Merge "target: msm8994: fix pll configuration for updated VCO frequency"
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 119ec4e..ce8751c 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -81,6 +81,14 @@
 void write_device_info_flash(device_info *dev);
 static int aboot_save_boot_hash_mmc(uint32_t image_addr, uint32_t image_size);
 
+/* fastboot command function pointer */
+typedef void (*fastboot_cmd_fn) (const char *, void *, unsigned);
+
+struct fastboot_cmd_desc {
+	char * name;
+	fastboot_cmd_fn cb;
+};
+
 #define EXPAND(NAME) #NAME
 #define TARGET(NAME) EXPAND(NAME)
 
@@ -606,6 +614,16 @@
 #endif
 
 	free(final_cmdline);
+
+#if VERIFIED_BOOT
+	/* Write protect the device info */
+	if (mmc_write_protect("devinfo", 1))
+	{
+		dprintf(INFO, "Failed to write protect dev info\n");
+		ASSERT(0);
+	}
+#endif
+
 	/* Perform target specific cleanup */
 	target_uninit();
 
@@ -1420,7 +1438,12 @@
 	uint32_t blocksize;
 	uint8_t lun = 0;
 
+#if VERIFIED_BOOT
+	index = partition_get_index("devinfo");
+#else
 	index = partition_get_index("aboot");
+#endif
+
 	ptn = partition_get_offset(index);
 	if(ptn == 0)
 	{
@@ -1436,7 +1459,11 @@
 
 	blocksize = mmc_get_device_blocksize();
 
+#if VERIFIED_BOOT
+	if(mmc_write(ptn, blocksize, (void *)info_buf))
+#else
 	if(mmc_write((ptn + size - blocksize), blocksize, (void *)info_buf))
+#endif
 	{
 		dprintf(CRITICAL, "ERROR: Cannot write device info\n");
 		return;
@@ -1451,18 +1478,29 @@
 	int index = INVALID_PTN;
 	uint32_t blocksize;
 
+#if VERIFIED_BOOT
+	index = partition_get_index("devinfo");
+#else
 	index = partition_get_index("aboot");
+#endif
+
 	ptn = partition_get_offset(index);
 	if(ptn == 0)
 	{
 		return;
 	}
 
+	mmc_set_lun(partition_get_lun(index));
+
 	size = partition_get_size(index);
 
 	blocksize = mmc_get_device_blocksize();
 
+#if VERIFIED_BOOT
+	if(mmc_read(ptn, (void *)info_buf, blocksize))
+#else
 	if(mmc_read((ptn + size - blocksize), (void *)info_buf, blocksize))
+#endif
 	{
 		dprintf(CRITICAL, "ERROR: Cannot read device info\n");
 		return;
@@ -1784,7 +1822,7 @@
 		   (void*) hdr->ramdisk_addr, hdr->ramdisk_size);
 }
 
-void cmd_erase(const char *arg, void *data, unsigned sz)
+void cmd_erase_nand(const char *arg, void *data, unsigned sz)
 {
 	struct ptentry *ptn;
 	struct ptable *ptable;
@@ -1860,6 +1898,13 @@
 	fastboot_okay("");
 }
 
+void cmd_erase(const char *arg, void *data, unsigned sz)
+{
+	if(target_is_emmc_boot())
+		cmd_erase_mmc(arg, data, sz);
+	else
+		cmd_erase_nand(arg, data, sz);
+}
 
 void cmd_flash_mmc_img(const char *arg, void *data, unsigned sz)
 {
@@ -2213,7 +2258,7 @@
 	return;
 }
 
-void cmd_flash(const char *arg, void *data, unsigned sz)
+void cmd_flash_nand(const char *arg, void *data, unsigned sz)
 {
 	struct ptentry *ptn;
 	struct ptable *ptable;
@@ -2261,6 +2306,14 @@
 	fastboot_okay("");
 }
 
+void cmd_flash(const char *arg, void *data, unsigned sz)
+{
+	if(target_is_emmc_boot())
+		cmd_flash_mmc(arg, data, sz);
+	else
+		cmd_flash_nand(arg, data, sz);
+}
+
 void cmd_continue(const char *arg, void *data, unsigned sz)
 {
 	fastboot_okay("");
@@ -2554,32 +2607,37 @@
 /* register commands and variables for fastboot */
 void aboot_fastboot_register_commands(void)
 {
-	if (target_is_emmc_boot())
-	{
-		fastboot_register("flash:", cmd_flash_mmc);
-		fastboot_register("erase:", cmd_erase_mmc);
-	}
-	else
-	{
-		fastboot_register("flash:", cmd_flash);
-		fastboot_register("erase:", cmd_erase);
-	}
+	int i;
 
-	fastboot_register("boot",              cmd_boot);
-	fastboot_register("continue",          cmd_continue);
-	fastboot_register("reboot",            cmd_reboot);
-	fastboot_register("reboot-bootloader", cmd_reboot_bootloader);
-	fastboot_register("oem unlock",        cmd_oem_unlock);
-	fastboot_register("oem lock",          cmd_oem_lock);
-	fastboot_register("oem verified",      cmd_oem_verified);
-	fastboot_register("oem device-info",   cmd_oem_devinfo);
-	fastboot_register("preflash",          cmd_preflash);
-	fastboot_register("oem enable-charger-screen",
-			cmd_oem_enable_charger_screen);
-	fastboot_register("oem disable-charger-screen",
-			cmd_oem_disable_charger_screen);
-	fastboot_register("oem select-display-panel",
-			cmd_oem_select_display_panel);
+	struct fastboot_cmd_desc cmd_list[] = {
+											/* By default the enabled list is empty. */
+											{"", NULL},
+											/* move commands enclosed within the below ifndef to here
+											 * if they need to be enabled in user build.
+											 */
+#ifndef DISABLE_FASTBOOT_CMDS
+											/* Register the following commands only for non-user builds */
+											{"flash:", cmd_flash},
+											{"erase:", cmd_erase},
+											{"boot", cmd_boot},
+											{"continue", cmd_continue},
+											{"reboot", cmd_reboot},
+											{"reboot-bootloader", cmd_reboot_bootloader},
+											{"oem unlock", cmd_oem_unlock},
+											{"oem lock", cmd_oem_lock},
+											{"oem verified", cmd_oem_verified},
+											{"oem device-info", cmd_oem_devinfo},
+											{"preflash", cmd_preflash},
+											{"oem enable-charger-screen", cmd_oem_enable_charger_screen},
+											{"oem disable-charger-screen", cmd_oem_disable_charger_screen},
+											{"oem-select-display-panel", cmd_oem_select_display_panel},
+#endif
+										  };
+
+	int fastboot_cmds_count = sizeof(cmd_list)/sizeof(cmd_list[0]);
+	for (i = 1; i < fastboot_cmds_count; i++)
+		fastboot_register(cmd_list[i].name,cmd_list[i].cb);
+
 	/* publish variables and their values */
 	fastboot_publish("product",  TARGET(BOARD));
 	fastboot_publish("kernel",   "lk");
diff --git a/app/aboot/recovery.c b/app/aboot/recovery.c
index 3c42902..71ee2ef 100644
--- a/app/aboot/recovery.c
+++ b/app/aboot/recovery.c
@@ -395,6 +395,7 @@
 
 	index = partition_get_index((unsigned char *) ptn_name);
 	ptn = partition_get_offset(index);
+	mmc_set_lun(partition_get_lun(index));
 	if(ptn == 0) {
 		dprintf(CRITICAL,"partition %s doesn't exist\n",ptn_name);
 		return -1;
@@ -417,6 +418,7 @@
 	size = mmc_get_device_blocksize();
 	index = partition_get_index((unsigned char *) ptn_name);
 	ptn = partition_get_offset(index);
+	mmc_set_lun(partition_get_lun(index));
 	if(ptn == 0) {
 		dprintf(CRITICAL,"partition %s doesn't exist\n",ptn_name);
 		return -1;
@@ -522,6 +524,8 @@
 		ptn = partition_get_offset(index);
 		ptn_size = partition_get_size(index);
 
+		mmc_set_lun(partition_get_lun(index));
+
 		if (ptn_size < offset + size)
 		{
 			dprintf(CRITICAL, "Read request out of '%s' boundaries\n",
diff --git a/app/rpmbtests/rules.mk b/app/rpmbtests/rules.mk
new file mode 100644
index 0000000..b59dee9
--- /dev/null
+++ b/app/rpmbtests/rules.mk
@@ -0,0 +1,8 @@
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+INCLUDES += -I$(LK_TOP_DIR)/platform/msm_shared/include
+
+DEFINES += ASSERT_ON_TAMPER=1
+
+OBJS += \
+	$(LOCAL_DIR)/ufs_rpmb.o
diff --git a/app/rpmbtests/ufs_rpmb.c b/app/rpmbtests/ufs_rpmb.c
new file mode 100644
index 0000000..4798b98
--- /dev/null
+++ b/app/rpmbtests/ufs_rpmb.c
@@ -0,0 +1,145 @@
+/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <reg.h>
+#include <ufs_hw.h>
+#include <utp.h>
+#include <upiu.h>
+#include <uic.h>
+#include <ucs.h>
+#include <dme.h>
+#include <rpmb.h>
+#include <string.h>
+#include <stdlib.h>
+#include <endian.h>
+#include "ufs_rpmb.h"
+#include <platform/iomap.h>
+#include <kernel/mutex.h>
+
+void rpmb_run_test()
+{
+	bool result;
+	uint16_t sector_address = 1, rpmb_num_blocks = 4;
+	void *dev;
+	dev = target_mmc_device();
+	result = rpmb_test((struct ufs_dev *)dev, sector_address, rpmb_num_blocks);
+	if (!result)
+		dprintf(INFO, "RPMB test failed");
+}
+
+int verify_rpmb_frame(struct rpmb_frame *request_frame, struct rpmb_frame *result_frame, int type)
+{
+	int i = 0;
+	if(result_frame->result[0] == MAXED_WR_COUNTER)
+	{
+		dprintf(INFO, "Max write counter value reached\n");
+		return MAXED_WR_COUNTER;
+	}
+	if(result_frame->result[1] != OPERATION_OK)
+	{
+		dprintf(INFO, "RPMB operation error: 0x%x\n", result_frame->result[1]);
+		return result_frame->result[1];
+	}
+	for(i = 0; i < 16; i++)
+	{
+		if(request_frame->nonce[i] != result_frame->nonce[i])
+			return NONCE_MISMATCH;
+	}
+	return OPERATION_OK;
+}
+
+void dump_rpmb_data(struct rpmb_frame *result_frame)
+{
+	int data_counter;
+	for (data_counter = 0; data_counter < 256; data_counter++)
+	{
+		printf("0x%x ", result_frame->data[data_counter]);
+		if ((data_counter + 1) % 16 == 0)
+			printf("\n");
+	}
+	printf("\n");
+}
+
+bool rpmb_test(struct ufs_dev *dev, uint16_t address, uint16_t rpmb_num_blocks)
+{
+	struct rpmb_frame data_frame, result_frame[rpmb_num_blocks];
+	uint8_t *temp = (uint8_t )&address;
+	int i = 0, ret;
+	uint32_t response_len = 0;
+	// check if address + sectors requested for read do not exceed total size of rpmb
+	if ((address + rpmb_num_blocks) > dev->rpmb_num_blocks)
+	{
+		dprintf(CRITICAL, "Invalid request to rpmb\n");
+		return false;
+	}
+	memset(&data_frame, 0, sizeof(data_frame));
+	memset(&result_frame, 0, sizeof(result_frame));
+	data_frame.address = BE16(address);
+	data_frame.blockcount = BE16(rpmb_num_blocks);
+	data_frame.requestresponse = BE16(AUTH_READ);
+	for(i = 0 ; i < 16; i++)
+	{
+		data_frame.nonce[i] = (rand() % 256) + 1;
+	}
+#ifdef DEBUG_UFS_RPMB
+	dprintf(INFO, "Dumping RPMB Request frame\n");
+	dprintf(INFO, "--------------------------\n");
+	dump((void *) &data_frame, sizeof(struct rpmb_frame));
+#endif
+	ret = ucs_do_scsi_rpmb_read(dev, (uint32_t *) &data_frame, rpmb_num_blocks,
+                               (uint32_t *) &result_frame, &response_len);
+	if (ret)
+	{
+		dprintf(CRITICAL, "RPMB Read error\n");
+		return;
+	}
+	for (i = 0; i < rpmb_num_blocks; i++)
+	{
+		ret = verify_rpmb_frame(&data_frame, &result_frame[i], AUTH_READ);
+		if(ret)
+		{
+			dprintf(CRITICAL, "Error in verifying RPMB frame\n");
+			dump((void *) &result_frame[i], sizeof(struct rpmb_frame));
+		}
+	}
+#ifdef DEBUG_UFS_RPMB
+	dprintf(INFO, "Dumping RPMB Response frames\n");
+	dprintf(INFO, "----------------------------\n");
+	dump((void *) &result_frame, sizeof(struct rpmb_frame)*rpmb_num_blocks);
+#endif
+	dprintf(INFO, "Data dump for RPMB read request\n");
+	printf("-------------------------------\n");
+
+	for (i = 0; i < rpmb_num_blocks; i++)
+		dump_rpmb_data((void *) &result_frame[i]);
+
+	printf("-------------------------------\n");
+
+	return true;
+}
diff --git a/app/rpmbtests/ufs_rpmb.h b/app/rpmbtests/ufs_rpmb.h
new file mode 100644
index 0000000..5d16a7b
--- /dev/null
+++ b/app/rpmbtests/ufs_rpmb.h
@@ -0,0 +1,46 @@
+/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+static inline void dump(const void *buff, int count)
+{
+	int i = 0;
+	printf("memory dump of %d bytes from address 0x%x\n",count, buff);
+	for (i = 0; i < count; i++) {
+		unsigned char ch = *(const unsigned char *) buff;
+		printf("0x%02X ", ch);
+		if ((i+1) % 16 == 0)
+			printf("\n");
+		buff = (const char *) buff + 1;
+	}
+	printf("\n");
+}
+
+void rpmb_run_test();
+bool rpmb_test(struct ufs_dev *dev, uint16_t address, uint16_t rpmb_num_blocks);
+void dump_rpmb_data(struct rpmb_frame *result_frame);
+int verify_rpmb_frame(struct rpmb_frame *request_frame, struct rpmb_frame *result_frame, int type);
diff --git a/arch/arm/asm.S b/arch/arm/asm.S
index 97ebc73..39b8dca 100644
--- a/arch/arm/asm.S
+++ b/arch/arm/asm.S
@@ -69,7 +69,7 @@
 FUNCTION(arm_save_mode_regs)
 	mrs		r1, cpsr
 
-#if ARM_ISA_ARMv6
+#if ARM_ISA_ARMv6 || ARM_ISA_ARMV7
 	cps		#0x11			/* fiq */
 	str		r13, [r0], #4
 	str		r14, [r0], #4
diff --git a/arch/arm/cache-ops.S b/arch/arm/cache-ops.S
index a1151ab..22d9a2b 100644
--- a/arch/arm/cache-ops.S
+++ b/arch/arm/cache-ops.S
@@ -313,11 +313,13 @@
 
