uint32_t autorefresh_framenum = 10;
 
 	if (pinfo == NULL)
 		return ERR_INVALID_ARGS;
@@ -186,7 +191,8 @@
 	writel(0x03ffffff, MDP_INTR_ENABLE);
 
 	// ------------- programming MDP_DMA_P_CONFIG ---------------------
-	writel(pack_pattern << 8 | 0x3f | (0 << 25)| (1 << 19) | (1 << 7) , MDP_DMA_P_CONFIG);  // rgb888
+	writel(pack_pattern << 8 | 0x3f | (0 << 25)| (1 << 19) | (1 << 7) ,
+		MDP_DMA_P_CONFIG);  /* rgb888 */
 	writel(0x00000000, MDP_DMA_P_OUT_XY);
 	writel(pinfo->yres << 16 | pinfo->xres, MDP_DMA_P_SIZE);
 	writel((uint32_t)fb->base, MDP_DMA_P_BUF_ADDR);
@@ -195,6 +201,14 @@
 
 	writel(0x10, MDP_DSI_CMD_MODE_ID_MAP);
 	writel(0x11, MDP_DSI_CMD_MODE_TRIGGER_EN);
+	/* Enable Auto refresh */
+	sync_cfg = (pinfo->yres - 1) << 21;
+	sync_cfg |= BIT(19);
+
+	sync_cfg |= vsync_hz / (pinfo->yres * 60);
+	writel(sync_cfg, MDP_SYNC_CONFIG_0);
+	writel((BIT(28) | autorefresh_framenum),
+		MDP_AUTOREFRESH_CONFIG_P);
 	mdelay(10);
 
 	return ret;
@@ -227,6 +241,9 @@
 		 */
 		mdelay(10);
 	}
+	/* Disable Auto refresh */
+	if (readl(MDP_AUTOREFRESH_CONFIG_P))
+		writel(0, MDP_AUTOREFRESH_CONFIG_P);
 	writel(0x00000000, MDP_INTR_ENABLE);
 	writel(0x01ffffff, MDP_INTR_CLEAR);
 	return NO_ERROR;
diff --git a/platform/msm_shared/smem.h b/platform/msm_shared/smem.h
index 74e0688..b931ca4 100644
--- a/platform/msm_shared/smem.h
+++ b/platform/msm_shared/smem.h
@@ -514,6 +514,7 @@
 	HW_PLATFORM_SUBTYPE_SWOC_NOWGR_CIRC = 13,
 	HW_PLATFORM_SUBTYPE_8909_PM660 = 15,
 	HW_PLATFORM_SUBTYPE_8909_COMPAL_ALPHA = 19,
+	HW_PLATFORM_SUBTYPE_8909_PM660_V1 = 18,
 	HW_PLATFORM_SUBTYPE_32BITS = 0x7FFFFFFF
 };
 
diff --git a/target/init.c b/target/init.c
index 7a66623..fed33cc 100644
--- a/target/init.c
+++ b/target/init.c
@@ -397,6 +397,10 @@
 	return PMIC_IS_UNKNOWN;
 }
 
+__WEAK bool is_display_disabled()
+{
+	return false;
+}
 /* Check battery if it's exist */
 bool target_battery_is_present()
 {
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index 268bdab..790dabb 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -159,10 +159,14 @@
 	/* Do not intilaise UART in case the h/w
 	* is RCM.
 	*/
-	if( board_hardware_id()!= HW_PLATFORM_RCM )
-		uart_dm_init(1, 0, BLSP1_UART0_BASE);
-	else
+	uint32_t platform_subtype = board_hardware_subtype();
+
+	if( board_hardware_id() == HW_PLATFORM_RCM )
 		return;
+	else if ( platform_subtype == HW_PLATFORM_SUBTYPE_8909_PM660_V1)
+		uart_dm_init(2, 0, BLSP1_UART1_BASE);
+	else
+		uart_dm_init(1, 0, BLSP1_UART0_BASE);
 #endif
 
