diff --git a/app/aboot/mdtp.c b/app/aboot/mdtp.c
index 21abc12..d44efa3 100644
--- a/app/aboot/mdtp.c
+++ b/app/aboot/mdtp.c
@@ -50,6 +50,8 @@
 #define MDTP_MAJOR_VERSION (0)
 #define MDTP_MINOR_VERSION (2)
 
+#define MDTP_CORRECT_PIN_DELAY_MSEC (1000)
+
 /** Extract major version number from complete version. */
 #define MDTP_GET_MAJOR_VERSION(version) ((version) >> 16)
 
@@ -62,6 +64,7 @@
 
 int check_aboot_addr_range_overlap(uint32_t start, uint32_t size);
 int scm_random(uint32_t * rbuf, uint32_t  r_len);
+extern void mdelay(unsigned msecs);
 void free_mdtp_image(void);
 
 /********************************************************************************/
@@ -445,6 +448,7 @@
 	out:
 	display_image_on_screen();
 	free_mdtp_image();
+	mdelay(MDTP_CORRECT_PIN_DELAY_MSEC);
 }
 
 /* Verify the boot or recovery partitions using boot_verifier. */
diff --git a/dev/gcdb/display/fastboot_oem_display.h b/dev/gcdb/display/fastboot_oem_display.h
index 26873ed..aaccf0e 100644
--- a/dev/gcdb/display/fastboot_oem_display.h
+++ b/dev/gcdb/display/fastboot_oem_display.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -94,6 +94,8 @@
 	{"r63417_1080p_video", "qcom,mdss_dsi_r63417_1080p_video", false},
 	{"samsung_wxga_video", "qcom,mdss_dsi_samsung_wxga_video", false},
 	{"sharp_1080p_cmd", "qcom,mdss_dsi_sharp_1080p_cmd", false},
+	{"sharp_4k_dsc_video", "qcom,mdss_dsi_sharp_4k_dsc_video", true},
+	{"sharp_4k_dsc_cmd", "qcom,mdss_dsi_sharp_4k_dsc_cmd", true},
 	{"sharp_qhd_video", "qcom,mdss_dsi_sharp_qhd_video", false},
 	{"sharp_wqxga_dualdsi_video", "qcom,mdss_dsi_sharp_wqxga_video", true},
 	{"ssd2080m_720p_video", "qcom,mdss_dsi_ssd2080m_720p_video", false},
diff --git a/dev/gcdb/display/include/panel_truly_1080p_video.h b/dev/gcdb/display/include/panel_truly_1080p_video.h
index 9b8a52b..46417c6 100755
--- a/dev/gcdb/display/include/panel_truly_1080p_video.h
+++ b/dev/gcdb/display/include/panel_truly_1080p_video.h
@@ -302,7 +302,7 @@
 /* Dynamic fps supported frequencies by panel                                */
 /*---------------------------------------------------------------------------*/
 static const struct dfps_panel_info truly_1080p_video_dfps = {
-	1, 3, {48, 54, 60}
+	1, 10, {48, 49, 50, 51, 52, 54, 56, 57, 58, 60}
 };
 
 /*---------------------------------------------------------------------------*/
diff --git a/platform/msm_shared/boot_verifier.c b/platform/msm_shared/boot_verifier.c
index 941bdaf..9c80839 100644
--- a/platform/msm_shared/boot_verifier.c
+++ b/platform/msm_shared/boot_verifier.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -418,6 +418,18 @@
 			// Send hash of key from OEM KEYSTORE + Boot device state
 			n = BN_num_bytes(oem_keystore->mykeybag->mykey->key_material->n);
 			e = BN_num_bytes(oem_keystore->mykeybag->mykey->key_material->e);
+			/*this assumes a valid acceptable range for RSA, including 4096 bits of modulo n. */
+			if (n<0 || n>1024)
+			{
+				dprintf(CRITICAL, "Invalid n value from key_material\n");
+				ASSERT(0);
+			}
+			/* e can assumes 3,5,17,257,65537 as valid values, which should be 1 byte long only, we accept 2 bytes or 16 bits long */
+			if( e < 0 || e >16)
+			{
+				dprintf(CRITICAL, "Invalid e value from key_material\n");
+				ASSERT(0);
+			}
 			len_oem_rsa = n + e;
 			if(!(input = malloc(len_oem_rsa)))
 			{
@@ -440,6 +452,18 @@
 			// Send hash of key from certificate in boot image + boot device state
 			n = BN_num_bytes(rsa_from_cert->n);
 			e = BN_num_bytes(rsa_from_cert->e);
+			/*this assumes a valid acceptable range for RSA, including 4096 bits of modulo n. */
+			if (n<0 || n>1024)
+			{
+				dprintf(CRITICAL, "Invalid n value from rsa_from_cert\n");
+				ASSERT(0);
+			}
+			/* e can assumes 3,5,17,257,65537 as valid values, which should be 1 byte long only, we accept 2 bytes or 16 bits long */
+			if( e < 0 || e >16)
+			{
+				dprintf(CRITICAL, "Invalid e value from rsa_from_cert\n");
+				ASSERT(0);
+			}
 			len_from_cert = n + e;
 			if(!(input = malloc(len_from_cert)))
 			{
diff --git a/platform/msm_shared/flash-ubi.c b/platform/msm_shared/flash-ubi.c
index d9c5cc0..010f61e 100644
--- a/platform/msm_shared/flash-ubi.c
+++ b/platform/msm_shared/flash-ubi.c
@@ -816,7 +816,8 @@
 	int num_pages;
 	int ret;
 	int bad_blocks_cnt = 0;
-	int fmsb_peb = 0;
+	uint32_t fmsb_peb = UINT_MAX;
+	int is_fmsb_peb_valid = 0;
 
 	si = scan_partition(ptn);
 	if (!si) {
@@ -867,8 +868,10 @@
 		else
 			size -= block_size;
 
-		if (fastmap_present(img_peb))
+		if (fastmap_present(img_peb)) {
 			fmsb_peb = curr_peb;
+			is_fmsb_peb_valid = 1;
+		}
 		img_peb += flash_block_size();
 		curr_peb++;
 	}
@@ -891,9 +894,10 @@
 	 * we need to invalidate the flashed fastmap since it isn't accurate
 	 * anymore.
 	 */
-	if (bad_blocks_cnt && fmsb_peb) {
-		dprintf(CRITICAL, "flash_ubi_img: invalidate fmsb\n");
-		ret = ubi_erase_peb(ptn->start + 2, si, ptn->start);
+	if (bad_blocks_cnt && (is_fmsb_peb_valid == 1)) {
+		dprintf(CRITICAL, "flash_ubi_img: invalidate fmsb (fmsb_peb = %u)\n",
+			fmsb_peb);
+		ret = ubi_erase_peb(fmsb_peb, si, ptn->start);
 	}
 
 out:
diff --git a/platform/msm_shared/mipi_dsi_autopll_thulium.c b/platform/msm_shared/mipi_dsi_autopll_thulium.c
index 83354b6..ffb1310 100644
--- a/platform/msm_shared/mipi_dsi_autopll_thulium.c
+++ b/platform/msm_shared/mipi_dsi_autopll_thulium.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -116,10 +116,7 @@
 	pdb->out.plllock_cmp = (uint32_t)pll_comp_val;
 
 	pdb->out.pll_txclk_en = 1;
-	if (board_soc_version() == 0x10000)
-		pdb->out.cmn_ldo_cntrl = 0x1c;
-	else
-		pdb->out.cmn_ldo_cntrl = 0x3c;
+	pdb->out.cmn_ldo_cntrl = 0x3c;
 }
 
 static uint32_t mdss_mdp_pll_kvco_slop(uint32_t vrate)
diff --git a/target/init.c b/target/init.c
index d8d8073..ca64cd1 100644
--- a/target/init.c
+++ b/target/init.c
@@ -274,9 +274,12 @@
 		case MSMGOLD2:
 		case MSMGOLD3:
 		case APQGOLD:
+		case MSMTITANIUM:
+		case APQTITANIUM:
 			config->vib_type = VIB_LRA_TYPE;
 			config->hap_rate_cfg1 = QPNP_HAP_RATE_CFG1_41;
 			config->hap_rate_cfg2 = QPNP_HAP_RATE_CFG2_03;
+			break;
 		default:
 			dprintf(CRITICAL,"Unsupported platform id\n");
 			break;