Merge "dev: gcdb: display: Add fastboot oem support for mirrorlake panel"
diff --git a/AndroidBoot.mk b/AndroidBoot.mk
index efecfa5..89cbfd0 100644
--- a/AndroidBoot.mk
+++ b/AndroidBoot.mk
@@ -1,16 +1,24 @@
 #Android makefile to build lk bootloader as a part of Android Build
 
+ifeq ($(PRODUCT_IOT),true)
+  LK_PATH := hardware/bsp/bootloader/qcom/lk
+  CROOT_DIR := ../../../../..
+else
+  LK_PATH := bootable/bootloader/lk/
+  CROOT_DIR := ../../..
+endif
+
 ifeq ($(BOOTLOADER_GCC_VERSION),)
 ifndef $(2ND_TARGET_GCC_VERSION)
-CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/arm-eabi-$(TARGET_GCC_VERSION)/bin/arm-eabi-
+CROSS_COMPILE := $(CROOT_DIR)/prebuilts/gcc/linux-x86/arm/arm-eabi-$(TARGET_GCC_VERSION)/bin/arm-eabi-
 else
-CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/arm-eabi-$(2ND_TARGET_GCC_VERSION)/bin/arm-eabi-
+CROSS_COMPILE := $(CROOT_DIR)/prebuilts/gcc/linux-x86/arm/arm-eabi-$(2ND_TARGET_GCC_VERSION)/bin/arm-eabi-
 endif
 else # BOOTLOADER_GCC_VERSION defined
 ifeq ($(BOOTLOADER_GCC_VERSION),arm-linux-androideabi-4.9)
-CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/$(BOOTLOADER_GCC_VERSION)/bin/arm-linux-androideabi-
+CROSS_COMPILE := $(CROOT_DIR)/prebuilts/gcc/linux-x86/arm/$(BOOTLOADER_GCC_VERSION)/bin/arm-linux-androideabi-
 else
-CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/$(BOOTLOADER_GCC_VERSION)/bin/arm-eabi-
+CROSS_COMPILE := $(CROOT_DIR)/prebuilts/gcc/linux-x86/arm/$(BOOTLOADER_GCC_VERSION)/bin/arm-eabi-
 endif
 endif
 
@@ -34,10 +42,10 @@
 ifeq ($(EARLY_MOUNT_SUPPORT),true)
   ENABLE_BOOTDEVICE_MOUNT := ENABLE_BOOTDEVICE_MOUNT=1
 else
-  ENABLE_BOOTDEVICE_MOUNT := ENABLE_BOOTDEVICE_MOUNT=1
+  ENABLE_BOOTDEVICE_MOUNT := ENABLE_BOOTDEVICE_MOUNT=0
 endif
 
-ifeq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_PM660),true)
+ifeq ($(BOARD_HAVE_PM660),true)
   ENABLE_BG_SUPPORT := ENABLE_BG_SUPPORT=1
 endif
 
@@ -63,6 +71,10 @@
   BUILD_VARIANT := USER_BUILD_VARIANT=true
 endif
 
+ifeq ($(TARGET_BOARD_PLATFORM),msm8x09)
+  BOOTLOADER_PLATFORM := msm8909
+endif
+
 ifeq ($(TARGET_BOARD_PLATFORM),msm8660)
   BOOTLOADER_PLATFORM := msm8660_surf
 endif
@@ -83,7 +95,7 @@
 # ELF binary for ABOOT
 TARGET_ABOOT_ELF := $(PRODUCT_OUT)/aboot.elf
 $(TARGET_ABOOT_ELF): ABOOT_CLEAN | $(ABOOT_OUT)
-	$(MAKE) -C bootable/bootloader/lk TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=../../../$(ABOOT_OUT) $(BOOTLOADER_PLATFORM) $(EMMC_BOOT) $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE)
+	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(ABOOT_OUT) $(BOOTLOADER_PLATFORM) $(EMMC_BOOT) $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE)
 
 # NAND variant output
 TARGET_NAND_BOOTLOADER := $(PRODUCT_OUT)/appsboot.mbn
@@ -108,11 +120,11 @@
 
 # Top level for NAND variant targets
 $(TARGET_NAND_BOOTLOADER): appsbootldr_clean | $(NAND_BOOTLOADER_OUT)
-	$(MAKE) -C bootable/bootloader/lk TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=../../../$(NAND_BOOTLOADER_OUT) $(BOOTLOADER_PLATFORM) $(SIGNED_KERNEL) $(BOARD_NAME)
+	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(NAND_BOOTLOADER_OUT) $(BOOTLOADER_PLATFORM) $(SIGNED_KERNEL) $(BOARD_NAME)
 
 # Top level for eMMC variant targets
 $(TARGET_EMMC_BOOTLOADER): emmc_appsbootldr_clean | $(EMMC_BOOTLOADER_OUT) $(INSTALLED_KEYSTOREIMAGE_TARGET)
-	$(MAKE) -C bootable/bootloader/lk TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=../../../$(EMMC_BOOTLOADER_OUT) $(BOOTLOADER_PLATFORM) EMMC_BOOT=1 $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE) $(ENABLE_BG_SUPPORT)
+	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(EMMC_BOOTLOADER_OUT) $(BOOTLOADER_PLATFORM) EMMC_BOOT=1 $(SIGNED_KERNEL) $(VERIFIED_BOOT) $(ENABLE_DISPLAY) $(ENABLE_BOOTDEVICE_MOUNT) $(DEVICE_STATUS) $(BUILD_VARIANT) $(BOARD_NAME) $(ENABLE_VB_ATTEST) $(OSVERSION_IN_BOOTIMAGE) $(ENABLE_BG_SUPPORT)
 
 # Keep build NAND & eMMC as default for targets still using TARGET_BOOTLOADER
 TARGET_BOOTLOADER := $(PRODUCT_OUT)/EMMCBOOT.MBN
@@ -133,4 +145,4 @@
 
 $(TARGET_NANDWRITE): nandwrite_clean | $(NANDWRITE_OUT)
 	@echo $(BOOTLOADER_PLATFORM)_nandwrite
-	$(MAKE) -C bootable/bootloader/lk TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=../../../$(NANDWRITE_OUT) $(BOOTLOADER_PLATFORM)_nandwrite BUILD_NANDWRITE=1
+	$(MAKE) -C $(LK_PATH) TOOLCHAIN_PREFIX=$(CROSS_COMPILE) BOOTLOADER_OUT=$(CROOT_DIR)/$(NANDWRITE_OUT) $(BOOTLOADER_PLATFORM)_nandwrite BUILD_NANDWRITE=1
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 26c5d1c..834fe07 100755
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -189,7 +189,6 @@
 static const char *sys_path = "  root=/dev/mmcblk0p";
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
 static const char *verity_mode = " androidboot.veritymode=";
 static const char *verified_state= " androidboot.verifiedbootstate=";
 static const char *keymaster_v1= " androidboot.keymaster=1";
@@ -212,7 +211,6 @@
 	{RED,"red" },
 };
 #endif
-#endif
 /*As per spec delay wait time before shutdown in Red state*/
 #define DELAY_WAIT 30000
 static unsigned page_size = 0;
@@ -229,11 +227,7 @@
 
 /* Assuming unauthorized kernel image by default */
 static int auth_kernel_img = 0;
-#if VBOOT_MOTA
-static device_info device = {DEVICE_MAGIC, 0, 0, 0, 0, {0}, {0},{0}};
-#else
 static device_info device = {DEVICE_MAGIC, 0, 0, 0, 0, {0}, {0},{0}, 1};
-#endif
 static bool is_allow_unlock = 0;
 
 static char frp_ptns[2][8] = {"config","frp"};
@@ -353,15 +347,19 @@
 	char lun_char_base = 'a';
 	int syspath_buflen = strlen(sys_path) + sizeof(int) + 1; /*allocate buflen for largest possible string*/
 	char syspath_buf[syspath_buflen];
+#if VERIFIED_BOOT
+	uint32_t boot_state = RED;
+#endif
 
