Merge "target: msm8909: use enable_gpio for 8909w BG platform"
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 8dede9b..11d64c4 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -136,7 +136,7 @@
 #endif
 
 #define MAX_TAGS_SIZE   1024
-
+#define PLL_CODES_OFFSET 4096
 /* make 4096 as default size to ensure EFS,EXT4's erasing */
 #define DEFAULT_ERASE_SIZE  4096
 #define MAX_PANEL_BUF_SIZE 196
@@ -188,7 +188,11 @@
 static const char *baseband_apq_nowgr   = " androidboot.baseband=baseband_apq_nowgr";
 static const char *androidboot_slot_suffix = " androidboot.slot_suffix=";
 static const char *skip_ramfs = " skip_initramfs";
+#ifdef INIT_BIN_LE
+static const char *sys_path_cmdline = " rootwait ro init="INIT_BIN_LE;
+#else
 static const char *sys_path_cmdline = " rootwait ro init=/init";
+#endif
 
 #if VERITY_LE
 static const char *verity_dev = " root=/dev/dm-0";
@@ -1809,6 +1813,7 @@
 	unsigned dt_table_offset;
 	uint32_t dt_actual;
 	uint32_t dt_hdr_size = 0;
+	uint32_t dtb_offset = 0;
 	unsigned int dtb_size = 0;
 	unsigned char *best_match_dt_addr = NULL;
 #endif
@@ -2034,7 +2039,27 @@
 		best_match_dt_addr = (unsigned char *)table + dt_entry.offset;
 		dtb_size = dt_entry.size;
 		memmove((void *)hdr->tags_addr, (char *)best_match_dt_addr, dtb_size);
-	}
+
+	} else {
+		/* Validate the tags_addr */
+		if (check_aboot_addr_range_overlap(hdr->tags_addr, kernel_actual) ||
+	        check_ddr_addr_range_bound(hdr->tags_addr, kernel_actual))
+		{
+			dprintf(CRITICAL, "Device tree addresses are not valid.\n");
+			return -1;
+		}
+		/*
+		 * If appended dev tree is found, update the atags with
+		 * memory address to the DTB appended location on RAM.
+		 * Else update with the atags address in the kernel header
+		 */
+		void *dtb = NULL;
+		dtb = dev_tree_appended((void*)(image_addr + page_size ),hdr->kernel_size, dtb_offset, (void *)hdr->tags_addr);
+		if (!dtb) {
+			dprintf(CRITICAL, "ERROR: Appended Device Tree Blob not found\n");
+			return -1;
+		}
+         }
 #endif
 	if(target_use_signed_kernel() && (!device.is_unlocked))
 	{
@@ -3168,7 +3193,7 @@
 	}
 
 	/* By default copy raw to response */
-	strncpy(response, RAW_STR, strlen(RAW_STR));
+	strlcpy(response, RAW_STR, MAX_RSP_SIZE);
 
 	/* Mark partiton type for known paritions only */
 	for (n=0; n < ARRAY_SIZE(part_type_known); n++)
@@ -3180,13 +3205,13 @@
 			switch (fs_signature)
 			{
 				case EXT_FS_SIGNATURE:
-					strncpy(response, EXT_STR, strlen(EXT_STR));
+					strlcpy(response, EXT_STR, MAX_RSP_SIZE);
 					break;
 				case EXT_F2FS_SIGNATURE:
-					strncpy(response, F2FS_STR, strlen(F2FS_STR));
+					strlcpy(response, F2FS_STR, MAX_RSP_SIZE);
 					break;
 				case NO_FS:
-					strncpy(response, part_type_known[n].type_response, MAX_RSP_SIZE);
+					strlcpy(response, part_type_known[n].type_response, MAX_RSP_SIZE);
 			}
 		}
 	}
@@ -4347,7 +4372,7 @@
 
 	base = (uint8_t *) fb_display->base;
 
-	if (mmc_read(ptn, (uint32_t *)(base + LOGO_IMG_OFFSET), blocksize)) {
+	if (mmc_read(ptn + PLL_CODES_OFFSET, (uint32_t *)(base + LOGO_IMG_OFFSET), blocksize)) {
 		dprintf(CRITICAL, "ERROR: Cannot read splash image header\n");
 		return -1;
 	}
@@ -4379,7 +4404,7 @@
 				return -1;
 			}
 
-			if (mmc_read(ptn + blocksize, (uint32_t *)(base + blocksize), readsize)) {
+			if (mmc_read(ptn + PLL_CODES_OFFSET + blocksize, (uint32_t *)(base + blocksize), readsize)) {
 				dprintf(CRITICAL, "ERROR: Cannot read splash image from partition\n");
 				return -1;
 			}
@@ -4396,13 +4421,13 @@
 			readsize =  ROUNDUP((realsize + LOGO_IMG_HEADER_SIZE), blocksize) - blocksize;
 
 			if (blocksize == LOGO_IMG_HEADER_SIZE) { /* read the content directly */
-				if (mmc_read((ptn + LOGO_IMG_HEADER_SIZE), (uint32_t *)base, readsize)) {
+				if (mmc_read((ptn + PLL_CODES_OFFSET + LOGO_IMG_HEADER_SIZE), (uint32_t *)base, readsize)) {
 					fbcon_clear();
 					dprintf(CRITICAL, "ERROR: Cannot read splash image from partition\n");
 					return -1;
 				}
 			} else {
-				if (mmc_read(ptn + blocksize ,
+				if (mmc_read(ptn + PLL_CODES_OFFSET + blocksize ,
 						(uint32_t *)(base + LOGO_IMG_OFFSET + blocksize), readsize)) {
 					dprintf(CRITICAL, "ERROR: Cannot read splash image from partition\n");
 					return -1;
diff --git a/dev/gcdb/display/include/panel_auo_390p_cmd.h b/dev/gcdb/display/include/panel_auo_390p_cmd.h
index d886cb2..5c8a860 100644
--- a/dev/gcdb/display/include/panel_auo_390p_cmd.h
+++ b/dev/gcdb/display/include/panel_auo_390p_cmd.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -140,6 +140,21 @@
 	0x52, 0x08, 0x01, 0xff,
 };
 