 	/* void arch_flush_cache_range(addr_t start, size_t len); */
 FUNCTION(arch_clean_cache_range)
+	add 	r2, r0, r1					// Calculate the end address
+	bic 	r0,#(CACHE_LINE-1)			// Align start with cache line
 0:
 	mcr		p15, 0, r0, c7, c10, 1		// clean cache to PoC by MVA
 	add		r0, r0, #CACHE_LINE
-	subs	r1, r1, #CACHE_LINE
-	bhs		0b
+	cmp 	r0, r2
+	blo		0b
 	
 	mov		r0, #0
 	dsb
@@ -326,11 +328,13 @@
 
 	/* void arch_flush_invalidate_cache_range(addr_t start, size_t len); */
 FUNCTION(arch_clean_invalidate_cache_range)
+	add 	r2, r0, r1					// Calculate the end address
+	bic 	r0,#(CACHE_LINE-1)			// Align start with cache line
 0:
 	mcr		p15, 0, r0, c7, c14, 1		// clean & invalidate cache to PoC by MVA
 	add		r0, r0, #CACHE_LINE
-	subs	r1, r1, #CACHE_LINE
-	bhs		0b
+	cmp 	r0, r2
+	blo		0b
 
 	mov		r0, #0
 	dsb
@@ -339,12 +343,14 @@
 
 	/* void arch_invalidate_cache_range(addr_t start, size_t len); */
 FUNCTION(arch_invalidate_cache_range)
-0:
 	/* invalidate cache line */
+	add 	r2, r0, r1					// Calculate the end address
+	bic 	r0,#(CACHE_LINE-1)			// Align start with cache line
+0:
 	mcr		p15, 0, r0, c7, c6, 1
 	add		r0, r0, #CACHE_LINE
-	subs	r1, r1, #CACHE_LINE
-	bhs		0b
+	cmp 	r0, r2
+	blo		0b
 	mov		r0, #0
 	dsb
 	bx		lr
diff --git a/arch/arm/faults.c b/arch/arm/faults.c
index 020266a..1b412ac 100644
--- a/arch/arm/faults.c
+++ b/arch/arm/faults.c
@@ -24,7 +24,7 @@
 #include <arch/arm.h>
 #include <kernel/thread.h>
 
-static void dump_fault_frame(struct arm_fault_frame *frame)
+void dump_fault_frame(struct arm_fault_frame *frame)
 {
 	dprintf(CRITICAL, "r0  0x%08x r1  0x%08x r2  0x%08x r3  0x%08x\n", frame->r[0], frame->r[1], frame->r[2], frame->r[3]);
 	dprintf(CRITICAL, "r4  0x%08x r5  0x%08x r6  0x%08x r7  0x%08x\n", frame->r[4], frame->r[5], frame->r[6], frame->r[7]);
diff --git a/dev/fbcon/fbcon.c b/dev/fbcon/fbcon.c
index 1fa8bd5..a593a62 100644
--- a/dev/fbcon/fbcon.c
+++ b/dev/fbcon/fbcon.c
@@ -2,7 +2,7 @@
  * Copyright (c) 2008, Google Inc.
  * All rights reserved.
  *
- * Copyright (c) 2009-2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2009-2014, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -223,8 +223,8 @@
 	if(!fbimg) {
 		flag = false;
 		fbimg = &default_fbimg;
-		fbimg->header.width = SPLASH_IMAGE_HEIGHT;
-		fbimg->header.height = SPLASH_IMAGE_WIDTH;
+		fbimg->header.width = SPLASH_IMAGE_WIDTH;
+		fbimg->header.height = SPLASH_IMAGE_HEIGHT;
 #if DISPLAY_TYPE_MIPI
 		fbimg->image = (unsigned char *)imageBuffer_rgb888;
 #else
@@ -304,15 +304,19 @@
 #endif
 
 #else
-    if (bytes_per_bpp == 2)
-    {
-        for (i = 0; i < header->width; i++)
-        {
-            memcpy (config->base + ((image_base + (i * (config->width))) * bytes_per_bpp),
-		   fbimg->image + (i * header->height * bytes_per_bpp),
-		   header->height * bytes_per_bpp);
-        }
-    }
-    fbcon_flush();
+	if (bytes_per_bpp == 2)
+	{
+		image_base = ((((total_y/2) - (height / 2) ) *
+				(config->width)) + (total_x/2 - (width / 2)));
+
+		for (i = 0; i < header->width; i++)
+		{
+			memcpy (config->base +
+				((image_base + (i * (config->width))) * bytes_per_bpp),
+				(fbimg->image + (i * header->height * bytes_per_bpp)),
+				(header->height * bytes_per_bpp));
+		}
+	}
+	fbcon_flush();
 #endif
 }
diff --git a/dev/gcdb/display/panel_display.h b/dev/gcdb/display/panel_display.h
index dcc5631..3c99289 100755
--- a/dev/gcdb/display/panel_display.h
+++ b/dev/gcdb/display/panel_display.h
@@ -39,6 +39,7 @@
 #define BPP_24 24
 
 #define TIMING_SIZE 48
+#define REGULATOR_SIZE 28
 
 #define DUAL_DSI_FLAG 0x1
 #define DUAL_PIPE_FLAG 0x2
diff --git a/include/debug.h b/include/debug.h
index bcf73c5..d4bce54 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -64,6 +64,8 @@
 /* systemwide halts */
 void halt(void);
 
+void dump_frame(void *frame);
+
 void _panic(void *caller, const char *fmt, ...) __PRINTFLIKE(2, 3);
 #define panic(x...) _panic(__GET_CALLER(), x)
 
diff --git a/lib/debug/debug.c b/lib/debug/debug.c
index 84d0678..f239bbe 100644
--- a/lib/debug/debug.c
+++ b/lib/debug/debug.c
@@ -35,6 +35,9 @@
 #include <kernel/thread.h>
 #include <kernel/timer.h>
 #include <rand.h>
+#if ARCH_ARM
+#include <arch/arm.h>
+#endif
 
 void __attribute__ ((noreturn))
 __stack_chk_fail (void)
@@ -56,8 +59,19 @@
 	platform_halt();
 }
 
+void dump_frame(void *frame)
+{
+	enter_critical_section(); // disable ints
+#if ARCH_ARM
+	dump_fault_frame((struct arm_fault_frame *)frame);
+#endif
+	exit_critical_section(); // disable ints
+}
+
 void _panic(void *caller, const char *fmt, ...)
 {
+	dprintf(ALWAYS, "panic (frame %p): \n", __GET_FRAME());
+	dump_frame(__GET_FRAME());
 	dprintf(ALWAYS, "panic (caller %p): ", caller);
 
 	va_list ap;
diff --git a/makefile b/makefile
index 0cf7e7c..1056726 100644
--- a/makefile
+++ b/makefile
@@ -60,6 +60,10 @@
   CFLAGS += -D_SIGNED_KERNEL=1
 endif
 
+ifeq ($(TARGET_BUILD_VARIANT),user)
+  CFLAGS += -DDISABLE_FASTBOOT_CMDS=1
+endif
+
 # setup toolchain prefix
 TOOLCHAIN_PREFIX ?= arm-eabi-
 CFLAGS += -fstack-protector-all
diff --git a/platform/mdm9x35/include/platform/iomap.h b/platform/mdm9x35/include/platform/iomap.h
index 9628da5..feff1a1 100755
--- a/platform/mdm9x35/include/platform/iomap.h
+++ b/platform/mdm9x35/include/platform/iomap.h
@@ -170,4 +170,8 @@
 #define PERIPH_SS_AHB2PHY_TOP_CFG            0xF9B3E010
 
 #define PLATFORM_QMP_OFFSET                  0x0
+
+/* QPIC DISPLAY */
+#define QPIC_BASE                            0xF9AC0000
+#define APCS_ALIAS0_IPC_INTERRUPT            0xF9011008
 #endif
diff --git a/platform/mdm9x35/include/platform/irqs.h b/platform/mdm9x35/include/platform/irqs.h
index 3f2a72c..3cef959 100755
--- a/platform/mdm9x35/include/platform/irqs.h
+++ b/platform/mdm9x35/include/platform/irqs.h
@@ -58,4 +58,5 @@
 #define NR_IRQS                                (NR_MSM_IRQS + NR_GPIO_IRQS + \
                                                NR_BOARD_IRQS)
 
+#define SMD_IRQ                                (GIC_SPI_START + 168)
 #endif /* __IRQS_9635_H */
diff --git a/platform/msm8909/acpuclock.c b/platform/msm8909/acpuclock.c
index 334a1f3..d483c79 100644
--- a/platform/msm8909/acpuclock.c
+++ b/platform/msm8909/acpuclock.c
@@ -39,24 +39,136 @@
 
 void hsusb_clock_init(void)
 {
+	int ret;
+	struct clk *iclk, *cclk;
 
+	ret = clk_get_set_enable("usb_iface_clk", 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_iface_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("usb_core_clk", 80000000, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_core_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	mdelay(20);
+
+	iclk = clk_get("usb_iface_clk");
+	cclk = clk_get("usb_core_clk");
+
+	clk_disable(iclk);
+	clk_disable(cclk);
+
+	mdelay(20);
+
+	/* Start the block reset for usb */
+	writel(1, USB_HS_BCR);
+
+	mdelay(20);
+
+	/* Take usb block out of reset */
+	writel(0, USB_HS_BCR);
+
+	mdelay(20);
+
+	ret = clk_enable(iclk);
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_iface_clk after async ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_enable(cclk);
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_iface_clk after async ret = %d\n", ret);
+		ASSERT(0);
+	}
 }
 
 void clock_init_mmc(uint32_t interface)
 {
+	char clk_name[64];
+	int ret;
 
+	snprintf(clk_name, sizeof(clk_name), "sdc%u_iface_clk", interface);
+
+	/* enable interface clock */
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set sdc1_iface_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
 }
 
 /* Configure MMC clock */
 void clock_config_mmc(uint32_t interface, uint32_t freq)
 {
+	int ret;
+	char clk_name[64];
 
+	snprintf(clk_name, sizeof(clk_name), "sdc%u_core_clk", interface);
+
+	if(freq == MMC_CLK_400KHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 400000, 1);
+	}
+	else if(freq == MMC_CLK_50MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 50000000, 1);
+	}
+	else if(freq == MMC_CLK_200MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 200000000, 1);
+	}
+	else if(freq == MMC_CLK_177MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 177770000, 1);
+	}
+	else
+	{
+		dprintf(CRITICAL, "sdc frequency (%u) is not supported\n", freq);
+		ASSERT(0);
+	}
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set %s ret = %d\n", clk_name, ret);
+		ASSERT(0);
+	}
 }
 
 /* Configure UART clock based on the UART block id*/
 void clock_config_uart_dm(uint8_t id)
 {
+	int ret;
+	char iclk[64];
+	char cclk[64];
 
+	snprintf(iclk, sizeof(iclk), "uart%u_iface_clk", id);
+	snprintf(cclk, sizeof(cclk), "uart%u_core_clk", id);
+
+	ret = clk_get_set_enable(iclk, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set %s ret = %d\n", iclk, ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable(cclk, 7372800, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set %s ret = %d\n", cclk, ret);
+		ASSERT(0);
+	}
 }
 
 /* Function to asynchronously reset CE.
@@ -64,17 +176,90 @@
  */
 static void ce_async_reset(uint8_t instance)
 {
+	/* Start the block reset for CE */
+	writel(1, GCC_CRYPTO_BCR);
 
+	udelay(2);
+
+	/* Take CE block out of reset */
+	writel(0, GCC_CRYPTO_BCR);
+
+	udelay(2);
 }
 
 void clock_ce_enable(uint8_t instance)
 {
+	int ret;
+	char clk_name[64];
 
+	snprintf(clk_name, sizeof(clk_name), "ce%u_src_clk", instance);
+	ret = clk_get_set_enable(clk_name, 160000000, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_src_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_core_clk", instance);
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_core_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_ahb_clk", instance);
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_ahb_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_axi_clk", instance);
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_axi_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	/* Wait for 48 * #pipes cycles.
+	* This is necessary as immediately after an access control reset (boot up)
+	* or a debug re-enable, the Crypto core sequentially clears its internal
+	* pipe key storage memory. If pipe key initialization writes are attempted
+	* during this time, they may be overwritten by the internal clearing logic.
+	*/
+	udelay(1);
 }
 
 void clock_ce_disable(uint8_t instance)
 {
+	struct clk *ahb_clk;
+	struct clk *cclk;
+	struct clk *axi_clk;
+	struct clk *src_clk;
+	char clk_name[64];
 
+	snprintf(clk_name, sizeof(clk_name), "ce%u_src_clk", instance);
+	src_clk = clk_get(clk_name);
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_ahb_clk", instance);
+	ahb_clk = clk_get(clk_name);
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_axi_clk", instance);
+	axi_clk = clk_get(clk_name);
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_core_clk", instance);
+	cclk    = clk_get(clk_name);
+
+	clk_disable(ahb_clk);
+	clk_disable(axi_clk);
+	clk_disable(cclk);
+	clk_disable(src_clk);
+
+	/* Some delay for the clocks to stabalize. */
+	udelay(1);
 }
 
 void clock_config_ce(uint8_t instance)
diff --git a/platform/msm8909/include/platform/iomap.h b/platform/msm8909/include/platform/iomap.h
index bbe731c..2ba6355 100644
--- a/platform/msm8909/include/platform/iomap.h
+++ b/platform/msm8909/include/platform/iomap.h
@@ -82,6 +82,7 @@
 #define SPMI_BASE                   0x02000000
 #define SPMI_GENI_BASE              (SPMI_BASE + 0xA000)
 #define SPMI_PIC_BASE               (SPMI_BASE +  0x01800000)
+#define PMIC_ARB_CORE               0x200F000
 
 #define TLMM_BASE_ADDR              0x1000000
 #define GPIO_CONFIG_ADDR(x)         (TLMM_BASE_ADDR + (x)*0x1000)
@@ -109,6 +110,7 @@
 
 /* GPLL */
 #define GPLL0_STATUS                (CLK_CTL_BASE + 0x21024)
+#define GPLL0_MODE                  (CLK_CTL_BASE + 0x21000)
 #define GPLL1_STATUS                (CLK_CTL_BASE + 0x2001C)
 #define APCS_GPLL_ENA_VOTE          (CLK_CTL_BASE + 0x45000)
 #define APCS_CLOCK_BRANCH_ENA_VOTE  (CLK_CTL_BASE + 0x45004)
@@ -142,6 +144,12 @@
 #define BLSP1_UART2_APPS_N          (CLK_CTL_BASE + 0x3040)
 #define BLSP1_UART2_APPS_D          (CLK_CTL_BASE + 0x3044)
 
+#define BLSP1_UART1_APPS_CBCR       (CLK_CTL_BASE + 0x203C)
+#define BLSP1_UART1_APPS_CMD_RCGR   (CLK_CTL_BASE + 0x2044)
+#define BLSP1_UART1_APPS_CFG_RCGR   (CLK_CTL_BASE + 0x2048)
+#define BLSP1_UART1_APPS_M          (CLK_CTL_BASE + 0x204C)
+#define BLSP1_UART1_APPS_N          (CLK_CTL_BASE + 0x2050)
+#define BLSP1_UART1_APPS_D          (CLK_CTL_BASE + 0x2054)
 
 /* USB */
 #define USB_HS_BCR                  (CLK_CTL_BASE + 0x41000)
@@ -238,4 +246,6 @@
 #define BOOT_CONFIG_OFFSET          0x0000602C
 #define BOOT_CONFIG_REG             (SEC_CTRL_CORE_BASE + BOOT_CONFIG_OFFSET)
 