 #if USE_LE_SYSTEMD
 	is_systemd_present=true;
 #endif
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-    uint32_t boot_state = boot_verify_get_state();
-#endif
+	if (VB_V2 == target_get_vb_version())
+	{
+    		boot_state = boot_verify_get_state();
+	}
 #endif
 
 #ifdef MDTP_SUPPORT
@@ -386,16 +384,17 @@
 	cmdline_len += strlen(sn_buf);
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	cmdline_len += strlen(verified_state) + strlen(vbsn[boot_state].name);
-	if ((device.verity_mode != 0 ) && (device.verity_mode != 1))
+	if (VB_V2 == target_get_vb_version())
 	{
-		dprintf(CRITICAL, "Devinfo paritition possibly corrupted!!!. Please erase devinfo partition to continue booting\n");
-		ASSERT(0);
+		cmdline_len += strlen(verified_state) + strlen(vbsn[boot_state].name);
+		if ((device.verity_mode != 0 ) && (device.verity_mode != 1))
+		{
+			dprintf(CRITICAL, "Devinfo paritition possibly corrupted!!!. Please erase devinfo partition to continue booting\n");
+			ASSERT(0);
+		}
+		cmdline_len += strlen(verity_mode) + strlen(vbvm[device.verity_mode].name);
+		cmdline_len += strlen(keymaster_v1);
 	}
-	cmdline_len += strlen(verity_mode) + strlen(vbvm[device.verity_mode].name);
-	cmdline_len += strlen(keymaster_v1);
-#endif
 #endif
 
 	if (boot_into_recovery && gpt_exists)
@@ -556,30 +555,31 @@
 		}
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-		src = verified_state;
-		if(have_cmdline) --dst;
-		have_cmdline = 1;
-		while ((*dst++ = *src++));
-		src = vbsn[boot_state].name;
-		if(have_cmdline) --dst;
-		while ((*dst++ = *src++));
-
-		if ((device.verity_mode != 0 ) && (device.verity_mode != 1))
+		if (VB_V2 == target_get_vb_version())
 		{
-			dprintf(CRITICAL, "Devinfo paritition possibly corrupted!!!. Please erase devinfo partition to continue booting\n");
-			ASSERT(0);
+			src = verified_state;
+			if(have_cmdline) --dst;
+			have_cmdline = 1;
+			while ((*dst++ = *src++));
+			src = vbsn[boot_state].name;
+			if(have_cmdline) --dst;
+			while ((*dst++ = *src++));
+
+			if ((device.verity_mode != 0 ) && (device.verity_mode != 1))
+			{
+				dprintf(CRITICAL, "Devinfo paritition possibly corrupted!!!. Please erase devinfo partition to continue booting\n");
+				ASSERT(0);
+			}
+			src = verity_mode;
+			if(have_cmdline) --dst;
+			while ((*dst++ = *src++));
+			src = vbvm[device.verity_mode].name;
+			if(have_cmdline) -- dst;
+			while ((*dst++ = *src++));
+			src = keymaster_v1;
+			if(have_cmdline) --dst;
+			while ((*dst++ = *src++));
 		}
-		src = verity_mode;
-		if(have_cmdline) --dst;
-		while ((*dst++ = *src++));
-		src = vbvm[device.verity_mode].name;
-		if(have_cmdline) -- dst;
-		while ((*dst++ = *src++));
-		src = keymaster_v1;
-		if(have_cmdline) --dst;
-		while ((*dst++ = *src++));
-#endif
 #endif
 		src = usb_sn_cmdline;
 		if (have_cmdline) --dst;
@@ -898,26 +898,26 @@
 	free(final_cmdline);
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	if (device.verity_mode == 0) {
+	if (VB_V2 == target_get_vb_version())
+	{
+		if (device.verity_mode == 0) {
 #if FBCON_DISPLAY_MSG
 #if ENABLE_VB_ATTEST
-		display_bootverify_menu(DISPLAY_MENU_EIO);
-		wait_for_users_action();
-		if(!pwr_key_is_pressed)
-			shutdown_device();
+			display_bootverify_menu(DISPLAY_MENU_EIO);
+			wait_for_users_action();
+			if(!pwr_key_is_pressed)
+				shutdown_device();
 #else
-		display_bootverify_menu(DISPLAY_MENU_LOGGING);
+			display_bootverify_menu(DISPLAY_MENU_LOGGING);
 #endif
-		wait_for_users_action();
+			wait_for_users_action();
 #else
-		dprintf(CRITICAL,
-			"The dm-verity is not started in enforcing mode.\nWait for 5 seconds before proceeding\n");
-		mdelay(5000);
+			dprintf(CRITICAL,
+				"The dm-verity is not started in enforcing mode.\nWait for 5 seconds before proceeding\n");
+			mdelay(5000);
 #endif
+		}
 	}
-
-#endif
 #endif
 
 #if VERIFIED_BOOT
@@ -1192,6 +1192,7 @@
 	unsigned int kernel_size = 0;
 	unsigned int patched_kernel_hdr_size = 0;
 	int rc;
+	char *ptn_name = NULL;
 #if DEVICE_TREE
 	struct dt_table *table;
 	struct dt_entry dt_entry;
@@ -1223,22 +1224,22 @@
 		hdr = uhdr;
 		goto unified_boot;
 	}
-	if (!boot_into_recovery) {
-		index = partition_get_index("boot");
-		ptn = partition_get_offset(index);
-		if(ptn == 0) {
-			dprintf(CRITICAL, "ERROR: No boot partition found\n");
-                    return -1;
-		}
+
+	/* For a/b recovery image code is on boot partition.
+	   If we support multislot, always use boot partition. */
+	if (boot_into_recovery &&
+		(!partition_multislot_is_supported()))
+			ptn_name = "recovery";
+	else
+			ptn_name = "boot";
+
+	index = partition_get_index(ptn_name);
+	ptn = partition_get_offset(index);
+	if(ptn == 0) {
+		dprintf(CRITICAL, "ERROR: No %s partition found\n", ptn_name);
+		return -1;
 	}
-	else {
-		index = partition_get_index("recovery");
-		ptn = partition_get_offset(index);
-		if(ptn == 0) {
-			dprintf(CRITICAL, "ERROR: No recovery partition found\n");
-                    return -1;
-		}
-	}
+
 	/* Set Lun for boot & recovery partitions */
 	mmc_set_lun(partition_get_lun(index));
 
@@ -1417,13 +1418,14 @@
 #endif
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	/* set boot and system versions. */
-	set_os_version((unsigned char *)image_addr);
-	// send root of trust
-	if(!send_rot_command((uint32_t)device.is_unlocked))
-		ASSERT(0);
-#endif
+	if (VB_V2 == target_get_vb_version())
+	{
+		/* set boot and system versions. */
+		set_os_version((unsigned char *)image_addr);
+		// send root of trust
+		if(!send_rot_command((uint32_t)device.is_unlocked))
+			ASSERT(0);
+	}
 #endif
 	/*
 	 * Check if the kernel image is a gzip package. If yes, need to decompress it.
@@ -2213,9 +2215,10 @@
 		memcpy(info, dev, sizeof(struct device_info));
 
 #if USE_RPMB_FOR_DEVINFO
-		if (is_secure_boot_enable()) {
-			if((write_device_info_rpmb((void*) info, PAGE_SIZE)) < 0)
-				ASSERT(0);
+		if (VB_V2 == target_get_vb_version() &&
+			is_secure_boot_enable()) {
+				if((write_device_info_rpmb((void*) info, PAGE_SIZE)) < 0)
+					ASSERT(0);
 		}
 		else
 			write_device_info_mmc(info);
@@ -2243,9 +2246,10 @@
 		info_buf = info;
 