+static char auo_390p_cmd_on_cmd14[] = {
+	0xfe, 0x01, 0x15, 0x80,
+};
+
+static char auo_390p_cmd_on_cmd15[] = {
+	0x04, 0x00, 0x15, 0x80,
+};
+
+static char auo_390p_cmd_on_cmd16[] = {
+	0xfe, 0x00, 0x15, 0x80,
+};
+
+static char auo_390p_cmd_on_cmd17[] = {
+	0x3a, 0x77, 0x15, 0x80,
+};
 
 static struct mipi_dsi_cmd auo_390p_cmd_on_command[] = {
 	{ 0x4 , auo_390p_cmd_on_cmd0, 0x00},
@@ -156,9 +171,13 @@
 	{ 0x4 , auo_390p_cmd_on_cmd11, 0x00},
 	{ 0xc , auo_390p_cmd_on_cmd12, 0x00},
 	{ 0xc , auo_390p_cmd_on_cmd13, 0x00},
+	{ 0x4 , auo_390p_cmd_on_cmd14, 0x00},
+	{ 0x4 , auo_390p_cmd_on_cmd15, 0x00},
+	{ 0x4 , auo_390p_cmd_on_cmd16, 0x00},
+	{ 0x4 , auo_390p_cmd_on_cmd17, 0x00},
 };
 
-#define AUO_390P_CMD_ON_COMMAND 14
+#define AUO_390P_CMD_ON_COMMAND 18
 
 
 static char auo_390p_cmd_off_cmd0[] = {
diff --git a/dev/qpnp_haptic/qpnp_vib.c b/dev/qpnp_haptic/qpnp_vib.c
index fecb794..097e486 100644
--- a/dev/qpnp_haptic/qpnp_vib.c
+++ b/dev/qpnp_haptic/qpnp_vib.c
@@ -31,7 +31,7 @@
 
 void pm_vib_turn_on()
 {
-	if ((board_pmic_target(1) & 0xffff) == PMIC_IS_PMI632)
+	if ((board_pmic_target(1) & PMIC_TYPE_MASK) == PMIC_IS_PMI632)
 		pm_vib_ldo_turn_on();
 	else
 		pm_haptic_vib_turn_on();
@@ -39,7 +39,7 @@
 
 void pm_vib_turn_off()
 {
-	if ((board_pmic_target(1) & 0xffff) == PMIC_IS_PMI632)
+	if ((board_pmic_target(1) & PMIC_TYPE_MASK) == PMIC_IS_PMI632)
 		pm_vib_ldo_turn_off();
 	else
 		pm_haptic_vib_turn_off();
diff --git a/dev/qpnp_haptic/qpnp_vib_ldo.c b/dev/qpnp_haptic/qpnp_vib_ldo.c
index 7b327cf..1506ed8 100644
--- a/dev/qpnp_haptic/qpnp_vib_ldo.c
+++ b/dev/qpnp_haptic/qpnp_vib_ldo.c
@@ -53,8 +53,8 @@
 
 #define MAX_WAIT_FOR_VREG_READY_US	1000
 #define VREG_READY_STEP_DELAY_US	100
-#define VIB_LDO_OVERDRIVE_VOLTAGE_MV	3000
-#define VIB_LDO_NOMINAL_VOLTAGE_MV	1500
+#define VIB_LDO_OVERDRIVE_VOLTAGE_MV	3500
+#define VIB_LDO_NOMINAL_VOLTAGE_MV	3000
 #define OVERDRIVE_TIME_US		30000
 
 /* Turn on vibrator */
diff --git a/include/platform.h b/include/platform.h
index b33399d..cd55d7e 100644
--- a/include/platform.h
+++ b/include/platform.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2008 Travis Geiselbrecht
  *
- * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining
  * a copy of this software and associated documentation files
@@ -71,6 +71,8 @@
 int platform_is_msm8952();
 int platform_is_msm8953();
 int platform_is_msm8956();
+int platform_is_sdm429();
+int platform_is_sdm439();
 uint32_t platform_is_msm8976_v_1_1();
 uint32_t platform_get_tz_app_add();
 uint32_t platform_get_tz_app_size();
diff --git a/platform/msm8952/msm8952-clock.c b/platform/msm8952/msm8952-clock.c
index d6c029f..3d2b85c 100644
--- a/platform/msm8952/msm8952-clock.c
+++ b/platform/msm8952/msm8952-clock.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, 2018, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -650,7 +650,8 @@
 			msm8976_v_1_1_sdcc_clock_modify();
 	}
 
-	if (platform_is_msm8937() || platform_is_msm8917())
+	if (platform_is_msm8937() || platform_is_msm8917() ||
+		platform_is_sdm429() || platform_is_sdm439())
 		msm8937_clock_override();
 
 	clk_init(msm_clocks_8952, ARRAY_SIZE(msm_clocks_8952));
diff --git a/platform/msm8952/platform.c b/platform/msm8952/platform.c
index 11501c2..184f5e2 100644
--- a/platform/msm8952/platform.c
+++ b/platform/msm8952/platform.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, 2018, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -260,6 +260,43 @@
 	return ret;
 }
 
