Merge "target: msm8994: Use chip serial for usb enumberation instead of ufs serial"
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 119ec4e..fcd0ee8 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -55,6 +55,7 @@
 #include <platform/iomap.h>
 #include <boot_device.h>
 #include <boot_verifier.h>
+#include <image_verify.h>
 
 #if DEVICE_TREE
 #include <libfdt.h>
@@ -81,6 +82,14 @@
 void write_device_info_flash(device_info *dev);
 static int aboot_save_boot_hash_mmc(uint32_t image_addr, uint32_t image_size);
 
+/* fastboot command function pointer */
+typedef void (*fastboot_cmd_fn) (const char *, void *, unsigned);
+
+struct fastboot_cmd_desc {
+	char * name;
+	fastboot_cmd_fn cb;
+};
+
 #define EXPAND(NAME) #NAME
 #define TARGET(NAME) EXPAND(NAME)
 
@@ -148,7 +157,7 @@
 /* Assuming unauthorized kernel image by default */
 static int auth_kernel_img = 0;
 
-static device_info device = {DEVICE_MAGIC, 0, 0, 0, 0, 0};
+static device_info device = {DEVICE_MAGIC, 0, 0, 0, 0, {0}};
 
 struct atag_ptbl_entry
 {
@@ -585,7 +594,7 @@
 	uint32_t tags_phys = PA((addr_t)tags);
 	struct kernel64_hdr *kptr = (struct kernel64_hdr*)kernel;
 
-	ramdisk = PA(ramdisk);
+	ramdisk = (void *)PA((addr_t)ramdisk);
 
 	final_cmdline = update_cmdline((const char*)cmdline);
 
@@ -593,7 +602,7 @@
 	dprintf(INFO, "Updating device tree: start\n");
 
 	/* Update the Device Tree */
-	ret = update_device_tree((void *)tags, final_cmdline, ramdisk, ramdisk_size);
+	ret = update_device_tree((void *)tags,(const char *)final_cmdline, ramdisk, ramdisk_size);
 	if(ret)
 	{
 		dprintf(CRITICAL, "ERROR: Updating Device Tree Failed \n");
@@ -606,6 +615,16 @@
 #endif
 
 	free(final_cmdline);
+
+#if VERIFIED_BOOT
+	/* Write protect the device info */
+	if (mmc_write_protect("devinfo", 1))
+	{
+		dprintf(INFO, "Failed to write protect dev info\n");
+		ASSERT(0);
+	}
+#endif
+
 	/* Perform target specific cleanup */
 	target_uninit();
 
@@ -616,7 +635,7 @@
 
 
 	dprintf(INFO, "booting linux @ %p, ramdisk @ %p (%d), tags/device tree @ %p\n",
-		entry, ramdisk, ramdisk_size, tags_phys);
+		entry, ramdisk, ramdisk_size, (void *)tags_phys);
 
 	enter_critical_section();
 
@@ -763,7 +782,7 @@
 	}
 	buf = (char *) memalign(CACHE_LINE, ROUNDUP(page_size, CACHE_LINE));
 	ASSERT(buf);
-	if (mmc_read(offset, (unsigned int *)buf, page_size))
+	if (mmc_read(offset, (uint32_t *)buf, page_size))
 	{
 		dprintf(INFO, "mmc read failure /bootselect %d\n", page_size);
 		free(buf);
@@ -872,7 +891,7 @@
 		}
 	}
 
-	if (mmc_read(ptn + offset, (unsigned int *) buf, page_size)) {
+	if (mmc_read(ptn + offset, (uint32_t *) buf, page_size)) {
 		dprintf(CRITICAL, "ERROR: Cannot read boot image header\n");
                 return -1;
 	}
@@ -896,7 +915,7 @@
 	 * which lives in the second page for arm64 targets.
 	 */
 
-	if (mmc_read(ptn + page_size, (unsigned int *) kbuf, page_size)) {
+	if (mmc_read(ptn + page_size, (uint32_t *) kbuf, page_size)) {
 		dprintf(CRITICAL, "ERROR: Cannot read boot image header\n");
                 return -1;
 	}
@@ -965,7 +984,7 @@
 		dprintf(INFO, "Loading boot image (%d): start\n", imagesize_actual);
 		bs_set_timestamp(BS_KERNEL_LOAD_START);
 
-		if (check_aboot_addr_range_overlap(image_addr, imagesize_actual))
+		if (check_aboot_addr_range_overlap((uint32_t)image_addr, imagesize_actual))
 		{
 			dprintf(CRITICAL, "Boot image buffer address overlaps with aboot addresses.\n");
 			return -1;
@@ -983,7 +1002,7 @@
 
 		offset = imagesize_actual;
 
-		if (check_aboot_addr_range_overlap(image_addr + offset, page_size))
+		if (check_aboot_addr_range_overlap((uint32_t)image_addr + offset, page_size))
 		{
 			dprintf(CRITICAL, "Signature read buffer address overlaps with aboot addresses.\n");
 			return -1;
@@ -996,7 +1015,7 @@
 			return -1;
 		}
 
-		verify_signed_bootimg(image_addr, imagesize_actual);
+		verify_signed_bootimg((uint32_t)image_addr, imagesize_actual);
 
 		/* Move kernel, ramdisk and device tree to correct address */
 		memmove((void*) hdr->kernel_addr, (char *)(image_addr + page_size), hdr->kernel_size);
@@ -1290,7 +1309,7 @@
 			return -1;
 		}
 
-		verify_signed_bootimg(image_addr, imagesize_actual);
+		verify_signed_bootimg((uint32_t)image_addr, imagesize_actual);
 
 		/* Move kernel and ramdisk to correct address */
 		memmove((void*) hdr->kernel_addr, (char *)(image_addr + page_size), hdr->kernel_size);
@@ -1420,7 +1439,12 @@
 	uint32_t blocksize;
 	uint8_t lun = 0;
 
+#if VERIFIED_BOOT
+	index = partition_get_index("devinfo");
+#else
 	index = partition_get_index("aboot");
+#endif
+
 	ptn = partition_get_offset(index);
 	if(ptn == 0)
 	{
@@ -1436,7 +1460,11 @@
 
 	blocksize = mmc_get_device_blocksize();
 
+#if VERIFIED_BOOT
+	if(mmc_write(ptn, blocksize, (void *)info_buf))
+#else
 	if(mmc_write((ptn + size - blocksize), blocksize, (void *)info_buf))
+#endif
 	{
 		dprintf(CRITICAL, "ERROR: Cannot write device info\n");
 		return;
@@ -1451,18 +1479,29 @@
 	int index = INVALID_PTN;
 	uint32_t blocksize;
 
+#if VERIFIED_BOOT
+	index = partition_get_index("devinfo");
+#else
 	index = partition_get_index("aboot");
+#endif
+
 	ptn = partition_get_offset(index);
 	if(ptn == 0)
 	{
 		return;
 	}
 
+	mmc_set_lun(partition_get_lun(index));
+
 	size = partition_get_size(index);
 
 	blocksize = mmc_get_device_blocksize();
 
+#if VERIFIED_BOOT
+	if(mmc_read(ptn, (void *)info_buf, blocksize))
+#else
 	if(mmc_read((ptn + size - blocksize), (void *)info_buf, blocksize))
+#endif
 	{
 		dprintf(CRITICAL, "ERROR: Cannot read device info\n");
 		return;
@@ -1784,7 +1823,7 @@
 		   (void*) hdr->ramdisk_addr, hdr->ramdisk_size);
 }
 
-void cmd_erase(const char *arg, void *data, unsigned sz)
+void cmd_erase_nand(const char *arg, void *data, unsigned sz)
 {
 	struct ptentry *ptn;
 	struct ptable *ptable;
@@ -1811,7 +1850,6 @@
 
 void cmd_erase_mmc(const char *arg, void *data, unsigned sz)
 {
-	BUF_DMA_ALIGN(out, DEFAULT_ERASE_SIZE);
 	unsigned long long ptn = 0;
 	unsigned long long size = 0;
 	int index = INVALID_PTN;
@@ -1846,6 +1884,7 @@
 		return;
 	}
 #else
+	BUF_DMA_ALIGN(out, DEFAULT_ERASE_SIZE);
 	size = partition_get_size(index);
 	if (size > DEFAULT_ERASE_SIZE)
 		size = DEFAULT_ERASE_SIZE;
@@ -1860,6 +1899,13 @@
 	fastboot_okay("");
 }
 
+void cmd_erase(const char *arg, void *data, unsigned sz)
+{
+	if(target_is_emmc_boot())
+		cmd_erase_mmc(arg, data, sz);
+	else
+		cmd_erase_nand(arg, data, sz);
+}
 
 void cmd_flash_mmc_img(const char *arg, void *data, unsigned sz)
 {
@@ -1871,7 +1917,7 @@
 	uint8_t lun = 0;
 	bool lun_set = false;
 
-	token = strtok(arg, ":");
+	token = strtok((char *)arg, ":");
 	pname = token;
 	token = strtok(NULL, ":");
 	if(token)
@@ -1956,7 +2002,7 @@
 	unsigned long long ptn = 0;
 	unsigned long long size = 0;
 	int index = INVALID_PTN;
-	int i;
+	uint32_t i;
 	uint8_t lun = 0;
 
 	index = partition_get_index(arg);
@@ -2213,7 +2259,7 @@
 	return;
 }
 
-void cmd_flash(const char *arg, void *data, unsigned sz)
+void cmd_flash_nand(const char *arg, void *data, unsigned sz)
 {
 	struct ptentry *ptn;
 	struct ptable *ptable;
@@ -2261,6 +2307,14 @@
 	fastboot_okay("");
 }
 
+void cmd_flash(const char *arg, void *data, unsigned sz)
+{
+	if(target_is_emmc_boot())
+		cmd_flash_mmc(arg, data, sz);
+	else
+		cmd_flash_nand(arg, data, sz);
+}
+
 void cmd_continue(const char *arg, void *data, unsigned sz)
 {
 	fastboot_okay("");
@@ -2371,7 +2425,7 @@
 	fastboot_okay("");
 }
 
-static struct fbimage logo_header = {0};
+static struct fbimage logo_header = {{{0}, 0, 0, 0, {0}}, 0};
 struct fbimage* splash_screen_flash();
 
 int splash_screen_check_header(struct fbimage *logo)
@@ -2451,7 +2505,7 @@
 		return NULL;
 	}
 
-	if (mmc_read(ptn, (unsigned int *) logo, sizeof(logo->header))) {
+	if (mmc_read(ptn, (uint32_t *) logo, sizeof(logo->header))) {
 		dprintf(CRITICAL, "ERROR: Cannot read splash image header\n");
 		return NULL;
 	}
@@ -2469,7 +2523,7 @@
 		}
 		uint8_t *base = (uint8_t *) fb_display->base;
 		if (mmc_read(ptn + sizeof(logo->header),
-			base,
+			(uint32_t *)base,
 			((((logo->header.width * logo->header.height * fb_display->bpp/8) + 511) >> 9) << 9))) {
 			fbcon_clear();
 			dprintf(CRITICAL, "ERROR: Cannot read splash image from partition\n");
@@ -2554,32 +2608,37 @@
 /* register commands and variables for fastboot */
 void aboot_fastboot_register_commands(void)
 {
-	if (target_is_emmc_boot())
-	{
-		fastboot_register("flash:", cmd_flash_mmc);
-		fastboot_register("erase:", cmd_erase_mmc);
-	}
-	else
-	{
-		fastboot_register("flash:", cmd_flash);
-		fastboot_register("erase:", cmd_erase);
-	}
+	int i;
 
-	fastboot_register("boot",              cmd_boot);
-	fastboot_register("continue",          cmd_continue);
-	fastboot_register("reboot",            cmd_reboot);
-	fastboot_register("reboot-bootloader", cmd_reboot_bootloader);
-	fastboot_register("oem unlock",        cmd_oem_unlock);
-	fastboot_register("oem lock",          cmd_oem_lock);
-	fastboot_register("oem verified",      cmd_oem_verified);
-	fastboot_register("oem device-info",   cmd_oem_devinfo);
-	fastboot_register("preflash",          cmd_preflash);
-	fastboot_register("oem enable-charger-screen",
-			cmd_oem_enable_charger_screen);
-	fastboot_register("oem disable-charger-screen",
-			cmd_oem_disable_charger_screen);
-	fastboot_register("oem select-display-panel",
-			cmd_oem_select_display_panel);
+	struct fastboot_cmd_desc cmd_list[] = {
+											/* By default the enabled list is empty. */
+											{"", NULL},
+											/* move commands enclosed within the below ifndef to here
+											 * if they need to be enabled in user build.
+											 */
+#ifndef DISABLE_FASTBOOT_CMDS
+											/* Register the following commands only for non-user builds */
+											{"flash:", cmd_flash},
+											{"erase:", cmd_erase},
+											{"boot", cmd_boot},
+											{"continue", cmd_continue},
+											{"reboot", cmd_reboot},
+											{"reboot-bootloader", cmd_reboot_bootloader},
+											{"oem unlock", cmd_oem_unlock},
+											{"oem lock", cmd_oem_lock},
+											{"oem verified", cmd_oem_verified},
+											{"oem device-info", cmd_oem_devinfo},
+											{"preflash", cmd_preflash},
+											{"oem enable-charger-screen", cmd_oem_enable_charger_screen},
+											{"oem disable-charger-screen", cmd_oem_disable_charger_screen},
+											{"oem select-display-panel", cmd_oem_select_display_panel},
+#endif
+										  };
+
+	int fastboot_cmds_count = sizeof(cmd_list)/sizeof(cmd_list[0]);
+	for (i = 1; i < fastboot_cmds_count; i++)
+		fastboot_register(cmd_list[i].name,cmd_list[i].cb);
+
 	/* publish variables and their values */
 	fastboot_publish("product",  TARGET(BOARD));
 	fastboot_publish("kernel",   "lk");
diff --git a/app/aboot/fastboot.c b/app/aboot/fastboot.c
index f905627..4017ec3 100644
--- a/app/aboot/fastboot.c
+++ b/app/aboot/fastboot.c
@@ -287,7 +287,7 @@
 
 	while (len > 0) {
 		xfer = (len > MAX_USBFS_BULK_SIZE) ? MAX_USBFS_BULK_SIZE : len;
-		req->buf = PA((addr_t)buf);
+		req->buf = (unsigned char *)PA((addr_t)buf);
 		req->length = xfer;
 		req->complete = req_complete;
 		r = udc_request_queue(out, req);
@@ -313,7 +313,7 @@
 	 * Force reload of buffer from memory
 	 * since transaction is complete now.
 	 */
-	arch_invalidate_cache_range(_buf, count);
+	arch_invalidate_cache_range((addr_t)_buf, count);
 	return count;
 
 oops:
@@ -333,7 +333,7 @@
 
 	while (len > 0) {
 		xfer = (len > MAX_USBFS_BULK_SIZE) ? MAX_USBFS_BULK_SIZE : len;
-		req->buf = PA((addr_t)_buf);
+		req->buf = (unsigned char *)PA((addr_t)_buf);
 		req->length = xfer;
 		req->complete = req_complete;
 		r = udc_request_queue(in, req);
@@ -372,10 +372,10 @@
 	if (reason == 0)
 		reason = "";
 
-	snprintf(response, MAX_RSP_SIZE, "%s%s", code, reason);
+	snprintf((char *)response, MAX_RSP_SIZE, "%s%s", code, reason);
 	fastboot_state = STATE_COMPLETE;
 
-	usb_if.usb_write(response, strlen(response));
+	usb_if.usb_write(response, strlen((const char *)response));
 
 }
 
@@ -389,9 +389,9 @@
 	if (reason == 0)
 		return;
 
-	snprintf(response, MAX_RSP_SIZE, "INFO%s", reason);
+	snprintf((char *)response, MAX_RSP_SIZE, "INFO%s", reason);
 
-	usb_if.usb_write(response, strlen(response));
+	usb_if.usb_write(response, strlen((const char *)response));
 }
 
 void fastboot_fail(const char *reason)
@@ -429,8 +429,8 @@
 		return;
 	}
 
-	snprintf(response, MAX_RSP_SIZE, "DATA%08x", len);
-	if (usb_if.usb_write(response, strlen(response)) < 0)
+	snprintf((char *)response, MAX_RSP_SIZE, "DATA%08x", len);
+	if (usb_if.usb_write(response, strlen((const char *)response)) < 0)
 		return;
 
 	r = usb_if.usb_read(download_base, len);
diff --git a/app/aboot/recovery.c b/app/aboot/recovery.c
index 3c42902..0c55e9b 100644
--- a/app/aboot/recovery.c
+++ b/app/aboot/recovery.c
@@ -42,6 +42,7 @@
 #include <target.h>
 #include <partition_parser.h>
 #include <mmc.h>
+#include <malloc.h>
 
 #include "recovery.h"
 #include "bootimg.h"
@@ -393,8 +394,9 @@
 	unsigned char data[size];
 	int index = INVALID_PTN;
 
-	index = partition_get_index((unsigned char *) ptn_name);
+	index = partition_get_index((const char *) ptn_name);
 	ptn = partition_get_offset(index);
+	mmc_set_lun(partition_get_lun(index));
 	if(ptn == 0) {
 		dprintf(CRITICAL,"partition %s doesn't exist\n",ptn_name);
 		return -1;
@@ -415,8 +417,9 @@
 	int index = INVALID_PTN;
 
 	size = mmc_get_device_blocksize();
-	index = partition_get_index((unsigned char *) ptn_name);
+	index = partition_get_index((const char *) ptn_name);
 	ptn = partition_get_offset(index);
+	mmc_set_lun(partition_get_lun(index));
 	if(ptn == 0) {
 		dprintf(CRITICAL,"partition %s doesn't exist\n",ptn_name);
 		return -1;
@@ -522,6 +525,8 @@
 		ptn = partition_get_offset(index);
 		ptn_size = partition_get_size(index);
 
+		mmc_set_lun(partition_get_lun(index));
+
 		if (ptn_size < offset + size)
 		{
 			dprintf(CRITICAL, "Read request out of '%s' boundaries\n",
diff --git a/app/rpmbtests/rules.mk b/app/rpmbtests/rules.mk
new file mode 100644
index 0000000..b59dee9
--- /dev/null
+++ b/app/rpmbtests/rules.mk
@@ -0,0 +1,8 @@
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+INCLUDES += -I$(LK_TOP_DIR)/platform/msm_shared/include
+
+DEFINES += ASSERT_ON_TAMPER=1
+
+OBJS += \
+	$(LOCAL_DIR)/ufs_rpmb.o
diff --git a/app/rpmbtests/ufs_rpmb.c b/app/rpmbtests/ufs_rpmb.c
new file mode 100644
index 0000000..7342a82
--- /dev/null
+++ b/app/rpmbtests/ufs_rpmb.c
@@ -0,0 +1,144 @@
+/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <reg.h>
+#include <ufs_hw.h>
+#include <utp.h>
+#include <upiu.h>
+#include <uic.h>
+#include <ucs.h>
+#include <dme.h>
+#include <rpmb.h>
+#include <rand.h>
+#include <string.h>
+#include <stdlib.h>
+#include <endian.h>
+#include <target.h>
+#include "ufs_rpmb.h"
+
+void rpmb_run_test()
+{
+	bool result;
+	uint16_t sector_address = 1, rpmb_num_blocks = 4;
+	void *dev;
+	dev = target_mmc_device();
+	result = rpmb_test((struct ufs_dev *)dev, sector_address, rpmb_num_blocks);
+	if (!result)
+		dprintf(INFO, "RPMB test failed");
+}
+
+int verify_rpmb_frame(struct rpmb_frame *request_frame, struct rpmb_frame *result_frame, int type)
+{
+	int i = 0;
+	if(result_frame->result[0] == MAXED_WR_COUNTER)
+	{
+		dprintf(INFO, "Max write counter value reached\n");
+		return MAXED_WR_COUNTER;
+	}
+	if(result_frame->result[1] != OPERATION_OK)
+	{
+		dprintf(INFO, "RPMB operation error: 0x%x\n", result_frame->result[1]);
+		return result_frame->result[1];
+	}
+	for(i = 0; i < 16; i++)
+	{
+		if(request_frame->nonce[i] != result_frame->nonce[i])
+			return NONCE_MISMATCH;
+	}
+	return OPERATION_OK;
+}
+
+void dump_rpmb_data(struct rpmb_frame *result_frame)
+{
+	int data_counter;
+	for (data_counter = 0; data_counter < 256; data_counter++)
+	{
+		printf("0x%x ", result_frame->data[data_counter]);
+		if ((data_counter + 1) % 16 == 0)
+			printf("\n");
+	}
+	printf("\n");
+}
+
+bool rpmb_test(struct ufs_dev *dev, uint16_t address, uint16_t rpmb_num_blocks)
+{
+	struct rpmb_frame data_frame, result_frame[rpmb_num_blocks];
+	int i = 0, ret;
+	uint32_t response_len = 0;
+	// check if address + sectors requested for read do not exceed total size of rpmb
+	if ((address + rpmb_num_blocks) > dev->rpmb_num_blocks)
+	{
+		dprintf(CRITICAL, "Invalid request to rpmb\n");
+		return false;
+	}
+	memset(&data_frame, 0, sizeof(data_frame));
+	memset(&result_frame, 0, sizeof(result_frame));
+	data_frame.address = BE16(address);
+	data_frame.blockcount = BE16(rpmb_num_blocks);
+	data_frame.requestresponse = BE16(AUTH_READ);
+	for(i = 0 ; i < 16; i++)
+	{
+		data_frame.nonce[i] = (rand() % 256) + 1;
+	}
+#ifdef DEBUG_UFS_RPMB
+	dprintf(INFO, "Dumping RPMB Request frame\n");
+	dprintf(INFO, "--------------------------\n");
+	dump((void *) &data_frame, sizeof(struct rpmb_frame));
+#endif
+	ret = ucs_do_scsi_rpmb_read(dev, (uint32_t *) &data_frame, rpmb_num_blocks,
+                               (uint32_t *) &result_frame, &response_len);
+	if (ret)
+	{
+		dprintf(CRITICAL, "RPMB Read error\n");
+		return false;
+	}
+	for (i = 0; i < rpmb_num_blocks; i++)
+	{
+		ret = verify_rpmb_frame(&data_frame, &result_frame[i], AUTH_READ);
+		if(ret)
+		{
+			dprintf(CRITICAL, "Error in verifying RPMB frame\n");
+			dump((void *) &result_frame[i], sizeof(struct rpmb_frame));
+		}
+	}
+#ifdef DEBUG_UFS_RPMB
+	dprintf(INFO, "Dumping RPMB Response frames\n");
+	dprintf(INFO, "----------------------------\n");
+	dump((void *) &result_frame, sizeof(struct rpmb_frame)*rpmb_num_blocks);
+#endif
+	dprintf(INFO, "Data dump for RPMB read request\n");
+	printf("-------------------------------\n");
+
+	for (i = 0; i < rpmb_num_blocks; i++)
+		dump_rpmb_data((void *) &result_frame[i]);
+
+	printf("-------------------------------\n");
+
+	return true;
+}
diff --git a/app/rpmbtests/ufs_rpmb.h b/app/rpmbtests/ufs_rpmb.h
new file mode 100644
index 0000000..5d16a7b
--- /dev/null
+++ b/app/rpmbtests/ufs_rpmb.h
@@ -0,0 +1,46 @@
+/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+static inline void dump(const void *buff, int count)
+{
+	int i = 0;
+	printf("memory dump of %d bytes from address 0x%x\n",count, buff);
+	for (i = 0; i < count; i++) {
+		unsigned char ch = *(const unsigned char *) buff;
+		printf("0x%02X ", ch);
+		if ((i+1) % 16 == 0)
+			printf("\n");
+		buff = (const char *) buff + 1;
+	}
+	printf("\n");
+}
+
+void rpmb_run_test();
+bool rpmb_test(struct ufs_dev *dev, uint16_t address, uint16_t rpmb_num_blocks);
+void dump_rpmb_data(struct rpmb_frame *result_frame);
+int verify_rpmb_frame(struct rpmb_frame *request_frame, struct rpmb_frame *result_frame, int type);
diff --git a/arch/arm/asm.S b/arch/arm/asm.S
index 97ebc73..39b8dca 100644
--- a/arch/arm/asm.S
+++ b/arch/arm/asm.S
@@ -69,7 +69,7 @@
 FUNCTION(arm_save_mode_regs)
 	mrs		r1, cpsr
 
-#if ARM_ISA_ARMv6
+#if ARM_ISA_ARMv6 || ARM_ISA_ARMV7
 	cps		#0x11			/* fiq */
 	str		r13, [r0], #4
 	str		r14, [r0], #4
diff --git a/arch/arm/cache-ops.S b/arch/arm/cache-ops.S
index a1151ab..22d9a2b 100644
--- a/arch/arm/cache-ops.S
+++ b/arch/arm/cache-ops.S
@@ -313,11 +313,13 @@
 
 	/* void arch_flush_cache_range(addr_t start, size_t len); */
 FUNCTION(arch_clean_cache_range)
+	add 	r2, r0, r1					// Calculate the end address
+	bic 	r0,#(CACHE_LINE-1)			// Align start with cache line
 0:
 	mcr		p15, 0, r0, c7, c10, 1		// clean cache to PoC by MVA
 	add		r0, r0, #CACHE_LINE
-	subs	r1, r1, #CACHE_LINE
-	bhs		0b
+	cmp 	r0, r2
+	blo		0b
 	
 	mov		r0, #0
 	dsb
@@ -326,11 +328,13 @@
 
 	/* void arch_flush_invalidate_cache_range(addr_t start, size_t len); */
 FUNCTION(arch_clean_invalidate_cache_range)
+	add 	r2, r0, r1					// Calculate the end address
+	bic 	r0,#(CACHE_LINE-1)			// Align start with cache line
 0:
 	mcr		p15, 0, r0, c7, c14, 1		// clean & invalidate cache to PoC by MVA
 	add		r0, r0, #CACHE_LINE
-	subs	r1, r1, #CACHE_LINE
-	bhs		0b
+	cmp 	r0, r2
+	blo		0b
 
 	mov		r0, #0
 	dsb
@@ -339,12 +343,14 @@
 
 	/* void arch_invalidate_cache_range(addr_t start, size_t len); */
 FUNCTION(arch_invalidate_cache_range)
-0:
 	/* invalidate cache line */
+	add 	r2, r0, r1					// Calculate the end address
+	bic 	r0,#(CACHE_LINE-1)			// Align start with cache line
+0:
 	mcr		p15, 0, r0, c7, c6, 1
 	add		r0, r0, #CACHE_LINE
-	subs	r1, r1, #CACHE_LINE
-	bhs		0b
+	cmp 	r0, r2
+	blo		0b
 	mov		r0, #0
 	dsb
 	bx		lr
diff --git a/arch/arm/faults.c b/arch/arm/faults.c
index 020266a..1b412ac 100644
--- a/arch/arm/faults.c
+++ b/arch/arm/faults.c
@@ -24,7 +24,7 @@
 #include <arch/arm.h>
 #include <kernel/thread.h>
 
-static void dump_fault_frame(struct arm_fault_frame *frame)
+void dump_fault_frame(struct arm_fault_frame *frame)
 {
 	dprintf(CRITICAL, "r0  0x%08x r1  0x%08x r2  0x%08x r3  0x%08x\n", frame->r[0], frame->r[1], frame->r[2], frame->r[3]);
 	dprintf(CRITICAL, "r4  0x%08x r5  0x%08x r6  0x%08x r7  0x%08x\n", frame->r[4], frame->r[5], frame->r[6], frame->r[7]);
diff --git a/arch/arm/mmu.c b/arch/arm/mmu.c
index 2027b41..d50c43a 100644
--- a/arch/arm/mmu.c
+++ b/arch/arm/mmu.c
@@ -27,6 +27,7 @@
 #include <arch/arm.h>
 #include <arch/defines.h>
 #include <arch/arm/mmu.h>
+#include <platform.h>
 