 #if USE_RPMB_FOR_DEVINFO
-		if (is_secure_boot_enable()) {
-			if((read_device_info_rpmb((void*) info, PAGE_SIZE)) < 0)
-				ASSERT(0);
+		if (VB_V2 == target_get_vb_version() &&
+			is_secure_boot_enable()) {
+				if((read_device_info_rpmb((void*) info, PAGE_SIZE)) < 0)
+					ASSERT(0);
 		}
 		else
 			read_device_info_mmc(info);
@@ -2258,19 +2262,22 @@
 			memcpy(info->magic, DEVICE_MAGIC, DEVICE_MAGIC_SIZE);
 			if (is_secure_boot_enable()) {
 				info->is_unlocked = 0;
-#if !VBOOT_MOTA
-				info->is_unlock_critical = 0;
+#if VERIFIED_BOOT
+				if (VB_V2 == target_get_vb_version())
+					info->is_unlock_critical = 0;
 #endif
 			} else {
 				info->is_unlocked = 1;
-#if !VBOOT_MOTA
-				info->is_unlock_critical = 1;
+#if VERIFIED_BOOT
+				if (VB_V2 == target_get_vb_version())
+					info->is_unlock_critical = 1;
 #endif
 			}
 			info->is_tampered = 0;
 			info->charger_screen_enabled = 0;
-#if !VBOOT_MOTA
-			info->verity_mode = 1; //enforcing by default
+#if VERIFIED_BOOT
+			if (VB_V2 == target_get_vb_version())
+				info->verity_mode = 1; //enforcing by default
 #endif
 			write_device_info(info);
 		}
@@ -2309,9 +2316,10 @@
 {
 	if (type == UNLOCK)
 		device.is_unlocked = status;
-#if !VBOOT_MOTA
-	else if (type == UNLOCK_CRITICAL)
-		device.is_unlock_critical = status;
+#if VERIFIED_BOOT
+	else if (VB_V2 == target_get_vb_version() &&
+			type == UNLOCK_CRITICAL)
+			device.is_unlock_critical = status;
 #endif
 	write_device_info(&device);
 }
@@ -2324,9 +2332,12 @@
 	/* check device unlock status if it is as expected */
 	if (type == UNLOCK)
 		is_unlocked = device.is_unlocked;
-#if !VBOOT_MOTA
-	else if (type == UNLOCK_CRITICAL)
-		is_unlocked = device.is_unlock_critical;
+#if VERIFIED_BOOT
+	if(VB_V2 == target_get_vb_version() &&
+		type == UNLOCK_CRITICAL)
+	{
+			is_unlocked = device.is_unlock_critical;
+	}
 #endif
 	if (is_unlocked == status) {
 		snprintf(response, sizeof(response), "\tDevice already : %s", (status ? "unlocked!" : "locked!"));
@@ -2608,13 +2619,14 @@
 #endif /* MDTP_SUPPORT */
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	/* set boot and system versions. */
-	set_os_version((unsigned char *)data);
-	// send root of trust
-	if(!send_rot_command((uint32_t)device.is_unlocked))
-		ASSERT(0);
-#endif
+	if (VB_V2 == target_get_vb_version())
+	{
+		/* set boot and system versions. */
+		set_os_version((unsigned char *)data);
+		// send root of trust
+		if(!send_rot_command((uint32_t)device.is_unlocked))
+			ASSERT(0);
+	}
 #endif
 	/*
 	 * Check if the kernel image is a gzip package. If yes, need to decompress it.
@@ -2817,12 +2829,11 @@
 		}
 	}
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	if(!(strncmp(arg, "userdata", 8)))
-		if(send_delete_keys_to_tz())
+	if (VB_V2 == target_get_vb_version() &&
+		!(strncmp(arg, "userdata", 8)) &&
+		send_delete_keys_to_tz())
 			ASSERT(0);
 #endif
-#endif
 	fastboot_okay("");
 }
 
@@ -2992,12 +3003,13 @@
 			fastboot_fail("Device is locked, meta image flashing is not allowed");
 			return;
 		}
-#if !VBOOT_MOTA
-		if(!device.is_unlock_critical) {
+
+		if (VB_V2 == target_get_vb_version() &&
+			!device.is_unlock_critical) 
+		{
 			fastboot_fail("Device is critical locked, Meta image flashing is not allowed");
 			return;
 		}
-#endif
 	}
 #endif
 
@@ -3399,16 +3411,17 @@
 			fastboot_fail("Partition flashing is not allowed");
 			return;
 		}
-#if !VBOOT_MOTA
+
 		/* if device critical is locked:
 		 * common partition will allow to be flashed
 		 * critical partition will not allow to flash image.
 		 */
-		if(!device.is_unlock_critical && critical_flash_allowed(arg)) {
-			fastboot_fail("Critical partition flashing is not allowed");
-			return;
+		if (VB_V2 == target_get_vb_version() &&
+			!device.is_unlock_critical &&
+			critical_flash_allowed(arg)) {
+				fastboot_fail("Critical partition flashing is not allowed");
+				return;
 		}
-#endif
 	}
 #endif
 
@@ -3422,14 +3435,12 @@
 		cmd_flash_mmc_img(arg, data, sz);
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	if((!strncmp(arg, "system", 6)) && !device.verity_mode)
-	{
+	if (VB_V2 == target_get_vb_version() &&
+		(!strncmp(arg, "system", 6)) &&
+		!device.verity_mode)
 		// reset dm_verity mode to enforcing
 		device.verity_mode = 1;
 		write_device_info(&device);
-	}
-#endif
 #endif
 
 	return;
@@ -3769,9 +3780,13 @@
 	fastboot_info(response);
 	snprintf(response, sizeof(response), "\tDevice unlocked: %s", (device.is_unlocked ? "true" : "false"));
 	fastboot_info(response);
-#if !VBOOT_MOTA
-	snprintf(response, sizeof(response), "\tDevice critical unlocked: %s", (device.is_unlock_critical ? "true" : "false"));
-	fastboot_info(response);
+#if VERIFIED_BOOT
+	if (VB_V2 == target_get_vb_version())
+	{
+		snprintf(response, sizeof(response), "\tDevice critical unlocked: %s",
+					(device.is_unlock_critical ? "true" : "false"));
+		fastboot_info(response);
+	}
 #endif
 	snprintf(response, sizeof(response), "\tCharger screen enabled: %s", (device.charger_screen_enabled ? "true" : "false"));
 	fastboot_info(response);
@@ -4369,27 +4384,28 @@
 		boot_reason_alarm = true;
 	}
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	else if (reboot_mode == DM_VERITY_ENFORCING)
+	else if (VB_V2 == target_get_vb_version())
 	{
-		device.verity_mode = 1;
-		write_device_info(&device);
-	}
+		if (reboot_mode == DM_VERITY_ENFORCING)
+		{
+			device.verity_mode = 1;
+			write_device_info(&device);
+		}
 #if ENABLE_VB_ATTEST
-	else if (reboot_mode == DM_VERITY_EIO)
+		else if (reboot_mode == DM_VERITY_EIO)
 #else
-	else if (reboot_mode == DM_VERITY_LOGGING)
+		else if (reboot_mode == DM_VERITY_LOGGING)
 #endif
-	{
-		device.verity_mode = 0;
-		write_device_info(&device);
+		{
+			device.verity_mode = 0;
+			write_device_info(&device);
+		}
+		else if (reboot_mode == DM_VERITY_KEYSCLEAR)
+		{
+			if(send_delete_keys_to_tz())
+				ASSERT(0);
+		}
 	}
-	else if (reboot_mode == DM_VERITY_KEYSCLEAR)
-	{
-		if(send_delete_keys_to_tz())
-			ASSERT(0);
-	}
-#endif
 #endif
 
 normal_boot:
diff --git a/app/aboot/devinfo.h b/app/aboot/devinfo.h
index 12d0554..ed43f43 100644
--- a/app/aboot/devinfo.h
+++ b/app/aboot/devinfo.h
@@ -41,19 +41,7 @@
 	UNLOCK = 0,
 	UNLOCK_CRITICAL,
 };
-#if VBOOT_MOTA
-struct device_info
-{
-	unsigned char magic[DEVICE_MAGIC_SIZE];
-	bool is_unlocked;
-	bool is_tampered;
-	bool is_verified;
-	bool charger_screen_enabled;
-	char display_panel[MAX_PANEL_ID_LEN];
-	char bootloader_version[MAX_VERSION_LEN];
-	char radio_version[MAX_VERSION_LEN];
-};
-#else
+
 struct device_info
 {
 	unsigned char magic[DEVICE_MAGIC_SIZE];
@@ -67,4 +55,3 @@
 	bool verity_mode; // 1 = enforcing, 0 = logging
 };
 #endif
-#endif
diff --git a/app/aboot/fastboot.c b/app/aboot/fastboot.c
index 9d5fb77..d82f3e5 100644
--- a/app/aboot/fastboot.c
+++ b/app/aboot/fastboot.c
@@ -37,6 +37,7 @@
 #include <kernel/event.h>
 #include <dev/udc.h>
 #include "fastboot.h"
+#include <err.h>
 