+int platform_is_sdm429()
+{
+	uint32_t platform = board_platform_id();
+	uint32_t ret = 0;
+
+	switch(platform)
+	{
+	case SDM429:
+	case SDA429:
+		ret = 1;
+		break;
+	default:
+		ret = 0;
+	};
+
+	return ret;
+}
+
+int platform_is_sdm439()
+{
+	uint32_t platform = board_platform_id();
+	uint32_t ret = 0;
+
+	switch(platform)
+	{
+	case SDM439:
+	case SDA439:
+		ret = 1;
+		break;
+	default:
+		ret = 0;
+	};
+
+	return ret;
+}
+
+
 int platform_is_msm8956()
 {
 	uint32_t platform = board_platform_id();
@@ -282,7 +319,8 @@
 
 uint32_t platform_get_tz_app_add()
 {
-	if(platform_is_msm8937() || platform_is_msm8917())
+	if(platform_is_msm8937() || platform_is_msm8917() ||
+		platform_is_sdm429() || platform_is_sdm439())
 		return APP_REGION_ADDR_8937;
 	else
 		return APP_REGION_ADDR_8952;
@@ -290,7 +328,8 @@
 
 uint32_t platform_get_tz_app_size()
 {
-	if(platform_is_msm8937() || platform_is_msm8917())
+	if(platform_is_msm8937() || platform_is_msm8917() ||
+		platform_is_sdm429() || platform_is_sdm439())
 		return APP_REGION_SIZE_8937;
 	else
 		return APP_REGION_SIZE_8952;
@@ -298,7 +337,7 @@
 
 uint32_t platform_get_apcs_ipc_base()
 {
-	if(platform_is_msm8917())
+	if(platform_is_msm8917() || platform_is_sdm429())
 		return APCS_ALIAS1_IPC_INTERRUPT_1;
 	else
 		return APCS_ALIAS0_IPC_INTERRUPT_2;
diff --git a/platform/msm_shared/avb/VerifiedBoot.c b/platform/msm_shared/avb/VerifiedBoot.c
index ec455d3..554f250 100644
--- a/platform/msm_shared/avb/VerifiedBoot.c
+++ b/platform/msm_shared/avb/VerifiedBoot.c
@@ -110,17 +110,6 @@
 	return (GetAVBVersion() > NO_AVB);
 }
 
-static int GetCurrentSlotSuffix(Slot *CurrentSlot)
-{
-	if (!partition_multislot_is_supported())
-		return ERR_INVALID_ARGS;
-
-	strncpy(CurrentSlot->Suffix,
-			SUFFIX_SLOT(partition_find_active_slot()),
-			MAX_SLOT_SUFFIX_SZ);
-	return 0;
-}
-
 static int check_img_header(void *ImageHdrBuffer, uint32_t ImageHdrSize, uint32_t *imgsizeActual)
 {
     /* These checks are already done before calling auth remove from here */
@@ -130,50 +119,6 @@
 	return 0;
 }
 
-static int GetActiveSlot(Slot *ActiveSlot)
-{
-	if (!partition_multislot_is_supported())
-		return ERR_INVALID_ARGS;
-	int idx = partition_find_active_slot();
-	if (idx != INVALID)
-	{
-		strncpy(ActiveSlot->Suffix,
-			SUFFIX_SLOT(partition_find_active_slot()),
-			MAX_SLOT_SUFFIX_SZ);
-		return 0;
-	}
-	return ERR_NOT_FOUND;
-}
-
-static int FindBootableSlot(Slot *BootableSlot)
-{
-   int Status = 0;
-
-   if (BootableSlot == NULL) {
-       dprintf(CRITICAL,"FindBootableSlot: input parameter invalid\n");
-       return -ERR_INVALID_ARGS;
-   }
-
-   Status = GetActiveSlot(BootableSlot);
-   if (Status != 0) {
-       /* clear bootable slot */
-       BootableSlot->Suffix[0] = '\0';
-   }
-   return Status;
-}
-
-bool IsSuffixEmpty(Slot *CheckSlot)
-{
-	if (CheckSlot == NULL) {
-		return TRUE;
-	}
-
-	if (strlen((char *)CheckSlot->Suffix) == 0) {
-		return TRUE;
-	}
-	return FALSE;
-}
-
 static int HandleActiveSlotUnbootable()
 {
    int curr_slot;
@@ -193,11 +138,9 @@
 	INT32 Index;
 	UINT32 Lun;
 	CHAR8 PartitionName[MAX_GPT_NAME_SIZE];
-	Slot CurSlot;
 	CHAR8 LunCharMapping[] = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'};
-
-	if (GetCurrentSlotSuffix(&CurSlot))
-		return 0;
+	const char *current_slot_suffix;
+	int current_active_slot;
 
 	*SysPath = malloc(sizeof(char) * MAX_PATH_SIZE);
 	if (!*SysPath) {
@@ -205,8 +148,14 @@
 		return 0;
 	}
 
-	strncpy(PartitionName, "system", strlen("system") + 1);
-	strncat(PartitionName, CurSlot.Suffix, MAX_GPT_NAME_SIZE - 1);
+	strlcpy(PartitionName, "system", strlen("system") + 1);
+	current_active_slot = partition_find_active_slot();
+	if (partition_multislot_is_supported()) {
+		if (current_active_slot == INVALID)
+			return 0;
+		current_slot_suffix = SUFFIX_SLOT(current_active_slot);
+		strncat(PartitionName, current_slot_suffix, MAX_GPT_NAME_SIZE - 1);
+	}
 