 #if ARM_WITH_MMU
 
diff --git a/dev/fbcon/fbcon.c b/dev/fbcon/fbcon.c
index 1fa8bd5..a593a62 100644
--- a/dev/fbcon/fbcon.c
+++ b/dev/fbcon/fbcon.c
@@ -2,7 +2,7 @@
  * Copyright (c) 2008, Google Inc.
  * All rights reserved.
  *
- * Copyright (c) 2009-2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2009-2014, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -223,8 +223,8 @@
 	if(!fbimg) {
 		flag = false;
 		fbimg = &default_fbimg;
-		fbimg->header.width = SPLASH_IMAGE_HEIGHT;
-		fbimg->header.height = SPLASH_IMAGE_WIDTH;
+		fbimg->header.width = SPLASH_IMAGE_WIDTH;
+		fbimg->header.height = SPLASH_IMAGE_HEIGHT;
 #if DISPLAY_TYPE_MIPI
 		fbimg->image = (unsigned char *)imageBuffer_rgb888;
 #else
@@ -304,15 +304,19 @@
 #endif
 
 #else
-    if (bytes_per_bpp == 2)
-    {
-        for (i = 0; i < header->width; i++)
-        {
-            memcpy (config->base + ((image_base + (i * (config->width))) * bytes_per_bpp),
-		   fbimg->image + (i * header->height * bytes_per_bpp),
-		   header->height * bytes_per_bpp);
-        }
-    }
-    fbcon_flush();
+	if (bytes_per_bpp == 2)
+	{
+		image_base = ((((total_y/2) - (height / 2) ) *
+				(config->width)) + (total_x/2 - (width / 2)));
+
+		for (i = 0; i < header->width; i++)
+		{
+			memcpy (config->base +
+				((image_base + (i * (config->width))) * bytes_per_bpp),
+				(fbimg->image + (i * header->height * bytes_per_bpp)),
+				(header->height * bytes_per_bpp));
+		}
+	}
+	fbcon_flush();
 #endif
 }
diff --git a/dev/gcdb/display/gcdb_autopll.c b/dev/gcdb/display/gcdb_autopll.c
index e2e497f..cff176f 100755
--- a/dev/gcdb/display/gcdb_autopll.c
+++ b/dev/gcdb/display/gcdb_autopll.c
@@ -144,7 +144,7 @@
 {
 	uint32_t refclk = 19200000;
 	uint32_t vco_rate = pll_data.vco_clock;
-	uint32_t tmp, mod;
+	uint32_t tmp;
 
 	vco_rate /= 2;
 	pll_data.dec_start = vco_rate / refclk;
@@ -157,16 +157,13 @@
 	pll_data.frac_start = tmp;
 
 	vco_rate *= 2; /* restore */
-	tmp = vco_rate / refclk;/* div 1000 first */
-	mod = vco_rate % refclk;
-	tmp *= 127;
-	mod *= 127;
-	mod /= refclk;
-	tmp += mod;
+	tmp = vco_rate / (refclk / 1000);/* div 1000 first */
+	tmp *= 1024;
+	tmp /= 1000;
 	tmp /= 10;
-	pll_data.lock_comp = tmp;
+	pll_data.lock_comp = tmp - 1;
 
-	dprintf(SPEW, "%s: dec_start=%u dec_frac=%u lock_comp=%u\n", __func__,
+	dprintf(SPEW, "%s: dec_start=0x%x dec_frac=0x%x lock_comp=0x%x\n", __func__,
 		pll_data.dec_start, pll_data.frac_start, pll_data.lock_comp);
 }
 
diff --git a/dev/gcdb/display/gcdb_autopll.h b/dev/gcdb/display/gcdb_autopll.h
index ee0070d..b261a34 100755
--- a/dev/gcdb/display/gcdb_autopll.h
+++ b/dev/gcdb/display/gcdb_autopll.h
@@ -43,8 +43,8 @@
 #define HALFBIT_CLOCK3 44000000  /* VCO min clock div by 8 */
 #define HALFBIT_CLOCK4 40000000  /* VCO min clock div by 9 */
 
-#define VCO_MIN_CLOCK_20NM 	1000000000
-#define VCO_MAX_CLOCK_20NM 	2000000000
+#define VCO_MIN_CLOCK_20NM 	300000000
+#define VCO_MAX_CLOCK_20NM 	1500000000
 
 #define HALF_VCO_MIN_CLOCK_20NM (VCO_MIN_CLOCK_20NM >> 1)
 
diff --git a/dev/gcdb/display/gcdb_display.c b/dev/gcdb/display/gcdb_display.c
index 5a060c4..2066e4d 100755
--- a/dev/gcdb/display/gcdb_display.c
+++ b/dev/gcdb/display/gcdb_display.c
@@ -160,6 +160,33 @@
 	return ret;
 }
 
+static bool mdss_dsi_set_panel_node(char *panel_name, char **dsi_id,
+		char **panel_node, char **slave_panel_node, int *panel_mode)
+{
+	if (!strcmp(panel_name, SIM_VIDEO_PANEL)) {
+		*dsi_id = SIM_DSI_ID;
+		*panel_node = SIM_VIDEO_PANEL_NODE;
+		*panel_mode = 0;
+	} else if (!strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL)) {
+		*dsi_id = SIM_DSI_ID;
+		*panel_node = SIM_DUALDSI_VIDEO_PANEL_NODE;
+		*slave_panel_node = SIM_DUALDSI_VIDEO_SLAVE_PANEL_NODE;
+		*panel_mode = 1;
+	} else if (!strcmp(panel_name, SIM_CMD_PANEL)) {
+		*dsi_id = SIM_DSI_ID;
+		*panel_node = SIM_CMD_PANEL_NODE;
+		*panel_mode = 0;
+	} else if (!strcmp(panel_name, SIM_DUALDSI_CMD_PANEL)) {
+		*dsi_id = SIM_DSI_ID;
+		*panel_node = SIM_DUALDSI_CMD_PANEL_NODE;
+		*slave_panel_node = SIM_DUALDSI_CMD_SLAVE_PANEL_NODE;
+		*panel_mode = 1;
+	} else {
+		return false;
+	}
+	return true;
+}
+
 bool gcdb_display_cmdline_arg(char *panel_name, char *pbuf, uint16_t buf_size)
 {
 	char *dsi_id = NULL;
@@ -168,43 +195,43 @@
 	uint16_t dsi_id_len = 0, panel_node_len = 0, slave_panel_node_len = 0;
 	uint32_t arg_size = 0;
 	bool ret = true;
+	bool rc;
 	char *default_str;
 	int panel_mode = SPLIT_DISPLAY_FLAG | DUAL_PIPE_FLAG | DST_SPLIT_FLAG;
 	int prefix_string_len = strlen(DISPLAY_CMDLINE_PREFIX);
 
-	if (!strcmp(panel_name, SIM_VIDEO_PANEL)) {
-		dsi_id = SIM_DSI_ID;
-		panel_mode = 0;
-		panel_node = SIM_VIDEO_PANEL_NODE;
-	}  else if (!strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL)) {
-		dsi_id = SIM_DSI_ID;
-		panel_mode = 1;
-		panel_node = SIM_DUALDSI_VIDEO_PANEL_NODE;
-		slave_panel_node = SIM_DUALDSI_VIDEO_SLAVE_PANEL_NODE;
-	} else if (panelstruct.paneldata && target_cont_splash_screen()) {
-		dsi_id = panelstruct.paneldata->panel_controller;
-		panel_node = panelstruct.paneldata->panel_node_id;
-		panel_mode = panelstruct.paneldata->panel_operating_mode &
-							panel_mode;
-		slave_panel_node = panelstruct.paneldata->slave_panel_node_id;
-	} else {
-		if (target_is_edp())
-			default_str = "0:edp:";
-		else
-			default_str = "0:dsi:0:";
+	panel_name += strspn(panel_name, " ");
 
-		arg_size = prefix_string_len + strlen(default_str);
-		if (buf_size < arg_size) {
-			dprintf(CRITICAL, "display command line buffer is small\n");
-			return false;
+	rc = mdss_dsi_set_panel_node(panel_name, &dsi_id, &panel_node,
+			&slave_panel_node, &panel_mode);
+	if (!rc) {
+		if (panelstruct.paneldata && target_cont_splash_screen()) {
+			dsi_id = panelstruct.paneldata->panel_controller;
+			panel_node = panelstruct.paneldata->panel_node_id;
+			panel_mode =
+				panelstruct.paneldata->panel_operating_mode &
+								panel_mode;
+			slave_panel_node =
+				panelstruct.paneldata->slave_panel_node_id;
+		} else {
+			if (target_is_edp())
+				default_str = "0:edp:";
+			else
+				default_str = "0:dsi:0:";
+
+			arg_size = prefix_string_len + strlen(default_str);
+			if (buf_size < arg_size) {
+				dprintf(CRITICAL, "display command line buffer is small\n");
+				return false;
+			}
+
+			strlcpy(pbuf, DISPLAY_CMDLINE_PREFIX, buf_size);
+			pbuf += prefix_string_len;
+			buf_size -= prefix_string_len;
+
+			strlcpy(pbuf, default_str, buf_size);
+			return true;
 		}
-
-		strlcpy(pbuf, DISPLAY_CMDLINE_PREFIX, buf_size);
-		pbuf += prefix_string_len;
-		buf_size -= prefix_string_len;
-
-		strlcpy(pbuf, default_str, buf_size);
-		return true;
 	}
 
 	if (dsi_id == NULL || panel_node == NULL) {
@@ -212,7 +239,8 @@
 		return false;
 	}
 
-	if (panel_mode && slave_panel_node == NULL) {
+	if (((panel_mode & SPLIT_DISPLAY_FLAG) ||
+	     (panel_mode & DST_SPLIT_FLAG)) && slave_panel_node == NULL) {
 		dprintf(CRITICAL, "slave node not present in dual dsi case\n");
 		return false;
 	}
diff --git a/dev/gcdb/display/include/display_resource.h b/dev/gcdb/display/include/display_resource.h
index ce95769..ca392ff 100755
--- a/dev/gcdb/display/include/display_resource.h
+++ b/dev/gcdb/display/include/display_resource.h
@@ -45,11 +45,16 @@
 #define NO_PANEL_CONFIG "none"
 #define SIM_VIDEO_PANEL "sim_video_panel"
 #define SIM_DUALDSI_VIDEO_PANEL "sim_dualdsi_video_panel"
+#define SIM_CMD_PANEL "sim_cmd_panel"
+#define SIM_DUALDSI_CMD_PANEL "sim_dualdsi_cmd_panel"
 
 #define SIM_DSI_ID "dsi:0:"
 #define SIM_VIDEO_PANEL_NODE "qcom,mdss_dsi_sim_video"
 #define SIM_DUALDSI_VIDEO_PANEL_NODE "qcom,mdss_dsi_sim_video_0"
 #define SIM_DUALDSI_VIDEO_SLAVE_PANEL_NODE "qcom,mdss_dsi_sim_video_1"
+#define SIM_CMD_PANEL_NODE "qcom,mdss_dsi_sim_cmd"
+#define SIM_DUALDSI_CMD_PANEL_NODE "qcom,mdss_dsi_sim_cmd_0"
+#define SIM_DUALDSI_CMD_SLAVE_PANEL_NODE "qcom,mdss_dsi_sim_cmd_1"
 
 /*---------------------------------------------------------------------------*/
 /* Structure definition                                                      */
diff --git a/dev/gcdb/display/include/panel_hx8379a_fwvga_skua_video.h b/dev/gcdb/display/include/panel_hx8379a_fwvga_skua_video.h
new file mode 100644
index 0000000..f4b5ff5
--- /dev/null
+++ b/dev/gcdb/display/include/panel_hx8379a_fwvga_skua_video.h
@@ -0,0 +1,246 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+
+#ifndef _PANEL_HX8379A_FWVGA_SKUA_VIDEO_H_
+#define _PANEL_HX8379A_FWVGA_SKUA_VIDEO_H_
+/*---------------------------------------------------------------------------*/
+/* HEADER files                                                              */
+/*---------------------------------------------------------------------------*/
+#include "panel.h"
+
+/*---------------------------------------------------------------------------*/
+/* Panel configuration                                                       */
+/*---------------------------------------------------------------------------*/
+static struct panel_config hx8379a_fwvga_skua_video_panel_data = {
+	"qcom,mdss_dsi_hx8379a_fwvga_skua_video", "dsi:0:", "qcom,mdss-dsi-panel",
+	10, 0, "DISPLAY_1", 0, 0, 60, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel resolution                                                          */
+/*---------------------------------------------------------------------------*/
+static struct panel_resolution hx8379a_fwvga_skua_video_panel_res = {
+	480, 854, 100, 94, 40, 0, 6, 4, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel color information                                                   */
+/*---------------------------------------------------------------------------*/
+static struct color_info hx8379a_fwvga_skua_video_color = {
+	24, 0, 0xff, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel on/off command information                                          */
+/*---------------------------------------------------------------------------*/
+static char hx8379a_fwvga_video_on_cmd0[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB9, 0xFF, 0x83, 0x79,
+};
+
+static char hx8379a_fwvga_video_on_cmd1[] = {
+	0x03, 0x00, 0x39, 0xC0,
+	0xBA, 0x51, 0x93, 0xFF,
+};
+
+static char hx8379a_fwvga_video_on_cmd2[] = {
+	0x14, 0x00, 0x39, 0xC0,
+	0xB1, 0x00, 0x50, 0x24,
+	0xEA, 0x51, 0x08, 0x11,
+	0x10, 0xF0, 0x27, 0x2F,
+	0x9A, 0x1A, 0x42, 0x0B,
+	0x7A, 0xF1, 0x00, 0xE6,
+};
+
+static char hx8379a_fwvga_video_on_cmd3[] = {//modified
+	0x0E, 0x00, 0x39, 0xC0,
+	0xB2, 0x00, 0x00, 0xFE,
+	0x06, 0x06, 0x19, 0x44,
+	0x00, 0xFF, 0x07, 0x03,
+	0x19, 0x20, 0xFF, 0xFF,
+};
+
+static char hx8379a_fwvga_video_on_cmd4[] = {//modified
+	0x20, 0x00, 0x39, 0xC0,
+	0xB4, 0x80, 0x08, 0x00,
+	0x32, 0x10, 0x03, 0x32,
+	0x13, 0x70, 0x32, 0x10,
+	0x08, 0x37, 0x01, 0x28,
+	0x07, 0x37, 0x08, 0x2D,
+	0x08, 0x35, 0x46, 0x06,
+	0x00, 0x40, 0x08, 0x28,
+	0x08, 0x30, 0x30, 0x04,
+};
+
+static char hx8379a_fwvga_video_on_cmd5[] = {
+	0xcc, 0x02, 0x23, 0x80
+};
+
+static char hx8379a_fwvga_video_on_cmd6[] = {
+	0x30, 0x00, 0x39, 0xC0,
+	0xD5, 0x00, 0x00, 0x0A,
+	0x00, 0x01, 0x05, 0x00,
+	0x03, 0x00, 0x88, 0x88,
+	0x88, 0x88, 0x23, 0x01,
+	0x67, 0x45, 0x02, 0x13,
+	0x88, 0x88, 0x88, 0x88,
+	0x88, 0x88, 0x88, 0x88,
+	0x88, 0x88, 0x54, 0x76,
+	0x10, 0x32, 0x31, 0x20,
+	0x88, 0x88, 0x88, 0x88,
+	0x88, 0x88, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00,
+};
+
+
+static char hx8379a_fwvga_video_on_cmd7[] = {
+	0x24, 0x00, 0x39, 0xC0,
+	0xE0, 0x79, 0x00, 0x0F,
+	0x14, 0x22, 0x22, 0x39,
+	0x2F, 0x43, 0x04, 0x0A,
+	0x12, 0x14, 0x17, 0x15,
+	0x16, 0x12, 0x16, 0x00,
+	0x0F, 0x14, 0x22, 0x22,
+	0x39, 0x2F, 0x43, 0x04,
+	0x0A, 0x12, 0x14, 0x17,
+	0x15, 0x16, 0x12, 0x16,
+};
+
+static char hx8379a_fwvga_video_on_cmd8[] = { //modified
+	0x05, 0x00, 0x39, 0xC0,
+	0xB6, 0x00, 0xA5, 0x00,
+	0xA5, 0xFF, 0xFF, 0xFF,
+};
+
+static char hx8379a_fwvga_video_on_cmd9[] = {
+	0x11, 0x00, 0x05, 0x80
+};
+
+static char hx8379a_fwvga_video_on_cmd10[] = {
+	0x29, 0x00, 0x05, 0x80
+};
+
+
+static struct mipi_dsi_cmd hx8379a_fwvga_skua_video_on_command[] = {
+	{0x8, hx8379a_fwvga_video_on_cmd0, 0x00},
+	{0x8, hx8379a_fwvga_video_on_cmd1, 0x00},
+	{0x18, hx8379a_fwvga_video_on_cmd2, 0x00},
+	{0x14, hx8379a_fwvga_video_on_cmd3, 0x00},
+	{0x24, hx8379a_fwvga_video_on_cmd4, 0x00},
+	{0x04, hx8379a_fwvga_video_on_cmd5, 0x00},
+	{0x34, hx8379a_fwvga_video_on_cmd6, 0x00},
+	{0x28, hx8379a_fwvga_video_on_cmd7, 0x00},
+	{0xc, hx8379a_fwvga_video_on_cmd8, 0x00},
+	{0x4, hx8379a_fwvga_video_on_cmd9, 0x96},
+	{0x4, hx8379a_fwvga_video_on_cmd10, 0x78}
+};
+
+#define HX8379A_FWVGA_SKUA_VIDEO_ON_COMMAND 11
+
+
+static char hx8379a_fwvga_skua_videooff_cmd0[] = {
+	0x28, 0x00, 0x05, 0x80
+};
+
+static char hx8379a_fwvga_skua_videooff_cmd1[] = {
+	0x10, 0x00, 0x05, 0x80
+};
+
+static struct mipi_dsi_cmd hx8379a_fwvga_skua_video_off_command[] = {
+	{0x4, hx8379a_fwvga_skua_videooff_cmd0, 0x32},
+	{0x4, hx8379a_fwvga_skua_videooff_cmd1, 0x78}
+};
+
+#define HX8379A_FWVGA_SKUA_VIDEO_OFF_COMMAND 2
+
+
+static struct command_state hx8379a_fwvga_skua_video_state = {
+	0, 1
+};
+
+/*---------------------------------------------------------------------------*/
+/* Command mode panel information                                            */
+/*---------------------------------------------------------------------------*/
+static struct commandpanel_info hx8379a_fwvga_skua_video_command_panel = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Video mode panel information                                              */
+/*---------------------------------------------------------------------------*/
+static struct videopanel_info hx8379a_fwvga_skua_video_video_panel = {
+	1, 0, 0, 0, 1, 1, 2, 0, 0x9
+};
+
+/*---------------------------------------------------------------------------*/
+/* Lane configuration                                                        */
+/*---------------------------------------------------------------------------*/
+static struct lane_configuration hx8379a_fwvga_skua_video_lane_config = {
+	2, 0, 1, 1, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel timing                                                              */
+/*---------------------------------------------------------------------------*/
+static const uint32_t hx8379a_fwvga_skua_video_timings[] = {
+	0x70, 0x23, 0x1C, 0x00, 0x36, 0x36, 0x10, 0x25, 0x2C, 0x03, 0x04, 0x00
+};
+
+static struct mipi_dsi_cmd hx8379a_fwvga_skua_video_rotation[] = {
+
+};
+#define HX8379A_FWVGA_SKUA_VIDEO_ROTATION 0
+
+static struct panel_timing hx8379a_fwvga_skua_video_timing_info = {
+	0, 4, 0x1F, 0x2C
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel reset sequence                                                      */
+/*---------------------------------------------------------------------------*/
+static struct panel_reset_sequence hx8379a_fwvga_skua_video_reset_seq = {
+	{1, 0, 1, }, {20, 20, 20, }, 2
+};
+
+/*---------------------------------------------------------------------------*/
+/* Backlight setting                                                         */
+/*---------------------------------------------------------------------------*/
+static struct backlight hx8379a_fwvga_skua_video_backlight = {
+	1, 1, 4095, 100, 1, "PMIC_8941"
+};
+
+#define HX8379A_FWVGA_SKUA_VIDEO_SIGNATURE 0xFFFF
+
+#endif /*_PANEL_HX8379A_FWVGA_SKUA_VIDEO_H_*/
diff --git a/dev/gcdb/display/include/panel_sharp_wqxga_dualdsi_video.h b/dev/gcdb/display/include/panel_sharp_wqxga_dualdsi_video.h
index 3704222..2fccf8c 100644
--- a/dev/gcdb/display/include/panel_sharp_wqxga_dualdsi_video.h
+++ b/dev/gcdb/display/include/panel_sharp_wqxga_dualdsi_video.h
@@ -76,7 +76,7 @@
 
 static struct mipi_dsi_cmd sharp_wqxga_dualdsi_video_on_command[] = {
 	{0x4, sharp_wqxga_dualdsi_video_on_cmd0, 0x0a},
-	{0x4, sharp_wqxga_dualdsi_video_on_cmd1, 0x0a}
+	{0x4, sharp_wqxga_dualdsi_video_on_cmd1, 0x02}
 };
 
 #define SHARP_WQXGA_DUALDSI_VIDEO_ON_COMMAND 2
@@ -137,7 +137,7 @@
 /* Panel reset sequence                                                      */
 /*---------------------------------------------------------------------------*/
 static struct panel_reset_sequence sharp_wqxga_dualdsi_video_reset_seq = {
-	{1, 0, 1, }, {10, 10, 120, }, 2
+	{1, 0, 1, }, {2, 5, 120, }, 2
 };
 
 /*---------------------------------------------------------------------------*/
diff --git a/dev/gcdb/display/panel_display.c b/dev/gcdb/display/panel_display.c
index 9734574..c09da68 100755
--- a/dev/gcdb/display/panel_display.c
+++ b/dev/gcdb/display/panel_display.c
@@ -63,10 +63,18 @@
 	pinfo->lcdc.v_front_porch = pstruct->panelres->vfront_porch;
 	pinfo->lcdc.v_pulse_width = pstruct->panelres->vpulse_width;
 	pinfo->lcdc.hsync_skew = pstruct->panelres->hsync_skew;
-	pinfo->lcdc.xres_pad = pstruct->panelres->hleft_border +
-				pstruct->panelres->hright_border;
-	pinfo->lcdc.yres_pad = pstruct->panelres->vtop_border +
-				 pstruct->panelres->vbottom_border;
+
+	pinfo->border_top = pstruct->panelres->vtop_border;
+	pinfo->border_bottom = pstruct->panelres->vbottom_border;
+	pinfo->border_left = pstruct->panelres->hleft_border;
+	pinfo->border_right = pstruct->panelres->hright_border;
+
+	dprintf(SPEW, "%s: left=%d right=%d top=%d bottom=%d\n", __func__,
+			pinfo->border_left, pinfo->border_right,
+			pinfo->border_top, pinfo->border_bottom);
+
+	pinfo->xres += (pinfo->border_left + pinfo->border_right);
+	pinfo->yres += (pinfo->border_top + pinfo->border_bottom);
 
 	if (pstruct->paneldata->panel_operating_mode & DUAL_PIPE_FLAG)
 		pinfo->lcdc.dual_pipe = 1;
diff --git a/dev/gcdb/display/panel_display.h b/dev/gcdb/display/panel_display.h
index dcc5631..3c99289 100755
--- a/dev/gcdb/display/panel_display.h
+++ b/dev/gcdb/display/panel_display.h
@@ -39,6 +39,7 @@
 #define BPP_24 24
 
 #define TIMING_SIZE 48
+#define REGULATOR_SIZE 28
 
 #define DUAL_DSI_FLAG 0x1
 #define DUAL_PIPE_FLAG 0x2
diff --git a/dev/pmic/pm8x41/pm8x41.c b/dev/pmic/pm8x41/pm8x41.c
index 9315f72..328d21d 100644
--- a/dev/pmic/pm8x41/pm8x41.c
+++ b/dev/pmic/pm8x41/pm8x41.c
@@ -37,11 +37,10 @@
 
 static uint8_t mpp_slave_id;
 
-uint8_t pmi8994_config_mpp_slave_id(uint8_t slave_id)
+void pmi8994_config_mpp_slave_id(uint8_t slave_id)
 {
 	mpp_slave_id = slave_id;
 }
-
 /* SPMI helper functions */
 uint8_t pm8x41_reg_read(uint32_t addr)
 {
diff --git a/include/debug.h b/include/debug.h
index bcf73c5..d4bce54 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -64,6 +64,8 @@
 /* systemwide halts */
 void halt(void);
 
+void dump_frame(void *frame);
+
 void _panic(void *caller, const char *fmt, ...) __PRINTFLIKE(2, 3);
 #define panic(x...) _panic(__GET_CALLER(), x)
 
diff --git a/include/dev/gpio.h b/include/dev/gpio.h
index 6e1bce8..50386e9 100644
--- a/include/dev/gpio.h
+++ b/include/dev/gpio.h
@@ -2,6 +2,8 @@
  * Copyright (c) 2008, Google Inc.
  * All rights reserved.
  *
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -26,6 +28,8 @@
  * SUCH DAMAGE.
  */
 
+#include <platform/gpio.h>
+
 #ifndef __DEV_GPIO_H
 #define __DEV_GPIO_H
 
diff --git a/include/platform.h b/include/platform.h
index b427b04..a76c68b 100644
--- a/include/platform.h
+++ b/include/platform.h
@@ -44,6 +44,7 @@
 void platform_init_mmu_mappings(void);
 addr_t platform_get_virt_to_phys_mapping(addr_t virt_addr);
 addr_t platform_get_phys_to_virt_mapping(addr_t phys_addr);
+addr_t get_bs_info_addr(void);
 
 void display_init(void);
 void display_shutdown(void);
@@ -56,4 +57,7 @@
 void reboot_device(unsigned);
 int set_download_mode(enum dload_mode mode);
 uint32_t platform_get_smem_base_addr();
+uint32_t platform_get_sclk_count(void);
+void clock_config_cdc(uint32_t interface);
+int platform_is_msm8939();
 #endif
diff --git a/include/stdio.h b/include/stdio.h
index ebabfca..5052636 100644
--- a/include/stdio.h
+++ b/include/stdio.h
@@ -4,9 +4,21 @@
 #include <debug.h>
 #include <printf.h>
 
+typedef struct {
+	char *fpos; /* Current position of file pointer (absolute address) */
+	void *base; /* Pointer to the base of the file */
+	unsigned short handle; /* File handle */
+	short flags; /* Flags (see FileFlags) */
+	short unget; /* 1-byte buffer for ungetc (b15=1 if non-empty) */
+	unsigned long alloc; /* Number of currently allocated bytes for the file */
+	unsigned short buffincrement; /* Number of bytes allocated at once */
+} FILE;
+
 void putc(char c);
 int puts(const char *str);
 int getc(char *c); // XXX not really getc
+size_t fwrite(const void *buf, size_t size, size_t count, FILE *stream);
+int sscanf(const char *str, const char *format, ...);
 
 #endif
 
diff --git a/include/stdlib.h b/include/stdlib.h
index 5c5145a..4db77fa 100644
--- a/include/stdlib.h
+++ b/include/stdlib.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2008 Travis Geiselbrecht
  *
- * Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2014 The Linux Foundation. All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining
  * a copy of this software and associated documentation files
@@ -39,6 +39,9 @@
 long atol(const char *num);
 unsigned long atoul(const char *num);
 int itoa(int num, unsigned char* str, int len, int base);
+long int strtol(const char *nptr, char **endptr, int base);
+char *getenv(const char *atypeofinformation);
+void qsort(void *buf, size_t num, size_t size, int (*compare) (const void *, const void *));
 
 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
 #define MAX(a, b) (((a) > (b)) ? (a) : (b))
diff --git a/include/target.h b/include/target.h
index 16a4268..055634b 100644
--- a/include/target.h
+++ b/include/target.h
@@ -25,7 +25,6 @@
 #ifndef __TARGET_H
 #define __TARGET_H
 
-
 /* Target helper functions exposed to USB driver */
 typedef struct {
 	void (*mux_config) ();
@@ -76,4 +75,12 @@
 uint32_t target_hw_interposer();
 uint32_t target_override_pll();
 uint32_t target_ddr_cfg_val();
+void target_usb_init(void);
+void target_usb_stop(void);
+uint32_t target_get_hlos_subtype(void);
+void shutdown_device();
+bool target_warm_boot(void);
+bool target_use_signed_kernel(void);
+int _emmc_recovery_init(void);
+void ulpi_write(unsigned val, unsigned reg);
 #endif
diff --git a/kernel/thread.c b/kernel/thread.c
index 58dff8d..2c205ee 100644
--- a/kernel/thread.c
+++ b/kernel/thread.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2008-2009 Travis Geiselbrecht
  *
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
  * Permission is hereby granted, free of charge, to any person obtaining
  * a copy of this software and associated documentation files
  * (the "Software"), to deal in the Software without restriction,
@@ -262,6 +264,7 @@
 	thread_resched();
 
 	panic("somehow fell through thread_exit()\n");
+	for(;;);
 }
 
 static void idle_thread_routine(void)
diff --git a/kernel/timer.c b/kernel/timer.c
index dd5cf9f..9a472f5 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2008-2009 Travis Geiselbrecht
  *
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
  * Permission is hereby granted, free of charge, to any person obtaining
  * a copy of this software and associated documentation files
  * (the "Software"), to deal in the Software without restriction,
@@ -264,7 +266,8 @@
 #endif
 