 }
@@ -644,15 +648,28 @@
 
 unsigned target_pause_for_battery_charge(void)
 {
-	uint8_t pon_reason = pm8x41_get_pon_reason();
-	uint8_t is_cold_boot = pm8x41_get_is_cold_boot();
-	dprintf(INFO, "%s : pon_reason is %d cold_boot:%d\n", __func__,
-		pon_reason, is_cold_boot);
+	uint32_t pmic = target_get_pmic();
+	uint8_t pon_reason = 0;
+	uint8_t is_cold_boot = 0;
+
 	/* In case of fastboot reboot,adb reboot or if we see the power key
 	* pressed we do not want go into charger mode.
 	* fastboot reboot is warm boot with PON hard reset bit not set
 	* adb reboot is a cold boot with PON hard reset bit set
 	*/
+	if (pmic == PMIC_IS_PM660)
+	{
+		pon_reason = pm660_get_pon_reason();
+		is_cold_boot = pm660_get_is_cold_boot();
+	}
+	else
+	{
+		pon_reason = pm8x41_get_pon_reason();
+		is_cold_boot = pm8x41_get_is_cold_boot();
+	}
+	dprintf(INFO, "%s : pon_reason is %d cold_boot:%d\n", __func__,
+		pon_reason, is_cold_boot);
+
 	if (is_cold_boot &&
 			(!(pon_reason & HARD_RST)) &&
 			(!(pon_reason & KPDPWR_N)) &&
@@ -826,7 +843,8 @@
 
 uint32_t target_get_pmic()
 {
-	if (board_hardware_subtype() == HW_PLATFORM_SUBTYPE_8909_PM660)
+	if ((board_hardware_subtype() == HW_PLATFORM_SUBTYPE_8909_PM660) ||
+		(board_hardware_subtype() == HW_PLATFORM_SUBTYPE_8909_PM660_V1))
 		return PMIC_IS_PM660;
 	else
 		return PMIC_IS_PM8909;
diff --git a/target/msm8909/oem_panel.c b/target/msm8909/oem_panel.c
index e4da42e..051f3cb 100644
--- a/target/msm8909/oem_panel.c
+++ b/target/msm8909/oem_panel.c
@@ -62,6 +62,7 @@
 
 enum {
 	BG_WTP = 0x0F,
+	WTP_V1 = 0x12,
 };
 /*---------------------------------------------------------------------------*/
 /* static panel selection variable                                           */
@@ -484,6 +485,7 @@
 	case HW_PLATFORM_RCM:
 		switch (platform_subtype) {
 		case BG_WTP:
+		case WTP_V1:
 			panel_id = AUO_390P_CMD_PANEL;
 			break;
 		default:
diff --git a/target/msm8909/target_display.c b/target/msm8909/target_display.c
old mode 100755
new mode 100644
index 526b138..0edfa89
--- a/target/msm8909/target_display.c
+++ b/target/msm8909/target_display.c
@@ -60,6 +60,7 @@
 static struct gpio_pin bob_gpio = {
   "pm8941_gpios", 12, 2, 1, 0, 1
 };
+static bool display_efuse = false;
 
 static void mdss_dsi_uniphy_pll_sw_reset_8909(uint32_t pll_base)
 {
@@ -201,7 +202,8 @@
 	if (bl->bl_interface_type == BL_DCS)
 		return 0;
 
-	if (!((HW_PLATFORM_SUBTYPE_8909_PM660 == platform_subtype) &&
+	if (!(((HW_PLATFORM_SUBTYPE_8909_PM660 == platform_subtype) ||
+		(HW_PLATFORM_SUBTYPE_8909_PM660_V1 == platform_subtype)) &&
 		((MSM8909W == platform) || (APQ8009W == platform)) &&
 		(HW_PLATFORM_MTP == hw_id))) {
 		struct pm8x41_mpp mpp;
@@ -298,7 +300,8 @@
 	uint32_t hw_subtype = board_hardware_subtype();
 	uint32_t platform = board_platform_id();
 