 #ifdef USB30_SUPPORT
 #include <usb30_udc.h>
@@ -166,6 +167,8 @@
 static void *download_base;
 static unsigned download_max;
 static unsigned download_size;
+static void *upload_base_addr;
+static unsigned upload_size;
 
 #define STATE_OFFLINE	0
 #define STATE_COMMAND	1
@@ -497,6 +500,48 @@
 	fastboot_okay("");
 }
 
+int fboot_set_upload(void *buf, uint32_t buf_size)
+{
+	/* sanity checks*/
+	if((buf == NULL)||(buf_size > download_max))
+	{
+		return ERR_INVALID_ARGS;
+	}
+	upload_base_addr = buf;
+	upload_size = buf_size;
+	return NO_ERROR;
+}
+
+static void cmd_upload(const char *arg, void *data, unsigned sz)
+{
+	STACKBUF_DMA_ALIGN(response, MAX_RSP_SIZE);
+	unsigned len = upload_size;
+	int r;
+
+	if ((upload_base_addr == NULL)||(upload_size == 0)) {
+		fastboot_fail("invalid data");
+		goto cleanup;
+	}
+	snprintf((char *)response, MAX_RSP_SIZE, "DATA%08x", len);
+	if (usb_if.usb_write(response, strlen((const char *)response)) < 0)
+		goto cleanup;
+	/*
+	 * Discard the cache contents before starting the download
+	 */
+	arch_invalidate_cache_range((addr_t) upload_base_addr, len);
+
+	r = usb_if.usb_write(upload_base_addr, len);
+	if ((r < 0) || ((unsigned) r != len)) {
+		fastboot_state = STATE_ERROR;
+		goto cleanup;
+	}
+	fastboot_okay("");
+cleanup:
+	upload_base_addr = NULL;
+	upload_size = 0;
+	return;
+}
+
 static void fastboot_command_loop(void)
 {
 	struct fastboot_cmd *cmd;
@@ -540,7 +585,7 @@
 					dprintf(INFO,"fastboot: battery voltage: %d\n",
 						target_get_battery_voltage());
 					fastboot_fail("Warning: battery's capacity is very low\n");
-					return;
+					continue;
 				}
 			}
 		}
@@ -672,6 +717,7 @@
 
 	fastboot_register("getvar:", cmd_getvar);
 	fastboot_register("download:", cmd_download);
+	fastboot_register("upload", cmd_upload);
 	fastboot_publish("version", "0.5");
 
 	thr = thread_create("fastboot", fastboot_handler, 0, DEFAULT_PRIORITY, 4096);
diff --git a/app/aboot/fastboot.h b/app/aboot/fastboot.h
index 11355da..b1c4c8f 100644
--- a/app/aboot/fastboot.h
+++ b/app/aboot/fastboot.h
@@ -53,5 +53,9 @@
 void fastboot_fail(const char *reason);
 void fastboot_info(const char *reason);
 
+/* required for upload command
+ * should be called before calling upload
+ */
+int fboot_set_upload(void *buf, uint32_t buf_size);
 
 #endif
diff --git a/app/aboot/fastboot_test.c b/app/aboot/fastboot_test.c
index 70bc64e..5ad5b58 100644
--- a/app/aboot/fastboot_test.c
+++ b/app/aboot/fastboot_test.c
@@ -36,6 +36,7 @@
 #include <target.h>
 #include <boot_device.h>
 #include "mdtp.h"
+#include <ufs.h>
 #if USE_RPMB_FOR_DEVINFO
 #include <rpmb.h>
 #endif
diff --git a/dev/gcdb/display/include/panel_auo_390p_cmd.h b/dev/gcdb/display/include/panel_auo_390p_cmd.h
index 705e562..d886cb2 100644
--- a/dev/gcdb/display/include/panel_auo_390p_cmd.h
+++ b/dev/gcdb/display/include/panel_auo_390p_cmd.h
@@ -118,28 +118,23 @@
 
 
 static char auo_390p_cmd_on_cmd10[] = {
-	0x36, 0xc0, 0x015, 0x80,
-};
-
-
-static char auo_390p_cmd_on_cmd11[] = {
 	0x11, 0x00, 0x05, 0x80,
 };
 
 
-static char auo_390p_cmd_on_cmd12[] = {
+static char auo_390p_cmd_on_cmd11[] = {
 	0x29, 0x00, 0x05, 0x80,
 };
 
 
-static char auo_390p_cmd_on_cmd13[] = {
+static char auo_390p_cmd_on_cmd12[] = {
 	0x06, 0x00, 0x39, 0xC0,
 	0xf0, 0x55, 0xaa, 0x52,
 	0x08, 0x01, 0xff, 0xff,
 };
 
 
-static char auo_390p_cmd_on_cmd14[] = {
+static char auo_390p_cmd_on_cmd13[] = {
 	0x07, 0x00, 0x39, 0xC0,
 	0xff, 0x00, 0x55, 0xaa,
 	0x52, 0x08, 0x01, 0xff,
@@ -159,12 +154,11 @@
 	{ 0x4 , auo_390p_cmd_on_cmd9, 0x00},
 	{ 0x4 , auo_390p_cmd_on_cmd10, 0x00},
 	{ 0x4 , auo_390p_cmd_on_cmd11, 0x00},
-	{ 0x4 , auo_390p_cmd_on_cmd12, 0x00},
+	{ 0xc , auo_390p_cmd_on_cmd12, 0x00},
 	{ 0xc , auo_390p_cmd_on_cmd13, 0x00},
-	{ 0xc , auo_390p_cmd_on_cmd14, 0x00},
 };
 
-#define AUO_390P_CMD_ON_COMMAND 15
+#define AUO_390P_CMD_ON_COMMAND 14
 
 
 static char auo_390p_cmd_off_cmd0[] = {
diff --git a/include/target.h b/include/target.h
index a9a1eea..2963b2d 100644
--- a/include/target.h
+++ b/include/target.h
@@ -27,6 +27,14 @@
 #include <qmp_phy.h>
 
 #define TARGET_MAX_CMDLNBUF 64
+
+/* Enum for target VB version detection */
+enum
+{
+	VB_V1 = 1,
+	VB_V2 = 2,
+};
+
 /* Target helper functions exposed to USB driver */
 typedef struct {
 	void (*mux_config) ();
@@ -109,4 +117,5 @@
 bool target_battery_is_present();
 uint32_t target_get_pmic();
 int target_update_cmdline(char *cmdline);
+int target_get_vb_version();
 #endif
diff --git a/platform/msm_shared/ab_partition_parser.c b/platform/msm_shared/ab_partition_parser.c
index c224e0f..5f3a384 100644
--- a/platform/msm_shared/ab_partition_parser.c
+++ b/platform/msm_shared/ab_partition_parser.c
@@ -45,9 +45,9 @@
 const char *suffix_delimiter = "_";
 
 /* local global variables */
-static signed active_slot = INVALID;		/* to store current active slot */
-static bool attributes_updated = false;		/* to store if we need to update partition table */
-static bool multislot_support = false;		/* to store if multislot support is present */
+static signed active_slot;		/* to store current active slot */
+static bool attributes_updated;		/* to store if we need to update partition table */
+static bool multislot_support;		/* to store if multislot support is present */
 
 static int boot_slot_index[AB_SUPPORTED_SLOTS];	/* store index for boot parition */
 
@@ -116,7 +116,10 @@
 	struct partition_entry *partition_entries =
 				partition_get_partition_entries();
 
+	/* Intialize all slot specific variables */
 	multislot_support = false;
+	active_slot = INVALID;
+	attributes_updated = false;
 
 	if (partition_count > NUM_PARTITIONS)
 	{
@@ -236,9 +239,12 @@
 	unsigned boot_priority;
 	struct partition_entry *partition_entries = partition_get_partition_entries();
 