+/* EBI2 */
+#define TLMM_EBI2_EMMC_GPIO_CFG     (TLMM_BASE_ADDR + 0x00111000)
 #endif
diff --git a/platform/msm8909/msm8909-clock.c b/platform/msm8909/msm8909-clock.c
index a2af96d..5c0c433 100644
--- a/platform/msm8909/msm8909-clock.c
+++ b/platform/msm8909/msm8909-clock.c
@@ -100,8 +100,8 @@
 {
 	.en_reg       = (void *) APCS_GPLL_ENA_VOTE,
 	.en_mask      = BIT(0),
-	.status_reg   = (void *) GPLL0_STATUS,
-	.status_mask  = BIT(17),
+	.status_reg   = (void *) GPLL0_MODE,
+	.status_mask  = BIT(30),
 	.parent       = &cxo_clk_src.c,
 
 	.c = {
@@ -254,31 +254,31 @@
 	F_END
 };
 
-static struct rcg_clk blsp1_uart2_apps_clk_src =
+static struct rcg_clk blsp1_uart1_apps_clk_src =
 {
-	.cmd_reg      = (uint32_t *) BLSP1_UART2_APPS_CMD_RCGR,
-	.cfg_reg      = (uint32_t *) BLSP1_UART2_APPS_CFG_RCGR,
-	.m_reg        = (uint32_t *) BLSP1_UART2_APPS_M,
-	.n_reg        = (uint32_t *) BLSP1_UART2_APPS_N,
-	.d_reg        = (uint32_t *) BLSP1_UART2_APPS_D,
+	.cmd_reg      = (uint32_t *) BLSP1_UART1_APPS_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) BLSP1_UART1_APPS_CFG_RCGR,
+	.m_reg        = (uint32_t *) BLSP1_UART1_APPS_M,
+	.n_reg        = (uint32_t *) BLSP1_UART1_APPS_N,
+	.d_reg        = (uint32_t *) BLSP1_UART1_APPS_D,
 
 	.set_rate     = clock_lib2_rcg_set_rate_mnd,
 	.freq_tbl     = ftbl_gcc_blsp1_2_uart1_6_apps_clk,
 	.current_freq = &rcg_dummy_freq,
 
 	.c = {
-		.dbg_name = "blsp1_uart2_apps_clk",
+		.dbg_name = "blsp1_uart1_apps_clk",
 		.ops      = &clk_ops_rcg_mnd,
 	},
 };
 
-static struct branch_clk gcc_blsp1_uart2_apps_clk =
+static struct branch_clk gcc_blsp1_uart1_apps_clk =
 {
-	.cbcr_reg     = (uint32_t *) BLSP1_UART2_APPS_CBCR,
-	.parent       = &blsp1_uart2_apps_clk_src.c,
+	.cbcr_reg     = (uint32_t *) BLSP1_UART1_APPS_CBCR,
+	.parent       = &blsp1_uart1_apps_clk_src.c,
 
 	.c = {
-		.dbg_name = "gcc_blsp1_uart2_apps_clk",
+		.dbg_name = "gcc_blsp1_uart1_apps_clk",
 		.ops      = &clk_ops_branch,
 	},
 };
@@ -422,8 +422,8 @@
 	CLK_LOOKUP("sdc2_iface_clk", gcc_sdcc2_ahb_clk.c),
 	CLK_LOOKUP("sdc2_core_clk",  gcc_sdcc2_apps_clk.c),
 
-	CLK_LOOKUP("uart2_iface_clk", gcc_blsp1_ahb_clk.c),
-	CLK_LOOKUP("uart2_core_clk",  gcc_blsp1_uart2_apps_clk.c),
+	CLK_LOOKUP("uart1_iface_clk", gcc_blsp1_ahb_clk.c),
+	CLK_LOOKUP("uart1_core_clk",  gcc_blsp1_uart1_apps_clk.c),
 
 	CLK_LOOKUP("usb_iface_clk",  gcc_usb_hs_ahb_clk.c),
 	CLK_LOOKUP("usb_core_clk",   gcc_usb_hs_system_clk.c),
diff --git a/platform/msm8916/include/platform/iomap.h b/platform/msm8916/include/platform/iomap.h
index c815bd0..2532601 100644
--- a/platform/msm8916/include/platform/iomap.h
+++ b/platform/msm8916/include/platform/iomap.h
@@ -51,6 +51,9 @@
 #define ABOOT_FORCE_RAMDISK_ADDR    DDR_START + 0x2000000
 #define ABOOT_FORCE_TAGS_ADDR       DDR_START + 0x1E00000
 
+/* 3GB DDR devices consider 0x40000000 as new mem base */
+#define BASE_ADDR_1                 0x40000000
+
 #define MSM_GIC_DIST_BASE           APPS_SS_BASE
 #define MSM_GIC_CPU_BASE            (APPS_SS_BASE + 0x2000)
 #define APPS_APCS_QTMR_AC_BASE      (APPS_SS_BASE + 0x00020000)
diff --git a/platform/msm8916/platform.c b/platform/msm8916/platform.c
index 4e896ce..0558b35 100644
--- a/platform/msm8916/platform.c
+++ b/platform/msm8916/platform.c
@@ -64,6 +64,7 @@
 	{    MSM_SHARED_BASE,   MSM_SHARED_BASE,  1,                COMMON_MEMORY},
 	{    BASE_ADDR,         BASE_ADDR,        90,               COMMON_MEMORY},
 	{    SCRATCH_ADDR,      SCRATCH_ADDR,     256,              COMMON_MEMORY},
+	{    BASE_ADDR_1,       BASE_ADDR_1,     1024,              COMMON_MEMORY},
 };
 
 static struct smem_ram_ptable ram_ptable;
diff --git a/platform/msm_shared/display.c b/platform/msm_shared/display.c
index aac82c0..f0b6020 100644
--- a/platform/msm_shared/display.c
+++ b/platform/msm_shared/display.c
@@ -68,6 +68,7 @@
 	mdp_set_revision(panel->mdp_rev);
 
 	switch (pinfo->type) {
+#ifdef DISPLAY_TYPE_MDSS
 	case LVDS_PANEL:
 		dprintf(INFO, "Config LVDS_PANEL.\n");
 		ret = mdp_lcdc_config(pinfo, &(panel->fb));
@@ -127,6 +128,13 @@
 		if (ret)
 			goto msm_display_config_out;
 		break;
+#endif
+#ifdef DISPLAY_TYPE_QPIC
+	case QPIC_PANEL:
+		dprintf(INFO, "Config QPIC_PANEL.\n");
+		qpic_init(pinfo, panel->fb.base);
+		break;
+#endif
 	default:
 		return ERR_INVALID_ARGS;
 	};
@@ -158,6 +166,7 @@
 	}
 
 	switch (pinfo->type) {
+#ifdef DISPLAY_TYPE_MDSS
 	case LVDS_PANEL:
 		dprintf(INFO, "Turn on LVDS PANEL.\n");
 		ret = mdp_lcdc_on(panel);
@@ -221,6 +230,18 @@
 		if (ret)
 			goto msm_display_on_out;
 		break;
+#endif
+#ifdef DISPLAY_TYPE_QPIC
+	case QPIC_PANEL:
+		dprintf(INFO, "Turn on QPIC_PANEL.\n");
+		ret = qpic_on();
+		if (ret) {
+			dprintf(CRITICAL, "QPIC panel on failed\n");
+			goto msm_display_on_out;
+		}
+		qpic_update();
+		break;
+#endif
 	default:
 		return ERR_INVALID_ARGS;
 	};
@@ -320,6 +341,7 @@
 	}
 
 	switch (pinfo->type) {
+#ifdef DISPLAY_TYPE_MDSS
 	case LVDS_PANEL:
 		dprintf(INFO, "Turn off LVDS PANEL.\n");
 		mdp_lcdc_off();
@@ -352,6 +374,13 @@
 		if (ret)
 			goto msm_display_off_out;
 		break;
+#endif
+#ifdef DISPLAY_TYPE_QPIC
+	case QPIC_PANEL:
+		dprintf(INFO, "Turn off QPIC_PANEL.\n");
+		qpic_off();
+		break;
+#endif
 	default:
 		return ERR_INVALID_ARGS;
 	};
diff --git a/platform/msm_shared/dme.c b/platform/msm_shared/dme.c
index 2571763..8b22384 100644
--- a/platform/msm_shared/dme.c
+++ b/platform/msm_shared/dme.c
@@ -37,6 +37,7 @@
 #include <dme.h>
 #include <uic.h>
 #include <utp.h>
+#include <ucs.h>
 
 int dme_send_linkstartup_req(struct ufs_dev *dev)
 {
@@ -309,7 +310,29 @@
 	arch_invalidate_cache_range((addr_t) str_desc, sizeof(struct ufs_string_desc));
 
 	dev->serial_num = dme_parse_serial_no(str_desc);
-	
+
+	return UFS_SUCCESS;
+}
+
+
+int dme_read_geo_desc(struct ufs_dev *dev)
+{
+	struct ufs_geometry_desc *desc;
+	STACKBUF_DMA_ALIGN(geometry_desc, sizeof(struct ufs_geometry_desc));
+	desc = geometry_desc;
+	struct utp_query_req_upiu_type query = {UPIU_QUERY_OP_READ_DESCRIPTOR,
+											UFS_DESC_IDN_GEOMETRY,
+											0,
+											0,
+											(addr_t) geometry_desc,
+											sizeof(struct ufs_geometry_desc)};
+
+	if (dme_send_query_upiu(dev, &query))
+		return -UFS_FAILURE;
+
+	// Flush buffer.
+	arch_invalidate_cache_range((addr_t) desc, sizeof(struct ufs_geometry_desc));
+	dev->rpmb_rw_size = desc->rpmb_read_write_size;
 	return UFS_SUCCESS;
 }
 
@@ -334,6 +357,10 @@
 
 	dev->lun_cfg[index].erase_blk_size = BE32(desc->erase_blk_size);
 
+	// use only the lower 32 bits for rpmb partition size
+	if (index == UFS_WLUN_RPMB)
+		dev->rpmb_num_blocks = BE32(desc->logical_blk_cnt >> 32);
+
 	return UFS_SUCCESS;
 }
 
diff --git a/platform/msm_shared/gpio.c b/platform/msm_shared/gpio.c
index eb569dd..7071a22 100644
--- a/platform/msm_shared/gpio.c
+++ b/platform/msm_shared/gpio.c
@@ -32,7 +32,7 @@
 #include <platform/iomap.h>
 #include <gpio.h>
 
-static void tlmm_set_sdc_pins(struct tlmm_cfgs *cfg)
+static void tlmm_set_pins(struct tlmm_cfgs *cfg)
 {
 	uint32_t reg_val;
 
@@ -57,7 +57,7 @@
 	uint8_t i;
 
 	for (i = 0; i < sz; i++)
-		tlmm_set_sdc_pins(&hdrv_cfgs[i]);
+		tlmm_set_pins(&hdrv_cfgs[i]);
 }
 
 void tlmm_set_pull_ctrl(struct tlmm_cfgs *pull_cfgs, uint8_t sz)
@@ -65,5 +65,5 @@
 	uint8_t i;
 
 	for (i = 0; i < sz; i++)
-		tlmm_set_sdc_pins(&pull_cfgs[i]);
+		tlmm_set_pins(&pull_cfgs[i]);
 }
diff --git a/platform/msm_shared/include/dme.h b/platform/msm_shared/include/dme.h
index c9ac677..2473ae2 100644
--- a/platform/msm_shared/include/dme.h
+++ b/platform/msm_shared/include/dme.h
@@ -150,28 +150,39 @@
 
 struct ufs_geometry_desc
 {
-	uint8_t  desc_len;
-	uint8_t  desc_type;
-	uint8_t  media_tech;
-	uint8_t  resv_0;
-	uint8_t  raw_dev_capacity[8];
-	uint8_t  resv_1;
-	uint32_t segment_size;
-	uint8_t  alloc_unit_size;
-	uint8_t  min_addr_blk_size;
-	uint8_t  optimal_read_blk_size;
-	uint8_t  optimal_write_blk_size;
-	uint8_t  max_inbuf_size;
-	uint8_t  maxoutbuf_size;
-	uint8_t  rpmb_rdwr_size;
-	uint8_t  resv_2;
-	uint8_t  data_ordering;
-	uint8_t  resv_3[5];
-	uint8_t  max_ctx_id_num;
-	uint8_t  sys_data_tag_unit_size;
-	uint8_t  sys_data_tag_res_size;
-	uint8_t  supp_sec_rt_types;
-	uint16_t supp_mem_types;
+	uint8_t   desc_len;
+	uint8_t   desc_type;
+	uint8_t   media_technology;
+	uint8_t   resv1;
+	uint64_t  total_raw_device_capacity;
+	uint8_t   resv2;
+	uint32_t  segment_size;
+	uint8_t   allocation_unit_size;
+	uint8_t   min_addr_block_size;
+	uint8_t   optimal_read_block_size;
+	uint8_t   optimal_write_block_size;
+	uint8_t   max_in_buffer_size;
+	uint8_t   max_out_buffer_zie;
+	uint8_t   rpmb_read_write_size;
+	uint8_t   resv3;
+	uint8_t   data_ordering;
+	uint8_t   max_context_id_number;
+	uint8_t   sys_data_tag_unit_size;
+	uint8_t   sys_data_tag_res_size;
+	uint8_t   supported_sec_r_types;
+	uint16_t  supported_memory_types;
+	uint32_t  system_code_max_n_alloc_u;
+	uint16_t  system_code_cap_adj_fac;
+	uint32_t  non_persist_max_n_alloc_u;
+	uint16_t  non_persist_cap_adj_fac;
+	uint32_t  enhanced_1_max_n_alloc_u;
+	uint16_t  enhanced_1_cap_adj_fac;
+	uint32_t  enhanced_2_max_n_alloc_u;
+	uint16_t  enhanced_2_cap_adj_fac;
+	uint32_t  enhanced_3_max_n_alloc_u;
+	uint16_t  enhanced_3_cap_adj_fac;
+	uint32_t  enhanced_4_max_n_alloc_u;
+	uint16_t  enhanced_4_cap_adj_fac;
 }__PACKED;
 
 struct ufs_dev_desc_config_params
@@ -225,4 +236,9 @@
 int dme_set_fpoweronwpen(struct ufs_dev *dev);
 int dme_read_unit_desc(struct ufs_dev *dev, uint8_t index);
 
+/* Geometry Descriptor contains RPMB read write size which indicates total
+   number of rpmb frames allowed in a single SCSI security command
+*/
+int dme_read_geometry_desc(struct ufs_dev *dev);
+
 #endif
diff --git a/platform/msm_shared/include/gpio.h b/platform/msm_shared/include/gpio.h
index 3606641..b7305b4 100644
--- a/platform/msm_shared/include/gpio.h
+++ b/platform/msm_shared/include/gpio.h
@@ -50,7 +50,7 @@
 	TLMM_NO_PULL = 0x0,
 } tlmm_pull_values;
 