 	Index = partition_get_index(PartitionName);
 	if (Index == INVALID_PTN || Index >= NUM_PARTITIONS) {
@@ -304,7 +253,7 @@
 	}
 	Info->num_loaded_images = 1;
 	Info->images[0].name = malloc(strlen(Info->pname) + 1);
-	strncpy(Info->images[0].name, Info->pname, strlen(Info->pname)); //FIXME
+	strlcpy(Info->images[0].name, Info->pname, strlen(Info->pname)); //FIXME
 	return Status;
 }
 
@@ -325,13 +274,13 @@
 	DevInfo_vb.is_unlocked = !is_device_locked();
 	DevInfo_vb.is_unlock_critical = !is_device_locked_critical();
 
-	strncpy(StrPname, "/", strlen("/"));
-	strncpy(Pname, Info->pname, strlen(Info->pname));
+	strlcpy(StrPname, "/", strlen("/"));
+	strlcpy(Pname, Info->pname, strlen(Info->pname));
 	if (Info->multi_slot_boot) {
-		strncat(StrPname, Pname,
+		strlcat(StrPname, Pname,
 	              strlen(Pname) - (MAX_SLOT_SUFFIX_SZ - 1));
 	} else {
-		strncat(StrPname, Pname, strlen(Pname));
+		strlcat(StrPname, Pname, strlen(Pname));
 	}
 
 	Status = boot_verify_image((UINT8 *)Info->images[0].image_buffer,
@@ -433,7 +382,7 @@
 		goto out;
 	}
 	if(Info->multi_slot_boot) {
-	strncpy(Pname, Info->pname, strlen(Info->pname));
+	strlcpy(Pname, Info->pname, strlen(Info->pname));
 	if ((MAX_SLOT_SUFFIX_SZ + 1) > strlen(Pname)) {
 		dprintf(CRITICAL, "ERROR: Can not determine slot suffix\n");
 		Status = EFI_INVALID_PARAMETER;
@@ -487,6 +436,11 @@
 		Info->boot_state = RED;
 		goto out;
 	}
+	if (SlotData == NULL) {
+		Status = EFI_LOAD_ERROR;
+		Info->boot_state = RED;
+		goto out;
+	}
 
 	for (UINTN ReqIndex = 0; ReqIndex < NumRequestedPartition; ReqIndex++) {
 		dprintf(DEBUG, "Requested Partition: %s\n",
@@ -651,13 +605,13 @@
 			if (ffbm_mode_string[0] != '\0' && !target_build_variant_user()) {
 				dprintf(DEBUG, "Device will boot into FFBM mode\n");
 			} else {
-				//display_bootverify_menu(DISPLAY_MENU_ORANGE);
-				//if (Status == EFI_SUCCESS) {
-				//	wait_for_users_action();
-				//} else {
+				display_bootverify_menu(DISPLAY_MENU_ORANGE);
+				if (Status == EFI_SUCCESS) {
+					wait_for_users_action();
+				} else {
 					dprintf(INFO, "Device is unlocked, Skipping boot verification\n");
 					udelay(5000000);
-				//}
+				}
 			}
 			break;
 		default:
@@ -672,6 +626,8 @@
 	BOOLEAN MdtpActive = FALSE;
 	UINT32 AVBVersion = NO_AVB;
 	mdtp_ext_partition_verification_t ext_partition;
+	const char *current_slot_suffix;
+	int current_active_slot;
 
 	if (Info == NULL) {
 		dprintf(CRITICAL, "Invalid parameter Info\n");
@@ -681,21 +637,22 @@
 	if (!Info->multi_slot_boot) {
 		if (Info->bootinto_recovery) {
 			dprintf(INFO, "Booting Into Recovery Mode\n");
-			strncpy(Info->pname, "recovery", strlen("recovery"));
+			strlcpy(Info->pname, "recovery", strlen("recovery"));
 		} else {
 			dprintf(INFO, "Booting Into Mission Mode\n");
-			strncpy(Info->pname, "boot", strlen("boot"));
+			strlcpy(Info->pname, "boot", strlen("boot"));
 		}
 	} else {
-		Slot CurrentSlot = {{0}};
-
-		GUARD(FindBootableSlot(&CurrentSlot));
-		if (IsSuffixEmpty(&CurrentSlot)) {
-			dprintf(CRITICAL, "No bootable slot\n");
-			return EFI_LOAD_ERROR;
+		strlcpy(Info->pname, "boot", strlen("boot"));
+		current_active_slot = partition_find_active_slot();
+		if (current_active_slot != INVALID ) {
+			current_slot_suffix = SUFFIX_SLOT(current_active_slot);
+			if (strlen(current_slot_suffix) == 0) {
+				dprintf(CRITICAL, "No bootable slot\n");
+				return EFI_LOAD_ERROR;
+			}
+			strlcat(Info->pname, current_slot_suffix, strlen(current_slot_suffix));
 		}
-		strncpy(Info->pname, "boot", strlen("boot"));
-		strncat(Info->pname, CurrentSlot.Suffix, strlen(CurrentSlot.Suffix));
 	}
 