-	if ((HW_PLATFORM_SUBTYPE_8909_PM660 == hw_subtype) &&
+	if (((HW_PLATFORM_SUBTYPE_8909_PM660 == hw_subtype) ||
+		(HW_PLATFORM_SUBTYPE_8909_PM660_V1 == hw_subtype)) &&
 		((MSM8909W == platform) || (APQ8009W == platform)) &&
 		(HW_PLATFORM_MTP == hw_id)) {
 		struct pm8x41_gpio bobgpio_param = {
@@ -353,7 +356,8 @@
 	uint32_t platform = board_platform_id();
 
 	if (enable) {
-		if ((HW_PLATFORM_SUBTYPE_8909_PM660 == hw_subtype) &&
+		if (((HW_PLATFORM_SUBTYPE_8909_PM660 == hw_subtype) ||
+			(HW_PLATFORM_SUBTYPE_8909_PM660_V1 == hw_subtype)) &&
 			((MSM8909W == platform) || (APQ8009W == platform)) &&
 			(HW_PLATFORM_MTP == hw_id))
 			regulator_enable(REG_LDO12 | REG_LDO5 | REG_LDO11 | REG_LDO18);
@@ -393,6 +397,38 @@
 	}
 }
 
+bool is_display_disabled(void)
+{
+	return display_efuse;
+}
+
+bool display_efuse_check(void)
+{
+	int i;
+	uint32_t efuse = 0;
+	uint32_t board_id = board_platform_id();
+
+	for (i = 0; i < ARRAY_SIZE(efuse_data);i++)
+		if (board_id == efuse_data[i].board_id) {
+			efuse = readl((efuse_data[i].start_address + efuse_data[i].offset));
+			display_efuse = (efuse & (efuse_data[i].mask)) >> (efuse_data[i].shift);
+	}
+
+	dprintf(INFO,"Efuse register: display disable flag = %d\n",display_efuse);
+	return display_efuse;
+}
+
+void efuse_display_enable(char *pbuf, uint16_t buf_size)
+{
+	char *default_str;
+	int prefix_display_len = strlen(pbuf);
+	if (display_efuse)
+		default_str = ";display_disabled:1";
+	pbuf += prefix_display_len;
+	buf_size -= prefix_display_len;
+	strlcpy(pbuf, default_str, buf_size);
+}
+
 bool target_display_panel_node(char *pbuf, uint16_t buf_size)
 {
 	int ret = true;
@@ -400,6 +436,14 @@
 	if (!target_splash_disable())
 		ret = gcdb_display_cmdline_arg(pbuf, buf_size);
 
+	if (display_efuse_check()){
+                if (target_splash_disable()){
+                        strlcpy(pbuf, DISPLAY_CMDLINE_PREFIX, buf_size);
+                        efuse_display_enable(pbuf, buf_size);
+                } else
+                        efuse_display_enable(pbuf, buf_size);
+        }
+
 	return ret;
 }
 
@@ -409,6 +453,9 @@
 	uint32_t ret = 0;
 	struct oem_panel_data oem;
 
+	if (display_efuse_check())
+		return;
+
 	set_panel_cmd_string(panel_name);
 	oem = mdss_dsi_get_oem_data();
 
diff --git a/target/msm8953/rules.mk b/target/msm8953/rules.mk
index 1957d9c..aef1150 100644
--- a/target/msm8953/rules.mk
+++ b/target/msm8953/rules.mk
@@ -9,7 +9,7 @@
 PLATFORM := msm8953
 
 MEMBASE := 0x8F600000 # SDRAM
-MEMSIZE := 0x00400000 # 1MB
+MEMSIZE := 0x00600000 # 6MB
 
 BASE_ADDR        := 0x80000000
 SCRATCH_ADDR     := 0xA0100000