+#ifdef AB_DEBUG
+	dprintf(INFO, "partition_find_active_slot() called\n");
+#endif
 	/* Return current active slot if already found */
 	if (active_slot != INVALID)
-		return active_slot;
+		goto out;
 
 	for (boot_priority = MAX_PRIORITY;
 			boot_priority > 0; boot_priority--)
@@ -274,7 +280,8 @@
 #ifdef AB_DEBUG
 	dprintf(INFO, "Slot (%s) is Valid High Priority Slot\n", SUFFIX_SLOT(i));
 #endif
-					return i;
+					active_slot = i;
+					goto out;
 				}
 			}
 		}
@@ -290,13 +297,20 @@
 							PART_ATT_MAX_RETRY_COUNT_VAL) &
 							(~PART_ATT_SUCCESSFUL_VAL &
 							~PART_ATT_UNBOOTABLE_VAL));
+
+			active_slot = SLOT_A;
+			/* This is required to mark all bits as active,
+			for fresh boot post fresh flash */
+			partition_mark_active_slot(active_slot);
+
 			if (!attributes_updated)
 				attributes_updated = true;
-			return SLOT_A;
+
+			goto out;
 		}
 	}
-	/* If no valid slot */
-	return INVALID;
+out:
+	return active_slot;
 }
 
 static int
@@ -381,6 +395,11 @@
 {
 	unsigned char tmp_guid[PARTITION_TYPE_GUID_SIZE];
 
+#ifdef AB_DEBUG
+	dprintf(INFO, "Swapping GUID (%s) --> (%s) \n",
+			partition_entries[old_index].name,
+			partition_entries[new_index].name);
+#endif
 	memcpy(tmp_guid, partition_entries[old_index].type_guid,
 				PARTITION_TYPE_GUID_SIZE);
 	memcpy(partition_entries[old_index].type_guid,
@@ -435,6 +454,47 @@
 }
 
 /*
+Function: To set active bit of all partitions of actve slot.
+	also, unset active bits of all other slot
+*/
+static void
+mark_all_partitions_active(signed slot)
+{
+	int i,j;
+	char *pname = NULL;
+	char *suffix_str = NULL;
+	struct partition_entry *partition_entries =
+				partition_get_partition_entries();
+	int partition_count = partition_get_partition_count();
+
+	for (i=0; i<partition_count; i++)
+	{
+		pname = (char *)partition_entries[i].name;
+ #ifdef AB_DEBUG
+	dprintf(INFO, "Transversing partition %s\n", pname);
+ #endif
+		/* 1. Find partition, if it is A/B enabled. */
+		for ( j = 0; j<AB_SUPPORTED_SLOTS; j++)
+		{
+			suffix_str = strstr(pname, SUFFIX_SLOT(j));
+			if (suffix_str)
+				break;
+		}
+
+		if (suffix_str)
+		{
+			if (!strcmp(suffix_str, SUFFIX_SLOT(slot)))
+				/* 2a. Mark matching partition as active. */
+				partition_entries[i].attribute_flag |= PART_ATT_ACTIVE_VAL;
+			else
+				/* 2b. Unset active bit for all other partitions. */
+				partition_entries[i].attribute_flag &= ~PART_ATT_ACTIVE_VAL;
+		}
+	}
+	attributes_updated = true;
+}
+
+/*
 	Function: Mark the slot to be active and also conditionally
 	update the slot parameters if there is a change.
 */
@@ -443,22 +503,22 @@
 	if (active_slot == slot)
 		goto out;
 
-	switch (active_slot)
+	if(slot != INVALID)
 	{
-		case INVALID:
-			if (slot != SLOT_A)
-				swap_guid(SLOT_A, slot);
-			goto out;
-		default:
-			if (slot == INVALID)
-				swap_guid(active_slot, SLOT_A);
-			else
-				swap_guid(active_slot, slot);
+		dprintf(INFO, "Marking (%s) as active\n", SUFFIX_SLOT(slot));
+
+		/* 1. Swap GUID's to new slot */
+		swap_guid(active_slot, slot);
+
+		/* 2. Set Active bit for all partitions of active slot */
+		mark_all_partitions_active(slot);
 	}
+
 	active_slot = slot;
 out:
 	if (attributes_updated)
 		attributes_update();
+
 	return;
 }
 
@@ -642,6 +702,19 @@
 		    GET_LWORD_FROM_BYTE(&gpt_hdr_ptr[PARTITION_COUNT_OFFSET]);
 	partition_entry_size =
 		    GET_LWORD_FROM_BYTE(&gpt_hdr_ptr[PENTRY_SIZE_OFFSET]);
+
+	/* Check for partition entry size */
+	if (partition_entry_size != PARTITION_ENTRY_SIZE) {
+		dprintf(CRITICAL,"Invalid parition entry size\n");
+		goto out;
+	}
+
+	/* Check for maximum partition size */
+	if ((max_partition_count) > (MIN_PARTITION_ARRAY_SIZE /(partition_entry_size))) {
+		dprintf(CRITICAL, "Invalid maximum partition count\n");
+		goto out;
+	}
+
 	crc_val  = crc32(~0L, gpt_entries_ptr, ((max_partition_count) *
 				(partition_entry_size))) ^ (~0L);
 	PUT_LONG(&gpt_hdr_ptr[PARTITION_CRC_OFFSET], crc_val);
diff --git a/platform/msm_shared/display_menu.c b/platform/msm_shared/display_menu.c
index 8ee11ff..4942567 100644
--- a/platform/msm_shared/display_menu.c
+++ b/platform/msm_shared/display_menu.c
@@ -56,19 +56,21 @@
 				"or No. Then press the Power button to continue.\n";
 
 #define YELLOW_WARNING_MSG	"Your device has loaded a different operating system\n\n "\
-				"Visit this link on another device:\n g.co/ABH"
+				"Visit this link on another device:\n"
 
 #define ORANGE_WARNING_MSG	"Your device software can't be\n checked for corruption. Please lock the bootloader\n\n"\
-				"Visit this link on another device:\n g.co/ABH"
+				"Visit this link on another device:\n"
 
 #define RED_WARNING_MSG	"Your device is corrupt. It can't be\ntrusted and will not boot\n\n" \
-				"Visit this link on another device:\n g.co/ABH"
+				"Visit this link on another device:\n"
 
 #define LOGGING_WARNING_MSG	"The dm-verity is not started in enforcing mode and may "\
 				"not work properly\n\nTo learn more, visit:\n"
 
 #define EIO_WARNING_MSG		"Your device is corrupt. It can't be\n trusted and may not work properly.\n\n"\
-				"Visit this link on another device:\n g.co/ABH"
+				"Visit this link on another device:\n"
+
+#define URL_MSG "g.co/ABH\n"
 
 #define DELAY_5SEC 5000
 #define DELAY_30SEC 30000
@@ -80,14 +82,15 @@
 struct boot_verify_info {
 	int msg_type;
 	const char *warning_msg;
+	const char *url_msg;
 };
 
 struct boot_verify_info boot_verify_info[] = {
-			[DISPLAY_MENU_RED] = {FBCON_RED_MSG, RED_WARNING_MSG},
-			[DISPLAY_MENU_YELLOW] = {FBCON_YELLOW_MSG, YELLOW_WARNING_MSG},
-			[DISPLAY_MENU_ORANGE] = {FBCON_ORANGE_MSG, ORANGE_WARNING_MSG},
-			[DISPLAY_MENU_LOGGING] = {FBCON_RED_MSG, LOGGING_WARNING_MSG},
-			[DISPLAY_MENU_EIO] = {FBCON_RED_MSG, EIO_WARNING_MSG}};
+			[DISPLAY_MENU_RED] = {FBCON_RED_MSG, RED_WARNING_MSG, URL_MSG},
+			[DISPLAY_MENU_YELLOW] = {FBCON_YELLOW_MSG, YELLOW_WARNING_MSG, URL_MSG},
+			[DISPLAY_MENU_ORANGE] = {FBCON_ORANGE_MSG, ORANGE_WARNING_MSG, URL_MSG},
+			[DISPLAY_MENU_LOGGING] = {FBCON_RED_MSG, LOGGING_WARNING_MSG, NULL},
+			[DISPLAY_MENU_EIO] = {FBCON_RED_MSG, EIO_WARNING_MSG, URL_MSG}};
 #endif
 
 static char *verify_option_menu[] = {
@@ -286,8 +289,9 @@
 		display_fbcon_menu_message((char*)boot_verify_info[type].warning_msg,
 			FBCON_COMMON_MSG, common_factor);
 