-/* Bit offsets in the TLMM register */
+/* SDC Bit offsets in the TLMM register */
 enum {
 	SDC1_DATA_HDRV_CTL_OFF = 0,
 	SDC1_CMD_HDRV_CTL_OFF  = 3,
@@ -59,7 +59,25 @@
 	SDC1_CMD_PULL_CTL_OFF  = 11,
 	SDC1_CLK_PULL_CTL_OFF  = 13,
 	SDC1_RCLK_PULL_CTL_OFF = 15,
-} tlmm_drv_ctrl;
+} tlmm_sdc_drv_ctrl;
+
+/* EBI2 Bit offsets in the TLMM register */
+enum {
+	EBI2_BUSY_HDRV_CTL_OFF = 29,
+	EBI2_WE_HDRV_CTL_OFF   = 24,
+	EBI2_OE_HDRV_CTL_OFF   = 9,
+	EBI2_CLE_HDRV_CTL_OFF  = 19,
+	EBI2_ALE_HDRV_CTL_OFF  = 14,
+	EBI2_CS_HDRV_CTL_OFF   = 4,
+	EBI2_DATA_HDRV_CTL_OFF = 17,
+	EBI2_BUSY_PULL_CTL_OFF = 27,
+	EBI2_WE_PULL_CTL_OFF   = 22,
+	EBI2_OE_PULL_CTL_OFF   = 7 ,
+	EBI2_CLE_PULL_CTL_OFF  = 17,
+	EBI2_ALE_PULL_CTL_OFF  = 12,
+	EBI2_CS_PULL_CTL_OFF   = 2,
+	EBI2_DATA_PULL_CTL_OFF = 15,
+} tlmm_ebi2_drv_ctrl;
 
 /* Input for the tlmm config function */
 struct tlmm_cfgs {
diff --git a/platform/msm_shared/include/mipi_dsi.h b/platform/msm_shared/include/mipi_dsi.h
index 84d5b44..9e73092 100644
--- a/platform/msm_shared/include/mipi_dsi.h
+++ b/platform/msm_shared/include/mipi_dsi.h
@@ -92,6 +92,7 @@
 #define TIMING_FLUSH		     0x1E4
 #define TIMING_DB_MODE		     0x1E8
 
+#define DSI_HW_REV_103			0x10030000	/* 8994 */
 #define DSI_HW_REV_103_1		0x10030001	/* 8936/8939 */
 
 #define DTYPE_GEN_WRITE2 0x23	/* 4th Byte is 0x80 */
diff --git a/platform/msm_shared/include/mmc_sdhci.h b/platform/msm_shared/include/mmc_sdhci.h
index 0098c0e..5f5ba72 100644
--- a/platform/msm_shared/include/mmc_sdhci.h
+++ b/platform/msm_shared/include/mmc_sdhci.h
@@ -86,6 +86,7 @@
 
 /* EXT_CSD */
 /* Offsets in the ext csd */
+#define MMC_EXT_CSD_RST_N_FUNC                    162
 #define MMC_EXT_MMC_BUS_WIDTH                     183
 #define MMC_EXT_MMC_HS_TIMING                     185
 #define MMC_DEVICE_TYPE                           196
@@ -114,6 +115,7 @@
 #define MMC_SEC_COUNT3_SHIFT                      16
 #define MMC_SEC_COUNT2_SHIFT                      8
 #define MMC_HC_ERASE_MULT                         (512 * 1024)
+#define RST_N_FUNC_ENABLE                         BIT(0)
 
 /* Command related */
 #define MMC_MAX_COMMAND_RETRY                     1000
diff --git a/platform/msm_shared/include/mmc_wrapper.h b/platform/msm_shared/include/mmc_wrapper.h
index 57f74a0..f52a117 100644
--- a/platform/msm_shared/include/mmc_wrapper.h
+++ b/platform/msm_shared/include/mmc_wrapper.h
@@ -48,4 +48,5 @@
 void mmc_set_lun(uint8_t lun);
 uint8_t mmc_get_lun(void);
 void  mmc_read_partition_table(uint8_t arg);
+uint32_t mmc_write_protect(const char *name, int set_clr);
 #endif
diff --git a/platform/msm_shared/include/msm_panel.h b/platform/msm_shared/include/msm_panel.h
index 6944f09..0592833 100755
--- a/platform/msm_shared/include/msm_panel.h
+++ b/platform/msm_shared/include/msm_panel.h
@@ -50,6 +50,7 @@
 #define WRITEBACK_PANEL		10	/* Wifi display */
 #define LVDS_PANEL		11	/* LVDS */
 #define EDP_PANEL		12	/* EDP */
+#define QPIC_PANEL		13	/* QPIC */
 
 enum mdss_mdp_pipe_type {
 	MDSS_MDP_PIPE_TYPE_VIG,
diff --git a/platform/msm_shared/include/partition_parser.h b/platform/msm_shared/include/partition_parser.h
index a2d3edd..af69e03 100644
--- a/platform/msm_shared/include/partition_parser.h
+++ b/platform/msm_shared/include/partition_parser.h
@@ -73,6 +73,7 @@
 #define PARTITION_TYPE_GUID_SIZE   16
 #define UNIQUE_PARTITION_GUID_SIZE 16
 #define NUM_PARTITIONS             128
+#define PART_ATT_READONLY_OFFSET   60
 
 /* Some useful define used to access the MBR/EBR table */
 #define BLOCK_SIZE                0x200
@@ -179,5 +180,6 @@
 
 /* For Debugging */
 void partition_dump(void);
-
+/* Read only attribute for partition */
+int partition_read_only(int index);
 #endif
diff --git a/platform/msm_shared/include/qpic.h b/platform/msm_shared/include/qpic.h
new file mode 100644
index 0000000..237923c
--- /dev/null
+++ b/platform/msm_shared/include/qpic.h
@@ -0,0 +1,100 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef MDSS_QPIC_H
+#define MDSS_QPIC_H
+
+#include "qpic_panel.h"
+
+#define QPIC_REG_QPIC_LCDC_CTRL				0x22000
+#define QPIC_REG_LCDC_VERSION				0x22004
+#define QPIC_REG_QPIC_LCDC_IRQ_EN			0x22008
+#define QPIC_REG_QPIC_LCDC_IRQ_STTS			0x2200C
+#define QPIC_REG_QPIC_LCDC_IRQ_CLR			0x22010
+#define QPIC_REG_QPIC_LCDC_STTS				0x22014
+#define QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT	0x22018
+#define QPIC_REG_QPIC_LCDC_CFG0				0x22020
+#define QPIC_REG_QPIC_LCDC_CFG1				0x22024
+#define QPIC_REG_QPIC_LCDC_CFG2				0x22028
+#define QPIC_REG_QPIC_LCDC_RESET			0x2202C
+#define QPIC_REG_QPIC_LCDC_FIFO_SOF			0x22100
+#define QPIC_REG_LCD_DEVICE_CMD0			0x23000
+#define QPIC_REG_QPIC_LCDC_FIFO_DATA_PORT0	0x22140
+#define QPIC_REG_QPIC_LCDC_FIFO_EOF			0x22180
+
+#define QPIC_OUTP(off, data) \
+	writel((data), qpic_res->qpic_base + (off))
+#define QPIC_OUTPW(off, data) \
+	writehw((data), qpic_res->qpic_base + (off))
+#define QPIC_INP(off) \
+	readl(qpic_res->qpic_base + (off))
+
+#define QPIC_MAX_VSYNC_WAIT_TIME			500
+#define QPIC_MAX_WAIT_CNT			1000
+#define QPIC_MAX_CMD_BUF_SIZE				512
+
+int mdss_qpic_init(void);
+int qpic_send_pkt(uint32_t cmd, uint8_t *param, uint32_t len);
+uint32_t qpic_read_data(uint32_t cmd_index, uint32_t size);
+int mdss_qpic_panel_on(struct qpic_panel_io_desc *panel_io);
+int mdss_qpic_panel_off(struct qpic_panel_io_desc *panel_io);
+
+struct qpic_data_type {
+	uint32_t rev;
+	size_t qpic_reg_size;
+	uint32_t qpic_phys;
+	uint32_t qpic_base;
+	uint32_t irq;
+	uint32_t irq_ena;
+	uint32_t res_init;
+	void *fb_virt;
+	uint32_t fb_phys;
+	void *cmd_buf_virt;
+	uint32_t cmd_buf_phys;
+	int qpic_endpt;
+	uint32_t sps_init;
+	uint32_t irq_requested;
+	struct qpic_panel_io_desc panel_io;
+	uint32_t bus_handle;
+	int fifo_eof_comp;
+	int fb_xres;
+	int fb_yres;
+	int fb_bpp;
+	int base;
+};
+
+uint32_t qpic_send_frame(
+		uint32_t x_start,
+		uint32_t y_start,
+		uint32_t x_end,
+		uint32_t y_end,
+		uint32_t *data,
+		uint32_t total_bytes);
+
+#endif /* MDSS_QPIC_H */
diff --git a/platform/msm_shared/include/qpic_panel.h b/platform/msm_shared/include/qpic_panel.h
new file mode 100644
index 0000000..af6230e
--- /dev/null
+++ b/platform/msm_shared/include/qpic_panel.h
@@ -0,0 +1,132 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef MDSS_QPIC_PANEL_H
+#define MDSS_QPIC_PANEL_H
+
+#define LCDC_INTERNAL_BUFFER_SIZE   30
+
+/* Macros for coding MIPI commands */
+#define INV_SIZE             0xFFFF
+/* Size of argument to MIPI command is variable */
+#define OP_SIZE_PAIR(op, size)    ((op << 16) | size)
+/* MIPI {command, argument size} tuple */
+#define LCDC_EXTRACT_OP_SIZE(op_identifier)     ((op_identifier & 0xFFFF))
+/* extract size from command identifier */
+#define LCDC_EXTRACT_OP_CMD(op_identifier)  (((op_identifier >> 16) & 0xFFFF))
+/* extract command id from command identifier */
+
+/* MIPI standard efinitions */
+#define LCDC_ADDRESS_MODE_ORDER_BOTTOM_TO_TOP                0x80
+#define LCDC_ADDRESS_MODE_ORDER_RIGHT_TO_LEFT                0x40
+#define LCDC_ADDRESS_MODE_ORDER_REVERSE                      0x20
+#define LCDC_ADDRESS_MODE_ORDER_REFRESH_BOTTOM_TO_TOP        0x10
+#define LCDC_ADDRESS_MODE_ORDER_BGER_RGB                     0x08
+#define LCDC_ADDRESS_MODE_ORDER_REFERESH_RIGHT_TO_LEFT       0x04
+#define LCDC_ADDRESS_MODE_FLIP_HORIZONTAL                    0x02
+#define LCDC_ADDRESS_MODE_FLIP_VERTICAL                      0x01
+
+#define LCDC_PIXEL_FORMAT_3_BITS_PER_PIXEL    0x1
+#define LCDC_PIXEL_FORMAT_8_BITS_PER_PIXEL    0x2
+#define LCDC_PIXEL_FORMAT_12_BITS_PER_PIXEL   0x3
+#define LCDC_PIXEL_FORMAT_16_BITS_PER_PIXEL   0x5
+#define LCDC_PIXEL_FORMAT_18_BITS_PER_PIXEL   0x6
+#define LCDC_PIXEL_FORMAT_24_BITS_PER_PIXEL   0x7
+
+#define LCDC_CREATE_PIXEL_FORMAT(dpi_format, dbi_format) \
+	(dpi_format | (dpi_format << 4))
+
+#define POWER_MODE_IDLE_ON       0x40
+#define POWER_MODE_PARTIAL_ON    0x20
+#define POWER_MODE_SLEEP_ON      0x10
+#define POWER_MODE_NORMAL_ON     0x08
+#define POWER_MODE_DISPLAY_ON    0x04
+
+#define LCDC_DISPLAY_MODE_SCROLLING_ON       0x80
+#define LCDC_DISPLAY_MODE_INVERSION_ON       0x20
+#define LCDC_DISPLAY_MODE_GAMMA_MASK         0x07
+
+/* LDCc MIPI Type B supported commands */
+#define	OP_ENTER_IDLE_MODE      0x39
+#define	OP_ENTER_INVERT_MODE    0x21
+#define	OP_ENTER_NORMAL_MODE    0x13
+#define	OP_ENTER_PARTIAL_MODE   0x12
+#define	OP_ENTER_SLEEP_MODE     0x10
+#define	OP_EXIT_INVERT_MODE     0x20
+#define	OP_EXIT_SLEEP_MODE      0x11
+#define	OP_EXIT_IDLE_MODE       0x38
+#define	OP_GET_ADDRESS_MODE     0x0B /* size 1 */
+#define	OP_GET_BLUE_CHANNEL     0x08 /* size 1 */
+#define	OP_GET_DIAGNOSTIC       0x0F /* size 2 */
+#define	OP_GET_DISPLAY_MODE     0x0D /* size 1 */
+#define	OP_GET_GREEN_CHANNEL    0x07 /* size 1 */
+#define	OP_GET_PIXEL_FORMAT     0x0C /* size 1 */
+#define	OP_GET_POWER_MODE       0x0A /* size 1 */
+#define	OP_GET_RED_CHANNEL      0x06 /* size 1 */
+#define	OP_GET_SCANLINE         0x45 /* size 1 */
+#define	OP_GET_SIGNAL_MODE      0x0E /* size 1 */
+#define	OP_NOP                  0x00
+#define	OP_READ_DDB_CONTINUE    0xA8 /* size not fixed */
+#define	OP_READ_DDB_START       0xA1 /* size not fixed */
+#define	OP_READ_MEMORY_CONTINUE 0x3E /* size not fixed */
+#define	OP_READ_MEMORY_START    0x2E /* size not fixed */
+#define	OP_SET_ADDRESS_MODE     0x36 /* size 1 */
+#define	OP_SET_COLUMN_ADDRESS   0x2A /* size 4 */
+#define	OP_SET_DISPLAY_OFF      0x28
+#define	OP_SET_DISPLAY_ON       0x29
+#define	OP_SET_GAMMA_CURVE      0x26 /* size 1 */
+#define	OP_SET_PAGE_ADDRESS     0x2B /* size 4 */
+#define	OP_SET_PARTIAL_COLUMNS  0x31 /* size 4 */
+#define	OP_SET_PARTIAL_ROWS     0x30 /* size 4 */
+#define	OP_SET_PIXEL_FORMAT     0x3A /* size 1 */
+#define	OP_SOFT_RESET           0x01
+#define	OP_WRITE_MEMORY_CONTINUE  0x3C /* size not fixed */
+#define	OP_WRITE_MEMORY_START   0x2C /* size not fixed */
+
+/* ILI9341 commands */
+#define OP_ILI9341_INTERFACE_CONTROL	0xf6
+#define OP_ILI9341_TEARING_EFFECT_LINE_ON	0x35
+
+struct qpic_panel_io_desc {
+	int rst_gpio;
+	int cs_gpio;
+	int ad8_gpio;
+	int te_gpio;
+	int bl_gpio;
+	int vdd_vreg;
+	int avdd_vreg;
+	uint32_t init;
+};
+
+int mdss_qpic_panel_io_init(struct qpic_panel_io_desc *qpic_panel_io);
+uint32_t qpic_panel_get_cmd(uint32_t command, uint32_t size);
+int ili9341_on(struct qpic_panel_io_desc *qpic_panel_io);
+void ili9341_off(struct qpic_panel_io_desc *qpic_panel_io);
+
+#endif /* MDSS_QPIC_PANEL_H */
diff --git a/platform/msm_shared/include/regulator.h b/platform/msm_shared/include/regulator.h
index 4e6c932..2915a16 100644
--- a/platform/msm_shared/include/regulator.h
+++ b/platform/msm_shared/include/regulator.h
@@ -30,6 +30,12 @@
 #ifndef __REGULATOR_H
 #define __REGULATOR_H
 