 	dprintf(DEBUG, "MultiSlot %s, partition name %s\n",
diff --git a/platform/msm_shared/avb/libavb/avb_slot_verify.c b/platform/msm_shared/avb/libavb/avb_slot_verify.c
index 0594fab..ea4ecec 100644
--- a/platform/msm_shared/avb/libavb/avb_slot_verify.c
+++ b/platform/msm_shared/avb/libavb/avb_slot_verify.c
@@ -190,6 +190,12 @@
     uint32_t complete_len = hash_desc.salt_len + hash_desc.image_size;
     uint8_t *complete_buf = (uint8_t *)target_get_scratch_address()+0x08000000;
     digest = avb_malloc(AVB_SHA256_DIGEST_SIZE);
+    if(digest == NULL)
+    {
+        avb_errorv(part_name, ": Failed to allocate memory\n", NULL);
+        ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+        goto out;
+    }
     avb_memcpy(complete_buf, desc_salt, hash_desc.salt_len);
     avb_memcpy(complete_buf + hash_desc.salt_len, image_buf, hash_desc.image_size);
     hash_find(complete_buf, complete_len, digest, CRYPTO_AUTH_ALG_SHA256);
@@ -198,6 +204,12 @@
     AvbSHA512Ctx sha512_ctx;
     uint8_t *dig;
     digest = avb_malloc(AVB_SHA512_DIGEST_SIZE);
+    if(digest == NULL)
+    {
+        avb_errorv(part_name, ": Failed to allocate memory\n", NULL);
+        ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+        goto out;
+    }
     avb_sha512_init(&sha512_ctx);
     avb_sha512_update(&sha512_ctx, desc_salt, hash_desc.salt_len);
     avb_sha512_update(&sha512_ctx, image_buf, hash_desc.image_size);
@@ -1133,6 +1145,12 @@
       uint8_t* tbuf = NULL;
 
       digest = avb_malloc(AVB_SHA256_DIGEST_SIZE);
+      if(digest == NULL)
+      {
+        avb_error("Failed to allocate memory\n");
+        ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+        goto out;
+      }
       for (n = 0; n < slot_data->num_vbmeta_images; n++) {
         total_size += slot_data->vbmeta_images[n].vbmeta_size;
       }
diff --git a/platform/msm_shared/avb/libavb/avb_vbmeta_image.c b/platform/msm_shared/avb/libavb/avb_vbmeta_image.c
index b95d8b6..7915aac 100644
--- a/platform/msm_shared/avb/libavb/avb_vbmeta_image.c
+++ b/platform/msm_shared/avb/libavb/avb_vbmeta_image.c
@@ -181,7 +181,17 @@
     case AVB_ALGORITHM_TYPE_SHA256_RSA8192:
       total_len = sizeof(AvbVBMetaImageHeader) + h.auxiliary_data_block_size;
       tbuf = avb_malloc_(total_len);
+      if(tbuf == NULL)
+      {
+           avb_error("Failed to allocate memory.\n");
+           goto out;
+      }
       computed_hash = avb_malloc_(AVB_SHA256_DIGEST_SIZE);
+      if(computed_hash == NULL)
+      {
+           avb_error("Failed to allocate memory.\n");
+           goto out;
+      }
       avb_memcpy(tbuf, header_block, sizeof(AvbVBMetaImageHeader));
       avb_memcpy(tbuf + sizeof(AvbVBMetaImageHeader), auxiliary_block, h.auxiliary_data_block_size);
       hash_find(tbuf, total_len, computed_hash, CRYPTO_AUTH_ALG_SHA256);
@@ -192,6 +202,11 @@
     case AVB_ALGORITHM_TYPE_SHA512_RSA4096:
     case AVB_ALGORITHM_TYPE_SHA512_RSA8192:
       computed_hash = avb_malloc(AVB_SHA512_DIGEST_SIZE);
+      if(computed_hash == NULL)
+      {
+           avb_error("Failed to allocate memory.\n");
+           goto out;
+      }
       avb_sha512_init(&sha512_ctx);
       avb_sha512_update(
           &sha512_ctx, header_block, sizeof(AvbVBMetaImageHeader));
diff --git a/platform/msm_shared/boot_verifier.c b/platform/msm_shared/boot_verifier.c
index 95feec5..b89e792 100644
--- a/platform/msm_shared/boot_verifier.c
+++ b/platform/msm_shared/boot_verifier.c
@@ -647,9 +647,10 @@
 
 	if(sig != NULL)
 		VERIFIED_BOOT_SIG_free(sig);
-	*bootstate = dev_boot_state;
+
 	if(bootstate == NULL)
 		goto verify_image_error;
+	*bootstate = dev_boot_state;
 
 verify_image_error:
 	free(signature);
diff --git a/platform/msm_shared/include/board.h b/platform/msm_shared/include/board.h
index 866fba2..90f7081 100644
--- a/platform/msm_shared/include/board.h
+++ b/platform/msm_shared/include/board.h
@@ -36,6 +36,8 @@
 #define BOARD_SOC_VERSION2     0x20000
 #define MAX_PMIC_DEVICES       SMEM_MAX_PMIC_DEVICES
 