-	display_fbcon_menu_message("g.co/placeholder\n",
-		boot_verify_info[type].msg_type, common_factor);
+	if(boot_verify_info[type].url_msg != NULL)
+		display_fbcon_menu_message((char*)boot_verify_info[type].url_msg,
+			boot_verify_info[type].msg_type, common_factor);
 
 	if (type == DISPLAY_MENU_YELLOW) {
 		fp_buf = get_boot_fingerprint(&fp_size);
diff --git a/platform/msm_shared/smem.h b/platform/msm_shared/smem.h
index e9e3515..d72d9b3 100644
--- a/platform/msm_shared/smem.h
+++ b/platform/msm_shared/smem.h
@@ -141,6 +141,7 @@
 	PMIC_IS_PMI8950   = 17,
 	PMIC_IS_PMI8994   = 10,
 	PMIC_IS_PMI8996   = 19,
+	PMIC_IS_PM660     = 27,
 } pm_model_type_bfly;
 
 struct smem_board_info_v3 {
diff --git a/project/msm8909.mk b/project/msm8909.mk
index 0d820e6..f7525f9 100644
--- a/project/msm8909.mk
+++ b/project/msm8909.mk
@@ -28,6 +28,7 @@
 ENABLE_PWM_SUPPORT := true
 ENABLE_BOOT_CONFIG_SUPPORT := 1
 
+DEFINES += USE_BOOTDEV_CMDLINE=1
 #DEFINES += WITH_DEBUG_DCC=1
 DEFINES += WITH_DEBUG_LOG_BUF=1
 DEFINES += WITH_DEBUG_UART=1
diff --git a/project/msm8952.mk b/project/msm8952.mk
index b118e8f..ee9063c 100644
--- a/project/msm8952.mk
+++ b/project/msm8952.mk
@@ -17,9 +17,6 @@
 
 ifeq ($(VERIFIED_BOOT),1)
 ENABLE_MDTP_SUPPORT := 1
-ifeq ($(ENABLE_VBOOT_MOTA_SUPPORT),1)
-DEFINES += VBOOT_MOTA=1
-else
 ENABLE_SECAPP_LOADER := 1
 ENABLE_RPMB_SUPPORT := 1
 #enable fbcon display menu
@@ -28,7 +25,6 @@
 else
 ENABLE_FBCON_DISPLAY_MSG := 0
 endif #DISPLAY_SPLASH_SCREEN END
-endif #ENABLE_VBOOT_MOTA_SUPPORT END
 endif #VERIFIED_BOOT
 
 
diff --git a/project/msm8953.mk b/project/msm8953.mk
index 2359c74..8da933b 100644
--- a/project/msm8953.mk
+++ b/project/msm8953.mk
@@ -15,9 +15,6 @@
 EMMC_BOOT := 1
 
 ifeq ($(VERIFIED_BOOT),1)
-ifeq ($(ENABLE_VBOOT_MOTA_SUPPORT),1)
-DEFINES += VBOOT_MOTA=1
-else
 ENABLE_SECAPP_LOADER := 1
 ENABLE_RPMB_SUPPORT := 1
 ifneq (,$(findstring DISPLAY_SPLASH_SCREEN,$(DEFINES)))
@@ -25,7 +22,6 @@
 ENABLE_FBCON_DISPLAY_MSG := 1
 endif
 endif
-endif
 
 ENABLE_SMD_SUPPORT := 1
 #ENABLE_PWM_SUPPORT := true
diff --git a/project/msm8996.mk b/project/msm8996.mk
index aa9fb8e..b6f7603 100644
--- a/project/msm8996.mk
+++ b/project/msm8996.mk
@@ -21,7 +21,6 @@
 ENABLE_QGIC3 := 1
 ENABLE_SECAPP_LOADER := 1
 ENABLE_PARTIAL_GOODS_SUPPORT := 1
-ENABLE_RPMB_SUPPORT := 1
 ENABLE_GLINK_SUPPORT := 1
 ENABLE_PWM_SUPPORT := true
 ENABLE_LPAE_SUPPORT := 1
@@ -54,6 +53,7 @@
 ifeq ($(VERIFIED_BOOT),1)
 #enable fbcon display menu
 ENABLE_FBCON_DISPLAY_MSG := 1
+ENABLE_RPMB_SUPPORT := 1
 endif
 
 ifeq ($(ENABLE_FBCON_DISPLAY_MSG),1)
diff --git a/target/apq8084/init.c b/target/apq8084/init.c
index de4ef9f..82aaf6d 100755
--- a/target/apq8084/init.c
+++ b/target/apq8084/init.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2015, 2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -330,8 +330,8 @@
 	}
 
 	size = partition_get_size(index);
-	if (size == 0) {
-		dprintf(CRITICAL, "Error: invalid ssd partition size\n");
+	if ((size == 0) || ((ULLONG_MAX - CACHE_LINE + 1) < size)) {
+		dprintf(CRITICAL, "Error: invalid ssd partition size %d\n",size);
 		return;
 	}
 
diff --git a/target/init.c b/target/init.c
index 06be1f0..7a66623 100644
--- a/target/init.c
+++ b/target/init.c
@@ -43,13 +43,26 @@
 #include <pm_fg_adc_usr.h>
 #endif
 
+#if VERIFIED_BOOT
+#include <partition_parser.h>
+#include <ab_partition_parser.h>
+#endif
+
 #define EXPAND(NAME) #NAME
 #define TARGET(NAME) EXPAND(NAME)
 
 #define BATTERY_MIN_VOLTAGE		3200000  //uv
 #define PMIC_SLAVE_ID                   0x20000
 #define BAT_IF_BAT_PRES_STATUS		0x1208
+#define BAT_IF_INT_RT_STS		0x1210
+#define BATT_INFO_VBATT_LSB		0x41A0
+#define BATT_INFO_VBATT_MSB		0x41A1
+#define BATT_VOLTAGE_NUMR		122070
+#define BATT_VOLTAGE_DENR		1000
 
+#if VERIFIED_BOOT
+static int vb_version = INVALID;
+#endif
 /*
  * default implementations of these routines, if the target code
  * chooses not to implement.
@@ -281,6 +294,24 @@
 	return ret;
 }
 
+#if VERIFIED_BOOT
+int target_get_vb_version()
+{
+	if (vb_version == INVALID)
+	{
+		/* check vb version on first time. */
+		/* Incase of keymaster present, its VB2.0 */
+		if (partition_get_index("keymaster") != INVALID_PTN)
+			vb_version = VB_V2;
+		else
+		/* Incase keymaster is not present,
+		we use keystore for verification. */
+			vb_version = VB_V1;
+	}
+	return vb_version;
+}
+#endif
+
 #if VERIFIED_BOOT_LE
 int verified_boot_le = 1;
 #else
@@ -391,6 +422,15 @@
 						BAT_IF_BAT_PRES_STATUS);
 			}
 			break;
+		case PMIC_IS_PM660:
+			value = REG_READ(BAT_IF_INT_RT_STS);
+			/* If BAT_TERMINAL_MISSING_RT_STS BIT(5) or BAT_THERM_OR_ID_MISSING_RT_STS BIT(4)
+			   are set, battery is not present. */
+			if (value & (BIT(5) | BIT(4)))
+				return false;
+			else
+				return true;
+			break;
 		default:
 			dprintf(CRITICAL, "ERROR: Couldn't get the pmic type\n");
 			break;
@@ -408,6 +448,8 @@
 {
 	uint32_t pmic;
 	uint32_t vbat = 0;
+	uint8_t buff[2];
+	uint16_t temp;
 
 	pmic = target_get_pmic();
 