+#define GENERIC_DISABLE 0
+#define GENERIC_ENABLE  1
+#define SW_MODE_LDO_IPEAK 1
+#define LDOA_RES_TYPE 0x616F646C //aodl
+#define SMPS_RES_TYPE 0x61706D73 //apms
+
 #define KEY_SOFTWARE_ENABLE                0x6E657773 // swen - software enable
 #define KEY_LDO_SOFTWARE_MODE              0X646D736C // lsmd - LDO software mode
 #define KEY_SMPS_SOFTWARE_MODE             0X646D7373 // ssmd - SMPS software mode
@@ -45,6 +51,11 @@
 #define KEY_BYPASS_ALLOWED_KEY             0x61707962 //bypa - bypass allowed
 #define KEY_CORNER_LEVEL_KEY               0x6E726F63 // corn - coner voltage
 #define KEY_ACTIVE_FLOOR                   0x636676
+#define GENERIC_DISABLE 0
+#define GENERIC_ENABLE  1
+#define SW_MODE_LDO_IPEAK 1
+#define LDOA_RES_TYPE 0x616F646C //aodl
+#define SMPS_RES_TYPE 0x61706D73 //apms
 
 void regulator_enable();
 void regulator_disable();
diff --git a/platform/msm_shared/include/rpmb.h b/platform/msm_shared/include/rpmb.h
new file mode 100644
index 0000000..8bbd985
--- /dev/null
+++ b/platform/msm_shared/include/rpmb.h
@@ -0,0 +1,70 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* RPMB request and response types */
+enum rpmb_rr_type {
+	KEY_PROVISION = 0x1,
+	READ_WRITE_COUNTER,
+	AUTH_WRITE,
+	AUTH_READ,
+	READ_RESULT_FLAG,
+};
+
+/* List of all return codes for rpmb frame verification from response */
+enum rpmb_verify_return_codes
+{
+	NONCE_MISMATCH = 0x100,
+};
+
+/* These are error codes returned for RPMB operations */
+enum rpmb_verify_error_codes
+{
+	OPERATION_OK = 0,
+	GENERAL_FAILURE,
+	AUTH_FAILURE,
+	COUNTER_FAILURE,
+	ADDRESS_FAILURE,
+	WRITE_FAILURE,
+	READ_FAILURE,
+	KEY_NOT_PROG,
+	MAXED_WR_COUNTER = 0x80,
+};
+
+/* RPMB Frame */
+struct rpmb_frame
+{
+	uint8_t  stuff_bytes[196];
+	uint8_t  keyMAC[32];
+	uint8_t  data[256];
+	uint8_t  nonce[16];
+	uint32_t writecounter;
+	uint16_t address;
+	uint16_t blockcount;
+	uint8_t  result[2];
+	uint16_t requestresponse;
+};
diff --git a/platform/msm_shared/include/splash.h b/platform/msm_shared/include/splash.h
index d908cf6..2afa254 100644
--- a/platform/msm_shared/include/splash.h
+++ b/platform/msm_shared/include/splash.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010,2014, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,10 +30,12 @@
 #ifndef __PLATFORM_SPLASH_H
 #define __PLATFORM_SPLASH_H
 
-#define SPLASH_IMAGE_WIDTH     124
-#define SPLASH_IMAGE_HEIGHT    113
+#define SPLASH_IMAGE_WIDTH     113
+#define SPLASH_IMAGE_HEIGHT    124
 
 #if (!DISPLAY_TYPE_MIPI)
+#define SPLASH_IMAGE_WIDTH     124
+#define SPLASH_IMAGE_HEIGHT    113
 /* This image is (SPLASH_IMAGE_WIDTH x SPLASH_IMAGE_WIDTH) raw image */
 static char imageBuffer[] = {
 
diff --git a/platform/msm_shared/include/ucs.h b/platform/msm_shared/include/ucs.h
index e4d366e..58fb188 100644
--- a/platform/msm_shared/include/ucs.h
+++ b/platform/msm_shared/include/ucs.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -40,6 +40,12 @@
 #define SCSI_SENSE_BUF_LEN             0x20
 #define SCSI_INQUIRY_LEN               36
 #define SCSI_CDB_PARAM_LEN             16
+#define SCSI_SEC_PROT                  0xEC
+#define SCSI_SEC_UFS_PROT_ID           0x0001
+
+#define RPMB_BLK_SIZE                  512
+#define RPMB_FRAME_SIZE                512
+#define RPMB_MIN_BLK_CNT               1
 
 /* FLAGS for indication of read or write */
 enum scsi_upiu_flags
@@ -87,6 +93,18 @@
 	uint32_t data_buffer_base;
 };
 
+struct scsi_sec_protocol_cdb
+{
+	uint8_t  opcode;
+	uint8_t  cdb1;
+	uint16_t sec_protocol_specific;
+	uint8_t  resv1;
+	uint8_t  resv2;
+	uint32_t alloc_tlen;
+	uint8_t  resv3;
+	uint8_t  control;
+}__PACKED;
+
 struct scsi_rdwr_cdb
 {
 	uint8_t  opcode;
@@ -148,4 +166,13 @@
 int ucs_do_scsi_read(struct ufs_dev *dev, struct scsi_rdwr_req *req);
 int ucs_do_scsi_write(struct ufs_dev *dev, struct scsi_rdwr_req *req);
 
+/*
+ * ucs_do_sci_rpmb_read function takes a RPMB frame, sector address and number of
+ * blocks to be read from RPMB partition as input and returns one or more RPMB
+ * frames as response along with total length of the reponse. The response is then
+ * processed by upper layers.
+ */
+int ucs_do_scsi_rpmb_read(struct ufs_dev *dev, uint32_t *req_buf, uint32_t blk_cnt,
+                                 uint32_t *resp_buffer, uint32_t *response_length);
+
 #endif
diff --git a/platform/msm_shared/include/ufs.h b/platform/msm_shared/include/ufs.h
index b5c76fc..c28c949 100644
--- a/platform/msm_shared/include/ufs.h
+++ b/platform/msm_shared/include/ufs.h
@@ -95,6 +95,8 @@
 	uint32_t                     serial_num;
 	uint32_t                     block_size;
 	uint32_t                     erase_blk_size;
+	uint32_t                     rpmb_rw_size;
+	uint32_t                     rpmb_num_blocks;
 	uint64_t                     capacity;
 	struct ufs_unit_desc         lun_cfg[8];
 
diff --git a/platform/msm_shared/mipi_dsi_phy.c b/platform/msm_shared/mipi_dsi_phy.c
index cd2d217..9fd69a4 100644
--- a/platform/msm_shared/mipi_dsi_phy.c
+++ b/platform/msm_shared/mipi_dsi_phy.c
@@ -214,29 +214,58 @@
 	udelay(100);
 }
 
-int mdss_dsi_phy_regulator_init(struct mdss_dsi_phy_ctrl *pd)
+int mdss_dsi_phy_regulator_init(struct mdss_dsi_phy_ctrl *pd, uint32_t phy_base)
 {
 	/* DSI0 and DSI1 have a common regulator */
 
 	uint32_t off = 0x0280;	/* phy regulator ctrl settings */
 
-	/* Regulator ctrl 0 */
-	writel(0x00, DSI0_PHY_BASE + off + (4 * 0));
-	/* Regulator ctrl - CAL_PWD_CFG */
-	writel(pd->regulator[6], DSI0_PHY_BASE + off + (4 * 6));
-	/* Regulator ctrl - TEST */
-	writel(pd->regulator[5], DSI0_PHY_BASE + off + (4 * 5));
-	/* Regulator ctrl 3 */
-	writel(pd->regulator[3], DSI0_PHY_BASE + off + (4 * 3));
-	/* Regulator ctrl 2 */
-	writel(pd->regulator[2], DSI0_PHY_BASE + off + (4 * 2));
-	/* Regulator ctrl 1 */
-	writel(pd->regulator[1], DSI0_PHY_BASE + off + (4 * 1));
-	/* Regulator ctrl 0 */
-	writel(pd->regulator[0], DSI0_PHY_BASE + off + (4 * 0));
-	/* Regulator ctrl 4 */
-	writel(pd->regulator[4], DSI0_PHY_BASE + off + (4 * 4));
-	dmb();
+	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE) {
+		/* Regulator ctrl 0 */
+		writel(0x00, DSI0_PHY_BASE + off + (4 * 0));
+		/* Regulator ctrl - CAL_PWD_CFG */
+		writel(pd->regulator[6], DSI0_PHY_BASE + off + (4 * 6));
+		/* Add h/w recommended delay */
+		udelay(1000);
+		/* Regulator ctrl - TEST */
+		writel(pd->regulator[5], DSI0_PHY_BASE + off + (4 * 5));
+		/* Regulator ctrl 3 */
+		writel(pd->regulator[3], DSI0_PHY_BASE + off + (4 * 3));
+		/* Regulator ctrl 2 */
+		writel(pd->regulator[2], DSI0_PHY_BASE + off + (4 * 2));
+		/* Regulator ctrl 1 */
+		writel(pd->regulator[1], DSI0_PHY_BASE + off + (4 * 1));
+		/* Regulator ctrl 4 */
+		writel(pd->regulator[4], DSI0_PHY_BASE + off + (4 * 4));
+		/* LDO ctrl */
+		if (readl(MIPI_DSI0_BASE) == DSI_HW_REV_103_1) /* 8916/8939 */
+			writel(0x05, phy_base + 0x01dc);
+		else if (readl(MIPI_DSI0_BASE) == DSI_HW_REV_103) /* 8994 */
+			writel(0x1d, phy_base + 0x01dc);
+		else
+			writel(0x0d, phy_base + 0x01dc);
+		dmb();
+	} else {
+		/* Regulator ctrl 0 */
+		writel(0x00, DSI0_PHY_BASE + off + (4 * 0));
+		/* Regulator ctrl - CAL_PWD_CFG */
+		writel(pd->regulator[6], DSI0_PHY_BASE + off + (4 * 6));
+		/* Add h/w recommended delay */
+		udelay(1000);
+		/* Regulator ctrl 1 */
+		writel(pd->regulator[1], DSI0_PHY_BASE + off + (4 * 1));
+		/* Regulator ctrl 2 */
+		writel(pd->regulator[2], DSI0_PHY_BASE + off + (4 * 2));
+		/* Regulator ctrl 3 */
+		writel(pd->regulator[3], DSI0_PHY_BASE + off + (4 * 3));
+		/* Regulator ctrl 4 */
+		writel(pd->regulator[4], DSI0_PHY_BASE + off + (4 * 4));
+		/* LDO ctrl */
+		writel(0x00, phy_base + 0x01dc);
+		/* Regulator ctrl 0 */
+		writel(pd->regulator[0], DSI0_PHY_BASE + off + (4 * 0));
+		dmb();
+	}
 }
 
 int mdss_dsi_v2_phy_init(struct mipi_dsi_panel_config *pinfo, uint32_t ctl_base)
@@ -305,15 +334,7 @@
 	/* Strength ctrl 0 */
 	writel(pd->strength[0], phy_base + 0x0184);
 
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		pd->regulator[0] = 0x2; /* LDO mode */
-	mdss_dsi_phy_regulator_init(pd);
-
-	/* DSIPHY_REGULATOR_CTRL_0 */
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		writel(0x25, phy_base + 0x01dc); /* LDO mode */
-	else
-		writel(0x00, phy_base + 0x01dc); /* DCDC mode */
+	mdss_dsi_phy_regulator_init(pd, phy_base);
 
 	off = 0x0140;	/* phy timing ctrl 0 - 11 */
 	for (i = 0; i < 12; i++) {
@@ -388,14 +409,7 @@
 	/* Strength ctrl 0 */
 	writel(pd->strength[0], phy_base + MMSS_DSI_PHY_STRENGTH_CTRL_0);
 
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		pd->regulator[0] = 0x2; /* LDO mode */
-	mdss_dsi_phy_regulator_init(pd);
-
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		writel(0x25, phy_base + MMSS_DSI_PHY_LDO_CTRL); /* LDO mode */
-	else
-		writel(0x00, phy_base + MMSS_DSI_PHY_LDO_CTRL); /* DCDC mode */
+	mdss_dsi_phy_regulator_init(pd, phy_base);
 
 	off = MMSS_DSI_PHY_TIMING_CTRL_0;
 	for (i = 0; i < TOTAL_TIMING_CTRL_CONFIG; i++, off += 4) {
diff --git a/platform/msm_shared/mmc_sdhci.c b/platform/msm_shared/mmc_sdhci.c
index 411f22c..76145eb 100644
--- a/platform/msm_shared/mmc_sdhci.c
+++ b/platform/msm_shared/mmc_sdhci.c
@@ -1665,6 +1665,18 @@
 
 	card->block_size = MMC_BLK_SZ;
 
+	/* Enable RST_n_FUNCTION */
+	if (!card->ext_csd[MMC_EXT_CSD_RST_N_FUNC])
+	{
+		mmc_return = mmc_switch_cmd(host, card, MMC_SET_BIT, MMC_EXT_CSD_RST_N_FUNC, RST_N_FUNC_ENABLE);
+
+		if (mmc_return)
+		{
+			dprintf(CRITICAL, "Failed to enable RST_n_FUNCTION\n");
+			return mmc_return;
+		}
+	}
+
 	return mmc_return;
 }
 
diff --git a/platform/msm_shared/mmc_wrapper.c b/platform/msm_shared/mmc_wrapper.c
index c660a5f..12bcd4d 100755
--- a/platform/msm_shared/mmc_wrapper.c
+++ b/platform/msm_shared/mmc_wrapper.c
@@ -34,6 +34,7 @@
 #include <ufs.h>
 #include <target.h>
 #include <string.h>
+#include <partition_parser.h>
 
 /*
  * Weak function for UFS.
@@ -586,3 +587,56 @@
 		}
 	}
 }
+
+uint32_t mmc_write_protect(const char *ptn_name, int set_clr)
+{
+	void *dev = NULL;
+	struct mmc_card *card = NULL;
+	uint32_t block_size;
+	unsigned long long  ptn = 0;
+	uint64_t size;
+	int index = -1;
+	int ret = 0;
+
+	dev = target_mmc_device();
+	block_size = mmc_get_device_blocksize();
+
+	if (platform_boot_dev_isemmc())
+	{
+		card = &((struct mmc_device *)dev)->card;
+
+		index = partition_get_index(ptn_name);
+
+		ptn = partition_get_offset(index);
+		if(!ptn)
+		{
+			return 1;
+		}
+
+		size = partition_get_size(index);
+
+		/*
+		 * For read only partitions the minimum size allocated on the disk is
+		 * 1 WP GRP size. If the size of partition is less than 1 WP GRP size
+		 * protect atleast one WP group.
+		 */
+		if (partition_read_only(index) && size < card->wp_grp_size)
+		{
+			size = card->wp_grp_size * block_size;
+		}
+		/* Set the power on WP bit */
+		return mmc_set_clr_power_on_wp_user((struct mmc_device *)dev, (ptn / block_size), size, set_clr);
+	}
+	else
+	{
+		/* Enable the power on WP fo all LUNs which have WP bit is enabled */
+		ret = dme_set_fpoweronwpen((struct ufs_dev*) dev);
+		if (ret < 0)
+		{
+			dprintf(CRITICAL, "Failure to WP UFS partition\n");
+			return 1;
+		}
+	}
+
+	return 0;
+}
diff --git a/platform/msm_shared/partition_parser.c b/platform/msm_shared/partition_parser.c
index d8774b9..d40fb8a 100644
--- a/platform/msm_shared/partition_parser.c
+++ b/platform/msm_shared/partition_parser.c
@@ -1057,3 +1057,8 @@
 {
 	return (gpt_partitions_exist != 0);
 }
+
+int partition_read_only(int index)
+{
+	 return partition_entries[index].attribute_flag >> PART_ATT_READONLY_OFFSET;
+}
diff --git a/platform/msm_shared/qpic.c b/platform/msm_shared/qpic.c
new file mode 100644
index 0000000..8c9e47d
--- /dev/null
+++ b/platform/msm_shared/qpic.c
@@ -0,0 +1,327 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <err.h>
+#include <msm_panel.h>
+#include <platform/iomap.h>
+#include <reg.h>
+
+#include "qpic.h"
+#include "qpic_panel.h"
+
+int mdss_qpic_panel_init(struct qpic_panel_io_desc *panel_io);
+
+struct qpic_data_type qpic_data;
+struct qpic_data_type *qpic_res = &qpic_data;
+static int qpic_send_pkt_sw(uint32_t cmd, uint32_t len, uint8_t *param);
+
+/* for debugging */
+static uint32_t use_bam = false;
+static uint32_t use_irq = false;
+static uint32_t use_vsync;
+
+/* For compilation */
+void mdp_set_revision(int rev)
+{
+    return;
+}
+
+int qpic_on(void)
+{
+	int ret;
+	ret = mdss_qpic_panel_on(&qpic_res->panel_io);
+	return ret;
+}
+
+int qpic_off(void)
+{
+	int ret = NO_ERROR;
+
+	if (!target_cont_splash_screen()) {
+		ret = mdss_qpic_panel_off(&qpic_res->panel_io);
+	}
+
+	return ret;
+}
+
+void qpic_update()
+{
+	uint32_t fb_offset, size;
+
+	if (use_bam)
+		fb_offset = qpic_res->fb_phys + qpic_res->base;
+	else
+		fb_offset = qpic_res->fb_virt + qpic_res->base;
+
+	size = qpic_res->fb_xres * qpic_res->fb_yres * qpic_res->fb_bpp;
+
+	qpic_send_frame(0, 0, qpic_res->fb_xres - 1, qpic_res->fb_yres - 1,
+		(uint32_t *)fb_offset, size);
+}
+
+int mdss_qpic_alloc_fb_mem(struct msm_panel_info *pinfo, int base)
+{
+	qpic_res->fb_virt = 0;
+	qpic_res->fb_phys = 0;
+	qpic_res->fb_xres = pinfo->xres;
+	qpic_res->fb_yres = pinfo->yres;
+	qpic_res->fb_bpp = pinfo->bpp / 8;
+	qpic_res->base = base;
+
+	return 0;
+}
+
+void qpic_init(struct msm_panel_info *pinfo, int base)
+{
+	if (qpic_res->res_init)
+		return;
+
+	qpic_res->qpic_base = QPIC_BASE;
+	mdss_qpic_panel_init(&qpic_res->panel_io);
+	mdss_qpic_alloc_fb_mem(pinfo, base);
+	qpic_res->res_init = true;
+}
+
+int qpic_init_sps(void)
+{
+	return 0;
+}
+
+void mdss_qpic_reset(void)
+{
+	uint32_t cnt = 0;
+
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_RESET, 1 << 0);
+	/* wait 100 us after reset as suggested by hw */
+	udelay(100);
+	while (((QPIC_INP(QPIC_REG_QPIC_LCDC_STTS) & (1 << 8)) == 0)) {
+		if (cnt > QPIC_MAX_WAIT_CNT) {
+			dprintf(CRITICAL, "%s reset not finished\n", __func__);
+			break;
+		}
+		/* yield 100 us for next polling by experiment*/
+		udelay(100);
+		cnt++;
+	}
+}
+
+static int qpic_send_pkt_bam(uint32_t cmd, uint32_t len, uint8_t *param)
+{
+	return qpic_send_pkt_sw(cmd, len, param);
+}
+
+static void qpic_dump_reg(void)
+{
+	dprintf(INFO, "%s\n", __func__);
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CTRL = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CTRL));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CFG0 = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CFG0));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CFG1 = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CFG1));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CFG2 = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CFG2));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_IRQ_EN = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_IRQ_EN));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_IRQ_STTS = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_IRQ_STTS));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_STTS = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_STTS));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_FIFO_SOF = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_FIFO_SOF));
+}
+
+static int qpic_wait_for_fifo(void)
+{
+	uint32_t data, cnt = 0;
+	int ret = 0;
+
+	while (1) {
+		data = QPIC_INP(QPIC_REG_QPIC_LCDC_STTS);
+		data &= 0x3F;
+		if (data == 0)
+			break;
+		/* yield 10 us for next polling by experiment*/
+		udelay(10);
+		if (cnt > (QPIC_MAX_WAIT_CNT * 10)) {
+			dprintf(CRITICAL, "%s time out\n", __func__);
+			ret = -1;
+			break;
+		}
+		cnt++;
+	}
+	return ret;
+}
+
+static int qpic_wait_for_eof(void)
+{
+	uint32_t data, cnt = 0;
+	int ret = 0;
+
+	while (1) {
+		data = QPIC_INP(QPIC_REG_QPIC_LCDC_IRQ_STTS);
+		if (data & (1 << 2))
+			break;
+		/* yield 10 us for next polling by experiment*/
+		udelay(10);
+		if (cnt > (QPIC_MAX_WAIT_CNT * 10)) {
+			dprintf(CRITICAL, "%s wait for eof time out\n", __func__);
+			qpic_dump_reg();
+			ret = -1;
+			break;
+		}
+		cnt++;
+	}
+	return ret;
+}
+
+static int qpic_send_pkt_sw(uint32_t cmd, uint32_t len, uint8_t *param)
+{
+	uint32_t bytes_left, space, data, cfg2;
+	int i, ret = 0;
+
+	if (len && !param) {
+		dprintf(CRITICAL, "Null Pointer!\n");
+		return 0;
+	}
+	if (len <= 4) {
+		len = (len + 3) / 4; /* len in dwords */
+		data = 0;
+		for (i = 0; i < len; i++)
+			data |= (uint32_t)param[i] << (8 * i);
+		QPIC_OUTP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT, len);
+		QPIC_OUTP(QPIC_REG_LCD_DEVICE_CMD0 + (4 * cmd), data);
+		return 0;
+	}
+
+	if ((len & 0x1) != 0) {
+		dprintf(INFO, "%s: number of bytes needs be even\n", __func__);
+		len = (len + 1) & (~0x1);
+	}
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_IRQ_CLR, 0xff);
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT, 0);
+	cfg2 = QPIC_INP(QPIC_REG_QPIC_LCDC_CFG2);
+	if ((cmd != OP_WRITE_MEMORY_START) &&
+		(cmd != OP_WRITE_MEMORY_CONTINUE))
+		cfg2 |= (1 << 24); /* transparent mode */
+	else
+		cfg2 &= ~(1 << 24);
+
+	cfg2 &= ~0xFF;
+	cfg2 |= cmd;
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG2, cfg2);
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_FIFO_SOF, 0x0);
+	bytes_left = len;
+
+	while (bytes_left > 0) {
+		ret = qpic_wait_for_fifo();
+		if (ret)
+			goto exit_send_cmd_sw;
+
+		space = 16;
+
+		while ((space > 0) && (bytes_left > 0)) {
+			/* write to fifo */
+			if (bytes_left >= 4) {
+				QPIC_OUTP(QPIC_REG_QPIC_LCDC_FIFO_DATA_PORT0,
+					*(uint32_t *)param);
+				param += 4;
+				bytes_left -= 4;
+				space--;
+			} else if (bytes_left == 2) {
+				QPIC_OUTPW(QPIC_REG_QPIC_LCDC_FIFO_DATA_PORT0,
+					*(uint16_t *)param);
+				bytes_left -= 2;
+			}
+		}
+	}
+	/* finished */
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_FIFO_EOF, 0x0);
+	ret = qpic_wait_for_eof();
+exit_send_cmd_sw:
+	cfg2 &= ~(1 << 24);
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG2, cfg2);
+	return ret;
+}
+
+int qpic_send_pkt(uint32_t cmd, uint8_t *param, uint32_t len)
+{
+	if (!use_bam || ((cmd != OP_WRITE_MEMORY_CONTINUE) &&
+		(cmd != OP_WRITE_MEMORY_START)))
+		return qpic_send_pkt_sw(cmd, len, param);
+	else
+		return qpic_send_pkt_bam(cmd, len, param);
+}
+
+int mdss_qpic_init(void)
+{
+	int ret = 0;
+	uint32_t data;
+	mdss_qpic_reset();
+
+	data = QPIC_INP(QPIC_REG_QPIC_LCDC_CTRL);
+	/* clear vsync wait , bam mode = 0 */
+	data &= ~(3 << 0);
+	data &= ~(0x1f << 3);
+	data |= (1 << 3); /* threshold */
+	data |= (1 << 8); /* lcd_en */
+	data &= ~(0x1f << 9);
+	data |= (1 << 9); /* threshold */
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CTRL, data);
+
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG0, 0x02108501);
+	data = QPIC_INP(QPIC_REG_QPIC_LCDC_CFG2);
+	data &= ~(0xFFF);
+	data |= 0x0; /* 565 */
+	data |= 0x2C;
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG2, data);
+
+	/* TE enable */
+	if (use_vsync) {
+		data = QPIC_INP(QPIC_REG_QPIC_LCDC_CTRL);
+		data |= (1 << 0);
+		QPIC_OUTP(QPIC_REG_QPIC_LCDC_CTRL, data);
+	}
+
+	return ret;
+}
+
+uint32_t qpic_read_data(uint32_t cmd_index, uint32_t size)
+{
+	uint32_t data = 0;
+	if (size <= 4) {
+		QPIC_OUTP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT, size);
+		data = QPIC_INP(QPIC_REG_LCD_DEVICE_CMD0 + (cmd_index * 4));
+	}
+	return data;
+}
+
diff --git a/platform/msm_shared/qpic_panel.c b/platform/msm_shared/qpic_panel.c
new file mode 100644
index 0000000..71993a7
--- /dev/null
+++ b/platform/msm_shared/qpic_panel.c
@@ -0,0 +1,132 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <err.h>
+#include <msm_panel.h>
+#include <platform/gpio.h>
+#include "qpic.h"
+#include "qpic_panel.h"
+#include <reg.h>
+
+static uint32_t panel_is_on;
+
+static int (*qpic_panel_on)(struct qpic_panel_io_desc *qpic_panel_io);
+static void (*qpic_panel_off)(struct qpic_panel_io_desc *qpic_panel_io);
+
+
+/* write a frame of pixels to a MIPI screen */
+uint32_t qpic_send_frame(uint32_t x_start,
+				uint32_t y_start,
+				uint32_t x_end,
+				uint32_t y_end,
+				uint32_t *data,
+				uint32_t total_bytes)
+{
+	uint8_t param[4];
+	uint32_t status;
+	uint32_t start_0_7;
+	uint32_t end_0_7;
+	uint32_t start_8_15;
+	uint32_t end_8_15;
+
+	/* convert to 16 bit representation */
+	x_start = x_start & 0xffff;
+	y_start = y_start & 0xffff;
+	x_end = x_end & 0xffff;
+	y_end = y_end & 0xffff;
+
+	/* set column/page */
+	start_0_7 = x_start & 0xff;
+	end_0_7 = x_end & 0xff;
+	start_8_15 = (x_start >> 8) & 0xff;
+	end_8_15 = (x_end >> 8) & 0xff;
+	param[0] = start_8_15;
+	param[1] = start_0_7;
+	param[2] = end_8_15;
+	param[3] = end_0_7;
+	status = qpic_send_pkt(OP_SET_COLUMN_ADDRESS, param, 4);
+	if (status) {
+		dprintf(CRITICAL, "Failed to set column address\n");
+		return status;
+	}
+
+	start_0_7 = y_start & 0xff;
+	end_0_7 = y_end & 0xff;
+	start_8_15 = (y_start >> 8) & 0xff;
+	end_8_15 = (y_end >> 8) & 0xff;
+	param[0] = start_8_15;
+	param[1] = start_0_7;
+	param[2] = end_8_15;
+	param[3] = end_0_7;
+	status = qpic_send_pkt(OP_SET_PAGE_ADDRESS, param, 4);
+	if (status) {
+		dprintf(CRITICAL, "Failed to set page address\n");
+		return status;
+	}
+
+	status = qpic_send_pkt(OP_WRITE_MEMORY_START, (uint8_t *)data, total_bytes);
+	if (status) {
+		dprintf(CRITICAL, "Failed to start memory write\n");
+		return status;
+	}
+	return 0;
+}
+
+int mdss_qpic_panel_on(struct qpic_panel_io_desc *panel_io)
+{
+	int rc = 0;
+
+	if (panel_is_on)
+		return 0;
+	mdss_qpic_init();
+
+	if (qpic_panel_on)
+		rc = qpic_panel_on(panel_io);
+
+	if (!rc)
+		panel_is_on = true;
+
+	return rc;
+}
+
+int mdss_qpic_panel_off(struct qpic_panel_io_desc *panel_io)
+{
+	if (qpic_panel_off)
+		qpic_panel_off(panel_io);
+
+	panel_is_on = false;
+	return 0;
+}
+
+int mdss_qpic_panel_init(struct qpic_panel_io_desc *panel_io)
+{
+	return 0;
+}
+
diff --git a/platform/msm_shared/rules.mk b/platform/msm_shared/rules.mk
index 9d9196c..252601f 100755
--- a/platform/msm_shared/rules.mk
+++ b/platform/msm_shared/rules.mk
@@ -19,8 +19,7 @@
 ifeq ($(ENABLE_SMD_SUPPORT),1)
 OBJS += \
 	$(LOCAL_DIR)/rpm-smd.o \
-	$(LOCAL_DIR)/smd.o \
-	$(LOCAL_DIR)/regulator.o
+	$(LOCAL_DIR)/smd.o
 endif
 
 ifeq ($(ENABLE_SDHCI_SUPPORT),1)
@@ -323,6 +322,7 @@
 endif
 
 ifeq ($(PLATFORM),mdm9x35)
+DEFINES += DISPLAY_TYPE_QPIC=1
 	OBJS += $(LOCAL_DIR)/qgic.o \
 			$(LOCAL_DIR)/uart_dm.o \
 			$(LOCAL_DIR)/interrupts.o \
@@ -337,7 +337,10 @@
 			$(LOCAL_DIR)/clock.o \
 			$(LOCAL_DIR)/clock_pll.o \
 			$(LOCAL_DIR)/clock_lib2.o \
-			$(LOCAL_DIR)/qmp_usb30_phy.o
+			$(LOCAL_DIR)/qmp_usb30_phy.o \
+			$(LOCAL_DIR)/display.o \
+			$(LOCAL_DIR)/qpic.o \
+			$(LOCAL_DIR)/qpic_panel.o
 endif
 
 ifeq ($(PLATFORM),msmzirc)
diff --git a/platform/msm_shared/smd.c b/platform/msm_shared/smd.c
index dfb5b62..6d99088 100644
--- a/platform/msm_shared/smd.c
+++ b/platform/msm_shared/smd.c
@@ -153,10 +153,63 @@
 		return false;
 }
 
+/* Copy the local buffer to fifo buffer.
+ * Takes care of fifo overlap.
+ * Uses the fifo as circular buffer, if the request data
+ * exceeds the max size of the buffer start from the beginning.
+ */
+static void memcpy_to_fifo(smd_channel_info_t *ch_ptr, uint32_t *src, size_t len)
+{
+	uint32_t write_index = ch_ptr->port_info->ch0.write_index;
+	uint32_t *dest = (uint32_t *)(ch_ptr->send_buf + write_index);
+
+	while(len)
+	{
+		*dest++ = *src++;
+		write_index += 4;
+		len -= 4;
+
+		if (write_index >= ch_ptr->fifo_size)
+		{
+			write_index = 0;
+			dest = (uint32_t *)(ch_ptr->send_buf + write_index);
+		}
+	}
+	ch_ptr->port_info->ch0.write_index = write_index;
+}
+
+/* Copy the fifo buffer to a local destination.
+ * Takes care of fifo overlap.
+ * If the response data is split across with some part at
+ * end of fifo and some at the beginning of the fifo
+ */
+void memcpy_from_fifo(smd_channel_info_t *ch_ptr, uint32_t *dest, size_t len)
+{
+	uint32_t read_index = ch_ptr->port_info->ch1.read_index;
+	uint32_t *src = (uint32_t *)(ch_ptr->recv_buf + read_index);
+
+	while(len)
+	{
+		*dest++ = *src++;
+		read_index += 4;
+		len -= 4;
+
+		if (read_index >= ch_ptr->fifo_size)
+		{
+			read_index = 0;
+			src = (uint32_t *) (ch_ptr->recv_buf + read_index);
+		}
+	}
+
+	ch_ptr->port_info->ch1.read_index = read_index;
+}
+
 uint8_t* smd_read(smd_channel_info_t *ch, uint32_t *len, int ch_type)
 {
 	smd_pkt_hdr smd_hdr;
 	uint32_t size = 0;
+	/* Response as per the current design does not exceed 20 bytes */
+	uint32_t response[5];
 
 	/* Read the indices from smem */
 	ch->port_info = smem_get_alloc_entry(SMEM_SMD_BASE_ID + ch->alloc_entry.cid,
@@ -172,20 +225,12 @@
 	{
 		/* Get the update info from memory */
 		arch_invalidate_cache_range((addr_t) ch->port_info, size);
-
-		if ((ch->port_info->ch1.read_index + sizeof(smd_pkt_hdr)) >= ch->fifo_size)
-		{
-			dprintf(CRITICAL, "At %d:%s:RX channel read index [%u] is greater than RX fifo size[%u]\n",
-							   __LINE__,__func__, ch->port_info->ch1.read_index, ch->fifo_size);
-			return -1;
-		}
 	}
 
-
-	arch_invalidate_cache_range((addr_t)(ch->recv_buf + ch->port_info->ch1.read_index), sizeof(smd_hdr));
-
 	/* Copy the smd buffer to local buf */
-	memcpy(&smd_hdr, (void*)(ch->recv_buf + ch->port_info->ch1.read_index), sizeof(smd_hdr));
+	memcpy_from_fifo(ch, &smd_hdr, sizeof(smd_hdr));
+
+	arch_invalidate_cache_range((addr_t)&smd_hdr, sizeof(smd_hdr));
 
 	*len = smd_hdr.pkt_size;
 
@@ -194,23 +239,18 @@
 	{
 		/* Get the update info from memory */
 		arch_invalidate_cache_range((addr_t) ch->port_info, size);
-
-		if ((ch->port_info->ch1.read_index + sizeof(smd_hdr) + smd_hdr.pkt_size) >= ch->fifo_size)
-		{
-			dprintf(CRITICAL, "At %d:%s:RX channel read index [%u] is greater than RX fifo size[%u]\n",
-							   __LINE__,__func__, ch->port_info->ch1.read_index, ch->fifo_size);
-			return -1;
-		}
 	}
 
 	/* We are good to return the response now */
-	return (uint8_t*)(ch->recv_buf + ch->port_info->ch1.read_index + sizeof(smd_hdr));
+	memcpy_from_fifo(ch, response, sizeof(response));
+
+	arch_invalidate_cache_range((addr_t)response, sizeof(response));
+
+	return response;
 }
 
 void smd_signal_read_complete(smd_channel_info_t *ch, uint32_t len)
 {
-	ch->port_info->ch1.read_index += sizeof(smd_pkt_hdr) + len;
-
 	/* Clear the data_written flag */
 	ch->port_info->ch1.data_written = 0;
 
@@ -258,14 +298,9 @@
 	/*copy the local buf to smd buf */
 	smd_hdr.pkt_size = len;
 
-	memcpy(ch->send_buf + ch->port_info->ch0.write_index, &smd_hdr, sizeof(smd_hdr));
+	memcpy_to_fifo(ch, (uint32_t *)&smd_hdr, sizeof(smd_hdr));
 
-	memcpy(ch->send_buf + ch->port_info->ch0.write_index + sizeof(smd_hdr), data, len);
-
-	arch_invalidate_cache_range((addr_t)ch->send_buf+ch->port_info->ch0.write_index, sizeof(smd_hdr) + len);
-
-	/* Update write index */
-	ch->port_info->ch0.write_index += sizeof(smd_hdr) + len;
+	memcpy_to_fifo(ch, data, len);
 
 	dsb();
 
diff --git a/platform/msm_shared/smem.c b/platform/msm_shared/smem.c
index 948a256..25628d3 100644
--- a/platform/msm_shared/smem.c
+++ b/platform/msm_shared/smem.c
@@ -87,7 +87,7 @@
 
 	size = readl(&ainfo->size);
 
-	if (size != (unsigned)((len + 7) & ~0x00000007))
+	if (size < (unsigned)((len + 7) & ~0x00000007))
 		return 1;
 
 	src = smem_addr + readl(&ainfo->offset);
diff --git a/platform/msm_shared/ucs.c b/platform/msm_shared/ucs.c
index 1e03410..432f3a7 100644
--- a/platform/msm_shared/ucs.c
+++ b/platform/msm_shared/ucs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -80,6 +80,108 @@
 	return UFS_SUCCESS;
 }
 
+int ucs_do_scsi_rpmb_read(struct ufs_dev *dev, uint32_t *req_buf, uint32_t blk_cnt,
+                                 uint32_t *resp_buf, uint32_t *resp_len)
+{
+	// validate input parameters
+	ASSERT(req_buf);
+	ASSERT(resp_buf);
+	ASSERT(resp_len);
+
+	STACKBUF_DMA_ALIGN(cdb, sizeof(struct scsi_sec_protocol_cdb));
+	struct scsi_req_build_type   req_upiu;
+	struct scsi_sec_protocol_cdb *cdb_out_param, *cdb_in_param;
+	uint32_t                     blks_remaining;
+	uint32_t                     blks_to_transfer;
+	uint64_t                     bytes_to_transfer;
+	uint32_t                     start_blk;
+	uint64_t                     max_size;
+	blks_remaining    = blk_cnt;
+	blks_to_transfer  = blks_remaining;
+	bytes_to_transfer = blks_to_transfer * RPMB_FRAME_SIZE;
+
+	// check if total bytes to transfer exceed max supported size
+	max_size = dev->rpmb_rw_size * RPMB_FRAME_SIZE * blk_cnt;
+	if (bytes_to_transfer > max_size)
+	{
+		dprintf(CRITICAL, "RPMB request transfer size %llu greater than max transfer size %llu\n", bytes_to_transfer, max_size);
+		return -UFS_FAILURE;
+	}
+#ifdef DEBUG_UFS
+	dprintf(INFO, "rpmb_read: req_buf: 0x%x blk_count: 0x%x\n", *req_buf, blk_cnt);
+	dprintf(INFO, "rpmb_read: bytes_to_transfer: 0x%x blks_to_transfer: 0x%x\n",
+                   bytes_to_transfer, blks_to_transfer);
+#endif
+	// send the request
+	cdb_out_param = (struct scsi_sec_protocol_cdb*) cdb;
+	memset(cdb_out_param, 0, sizeof(struct scsi_sec_protocol_cdb));
+
+	cdb_out_param->opcode                = SCSI_CMD_SECPROT_OUT;
+	cdb_out_param->cdb1                  = SCSI_SEC_PROT;
+	cdb_out_param->sec_protocol_specific = BE16(SCSI_SEC_UFS_PROT_ID);
+	cdb_out_param->alloc_tlen            = BE32(bytes_to_transfer);
+
+	// Flush CDB to memory
+	dsb();
+	arch_clean_invalidate_cache_range((addr_t) cdb_out_param, sizeof(struct scsi_sec_protocol_cdb));
+
+	memset(&req_upiu, 0, sizeof(struct scsi_req_build_type));
+
+	req_upiu.cdb              = (addr_t) cdb_out_param;
+	req_upiu.data_buffer_addr = req_buf;
+	req_upiu.data_len         = bytes_to_transfer;
+	req_upiu.flags            = UPIU_FLAGS_WRITE;
+	req_upiu.lun              = UFS_WLUN_RPMB;
+	req_upiu.dd               = UTRD_TARGET_TO_SYSTEM;
+
+#ifdef DEBUG_UFS
+	dprintf(INFO, "Sending RPMB Read request\n");
+#endif
+	if (ucs_do_scsi_cmd(dev, &req_upiu))
+	{
+		dprintf(CRITICAL, "%s:%d ucs_do_scsi_rpmb_read: failed\n", __func__, __LINE__);
+		return -UFS_FAILURE;
+	}
+#ifdef DEBUG_UFS
+	dprintf(INFO, "Sending RPMB Read request complete\n");
+#endif
+	// read the response
+	cdb_in_param = (struct scsi_sec_protocol_cdb*) cdb;
+	memset(cdb_in_param, 0, sizeof(struct scsi_sec_protocol_cdb));
+
+	cdb_in_param->opcode                = SCSI_CMD_SECPROT_IN;
+	cdb_in_param->cdb1                  = SCSI_SEC_PROT;
+	cdb_in_param->sec_protocol_specific = BE16(SCSI_SEC_UFS_PROT_ID);
+	cdb_in_param->alloc_tlen            = BE32(bytes_to_transfer);
+
+	// Flush CDB to memory
+	dsb();
+	arch_clean_invalidate_cache_range((addr_t) cdb_in_param, sizeof(struct scsi_sec_protocol_cdb));
+
+	memset(&req_upiu, 0, sizeof(struct scsi_req_build_type));
+
+	req_upiu.cdb              = (addr_t) cdb_in_param;
+	req_upiu.data_buffer_addr = resp_buf;
+	req_upiu.data_len         = bytes_to_transfer;
+	req_upiu.flags            = UPIU_FLAGS_READ;
+	req_upiu.lun              = UFS_WLUN_RPMB;
+	req_upiu.dd               = UTRD_SYSTEM_TO_TARGET;
+
+#ifdef DEBUG_UFS
+	dprintf(INFO, "Sending RPMB Read response\n");
+#endif
+	if (ucs_do_scsi_cmd(dev, &req_upiu))
+	{
+		dprintf(CRITICAL, "%s:%d ucs_do_scsi_rpmb_read: failed\n", __func__, __LINE__);
+		return -UFS_FAILURE;
+	}
+#ifdef DEBUG_UFS
+	dprintf(SPEW, "Sending RPMB Read response complete\n");
+#endif
+	*resp_len = bytes_to_transfer;
+	return UFS_SUCCESS;
+}
+
 int ucs_do_scsi_read(struct ufs_dev *dev, struct scsi_rdwr_req *req)
 {
 	STACKBUF_DMA_ALIGN(cdb, sizeof(struct scsi_rdwr_cdb));
diff --git a/platform/msm_shared/ufs.c b/platform/msm_shared/ufs.c
index 1fd26b4..3cb1487 100644
--- a/platform/msm_shared/ufs.c
+++ b/platform/msm_shared/ufs.c
@@ -89,6 +89,31 @@
 	qgic_change_interrupt_cfg(UFS_IRQ, INTERRUPT_LVL_N_TO_N);
 }
 
+static void ufs_rpmb_init(struct ufs_dev *dev)
+{
+	int ret = 0;
+
+	// calculate the size of rpmb partition in sectors
+	ret = dme_read_unit_desc(dev, UFS_WLUN_RPMB);
+	if (ret != UFS_SUCCESS)
+	{
+		dprintf(CRITICAL, "UFS dme_read_unit_desc failed for RPMB Partition\n");
+		return;
+	}
+
+	// gets the number of rpmb frames allowed in a single UPIU commands
+	ret = dme_read_geo_desc(dev, UFS_WLUN_RPMB);
+	if (ret != UFS_SUCCESS)
+	{
+		dprintf(CRITICAL, "UFS dme_read_geo_desc failed for RPMB Partition\n");
+		return;
+	}
+#ifdef DEBUG_UFS
+	dprintf(INFO, "RPMB: Logical Block Count: 0x%x\n", dev->rpmb_num_blocks);
+	dprintf(INFO, "RPMB: RPMB Read Write Size: 0x%x\n", dev->rpmb_rw_size);
+#endif
+}
+
 int ufs_read(struct ufs_dev* dev, uint64_t start_lba, addr_t buffer, uint32_t num_blocks)
 {
 	struct scsi_rdwr_req req;
diff --git a/project/mdm9635.mk b/project/mdm9635.mk
index 076a6d8..e83f0c1 100644
--- a/project/mdm9635.mk
+++ b/project/mdm9635.mk
@@ -24,3 +24,9 @@
 ifeq ($(ENABLE_USB30_SUPPORT),1)
 DEFINES += USB30_SUPPORT=1
 endif
+
+ENABLE_SMD_SUPPORT := 1
+
+ifeq ($(ENABLE_SMD_SUPPORT),1)
+DEFINES += SMD_SUPPORT=1
+endif
diff --git a/project/msm8909.mk b/project/msm8909.mk
index 0ffce48..e00fbe2 100644
--- a/project/msm8909.mk
+++ b/project/msm8909.mk
@@ -6,18 +6,25 @@
 
 MODULES += app/aboot
 
+ifeq ($(TARGET_BUILD_VARIANT),user)
+DEBUG := 0
+else
 DEBUG := 1
+endif
+
 EMMC_BOOT := 1
 
-ENABLE_SMD_SUPPORT := 1
+#ENABLE_SMD_SUPPORT := 1
 ENABLE_BOOT_CONFIG_SUPPORT := 1
 
 #DEFINES += WITH_DEBUG_DCC=1
+DEFINES += WITH_DEBUG_LOG_BUF=1
 DEFINES += WITH_DEBUG_UART=1
 #DEFINES += WITH_DEBUG_FBCON=1
 DEFINES += DEVICE_TREE=1
 #DEFINES += MMC_BOOT_BAM=1
 #DEFINES += CRYPTO_BAM=1
+DEFINES += SPMI_CORE_V2=1
 DEFINES += ABOOT_IGNORE_BOOT_HEADER_ADDRS=1
 