+#define PMIC_TYPE_MASK 0xff
+
 struct board_pmic_data {
 	uint32_t pmic_type;
 	uint32_t pmic_version;
diff --git a/platform/msm_shared/menu_keys_detect.c b/platform/msm_shared/menu_keys_detect.c
index 3a81b70..f118e00 100644
--- a/platform/msm_shared/menu_keys_detect.c
+++ b/platform/msm_shared/menu_keys_detect.c
@@ -145,8 +145,6 @@
 			reboot_device(FASTBOOT_MODE);
 			break;
 		case CONTINUE:
-			display_image_on_screen();
-
 			/* Continue boot, no need to detect the keys'status */
 			msg_info->info.is_exit = true;
 			break;
diff --git a/platform/msm_shared/mmc_wrapper.c b/platform/msm_shared/mmc_wrapper.c
index 495767a..f25a633 100755
--- a/platform/msm_shared/mmc_wrapper.c
+++ b/platform/msm_shared/mmc_wrapper.c
@@ -675,6 +675,7 @@
 		 */
 		if (partition_read_only(index) && size < card->wp_grp_size)
 		{
+			dprintf(CRITICAL, "WARNING: Size of partition is less than 1 Write Protect GRP size\n");
 			/* Write protect api takes the size in bytes, convert size to bytes */
 			size = card->wp_grp_size * block_size;
 		}
diff --git a/platform/msm_shared/smem.h b/platform/msm_shared/smem.h
index c8a3e48..51692e0 100644
--- a/platform/msm_shared/smem.h
+++ b/platform/msm_shared/smem.h
@@ -469,7 +469,11 @@
 	MDM9206 = 322,
 	SDA450 = 351,
 	SDM632 = 349,
-	SDA632 = 350
+	SDA632 = 350,
+	SDM429 = 354,
+	SDM439 = 353,
+	SDA429 = 364,
+	SDA439 = 363
 };
 
 enum platform {
diff --git a/project/msm8952.mk b/project/msm8952.mk
index d40dfa1..668d241 100644
--- a/project/msm8952.mk
+++ b/project/msm8952.mk
@@ -19,10 +19,11 @@
 DEFINES += DISPLAY_SPLASH_SCREEN=1
 endif
 
-ifeq ($(VERIFIED_BOOT),1)
-ENABLE_MDTP_SUPPORT := 1
 ENABLE_SECAPP_LOADER := 1
 ENABLE_RPMB_SUPPORT := 1
+
+ifeq ($(VERIFIED_BOOT),1)
+ENABLE_MDTP_SUPPORT := 1
 #enable fbcon display menu
 ifneq (,$(findstring DISPLAY_SPLASH_SCREEN,$(DEFINES)))
 ENABLE_FBCON_DISPLAY_MSG := 1
@@ -31,10 +32,15 @@
 endif #DISPLAY_SPLASH_SCREEN END
 endif #VERIFIED_BOOT
 
-
+ifeq ($(VERIFIED_BOOT_2),1)
+ifneq (,$(findstring DISPLAY_SPLASH_SCREEN,$(DEFINES)))
+#enable fbcon display menu
+  ENABLE_FBCON_DISPLAY_MSG := 1
+endif
+endif
 
 ENABLE_SMD_SUPPORT := 1
-#ENABLE_PWM_SUPPORT := true
+ENABLE_PWM_SUPPORT := true
 
 #DEFINES += WITH_DEBUG_DCC=1
 DEFINES += WITH_DEBUG_LOG_BUF=1
diff --git a/target/init.c b/target/init.c
index 386f5c6..80c95c3 100644
--- a/target/init.c
+++ b/target/init.c
@@ -43,8 +43,8 @@
 #include <pm_fg_adc_usr.h>
 #endif
 
-#include <partition_parser.h>
 #if VERIFIED_BOOT || VERIFIED_BOOT_2
+#include <partition_parser.h>
 #include <ab_partition_parser.h>
 #endif
 
@@ -290,6 +290,10 @@
 		case SDA450:
 		case SDM632:
 		case SDA632:
+		case SDM429:
+		case SDM439:
+		case SDA429:
+		case SDA439:
 		/* SDCC HC DDR CONFIG has shifted by 4 bytes for these platform */
 			ret += 4;
 			break;
@@ -298,7 +302,7 @@
 	}
 	return ret;
 }
-
+#if VERIFIED_BOOT || VERIFIED_BOOT_2
 int target_get_vb_version()
 {
 	if (vb_version == INVALID)
@@ -313,6 +317,12 @@
 	}
 	return vb_version;
 }
+#else
+int target_get_vb_version()
+{
+	return vb_version;
+}
+#endif
 
 #if VERIFIED_BOOT_LE
 int verified_boot_le = 1;
@@ -368,6 +378,10 @@
 		case SDA450:
 		case SDM632:
 		case SDA632:
+		case SDM429:
+		case SDM439:
+		case SDA429:
+		case SDA439:
 			config->vib_type = VIB_LRA_TYPE;
 			config->hap_rate_cfg1 = QPNP_HAP_RATE_CFG1_41;
 			config->hap_rate_cfg2 = QPNP_HAP_RATE_CFG2_03;
diff --git a/target/mdm9607/init.c b/target/mdm9607/init.c
index 40776f7..51172fd 100644
--- a/target/mdm9607/init.c
+++ b/target/mdm9607/init.c
@@ -97,6 +97,11 @@
 #define CE_ARRAY_SIZE           20
 #define SUB_TYPE_SKUT           0x0A
 
+__WEAK unsigned int qseecom_get_version()
+{
+        return 0;
+}
+
 struct qpic_nand_init_config config;
 
 void update_ptable_names(void)
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index 4a5a3db..7ebf174 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -81,6 +81,9 @@
 #define CE_ARRAY_SIZE           20
 #define SUB_TYPE_SKUT           0x0A
 
+/* Fastboot switch GPIO for Intrinsic board. */
+#define USB_SW_GPIO_INTRINSIC_SOM 3
+
 extern void smem_ptable_init(void);
 extern void smem_add_modem_partitions(struct ptable *flash_ptable);
 void target_sdc_init();
@@ -735,6 +738,9 @@
 /* Do any target specific intialization needed before entering fastboot mode */
 void target_fastboot_init(void)
 {
+	uint32_t hw_id = board_hardware_id();
+	uint32_t platform_subtype = board_hardware_subtype();
+
 	/* Set the BOOT_DONE flag in PM8916 */
 	pm8x41_set_boot_done();
 