@@ -430,6 +472,13 @@
 				}
 			}
 			break;
+		case PMIC_IS_PM660:
+			buff[0] = REG_READ(BATT_INFO_VBATT_LSB);
+			buff[1] = REG_READ(BATT_INFO_VBATT_MSB);
+			temp = buff[1] << 8 | buff[0];
+			/* {MSB,LSB} to decode the voltage level, refer register description. */
+			vbat = (((uint32_t)temp)*BATT_VOLTAGE_NUMR/BATT_VOLTAGE_DENR);
+			break;
 		default:
 			dprintf(CRITICAL, "ERROR: Couldn't get the pmic type\n");
 			break;
diff --git a/target/mdm9640/rules.mk b/target/mdm9640/rules.mk
index 84d1417..12b4c94 100644
--- a/target/mdm9640/rules.mk
+++ b/target/mdm9640/rules.mk
@@ -9,7 +9,7 @@
 BASE_ADDR                           := 0x80000000
 SCRATCH_ADDR                        := 0x80000000
 SCRATCH_REGION1                     := 0x81300000
-SCRATCH_REGION1_SIZE                := 0x06900000 # 105MB
+SCRATCH_REGION1_SIZE                := 0x06400000 # 100MB
 SCRATCH_REGION2                     := 0x88000000
 SCRATCH_REGION2_SIZE                := 0x08000000 # 128MB
 KERNEL_REGION                       := 0x80000000
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index 2203e01..268bdab 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -122,19 +122,6 @@
 static void set_sdc_power_ctrl(void);
 static void set_ebi2_config(void);
 
-#if VERIFIED_BOOT
-/**
-* Check if keymaster partition is present to test
-* if we have VB on this target.
-**/
-static bool target_is_vb_enabled()
-{
-	if (partition_get_index("keymaster") == INVALID_PTN)
-		return false;
-	return true;
-}
-#endif
-
 void update_ptable_names(void)
 {
 	uint32_t ptn_index;
@@ -397,7 +384,7 @@
 		target_crypto_init_params();
 
 #if VERIFIED_BOOT
-	if (target_is_vb_enabled())
+	if (VB_V2 == target_get_vb_version())
 	{
 		clock_ce_enable(CE1_INSTANCE);
 
@@ -702,7 +689,7 @@
 		clock_ce_disable(CE1_INSTANCE);
 
 #if VERIFIED_BOOT
-	if(target_is_vb_enabled())
+	if(VB_V2 == target_get_vb_version())
 	{
 		if (is_sec_app_loaded())
 		{
@@ -839,5 +826,8 @@
 
 uint32_t target_get_pmic()
 {
-	return PMIC_IS_PM8909;
+	if (board_hardware_subtype() == HW_PLATFORM_SUBTYPE_8909_PM660)
+		return PMIC_IS_PM660;
+	else
+		return PMIC_IS_PM8909;
 }
diff --git a/target/msm8909/rules.mk b/target/msm8909/rules.mk
index f5393c5..55aa9d0 100644
--- a/target/msm8909/rules.mk
+++ b/target/msm8909/rules.mk
@@ -11,7 +11,10 @@
 BASE_ADDR        := 0x80000000
 SCRATCH_ADDR     := 0x90100000
 
+ifeq ($(ENABLE_DISPLAY),1)
+DEFINES += ENABLE_DISPLAY=1
 DEFINES += DISPLAY_SPLASH_SCREEN=1
+endif
 DEFINES += DISPLAY_TYPE_MIPI=1
 DEFINES += DISPLAY_TYPE_DSI6G=1
 DEFINES += NO_ALARM_DISPLAY=0
diff --git a/target/msm8909/target_display.c b/target/msm8909/target_display.c
index 9c4cd48..526b138 100755
--- a/target/msm8909/target_display.c
+++ b/target/msm8909/target_display.c
@@ -202,7 +202,7 @@
 		return 0;
 
 	if (!((HW_PLATFORM_SUBTYPE_8909_PM660 == platform_subtype) &&
-		(MSM8909W == platform) &&
+		((MSM8909W == platform) || (APQ8009W == platform)) &&
 		(HW_PLATFORM_MTP == hw_id))) {
 		struct pm8x41_mpp mpp;
 		struct board_pmic_data pmic_info;
@@ -299,7 +299,7 @@
 	uint32_t platform = board_platform_id();
 
 	if ((HW_PLATFORM_SUBTYPE_8909_PM660 == hw_subtype) &&
-		(MSM8909W == platform) &&
+		((MSM8909W == platform) || (APQ8009W == platform)) &&
 		(HW_PLATFORM_MTP == hw_id)) {
 		struct pm8x41_gpio bobgpio_param = {
 			.direction = PM_GPIO_DIR_OUT,
@@ -354,7 +354,7 @@
 
 	if (enable) {
 		if ((HW_PLATFORM_SUBTYPE_8909_PM660 == hw_subtype) &&
-			(MSM8909W == platform) &&
+			((MSM8909W == platform) || (APQ8009W == platform)) &&
 			(HW_PLATFORM_MTP == hw_id))
 			regulator_enable(REG_LDO12 | REG_LDO5 | REG_LDO11 | REG_LDO18);
 		else
diff --git a/target/msm8952/init.c b/target/msm8952/init.c
index 88d6854..2c96f67 100644
--- a/target/msm8952/init.c
+++ b/target/msm8952/init.c
@@ -285,11 +285,6 @@
 
 void target_init(void)
 {
-#if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	int ret = 0;
-#endif
-#endif
 	dprintf(INFO, "target_init()\n");
 
 	spmi_init(PMIC_ARB_CHANNEL_NUM, PMIC_ARB_OWNER_ID);
@@ -337,43 +332,40 @@
 		target_crypto_init_params();
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	clock_ce_enable(CE1_INSTANCE);
-
-	/* Initialize Qseecom */
-	ret = qseecom_init();
-
-	if (ret < 0)
+	if (VB_V2 == target_get_vb_version())
 	{
-		dprintf(CRITICAL, "Failed to initialize qseecom, error: %d\n", ret);
-		ASSERT(0);
-	}
+		clock_ce_enable(CE1_INSTANCE);
 
-	/* Start Qseecom */
-	ret = qseecom_tz_init();
+		/* Initialize Qseecom */
+		if (qseecom_init() < 0)
+		{
+			dprintf(CRITICAL, "Failed to initialize qseecom\n");
+			ASSERT(0);
+		}
 
-	if (ret < 0)
-	{
-		dprintf(CRITICAL, "Failed to start qseecom, error: %d\n", ret);
-		ASSERT(0);
-	}
+		/* Start Qseecom */
+		if (qseecom_tz_init() < 0)
+		{
+			dprintf(CRITICAL, "Failed to start qseecom\n");
+			ASSERT(0);
+		}
 
-	if (rpmb_init() < 0)
-	{
-		dprintf(CRITICAL, "RPMB init failed\n");
-		ASSERT(0);
-	}
+		if (rpmb_init() < 0)
+		{
+			dprintf(CRITICAL, "RPMB init failed\n");
+			ASSERT(0);
+		}
 
-	/*
-	 * Load the sec app for first time
-	 */
-	if (load_sec_app() < 0)
-	{
-		dprintf(CRITICAL, "Failed to load App for verified\n");
-		ASSERT(0);
+		/*
+		 * Load the sec app for first time
+	 	*/
+		if (load_sec_app() < 0)
+		{
+			dprintf(CRITICAL, "Failed to load App for verified\n");
+			ASSERT(0);
+		}
 	}
 #endif
-#endif
 
 #if SMD_SUPPORT
 	rpm_smd_init();
@@ -579,24 +571,25 @@
 		clock_ce_disable(CE1_INSTANCE);
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	if (is_sec_app_loaded())
+	if (VB_V2 == target_get_vb_version())
 	{
-		if (send_milestone_call_to_tz() < 0)
+		if (is_sec_app_loaded())
 		{
-			dprintf(CRITICAL, "Failed to unload App for rpmb\n");
+			if (send_milestone_call_to_tz() < 0)
+			{
+				dprintf(CRITICAL, "Failed to unload App for rpmb\n");
+				ASSERT(0);
+			}
+		}
+
+		if (rpmb_uninit() < 0)
+		{
+			dprintf(CRITICAL, "RPMB uninit failed\n");
 			ASSERT(0);
 		}
-	}
 