 	// XXX fix this, should return ret
-	return INT_RESCHEDULE;
+	ret = INT_RESCHEDULE;
+	return ret;
 }
 
 void timer_init(void)
diff --git a/lib/debug/debug.c b/lib/debug/debug.c
index 84d0678..f239bbe 100644
--- a/lib/debug/debug.c
+++ b/lib/debug/debug.c
@@ -35,6 +35,9 @@
 #include <kernel/thread.h>
 #include <kernel/timer.h>
 #include <rand.h>
+#if ARCH_ARM
+#include <arch/arm.h>
+#endif
 
 void __attribute__ ((noreturn))
 __stack_chk_fail (void)
@@ -56,8 +59,19 @@
 	platform_halt();
 }
 
+void dump_frame(void *frame)
+{
+	enter_critical_section(); // disable ints
+#if ARCH_ARM
+	dump_fault_frame((struct arm_fault_frame *)frame);
+#endif
+	exit_critical_section(); // disable ints
+}
+
 void _panic(void *caller, const char *fmt, ...)
 {
+	dprintf(ALWAYS, "panic (frame %p): \n", __GET_FRAME());
+	dump_frame(__GET_FRAME());
 	dprintf(ALWAYS, "panic (caller %p): ", caller);
 
 	va_list ap;
diff --git a/makefile b/makefile
index 0cf7e7c..1056726 100644
--- a/makefile
+++ b/makefile
@@ -60,6 +60,10 @@
   CFLAGS += -D_SIGNED_KERNEL=1
 endif
 
+ifeq ($(TARGET_BUILD_VARIANT),user)
+  CFLAGS += -DDISABLE_FASTBOOT_CMDS=1
+endif
+
 # setup toolchain prefix
 TOOLCHAIN_PREFIX ?= arm-eabi-
 CFLAGS += -fstack-protector-all
diff --git a/platform/fsm9010/include/platform/iomap.h b/platform/fsm9010/include/platform/iomap.h
index 65f46fa..fca1800 100644
--- a/platform/fsm9010/include/platform/iomap.h
+++ b/platform/fsm9010/include/platform/iomap.h
@@ -35,7 +35,7 @@
 #define SDRAM_START_ADDR            0x00000000
 #define SDRAM_SEC_BANK_START_ADDR   0x10000000
 
-#define MSM_SHARED_BASE             0x0FA00000
+#define MSM_SHARED_BASE             0x13600000
 
 #define RPM_MSG_RAM_BASE            0xFC42B000
 #define SYSTEM_IMEM_BASE            0xFE800000
diff --git a/platform/init.c b/platform/init.c
index 412184e..095f6e2 100644
--- a/platform/init.c
+++ b/platform/init.c
@@ -97,7 +97,7 @@
 
 __WEAK addr_t get_bs_info_addr()
 {
-	return NULL;
+	return 0;
 }
 
 __WEAK uint32_t platform_get_sclk_count(void)
@@ -105,8 +105,9 @@
 	return 0;
 }
 
-__WEAK void clock_config_cdc(uint8_t slot)
+__WEAK void clock_config_cdc(uint32_t slot)
 {
+
 }
 
 __WEAK int get_target_boot_params(const char *cmdline, const char *part,
diff --git a/platform/mdm9x35/include/platform/iomap.h b/platform/mdm9x35/include/platform/iomap.h
index 9628da5..feff1a1 100755
--- a/platform/mdm9x35/include/platform/iomap.h
+++ b/platform/mdm9x35/include/platform/iomap.h
@@ -170,4 +170,8 @@
 #define PERIPH_SS_AHB2PHY_TOP_CFG            0xF9B3E010
 
 #define PLATFORM_QMP_OFFSET                  0x0
+
+/* QPIC DISPLAY */
+#define QPIC_BASE                            0xF9AC0000
+#define APCS_ALIAS0_IPC_INTERRUPT            0xF9011008
 #endif
diff --git a/platform/mdm9x35/include/platform/irqs.h b/platform/mdm9x35/include/platform/irqs.h
index 3f2a72c..3cef959 100755
--- a/platform/mdm9x35/include/platform/irqs.h
+++ b/platform/mdm9x35/include/platform/irqs.h
@@ -58,4 +58,5 @@
 #define NR_IRQS                                (NR_MSM_IRQS + NR_GPIO_IRQS + \
                                                NR_BOARD_IRQS)
 
+#define SMD_IRQ                                (GIC_SPI_START + 168)
 #endif /* __IRQS_9635_H */
diff --git a/platform/msm8909/acpuclock.c b/platform/msm8909/acpuclock.c
index 334a1f3..413816b 100644
--- a/platform/msm8909/acpuclock.c
+++ b/platform/msm8909/acpuclock.c
@@ -39,24 +39,136 @@
 
 void hsusb_clock_init(void)
 {
+	int ret;
+	struct clk *iclk, *cclk;
 
+	ret = clk_get_set_enable("usb_iface_clk", 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_iface_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("usb_core_clk", 80000000, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_core_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	mdelay(20);
+
+	iclk = clk_get("usb_iface_clk");
+	cclk = clk_get("usb_core_clk");
+
+	clk_disable(iclk);
+	clk_disable(cclk);
+
+	mdelay(20);
+
+	/* Start the block reset for usb */
+	writel(1, USB_HS_BCR);
+
+	mdelay(20);
+
+	/* Take usb block out of reset */
+	writel(0, USB_HS_BCR);
+
+	mdelay(20);
+
+	ret = clk_enable(iclk);
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_iface_clk after async ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_enable(cclk);
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb_iface_clk after async ret = %d\n", ret);
+		ASSERT(0);
+	}
 }
 
 void clock_init_mmc(uint32_t interface)
 {
+	char clk_name[64];
+	int ret;
 
+	snprintf(clk_name, sizeof(clk_name), "sdc%u_iface_clk", interface);
+
+	/* enable interface clock */
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set sdc1_iface_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
 }
 
 /* Configure MMC clock */
 void clock_config_mmc(uint32_t interface, uint32_t freq)
 {
+	int ret;
+	char clk_name[64];
 
+	snprintf(clk_name, sizeof(clk_name), "sdc%u_core_clk", interface);
+
+	if(freq == MMC_CLK_400KHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 400000, 1);
+	}
+	else if(freq == MMC_CLK_50MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 50000000, 1);
+	}
+	else if(freq == MMC_CLK_200MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 200000000, 1);
+	}
+	else if(freq == MMC_CLK_177MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 177770000, 1);
+	}
+	else
+	{
+		dprintf(CRITICAL, "sdc frequency (%u) is not supported\n", freq);
+		ASSERT(0);
+	}
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set %s ret = %d\n", clk_name, ret);
+		ASSERT(0);
+	}
 }
 
 /* Configure UART clock based on the UART block id*/
 void clock_config_uart_dm(uint8_t id)
 {
+	int ret;
+	char iclk[64];
+	char cclk[64];
 
+	snprintf(iclk, sizeof(iclk), "uart%u_iface_clk", id);
+	snprintf(cclk, sizeof(cclk), "uart%u_core_clk", id);
+
+	ret = clk_get_set_enable(iclk, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set %s ret = %d\n", iclk, ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable(cclk, 7372800, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set %s ret = %d\n", cclk, ret);
+		ASSERT(0);
+	}
 }
 
 /* Function to asynchronously reset CE.
@@ -64,17 +176,90 @@
  */
 static void ce_async_reset(uint8_t instance)
 {
+	/* Start the block reset for CE */
+	writel(1, GCC_CRYPTO_BCR);
 
+	udelay(2);
+
+	/* Take CE block out of reset */
+	writel(0, GCC_CRYPTO_BCR);
+
+	udelay(2);
 }
 
 void clock_ce_enable(uint8_t instance)
 {
+	int ret;
+	char clk_name[64];
 
+	snprintf(clk_name, sizeof(clk_name), "ce%u_src_clk", instance);
+	ret = clk_get_set_enable(clk_name, 160000000, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_src_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_core_clk", instance);
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_core_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_ahb_clk", instance);
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_ahb_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_axi_clk", instance);
+	ret = clk_get_set_enable(clk_name, 0, 1);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set ce%u_axi_clk ret = %d\n", instance, ret);
+		ASSERT(0);
+	}
+
+	/* Wait for 48 * #pipes cycles.
+	* This is necessary as immediately after an access control reset (boot up)
+	* or a debug re-enable, the Crypto core sequentially clears its internal
+	* pipe key storage memory. If pipe key initialization writes are attempted
+	* during this time, they may be overwritten by the internal clearing logic.
+	*/
+	udelay(1);
 }
 
 void clock_ce_disable(uint8_t instance)
 {
+	struct clk *ahb_clk;
+	struct clk *cclk;
+	struct clk *axi_clk;
+	struct clk *src_clk;
+	char clk_name[64];
 
+	snprintf(clk_name, sizeof(clk_name), "ce%u_src_clk", instance);
+	src_clk = clk_get(clk_name);
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_ahb_clk", instance);
+	ahb_clk = clk_get(clk_name);
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_axi_clk", instance);
+	axi_clk = clk_get(clk_name);
+
+	snprintf(clk_name, sizeof(clk_name), "ce%u_core_clk", instance);
+	cclk    = clk_get(clk_name);
+
+	clk_disable(ahb_clk);
+	clk_disable(axi_clk);
+	clk_disable(cclk);
+	clk_disable(src_clk);
+
+	/* Some delay for the clocks to stabalize. */
+	udelay(1);
 }
 
 void clock_config_ce(uint8_t instance)
@@ -91,3 +276,120 @@
 
 	clock_ce_enable(instance);
 }
+
+/* Control the MDSS GDSC */
+void mdp_gdsc_ctrl(uint8_t enable)
+{
+	uint32_t reg = 0;
+	reg = readl(MDP_GDSCR);
+	if (enable) {
+		if (!(reg & GDSC_POWER_ON_BIT)) {
+			reg &=  ~(BIT(0) | GDSC_EN_FEW_WAIT_MASK);
+			reg |= GDSC_EN_FEW_WAIT_256_MASK;
+			writel(reg, MDP_GDSCR);
+			while(!(readl(MDP_GDSCR) & (GDSC_POWER_ON_BIT)));
+		} else {
+			dprintf(SPEW, "MDP GDSC already enabled\n");
+		}
+	} else {
+		reg |= BIT(0);
+		writel(reg, MDP_GDSCR);
+		while(readl(MDP_GDSCR) & (GDSC_POWER_ON_BIT));
+	}
+}
+
+/* Enable all the MDP branch clocks */
+void mdp_clock_enable(void)
+{
+	int ret;
+
+	ret = clk_get_set_enable("mdp_ahb_clk", 0, 1);
+	if (ret) {
+		dprintf(CRITICAL, "failed to set mdp_ahb_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	/* Set MDP clock to 160MHz */
+	ret = clk_get_set_enable("mdss_mdp_clk_src", 160000000, 1);
+	if (ret) {
+		dprintf(CRITICAL, "failed to set mdp_clk_src ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("mdss_vsync_clk", 0, 1);
+	if (ret) {
+		dprintf(CRITICAL, "failed to set mdss vsync clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("mdss_mdp_clk", 0, 1);
+	if (ret) {
+		dprintf(CRITICAL, "failed to set mdp_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+}
+
+/* Disable all the MDP branch clocks */
+void mdp_clock_disable(void)
+{
+	clk_disable(clk_get("mdss_vsync_clk"));
+	clk_disable(clk_get("mdss_mdp_clk"));
+	clk_disable(clk_get("mdss_mdp_clk_src"));
+	clk_disable(clk_get("mdp_ahb_clk"));
+}
+
+/* Disable all the bus clocks needed by MDSS */
+void mdss_bus_clocks_disable(void)
+{
+	/* Disable MDSS AXI clock */
+	clk_disable(clk_get("mdss_axi_clk"));
+}
+
+/* Enable all the bus clocks needed by MDSS */
+void mdss_bus_clocks_enable(void)
+{
+	int ret;
+
+	/* Configure AXI clock */
+	ret = clk_get_set_enable("mdss_axi_clk", 0, 1);
+	if (ret) {
+		dprintf(CRITICAL, "failed to set mdss_axi_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+}
+
+/* Disable all the branch clocks needed by the DSI controller */
+void gcc_dsi_clocks_disable(void)
+{
+	clk_disable(clk_get("mdss_esc0_clk"));
+	writel(0x0, DSI_PIXEL0_CBCR);
+	writel(0x0, DSI_BYTE0_CBCR);
+}
+
+/* Configure all the branch clocks needed by the DSI controller */
+void gcc_dsi_clocks_enable(uint8_t pclk0_m, uint8_t pclk0_n, uint8_t pclk0_d)
+{
+	int ret;
+
+	/* Configure Byte clock -autopll- This will not change becasue
+	byte clock does not need any divider*/
+	writel(0x100, DSI_BYTE0_CFG_RCGR);
+	writel(0x1, DSI_BYTE0_CMD_RCGR);
+	writel(0x1, DSI_BYTE0_CBCR);
+
+	/* Configure Pixel clock */
+	writel(0x100, DSI_PIXEL0_CFG_RCGR);
+	writel(0x1, DSI_PIXEL0_CMD_RCGR);
+	writel(0x1, DSI_PIXEL0_CBCR);
+
+	writel(pclk0_m, DSI_PIXEL0_M);
+	writel(pclk0_n, DSI_PIXEL0_N);
+	writel(pclk0_d, DSI_PIXEL0_D);
+
+	/* Configure ESC clock */
+	ret = clk_get_set_enable("mdss_esc0_clk", 0, 1);
+	if (ret) {
+		dprintf(CRITICAL, "failed to set esc0_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+}
diff --git a/platform/msm8909/include/platform/clock.h b/platform/msm8909/include/platform/clock.h
index 55d3d4e..ffdaef0 100644
--- a/platform/msm8909/include/platform/clock.h
+++ b/platform/msm8909/include/platform/clock.h
@@ -34,6 +34,37 @@
 
 #define UART_DM_CLK_RX_TX_BIT_RATE 0xCC
 
+#define REG_MM(off)                     (CLK_CTL_BASE + (off))
+
+#define MDP_GDSCR                       REG_MM(0x4D078)
+#define GDSC_POWER_ON_BIT               BIT(31)
+#define GDSC_POWER_ON_STATUS_BIT        BIT(29)
+#define GDSC_EN_FEW_WAIT_MASK           (0x0F << 16)
+#define GDSC_EN_FEW_WAIT_256_MASK       BIT(19)
+
+#define VSYNC_CMD_RCGR                  REG_MM(0x4D02C)
+#define VSYNC_CFG_RCGR                  REG_MM(0x4D030)
+#define MDSS_VSYNC_CBCR                 REG_MM(0x4D090)
+
+#define MDP_CMD_RCGR                    REG_MM(0x4D014)
+#define MDP_CFG_RCGR                    REG_MM(0x4D018)
+#define MDP_CBCR                        REG_MM(0x4D088)
+#define MDP_AHB_CBCR                    REG_MM(0x4D07C)
+#define MDP_AXI_CBCR                    REG_MM(0x4D080)
+
+#define DSI_BYTE0_CMD_RCGR              REG_MM(0x4D044)
+#define DSI_BYTE0_CFG_RCGR              REG_MM(0x4D048)
+#define DSI_BYTE0_CBCR                  REG_MM(0x4D094)
+#define DSI_ESC0_CMD_RCGR               REG_MM(0x4D05C)
+#define DSI_ESC0_CFG_RCGR               REG_MM(0x4D060)
+#define DSI_ESC0_CBCR                   REG_MM(0x4D098)
+#define DSI_PIXEL0_CMD_RCGR             REG_MM(0x4D000)
+#define DSI_PIXEL0_CFG_RCGR             REG_MM(0x4D004)
+#define DSI_PIXEL0_CBCR                 REG_MM(0x4D084)
+#define DSI_PIXEL0_M                    REG_MM(0x4D008)
+#define DSI_PIXEL0_N                    REG_MM(0x4D00C)
+#define DSI_PIXEL0_D                    REG_MM(0x4D010)
+
 void platform_clock_init(void);
 
 void clock_init_mmc(uint32_t interface);
@@ -41,4 +72,6 @@
 void clock_config_uart_dm(uint8_t id);
 void hsusb_clock_init(void);
 void clock_config_ce(uint8_t instance);
+void mdp_clock_init(void);
+void mdp_gdsc_ctrl(uint8_t enable);
 #endif
diff --git a/platform/msm8909/include/platform/iomap.h b/platform/msm8909/include/platform/iomap.h
index bbe731c..b47fede 100644
--- a/platform/msm8909/include/platform/iomap.h
+++ b/platform/msm8909/include/platform/iomap.h
@@ -82,6 +82,7 @@
 #define SPMI_BASE                   0x02000000
 #define SPMI_GENI_BASE              (SPMI_BASE + 0xA000)
 #define SPMI_PIC_BASE               (SPMI_BASE +  0x01800000)
+#define PMIC_ARB_CORE               0x200F000
 
 #define TLMM_BASE_ADDR              0x1000000
 #define GPIO_CONFIG_ADDR(x)         (TLMM_BASE_ADDR + (x)*0x1000)
@@ -109,6 +110,7 @@
 
 /* GPLL */
 #define GPLL0_STATUS                (CLK_CTL_BASE + 0x21024)
+#define GPLL0_MODE                  (CLK_CTL_BASE + 0x21000)
 #define GPLL1_STATUS                (CLK_CTL_BASE + 0x2001C)
 #define APCS_GPLL_ENA_VOTE          (CLK_CTL_BASE + 0x45000)
 #define APCS_CLOCK_BRANCH_ENA_VOTE  (CLK_CTL_BASE + 0x45004)
@@ -142,6 +144,12 @@
 #define BLSP1_UART2_APPS_N          (CLK_CTL_BASE + 0x3040)
 #define BLSP1_UART2_APPS_D          (CLK_CTL_BASE + 0x3044)
 
+#define BLSP1_UART1_APPS_CBCR       (CLK_CTL_BASE + 0x203C)
+#define BLSP1_UART1_APPS_CMD_RCGR   (CLK_CTL_BASE + 0x2044)
+#define BLSP1_UART1_APPS_CFG_RCGR   (CLK_CTL_BASE + 0x2048)
+#define BLSP1_UART1_APPS_M          (CLK_CTL_BASE + 0x204C)
+#define BLSP1_UART1_APPS_N          (CLK_CTL_BASE + 0x2050)
+#define BLSP1_UART1_APPS_D          (CLK_CTL_BASE + 0x2054)
 
 /* USB */
 #define USB_HS_BCR                  (CLK_CTL_BASE + 0x41000)
@@ -196,6 +204,8 @@
 #define MDP_TEST_MODE_CLK           REG_MDP(0xF0000)
 #define MDP_INTR_STATUS             REG_MDP(0x00054)
 
+#define MDP_CGC_EN                  REG_MDP(0x100)
+
 #define SOFT_RESET                  0x118
 #define CLK_CTRL                    0x11C
 #define TRIG_CTRL                   0x084
@@ -238,4 +248,6 @@
 #define BOOT_CONFIG_OFFSET          0x0000602C
 #define BOOT_CONFIG_REG             (SEC_CTRL_CORE_BASE + BOOT_CONFIG_OFFSET)
 
+/* EBI2 */
+#define TLMM_EBI2_EMMC_GPIO_CFG     (TLMM_BASE_ADDR + 0x00111000)
 #endif
diff --git a/platform/msm8909/msm8909-clock.c b/platform/msm8909/msm8909-clock.c
index a2af96d..78ece16 100644
--- a/platform/msm8909/msm8909-clock.c
+++ b/platform/msm8909/msm8909-clock.c
@@ -100,8 +100,8 @@
 {
 	.en_reg       = (void *) APCS_GPLL_ENA_VOTE,
 	.en_mask      = BIT(0),
-	.status_reg   = (void *) GPLL0_STATUS,
-	.status_mask  = BIT(17),
+	.status_reg   = (void *) GPLL0_MODE,
+	.status_mask  = BIT(30),
 	.parent       = &cxo_clk_src.c,
 
 	.c = {
@@ -254,31 +254,31 @@
 	F_END
 };
 
-static struct rcg_clk blsp1_uart2_apps_clk_src =
+static struct rcg_clk blsp1_uart1_apps_clk_src =
 {
-	.cmd_reg      = (uint32_t *) BLSP1_UART2_APPS_CMD_RCGR,
-	.cfg_reg      = (uint32_t *) BLSP1_UART2_APPS_CFG_RCGR,
-	.m_reg        = (uint32_t *) BLSP1_UART2_APPS_M,
-	.n_reg        = (uint32_t *) BLSP1_UART2_APPS_N,
-	.d_reg        = (uint32_t *) BLSP1_UART2_APPS_D,
+	.cmd_reg      = (uint32_t *) BLSP1_UART1_APPS_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) BLSP1_UART1_APPS_CFG_RCGR,
+	.m_reg        = (uint32_t *) BLSP1_UART1_APPS_M,
+	.n_reg        = (uint32_t *) BLSP1_UART1_APPS_N,
+	.d_reg        = (uint32_t *) BLSP1_UART1_APPS_D,
 
 	.set_rate     = clock_lib2_rcg_set_rate_mnd,
 	.freq_tbl     = ftbl_gcc_blsp1_2_uart1_6_apps_clk,
 	.current_freq = &rcg_dummy_freq,
 
 	.c = {
-		.dbg_name = "blsp1_uart2_apps_clk",
+		.dbg_name = "blsp1_uart1_apps_clk",
 		.ops      = &clk_ops_rcg_mnd,
 	},
 };
 
-static struct branch_clk gcc_blsp1_uart2_apps_clk =
+static struct branch_clk gcc_blsp1_uart1_apps_clk =
 {
-	.cbcr_reg     = (uint32_t *) BLSP1_UART2_APPS_CBCR,
-	.parent       = &blsp1_uart2_apps_clk_src.c,
+	.cbcr_reg     = (uint32_t *) BLSP1_UART1_APPS_CBCR,
+	.parent       = &blsp1_uart1_apps_clk_src.c,
 
 	.c = {
-		.dbg_name = "gcc_blsp1_uart2_apps_clk",
+		.dbg_name = "gcc_blsp1_uart1_apps_clk",
 		.ops      = &clk_ops_branch,
 	},
 };
@@ -413,6 +413,120 @@
 		.ops      = &clk_ops_branch,
 	},
 };
+
+/* Display clocks */
+static struct clk_freq_tbl ftbl_mdss_esc0_1_clk[] = {
+	F_MM(19200000,    cxo,   1,   0,   0),
+	F_END
+};
+
+static struct clk_freq_tbl ftbl_mdp_clk[] = {
+	F_MM( 50000000,    gpll0,  16,     0,      0),
+	F_MM( 80000000,    gpll0,  10,     0,      0),
+	F_MM( 100000000,   gpll0,  8,      0,      0),
+	F_MM( 160000000,   gpll0,  5,      0,      0),
+	F_MM( 177780000,   gpll0,  4.5,    0,      0),
+	F_MM( 200000000,   gpll0,  4,      0,      0),
+	F_MM( 266670000,   gpll0,  3,      0,      0),
+	F_MM( 307200000,   gpll1,  4,      0,      0),
+	F_END
+};
+
+static struct rcg_clk dsi_esc0_clk_src = {
+	.cmd_reg  = (uint32_t *) DSI_ESC0_CMD_RCGR,
+	.cfg_reg  = (uint32_t *) DSI_ESC0_CFG_RCGR,
+	.set_rate = clock_lib2_rcg_set_rate_hid,
+	.freq_tbl = ftbl_mdss_esc0_1_clk,
+
+	.c = {
+		.dbg_name = "dsi_esc0_clk_src",
+		.ops      = &clk_ops_rcg,
+	},
+};
+
+static struct clk_freq_tbl ftbl_mdss_vsync_clk[] = {
+	F_MM(19200000,    cxo,   1,   0,   0),
+	F_END
+};
+
+static struct rcg_clk vsync_clk_src = {
+	.cmd_reg  = (uint32_t *) VSYNC_CMD_RCGR,
+	.cfg_reg  = (uint32_t *) VSYNC_CFG_RCGR,
+	.set_rate = clock_lib2_rcg_set_rate_hid,
+	.freq_tbl = ftbl_mdss_vsync_clk,
+
+	.c = {
+		.dbg_name = "vsync_clk_src",
+		.ops      = &clk_ops_rcg,
+	},
+};
+
+static struct branch_clk mdss_esc0_clk = {
+	.cbcr_reg    = (uint32_t *) DSI_ESC0_CBCR,
+	.parent      = &dsi_esc0_clk_src.c,
+	.has_sibling = 0,
+
+	.c = {
+		.dbg_name = "mdss_esc0_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk mdss_axi_clk = {
+	.cbcr_reg    = (uint32_t *) MDP_AXI_CBCR,
+	.has_sibling = 1,
+
+	.c = {
+		.dbg_name = "mdss_axi_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk mdp_ahb_clk = {
+	.cbcr_reg    = (uint32_t *) MDP_AHB_CBCR,
+	.has_sibling = 1,
+
+	.c = {
+		.dbg_name = "mdp_ahb_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct rcg_clk mdss_mdp_clk_src = {
+	.cmd_reg      = (uint32_t *) MDP_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) MDP_CFG_RCGR,
+	.set_rate     = clock_lib2_rcg_set_rate_hid,
+	.freq_tbl     = ftbl_mdp_clk,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "mdss_mdp_clk_src",
+		.ops      = &clk_ops_rcg,
+	},
+};
+
+static struct branch_clk mdss_mdp_clk = {
+	.cbcr_reg    = (uint32_t *) MDP_CBCR,
+	.parent      = &mdss_mdp_clk_src.c,
+	.has_sibling = 0,
+
+	.c = {
+		.dbg_name = "mdss_mdp_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk mdss_vsync_clk = {
+	.cbcr_reg    = MDSS_VSYNC_CBCR,
+	.parent      = &vsync_clk_src.c,
+	.has_sibling = 0,
+
+	.c = {
+		.dbg_name = "mdss_vsync_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
 /* Clock lookup table */
 static struct clk_lookup msm_clocks_msm8909[] =
 {
@@ -422,8 +536,8 @@
 	CLK_LOOKUP("sdc2_iface_clk", gcc_sdcc2_ahb_clk.c),
 	CLK_LOOKUP("sdc2_core_clk",  gcc_sdcc2_apps_clk.c),
 
-	CLK_LOOKUP("uart2_iface_clk", gcc_blsp1_ahb_clk.c),
-	CLK_LOOKUP("uart2_core_clk",  gcc_blsp1_uart2_apps_clk.c),
+	CLK_LOOKUP("uart1_iface_clk", gcc_blsp1_ahb_clk.c),
+	CLK_LOOKUP("uart1_core_clk",  gcc_blsp1_uart1_apps_clk.c),
 
 	CLK_LOOKUP("usb_iface_clk",  gcc_usb_hs_ahb_clk.c),
 	CLK_LOOKUP("usb_core_clk",   gcc_usb_hs_system_clk.c),
@@ -436,6 +550,13 @@
 	CLK_LOOKUP("blsp1_qup2_ahb_iface_clk", gcc_blsp1_ahb_clk.c),
 	CLK_LOOKUP("gcc_blsp1_qup2_i2c_apps_clk_src", gcc_blsp1_qup2_i2c_apps_clk_src.c),
 	CLK_LOOKUP("gcc_blsp1_qup2_i2c_apps_clk", gcc_blsp1_qup2_i2c_apps_clk.c),
+
+	CLK_LOOKUP("mdp_ahb_clk", mdp_ahb_clk.c),
+	CLK_LOOKUP("mdss_esc0_clk", mdss_esc0_clk.c),
+	CLK_LOOKUP("mdss_axi_clk", mdss_axi_clk.c),
+	CLK_LOOKUP("mdss_vsync_clk", mdss_vsync_clk.c),
+	CLK_LOOKUP("mdss_mdp_clk_src", mdss_mdp_clk_src.c),
+	CLK_LOOKUP("mdss_mdp_clk", mdss_mdp_clk.c),
 };
 
 void platform_clock_init(void)
diff --git a/platform/msm8909/rules.mk b/platform/msm8909/rules.mk
index 4da135e..ba6d8f3 100644
--- a/platform/msm8909/rules.mk
+++ b/platform/msm8909/rules.mk
@@ -14,6 +14,8 @@
 