@@ -742,6 +748,26 @@
 		clock_ce_enable(CE1_INSTANCE);
 		target_load_ssd_keystore();
 	}
+
+	if ((HW_PLATFORM_MTP == hw_id) &&
+		(HW_PLATFORM_SUBTYPE_INTRINSIC_SOM == platform_subtype))
+	{
+		dprintf(SPEW, "Enabling PMIC GPIO for USB detection\n");
+
+		struct pm8x41_gpio usbgpio_param = {
+			.direction = PM_GPIO_DIR_OUT,
+			.vin_sel = 0,
+			.out_strength = PM_GPIO_OUT_DRIVE_MED,
+			.function = PM_GPIO_FUNC_HIGH,
+			.pull = PM_GPIO_PULLDOWN_10,
+			.inv_int_pol = PM_GPIO_INVERT,
+		};
+
+		pm8x41_gpio_config(USB_SW_GPIO_INTRINSIC_SOM, &usbgpio_param);
+		pm8x41_gpio_set(USB_SW_GPIO_INTRINSIC_SOM, 0);
+	}
+
+	return;
 }
 
 int set_download_mode(enum reboot_reason mode)
diff --git a/target/msm8952/init.c b/target/msm8952/init.c
index add808a..1489467 100644
--- a/target/msm8952/init.c
+++ b/target/msm8952/init.c
@@ -192,7 +192,8 @@
 
 	if(platform_is_msm8956())
 		vol_up_gpio = TLMM_VOL_UP_BTN_GPIO_8956;
-	else if(platform_is_msm8937() || platform_is_msm8917())
+	else if(platform_is_msm8937() || platform_is_msm8917() ||
+		    platform_is_sdm429() || platform_is_sdm439())
 		vol_up_gpio = TLMM_VOL_UP_BTN_GPIO_8937;
 	else
 		vol_up_gpio = TLMM_VOL_UP_BTN_GPIO;
@@ -287,12 +288,13 @@
 
 	if(target_is_pmi_enabled())
 	{
-		if(platform_is_msm8937() || platform_is_msm8917())
+		if(platform_is_msm8937() || platform_is_msm8917() ||
+		   platform_is_sdm429() || platform_is_sdm439())
 		{
 			uint8_t pmi_rev = 0;
 			uint32_t pmi_type = 0;
 
-			pmi_type = board_pmic_target(1) & 0xffff;
+			pmi_type = board_pmic_target(1) & PMIC_TYPE_MASK;
 			if(pmi_type == PMIC_IS_PMI8950)
 			{
 				/* read pmic spare register for rev */
@@ -327,7 +329,6 @@
 	if (target_use_signed_kernel())
 		target_crypto_init_params();
 
-#if VERIFIED_BOOT
 	if (VB_M <= target_get_vb_version())
 	{
 		clock_ce_enable(CE1_INSTANCE);
@@ -361,7 +362,6 @@
 			ASSERT(0);
 		}
 	}
-#endif
 
 #if SMD_SUPPORT
 	rpm_smd_init();
@@ -405,6 +405,8 @@
 	case MSM8920:
 	case MSM8217:
 	case MSM8617:
+	case SDM429:
+	case SDM439:
 		board->baseband = BASEBAND_MSM;
 		break;
 	case APQ8052:
@@ -412,6 +414,8 @@
 	case APQ8076:
 	case APQ8037:
 	case APQ8017:
+	case SDA429:
+	case SDA439:
 		board->baseband = BASEBAND_APQ;
 		break;
 	default:
@@ -490,7 +494,6 @@
 	if (target_is_ssd_enabled())
 		clock_ce_disable(CE1_INSTANCE);
 
-#if VERIFIED_BOOT
 	if (VB_M <= target_get_vb_version())
 	{
 		if (is_sec_app_loaded())
@@ -510,7 +513,6 @@
 
 		clock_ce_disable(CE1_INSTANCE);
 	}
-#endif
 
 #if SMD_SUPPORT
 	rpm_smd_uninit();
@@ -721,7 +723,7 @@
 uint32_t target_get_pmic()
 {
 	if (target_is_pmi_enabled()) {
-		uint32_t pmi_type = board_pmic_target(1) & 0xffff;
+		uint32_t pmi_type = board_pmic_target(1) & PMIC_TYPE_MASK;
 		if (pmi_type == PMIC_IS_PMI632)
 			return PMIC_IS_PMI632;
 		else
diff --git a/target/msm8952/target_display.c b/target/msm8952/target_display.c
index 2f27fda..68baa70 100644
--- a/target/msm8952/target_display.c
+++ b/target/msm8952/target_display.c
@@ -53,6 +53,9 @@
 #include "include/display_resource.h"
 #include "gcdb_display.h"
 
+#define PWM_DUTY_US 13
+#define PWM_PERIOD_US 27
+
 #define TRULY_720P_VID_PANEL "truly_720p_video"
 #define TRULY_720P_CMD_PANEL "truly_720p_cmd"
 
@@ -276,6 +279,19 @@
 	return NO_ERROR;
 }
 
+static int pwm_backlight_ctrl(uint8_t enable)
+{
+	if (enable) {
+		pm_pwm_enable(false);
+		pm_pwm_config(PWM_DUTY_US, PWM_PERIOD_US);
+		pm_pwm_enable(true);
+	} else {
+		pm_pwm_enable(false);
+	}
+
+	return NO_ERROR;
+}
+
 int target_backlight_ctrl(struct backlight *bl, uint8_t enable)
 {
 	uint32_t ret = NO_ERROR;
@@ -283,8 +299,12 @@
 	if (bl->bl_interface_type == BL_DCS)
 		return ret;
 