-	if (rpmb_uninit() < 0)
-	{
-		dprintf(CRITICAL, "RPMB uninit failed\n");
-		ASSERT(0);
+		clock_ce_disable(CE1_INSTANCE);
 	}
-
-	clock_ce_disable(CE1_INSTANCE);
-#endif
 #endif
 
 #if SMD_SUPPORT
diff --git a/target/msm8952/rules.mk b/target/msm8952/rules.mk
index d50f8d9..d86ea01 100644
--- a/target/msm8952/rules.mk
+++ b/target/msm8952/rules.mk
@@ -18,7 +18,10 @@
 SCRATCH_SIZE     := 511
 SCRATCH_SIZE_512 := 234
 
+ifeq ($(ENABLE_DISPLAY),1)
+DEFINES += ENABLE_DISPLAY=1
 DEFINES += DISPLAY_SPLASH_SCREEN=1
+endif
 DEFINES += DISPLAY_TYPE_MIPI=1
 DEFINES += DISPLAY_TYPE_DSI6G=1
 
diff --git a/target/msm8953/init.c b/target/msm8953/init.c
index a0b118a..159279d 100644
--- a/target/msm8953/init.c
+++ b/target/msm8953/init.c
@@ -260,11 +260,6 @@
 
 void target_init(void)
 {
-#if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	int ret = 0;
-#endif
-#endif
 	dprintf(INFO, "target_init()\n");
 
 	spmi_init(PMIC_ARB_CHANNEL_NUM, PMIC_ARB_OWNER_ID);
@@ -291,43 +286,40 @@
 		target_crypto_init_params();
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	clock_ce_enable(CE1_INSTANCE);
-
-	/* Initialize Qseecom */
-	ret = qseecom_init();
-
-	if (ret < 0)
+	if (VB_V2 == target_get_vb_version())
 	{
-		dprintf(CRITICAL, "Failed to initialize qseecom, error: %d\n", ret);
-		ASSERT(0);
-	}
+		clock_ce_enable(CE1_INSTANCE);
 
-	/* Start Qseecom */
-	ret = qseecom_tz_init();
+		/* Initialize Qseecom */
+		if (qseecom_init() < 0)
+		{
+			dprintf(CRITICAL, "Failed to initialize qseecom\n");
+			ASSERT(0);
+		}
 
-	if (ret < 0)
-	{
-		dprintf(CRITICAL, "Failed to start qseecom, error: %d\n", ret);
-		ASSERT(0);
-	}
+		/* Start Qseecom */
+		if (qseecom_tz_init() < 0)
+		{
+			dprintf(CRITICAL, "Failed to start qseecom\n");
+			ASSERT(0);
+		}
 
-	if (rpmb_init() < 0)
-	{
-		dprintf(CRITICAL, "RPMB init failed\n");
-		ASSERT(0);
-	}
+		if (rpmb_init() < 0)
+		{
+			dprintf(CRITICAL, "RPMB init failed\n");
+			ASSERT(0);
+		}
 
-	/*
-	 * Load the sec app for first time
-	 */
-	if (load_sec_app() < 0)
-	{
-		dprintf(CRITICAL, "Failed to load App for verified\n");
-		ASSERT(0);
+		/*
+		 * Load the sec app for first time
+		 */
+		if (load_sec_app() < 0)
+		{
+			dprintf(CRITICAL, "Failed to load App for verified\n");
+			ASSERT(0);
+		}
 	}
 #endif
-#endif
 
 #if SMD_SUPPORT
 	rpm_smd_init();
@@ -428,24 +420,25 @@
 		clock_ce_disable(CE1_INSTANCE);
 
 #if VERIFIED_BOOT
-#if !VBOOT_MOTA
-	if (is_sec_app_loaded())
+	if (VB_V2 == target_get_vb_version())
 	{
-		if (send_milestone_call_to_tz() < 0)
+		if (is_sec_app_loaded())
 		{
-			dprintf(CRITICAL, "Failed to unload App for rpmb\n");
+			if (send_milestone_call_to_tz() < 0)
+			{
+				dprintf(CRITICAL, "Failed to unload App for rpmb\n");
+				ASSERT(0);
+			}
+		}
+
+		if (rpmb_uninit() < 0)
+		{
+			dprintf(CRITICAL, "RPMB uninit failed\n");
 			ASSERT(0);
 		}
-	}
 
-	if (rpmb_uninit() < 0)
-	{
-		dprintf(CRITICAL, "RPMB uninit failed\n");
-		ASSERT(0);
+		clock_ce_disable(CE1_INSTANCE);
 	}
-
-	clock_ce_disable(CE1_INSTANCE);
-#endif
 #endif
 
 #if SMD_SUPPORT
diff --git a/target/msm8996/init.c b/target/msm8996/init.c
index 539d98d..4e9825e 100644
--- a/target/msm8996/init.c
+++ b/target/msm8996/init.c
@@ -179,7 +179,9 @@
 		mmc_put_card_to_sleep(dev);
 	}
 
-	if (is_sec_app_loaded())
+#if VERIFIED_BOOT
+	if (target_get_vb_version() == VB_V2 &&
+		is_sec_app_loaded())
 	{
 		if (send_milestone_call_to_tz() < 0)
 		{
@@ -187,6 +189,7 @@
 			ASSERT(0);
 		}
 	}
+#endif
 
 #if ENABLE_WBC
 	if (board_hardware_id() == HW_PLATFORM_MTP)
@@ -203,11 +206,16 @@
 	/* Tear down glink channels */
 	rpm_glink_uninit();
 
-	if (rpmb_uninit() < 0)
+#if VERIFIED_BOOT
+	if (target_get_vb_version() == VB_V2)
 	{
-		dprintf(CRITICAL, "RPMB uninit failed\n");
-		ASSERT(0);
+		if (rpmb_uninit() < 0)
+		{
+			dprintf(CRITICAL, "RPMB uninit failed\n");
+			ASSERT(0);
+		}
 	}
+#endif
 
 }
 
@@ -329,7 +337,6 @@
 
 void target_init(void)
 {
-	int ret = 0;
 	dprintf(INFO, "target_init()\n");
 
 	pmic_info_populate();
@@ -397,38 +404,39 @@
 	};
 #endif
 
-	/* Initialize Qseecom */
-	ret = qseecom_init();
-
-	if (ret < 0)
+#if VERIFIED_BOOT
+	if (VB_V2 == target_get_vb_version())
 	{
-		dprintf(CRITICAL, "Failed to initialize qseecom, error: %d\n", ret);
-		ASSERT(0);
-	}
+		/* Initialize Qseecom */
+		if (qseecom_init() < 0)
+		{
+			dprintf(CRITICAL, "Failed to initialize qseecom\n");
+			ASSERT(0);
+		}
 
-	/* Start Qseecom */
-	ret = qseecom_tz_init();
+		/* Start Qseecom */
+		if (qseecom_tz_init() < 0)
+		{
+			dprintf(CRITICAL, "Failed to start qseecom\n");
+			ASSERT(0);
+		}
 
-	if (ret < 0)
-	{
-		dprintf(CRITICAL, "Failed to start qseecom, error: %d\n", ret);
-		ASSERT(0);
-	}
+		if (rpmb_init() < 0)
+		{
+			dprintf(CRITICAL, "RPMB init failed\n");
+			ASSERT(0);
+		}
 
-	if (rpmb_init() < 0)
-	{
-		dprintf(CRITICAL, "RPMB init failed\n");
-		ASSERT(0);
+		/*
+		 * Load the sec app for first time
+		 */
+		if (load_sec_app() < 0)
+		{
+			dprintf(CRITICAL, "Failed to load App for verified\n");
+			ASSERT(0);
+		}
 	}
-
-	/*
-	 * Load the sec app for first time
-	 */
-	if (load_sec_app() < 0)
-	{
-		dprintf(CRITICAL, "Failed to load App for verified\n");
-		ASSERT(0);
-	}
+#endif
 }
 
 unsigned board_machtype(void)