 INCLUDES += -I$(LOCAL_DIR)/include -I$(LK_TOP_DIR)/platform/msm_shared/include
 
+DEV += fbcon
+MODULES += dev/fbcon
 
 OBJS += \
        $(LOCAL_DIR)/platform.o \
diff --git a/platform/msm8916/include/platform/iomap.h b/platform/msm8916/include/platform/iomap.h
index c815bd0..2532601 100644
--- a/platform/msm8916/include/platform/iomap.h
+++ b/platform/msm8916/include/platform/iomap.h
@@ -51,6 +51,9 @@
 #define ABOOT_FORCE_RAMDISK_ADDR    DDR_START + 0x2000000
 #define ABOOT_FORCE_TAGS_ADDR       DDR_START + 0x1E00000
 
+/* 3GB DDR devices consider 0x40000000 as new mem base */
+#define BASE_ADDR_1                 0x40000000
+
 #define MSM_GIC_DIST_BASE           APPS_SS_BASE
 #define MSM_GIC_CPU_BASE            (APPS_SS_BASE + 0x2000)
 #define APPS_APCS_QTMR_AC_BASE      (APPS_SS_BASE + 0x00020000)
diff --git a/platform/msm8916/platform.c b/platform/msm8916/platform.c
index 4e896ce..0558b35 100644
--- a/platform/msm8916/platform.c
+++ b/platform/msm8916/platform.c
@@ -64,6 +64,7 @@
 	{    MSM_SHARED_BASE,   MSM_SHARED_BASE,  1,                COMMON_MEMORY},
 	{    BASE_ADDR,         BASE_ADDR,        90,               COMMON_MEMORY},
 	{    SCRATCH_ADDR,      SCRATCH_ADDR,     256,              COMMON_MEMORY},
+	{    BASE_ADDR_1,       BASE_ADDR_1,     1024,              COMMON_MEMORY},
 };
 
 static struct smem_ram_ptable ram_ptable;
diff --git a/platform/msm_shared/dev_tree.c b/platform/msm_shared/dev_tree.c
index 52aa420..36b2a3a 100644
--- a/platform/msm_shared/dev_tree.c
+++ b/platform/msm_shared/dev_tree.c
@@ -614,7 +614,7 @@
 		switch(dtb_info) {
 		case DTB_FOUNDRY:
 			current_info = ((dt_node_tmp1->dt_entry_m->platform_id) & 0x00ff0000);
-			board_info = board_foundry_id();
+			board_info = board_foundry_id() << 16;
 			break;
 		case DTB_PMIC_MODEL:
 			for (i = 0; i < 4; i++) {
diff --git a/platform/msm_shared/display.c b/platform/msm_shared/display.c
index aac82c0..f0b6020 100644
--- a/platform/msm_shared/display.c
+++ b/platform/msm_shared/display.c
@@ -68,6 +68,7 @@
 	mdp_set_revision(panel->mdp_rev);
 
 	switch (pinfo->type) {
+#ifdef DISPLAY_TYPE_MDSS
 	case LVDS_PANEL:
 		dprintf(INFO, "Config LVDS_PANEL.\n");
 		ret = mdp_lcdc_config(pinfo, &(panel->fb));
@@ -127,6 +128,13 @@
 		if (ret)
 			goto msm_display_config_out;
 		break;
+#endif
+#ifdef DISPLAY_TYPE_QPIC
+	case QPIC_PANEL:
+		dprintf(INFO, "Config QPIC_PANEL.\n");
+		qpic_init(pinfo, panel->fb.base);
+		break;
+#endif
 	default:
 		return ERR_INVALID_ARGS;
 	};
@@ -158,6 +166,7 @@
 	}
 
 	switch (pinfo->type) {
+#ifdef DISPLAY_TYPE_MDSS
 	case LVDS_PANEL:
 		dprintf(INFO, "Turn on LVDS PANEL.\n");
 		ret = mdp_lcdc_on(panel);
@@ -221,6 +230,18 @@
 		if (ret)
 			goto msm_display_on_out;
 		break;
+#endif
+#ifdef DISPLAY_TYPE_QPIC
+	case QPIC_PANEL:
+		dprintf(INFO, "Turn on QPIC_PANEL.\n");
+		ret = qpic_on();
+		if (ret) {
+			dprintf(CRITICAL, "QPIC panel on failed\n");
+			goto msm_display_on_out;
+		}
+		qpic_update();
+		break;
+#endif
 	default:
 		return ERR_INVALID_ARGS;
 	};
@@ -320,6 +341,7 @@
 	}
 
 	switch (pinfo->type) {
+#ifdef DISPLAY_TYPE_MDSS
 	case LVDS_PANEL:
 		dprintf(INFO, "Turn off LVDS PANEL.\n");
 		mdp_lcdc_off();
@@ -352,6 +374,13 @@
 		if (ret)
 			goto msm_display_off_out;
 		break;
+#endif
+#ifdef DISPLAY_TYPE_QPIC
+	case QPIC_PANEL:
+		dprintf(INFO, "Turn off QPIC_PANEL.\n");
+		qpic_off();
+		break;
+#endif
 	default:
 		return ERR_INVALID_ARGS;
 	};
diff --git a/platform/msm_shared/dme.c b/platform/msm_shared/dme.c
index 2571763..61efb47 100644
--- a/platform/msm_shared/dme.c
+++ b/platform/msm_shared/dme.c
@@ -37,6 +37,7 @@
 #include <dme.h>
 #include <uic.h>
 #include <utp.h>
+#include <ucs.h>
 
 int dme_send_linkstartup_req(struct ufs_dev *dev)
 {
@@ -52,7 +53,7 @@
 	return UFS_SUCCESS;
 
 dme_send_linkstartup_req_err:
-	dprintf(CRITICAL, "DME_LINKSTARTUP command failed.\n");
+	dprintf(CRITICAL, "%s:%d DME_LINKSTARTUP command failed.\n",__func__, __LINE__);
 	return -UFS_FAILURE;
 }
 
@@ -74,7 +75,7 @@
 	return UFS_SUCCESS;
 
 dme_get_req_err:
-	dprintf(CRITICAL, "DME_GET command failed.\n");
+	dprintf(CRITICAL, "%s:%d DME_GET command failed.\n", __func__, __LINE__);
 	return -UFS_FAILURE;
 }
 
@@ -88,9 +89,15 @@
 	resp_upiu = (struct upiu_trans_mgmt_query_hdr *) req_upiu->resp_ptr;
 
 	if (resp_upiu->opcode != req_upiu->opcode)
+	{
+		dprintf(CRITICAL, "%s:%d Opcode from respose does not match with Opcode from request\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 	if (resp_upiu->basic_hdr.response != UPIU_QUERY_RESP_SUCCESS)
+	{
+		dprintf(CRITICAL, "%s:%d UPIU Response is not SUCCESS\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
 	switch (resp_upiu->opcode)
 	{
@@ -98,7 +105,7 @@
 		case UPIU_QUERY_OP_SET_FLAG:
 									  if (buf_len < sizeof(uint32_t))
 									  {
-										dprintf(CRITICAL, "Insufficient buffer space.\n");
+										dprintf(CRITICAL, "%s:%d Insufficient buffer space.\n", __func__, __LINE__);
 										return -UFS_FAILURE;
 									  }
 
@@ -108,8 +115,9 @@
 		case UPIU_QUERY_OP_CLEAR_FLAG:
 		case UPIU_QUERY_OP_READ_DESCRIPTOR:
 									 break;
-		default: dprintf(CRITICAL, "UPIU query opcode not supported.\n");
-				 return -UFS_FAILURE;
+		default:
+				dprintf(CRITICAL, "%s:%d UPIU query opcode not supported.\n", __func__, __LINE__);
+				return -UFS_FAILURE;
 	}
 
 	return UFS_SUCCESS;
@@ -170,7 +178,10 @@
 
 
 	if (dme_send_query_upiu(dev, &read_query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Power On Write Read Request failed\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
 	arch_invalidate_cache_range((addr_t) result, sizeof(uint32_t));
 
@@ -183,9 +194,16 @@
 		dprintf(CRITICAL, "Power on Write Protect request failed. Retrying again.\n");
 
 		if (dme_send_query_upiu(dev, &set_query))
+		{
+			dprintf(CRITICAL, "%s:%d DME Power On Write Set Request failed\n", __func__, __LINE__);
 			return -UFS_FAILURE;
+		}
+
 		if (dme_send_query_upiu(dev, &read_query))
+		{
+			dprintf(CRITICAL, "%s:%d DME Power On Write Read Request failed\n", __func__, __LINE__);
 			return -UFS_FAILURE;
+		}
 
 		if (*result == 1)
 			break;
@@ -215,7 +233,10 @@
 
 
 	if (dme_send_query_upiu(dev, &read_query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Device Init Read request failed\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
 	arch_invalidate_cache_range((addr_t) result, sizeof(uint32_t));
 
@@ -227,10 +248,16 @@
 		try_again--;
 
 		if (dme_send_query_upiu(dev, &set_query))
+		{
+			dprintf(CRITICAL, "%s:%d DME Device Init Set request failed\n", __func__, __LINE__);
 			return -UFS_FAILURE;
+		}
 
 		if (dme_send_query_upiu(dev, &read_query))
+		{
+			dprintf(CRITICAL, "%s:%d DME Device Init Read request failed\n", __func__, __LINE__);
 			return -UFS_FAILURE;
+		}
 
 		if (*result == 1)
 			break;
@@ -250,11 +277,14 @@
 											sizeof(struct ufs_string_desc)};
 
 	if (dme_send_query_upiu(dev, &query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Read String Descriptor request failed\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
 	if (desc->desc_len != 0)
 		return UFS_SUCCESS;
-
+	dprintf(CRITICAL, "%s:%d DME Read String Descriptor is length 0\n", __func__, __LINE__);
 	return -UFS_FAILURE;
 }
 
@@ -265,9 +295,12 @@
 	int index=0,len=0;
 
 	if(desc->desc_len <= 0)
+	{
+		dprintf(CRITICAL, "%s:%d Invalid string descriptor length\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
-	ptr = desc->serial_num;
+	ptr = (uint16_t *) desc->serial_num;
 	len = (desc->desc_len-2)/2;
 
 	for(index=0; index<len; index++)
@@ -283,8 +316,8 @@
 {
 	STACKBUF_DMA_ALIGN(dev_desc, sizeof(struct ufs_dev_desc));
 	STACKBUF_DMA_ALIGN(desc, sizeof(struct ufs_string_desc));
-	struct ufs_dev_desc            *device_desc = dev_desc;
-	struct ufs_string_desc         *str_desc    = desc;
+	struct ufs_dev_desc            *device_desc = (struct ufs_dev_desc *) dev_desc;
+	struct ufs_string_desc         *str_desc    = (struct ufs_string_desc *) desc;
 	struct utp_query_req_upiu_type query = {UPIU_QUERY_OP_READ_DESCRIPTOR,
 											UFS_DESC_IDN_DEVICE,
 											0,
@@ -293,7 +326,10 @@
 											sizeof(struct ufs_dev_desc)};
 
 	if (dme_send_query_upiu(dev, &query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Read Device Descriptor request failed\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
 	/* Flush buffer. */
 	arch_invalidate_cache_range((addr_t) device_desc, sizeof(struct ufs_dev_desc));
@@ -302,21 +338,46 @@
 	dev->num_lus = device_desc->num_lu;
 
 	/* Get serial number for the device based on the string index. */
-	if (dme_read_string_desc(dev, device_desc->serial_num, desc))
+	if (dme_read_string_desc(dev, device_desc->serial_num, (struct ufs_string_desc *) desc))
 		return -UFS_FAILURE;
 
 	/* Flush buffer. */
 	arch_invalidate_cache_range((addr_t) str_desc, sizeof(struct ufs_string_desc));
 
 	dev->serial_num = dme_parse_serial_no(str_desc);
-	
+
+	return UFS_SUCCESS;
+}
+
+
+int dme_read_geo_desc(struct ufs_dev *dev)
+{
+	struct ufs_geometry_desc *desc;
+	STACKBUF_DMA_ALIGN(geometry_desc, sizeof(struct ufs_geometry_desc));
+	desc = (struct ufs_geometry_desc *) geometry_desc;
+	struct utp_query_req_upiu_type query = {UPIU_QUERY_OP_READ_DESCRIPTOR,
+											UFS_DESC_IDN_GEOMETRY,
+											0,
+											0,
+											(addr_t) geometry_desc,
+											sizeof(struct ufs_geometry_desc)};
+
+	if (dme_send_query_upiu(dev, &query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Read Geometry Descriptor request failed\n", __func__, __LINE__);
+		return -UFS_FAILURE;
+	}
+
+	// Flush buffer.
+	arch_invalidate_cache_range((addr_t) desc, sizeof(struct ufs_geometry_desc));
+	dev->rpmb_rw_size = desc->rpmb_read_write_size;
 	return UFS_SUCCESS;
 }
 
 int dme_read_unit_desc(struct ufs_dev *dev, uint8_t index)
 {
 	STACKBUF_DMA_ALIGN(unit_desc, sizeof(struct ufs_unit_desc));
-	struct ufs_unit_desc           *desc = unit_desc;
+	struct ufs_unit_desc           *desc = (struct ufs_unit_desc *) unit_desc;
 	struct utp_query_req_upiu_type query = {UPIU_QUERY_OP_READ_DESCRIPTOR,
 											UFS_DESC_IDN_UNIT,
 											index,
@@ -325,8 +386,10 @@
 											sizeof(struct ufs_unit_desc)};
 
 	if (dme_send_query_upiu(dev, &query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Read Unit Descriptor request failed\n", __func__, __LINE__);
 		return -UFS_FAILURE;
-
+	}
 	/* Flush buffer. */
 	arch_invalidate_cache_range((addr_t) desc, sizeof(struct ufs_unit_desc));
 
@@ -334,13 +397,17 @@
 
 	dev->lun_cfg[index].erase_blk_size = BE32(desc->erase_blk_size);
 
+	// use only the lower 32 bits for rpmb partition size
+	if (index == UFS_WLUN_RPMB)
+		dev->rpmb_num_blocks = BE32(desc->logical_blk_cnt >> 32);
+
 	return UFS_SUCCESS;
 }
 
 int dme_read_config_desc(struct ufs_dev *dev)
 {
 	STACKBUF_DMA_ALIGN(desc, sizeof(struct ufs_config_desc));
-	struct ufs_config_desc         *config_desc = desc;
+	struct ufs_config_desc         *config_desc = (struct ufs_config_desc *)desc;
 	struct utp_query_req_upiu_type query = {UPIU_QUERY_OP_READ_DESCRIPTOR,
 											UFS_DESC_IDN_CONFIGURATION,
 											0,
@@ -349,7 +416,10 @@
 											sizeof(struct ufs_config_desc)};
 
 	if (dme_send_query_upiu(dev, &query))
+	{
+		dprintf(CRITICAL, "%s:%d DME Read Config Descriptor request failed\n", __func__, __LINE__);
 		return -UFS_FAILURE;
+	}
 
 	/* Flush buffer. */
 	arch_invalidate_cache_range((addr_t) config_desc, sizeof(struct ufs_config_desc));
@@ -390,14 +460,14 @@
 		}
 		else if (ret == -UFS_FAILURE)
 		{
-			dprintf(CRITICAL, "sending nop out failed.\n");
+			dprintf(CRITICAL, "%s:%d Sending nop out failed.\n", __func__, __LINE__);
 			goto upiu_send_nop_out_err;
 		}
 
 		/* Check response UPIU */
 		if (resp_upiu.trans_type != UPIU_TYPE_NOP_IN)
 		{
-			dprintf(CRITICAL, "Command failed. command = %x. Invalid response.\n", req_upiu.trans_type);
+			dprintf(CRITICAL, "%s:%d Command failed. command = %x. Invalid response.\n",__func__,__LINE__, req_upiu.trans_type);
 			ret = -UFS_FAILURE;
 			goto upiu_send_nop_out_err;
 		}
@@ -429,8 +499,9 @@
 		case UPIU_QUERY_OP_SET_FLAG:
 									 req_upiu->basic_hdr.query_task_mgmt_func = UPIU_QUERY_FUNC_STD_WRITE_REQ;
 									 break;
-		default: dprintf(CRITICAL, "UPIU query opcode not supported.\n");
-				 return -UFS_FAILURE;
+		default:
+				dprintf(CRITICAL, "%s:%d UPIU query opcode not supported.\n", __func__, __LINE__);
+				return -UFS_FAILURE;
 	}
 
 	return UFS_SUCCESS;
diff --git a/platform/msm_shared/gpio.c b/platform/msm_shared/gpio.c
index eb569dd..7071a22 100644
--- a/platform/msm_shared/gpio.c
+++ b/platform/msm_shared/gpio.c
@@ -32,7 +32,7 @@
 #include <platform/iomap.h>
 #include <gpio.h>
 
-static void tlmm_set_sdc_pins(struct tlmm_cfgs *cfg)
+static void tlmm_set_pins(struct tlmm_cfgs *cfg)
 {
 	uint32_t reg_val;
 
@@ -57,7 +57,7 @@
 	uint8_t i;
 
 	for (i = 0; i < sz; i++)
-		tlmm_set_sdc_pins(&hdrv_cfgs[i]);
+		tlmm_set_pins(&hdrv_cfgs[i]);
 }
 
 void tlmm_set_pull_ctrl(struct tlmm_cfgs *pull_cfgs, uint8_t sz)
@@ -65,5 +65,5 @@
 	uint8_t i;
 
 	for (i = 0; i < sz; i++)
-		tlmm_set_sdc_pins(&pull_cfgs[i]);
+		tlmm_set_pins(&pull_cfgs[i]);
 }
diff --git a/platform/msm_shared/include/dme.h b/platform/msm_shared/include/dme.h
index c9ac677..0bc2b3d 100644
--- a/platform/msm_shared/include/dme.h
+++ b/platform/msm_shared/include/dme.h
@@ -150,28 +150,39 @@
 
 struct ufs_geometry_desc
 {
-	uint8_t  desc_len;
-	uint8_t  desc_type;
-	uint8_t  media_tech;
-	uint8_t  resv_0;
-	uint8_t  raw_dev_capacity[8];
-	uint8_t  resv_1;
-	uint32_t segment_size;
-	uint8_t  alloc_unit_size;
-	uint8_t  min_addr_blk_size;
-	uint8_t  optimal_read_blk_size;
-	uint8_t  optimal_write_blk_size;
-	uint8_t  max_inbuf_size;
-	uint8_t  maxoutbuf_size;
-	uint8_t  rpmb_rdwr_size;
-	uint8_t  resv_2;
-	uint8_t  data_ordering;
-	uint8_t  resv_3[5];
-	uint8_t  max_ctx_id_num;
-	uint8_t  sys_data_tag_unit_size;
-	uint8_t  sys_data_tag_res_size;
-	uint8_t  supp_sec_rt_types;
-	uint16_t supp_mem_types;
+	uint8_t   desc_len;
+	uint8_t   desc_type;
+	uint8_t   media_technology;
+	uint8_t   resv1;
+	uint64_t  total_raw_device_capacity;
+	uint8_t   resv2;
+	uint32_t  segment_size;
+	uint8_t   allocation_unit_size;
+	uint8_t   min_addr_block_size;
+	uint8_t   optimal_read_block_size;
+	uint8_t   optimal_write_block_size;
+	uint8_t   max_in_buffer_size;
+	uint8_t   max_out_buffer_zie;
+	uint8_t   rpmb_read_write_size;
+	uint8_t   resv3;
+	uint8_t   data_ordering;
+	uint8_t   max_context_id_number;
+	uint8_t   sys_data_tag_unit_size;
+	uint8_t   sys_data_tag_res_size;
+	uint8_t   supported_sec_r_types;
+	uint16_t  supported_memory_types;
+	uint32_t  system_code_max_n_alloc_u;
+	uint16_t  system_code_cap_adj_fac;
+	uint32_t  non_persist_max_n_alloc_u;
+	uint16_t  non_persist_cap_adj_fac;
+	uint32_t  enhanced_1_max_n_alloc_u;
+	uint16_t  enhanced_1_cap_adj_fac;
+	uint32_t  enhanced_2_max_n_alloc_u;
+	uint16_t  enhanced_2_cap_adj_fac;
+	uint32_t  enhanced_3_max_n_alloc_u;
+	uint16_t  enhanced_3_cap_adj_fac;
+	uint32_t  enhanced_4_max_n_alloc_u;
+	uint16_t  enhanced_4_cap_adj_fac;
 }__PACKED;
 
 struct ufs_dev_desc_config_params
@@ -220,9 +231,35 @@
 int dme_get_req(struct ufs_dev *dev, struct dme_get_req_type *req);
 int utp_build_query_req_upiu(struct upiu_trans_mgmt_query_hdr *req_upiu,
 								  struct upiu_req_build_type *upiu_data);
+
+/* Nop Query is used to check the connection to the device
+ */
 int dme_send_nop_query(struct ufs_dev *dev);
+
+/* Device Init is used to set the fDeviceInit flag to initiate device
+ * initialization
+ */
 int dme_set_fdeviceinit(struct ufs_dev *dev);
+
+/* Power On WP Enable is used to enable Power on WP for all LUN's
+ * that have WP bit enabled.
+ */
 int dme_set_fpoweronwpen(struct ufs_dev *dev);
+
+/* Unit descriptor gives the characteristics and capabilities of
+ * logical units.
+ */
 int dme_read_unit_desc(struct ufs_dev *dev, uint8_t index);
 
+/* Device descriptor is the main descriptor and it provides the device
+ * class, sub-class, the protocol to access the device and the maximum
+ * number oflogical units in the device.
+ */
+int dme_read_device_desc(struct ufs_dev *dev);
+
+/* Geometry Descriptor contains RPMB read write size which indicates total
+   number of rpmb frames allowed in a single SCSI security command.
+*/
+int dme_read_geo_desc(struct ufs_dev *dev);
+
 #endif
diff --git a/platform/msm_shared/include/gpio.h b/platform/msm_shared/include/gpio.h
index 3606641..b7305b4 100644
--- a/platform/msm_shared/include/gpio.h
+++ b/platform/msm_shared/include/gpio.h
@@ -50,7 +50,7 @@
 	TLMM_NO_PULL = 0x0,
 } tlmm_pull_values;
 
-/* Bit offsets in the TLMM register */
+/* SDC Bit offsets in the TLMM register */
 enum {
 	SDC1_DATA_HDRV_CTL_OFF = 0,
 	SDC1_CMD_HDRV_CTL_OFF  = 3,
@@ -59,7 +59,25 @@
 	SDC1_CMD_PULL_CTL_OFF  = 11,
 	SDC1_CLK_PULL_CTL_OFF  = 13,
 	SDC1_RCLK_PULL_CTL_OFF = 15,
-} tlmm_drv_ctrl;
+} tlmm_sdc_drv_ctrl;
+
+/* EBI2 Bit offsets in the TLMM register */
+enum {
+	EBI2_BUSY_HDRV_CTL_OFF = 29,
+	EBI2_WE_HDRV_CTL_OFF   = 24,
+	EBI2_OE_HDRV_CTL_OFF   = 9,
+	EBI2_CLE_HDRV_CTL_OFF  = 19,
+	EBI2_ALE_HDRV_CTL_OFF  = 14,
+	EBI2_CS_HDRV_CTL_OFF   = 4,
+	EBI2_DATA_HDRV_CTL_OFF = 17,
+	EBI2_BUSY_PULL_CTL_OFF = 27,
+	EBI2_WE_PULL_CTL_OFF   = 22,
+	EBI2_OE_PULL_CTL_OFF   = 7 ,
+	EBI2_CLE_PULL_CTL_OFF  = 17,
+	EBI2_ALE_PULL_CTL_OFF  = 12,
+	EBI2_CS_PULL_CTL_OFF   = 2,
+	EBI2_DATA_PULL_CTL_OFF = 15,
+} tlmm_ebi2_drv_ctrl;
 
 /* Input for the tlmm config function */
 struct tlmm_cfgs {
diff --git a/platform/msm_shared/include/mipi_dsi.h b/platform/msm_shared/include/mipi_dsi.h
index 84d5b44..9e73092 100644
--- a/platform/msm_shared/include/mipi_dsi.h
+++ b/platform/msm_shared/include/mipi_dsi.h
@@ -92,6 +92,7 @@
 #define TIMING_FLUSH		     0x1E4
 #define TIMING_DB_MODE		     0x1E8
 
+#define DSI_HW_REV_103			0x10030000	/* 8994 */
 #define DSI_HW_REV_103_1		0x10030001	/* 8936/8939 */
 
 #define DTYPE_GEN_WRITE2 0x23	/* 4th Byte is 0x80 */
diff --git a/platform/msm_shared/include/mmc_sdhci.h b/platform/msm_shared/include/mmc_sdhci.h
index 0098c0e..5f5ba72 100644
--- a/platform/msm_shared/include/mmc_sdhci.h
+++ b/platform/msm_shared/include/mmc_sdhci.h
@@ -86,6 +86,7 @@
 
 /* EXT_CSD */
 /* Offsets in the ext csd */
+#define MMC_EXT_CSD_RST_N_FUNC                    162
 #define MMC_EXT_MMC_BUS_WIDTH                     183
 #define MMC_EXT_MMC_HS_TIMING                     185
 #define MMC_DEVICE_TYPE                           196
@@ -114,6 +115,7 @@
 #define MMC_SEC_COUNT3_SHIFT                      16
 #define MMC_SEC_COUNT2_SHIFT                      8
 #define MMC_HC_ERASE_MULT                         (512 * 1024)
+#define RST_N_FUNC_ENABLE                         BIT(0)
 
 /* Command related */
 #define MMC_MAX_COMMAND_RETRY                     1000
diff --git a/platform/msm_shared/include/mmc_wrapper.h b/platform/msm_shared/include/mmc_wrapper.h
index 57f74a0..f52a117 100644
--- a/platform/msm_shared/include/mmc_wrapper.h
+++ b/platform/msm_shared/include/mmc_wrapper.h
@@ -48,4 +48,5 @@
 void mmc_set_lun(uint8_t lun);
 uint8_t mmc_get_lun(void);
 void  mmc_read_partition_table(uint8_t arg);
+uint32_t mmc_write_protect(const char *name, int set_clr);
 #endif
diff --git a/platform/msm_shared/include/msm_panel.h b/platform/msm_shared/include/msm_panel.h
index 6944f09..e2c9923 100755
--- a/platform/msm_shared/include/msm_panel.h
+++ b/platform/msm_shared/include/msm_panel.h
@@ -50,6 +50,7 @@
 #define WRITEBACK_PANEL		10	/* Wifi display */
 #define LVDS_PANEL		11	/* LVDS */
 #define EDP_PANEL		12	/* EDP */
+#define QPIC_PANEL		13	/* QPIC */
 
 enum mdss_mdp_pipe_type {
 	MDSS_MDP_PIPE_TYPE_VIG,
@@ -241,6 +242,10 @@
 	uint32_t pipe_type;
 	char     lowpowerstop;
 	char     lcd_reg_en;
+	uint32_t border_top;
+	uint32_t border_bottom;
+	uint32_t border_left;
+	uint32_t border_right;
 
 	struct lcd_panel_info lcd;
 	struct lcdc_panel_info lcdc;
diff --git a/platform/msm_shared/include/partition_parser.h b/platform/msm_shared/include/partition_parser.h
index a2d3edd..af69e03 100644
--- a/platform/msm_shared/include/partition_parser.h
+++ b/platform/msm_shared/include/partition_parser.h
@@ -73,6 +73,7 @@
 #define PARTITION_TYPE_GUID_SIZE   16
 #define UNIQUE_PARTITION_GUID_SIZE 16
 #define NUM_PARTITIONS             128
+#define PART_ATT_READONLY_OFFSET   60
 
 /* Some useful define used to access the MBR/EBR table */
 #define BLOCK_SIZE                0x200
@@ -179,5 +180,6 @@
 
 /* For Debugging */
 void partition_dump(void);
-
+/* Read only attribute for partition */
+int partition_read_only(int index);
 #endif
diff --git a/platform/msm_shared/include/qgic.h b/platform/msm_shared/include/qgic.h
index 30abec5..cb4c573 100644
--- a/platform/msm_shared/include/qgic.h
+++ b/platform/msm_shared/include/qgic.h
@@ -30,11 +30,9 @@
 #ifndef __PLATFORM_MSM_SHARED_QGIC_H
 #define __PLATFORM_MSM_SHARED_QGIC_H
 
-#include <platform/iomap.h>
-#include <platform/interrupts.h>
+#include "qgic_common.h"
 
 #define GIC_CPU_REG(off)            (MSM_GIC_CPU_BASE  + (off))
-#define GIC_DIST_REG(off)           (MSM_GIC_DIST_BASE + (off))
 
 #define GIC_CPU_CTRL                GIC_CPU_REG(0x00)
 #define GIC_CPU_PRIMASK             GIC_CPU_REG(0x04)
@@ -44,29 +42,12 @@
 #define GIC_CPU_RUNNINGPRI          GIC_CPU_REG(0x14)
 #define GIC_CPU_HIGHPRI             GIC_CPU_REG(0x18)
 
-#define GIC_DIST_CTRL               GIC_DIST_REG(0x000)
-#define GIC_DIST_CTR                GIC_DIST_REG(0x004)
-#define GIC_DIST_ENABLE_SET         GIC_DIST_REG(0x100)
-#define GIC_DIST_ENABLE_CLEAR       GIC_DIST_REG(0x180)
-#define GIC_DIST_PENDING_SET        GIC_DIST_REG(0x200)
-#define GIC_DIST_PENDING_CLEAR      GIC_DIST_REG(0x280)
-#define GIC_DIST_ACTIVE_BIT         GIC_DIST_REG(0x300)
-#define GIC_DIST_PRI                GIC_DIST_REG(0x400)
-#define GIC_DIST_TARGET             GIC_DIST_REG(0x800)
-#define GIC_DIST_CONFIG             GIC_DIST_REG(0xc00)
-#define GIC_DIST_SOFTINT            GIC_DIST_REG(0xf00)
-
 #define INTERRUPT_LVL_N_TO_N        0x0
 #define INTERRUPT_LVL_1_TO_N        0x1
 #define INTERRUPT_EDGE_N_TO_N       0x2
 #define INTERRUPT_EDGE_1_TO_N       0x3
 
-struct ihandler {
-	int_handler func;
-	void *arg;
-};
-
-void qgic_init(void);
-void qgic_change_interrupt_cfg(uint32_t spi_number, uint8_t type);
+uint32_t qgic_read_iar(void);
+void qgic_write_eoi(uint32_t);
 
 #endif
diff --git a/platform/msm_shared/include/qgic_common.h b/platform/msm_shared/include/qgic_common.h
new file mode 100644
index 0000000..431803d
--- /dev/null
+++ b/platform/msm_shared/include/qgic_common.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2011,2014 The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __PLATFORM_MSM_SHARED_QGIC_COMMON_H
+#define __PLATFORM_MSM_SHARED_QGIC_COMMON_H
+
+#include <platform/iomap.h>
+#include <platform/irqs.h>
+#include <platform/interrupts.h>
+
+#define GIC_DIST_REG(off)           (MSM_GIC_DIST_BASE + (off))
+
+#define GIC_DIST_CTRL               GIC_DIST_REG(0x000)
+#define GIC_DIST_CTR                GIC_DIST_REG(0x004)
+#define GIC_DIST_ENABLE_SET         GIC_DIST_REG(0x100)
+#define GIC_DIST_ENABLE_CLEAR       GIC_DIST_REG(0x180)
+#define GIC_DIST_PENDING_SET        GIC_DIST_REG(0x200)
+#define GIC_DIST_PENDING_CLEAR      GIC_DIST_REG(0x280)
+#define GIC_DIST_ACTIVE_BIT         GIC_DIST_REG(0x300)
+#define GIC_DIST_PRI                GIC_DIST_REG(0x400)
+#define GIC_DIST_TARGET             GIC_DIST_REG(0x800)
+#define GIC_DIST_CONFIG             GIC_DIST_REG(0xc00)
+#define GIC_DIST_SOFTINT            GIC_DIST_REG(0xf00)
+
+struct ihandler {
+	int_handler func;
+	void *arg;
+};
+
+void qgic_init(void);
+void qgic_dist_config(uint32_t);
+void qgic_dist_init(void);
+void qgic_cpu_init(void);
+void qgic_change_interrupt_cfg(uint32_t spi_number, uint8_t type);
+#endif
diff --git a/platform/msm_shared/include/qgic_v3.h b/platform/msm_shared/include/qgic_v3.h
new file mode 100644
index 0000000..e0c159d
--- /dev/null
+++ b/platform/msm_shared/include/qgic_v3.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __PLATFORM_MSM_SHARED_QGIC_V3_H
+#define __PLATFORM_MSM_SHARED_QGIC_V3_H
+
+#include "qgic_common.h"
+
+#define GICD_IROUTER                GIC_DIST_REG(0x6000)
+#define GICR_WAKER_CPU0             MSM_GIC_REDIST_BASE
+
+#define ENABLE_GRP0_SEC             BIT(0)
+#define ENABLE_GRP1_NS              BIT(1)
+#define ENABLE_ARE                  BIT(4)
+
+uint32_t qgic_read_iar(void);
+void qgic_write_eoi(uint32_t);
+
+#endif
diff --git a/platform/msm_shared/include/qpic.h b/platform/msm_shared/include/qpic.h
new file mode 100644
index 0000000..237923c
--- /dev/null
+++ b/platform/msm_shared/include/qpic.h
@@ -0,0 +1,100 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef MDSS_QPIC_H
+#define MDSS_QPIC_H
+
+#include "qpic_panel.h"
+
+#define QPIC_REG_QPIC_LCDC_CTRL				0x22000
+#define QPIC_REG_LCDC_VERSION				0x22004
+#define QPIC_REG_QPIC_LCDC_IRQ_EN			0x22008
+#define QPIC_REG_QPIC_LCDC_IRQ_STTS			0x2200C
+#define QPIC_REG_QPIC_LCDC_IRQ_CLR			0x22010
+#define QPIC_REG_QPIC_LCDC_STTS				0x22014
+#define QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT	0x22018
+#define QPIC_REG_QPIC_LCDC_CFG0				0x22020
+#define QPIC_REG_QPIC_LCDC_CFG1				0x22024
+#define QPIC_REG_QPIC_LCDC_CFG2				0x22028
+#define QPIC_REG_QPIC_LCDC_RESET			0x2202C
+#define QPIC_REG_QPIC_LCDC_FIFO_SOF			0x22100
+#define QPIC_REG_LCD_DEVICE_CMD0			0x23000
+#define QPIC_REG_QPIC_LCDC_FIFO_DATA_PORT0	0x22140
+#define QPIC_REG_QPIC_LCDC_FIFO_EOF			0x22180
+
+#define QPIC_OUTP(off, data) \
+	writel((data), qpic_res->qpic_base + (off))
+#define QPIC_OUTPW(off, data) \
+	writehw((data), qpic_res->qpic_base + (off))
+#define QPIC_INP(off) \
+	readl(qpic_res->qpic_base + (off))
+
+#define QPIC_MAX_VSYNC_WAIT_TIME			500
+#define QPIC_MAX_WAIT_CNT			1000
+#define QPIC_MAX_CMD_BUF_SIZE				512
+
+int mdss_qpic_init(void);
+int qpic_send_pkt(uint32_t cmd, uint8_t *param, uint32_t len);
+uint32_t qpic_read_data(uint32_t cmd_index, uint32_t size);
+int mdss_qpic_panel_on(struct qpic_panel_io_desc *panel_io);
+int mdss_qpic_panel_off(struct qpic_panel_io_desc *panel_io);
+
+struct qpic_data_type {
+	uint32_t rev;
+	size_t qpic_reg_size;
+	uint32_t qpic_phys;
+	uint32_t qpic_base;
+	uint32_t irq;
+	uint32_t irq_ena;
+	uint32_t res_init;
+	void *fb_virt;
+	uint32_t fb_phys;
+	void *cmd_buf_virt;
+	uint32_t cmd_buf_phys;
+	int qpic_endpt;
+	uint32_t sps_init;
+	uint32_t irq_requested;
+	struct qpic_panel_io_desc panel_io;
+	uint32_t bus_handle;
+	int fifo_eof_comp;
+	int fb_xres;
+	int fb_yres;
+	int fb_bpp;
+	int base;
+};
+
+uint32_t qpic_send_frame(
+		uint32_t x_start,
+		uint32_t y_start,
+		uint32_t x_end,
+		uint32_t y_end,
+		uint32_t *data,
+		uint32_t total_bytes);
+
+#endif /* MDSS_QPIC_H */
diff --git a/platform/msm_shared/include/qpic_panel.h b/platform/msm_shared/include/qpic_panel.h
new file mode 100644
index 0000000..79f9bac
--- /dev/null
+++ b/platform/msm_shared/include/qpic_panel.h
@@ -0,0 +1,132 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef MDSS_QPIC_PANEL_H
+#define MDSS_QPIC_PANEL_H
+
+#define LCDC_INTERNAL_BUFFER_SIZE   30
+
+/* Macros for coding MIPI commands */
+#define INV_SIZE             0xFFFF
+/* Size of argument to MIPI command is variable */
+#define OP_SIZE_PAIR(op, size)    ((op << 16) | size)
+/* MIPI {command, argument size} tuple */
+#define LCDC_EXTRACT_OP_SIZE(op_identifier)     ((op_identifier & 0xFFFF))
+/* extract size from command identifier */
+#define LCDC_EXTRACT_OP_CMD(op_identifier)  (((op_identifier >> 16) & 0xFFFF))
+/* extract command id from command identifier */
+
+/* MIPI standard efinitions */
+#define LCDC_ADDRESS_MODE_ORDER_BOTTOM_TO_TOP                0x80
+#define LCDC_ADDRESS_MODE_ORDER_RIGHT_TO_LEFT                0x40
+#define LCDC_ADDRESS_MODE_ORDER_REVERSE                      0x20
+#define LCDC_ADDRESS_MODE_ORDER_REFRESH_BOTTOM_TO_TOP        0x10
+#define LCDC_ADDRESS_MODE_ORDER_BGER_RGB                     0x08
+#define LCDC_ADDRESS_MODE_ORDER_REFERESH_RIGHT_TO_LEFT       0x04
+#define LCDC_ADDRESS_MODE_FLIP_HORIZONTAL                    0x02
+#define LCDC_ADDRESS_MODE_FLIP_VERTICAL                      0x01
+
+#define LCDC_PIXEL_FORMAT_3_BITS_PER_PIXEL    0x1
+#define LCDC_PIXEL_FORMAT_8_BITS_PER_PIXEL    0x2
+#define LCDC_PIXEL_FORMAT_12_BITS_PER_PIXEL   0x3
+#define LCDC_PIXEL_FORMAT_16_BITS_PER_PIXEL   0x5
+#define LCDC_PIXEL_FORMAT_18_BITS_PER_PIXEL   0x6
+#define LCDC_PIXEL_FORMAT_24_BITS_PER_PIXEL   0x7
+
+#define LCDC_CREATE_PIXEL_FORMAT(dpi_format, dbi_format) \
+	(dpi_format | (dpi_format << 4))
+
+#define POWER_MODE_IDLE_ON       0x40
+#define POWER_MODE_PARTIAL_ON    0x20
+#define POWER_MODE_SLEEP_ON      0x10
+#define POWER_MODE_NORMAL_ON     0x08
+#define POWER_MODE_DISPLAY_ON    0x04
+
+#define LCDC_DISPLAY_MODE_SCROLLING_ON       0x80
+#define LCDC_DISPLAY_MODE_INVERSION_ON       0x20
+#define LCDC_DISPLAY_MODE_GAMMA_MASK         0x07
+
+/* LDCc MIPI Type B supported commands */
+#define	OP_ENTER_IDLE_MODE      0x39
+#define	OP_ENTER_INVERT_MODE    0x21
+#define	OP_ENTER_NORMAL_MODE    0x13
+#define	OP_ENTER_PARTIAL_MODE   0x12
+#define	OP_ENTER_SLEEP_MODE     0x10
+#define	OP_EXIT_INVERT_MODE     0x20
+#define	OP_EXIT_SLEEP_MODE      0x11
+#define	OP_EXIT_IDLE_MODE       0x38
+#define	OP_GET_ADDRESS_MODE     0x0B /* size 1 */
+#define	OP_GET_BLUE_CHANNEL     0x08 /* size 1 */
+#define	OP_GET_DIAGNOSTIC       0x0F /* size 2 */
+#define	OP_GET_DISPLAY_MODE     0x0D /* size 1 */
+#define	OP_GET_GREEN_CHANNEL    0x07 /* size 1 */
+#define	OP_GET_PIXEL_FORMAT     0x0C /* size 1 */
+#define	OP_GET_POWER_MODE       0x0A /* size 1 */
+#define	OP_GET_RED_CHANNEL      0x06 /* size 1 */
+#define	OP_GET_SCANLINE         0x45 /* size 1 */
+#define	OP_GET_SIGNAL_MODE      0x0E /* size 1 */
+#define	OP_NOP                  0x00
+#define	OP_READ_DDB_CONTINUE    0xA8 /* size not fixed */
+#define	OP_READ_DDB_START       0xA1 /* size not fixed */
+#define	OP_READ_MEMORY_CONTINUE 0x3E /* size not fixed */
+#define	OP_READ_MEMORY_START    0x2E /* size not fixed */
+#define	OP_SET_ADDRESS_MODE     0x36 /* size 1 */
+#define	OP_SET_COLUMN_ADDRESS   0x2A /* size 4 */
+#define	OP_SET_DISPLAY_OFF      0x28
+#define	OP_SET_DISPLAY_ON       0x29
+#define	OP_SET_GAMMA_CURVE      0x26 /* size 1 */
+#define	OP_SET_PAGE_ADDRESS     0x2B /* size 4 */
+#define	OP_SET_PARTIAL_COLUMNS  0x31 /* size 4 */
+#define	OP_SET_PARTIAL_ROWS     0x30 /* size 4 */
+#define	OP_SET_PIXEL_FORMAT     0x3A /* size 1 */
+#define	OP_SOFT_RESET           0x01
+#define	OP_WRITE_MEMORY_CONTINUE  0x3C /* size not fixed */
+#define	OP_WRITE_MEMORY_START   0x2C /* size not fixed */
+
+/* ILI9341 commands */
+#define OP_ILI9341_INTERFACE_CONTROL    0xf6
+#define OP_ILI9341_TEARING_EFFECT_LINE_ON    0x35
+
+struct qpic_panel_io_desc {
+	int rst_gpio;
+	int cs_gpio;
+	int ad8_gpio;
+	int te_gpio;
+	int bl_gpio;
+	int vdd_vreg;
+	int avdd_vreg;
+	uint32_t init;
+};
+
+int mdss_qpic_panel_io_init(struct qpic_panel_io_desc *qpic_panel_io);
+uint32_t qpic_panel_get_cmd(uint32_t command, uint32_t size);
+int ili9341_on(struct qpic_panel_io_desc *qpic_panel_io);
+void ili9341_off(struct qpic_panel_io_desc *qpic_panel_io);
+
+#endif /* MDSS_QPIC_PANEL_H */
diff --git a/platform/msm_shared/include/regulator.h b/platform/msm_shared/include/regulator.h
index 4e6c932..2915a16 100644
--- a/platform/msm_shared/include/regulator.h
+++ b/platform/msm_shared/include/regulator.h
@@ -30,6 +30,12 @@
 #ifndef __REGULATOR_H
 #define __REGULATOR_H
 
+#define GENERIC_DISABLE 0
+#define GENERIC_ENABLE  1
+#define SW_MODE_LDO_IPEAK 1
+#define LDOA_RES_TYPE 0x616F646C //aodl
+#define SMPS_RES_TYPE 0x61706D73 //apms
+
 #define KEY_SOFTWARE_ENABLE                0x6E657773 // swen - software enable
 #define KEY_LDO_SOFTWARE_MODE              0X646D736C // lsmd - LDO software mode
 #define KEY_SMPS_SOFTWARE_MODE             0X646D7373 // ssmd - SMPS software mode
@@ -45,6 +51,11 @@
 #define KEY_BYPASS_ALLOWED_KEY             0x61707962 //bypa - bypass allowed
 #define KEY_CORNER_LEVEL_KEY               0x6E726F63 // corn - coner voltage
 #define KEY_ACTIVE_FLOOR                   0x636676
+#define GENERIC_DISABLE 0
+#define GENERIC_ENABLE  1
+#define SW_MODE_LDO_IPEAK 1
+#define LDOA_RES_TYPE 0x616F646C //aodl
+#define SMPS_RES_TYPE 0x61706D73 //apms
 
 void regulator_enable();
 void regulator_disable();
diff --git a/platform/msm_shared/include/rpmb.h b/platform/msm_shared/include/rpmb.h
new file mode 100644
index 0000000..8bbd985
--- /dev/null
+++ b/platform/msm_shared/include/rpmb.h
@@ -0,0 +1,70 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* RPMB request and response types */
+enum rpmb_rr_type {
+	KEY_PROVISION = 0x1,
+	READ_WRITE_COUNTER,
+	AUTH_WRITE,
+	AUTH_READ,
+	READ_RESULT_FLAG,
+};
+
+/* List of all return codes for rpmb frame verification from response */
+enum rpmb_verify_return_codes
+{
+	NONCE_MISMATCH = 0x100,
+};
+
+/* These are error codes returned for RPMB operations */
+enum rpmb_verify_error_codes
+{
+	OPERATION_OK = 0,
+	GENERAL_FAILURE,
+	AUTH_FAILURE,
+	COUNTER_FAILURE,
+	ADDRESS_FAILURE,
+	WRITE_FAILURE,
+	READ_FAILURE,
+	KEY_NOT_PROG,
+	MAXED_WR_COUNTER = 0x80,
+};
+
+/* RPMB Frame */
+struct rpmb_frame
+{
+	uint8_t  stuff_bytes[196];
+	uint8_t  keyMAC[32];
+	uint8_t  data[256];
+	uint8_t  nonce[16];
+	uint32_t writecounter;
+	uint16_t address;
+	uint16_t blockcount;
+	uint8_t  result[2];
+	uint16_t requestresponse;
+};
diff --git a/platform/msm_shared/include/sdhci_msm.h b/platform/msm_shared/include/sdhci_msm.h
index 4682694..fe68140 100644
--- a/platform/msm_shared/include/sdhci_msm.h
+++ b/platform/msm_shared/include/sdhci_msm.h
@@ -121,6 +121,8 @@
 #define HC_IO_PAD_PWR_SWITCH_EN                   BIT(15)
 #define HC_IO_PAD_PWR_SWITCH                      BIT(16)
 
+#define SDCC_HC_VENDOR_SPECIFIC_CAPABILITIES0     0x11C
+
 struct sdhci_msm_data
 {
 	uint32_t pwrctl_base;
diff --git a/platform/msm_shared/include/splash.h b/platform/msm_shared/include/splash.h
index d908cf6..2afa254 100644
--- a/platform/msm_shared/include/splash.h
+++ b/platform/msm_shared/include/splash.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010,2014, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,10 +30,12 @@
 #ifndef __PLATFORM_SPLASH_H
 #define __PLATFORM_SPLASH_H
 
-#define SPLASH_IMAGE_WIDTH     124
-#define SPLASH_IMAGE_HEIGHT    113
+#define SPLASH_IMAGE_WIDTH     113
+#define SPLASH_IMAGE_HEIGHT    124
 
 #if (!DISPLAY_TYPE_MIPI)
+#define SPLASH_IMAGE_WIDTH     124
+#define SPLASH_IMAGE_HEIGHT    113
 /* This image is (SPLASH_IMAGE_WIDTH x SPLASH_IMAGE_WIDTH) raw image */
 static char imageBuffer[] = {
 
diff --git a/platform/msm_shared/include/ucs.h b/platform/msm_shared/include/ucs.h
index e4d366e..094946e 100644
--- a/platform/msm_shared/include/ucs.h
+++ b/platform/msm_shared/include/ucs.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -40,6 +40,12 @@
 #define SCSI_SENSE_BUF_LEN             0x20
 #define SCSI_INQUIRY_LEN               36
 #define SCSI_CDB_PARAM_LEN             16
+#define SCSI_SEC_PROT                  0xEC
+#define SCSI_SEC_UFS_PROT_ID           0x0001
+
+#define RPMB_BLK_SIZE                  512
+#define RPMB_FRAME_SIZE                512
+#define RPMB_MIN_BLK_CNT               1
 
 /* FLAGS for indication of read or write */
 enum scsi_upiu_flags
@@ -87,6 +93,18 @@
 	uint32_t data_buffer_base;
 };
 
+struct scsi_sec_protocol_cdb
+{
+	uint8_t  opcode;
+	uint8_t  cdb1;
+	uint16_t sec_protocol_specific;
+	uint8_t  resv1;
+	uint8_t  resv2;
+	uint32_t alloc_tlen;
+	uint8_t  resv3;
+	uint8_t  control;
+}__PACKED;
+
 struct scsi_rdwr_cdb
 {
 	uint8_t  opcode;
@@ -147,5 +165,14 @@
 int ucs_scsi_send_inquiry(struct ufs_dev *dev);
 int ucs_do_scsi_read(struct ufs_dev *dev, struct scsi_rdwr_req *req);
 int ucs_do_scsi_write(struct ufs_dev *dev, struct scsi_rdwr_req *req);
+int ucs_do_scsi_unmap(struct ufs_dev *dev, struct scsi_unmap_req *req);
+/*
+ * ucs_do_sci_rpmb_read function takes a RPMB frame, sector address and number of
+ * blocks to be read from RPMB partition as input and returns one or more RPMB
+ * frames as response along with total length of the reponse. The response is then
+ * processed by upper layers.
+ */
+int ucs_do_scsi_rpmb_read(struct ufs_dev *dev, uint32_t *req_buf, uint32_t blk_cnt,
+                                 uint32_t *resp_buffer, uint32_t *response_length);
 
 #endif
diff --git a/platform/msm_shared/include/ufs.h b/platform/msm_shared/include/ufs.h
index b5c76fc..c28c949 100644
--- a/platform/msm_shared/include/ufs.h
+++ b/platform/msm_shared/include/ufs.h
@@ -95,6 +95,8 @@
 	uint32_t                     serial_num;
 	uint32_t                     block_size;
 	uint32_t                     erase_blk_size;
+	uint32_t                     rpmb_rw_size;
+	uint32_t                     rpmb_num_blocks;
 	uint64_t                     capacity;
 	struct ufs_unit_desc         lun_cfg[8];
 
diff --git a/platform/msm_shared/mdp5.c b/platform/msm_shared/mdp5.c
index ff0709e..5509bc8 100755
--- a/platform/msm_shared/mdp5.c
+++ b/platform/msm_shared/mdp5.c
@@ -109,18 +109,29 @@
 				uint32_t *ctl0_reg_val, uint32_t *ctl1_reg_val)
 {
 	uint32_t mdss_mdp_rev = readl(MDP_HW_REV);
+	bool dual_pipe_single_ctl = pinfo->lcdc.dual_pipe &&
+		!pinfo->mipi.dual_dsi && !pinfo->lcdc.split_display;
 	switch (pinfo->pipe_type) {
 		case MDSS_MDP_PIPE_TYPE_RGB:
-			*ctl0_reg_val = 0x22048;
+			if (dual_pipe_single_ctl)
+				*ctl0_reg_val = 0x220D8;
+			else
+				*ctl0_reg_val = 0x22048;
 			*ctl1_reg_val = 0x24090;
 			break;
 		case MDSS_MDP_PIPE_TYPE_DMA:
-			*ctl0_reg_val = 0x22840;
+			if (dual_pipe_single_ctl)
+				*ctl0_reg_val = 0x238C0;
+			else
+				*ctl0_reg_val = 0x22840;
 			*ctl1_reg_val = 0x25080;
 			break;
 		case MDSS_MDP_PIPE_TYPE_VIG:
 		default:
-			*ctl0_reg_val = 0x22041;
+			if (dual_pipe_single_ctl)
+				*ctl0_reg_val = 0x220C3;
+			else
+				*ctl0_reg_val = 0x22041;
 			*ctl1_reg_val = 0x24082;
 			break;
 	}
@@ -142,12 +153,17 @@
 	uint32_t src_size, out_size, stride;
 	uint32_t fb_off = 0;
 	uint32_t flip_bits = 0;
+	uint32_t src_xy = 0, dst_xy = 0;
+	uint32_t height, width;
+
+	height = fb->height - pinfo->border_top - pinfo->border_bottom;
+	width = fb->width - pinfo->border_left - pinfo->border_right;
 
 	/* write active region size*/
-	src_size = (fb->height << 16) + fb->width;
+	src_size = (height << 16) + width;
 	out_size = src_size;
 	if (pinfo->lcdc.dual_pipe) {
-		out_size = (fb->height << 16) + (fb->width / 2);
+		out_size = (height << 16) + (width / 2);
 		if ((pipe_base == MDP_VP_0_RGB_1_BASE) ||
 			(pipe_base == MDP_VP_0_DMA_1_BASE) ||
 			(pipe_base == MDP_VP_0_VIG_1_BASE))
@@ -156,13 +172,24 @@
 
 	stride = (fb->stride * fb->bpp/8);
 
+	if (fb_off == 0) {	/* left */
+		dst_xy = (pinfo->border_top << 16) | pinfo->border_left;
+		src_xy = dst_xy;
+	} else {	/* right */
+		dst_xy = (pinfo->border_top << 16);
+		src_xy = (pinfo->border_top << 16) | fb_off;
+	}
+
+	dprintf(SPEW,"%s: src=%x fb_off=%x src_xy=%x dst_xy=%x\n",
+			 __func__, out_size, fb_off, src_xy, dst_xy);
+
 	writel(fb->base, pipe_base + PIPE_SSPP_SRC0_ADDR);
 	writel(stride, pipe_base + PIPE_SSPP_SRC_YSTRIDE);
 	writel(src_size, pipe_base + PIPE_SSPP_SRC_IMG_SIZE);
 	writel(out_size, pipe_base + PIPE_SSPP_SRC_SIZE);
 	writel(out_size, pipe_base + PIPE_SSPP_SRC_OUT_SIZE);
-	writel(fb_off, pipe_base + PIPE_SSPP_SRC_XY);
-	writel(0x00, pipe_base + PIPE_SSPP_OUT_XY);
+	writel(src_xy, pipe_base + PIPE_SSPP_SRC_XY);
+	writel(dst_xy, pipe_base + PIPE_SSPP_OUT_XY);
 
 	/* Tight Packing 3bpp 0-Alpha 8-bit R B G */
 	writel(0x0002243F, pipe_base + PIPE_SSPP_SRC_FORMAT);
@@ -762,6 +789,12 @@
 	mdss_layer_mixer_setup(fb, pinfo);
 
 	reg = 0x1f00 | mdss_mdp_ctl_out_sel(pinfo, 1);
+
+	/* enable 3D mux for dual_pipe but single interface config */
+	if (pinfo->lcdc.dual_pipe && !pinfo->mipi.dual_dsi &&
+		!pinfo->lcdc.split_display)
+		reg |= BIT(19) | BIT(20);
+
 	writel(reg, MDP_CTL_0_BASE + CTL_TOP);
 
 	/*If dst_split is enabled only intf 2 needs to be enabled.
diff --git a/platform/msm_shared/mipi_dsi.c b/platform/msm_shared/mipi_dsi.c
index fef1a0f..cedefe7 100644
--- a/platform/msm_shared/mipi_dsi.c
+++ b/platform/msm_shared/mipi_dsi.c
@@ -666,7 +666,8 @@
 	writel(0x02020202, ctl_base + INT_CTRL);
 
 	/* For 8916/8939, enable DSI timing double buffering */
-	if (readl(ctl_base) == DSI_HW_REV_103_1)
+	if (readl(ctl_base) == DSI_HW_REV_103_1 &&
+				mdp_get_revision() != MDP_REV_305)
 		writel(0x1, ctl_base + TIMING_DB_MODE);
 
 	writel(((disp_width + hsync_porch0_bp) << 16) | hsync_porch0_bp,
@@ -698,14 +699,15 @@
 	writel(vsync_width << 16 | 0, ctl_base + VIDEO_MODE_VSYNC_VPOS);
 
 	/* For 8916/8939, flush the DSI timing registers */
-	if (readl(ctl_base) == DSI_HW_REV_103_1)
+	if (readl(ctl_base) == DSI_HW_REV_103_1 &&
+				mdp_get_revision() != MDP_REV_305)
 		writel(0x1, ctl_base + TIMING_FLUSH);
 
 	writel(0x0, ctl_base + EOT_PACKET_CTRL);
 
 	writel(0x00000100, ctl_base + MISR_VIDEO_CTRL);
 
-	if (mdp_get_revision() >= MDP_REV_41) {
+	if (mdp_get_revision() >= MDP_REV_41 || mdp_get_revision() == MDP_REV_305) {
 		writel(low_pwr_stop_mode << 16 |
 				eof_bllp_pwr << 12 | traffic_mode << 8
 				| dst_format << 4 | 0x0, ctl_base + VIDEO_MODE_CTRL);
diff --git a/platform/msm_shared/mipi_dsi_autopll.c b/platform/msm_shared/mipi_dsi_autopll.c
index 9e7ee60..b5d386f 100755
--- a/platform/msm_shared/mipi_dsi_autopll.c
+++ b/platform/msm_shared/mipi_dsi_autopll.c
@@ -98,7 +98,7 @@
 			break;
 	if (i == LPFR_LUT_SIZE) {
 		dprintf(INFO, "unable to get loop filter resistance. vco=%d\n"
-						, lpfr_lut[i].vco_rate);
+						, lpfr_lut[i-1].vco_rate);
 		rc = ERROR;
 		return rc;
 	}
diff --git a/platform/msm_shared/mipi_dsi_phy.c b/platform/msm_shared/mipi_dsi_phy.c
index cd2d217..9fd69a4 100644
--- a/platform/msm_shared/mipi_dsi_phy.c
+++ b/platform/msm_shared/mipi_dsi_phy.c
@@ -214,29 +214,58 @@
 	udelay(100);
 }
 
-int mdss_dsi_phy_regulator_init(struct mdss_dsi_phy_ctrl *pd)
+int mdss_dsi_phy_regulator_init(struct mdss_dsi_phy_ctrl *pd, uint32_t phy_base)
 {
 	/* DSI0 and DSI1 have a common regulator */
 
 	uint32_t off = 0x0280;	/* phy regulator ctrl settings */
 
-	/* Regulator ctrl 0 */
-	writel(0x00, DSI0_PHY_BASE + off + (4 * 0));
-	/* Regulator ctrl - CAL_PWD_CFG */
-	writel(pd->regulator[6], DSI0_PHY_BASE + off + (4 * 6));
-	/* Regulator ctrl - TEST */
-	writel(pd->regulator[5], DSI0_PHY_BASE + off + (4 * 5));
-	/* Regulator ctrl 3 */
-	writel(pd->regulator[3], DSI0_PHY_BASE + off + (4 * 3));
-	/* Regulator ctrl 2 */
-	writel(pd->regulator[2], DSI0_PHY_BASE + off + (4 * 2));
-	/* Regulator ctrl 1 */
-	writel(pd->regulator[1], DSI0_PHY_BASE + off + (4 * 1));
-	/* Regulator ctrl 0 */
-	writel(pd->regulator[0], DSI0_PHY_BASE + off + (4 * 0));
-	/* Regulator ctrl 4 */
-	writel(pd->regulator[4], DSI0_PHY_BASE + off + (4 * 4));
-	dmb();
+	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE) {
+		/* Regulator ctrl 0 */
+		writel(0x00, DSI0_PHY_BASE + off + (4 * 0));
+		/* Regulator ctrl - CAL_PWD_CFG */
+		writel(pd->regulator[6], DSI0_PHY_BASE + off + (4 * 6));
+		/* Add h/w recommended delay */
+		udelay(1000);
+		/* Regulator ctrl - TEST */
+		writel(pd->regulator[5], DSI0_PHY_BASE + off + (4 * 5));
+		/* Regulator ctrl 3 */
+		writel(pd->regulator[3], DSI0_PHY_BASE + off + (4 * 3));
+		/* Regulator ctrl 2 */
+		writel(pd->regulator[2], DSI0_PHY_BASE + off + (4 * 2));
+		/* Regulator ctrl 1 */
+		writel(pd->regulator[1], DSI0_PHY_BASE + off + (4 * 1));
+		/* Regulator ctrl 4 */
+		writel(pd->regulator[4], DSI0_PHY_BASE + off + (4 * 4));
+		/* LDO ctrl */
+		if (readl(MIPI_DSI0_BASE) == DSI_HW_REV_103_1) /* 8916/8939 */
+			writel(0x05, phy_base + 0x01dc);
+		else if (readl(MIPI_DSI0_BASE) == DSI_HW_REV_103) /* 8994 */
+			writel(0x1d, phy_base + 0x01dc);
+		else
+			writel(0x0d, phy_base + 0x01dc);
+		dmb();
+	} else {
+		/* Regulator ctrl 0 */
+		writel(0x00, DSI0_PHY_BASE + off + (4 * 0));
+		/* Regulator ctrl - CAL_PWD_CFG */
+		writel(pd->regulator[6], DSI0_PHY_BASE + off + (4 * 6));
+		/* Add h/w recommended delay */
+		udelay(1000);
+		/* Regulator ctrl 1 */
+		writel(pd->regulator[1], DSI0_PHY_BASE + off + (4 * 1));
+		/* Regulator ctrl 2 */
+		writel(pd->regulator[2], DSI0_PHY_BASE + off + (4 * 2));
+		/* Regulator ctrl 3 */
+		writel(pd->regulator[3], DSI0_PHY_BASE + off + (4 * 3));
+		/* Regulator ctrl 4 */
+		writel(pd->regulator[4], DSI0_PHY_BASE + off + (4 * 4));
+		/* LDO ctrl */
+		writel(0x00, phy_base + 0x01dc);
+		/* Regulator ctrl 0 */
+		writel(pd->regulator[0], DSI0_PHY_BASE + off + (4 * 0));
+		dmb();
+	}
 }
 
 int mdss_dsi_v2_phy_init(struct mipi_dsi_panel_config *pinfo, uint32_t ctl_base)
@@ -305,15 +334,7 @@
 	/* Strength ctrl 0 */
 	writel(pd->strength[0], phy_base + 0x0184);
 
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		pd->regulator[0] = 0x2; /* LDO mode */
-	mdss_dsi_phy_regulator_init(pd);
-
-	/* DSIPHY_REGULATOR_CTRL_0 */
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		writel(0x25, phy_base + 0x01dc); /* LDO mode */
-	else
-		writel(0x00, phy_base + 0x01dc); /* DCDC mode */
+	mdss_dsi_phy_regulator_init(pd, phy_base);
 
 	off = 0x0140;	/* phy timing ctrl 0 - 11 */
 	for (i = 0; i < 12; i++) {
@@ -388,14 +409,7 @@
 	/* Strength ctrl 0 */
 	writel(pd->strength[0], phy_base + MMSS_DSI_PHY_STRENGTH_CTRL_0);
 
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		pd->regulator[0] = 0x2; /* LDO mode */
-	mdss_dsi_phy_regulator_init(pd);
-
-	if (pd->regulator_mode == DSI_PHY_REGULATOR_LDO_MODE)
-		writel(0x25, phy_base + MMSS_DSI_PHY_LDO_CTRL); /* LDO mode */
-	else
-		writel(0x00, phy_base + MMSS_DSI_PHY_LDO_CTRL); /* DCDC mode */
+	mdss_dsi_phy_regulator_init(pd, phy_base);
 
 	off = MMSS_DSI_PHY_TIMING_CTRL_0;
 	for (i = 0; i < TOTAL_TIMING_CTRL_CONFIG; i++, off += 4) {
diff --git a/platform/msm_shared/mmc_sdhci.c b/platform/msm_shared/mmc_sdhci.c
index 411f22c..76145eb 100644
--- a/platform/msm_shared/mmc_sdhci.c
+++ b/platform/msm_shared/mmc_sdhci.c
@@ -1665,6 +1665,18 @@
 
 	card->block_size = MMC_BLK_SZ;
 
+	/* Enable RST_n_FUNCTION */
+	if (!card->ext_csd[MMC_EXT_CSD_RST_N_FUNC])
+	{
+		mmc_return = mmc_switch_cmd(host, card, MMC_SET_BIT, MMC_EXT_CSD_RST_N_FUNC, RST_N_FUNC_ENABLE);
+
+		if (mmc_return)
+		{
+			dprintf(CRITICAL, "Failed to enable RST_n_FUNCTION\n");
+			return mmc_return;
+		}
+	}
+
 	return mmc_return;
 }
 
diff --git a/platform/msm_shared/mmc_wrapper.c b/platform/msm_shared/mmc_wrapper.c
index c660a5f..0a7d5b4 100755
--- a/platform/msm_shared/mmc_wrapper.c
+++ b/platform/msm_shared/mmc_wrapper.c
@@ -34,7 +34,8 @@
 #include <ufs.h>
 #include <target.h>
 #include <string.h>
-
+#include <partition_parser.h>
+#include <dme.h>
 /*
  * Weak function for UFS.
  * These are needed to avoid link errors for platforms which
@@ -586,3 +587,56 @@
 		}
 	}
 }
+
+uint32_t mmc_write_protect(const char *ptn_name, int set_clr)
+{
+	void *dev = NULL;
+	struct mmc_card *card = NULL;
+	uint32_t block_size;
+	unsigned long long  ptn = 0;
+	uint64_t size;
+	int index = -1;
+	int ret = 0;
+
+	dev = target_mmc_device();
+	block_size = mmc_get_device_blocksize();
+
+	if (platform_boot_dev_isemmc())
+	{
+		card = &((struct mmc_device *)dev)->card;
+
+		index = partition_get_index(ptn_name);
+
+		ptn = partition_get_offset(index);
+		if(!ptn)
+		{
+			return 1;
+		}
+
+		size = partition_get_size(index);
+
+		/*
+		 * For read only partitions the minimum size allocated on the disk is
+		 * 1 WP GRP size. If the size of partition is less than 1 WP GRP size
+		 * protect atleast one WP group.
+		 */
+		if (partition_read_only(index) && size < card->wp_grp_size)
+		{
+			size = card->wp_grp_size * block_size;
+		}
+		/* Set the power on WP bit */
+		return mmc_set_clr_power_on_wp_user((struct mmc_device *)dev, (ptn / block_size), size, set_clr);
+	}
+	else
+	{
+		/* Enable the power on WP fo all LUNs which have WP bit is enabled */
+		ret = dme_set_fpoweronwpen((struct ufs_dev*) dev);
+		if (ret < 0)
+		{
+			dprintf(CRITICAL, "Failure to WP UFS partition\n");
+			return 1;
+		}
+	}
+
+	return 0;
+}
diff --git a/platform/msm_shared/partition_parser.c b/platform/msm_shared/partition_parser.c
index d8774b9..d40fb8a 100644
--- a/platform/msm_shared/partition_parser.c
+++ b/platform/msm_shared/partition_parser.c
@@ -1057,3 +1057,8 @@
 {
 	return (gpt_partitions_exist != 0);
 }
+
+int partition_read_only(int index)
+{
+	 return partition_entries[index].attribute_flag >> PART_ATT_READONLY_OFFSET;
+}
diff --git a/platform/msm_shared/qgic.c b/platform/msm_shared/qgic.c
index 49299e7..7250c62 100644
--- a/platform/msm_shared/qgic.c
+++ b/platform/msm_shared/qgic.c
@@ -32,11 +32,7 @@
  */
 
 #include <reg.h>
-#include <bits.h>
-#include <debug.h>
 #include <arch/arm.h>
-#include <kernel/thread.h>
-#include <platform/irqs.h>
 #include <qgic.h>
 
 static struct ihandler handler[NR_IRQS];
@@ -53,15 +49,11 @@
 		if (mask)
 			break;
 	}
-
-	if (!mask)
-		dprintf(CRITICAL, "GIC CPU mask not found\n");
-
 	return mask;
 }
 
 /* Intialize distributor */
-static void qgic_dist_init(void)
+void qgic_dist_init(void)
 {
 	uint32_t i;
 	uint32_t num_irq = 0;
@@ -81,123 +73,29 @@
 	num_irq = readl(GIC_DIST_CTR) & 0x1f;
 	num_irq = (num_irq + 1) * 32;
 
-	/* Set each interrupt line to use N-N software model
-	 * and edge sensitive, active high
-	 */
-	for (i = 32; i < num_irq; i += 16)
-		writel(0xffffffff, GIC_DIST_CONFIG + i * 4 / 16);
-
-	writel(0xffffffff, GIC_DIST_CONFIG + 4);
-
 	/* Set up interrupts for this CPU */
 	for (i = 32; i < num_irq; i += 4)
 		writel(cpumask, GIC_DIST_TARGET + i * 4 / 4);
 
-	/* Set priority of all interrupts */
-
-	/*
-	 * In bootloader we dont care about priority so
-	 * setting up equal priorities for all
-	 */
-	for (i = 0; i < num_irq; i += 4)
-		writel(0xa0a0a0a0, GIC_DIST_PRI + i * 4 / 4);
-
-	/* Disabling interrupts */
-	for (i = 0; i < num_irq; i += 32)
-		writel(0xffffffff, GIC_DIST_ENABLE_CLEAR + i * 4 / 32);
-
-	writel(0x0000ffff, GIC_DIST_ENABLE_SET);
+	qgic_dist_config(num_irq);
 
 	/*Enabling GIC */
 	writel(1, GIC_DIST_CTRL);
 }
 
 /* Intialize cpu specific controller */
-static void qgic_cpu_init(void)
+void qgic_cpu_init(void)
 {
 	writel(0xf0, GIC_CPU_PRIMASK);
 	writel(1, GIC_CPU_CTRL);
 }
 
-/* Initialize QGIC. Called from platform specific init code */
-void qgic_init(void)
+uint32_t qgic_read_iar()
 {
-	qgic_dist_init();
-	qgic_cpu_init();
+	return readl(GIC_CPU_INTACK);
 }
 
-/* IRQ handler */
-enum handler_return gic_platform_irq(struct arm_iframe *frame)
+void qgic_write_eoi(uint32_t num)
 {
-	uint32_t num;
-	enum handler_return ret;
-
-	num = readl(GIC_CPU_INTACK);
-	if (num >= NR_IRQS)
-		return 0;
-
-	ret = handler[num].func(handler[num].arg);
 	writel(num, GIC_CPU_EOI);
-
-	return ret;
-}
-
-/* FIQ handler */
-void gic_platform_fiq(struct arm_iframe *frame)
-{
-	PANIC_UNIMPLEMENTED;
-}
-
-/* Mask interrupt */
-status_t gic_mask_interrupt(unsigned int vector)
-{
-	uint32_t reg = GIC_DIST_ENABLE_CLEAR + (vector / 32) * 4;
-	uint32_t bit = 1 << (vector & 31);
-
-	writel(bit, reg);
-
-	return 0;
-}
-
-/* Un-mask interrupt */
-status_t gic_unmask_interrupt(unsigned int vector)
-{
-	uint32_t reg = GIC_DIST_ENABLE_SET + (vector / 32) * 4;
-	uint32_t bit = 1 << (vector & 31);
-
-	writel(bit, reg);
-
-	return 0;
-}
-
-/* Register interrupt handler */
-void gic_register_int_handler(unsigned int vector, int_handler func, void *arg)
-{
-	ASSERT(vector < NR_IRQS);
-
-	enter_critical_section();
-	handler[vector].func = func;
-	handler[vector].arg = arg;
-	exit_critical_section();
-}
-
-void qgic_change_interrupt_cfg(uint32_t spi_number, uint8_t type)
-{
-	uint32_t register_number, register_address, bit_number, value;
-	register_number = spi_number >> 4; // r = n DIV 16
-	bit_number = (spi_number % 16) << 1; // b = (n MOD 16) * 2
-	value = readl(GIC_DIST_CONFIG + (register_number << 2));
-	// there are two bits per register to indicate the level
-	if (type == INTERRUPT_LVL_N_TO_N)
-		value &= ~(BIT(bit_number)|BIT(bit_number+1)); // 0x0 0x0
-	else if (type == INTERRUPT_LVL_1_TO_N)
-		value = (value & ~BIT(bit_number+1)) | BIT(bit_number); // 0x0 0x1
-	else if (type == INTERRUPT_EDGE_N_TO_N)
-		value =  BIT(bit_number+1) | (value & ~BIT(bit_number));// 0x1 0x0
-	else if (type == INTERRUPT_EDGE_1_TO_N)
-		value |= (BIT(bit_number)|BIT(bit_number+1)); // 0x1 0x1
-	else
-		dprintf(CRITICAL, "Invalid interrupt type change requested\n");
-	register_address = GIC_DIST_CONFIG + (register_number << 2);
-	writel(value, register_address);
 }
diff --git a/platform/msm_shared/qgic_common.c b/platform/msm_shared/qgic_common.c
new file mode 100644
index 0000000..7abb5a1
--- /dev/null
+++ b/platform/msm_shared/qgic_common.c
@@ -0,0 +1,155 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Fundation, Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include <reg.h>
+#include <bits.h>
+#include <arch/arm.h>
+#include <kernel/thread.h>
+#include <platform/irqs.h>
+#include <platform/iomap.h>
+#include <qgic.h>
+#include <debug.h>
+
+static struct ihandler handler[NR_IRQS];
+
+/* Intialize distributor */
+void qgic_dist_config(uint32_t num_irq)
+{
+	uint32_t i;
+
+	/* Set each interrupt line to use N-N software model
+	 * and edge sensitive, active high
+	 */
+	for (i = 32; i < num_irq; i += 16)
+		writel(0xffffffff, GIC_DIST_CONFIG + i * 4 / 16);
+
+	writel(0xffffffff, GIC_DIST_CONFIG + 4);
+
+	/* Set priority of all interrupts */
+
+	/*
+	 * In bootloader we dont care about priority so
+	 * setting up equal priorities for all
+	 */
+	for (i = 0; i < num_irq; i += 4)
+		writel(0xa0a0a0a0, GIC_DIST_PRI + i * 4 / 4);
+
+	/* Disabling interrupts */
+	for (i = 0; i < num_irq; i += 32)
+		writel(0xffffffff, GIC_DIST_ENABLE_CLEAR + i * 4 / 32);
+
+	writel(0x0000ffff, GIC_DIST_ENABLE_SET);
+}
+
+/* Initialize QGIC. Called from platform specific init code */
+void qgic_init(void)
+{
+	qgic_dist_init();
+	qgic_cpu_init();
+}
+
+/* IRQ handler */
+enum handler_return gic_platform_irq(struct arm_iframe *frame)
+{
+	uint32_t num;
+	enum handler_return ret;
+
+	/* Read the interrupt number to be served*/
+	num = qgic_read_iar();
+
+	if (num >= NR_IRQS)
+		return 0;
+
+	ret = handler[num].func(handler[num].arg);
+
+	/* End of interrupt */
+	qgic_write_eoi(num);
+
+	return ret;
+}
+
+/* FIQ handler */
+void gic_platform_fiq(struct arm_iframe *frame)
+{
+	PANIC_UNIMPLEMENTED;
+}
+
+/* Mask interrupt */
+status_t gic_mask_interrupt(unsigned int vector)
+{
+	uint32_t reg = GIC_DIST_ENABLE_CLEAR + (vector / 32) * 4;
+	uint32_t bit = 1 << (vector & 31);
+
+	writel(bit, reg);
+
+	return 0;
+}
+
+/* Un-mask interrupt */
+status_t gic_unmask_interrupt(unsigned int vector)
+{
+	uint32_t reg = GIC_DIST_ENABLE_SET + (vector / 32) * 4;
+	uint32_t bit = 1 << (vector & 31);
+
+	writel(bit, reg);
+
+	return 0;
+}
+
+/* Register interrupt handler */
+void gic_register_int_handler(unsigned int vector, int_handler func, void *arg)
+{
+	ASSERT(vector < NR_IRQS);
+
+	enter_critical_section();
+	handler[vector].func = func;
+	handler[vector].arg = arg;
+	exit_critical_section();
+}
+
+void qgic_change_interrupt_cfg(uint32_t spi_number, uint8_t type)
+{
+	uint32_t register_number, register_address, bit_number, value;
+	register_number = spi_number >> 4; // r = n DIV 16
+	bit_number = (spi_number % 16) << 1; // b = (n MOD 16) * 2
+	value = readl(GIC_DIST_CONFIG + (register_number << 2));
+	// there are two bits per register to indicate the level
+	if (type == INTERRUPT_LVL_N_TO_N)
+		value &= ~(BIT(bit_number)|BIT(bit_number+1)); // 0x0 0x0
+	else if (type == INTERRUPT_LVL_1_TO_N)
+		value = (value & ~BIT(bit_number+1)) | BIT(bit_number); // 0x0 0x1
+	else if (type == INTERRUPT_EDGE_N_TO_N)
+		value =  BIT(bit_number+1) | (value & ~BIT(bit_number));// 0x1 0x0
+	else if (type == INTERRUPT_EDGE_1_TO_N)
+		value |= (BIT(bit_number)|BIT(bit_number+1)); // 0x1 0x1
+	else
+		dprintf(CRITICAL, "Invalid interrupt type change requested\n");
+	register_address = GIC_DIST_CONFIG + (register_number << 2);
+	writel(value, register_address);
+}
diff --git a/platform/msm_shared/qgic_v3.c b/platform/msm_shared/qgic_v3.c
new file mode 100644
index 0000000..1177a23
--- /dev/null
+++ b/platform/msm_shared/qgic_v3.c
@@ -0,0 +1,145 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Fundation, Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include <reg.h>
+#include <bits.h>
+#include <debug.h>
+#include <arch/arm.h>
+#include <arch/defines.h>
+#include <qgic_v3.h>
+
+#define GIC_WAKER_PROCESSORSLEEP                 BIT(1)
+#define GIC_WAKER_CHILDRENASLEEP                 BIT(2)
+
+void qgic_dist_init()
+{
+	uint32_t num_irq;
+	uint32_t affinity;
+	uint32_t i;
+
+	/* Read the mpidr register to find out the boot up cluster */
+	__asm__ volatile("mrc p15, 0, %0, c0, c0, 5" : "=r" (affinity));
+
+	/* For aarch32 mode we have only 3 affinity values: aff0:aff1:aff2*/
+	affinity = affinity & 0x00ffffff;
+
+	writel(0, GIC_DIST_CTRL);
+
+	/*
+	 * Find out how many interrupts are supported.
+	 */
+	num_irq = readl(GIC_DIST_CTR) & 0x1f;
+	num_irq = (num_irq + 1) * 32;
+
+	/* Do the qgic dist initialization */
+	qgic_dist_config(num_irq);
+
+	/* Write the affinity value, for routing all the SPIs */
+	for (i = 32; i < num_irq; i++)
+		writel(affinity, GICD_IROUTER + i * 8);
+
+	/* Enable affinity routing of grp0/grp1 interrupts */
+	writel(ENABLE_GRP0_SEC | ENABLE_GRP1_NS | ENABLE_ARE, GIC_DIST_CTRL);
+}
+
+void qgic_cpu_init()
+{
+	uint32_t waker = 0;
+	uint32_t retry = 1000;
+	uint32_t sre = 0;
+	uint32_t pmr = 0xff;
+	uint32_t eoimode = 0;
+	uint32_t grpen1 = 0x1;
+
+	/* For cpu init need to wake up the redistributor */
+	writel((readl(GICR_WAKER_CPU0) & ~GIC_WAKER_PROCESSORSLEEP), GICR_WAKER_CPU0);
+
+	/* Wait until redistributor is up */
+	while(readl(GICR_WAKER_CPU0) & GIC_WAKER_CHILDRENASLEEP)
+	{
+		retry--;
+		if (!retry)
+		{
+			dprintf(CRITICAL, "Failed to wake redistributor for CPU0\n");
+			ASSERT(0);
+		}
+		mdelay(1);
+	}
+
+
+	/* Make sure the system register access is enabled for us */
+	__asm__ volatile("mrc p15, 0, %0, c12, c12, 5" : "=r" (sre));
+	sre |= BIT(0);
+	__asm__ volatile("mcr p15, 0, %0, c12, c12, 5" :: "r" (sre));
+
+	isb();
+
+	/* If system register access is not set, we fail */
+	__asm__ volatile("mrc p15, 0, %0, c12, c12, 5" : "=r" (sre));
+	if (!(sre & BIT(0)))
+	{
+		dprintf(CRITICAL, "Failed to set SRE for NS world\n");
+		ASSERT(0);
+	}
+
+	/* Set the priortiy mask register, interrupts with priority
+	 * higher than this value will be signalled to processor.
+	 * Lower value means higher priority.
+	 */
+	__asm__ volatile("mcr p15, 0, %0, c4, c6, 0" :: "r" (pmr));
+	isb();
+
+	/* Make sure EOI is handled in NS EL3 */
+	__asm__ volatile("mrc p15, 0, %0, c12, c12, 4" : "=r" (eoimode));
+	eoimode &= ~BIT(1);
+	__asm__ volatile("mcr p15, 0, %0, c12, c12, 4" :: "r" (eoimode));
+	isb();
+
+	/* Enable grp1 interrupts for NS EL3*/
+	__asm__ volatile("mcr p15, 0, %0, c12, c12, 7" :: "r" (grpen1));
+	isb();
+}
+
+uint32_t qgic_read_iar()
+{
+	uint32_t iar;
+
+	/* Read the interrupt ack register, for the current interrupt number */
+	__asm__ volatile("mrc p15, 0, %0, c12, c12, 0" : "=r" (iar));
+	isb();
+
+	return iar;
+}
+
+void qgic_write_eoi(uint32_t iar)
+{
+	/* Write end of interrupt to indicate CPU that this interrupt is processed*/
+	__asm__ volatile("mcr p15, 0, %0, c12, c12, 1" :: "r" (iar));
+	isb();
+}
diff --git a/platform/msm_shared/qmp_usb30_phy.c b/platform/msm_shared/qmp_usb30_phy.c
index 5e4ceab..b3b3477 100644
--- a/platform/msm_shared/qmp_usb30_phy.c
+++ b/platform/msm_shared/qmp_usb30_phy.c
@@ -61,6 +61,9 @@
 	struct clk *phy_com_clk = NULL;
 	struct clk *phy_clk = NULL;
 
+#if USB_RESET_FROM_CLK
+	clock_reset_usb_phy();
+#else
 	/* Look if phy com clock is present */
 	phy_com_clk = clk_get("usb30_phy_com_reset");
 	if (phy_com_clk)
@@ -131,6 +134,7 @@
 	ret = clk_reset(usb2b_clk, CLK_RESET_DEASSERT);
 	if (ret)
 		dprintf(CRITICAL, "Failed to deassert usb2b_phy_clk\n");
+#endif
 