 DEFINES += ABOOT_FORCE_KERNEL_ADDR=0x80008000
diff --git a/project/msm8994.mk b/project/msm8994.mk
index 743e7eb..26b097e 100644
--- a/project/msm8994.mk
+++ b/project/msm8994.mk
@@ -5,6 +5,7 @@
 TARGET := msm8994
 
 MODULES += app/aboot
+MODULES += app/rpmbtests
 
 ifeq ($(TARGET_BUILD_VARIANT),user)
 DEBUG := 0
diff --git a/target/apq8084/include/target/display.h b/target/apq8084/include/target/display.h
index d89b797..c1d78f0 100644
--- a/target/apq8084/include/target/display.h
+++ b/target/apq8084/include/target/display.h
@@ -114,7 +114,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x03, 0x09, 0x03, 0x00, 0x20, 0x07, 0x01
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/mdm9635/init.c b/target/mdm9635/init.c
index 9409e81..647cf95 100644
--- a/target/mdm9635/init.c
+++ b/target/mdm9635/init.c
@@ -44,6 +44,7 @@
 #include <bits.h>
 #include <qmp_phy.h>
 #include <scm.h>
+#include <rpm-smd.h>
 
 extern void smem_ptable_init(void);
 extern void smem_add_modem_partitions(struct ptable *flash_ptable);
@@ -145,8 +146,12 @@
 	update_ptable_names();
 
 	flash_set_ptable(&flash_ptable);
+	rpm_smd_init();
 }
-
+void target_uninit()
+{
+	rpm_smd_uninit();
+}
 /* Do target specific usb initialization */
 void target_usb_init(void)
 {
diff --git a/target/msm8226/include/target/display.h b/target/msm8226/include/target/display.h
index 8e87a7a..91d1e57 100755
--- a/target/msm8226/include/target/display.h
+++ b/target/msm8226/include/target/display.h
@@ -77,7 +77,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x07, 0x08, 0x07, 0x00, 0x20, 0x07, 0x01
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index b0eed95..3186c82 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -115,6 +115,7 @@
 	{ SDCC1_PWRCTL_IRQ, SDCC2_PWRCTL_IRQ };
 
 static void set_sdc_power_ctrl(void);
+static void set_ebi2_config(void);
 
 void update_ptable_names(void)
 {
@@ -237,17 +238,17 @@
 	/* Drive strength configs for sdc pins */
 	struct tlmm_cfgs sdc1_hdrv_cfg[] =
 	{
-		{ SDC1_CLK_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK },
-		{ SDC1_CMD_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK },
-		{ SDC1_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_6MA, TLMM_HDRV_MASK },
+		{ SDC1_CLK_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CMD_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_6MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
 	};
 
 	/* Pull configs for sdc pins */
 	struct tlmm_cfgs sdc1_pull_cfg[] =
 	{
-		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK },
-		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK },
-		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK },
+		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
 	};
 
 	/* Set the drive strength & pull control values */
@@ -255,6 +256,37 @@
 	tlmm_set_pull_ctrl(sdc1_pull_cfg, ARRAY_SIZE(sdc1_pull_cfg));
 }
 
+static void set_ebi2_config()
+{
+	/* Drive strength configs for ebi2 pins */
+	struct tlmm_cfgs ebi2_hdrv_cfg[] =
+	{
+		{ EBI2_BUSY_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_WE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_OE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CLE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_ALE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CS_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_6MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	/* Pull configs for ebi2 pins */
+	struct tlmm_cfgs ebi2_pull_cfg[] =
+	{
+		{ EBI2_BUSY_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_WE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_OE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CLE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_ALE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CS_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	/* Set the drive strength & pull control values */
+	tlmm_set_hdrive_ctrl(ebi2_hdrv_cfg, ARRAY_SIZE(ebi2_hdrv_cfg));
+	tlmm_set_pull_ctrl(ebi2_pull_cfg, ARRAY_SIZE(ebi2_pull_cfg));
+
+}
 void target_init(void)
 {
 	uint32_t base_addr;
@@ -266,7 +298,9 @@
 
 	target_keystatus();
 
+#if ENABLE_BOOT_CONFIG_SUPPORT
 	platform_read_boot_config();
+#endif
 
 	if (platform_boot_dev_isemmc()) {
 		target_sdc_init();
@@ -277,6 +311,7 @@
 		}
 
 	} else {
+		set_ebi2_config();
 		config.pipes.read_pipe = DATA_PRODUCER_PIPE;
 		config.pipes.write_pipe = DATA_CONSUMER_PIPE;
 		config.pipes.cmd_pipe = CMD_PIPE;
@@ -313,7 +348,9 @@
 	if (target_use_signed_kernel())
 		target_crypto_init_params();
 
+#if ENABLE_SMD_SUPPORT
 	rpm_smd_init();
+#endif
 }
 
 void target_serialno(unsigned char *buf)
@@ -595,7 +632,9 @@
 	if (target_is_ssd_enabled())
 		clock_ce_disable(CE1_INSTANCE);
 
+#if ENABLE_SMD_SUPPORT
 	rpm_smd_uninit();
+#endif
 }
 
 /* Do any target specific intialization needed before entering fastboot mode */
diff --git a/target/msm8916/include/target/display.h b/target/msm8916/include/target/display.h
index d904966..5b90130 100755
--- a/target/msm8916/include/target/display.h
+++ b/target/msm8916/include/target/display.h
@@ -93,8 +93,14 @@
   0x00, 0x00, 0xb1, 0xff, 0x00, 0x00
 };
 
-static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+extern uint32_t panel_regulator_settings[7];
+
+static const uint32_t dcdc_regulator_settings[] = {
+  0x03, 0x08, 0x07, 0x00, 0x20, 0x07, 0x01
+};
+
+static const uint32_t ldo_regulator_settings[] = {
+  0x00, 0x01, 0x01, 0x00, 0x20, 0x07, 0x00
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8916/oem_panel.c b/target/msm8916/oem_panel.c
index 82bcdad..a8e919f 100755
--- a/target/msm8916/oem_panel.c
+++ b/target/msm8916/oem_panel.c
@@ -63,6 +63,10 @@
 /*---------------------------------------------------------------------------*/
 static uint32_t auto_pan_loop = 0;
 
+uint32_t panel_regulator_settings[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
 enum {
 JDI_1080P_VIDEO_PANEL,
 NT35590_720P_VIDEO_PANEL,
@@ -494,9 +498,18 @@
 	}
 
 panel_init:
-	/* Set LDO mode */
-	if (platform_is_msm8939() || (hw_id == HW_PLATFORM_QRD))
+	/*
+	 * Update all data structures after 'panel_init' label. Only panel
+	 * selection is supposed to happen before that.
+	 */
+	if (platform_is_msm8939() || (hw_id == HW_PLATFORM_QRD)) {
 		phy_db->regulator_mode = DSI_PHY_REGULATOR_LDO_MODE;
+		memcpy(panel_regulator_settings,
+				ldo_regulator_settings, REGULATOR_SIZE);
+	} else {
+		memcpy(panel_regulator_settings,
+				dcdc_regulator_settings, REGULATOR_SIZE);
+	}
 
 	pinfo->pipe_type = MDSS_MDP_PIPE_TYPE_RGB;
 	return init_panel_data(panelstruct, pinfo, phy_db);
diff --git a/target/msm8974/include/target/display.h b/target/msm8974/include/target/display.h
index 420636d..953a1af 100644
--- a/target/msm8974/include/target/display.h
+++ b/target/msm8974/include/target/display.h
@@ -73,7 +73,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x03, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8994/init.c b/target/msm8994/init.c
index 18c6ab9..959bd12 100644
--- a/target/msm8994/init.c
+++ b/target/msm8994/init.c
@@ -197,7 +197,7 @@
 	if (is_cold_boot &&
 			(!(pon_reason & HARD_RST)) &&
 			(!(pon_reason & KPDPWR_N)) &&
-			((pon_reason & USB_CHG) || (pon_reason & DC_CHG)))
+			((pon_reason & PON1)))
 		return 1;
 	else
 		return 0;
@@ -327,11 +327,7 @@
 	}
 
 	/* Storage initialization is complete, read the partition table info */
-	if (partition_read_table())
-	{
-		dprintf(CRITICAL, "Error reading the partition table info\n");
-		ASSERT(0);
-	}
+	mmc_read_partition_table(0);
 
 	rpm_smd_init();
 
@@ -362,6 +358,7 @@
 			case HW_PLATFORM_SURF:
 			case HW_PLATFORM_MTP:
 			case HW_PLATFORM_FLUID:
+			case HW_PLATFORM_LIQUID:
 				dprintf(SPEW, "Target_cont_splash=1\n");
 				splash_screen = 1;
 				break;
@@ -555,12 +552,6 @@
 	ASSERT(0);
 }
 
-void target_fastboot_init(void)
-{
-	/* We are entering fastboot mode, so read partition table */
-	mmc_read_partition_table(1);
-}
-
 uint32_t target_ddr_cfg_val()
 {
 	return DDR_CFG_DLY_VAL;
diff --git a/target/msm8994/oem_panel.c b/target/msm8994/oem_panel.c
index 2d95439..afbe07b 100644
--- a/target/msm8994/oem_panel.c
+++ b/target/msm8994/oem_panel.c
@@ -43,6 +43,7 @@
 #include "include/panel_sharp_wqxga_dualdsi_video.h"
 #include "include/panel_jdi_qhd_dualdsi_video.h"
 #include "include/panel_jdi_qhd_dualdsi_cmd.h"
+#include "include/panel_jdi_4k_dualdsi_video.h"
 
 /*---------------------------------------------------------------------------*/
 /* static panel selection variable                                           */
@@ -51,6 +52,7 @@
 SHARP_WQXGA_DUALDSI_VIDEO_PANEL,
 JDI_QHD_DUALDSI_VIDEO_PANEL,
 JDI_QHD_DUALDSI_CMD_PANEL,
+JDI_4K_DUALDSI_VIDEO_PANEL,
 UNKNOWN_PANEL
 };
 
@@ -62,6 +64,7 @@
 	{"sharp_wqxga_dualdsi_video", SHARP_WQXGA_DUALDSI_VIDEO_PANEL},
 	{"jdi_qhd_dualdsi_video", JDI_QHD_DUALDSI_VIDEO_PANEL},
 	{"jdi_qhd_dualdsi_cmd", JDI_QHD_DUALDSI_CMD_PANEL},
+	{"jdi_4k_dualdsi_video", JDI_4K_DUALDSI_VIDEO_PANEL},
 };
 
 static uint32_t panel_id;
@@ -169,6 +172,31 @@
 		memcpy(phy_db->timing,
 			jdi_qhd_dualdsi_cmd_timings, TIMING_SIZE);
 		break;
+	case JDI_4K_DUALDSI_VIDEO_PANEL:
+		pan_type = PANEL_TYPE_DSI;
+		pinfo->lcd_reg_en = 1;
+		pinfo->mipi.cmds_post_tg = 1;
+		panelstruct->paneldata    = &jdi_4k_dualdsi_video_panel_data;
+		panelstruct->panelres     = &jdi_4k_dualdsi_video_panel_res;
+		panelstruct->color        = &jdi_4k_dualdsi_video_color;
+		panelstruct->videopanel   = &jdi_4k_dualdsi_video_video_panel;
+		panelstruct->commandpanel = &jdi_4k_dualdsi_video_command_panel;
+		panelstruct->state        = &jdi_4k_dualdsi_video_state;
+		panelstruct->laneconfig   = &jdi_4k_dualdsi_video_lane_config;
+		panelstruct->paneltiminginfo
+			= &jdi_4k_dualdsi_video_timing_info;
+		panelstruct->panelresetseq
+					 = &jdi_4k_dualdsi_video_reset_seq;
+		panelstruct->backlightinfo = &jdi_4k_dualdsi_video_backlight;
+		pinfo->mipi.panel_cmds
+			= jdi_4k_dualdsi_video_on_command;
+		pinfo->mipi.num_of_panel_cmds
+			= JDI_4K_DUALDSI_VIDEO_ON_COMMAND;
+		memcpy(phy_db->timing,
+			jdi_4k_dualdsi_video_timings, TIMING_SIZE);
+		memcpy(&panelstruct->fbcinfo, &jdi_4k_dualdsi_video_fbc,
+				sizeof(struct fb_compression));
+		break;
 	default:
 	case UNKNOWN_PANEL:
 		pan_type = PANEL_TYPE_UNKNOWN;
@@ -207,6 +235,9 @@
 	case HW_PLATFORM_SURF:
 		panel_id = SHARP_WQXGA_DUALDSI_VIDEO_PANEL;
 		break;
+	case HW_PLATFORM_LIQUID:
+		panel_id = JDI_4K_DUALDSI_VIDEO_PANEL;
+		break;
 	default:
 		dprintf(CRITICAL, "Display not enabled for %d HW type\n"
 					, hw_id);
@@ -214,5 +245,7 @@
 	}
 
 panel_init:
+	if (panel_id == JDI_4K_DUALDSI_VIDEO_PANEL)
+		phy_db->regulator_mode = DSI_PHY_REGULATOR_LDO_MODE;
 	return init_panel_data(panelstruct, pinfo, phy_db);
 }
diff --git a/platform/msm_shared/regulator.c b/target/msm8994/regulator.c
similarity index 94%
rename from platform/msm_shared/regulator.c
rename to target/msm8994/regulator.c
index 440049b..8a8d1e1 100644
--- a/platform/msm_shared/regulator.c
+++ b/target/msm8994/regulator.c
@@ -30,12 +30,6 @@
 #include <regulator.h>
 #include <rpm-smd.h>
 
-#define GENERIC_DISABLE 0
-#define GENERIC_ENABLE  1
-#define SW_MODE_LDO_IPEAK 1
-#define LDOA_RES_TYPE 0x616F646C //aodl
-#define SMPS_RES_TYPE 0x61706D73 //apms
-
 static uint32_t ldo2[][11]=
 {
 	{
@@ -116,7 +110,6 @@
 	rpm_send_data(&ldo28[GENERIC_ENABLE][0], 36, RPM_REQUEST_TYPE);
 }
 
-
 void regulator_disable()
 {
 
diff --git a/target/msm8994/rules.mk b/target/msm8994/rules.mk
index 509c91a..ec35e53 100644
--- a/target/msm8994/rules.mk
+++ b/target/msm8994/rules.mk
@@ -39,3 +39,8 @@
     $(LOCAL_DIR)/meminfo.o \
     $(LOCAL_DIR)/target_display.o \
     $(LOCAL_DIR)/oem_panel.o
+
+ifeq ($(ENABLE_SMD_SUPPORT),1)
+OBJS += \
+    $(LOCAL_DIR)/regulator.o
+endif
diff --git a/target/msmzirc/init.c b/target/msmzirc/init.c
index 22e03df..ef2ebf7 100644
--- a/target/msmzirc/init.c
+++ b/target/msmzirc/init.c
@@ -246,7 +246,7 @@
 		}
 		else {
 			/* Below is for emmc boot */
-			system_ptn_index = partition_get_index(part);
+			system_ptn_index = partition_get_index(part) + 1; /* Adding +1 as offsets for eMMC start at 1 and NAND at 0 */
 			if (system_ptn_index < 0) {
 				dprintf(CRITICAL,
 						"WARN: Cannot get partition index for %s\n", part);