-	ret = msm8952_wled_backlight_ctrl(enable);
-
+	if ((target_get_pmic() == PMIC_IS_PMI632) &&
+		(bl->bl_interface_type == BL_PWM)) {
+		ret = pwm_backlight_ctrl(enable);
+	} else {
+		ret = msm8952_wled_backlight_ctrl(enable);
+	}
 	return ret;
 }
 
@@ -593,10 +613,11 @@
 	bool ret = true;
 	struct oem_panel_data oem = mdss_dsi_get_oem_data();
 	uint32_t platform_subtype = board_hardware_subtype();
+	uint32_t platform = board_platform_id();
 
 	/* default to hdmi for apq iot */
-	if ((HW_PLATFORM_SUBTYPE_SAP == platform_subtype) ||
-		(HW_PLATFORM_SUBTYPE_SAP_NOPMI == platform_subtype)) {
+	if ((APQ8017 == platform) && ((HW_PLATFORM_SUBTYPE_SAP == platform_subtype) ||
+		(HW_PLATFORM_SUBTYPE_SAP_NOPMI == platform_subtype))) {
 		if (!strcmp(oem.panel, "")) {
 			if (buf_size < (prefix_string_len +
 				strlen(HDMI_ADV_PANEL_STRING))) {
@@ -646,6 +667,7 @@
 	int32_t ret = 0;
 	uint32_t panel_loop = 0;
 	uint32_t platform_subtype = board_hardware_subtype();
+	uint32_t platform = board_platform_id();
 
 	set_panel_cmd_string(panel_name);
 	oem = mdss_dsi_get_oem_data();
@@ -659,8 +681,8 @@
 		oem.cont_splash = false;
 	}
 
-	if ((HW_PLATFORM_SUBTYPE_SAP == platform_subtype) ||
-		(HW_PLATFORM_SUBTYPE_SAP_NOPMI == platform_subtype)) {
+	if ((APQ8017 == platform) && ((HW_PLATFORM_SUBTYPE_SAP == platform_subtype) ||
+		(HW_PLATFORM_SUBTYPE_SAP_NOPMI == platform_subtype))) {
 		dprintf(INFO, "%s: Platform subtype %d\n",
 			__func__, platform_subtype);
 		return;
diff --git a/target/msm8953/include/target/display.h b/target/msm8953/include/target/display.h
index 07b3f26..a70edf1 100755
--- a/target/msm8953/include/target/display.h
+++ b/target/msm8953/include/target/display.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, 2018, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -66,7 +66,7 @@
 /*---------------------------------------------------------------------------*/
 #define DISPLAY_CMDLINE_PREFIX " mdss_mdp.panel="
 
-#define MIPI_FB_ADDR 0x90100000
+#define MIPI_FB_ADDR 0x90000000
 
 #define MIPI_HSYNC_PULSE_WIDTH       12
 #define MIPI_HSYNC_BACK_PORCH_DCLK   32
diff --git a/target/msm8953/init.c b/target/msm8953/init.c
index d09b5c8..2195f83 100644
--- a/target/msm8953/init.c
+++ b/target/msm8953/init.c
@@ -75,6 +75,9 @@
 #define PMIC_ARB_OWNER_ID       0
 #define TLMM_VOL_UP_BTN_GPIO    85
 
+#define PRI_PMIC_SLAVE_ID	0
+#define SEC_PMIC_SLAVE_ID	2
+
 #define FASTBOOT_MODE           0x77665500
 #define RECOVERY_MODE           0x77665502
 #define PON_SOFT_RB_SPARE       0x88F
@@ -691,7 +694,7 @@
 uint32_t target_get_pmic()
 {
 	if (target_is_pmi_enabled()) {
-		uint32_t pmi_type = board_pmic_target(1) & 0xffff;
+		uint32_t pmi_type = board_pmic_target(1) & PMIC_TYPE_MASK;
 		if (pmi_type == PMIC_IS_PMI632)
 			return PMIC_IS_PMI632;
 		else
@@ -705,12 +708,21 @@
 void pmic_reset_configure(uint8_t reset_type)
 {
 	uint32_t pmi_type;
+	uint8_t sec_reset_type = reset_type;
 
 	pmi_type = target_get_pmic();
 	if (pmi_type == PMIC_IS_PMI632)
+	{
 		pmi632_reset_configure(reset_type);
+	}
 	else
-		pm8994_reset_configure(reset_type);
+	{
+		if (reset_type == PON_PSHOLD_HARD_RESET)
+			sec_reset_type = PON_PSHOLD_SHUTDOWN;
+
+		pm8996_reset_configure(PRI_PMIC_SLAVE_ID, reset_type);
+		pm8996_reset_configure(SEC_PMIC_SLAVE_ID, sec_reset_type);
+	}
 }
 
 struct qmp_reg qmp_settings[] =
diff --git a/target/msm8953/oem_panel.c b/target/msm8953/oem_panel.c
index f035b6f..8bb0c47 100644
--- a/target/msm8953/oem_panel.c
+++ b/target/msm8953/oem_panel.c
@@ -344,7 +344,7 @@
 		break;
 	case HW_PLATFORM_QRD:
 		panel_id = R69006_1080P_CMD_PANEL;
-		if (platform_subtype == 0x01)
+		if (platform_subtype == 0x01 || platform_subtype == 0x03)
 			panel_id = HX8399C_FHD_PLUSE_VIDEO_PANEL;
 		break;
 	default: