Merge "Fix encoding bug in i2c_ASN1_INTEGER"
diff --git a/arch/arm/crt0.S b/arch/arm/crt0.S
index 2a72ce3..be6d4d6 100644
--- a/arch/arm/crt0.S
+++ b/arch/arm/crt0.S
@@ -191,5 +191,5 @@
 	 * dynamically allocated stack, so we don't need it for very long
 	 */
 abort_stack:
-	.skip 1024
+	.skip 2048
 abort_stack_top:
diff --git a/dev/gcdb/display/gcdb_display.c b/dev/gcdb/display/gcdb_display.c
index 39c8c26..b144433 100644
--- a/dev/gcdb/display/gcdb_display.c
+++ b/dev/gcdb/display/gcdb_display.c
@@ -240,8 +240,9 @@
 	dprintf(SPEW, "enable=%d cnt=%d\n", dfps->panel_dfps.enabled,
 		dfps->panel_dfps.frame_rate_cnt);
 
-	if (!dfps->panel_dfps.enabled || dfps->panel_dfps.frame_rate_cnt >
-		DFPS_MAX_FRAME_RATE) {
+	if (!dfps->panel_dfps.enabled || (dfps->panel_dfps.frame_rate_cnt >
+		DFPS_MAX_FRAME_RATE) || (dfps->dfps_fb_base !=
+		pinfo->dfps.dfps_fb_base)) {
 		ret = ERROR;
 		free(dfps);
 		goto splash_err;
diff --git a/lib/openssl/crypto/bio/b_print.c b/lib/openssl/crypto/bio/b_print.c
index 143a7cf..a8c5dc9 100644
--- a/lib/openssl/crypto/bio/b_print.c
+++ b/lib/openssl/crypto/bio/b_print.c
@@ -125,14 +125,14 @@
 #define LLONG long
 #endif
 
-static void fmtstr     (char **, char **, size_t *, size_t *,
+static int fmtstr(char **, char **, size_t *, size_t *,
 			const char *, int, int, int);
-static void fmtint     (char **, char **, size_t *, size_t *,
+static int fmtint(char **, char **, size_t *, size_t *,
 			LLONG, int, int, int, int);
-static void fmtfp      (char **, char **, size_t *, size_t *,
+static int fmtfp(char **, char **, size_t *, size_t *,
 			LDOUBLE, int, int, int);
-static void doapr_outch (char **, char **, size_t *, size_t *, int);
-static void _dopr(char **sbuffer, char **buffer,
+static int doapr_outch(char **, char **, size_t *, size_t *, int);
+static int _dopr(char **sbuffer, char **buffer,
 		  size_t *maxlen, size_t *retlen, int *truncated,
 		  const char *format, va_list args);
 
@@ -165,7 +165,7 @@
 #define char_to_int(p) (p - '0')
 #define OSSL_MAX(p,q) ((p >= q) ? p : q)
 
-static void
+static int
 _dopr(
     char **sbuffer,
     char **buffer,
@@ -200,7 +200,8 @@
             if (ch == '%')
                 state = DP_S_FLAGS;
             else
-                doapr_outch(sbuffer,buffer, &currlen, maxlen, ch);
+                if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
+			return 0;
             ch = *format++;
             break;
         case DP_S_FLAGS:
@@ -306,8 +307,9 @@
                     value = va_arg(args, int);
                     break;
                 }
-                fmtint(sbuffer, buffer, &currlen, maxlen,
-                       value, 10, min, max, flags);
+                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value, 10, min,
+                            max, flags))
+                    return 0;
                 break;
             case 'X':
                 flags |= DP_F_UP;
@@ -332,17 +334,19 @@
                         unsigned int);
                     break;
                 }
-                fmtint(sbuffer, buffer, &currlen, maxlen, value,
+                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value,
                        ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),
-                       min, max, flags);
+                            min, max, flags))
+                    return 0;
                 break;
             case 'f':
                 if (cflags == DP_C_LDOUBLE)
                     fvalue = va_arg(args, LDOUBLE);
                 else
                     fvalue = va_arg(args, double);
-                fmtfp(sbuffer, buffer, &currlen, maxlen,
-                      fvalue, min, max, flags);
+                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
+                           flags))
+                    return 0;
                 break;
             case 'E':
                 flags |= DP_F_UP;
@@ -361,8 +365,9 @@
                     fvalue = va_arg(args, double);
                 break;
             case 'c':
-                doapr_outch(sbuffer, buffer, &currlen, maxlen,
-                    va_arg(args, int));
+                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen,
+                            va_arg(args, int)))
+                    return 0;
                 break;
             case 's':
                 strvalue = va_arg(args, char *);
@@ -372,13 +377,15 @@
 		    else
 			max = *maxlen;
 		}
-                fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,
-                       flags, min, max);
+                if (!fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,
+                            flags, min, max))
+                    return 0;
                 break;
             case 'p':
                 value = (long)va_arg(args, void *);
-                fmtint(sbuffer, buffer, &currlen, maxlen,
-                    value, 16, min, max, flags|DP_F_NUM);
+                if (!fmtint(sbuffer, buffer, &currlen, maxlen,
+                            value, 16, min, max, flags | DP_F_NUM))
+                    return 0;
                 break;
             case 'n': /* XXX */
                 if (cflags == DP_C_SHORT) {
@@ -400,7 +407,8 @@
                 }
                 break;
             case '%':
-                doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);
+                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
+                    return 0;
                 break;
             case 'w':
                 /* not supported yet, treat as next char */
@@ -424,12 +432,13 @@
     *truncated = (currlen > *maxlen - 1);
     if (*truncated)
         currlen = *maxlen - 1;
-    doapr_outch(sbuffer, buffer, &currlen, maxlen, '\0');
+    if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, '\0'))
+        return 0;
     *retlen = currlen - 1;
-    return;
+    return 1;
 }
 
-static void
+static int
 fmtstr(
     char **sbuffer,
     char **buffer,
@@ -440,36 +449,44 @@
     int min,
     int max)
 {
-    int padlen, strln;
+    int padlen;
+    size_t strln;
     int cnt = 0;
 
     if (value == 0)
         value = "<NULL>";
-    for (strln = 0; value[strln]; ++strln)
-        ;
+
+    strln = strlen(value);
+    if (strln > INT_MAX)
+        strln = INT_MAX;
+
     padlen = min - strln;
-    if (padlen < 0)
+    if (min < 0 || padlen < 0)
         padlen = 0;
     if (flags & DP_F_MINUS)
         padlen = -padlen;
 
     while ((padlen > 0) && (cnt < max)) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, ' ');
+        if(!doapr_outch(sbuffer, buffer, currlen, maxlen, ' '))
+            return 0;
         --padlen;
         ++cnt;
     }
     while (*value && (cnt < max)) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, *value++);
+        if(!doapr_outch(sbuffer, buffer, currlen, maxlen, *value++))
+            return 0;
         ++cnt;
     }
     while ((padlen < 0) && (cnt < max)) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, ' ');
+        if(!doapr_outch(sbuffer, buffer, currlen, maxlen, ' '))
+            return 0;
         ++padlen;
         ++cnt;
     }
+    return 1;
 }
 
-static void
+static int
 fmtint(
     char **sbuffer,
     char **buffer,
@@ -533,37 +550,44 @@
 
     /* spaces */
     while (spadlen > 0) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, ' ');
+        if(!doapr_outch(sbuffer, buffer, currlen, maxlen, ' '))
+            return 0;
         --spadlen;
     }
 
     /* sign */
     if (signvalue)
-        doapr_outch(sbuffer, buffer, currlen, maxlen, signvalue);
+        if(!doapr_outch(sbuffer, buffer, currlen, maxlen, signvalue))
+            return 0;
 
     /* prefix */
     while (*prefix) {
-	doapr_outch(sbuffer, buffer, currlen, maxlen, *prefix);
+        if(!doapr_outch(sbuffer, buffer, currlen, maxlen, *prefix))
+            return 0;
 	prefix++;
     }
 
     /* zeros */
     if (zpadlen > 0) {
         while (zpadlen > 0) {
-            doapr_outch(sbuffer, buffer, currlen, maxlen, '0');
+            if(!doapr_outch(sbuffer, buffer, currlen, maxlen, '0'))
+                return 0;
             --zpadlen;
         }
     }
     /* digits */
-    while (place > 0)
-        doapr_outch(sbuffer, buffer, currlen, maxlen, convert[--place]);
+    while (place > 0) {
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, convert[--place]))
+            return 0;
+    }
 
     /* left justified spaces */
     while (spadlen < 0) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, ' ');
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, ' '))
+            return 0;
         ++spadlen;
     }
-    return;
+    return 1;
 }
 
 static LDOUBLE
@@ -597,7 +621,7 @@
     return intpart;
 }
 
-static void
+static int
 fmtfp(
     char **sbuffer,
     char **buffer,
@@ -616,7 +640,6 @@
     int fplace = 0;
     int padlen = 0;
     int zpadlen = 0;
-    int caps = 0;
     long intpart;
     long fracpart;
     long max10;
@@ -650,9 +673,7 @@
 
     /* convert integer part */
     do {
-        iconvert[iplace++] =
-            (caps ? "0123456789ABCDEF"
-              : "0123456789abcdef")[intpart % 10];
+        iconvert[iplace++] = "0123456789"[intpart % 10];
         intpart = (intpart / 10);
     } while (intpart && (iplace < (int)sizeof(iconvert)));
     if (iplace == sizeof iconvert)
@@ -661,9 +682,7 @@
 
     /* convert fractional part */
     do {
-        fconvert[fplace++] =
-            (caps ? "0123456789ABCDEF"
-              : "0123456789abcdef")[fracpart % 10];
+        fconvert[fplace++] = "0123456789"[fracpart % 10];
         fracpart = (fracpart / 10);
     } while (fplace < max);
     if (fplace == sizeof fconvert)
@@ -682,47 +701,61 @@
 
     if ((flags & DP_F_ZERO) && (padlen > 0)) {
         if (signvalue) {
-            doapr_outch(sbuffer, buffer, currlen, maxlen, signvalue);
+            if (!doapr_outch(sbuffer, buffer, currlen, maxlen, signvalue))
+                return 0;
             --padlen;
             signvalue = 0;
         }
         while (padlen > 0) {
-            doapr_outch(sbuffer, buffer, currlen, maxlen, '0');
+            if (!doapr_outch(sbuffer, buffer, currlen, maxlen, '0'))
+                return 0;
             --padlen;
         }
     }
     while (padlen > 0) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, ' ');
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, ' '))
+            return 0;
         --padlen;
     }
-    if (signvalue)
-        doapr_outch(sbuffer, buffer, currlen, maxlen, signvalue);
+    if (signvalue && !doapr_outch(sbuffer, buffer, currlen, maxlen, signvalue))
+        return 0;
 
-    while (iplace > 0)
-        doapr_outch(sbuffer, buffer, currlen, maxlen, iconvert[--iplace]);
+    while (iplace > 0) {
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, iconvert[--iplace]))
+            return 0;
+    }
 
     /*
      * Decimal point. This should probably use locale to find the correct
      * char to print out.
      */
     if (max > 0 || (flags & DP_F_NUM)) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, '.');
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, '.'))
+            return 0;
 
-        while (fplace > 0)
-            doapr_outch(sbuffer, buffer, currlen, maxlen, fconvert[--fplace]);
+        while (fplace > 0) {
+            if(!doapr_outch(sbuffer, buffer, currlen, maxlen,
+                            fconvert[--fplace]))
+                return 0;
+        }
     }
     while (zpadlen > 0) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, '0');
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, '0'))
+            return 0;
         --zpadlen;
     }
 
     while (padlen < 0) {
-        doapr_outch(sbuffer, buffer, currlen, maxlen, ' ');
+        if (!doapr_outch(sbuffer, buffer, currlen, maxlen, ' '))
+            return 0;
         ++padlen;
     }
+    return 1;
 }
 
-static void
+#define BUFFER_INC  1024
+
+static int
 doapr_outch(
     char **sbuffer,
     char **buffer,
@@ -733,24 +766,30 @@
     /* If we haven't at least one buffer, someone has doe a big booboo */
     assert(*sbuffer != NULL || buffer != NULL);
 
-    if (buffer) {
-	while (*currlen >= *maxlen) {
-	    if (*buffer == NULL) {
-		if (*maxlen == 0)
-		    *maxlen = 1024;
+    /* |currlen| must always be <= |*maxlen| */
+    assert(*currlen <= *maxlen);
+
+    if (buffer && *currlen == *maxlen) {
+        if (*maxlen > INT_MAX - BUFFER_INC)
+            return 0;
+
+        *maxlen += BUFFER_INC;
+	if (*buffer == NULL) {
 		*buffer = OPENSSL_malloc(*maxlen);
+		if (*buffer == NULL)
+		    return 0;
 		if (*currlen > 0) {
 		    assert(*sbuffer != NULL);
 		    memcpy(*buffer, *sbuffer, *currlen);
 		}
 		*sbuffer = NULL;
-	    } else {
-		*maxlen += 1024;
-		*buffer = OPENSSL_realloc(*buffer, *maxlen);
-	    }
+	} else {
+            char *tmpbuf;
+            tmpbuf = OPENSSL_realloc(*buffer, *maxlen);
+            if (tmpbuf == NULL)
+                return 0;
+            *buffer = tmpbuf;
 	}
-	/* What to do if *buffer is NULL? */
-	assert(*sbuffer != NULL || *buffer != NULL);
     }
 
     if (*currlen < *maxlen) {
@@ -760,7 +799,7 @@
 	    (*buffer)[(*currlen)++] = (char)c;
     }
 
-    return;
+    return 1;
 }
 
 /***************************************************************************/
@@ -792,11 +831,15 @@
 
 	dynbuf = NULL;
 	CRYPTO_push_info("doapr()");
-	_dopr(&hugebufp, &dynbuf, &hugebufsize,
-		&retlen, &ignored, format, args);
+	if (!_dopr(&hugebufp, &dynbuf, &hugebufsize, &retlen, &ignored, format,
+                args))
+		{
+		OPENSSL_free(dynbuf);
+		return -1;
+		}
 	if (dynbuf)
 		{
-		ret=BIO_write(bio, dynbuf, (int)retlen);
+		ret = BIO_write(bio, dynbuf, (int)retlen);
 		OPENSSL_free(dynbuf);
 		}
 	else
@@ -829,7 +872,8 @@
 	size_t retlen;
 	int truncated;
 
-	_dopr(&buf, NULL, &n, &retlen, &truncated, format, args);
+	if(!_dopr(&buf, NULL, &n, &retlen, &truncated, format, args))
+	    return -1;
 
 	if (truncated)
 		/* In case of truncation, return -1 like traditional snprintf.
diff --git a/platform/msm8996/acpuclock.c b/platform/msm8996/acpuclock.c
index c74e2e6..6e6613e 100644
--- a/platform/msm8996/acpuclock.c
+++ b/platform/msm8996/acpuclock.c
@@ -98,6 +98,10 @@
 	{
 		ret = clk_get_set_enable(clk_name, 192000000, true);
 	}
+	else if(freq == MMC_CLK_200MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 200000000, 1);
+	}
 	else if(freq == MMC_CLK_400MHZ)
 	{
 		ret = clk_get_set_enable(clk_name, 384000000, 1);
diff --git a/platform/msm8996/include/platform/iomap.h b/platform/msm8996/include/platform/iomap.h
index 63dca93..3a3b12b 100644
--- a/platform/msm8996/include/platform/iomap.h
+++ b/platform/msm8996/include/platform/iomap.h
@@ -215,6 +215,7 @@
 
 /* DRV strength for sdcc */
 #define SDC1_HDRV_PULL_CTL           (TLMM_BASE_ADDR + 0x0012C000)
+#define SDC2_HDRV_PULL_CTL           (TLMM_BASE_ADDR + 0x0012D000)
 
 /* SDHCI - power control registers */
 #define SDCC_MCI_HC_MODE            (0x00000078)
diff --git a/platform/msm8996/msm8996-clock.c b/platform/msm8996/msm8996-clock.c
index c92974a..31aa047 100644
--- a/platform/msm8996/msm8996-clock.c
+++ b/platform/msm8996/msm8996-clock.c
@@ -286,6 +286,19 @@
 	F_END
 };
 
+static struct clk_freq_tbl ftbl_gcc_sdcc2_4_apps_clk[] =
+{
+	F(   144000,    cxo,  16,   3,  25),
+	F(   400000,    cxo,  12,   1,   4),
+	F( 20000000,  gpll0,  15,   1,   2),
+	F( 25000000,  gpll0,  12,   1,   2),
+	F( 50000000,  gpll0,  12,   0,   0),
+	F(100000000,  gpll0,   6,   0,   0),
+	F(200000000,  gpll0,   3,   0,   0),
+	F_END
+};
+
+
 static struct rcg_clk sdcc1_apps_clk_src =
 {
 	.cmd_reg      = (uint32_t *) SDCC1_CMD_RCGR,
@@ -326,6 +339,47 @@
 	},
 };
 
+static struct rcg_clk sdcc2_apps_clk_src =
+{
+	.cmd_reg      = (uint32_t *) SDCC2_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) SDCC2_CFG_RCGR,
+	.m_reg        = (uint32_t *) SDCC2_M,
+	.n_reg        = (uint32_t *) SDCC2_N,
+	.d_reg        = (uint32_t *) SDCC2_D,
+
+	.set_rate     = clock_lib2_rcg_set_rate_mnd,
+	.freq_tbl     = ftbl_gcc_sdcc2_4_apps_clk,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "sdc2_clk",
+		.ops      = &clk_ops_rcg_mnd,
+	},
+};
+
+static struct branch_clk gcc_sdcc2_apps_clk =
+{
+	.cbcr_reg     = (uint32_t *) SDCC2_APPS_CBCR,
+	.parent       = &sdcc2_apps_clk_src.c,
+
+	.c = {
+		.dbg_name = "gcc_sdcc2_apps_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk gcc_sdcc2_ahb_clk =
+{
+	.cbcr_reg     = (uint32_t *) SDCC2_AHB_CBCR,
+	.has_sibling  = 1,
+
+	.c = {
+		.dbg_name = "gcc_sdcc2_ahb_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+
 static struct branch_clk gcc_sys_noc_usb30_axi_clk = {
 	.cbcr_reg    = (uint32_t *) SYS_NOC_USB3_AXI_CBCR,
 	.has_sibling = 1,
@@ -893,6 +947,9 @@
 	CLK_LOOKUP("sdc1_iface_clk", gcc_sdcc1_ahb_clk.c),
 	CLK_LOOKUP("sdc1_core_clk",  gcc_sdcc1_apps_clk.c),
 
+	CLK_LOOKUP("sdc2_iface_clk", gcc_sdcc2_ahb_clk.c),
+	CLK_LOOKUP("sdc2_core_clk",  gcc_sdcc2_apps_clk.c),
+
 	CLK_LOOKUP("uart8_iface_clk", gcc_blsp2_ahb_clk.c),
 	CLK_LOOKUP("uart8_core_clk",  gcc_blsp2_uart2_apps_clk.c),
 
diff --git a/platform/msm_shared/boot_device.c b/platform/msm_shared/boot_device.c
index 3416ad9..f73b4dd 100644
--- a/platform/msm_shared/boot_device.c
+++ b/platform/msm_shared/boot_device.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -81,6 +81,7 @@
 			snprintf(buf, ((sizeof((struct mmc_device *)dev)->host.base)*2) + 7,"%x.sdhci", ((struct mmc_device *)dev)->host.base);
 			break;
 		case BOOT_UFS:
+		case BOOT_SD_ELSE_UFS:
 			snprintf(buf, ((sizeof((struct ufs_dev *)dev)->base)*2) + 7, "%x.ufshc", ((struct ufs_dev *)dev)->base);
 			break;
 #endif
diff --git a/platform/msm_shared/include/boot_device.h b/platform/msm_shared/include/boot_device.h
index c216586..7d2451a 100644
--- a/platform/msm_shared/include/boot_device.h
+++ b/platform/msm_shared/include/boot_device.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014,2016 The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -51,6 +51,7 @@
 	BOOT_DEFAULT=0, /* EMMC */
 	BOOT_EMMC=2,
 	BOOT_UFS=4,
+	BOOT_SD_ELSE_UFS=5,
 };
 #endif
 
diff --git a/platform/msm_shared/scm.c b/platform/msm_shared/scm.c
index 7f19b04..d5653b5 100644
--- a/platform/msm_shared/scm.c
+++ b/platform/msm_shared/scm.c
@@ -1250,28 +1250,33 @@
 void scm_check_boot_fuses()
 {
 	uint32_t ret = 0;
-	uint32_t resp;
+	uint32_t *resp = NULL;
 	scmcall_arg scm_arg = {0};
 	scmcall_ret scm_ret = {0};
 
+	resp = memalign(CACHE_LINE, (2 * sizeof(uint32_t)));
+	ASSERT(resp);
 	if (!is_scm_armv8_support()) {
-		ret = scm_call(TZBSP_SVC_INFO, IS_SECURE_BOOT_ENABLED, NULL, 0, &resp, sizeof(resp));
+		ret = scm_call_atomic2(TZBSP_SVC_INFO, IS_SECURE_BOOT_ENABLED, (uint32_t)resp, 2 * sizeof(uint32_t));
+		arch_clean_invalidate_cache_range((addr_t)resp, ROUNDUP((2*sizeof(uint32_t)), CACHE_LINE));
 	} else {
 		scm_arg.x0 = MAKE_SIP_SCM_CMD(TZBSP_SVC_INFO, IS_SECURE_BOOT_ENABLED);
 		ret = scm_call2(&scm_arg, &scm_ret);
-		resp = scm_ret.x1;
+		resp[0] = scm_ret.x1;
 	}
 
+
 	/* Parse Bit 0 and Bit 2 of the response */
 	if(!ret) {
 		/* Bit 0 - SECBOOT_ENABLE_CHECK */
-		if(resp & 0x1)
+		if(resp[0] & 0x1)
 			secure_boot_enabled = false;
 		/* Bit 2 - DEBUG_DISABLE_CHECK */
-		if(resp & 0x4)
+		if(resp[0] & 0x4)
 			wdog_debug_fuse_disabled = false;
 	} else
 		dprintf(CRITICAL, "scm call to check secure boot fuses failed\n");
+	free(resp);
 }
 
 bool is_secure_boot_enable()
diff --git a/project/msm8909.mk b/project/msm8909.mk
index cb08003..5fe2820 100644
--- a/project/msm8909.mk
+++ b/project/msm8909.mk
@@ -69,6 +69,7 @@
 
 #SCM call before entering DLOAD mode
 DEFINES += PLATFORM_USE_SCM_DLOAD=1
+DEFINES += NO_SCM_V8_SUPPORT=1
 
 #Enable the external reboot functions
 ENABLE_REBOOT_MODULE := 1
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index b5ae8b6..8318ca3 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -522,8 +522,10 @@
 		* " root=" in the middle of buffer.
 		*/
 		if (((!strncmp(cmdline, "root=", strlen("root="))) ||
-			(strstr(cmdline, " root="))))
+			(strstr(cmdline, " root=")))) {
 			dprintf(DEBUG, "DEBUG: cmdline has root=\n");
+			return -1;
+		}
 		else
 		/*in success case buf will be freed in the calling function of this*/
 		{
@@ -539,7 +541,7 @@
 					return -1;
 				}
 
-				snprintf(buf, buflen, " root=/dev/mtdblock%d",system_ptn_index);
+				snprintf(*buf, buflen, " root=/dev/mtdblock%d",system_ptn_index);
 			}
 			else
 			{
@@ -554,7 +556,7 @@
 				}
 
 				/*For Emmc case increase the ptn_index by 1*/
-				snprintf(buf, buflen, " root=/dev/mmcblk0p%d",system_ptn_index + 1);
+				snprintf(*buf, buflen, " root=/dev/mmcblk0p%d",system_ptn_index + 1);
 			}
 		}
 
diff --git a/target/msm8952/oem_panel.c b/target/msm8952/oem_panel.c
index 60be169..e59f3af 100755
--- a/target/msm8952/oem_panel.c
+++ b/target/msm8952/oem_panel.c
@@ -801,12 +801,17 @@
 		else
 			panel_id = OTM1906C_1080P_CMD_PANEL;
 
-		/* QRD 8937 SKU1 uses R69006, and SKU2 uses HX8399A */
 		if (platform_is_msm8937()){
-			if (plat_hw_ver_major > 16)
+			if (hw_subtype == 0x80) {
+				/* 8940 SKU7 uses HX8394F */
 				panel_id = HX8394F_720P_VIDEO_PANEL;
-			else
-				panel_id = R69006_1080P_CMD_PANEL;
+			} else {
+				/* 8937 SKU1 uses R69006, SKU2 uses HX8394F */
+				if (plat_hw_ver_major > 16)
+					panel_id = HX8394F_720P_VIDEO_PANEL;
+				else
+					panel_id = R69006_1080P_CMD_PANEL;
+			}
 		}
 
 		/* QRD EVT1 uses OTM1906C, and EVT2 uses HX8394F */
diff --git a/target/msm8996/init.c b/target/msm8996/init.c
index 51051c9..20a4caf 100644
--- a/target/msm8996/init.c
+++ b/target/msm8996/init.c
@@ -98,7 +98,8 @@
 	FUSION_I2S_CDP = 2,
 } cdp_subtype;
 
-static void set_sdc_power_ctrl(void);
+static uint8_t flash_memory_slot = 0;
+static void set_sdc_power_ctrl();
 static uint32_t mmc_pwrctl_base[] =
 	{ MSM_SDC1_BASE, MSM_SDC2_BASE };
 
@@ -204,25 +205,45 @@
 
 static void set_sdc_power_ctrl()
 {
+	uint32_t reg = 0;
+	uint8_t clk = 0;
+	uint8_t cmd = 0;
+	uint8_t dat = 0;
+
+	if (flash_memory_slot == 0x1)
+	{
+		clk = TLMM_CUR_VAL_10MA;
+		cmd = TLMM_CUR_VAL_8MA;
+		dat = TLMM_CUR_VAL_8MA;
+		reg = SDC1_HDRV_PULL_CTL;
+	}
+	else if (flash_memory_slot == 0x2)
+	{
+		clk = TLMM_CUR_VAL_16MA;
+		cmd = TLMM_CUR_VAL_10MA;
+		dat = TLMM_CUR_VAL_10MA;
+		reg = SDC2_HDRV_PULL_CTL;
+	}
+
 	/* Drive strength configs for sdc pins */
 	struct tlmm_cfgs sdc1_hdrv_cfg[] =
 	{
-		{ SDC1_CLK_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
-		{ SDC1_CMD_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
-		{ SDC1_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CLK_HDRV_CTL_OFF,  clk, TLMM_HDRV_MASK, reg },
+		{ SDC1_CMD_HDRV_CTL_OFF,  cmd, TLMM_HDRV_MASK, reg },
+		{ SDC1_DATA_HDRV_CTL_OFF, dat, TLMM_HDRV_MASK, reg },
 	};
 
 	/* Pull configs for sdc pins */
 	struct tlmm_cfgs sdc1_pull_cfg[] =
 	{
-		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
-		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
-		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, reg },
+		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, reg },
+		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, reg },
 	};
 
 	struct tlmm_cfgs sdc1_rclk_cfg[] =
 	{
-		{ SDC1_RCLK_PULL_CTL_OFF, TLMM_PULL_DOWN, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_RCLK_PULL_CTL_OFF, TLMM_PULL_DOWN, TLMM_PULL_MASK, reg },
 	};
 
 	/* Set the drive strength & pull control values */
@@ -245,28 +266,33 @@
 {
 	struct mmc_config_data config = {0};
 
-	/* Set drive strength & pull ctrl values */
-	set_sdc_power_ctrl();
-
 	config.bus_width = DATA_BUS_WIDTH_8BIT;
 	config.max_clk_rate = MMC_CLK_192MHZ;
 	config.hs400_support = 1;
 
 	/* Try slot 1*/
+	flash_memory_slot = 1;
 	config.slot = 1;
 	config.sdhc_base = mmc_sdhci_base[config.slot - 1];
 	config.pwrctl_base = mmc_pwrctl_base[config.slot - 1];
 	config.pwr_irq     = mmc_sdc_pwrctl_irq[config.slot - 1];
 
+	/* Set drive strength & pull ctrl values */
+	set_sdc_power_ctrl();
+
 	if (!(dev = mmc_init(&config)))
 	{
 		/* Try slot 2 */
+		flash_memory_slot = 2;
 		config.slot = 2;
 		config.max_clk_rate = MMC_CLK_200MHZ;
 		config.sdhc_base = mmc_sdhci_base[config.slot - 1];
 		config.pwrctl_base = mmc_pwrctl_base[config.slot - 1];
 		config.pwr_irq     = mmc_sdc_pwrctl_irq[config.slot - 1];
 
+		/* Set drive strength & pull ctrl values */
+		set_sdc_power_ctrl();
+
 		if (!(dev = mmc_init(&config)))
 		{
 			dprintf(CRITICAL, "mmc init failed!");
diff --git a/target/msm8996/rules.mk b/target/msm8996/rules.mk
index c6918f7..a261eb5 100644
--- a/target/msm8996/rules.mk
+++ b/target/msm8996/rules.mk
@@ -24,7 +24,12 @@
 
 DEFINES += PMI_CONFIGURED=1
 
-DEFINES += DISPLAY_SPLASH_SCREEN=1
+ifeq ($(DISPLAY_SCREEN),0)
+ DEFINES += DISPLAY_SPLASH_SCREEN=0
+else
+ DEFINES += DISPLAY_SPLASH_SCREEN=1
+endif
+
 DEFINES += DISPLAY_TYPE_MIPI=1
 DEFINES += DISPLAY_TYPE_DSI6G=1
 
diff --git a/target/msm8996/target_display.c b/target/msm8996/target_display.c
index 19e8b56..bdc9b1b 100644
--- a/target/msm8996/target_display.c
+++ b/target/msm8996/target_display.c
@@ -523,11 +523,12 @@
 		!(board_hw_id == MSM8996SG || board_hw_id == APQ8096SG);
 
 	if (!enable) {
+		mmss_dsi_clock_disable(flags);
+
 		/* stop pll */
 		writel(0x0, pinfo->mipi.phy_base + 0x48);
 		dmb();
 
-		mmss_dsi_clock_disable(flags);
 		goto clks_disable;
 	}