 	/* Override the phy common control values */
 	val = readl(MSM_USB30_QSCRATCH_BASE + HS_PHY_COMMON_CTRL);
diff --git a/platform/msm_shared/qpic.c b/platform/msm_shared/qpic.c
new file mode 100644
index 0000000..8c9e47d
--- /dev/null
+++ b/platform/msm_shared/qpic.c
@@ -0,0 +1,327 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <err.h>
+#include <msm_panel.h>
+#include <platform/iomap.h>
+#include <reg.h>
+
+#include "qpic.h"
+#include "qpic_panel.h"
+
+int mdss_qpic_panel_init(struct qpic_panel_io_desc *panel_io);
+
+struct qpic_data_type qpic_data;
+struct qpic_data_type *qpic_res = &qpic_data;
+static int qpic_send_pkt_sw(uint32_t cmd, uint32_t len, uint8_t *param);
+
+/* for debugging */
+static uint32_t use_bam = false;
+static uint32_t use_irq = false;
+static uint32_t use_vsync;
+
+/* For compilation */
+void mdp_set_revision(int rev)
+{
+    return;
+}
+
+int qpic_on(void)
+{
+	int ret;
+	ret = mdss_qpic_panel_on(&qpic_res->panel_io);
+	return ret;
+}
+
+int qpic_off(void)
+{
+	int ret = NO_ERROR;
+
+	if (!target_cont_splash_screen()) {
+		ret = mdss_qpic_panel_off(&qpic_res->panel_io);
+	}
+
+	return ret;
+}
+
+void qpic_update()
+{
+	uint32_t fb_offset, size;
+
+	if (use_bam)
+		fb_offset = qpic_res->fb_phys + qpic_res->base;
+	else
+		fb_offset = qpic_res->fb_virt + qpic_res->base;
+
+	size = qpic_res->fb_xres * qpic_res->fb_yres * qpic_res->fb_bpp;
+
+	qpic_send_frame(0, 0, qpic_res->fb_xres - 1, qpic_res->fb_yres - 1,
+		(uint32_t *)fb_offset, size);
+}
+
+int mdss_qpic_alloc_fb_mem(struct msm_panel_info *pinfo, int base)
+{
+	qpic_res->fb_virt = 0;
+	qpic_res->fb_phys = 0;
+	qpic_res->fb_xres = pinfo->xres;
+	qpic_res->fb_yres = pinfo->yres;
+	qpic_res->fb_bpp = pinfo->bpp / 8;
+	qpic_res->base = base;
+
+	return 0;
+}
+
+void qpic_init(struct msm_panel_info *pinfo, int base)
+{
+	if (qpic_res->res_init)
+		return;
+
+	qpic_res->qpic_base = QPIC_BASE;
+	mdss_qpic_panel_init(&qpic_res->panel_io);
+	mdss_qpic_alloc_fb_mem(pinfo, base);
+	qpic_res->res_init = true;
+}
+
+int qpic_init_sps(void)
+{
+	return 0;
+}
+
+void mdss_qpic_reset(void)
+{
+	uint32_t cnt = 0;
+
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_RESET, 1 << 0);
+	/* wait 100 us after reset as suggested by hw */
+	udelay(100);
+	while (((QPIC_INP(QPIC_REG_QPIC_LCDC_STTS) & (1 << 8)) == 0)) {
+		if (cnt > QPIC_MAX_WAIT_CNT) {
+			dprintf(CRITICAL, "%s reset not finished\n", __func__);
+			break;
+		}
+		/* yield 100 us for next polling by experiment*/
+		udelay(100);
+		cnt++;
+	}
+}
+
+static int qpic_send_pkt_bam(uint32_t cmd, uint32_t len, uint8_t *param)
+{
+	return qpic_send_pkt_sw(cmd, len, param);
+}
+
+static void qpic_dump_reg(void)
+{
+	dprintf(INFO, "%s\n", __func__);
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CTRL = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CTRL));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CFG0 = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CFG0));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CFG1 = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CFG1));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_CFG2 = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_CFG2));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_IRQ_EN = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_IRQ_EN));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_IRQ_STTS = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_IRQ_STTS));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_STTS = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_STTS));
+	dprintf(INFO, "QPIC_REG_QPIC_LCDC_FIFO_SOF = %x\n",
+		QPIC_INP(QPIC_REG_QPIC_LCDC_FIFO_SOF));
+}
+
+static int qpic_wait_for_fifo(void)
+{
+	uint32_t data, cnt = 0;
+	int ret = 0;
+
+	while (1) {
+		data = QPIC_INP(QPIC_REG_QPIC_LCDC_STTS);
+		data &= 0x3F;
+		if (data == 0)
+			break;
+		/* yield 10 us for next polling by experiment*/
+		udelay(10);
+		if (cnt > (QPIC_MAX_WAIT_CNT * 10)) {
+			dprintf(CRITICAL, "%s time out\n", __func__);
+			ret = -1;
+			break;
+		}
+		cnt++;
+	}
+	return ret;
+}
+
+static int qpic_wait_for_eof(void)
+{
+	uint32_t data, cnt = 0;
+	int ret = 0;
+
+	while (1) {
+		data = QPIC_INP(QPIC_REG_QPIC_LCDC_IRQ_STTS);
+		if (data & (1 << 2))
+			break;
+		/* yield 10 us for next polling by experiment*/
+		udelay(10);
+		if (cnt > (QPIC_MAX_WAIT_CNT * 10)) {
+			dprintf(CRITICAL, "%s wait for eof time out\n", __func__);
+			qpic_dump_reg();
+			ret = -1;
+			break;
+		}
+		cnt++;
+	}
+	return ret;
+}
+
+static int qpic_send_pkt_sw(uint32_t cmd, uint32_t len, uint8_t *param)
+{
+	uint32_t bytes_left, space, data, cfg2;
+	int i, ret = 0;
+
+	if (len && !param) {
+		dprintf(CRITICAL, "Null Pointer!\n");
+		return 0;
+	}
+	if (len <= 4) {
+		len = (len + 3) / 4; /* len in dwords */
+		data = 0;
+		for (i = 0; i < len; i++)
+			data |= (uint32_t)param[i] << (8 * i);
+		QPIC_OUTP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT, len);
+		QPIC_OUTP(QPIC_REG_LCD_DEVICE_CMD0 + (4 * cmd), data);
+		return 0;
+	}
+
+	if ((len & 0x1) != 0) {
+		dprintf(INFO, "%s: number of bytes needs be even\n", __func__);
+		len = (len + 1) & (~0x1);
+	}
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_IRQ_CLR, 0xff);
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT, 0);
+	cfg2 = QPIC_INP(QPIC_REG_QPIC_LCDC_CFG2);
+	if ((cmd != OP_WRITE_MEMORY_START) &&
+		(cmd != OP_WRITE_MEMORY_CONTINUE))
+		cfg2 |= (1 << 24); /* transparent mode */
+	else
+		cfg2 &= ~(1 << 24);
+
+	cfg2 &= ~0xFF;
+	cfg2 |= cmd;
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG2, cfg2);
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_FIFO_SOF, 0x0);
+	bytes_left = len;
+
+	while (bytes_left > 0) {
+		ret = qpic_wait_for_fifo();
+		if (ret)
+			goto exit_send_cmd_sw;
+
+		space = 16;
+
+		while ((space > 0) && (bytes_left > 0)) {
+			/* write to fifo */
+			if (bytes_left >= 4) {
+				QPIC_OUTP(QPIC_REG_QPIC_LCDC_FIFO_DATA_PORT0,
+					*(uint32_t *)param);
+				param += 4;
+				bytes_left -= 4;
+				space--;
+			} else if (bytes_left == 2) {
+				QPIC_OUTPW(QPIC_REG_QPIC_LCDC_FIFO_DATA_PORT0,
+					*(uint16_t *)param);
+				bytes_left -= 2;
+			}
+		}
+	}
+	/* finished */
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_FIFO_EOF, 0x0);
+	ret = qpic_wait_for_eof();
+exit_send_cmd_sw:
+	cfg2 &= ~(1 << 24);
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG2, cfg2);
+	return ret;
+}
+
+int qpic_send_pkt(uint32_t cmd, uint8_t *param, uint32_t len)
+{
+	if (!use_bam || ((cmd != OP_WRITE_MEMORY_CONTINUE) &&
+		(cmd != OP_WRITE_MEMORY_START)))
+		return qpic_send_pkt_sw(cmd, len, param);
+	else
+		return qpic_send_pkt_bam(cmd, len, param);
+}
+
+int mdss_qpic_init(void)
+{
+	int ret = 0;
+	uint32_t data;
+	mdss_qpic_reset();
+
+	data = QPIC_INP(QPIC_REG_QPIC_LCDC_CTRL);
+	/* clear vsync wait , bam mode = 0 */
+	data &= ~(3 << 0);
+	data &= ~(0x1f << 3);
+	data |= (1 << 3); /* threshold */
+	data |= (1 << 8); /* lcd_en */
+	data &= ~(0x1f << 9);
+	data |= (1 << 9); /* threshold */
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CTRL, data);
+
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG0, 0x02108501);
+	data = QPIC_INP(QPIC_REG_QPIC_LCDC_CFG2);
+	data &= ~(0xFFF);
+	data |= 0x0; /* 565 */
+	data |= 0x2C;
+	QPIC_OUTP(QPIC_REG_QPIC_LCDC_CFG2, data);
+
+	/* TE enable */
+	if (use_vsync) {
+		data = QPIC_INP(QPIC_REG_QPIC_LCDC_CTRL);
+		data |= (1 << 0);
+		QPIC_OUTP(QPIC_REG_QPIC_LCDC_CTRL, data);
+	}
+
+	return ret;
+}
+
+uint32_t qpic_read_data(uint32_t cmd_index, uint32_t size)
+{
+	uint32_t data = 0;
+	if (size <= 4) {
+		QPIC_OUTP(QPIC_REG_QPIC_LCDC_CMD_DATA_CYCLE_CNT, size);
+		data = QPIC_INP(QPIC_REG_LCD_DEVICE_CMD0 + (cmd_index * 4));
+	}
+	return data;
+}
+
diff --git a/platform/msm_shared/qpic_panel.c b/platform/msm_shared/qpic_panel.c
new file mode 100644
index 0000000..2b9e4e2
--- /dev/null
+++ b/platform/msm_shared/qpic_panel.c
@@ -0,0 +1,135 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <err.h>
+#include <msm_panel.h>
+#include <platform/gpio.h>
+#include "qpic.h"
+#include "qpic_panel.h"
+#include <reg.h>
+
+static uint32_t panel_is_on;
+
+static int (*qpic_panel_on)(struct qpic_panel_io_desc *qpic_panel_io);
+static void (*qpic_panel_off)(struct qpic_panel_io_desc *qpic_panel_io);
+
+
+/* write a frame of pixels to a MIPI screen */
+uint32_t qpic_send_frame(uint32_t x_start,
+				uint32_t y_start,
+				uint32_t x_end,
+				uint32_t y_end,
+				uint32_t *data,
+				uint32_t total_bytes)
+{
+	uint8_t param[4];
+	uint32_t status;
+	uint32_t start_0_7;
+	uint32_t end_0_7;
+	uint32_t start_8_15;
+	uint32_t end_8_15;
+
+	/* convert to 16 bit representation */
+	x_start = x_start & 0xffff;
+	y_start = y_start & 0xffff;
+	x_end = x_end & 0xffff;
+	y_end = y_end & 0xffff;
+
+	/* set column/page */
+	start_0_7 = x_start & 0xff;
+	end_0_7 = x_end & 0xff;
+	start_8_15 = (x_start >> 8) & 0xff;
+	end_8_15 = (x_end >> 8) & 0xff;
+	param[0] = start_8_15;
+	param[1] = start_0_7;
+	param[2] = end_8_15;
+	param[3] = end_0_7;
+	status = qpic_send_pkt(OP_SET_COLUMN_ADDRESS, param, 4);
+	if (status) {
+		dprintf(CRITICAL, "Failed to set column address\n");
+		return status;
+	}
+
+	start_0_7 = y_start & 0xff;
+	end_0_7 = y_end & 0xff;
+	start_8_15 = (y_start >> 8) & 0xff;
+	end_8_15 = (y_end >> 8) & 0xff;
+	param[0] = start_8_15;
+	param[1] = start_0_7;
+	param[2] = end_8_15;
+	param[3] = end_0_7;
+	status = qpic_send_pkt(OP_SET_PAGE_ADDRESS, param, 4);
+	if (status) {
+		dprintf(CRITICAL, "Failed to set page address\n");
+		return status;
+	}
+
+	status = qpic_send_pkt(OP_WRITE_MEMORY_START, (uint8_t *)data, total_bytes);
+	if (status) {
+		dprintf(CRITICAL, "Failed to start memory write\n");
+		return status;
+	}
+	return 0;
+}
+
+int mdss_qpic_panel_on(struct qpic_panel_io_desc *panel_io)
+{
+	int rc = 0;
+
+	if (panel_is_on)
+		return 0;
+	mdss_qpic_init();
+
+	if (qpic_panel_on)
+		rc = qpic_panel_on(panel_io);
+
+	if (!rc)
+		panel_is_on = true;
+
+	return rc;
+}
+
+int mdss_qpic_panel_off(struct qpic_panel_io_desc *panel_io)
+{
+	if (qpic_panel_off)
+		qpic_panel_off(panel_io);
+
+	panel_is_on = false;
+	return 0;
+}
+
+int mdss_qpic_panel_init(struct qpic_panel_io_desc *panel_io)
+{
+	qpic_panel_on = ili9341_on;
+	qpic_panel_off = ili9341_off;
+
+	return 0;
+}
+
diff --git a/platform/msm_shared/rpm-smd.c b/platform/msm_shared/rpm-smd.c
index 6144fba..d623542 100644
--- a/platform/msm_shared/rpm-smd.c
+++ b/platform/msm_shared/rpm-smd.c
@@ -114,7 +114,7 @@
 		case RPM_CMD_TYPE:
 			cmd.hdr.type = RPM_CMD_MAGIC;
 			cmd.hdr.len = CMD_MSG_LENGTH;//0x8;
-			len_to_smd  = 0x12;
+			len_to_smd  = sizeof(rpm_cmd);
 
 			fill_kvp_object(&cmd.data, data, len);
 			ret = smd_write(&ch, (void *)&cmd, len_to_smd, SMD_APPS_RPM);
diff --git a/platform/msm_shared/rules.mk b/platform/msm_shared/rules.mk
index 9d9196c..c905e23 100755
--- a/platform/msm_shared/rules.mk
+++ b/platform/msm_shared/rules.mk
@@ -14,13 +14,17 @@
 	$(LOCAL_DIR)/jtag.o \
 	$(LOCAL_DIR)/partition_parser.o \
 	$(LOCAL_DIR)/hsusb.o \
-	$(LOCAL_DIR)/boot_stats.o
+	$(LOCAL_DIR)/boot_stats.o \
+	$(LOCAL_DIR)/qgic_common.o
+
+ifeq ($(ENABLE_QGIC3), 1)
+OBJS += $(LOCAL_DIR)/qgic_v3.o
+endif
 
 ifeq ($(ENABLE_SMD_SUPPORT),1)
 OBJS += \
 	$(LOCAL_DIR)/rpm-smd.o \
-	$(LOCAL_DIR)/smd.o \
-	$(LOCAL_DIR)/regulator.o
+	$(LOCAL_DIR)/smd.o
 endif
 
 ifeq ($(ENABLE_SDHCI_SUPPORT),1)
@@ -323,6 +327,7 @@
 endif
 
 ifeq ($(PLATFORM),mdm9x35)
+DEFINES += DISPLAY_TYPE_QPIC=1
 	OBJS += $(LOCAL_DIR)/qgic.o \
 			$(LOCAL_DIR)/uart_dm.o \
 			$(LOCAL_DIR)/interrupts.o \
@@ -337,7 +342,10 @@
 			$(LOCAL_DIR)/clock.o \
 			$(LOCAL_DIR)/clock_pll.o \
 			$(LOCAL_DIR)/clock_lib2.o \
-			$(LOCAL_DIR)/qmp_usb30_phy.o
+			$(LOCAL_DIR)/qmp_usb30_phy.o \
+			$(LOCAL_DIR)/display.o \
+			$(LOCAL_DIR)/qpic.o \
+			$(LOCAL_DIR)/qpic_panel.o
 endif
 
 ifeq ($(PLATFORM),msmzirc)
@@ -449,6 +457,7 @@
 endif
 
 ifeq ($(PLATFORM),msm8909)
+DEFINES += DISPLAY_TYPE_MDSS=1
 	OBJS += $(LOCAL_DIR)/qgic.o \
 			$(LOCAL_DIR)/qtimer.o \
 			$(LOCAL_DIR)/qtimer_mmap.o \
@@ -479,6 +488,31 @@
 			$(LOCAL_DIR)/mipi_dsi_autopll.o
 endif
 
+ifeq ($(PLATFORM),thulium)
+	OBJS += $(LOCAL_DIR)/qtimer.o \
+			$(LOCAL_DIR)/qtimer_mmap.o \
+			$(LOCAL_DIR)/interrupts.o \
+			$(LOCAL_DIR)/clock.o \
+			$(LOCAL_DIR)/clock_pll.o \
+			$(LOCAL_DIR)/clock_lib2.o \
+			$(LOCAL_DIR)/uart_dm.o \
+			$(LOCAL_DIR)/board.o \
+			$(LOCAL_DIR)/spmi.o \
+			$(LOCAL_DIR)/bam.o \
+			$(LOCAL_DIR)/qpic_nand.o \
+			$(LOCAL_DIR)/dev_tree.o \
+			$(LOCAL_DIR)/gpio.o \
+			$(LOCAL_DIR)/scm.o \
+			$(LOCAL_DIR)/ufs.o \
+			$(LOCAL_DIR)/utp.o \
+			$(LOCAL_DIR)/uic.o \
+			$(LOCAL_DIR)/ucs.o \
+			$(LOCAL_DIR)/ufs_hci.o \
+			$(LOCAL_DIR)/dme.o \
+			$(LOCAL_DIR)/qmp_usb30_phy.o \
+			$(LOCAL_DIR)/qusb2_phy.o
+endif
+
 ifeq ($(ENABLE_BOOT_CONFIG_SUPPORT), 1)
 	OBJS += \
 		$(LOCAL_DIR)/boot_device.o
diff --git a/platform/msm_shared/scm.c b/platform/msm_shared/scm.c
index 48f62be..c7ff1b8 100644
--- a/platform/msm_shared/scm.c
+++ b/platform/msm_shared/scm.c
@@ -313,12 +313,8 @@
 {
 	int ret;
 	img_req cmd;
+	scmcall_arg scm_arg = {0};
 
-	if (scm_arm_support)
-	{
-		dprintf(INFO, "%s:SCM call is not supported\n",__func__);
-		return -1;
-	}
 
 	cmd.img_ptr     = (uint32*) img_ptr;
 	cmd.img_len_ptr = img_len_ptr;
@@ -328,7 +324,19 @@
 	 */
 	arch_clean_invalidate_cache_range((addr_t) *img_ptr, *img_len_ptr);
 
-	ret = scm_call(SCM_SVC_SSD, SSD_ENCRYPT_ID, &cmd, sizeof(cmd), NULL, 0);
+	if (!scm_arm_support)
+	{
+		ret = scm_call(SCM_SVC_SSD, SSD_ENCRYPT_ID, &cmd, sizeof(cmd), NULL, 0);
+	}
+	else
+	{
+		scm_arg.x0 = MAKE_SIP_SCM_CMD(SCM_SVC_SSD,SSD_ENCRYPT_ID);
+		scm_arg.x1 = MAKE_SCM_ARGS(0x2,SMC_PARAM_TYPE_BUFFER_READWRITE,SMC_PARAM_TYPE_VALUE);
+		scm_arg.x2 = cmd.img_ptr;
+		scm_arg.x3 = cmd.img_len_ptr;
+
+		ret = scm_call2(&scm_arg, NULL);
+	}
 
 	/* Values at img_ptr and img_len_ptr are updated by TZ. Must be invalidated
 	 * before we use them.
@@ -383,13 +391,8 @@
 	ssd_parse_md_req parse_req;
 	ssd_parse_md_rsp parse_rsp;
 	int              prev_len = 0;
-
-	if (scm_arm_support)
-	{
-		dprintf(INFO, "%s:SCM call is not supported\n",__func__);
-		return -1;
-	}
-
+	scmcall_arg scm_arg = {0};
+	scmcall_ret scm_ret = {0};
 	/* Populate meta-data ptr. Here md_len is the meta-data length.
 	 * The Code below follows a growing length approach. First send
 	 * min(img_len_ptr,SSD_HEADER_MIN_SIZE) say 128 bytes for example.
@@ -404,13 +407,25 @@
 
 	do
 	{
-		ret = scm_call(SCM_SVC_SSD,
-				SSD_PARSE_MD_ID,
-				&parse_req,
-				sizeof(parse_req),
-				&parse_rsp,
-				sizeof(parse_rsp));
+		if (!scm_arm_support)
+		{
+			ret = scm_call(SCM_SVC_SSD,
+					SSD_PARSE_MD_ID,
+					&parse_req,
+					sizeof(parse_req),
+					&parse_rsp,
+					sizeof(parse_rsp));
+		}
+		else
+		{
+			scm_arg.x0 = MAKE_SIP_SCM_CMD(SCM_SVC_SSD, SSD_PARSE_MD_ID);
+			scm_arg.x1 = MAKE_SCM_ARGS(0x2,SMC_PARAM_TYPE_VALUE,SMC_PARAM_TYPE_BUFFER_READWRITE);
+			scm_arg.x2 = parse_req.md_len;
+			scm_arg.x3 = parse_req.md;
 
+			ret = scm_call2(&scm_arg, &scm_ret);
+			parse_rsp.status = scm_ret.x1;
+		}
 		if(!ret && (parse_rsp.status == SSD_PMD_PARSING_INCOMPLETE))
 		{
 			prev_len          = parse_req.md_len;
@@ -454,12 +469,9 @@
 	uint32                   ctx_id = 0;
 	ssd_decrypt_img_frag_req decrypt_req;
 	ssd_decrypt_img_frag_rsp decrypt_rsp;
+	scmcall_arg scm_arg = {0};
+	scmcall_ret scm_ret = {0};
 
-	if (scm_arm_support)
-	{
-		dprintf(INFO, "%s:SCM call is not supported\n",__func__);
-		return -1;
-	}
 
 	ret = ssd_image_is_encrypted(img_ptr,img_len_ptr,&ctx_id);
 	switch(ret)
@@ -478,13 +490,27 @@
 			decrypt_req.frag_len  = *img_len_ptr;
 			decrypt_req.frag      = *img_ptr;
 
-			ret = scm_call(SCM_SVC_SSD,
-					SSD_DECRYPT_IMG_FRAG_ID,
-					&decrypt_req,
-					sizeof(decrypt_req),
-					&decrypt_rsp,
-					sizeof(decrypt_rsp));
+			if (!scm_arm_support)
+			{
+				ret = scm_call(SCM_SVC_SSD,
+						SSD_DECRYPT_IMG_FRAG_ID,
+						&decrypt_req,
+						sizeof(decrypt_req),
+						&decrypt_rsp,
+						sizeof(decrypt_rsp));
+			}
+			else
+			{
+				scm_arg.x0 = MAKE_SIP_SCM_CMD(SCM_SVC_SSD, SSD_DECRYPT_IMG_FRAG_ID);
+				scm_arg.x1 = MAKE_SCM_ARGS(0x4,SMC_PARAM_TYPE_VALUE,SMC_PARAM_TYPE_VALUE,SMC_PARAM_TYPE_VALUE,SMC_PARAM_TYPE_BUFFER_READWRITE);
+				scm_arg.x2 = decrypt_req.md_ctx_id;
+				scm_arg.x3 = decrypt_req.last_frag;
+				scm_arg.x4 = decrypt_req.frag_len;
+				scm_arg.x5[0] = decrypt_req.frag;
 
+				ret = scm_call2(&scm_arg, &scm_ret);
+				decrypt_rsp.status = scm_ret.x1;
+			}
 			if(!ret){
 				ret = decrypt_rsp.status;
 			}
@@ -542,7 +568,7 @@
 	else
 	{
 		scm_arg.x0 = MAKE_SIP_SCM_CMD(TZBSP_SVC_INFO, TZ_INFO_GET_FEATURE_ID);
-		scm_arg.x1 = MAKE_SCM_ARGS(0x1);
+		scm_arg.x1 = MAKE_SCM_ARGS(0x1,SMC_PARAM_TYPE_VALUE);
 		scm_arg.x2 = feature_req.feature_id;
 
 		ret = scm_call2(&scm_arg, &scm_ret);
@@ -560,24 +586,33 @@
 	int                      ret=0;
 	ssd_protect_keystore_req protect_req;
 	ssd_protect_keystore_rsp protect_rsp;
-
-	if (scm_arm_support)
-	{
-		dprintf(INFO, "%s:SCM call is not supported\n",__func__);
-		return -1;
-	}
+	scmcall_arg scm_arg = {0};
+	scmcall_ret scm_ret = {0};
 
 	protect_req.keystore_ptr = img_ptr;
 	protect_req.keystore_len = img_len;
 
 	arch_clean_invalidate_cache_range((addr_t) img_ptr, img_len);
 
-	ret = scm_call(SCM_SVC_SSD,
-		       SSD_PROTECT_KEYSTORE_ID,
-		       &protect_req,
-		       sizeof(protect_req),
-		       &protect_rsp,
-		       sizeof(protect_rsp));
+	if (!scm_arm_support)
+	{
+		ret = scm_call(SCM_SVC_SSD,
+				SSD_PROTECT_KEYSTORE_ID,
+				&protect_req,
+				sizeof(protect_req),
+				&protect_rsp,
+				sizeof(protect_rsp));
+	}
+	else
+	{
+		scm_arg.x0 = MAKE_SIP_SCM_CMD(SCM_SVC_SSD, SSD_PROTECT_KEYSTORE_ID);
+		scm_arg.x1 = MAKE_SCM_ARGS(0x2,SMC_PARAM_TYPE_BUFFER_READWRITE,SMC_PARAM_TYPE_VALUE);
+		scm_arg.x2 = protect_req.keystore_ptr;
+		scm_arg.x3 = protect_req.keystore_len;
+
+		ret = scm_call2(&scm_arg, &scm_ret);
+		protect_rsp.status = scm_ret.x1;
+	}
 	if(!ret)
 	{
 		if(protect_rsp.status == TZBSP_SSD_PKS_SUCCESS)
@@ -602,26 +637,34 @@
 	size_t cmd_len;
 	void *resp_buf = NULL;
 	size_t resp_len = 0;
+	scmcall_arg scm_arg = {0};
 
 	uint32_t fuse_id = HLOS_IMG_TAMPER_FUSE;
 	cmd_buf = (void *)&fuse_id;
 	cmd_len = sizeof(fuse_id);
 
-	if (scm_arm_support)
+	if (!scm_arm_support)
 	{
-		dprintf(INFO, "%s:SCM call is not supported\n",__func__);
-		return;
+		/*no response */
+		resp_buf = NULL;
+		resp_len = 0;
+
+		svc_id = SCM_SVC_FUSE;
+		cmd_id = SCM_BLOW_SW_FUSE_ID;
+
+		scm_call(svc_id, cmd_id, cmd_buf, cmd_len, resp_buf, resp_len);
+	}
+	else
+	{
+		scm_arg.x0 = MAKE_SIP_SCM_CMD(SCM_SVC_FUSE, SCM_BLOW_SW_FUSE_ID);
+		scm_arg.x1 = MAKE_SCM_ARGS(0x2,SMC_PARAM_TYPE_BUFFER_READWRITE,SMC_PARAM_TYPE_VALUE);
+		scm_arg.x2  = cmd_buf;
+		scm_arg.x3 = cmd_len;
+
+		scm_call2(&scm_arg, NULL);
+
 	}
 
-	/*no response */
-	resp_buf = NULL;
-	resp_len = 0;
-
-	svc_id = SCM_SVC_FUSE;
-	cmd_id = SCM_BLOW_SW_FUSE_ID;
-
-	scm_call(svc_id, cmd_id, cmd_buf, cmd_len, resp_buf, resp_len);
-	return;
 }
 
 uint8_t get_tamper_fuse_cmd()
@@ -634,24 +677,33 @@
 	uint8_t resp_buf;
 
 	uint32_t fuse_id = HLOS_IMG_TAMPER_FUSE;
-
-	if (scm_arm_support)
-	{
-		dprintf(INFO, "%s:SCM call is not supported\n",__func__);
-		return;
-	}
+	scmcall_arg scm_arg = {0};
+	scmcall_ret scm_ret = {0};
 
 	cmd_buf = (void *)&fuse_id;
 	cmd_len = sizeof(fuse_id);
 
-	/*response */
-	resp_len = sizeof(resp_buf);
+	if (!scm_arm_support)
+	{
+		/*response */
+		resp_len = sizeof(resp_buf);
 
-	svc_id = SCM_SVC_FUSE;
-	cmd_id = SCM_IS_SW_FUSE_BLOWN_ID;
+		svc_id = SCM_SVC_FUSE;
+		cmd_id = SCM_IS_SW_FUSE_BLOWN_ID;
 
-	scm_call(svc_id, cmd_id, cmd_buf, cmd_len, &resp_buf, resp_len);
-	return resp_buf;
+		scm_call(svc_id, cmd_id, cmd_buf, cmd_len, &resp_buf, resp_len);
+		return resp_buf;
+	}
+	else
+	{
+		scm_arg.x0 = MAKE_SIP_SCM_CMD(SCM_SVC_FUSE, SCM_IS_SW_FUSE_BLOWN_ID);
+		scm_arg.x1 = MAKE_SCM_ARGS(0x2,SMC_PARAM_TYPE_BUFFER_READWRITE,SMC_PARAM_TYPE_VALUE);
+		scm_arg.x2  = cmd_buf;
+		scm_arg.x3 = cmd_len;
+
+		scm_call2(&scm_arg, &scm_ret);
+		return (uint8_t)scm_ret.x1;
+	}
 }
 
 #define SHA256_DIGEST_LENGTH	(256/8)
diff --git a/platform/msm_shared/sdhci_msm.c b/platform/msm_shared/sdhci_msm.c
index d72d90d..d721110 100644
--- a/platform/msm_shared/sdhci_msm.c
+++ b/platform/msm_shared/sdhci_msm.c
@@ -143,6 +143,8 @@
 void sdhci_msm_init(struct sdhci_host *host, struct sdhci_msm_data *config)
 {
 	uint32_t io_switch;
+	uint32_t caps = 0;
+	uint32_t version;
 
 	/* Disable HC mode */
 	RMWREG32((config->pwrctl_base + SDCC_MCI_HC_MODE), SDHCI_HC_START_BIT, SDHCI_HC_WIDTH, 0);
@@ -196,6 +198,25 @@
 	/* Enable pwr control interrupt */
 	writel(SDCC_HC_PWR_CTRL_INT, (config->pwrctl_base + SDCC_HC_PWRCTL_MASK_REG));
 
+	version = readl(host->msm_host->pwrctl_base + MCI_VERSION);
+
+	host->major = (version & CORE_VERSION_MAJOR_MASK) >> CORE_VERSION_MAJOR_SHIFT;
+	host->minor = (version & CORE_VERSION_MINOR_MASK);
+
+	/*
+	 * For SDCC5 the capabilities registers does not have voltage advertised
+	 * Override the values using SDCC_HC_VENDOR_SPECIFIC_CAPABILITIES0
+	 */
+	if (host->major >= 1 && host->minor != 0x11 && host->minor != 0x12)
+	{
+		caps = REG_READ32(host, SDHCI_CAPS_REG1);
+
+		if (config->slot == 0x1)
+			REG_WRITE32(host, (caps | SDHCI_1_8_VOL_MASK), SDCC_HC_VENDOR_SPECIFIC_CAPABILITIES0);
+		else
+			REG_WRITE32(host, (caps | SDHCI_3_0_VOL_MASK), SDCC_HC_VENDOR_SPECIFIC_CAPABILITIES0);
+	}
+
 	config->tuning_done = false;
 	config->calibration_done = false;
 	host->tuning_in_progress = false;
diff --git a/platform/msm_shared/smd.c b/platform/msm_shared/smd.c
index dfb5b62..6d99088 100644
--- a/platform/msm_shared/smd.c
+++ b/platform/msm_shared/smd.c
@@ -153,10 +153,63 @@
 		return false;
 }
 
+/* Copy the local buffer to fifo buffer.
+ * Takes care of fifo overlap.
+ * Uses the fifo as circular buffer, if the request data
+ * exceeds the max size of the buffer start from the beginning.
+ */
+static void memcpy_to_fifo(smd_channel_info_t *ch_ptr, uint32_t *src, size_t len)
+{
+	uint32_t write_index = ch_ptr->port_info->ch0.write_index;
+	uint32_t *dest = (uint32_t *)(ch_ptr->send_buf + write_index);
+
+	while(len)
+	{
+		*dest++ = *src++;
+		write_index += 4;
+		len -= 4;
+
+		if (write_index >= ch_ptr->fifo_size)
+		{
+			write_index = 0;
+			dest = (uint32_t *)(ch_ptr->send_buf + write_index);
+		}
+	}
+	ch_ptr->port_info->ch0.write_index = write_index;
+}
+
+/* Copy the fifo buffer to a local destination.
+ * Takes care of fifo overlap.
+ * If the response data is split across with some part at
+ * end of fifo and some at the beginning of the fifo
+ */
+void memcpy_from_fifo(smd_channel_info_t *ch_ptr, uint32_t *dest, size_t len)
+{
+	uint32_t read_index = ch_ptr->port_info->ch1.read_index;
+	uint32_t *src = (uint32_t *)(ch_ptr->recv_buf + read_index);
+
+	while(len)
+	{
+		*dest++ = *src++;
+		read_index += 4;
+		len -= 4;
+
+		if (read_index >= ch_ptr->fifo_size)
+		{
+			read_index = 0;
+			src = (uint32_t *) (ch_ptr->recv_buf + read_index);
+		}
+	}
+
+	ch_ptr->port_info->ch1.read_index = read_index;
+}
+
 uint8_t* smd_read(smd_channel_info_t *ch, uint32_t *len, int ch_type)
 {
 	smd_pkt_hdr smd_hdr;
 	uint32_t size = 0;
+	/* Response as per the current design does not exceed 20 bytes */
+	uint32_t response[5];
 
 	/* Read the indices from smem */
 	ch->port_info = smem_get_alloc_entry(SMEM_SMD_BASE_ID + ch->alloc_entry.cid,
@@ -172,20 +225,12 @@
 	{
 		/* Get the update info from memory */
 		arch_invalidate_cache_range((addr_t) ch->port_info, size);
-
-		if ((ch->port_info->ch1.read_index + sizeof(smd_pkt_hdr)) >= ch->fifo_size)
-		{
-			dprintf(CRITICAL, "At %d:%s:RX channel read index [%u] is greater than RX fifo size[%u]\n",
-							   __LINE__,__func__, ch->port_info->ch1.read_index, ch->fifo_size);
-			return -1;
-		}
 	}
 
-
-	arch_invalidate_cache_range((addr_t)(ch->recv_buf + ch->port_info->ch1.read_index), sizeof(smd_hdr));
-
 	/* Copy the smd buffer to local buf */
-	memcpy(&smd_hdr, (void*)(ch->recv_buf + ch->port_info->ch1.read_index), sizeof(smd_hdr));
+	memcpy_from_fifo(ch, &smd_hdr, sizeof(smd_hdr));
+
+	arch_invalidate_cache_range((addr_t)&smd_hdr, sizeof(smd_hdr));
 
 	*len = smd_hdr.pkt_size;
 
@@ -194,23 +239,18 @@
 	{
 		/* Get the update info from memory */
 		arch_invalidate_cache_range((addr_t) ch->port_info, size);
-
-		if ((ch->port_info->ch1.read_index + sizeof(smd_hdr) + smd_hdr.pkt_size) >= ch->fifo_size)
-		{
-			dprintf(CRITICAL, "At %d:%s:RX channel read index [%u] is greater than RX fifo size[%u]\n",
-							   __LINE__,__func__, ch->port_info->ch1.read_index, ch->fifo_size);
-			return -1;
-		}
 	}
 
 	/* We are good to return the response now */
-	return (uint8_t*)(ch->recv_buf + ch->port_info->ch1.read_index + sizeof(smd_hdr));
+	memcpy_from_fifo(ch, response, sizeof(response));
+
+	arch_invalidate_cache_range((addr_t)response, sizeof(response));
+
+	return response;
 }
 
 void smd_signal_read_complete(smd_channel_info_t *ch, uint32_t len)
 {
-	ch->port_info->ch1.read_index += sizeof(smd_pkt_hdr) + len;
-
 	/* Clear the data_written flag */
 	ch->port_info->ch1.data_written = 0;
 
@@ -258,14 +298,9 @@
 	/*copy the local buf to smd buf */
 	smd_hdr.pkt_size = len;
 
-	memcpy(ch->send_buf + ch->port_info->ch0.write_index, &smd_hdr, sizeof(smd_hdr));
+	memcpy_to_fifo(ch, (uint32_t *)&smd_hdr, sizeof(smd_hdr));
 
-	memcpy(ch->send_buf + ch->port_info->ch0.write_index + sizeof(smd_hdr), data, len);
-
-	arch_invalidate_cache_range((addr_t)ch->send_buf+ch->port_info->ch0.write_index, sizeof(smd_hdr) + len);
-
-	/* Update write index */
-	ch->port_info->ch0.write_index += sizeof(smd_hdr) + len;
+	memcpy_to_fifo(ch, data, len);
 
 	dsb();
 
diff --git a/platform/msm_shared/smem.h b/platform/msm_shared/smem.h
index 6d9f43d..7760e69 100644
--- a/platform/msm_shared/smem.h
+++ b/platform/msm_shared/smem.h
@@ -367,6 +367,7 @@
 	MSM8236  = 242,
 	MSM8636  = 243,
 	MSM8909  = 245,
+	MSMTHULIUM  = 246,
 	APQ8016  = 247,
 	MSM8216  = 248,
 	MSM8116  = 249,
diff --git a/platform/msm_shared/ucs.c b/platform/msm_shared/ucs.c
index 1e03410..49ecf1b 100644
--- a/platform/msm_shared/ucs.c
+++ b/platform/msm_shared/ucs.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -80,6 +80,107 @@
 	return UFS_SUCCESS;
 }
 
+int ucs_do_scsi_rpmb_read(struct ufs_dev *dev, uint32_t *req_buf, uint32_t blk_cnt,
+                                 uint32_t *resp_buf, uint32_t *resp_len)
+{
+	// validate input parameters
+	ASSERT(req_buf);
+	ASSERT(resp_buf);
+	ASSERT(resp_len);
+
+	STACKBUF_DMA_ALIGN(cdb, sizeof(struct scsi_sec_protocol_cdb));
+	struct scsi_req_build_type   req_upiu;
+	struct scsi_sec_protocol_cdb *cdb_out_param, *cdb_in_param;
+	uint32_t                     blks_remaining;
+	uint32_t                     blks_to_transfer;
+	uint64_t                     bytes_to_transfer;
+	uint64_t                     max_size;
+	blks_remaining    = blk_cnt;
+	blks_to_transfer  = blks_remaining;
+	bytes_to_transfer = blks_to_transfer * RPMB_FRAME_SIZE;
+
+	// check if total bytes to transfer exceed max supported size
+	max_size = dev->rpmb_rw_size * RPMB_FRAME_SIZE * blk_cnt;
+	if (bytes_to_transfer > max_size)
+	{
+		dprintf(CRITICAL, "RPMB request transfer size %llu greater than max transfer size %llu\n", bytes_to_transfer, max_size);
+		return -UFS_FAILURE;
+	}
+#ifdef DEBUG_UFS
+	dprintf(INFO, "rpmb_read: req_buf: 0x%x blk_count: 0x%x\n", *req_buf, blk_cnt);
+	dprintf(INFO, "rpmb_read: bytes_to_transfer: 0x%x blks_to_transfer: 0x%x\n",
+                   bytes_to_transfer, blks_to_transfer);
+#endif
+	// send the request
+	cdb_out_param = (struct scsi_sec_protocol_cdb*) cdb;
+	memset(cdb_out_param, 0, sizeof(struct scsi_sec_protocol_cdb));
+
+	cdb_out_param->opcode                = SCSI_CMD_SECPROT_OUT;
+	cdb_out_param->cdb1                  = SCSI_SEC_PROT;
+	cdb_out_param->sec_protocol_specific = BE16(SCSI_SEC_UFS_PROT_ID);
+	cdb_out_param->alloc_tlen            = BE32(bytes_to_transfer);
+
+	// Flush CDB to memory
+	dsb();
+	arch_clean_invalidate_cache_range((addr_t) cdb_out_param, sizeof(struct scsi_sec_protocol_cdb));
+
+	memset(&req_upiu, 0, sizeof(struct scsi_req_build_type));
+
+	req_upiu.cdb              = (addr_t) cdb_out_param;
+	req_upiu.data_buffer_addr = (addr_t) req_buf;
+	req_upiu.data_len         = bytes_to_transfer;
+	req_upiu.flags            = UPIU_FLAGS_WRITE;
+	req_upiu.lun              = UFS_WLUN_RPMB;
+	req_upiu.dd               = UTRD_TARGET_TO_SYSTEM;
+
+#ifdef DEBUG_UFS
+	dprintf(INFO, "Sending RPMB Read request\n");
+#endif
+	if (ucs_do_scsi_cmd(dev, &req_upiu))
+	{
+		dprintf(CRITICAL, "%s:%d ucs_do_scsi_rpmb_read: failed\n", __func__, __LINE__);
+		return -UFS_FAILURE;
+	}
+#ifdef DEBUG_UFS
+	dprintf(INFO, "Sending RPMB Read request complete\n");
+#endif
+	// read the response
+	cdb_in_param = (struct scsi_sec_protocol_cdb*) cdb;
+	memset(cdb_in_param, 0, sizeof(struct scsi_sec_protocol_cdb));
+
+	cdb_in_param->opcode                = SCSI_CMD_SECPROT_IN;
+	cdb_in_param->cdb1                  = SCSI_SEC_PROT;
+	cdb_in_param->sec_protocol_specific = BE16(SCSI_SEC_UFS_PROT_ID);
+	cdb_in_param->alloc_tlen            = BE32(bytes_to_transfer);
+
+	// Flush CDB to memory
+	dsb();
+	arch_clean_invalidate_cache_range((addr_t) cdb_in_param, sizeof(struct scsi_sec_protocol_cdb));
+
+	memset(&req_upiu, 0, sizeof(struct scsi_req_build_type));
+
+	req_upiu.cdb              = (addr_t) cdb_in_param;
+	req_upiu.data_buffer_addr = (addr_t) resp_buf;
+	req_upiu.data_len         = bytes_to_transfer;
+	req_upiu.flags            = UPIU_FLAGS_READ;
+	req_upiu.lun              = UFS_WLUN_RPMB;
+	req_upiu.dd               = UTRD_SYSTEM_TO_TARGET;
+
+#ifdef DEBUG_UFS
+	dprintf(INFO, "Sending RPMB Read response\n");
+#endif
+	if (ucs_do_scsi_cmd(dev, &req_upiu))
+	{
+		dprintf(CRITICAL, "%s:%d ucs_do_scsi_rpmb_read: failed\n", __func__, __LINE__);
+		return -UFS_FAILURE;
+	}
+#ifdef DEBUG_UFS
+	dprintf(SPEW, "Sending RPMB Read response complete\n");
+#endif
+	*resp_len = bytes_to_transfer;
+	return UFS_SUCCESS;
+}
+
 int ucs_do_scsi_read(struct ufs_dev *dev, struct scsi_rdwr_req *req)
 {
 	STACKBUF_DMA_ALIGN(cdb, sizeof(struct scsi_rdwr_cdb));
@@ -312,7 +413,7 @@
 	struct scsi_sense_cdb      *cdb_param;
 	uint8_t                    buf[SCSI_SENSE_BUF_LEN];
 
-	cdb_param = cdb;
+	cdb_param = (struct scsi_sense_cdb *) cdb;
 
 	memset(cdb, 0, sizeof(struct scsi_sense_cdb));
 
diff --git a/platform/msm_shared/ufs.c b/platform/msm_shared/ufs.c
index 1fd26b4..aa5f90b 100644
--- a/platform/msm_shared/ufs.c
+++ b/platform/msm_shared/ufs.c
@@ -89,6 +89,31 @@
 	qgic_change_interrupt_cfg(UFS_IRQ, INTERRUPT_LVL_N_TO_N);
 }
 
+static void ufs_rpmb_init(struct ufs_dev *dev)
+{
+	int ret = 0;
+
+	// calculate the size of rpmb partition in sectors
+	ret = dme_read_unit_desc(dev, UFS_WLUN_RPMB);
+	if (ret != UFS_SUCCESS)
+	{
+		dprintf(CRITICAL, "UFS dme_read_unit_desc failed for RPMB Partition\n");
+		return;
+	}
+
+	// gets the number of rpmb frames allowed in a single UPIU commands
+	ret = dme_read_geo_desc(dev);
+	if (ret != UFS_SUCCESS)
+	{
+		dprintf(CRITICAL, "UFS dme_read_geo_desc failed for RPMB Partition\n");
+		return;
+	}
+#ifdef DEBUG_UFS
+	dprintf(INFO, "RPMB: Logical Block Count: 0x%x\n", dev->rpmb_num_blocks);
+	dprintf(INFO, "RPMB: RPMB Read Write Size: 0x%x\n", dev->rpmb_rw_size);
+#endif
+}
+
 int ufs_read(struct ufs_dev* dev, uint64_t start_lba, addr_t buffer, uint32_t num_blocks)
 {
 	struct scsi_rdwr_req req;
@@ -194,7 +219,6 @@
 int ufs_init(struct ufs_dev *dev)
 {
 	uint32_t ret = UFS_SUCCESS;
-	uint64_t cap;
 	uint8_t lun = 0;
 
 	dev->block_size = 4096;
diff --git a/platform/msm_shared/utp.c b/platform/msm_shared/utp.c
index 317cd69..e0463b2 100644
--- a/platform/msm_shared/utp.c
+++ b/platform/msm_shared/utp.c
@@ -40,6 +40,7 @@
 #include <ufs.h>
 #include <platform/iomap.h>
 #include <platform/clock.h>
+#include <platform/timer.h>
 #include <arch/ops.h>
 #include <endian.h>
 #include <stdlib.h>
@@ -54,7 +55,7 @@
 	/* Make sure we have more nodes than just the head in the list. */
 	if (list_next(irq->list, irq->list) == NULL)
 	{
-		dprintf(CRITICAL, "UTRD/ UTMRD processed signalled and the wait queue is empty\n");
+		dprintf(CRITICAL, "%s:%d UTRD/ UTMRD processed signalled and the wait queue is empty\n", __func__, __LINE__);
 		ASSERT(0);
 	}
 
@@ -74,7 +75,7 @@
 
 			if (event_signal(req->event, false))
 			{
-				dprintf(CRITICAL, "Event signal failed.\n");
+				dprintf(CRITICAL, "%s:%d Event signal failed.\n",__func__, __LINE__);
 				ASSERT(0);
 
 			}
@@ -113,11 +114,8 @@
 
 	if (!found)
 	{
-		/* TODO: This case shouldd wait on a semaphore instead od returning error.
-		 * Return error until LK adds semaphore support.
-		 */
 		doorbell_bit_val = 0;
-		dprintf(CRITICAL, "Unable to find a free slot for transaction.\n");
+		dprintf(CRITICAL, "%s:%d Unable to find a free slot for transaction.\n",__func__, __LINE__);
 	}
 
 	return doorbell_bit_val;
@@ -232,8 +230,8 @@
 		udelay(1);
 		if(retry == UTP_MAX_COMMAND_RETRY)
 		{
-			dprintf(CRITICAL, "UTP command never completed.\n");
-			return 1;
+			dprintf(CRITICAL, "%s:%d UTP command never completed.\n", __func__, __LINE__);
+			return ERR_TIMED_OUT;
 		}
 #ifdef DEBUG_UFS
 		dprintf(INFO, "Waiting for UTRCS/URMRCS Completion...\n");
@@ -313,15 +311,11 @@
 #endif
 	ret = utp_poll_utrd_complete(dev);
 
-	if (ret)
+	if (ret == ERR_TIMED_OUT)
 	{
-		if (ret == ERR_TIMED_OUT)
-		{
-			/* Transaction not completed even after timeout ms. */
-			ret = utp_utrd_process_timeout_req(dev, utrd_req, &req);
-		}
-		else
-			ret = -UFS_FAILURE;
+		/* Transaction not completed even after timeout ms. */
+		dprintf(CRITICAL, "%s:%d Transaction timeout after polling %d times\n",__func__, __LINE__, UTP_MAX_COMMAND_RETRY);
+		ret = utp_utrd_process_timeout_req(dev, utrd_req, &req);
 		goto utp_enqueue_utrd_err;
 	}
 	else
@@ -336,7 +330,7 @@
 		/* Check the response. */
 		if (desc->overall_cmd_status != UTRD_OCS_SUCCESS)
 		{
-			dprintf(CRITICAL, "Command failed. command type = %x\n", utrd_req->cmd_type);
+			dprintf(CRITICAL, "%s:%d Command failed. command type = %x\n", __func__, __LINE__, utrd_req->cmd_type);
 			ret = -UFS_FAILURE;
 			goto utp_enqueue_utrd_err;
 		}
@@ -363,7 +357,7 @@
 
 	if (*num_prdt > UTP_MAX_PRD_TABLE_ENTRIES)
 	{
-		dprintf(CRITICAL, "Data length exceeds for a single upiu transfer.\n");
+		dprintf(CRITICAL, "%s:%d Data length exceeds for a single upiu transfer.\n", __func__,__LINE__);
 		return -UFS_FAILURE;
 	}
 
@@ -388,6 +382,7 @@
 	{
 		if (upiu_data->data_buffer_addr & 0x3)
 		{
+			dprintf(CRITICAL, "%s:%d Alignment and length check failed for data tranfer command.\n", __func__, __LINE__);
 			return -UFS_FAILURE;
 		}
 	}
@@ -475,7 +470,7 @@
 	req_upiu = (struct upiu_gen_hdr*) memalign((size_t ) lcm(CACHE_LINE, UTP_CMD_DESC_BASE_ALIGNMENT_SIZE), ROUNDUP(cmd_desc_len, CACHE_LINE));
 	if (!req_upiu)
 	{
-		dprintf(CRITICAL, "Unable to allocate request upiu\n");
+		dprintf(CRITICAL, "%s:%d Unable to allocate request upiu\n",__func__, __LINE__);
 		return -UFS_FAILURE;
 	}
 
@@ -506,7 +501,7 @@
 	ret = utp_enqueue_utrd(dev, &utrd);
 	if (ret)
 	{
-		dprintf(CRITICAL, "Command failed. command = %x\n", req_upiu->basic_hdr.trans_type);
+		dprintf(CRITICAL, "%s:%d Command failed. command = %x\n", __func__, __LINE__, req_upiu->basic_hdr.trans_type);
 		goto utp_enqueue_upiu_err;
 	}
 
diff --git a/platform/thulium/acpuclock.c b/platform/thulium/acpuclock.c
new file mode 100644
index 0000000..3b76b91
--- /dev/null
+++ b/platform/thulium/acpuclock.c
@@ -0,0 +1,271 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <debug.h>
+#include <reg.h>
+#include <mmc.h>
+#include <clock.h>
+#include <platform/timer.h>
+#include <platform/clock.h>
+#include <platform/iomap.h>
+#include <pm8x41.h>
+
+void clock_init_mmc(uint32_t interface)
+{
+	char clk_name[64];
+	int ret;
+
+	snprintf(clk_name, sizeof(clk_name), "sdc%u_iface_clk", interface);
+
+	/* enable interface clock */
+	ret = clk_get_set_enable(clk_name, 0, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set sdc%u_iface_clk ret = %d\n", interface, ret);
+		ASSERT(0);
+	}
+}
+
+/* Configure MMC clock */
+void clock_config_mmc(uint32_t interface, uint32_t freq)
+{
+	int ret = 0;
+	char clk_name[64];
+
+	snprintf(clk_name, sizeof(clk_name), "sdc%u_core_clk", interface);
+
+	if(freq == MMC_CLK_400KHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 400000, true);
+	}
+	else if(freq == MMC_CLK_50MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 50000000, true);
+	}
+	else if(freq == MMC_CLK_96MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 100000000, true);
+	}
+	else if(freq == MMC_CLK_192MHZ)
+	{
+		ret = clk_get_set_enable(clk_name, 192000000, true);
+	}
+	else
+	{
+		dprintf(CRITICAL, "sdc frequency (%u) is not supported\n", freq);
+		ASSERT(0);
+	}
+
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set sdc%u_core_clk ret = %d\n", interface, ret);
+		ASSERT(0);
+	}
+}
+
+/* Configure UART clock based on the UART block id*/
+void clock_config_uart_dm(uint8_t id)
+{
+	int ret;
+	char iclk[64];
+	char cclk[64];
+
+	snprintf(iclk, sizeof(iclk), "uart%u_iface_clk", id);
+	snprintf(cclk, sizeof(cclk), "uart%u_core_clk", id);
+
+	ret = clk_get_set_enable(iclk, 0, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set uart%u_iface_clk ret = %d\n", id, ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable(cclk, 7372800, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set uart%u_core_clk ret = %d\n", id, ret);
+		ASSERT(0);
+	}
+}
+
+/* Function to asynchronously reset CE (Crypto Engine).
+ * Function assumes that all the CE clocks are off.
+ */
+static void ce_async_reset(uint8_t instance)
+{
+}
+
+void clock_ce_enable(uint8_t instance)
+{
+}
+
+void clock_ce_disable(uint8_t instance)
+{
+}
+
+void clock_config_ce(uint8_t instance)
+{
+	/* Need to enable the clock before disabling since the clk_disable()
+	 * has a check to default to nop when the clk_enable() is not called
+	 * on that particular clock.
+	 */
+	clock_ce_enable(instance);
+
+	clock_ce_disable(instance);
+
+	ce_async_reset(instance);
+
+	clock_ce_enable(instance);
+
+}
+
+void clock_usb30_gdsc_enable(void)
+{
+	uint32_t reg = readl(GCC_USB30_GDSCR);
+
+	reg &= ~(0x1);
+
+	writel(reg, GCC_USB30_GDSCR);
+}
+
+/* enables usb30 clocks */
+void clock_usb30_init(void)
+{
+	int ret;
+
+	ret = clk_get_set_enable("usb30_iface_clk", 0, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb30_iface_clk. ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	clock_usb30_gdsc_enable();
+
+	ret = clk_get_set_enable("usb30_master_clk", 125000000, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb30_master_clk. ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("usb30_phy_aux_clk", 1200000, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb30_phy_aux_clk. ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("usb30_mock_utmi_clk", 60000000, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb30_mock_utmi_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("usb30_sleep_clk", 0, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb30_sleep_clk ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	ret = clk_get_set_enable("usb_phy_cfg_ahb2phy_clk", 0, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to enable usb_phy_cfg_ahb2phy_clk = %d\n", ret);
+		ASSERT(0);
+	}
+
+	pm8x41_lnbb_clock_ctrl(1);
+}
+
+void clock_bumpup_pipe3_clk()
+{
+	int ret = 0;
+
+	ret = clk_get_set_enable("usb30_pipe_clk", 0, true);
+	if(ret)
+	{
+		dprintf(CRITICAL, "failed to set usb30_pipe_clk. ret = %d\n", ret);
+		ASSERT(0);
+	}
+
+	return;
+}
+
+void clock_reset_usb_phy()
+{
+	int ret;
+
+	struct clk *phy_reset_clk = NULL;
+	struct clk *pipe_reset_clk = NULL;
+
+	/* Look if phy com clock is present */
+	phy_reset_clk = clk_get("usb30_phy_reset");
+	ASSERT(phy_reset_clk);
+
+	pipe_reset_clk = clk_get("usb30_pipe_clk");
+	ASSERT(pipe_reset_clk);
+
+	/* ASSERT */
+	ret = clk_reset(phy_reset_clk, CLK_RESET_ASSERT);
+
+	if (ret)
+	{
+		dprintf(CRITICAL, "Failed to assert usb30_phy_reset clk\n");
+		return;
+	}
+
+	ret = clk_reset(pipe_reset_clk, CLK_RESET_ASSERT);
+	if (ret)
+	{
+		dprintf(CRITICAL, "Failed to assert usb30_pipe_clk\n");
+		goto deassert_phy_clk;
+	}
+
+	udelay(100);
+
+	/* DEASSERT */
+	ret = clk_reset(pipe_reset_clk, CLK_RESET_DEASSERT);
+	if (ret)
+	{
+		dprintf(CRITICAL, "Failed to deassert usb_pipe_clk\n");
+		return;
+	}
+
+deassert_phy_clk:
+
+	ret = clk_reset(phy_reset_clk, CLK_RESET_DEASSERT);
+	if (ret)
+	{
+		dprintf(CRITICAL, "Failed to deassert usb30_phy_com_reset clk\n");
+		return;
+	}
+}
diff --git a/platform/thulium/gpio.c b/platform/thulium/gpio.c
new file mode 100644
index 0000000..281584f
--- /dev/null
+++ b/platform/thulium/gpio.c
@@ -0,0 +1,64 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials provided
+ *    with the distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <reg.h>
+#include <platform/iomap.h>
+#include <platform/gpio.h>
+
+/* Remove the file after the gpio patch to move this to msm_shared gets merged. */
+void gpio_tlmm_config(uint32_t gpio, uint8_t func,
+		      uint8_t dir, uint8_t pull,
+		      uint8_t drvstr, uint32_t enable)
+{
+	uint32_t val = 0;
+	val |= pull;
+	val |= func << 2;
+	val |= drvstr << 6;
+	val |= enable << 9;
+	writel(val, (unsigned int *)GPIO_CONFIG_ADDR(gpio));
+	return;
+}
+
+void gpio_set(uint32_t gpio, uint32_t dir)
+{
+	writel(dir, (unsigned int *)GPIO_IN_OUT_ADDR(gpio));
+	return;
+}
+
+/* Configure gpio for blsp uart */
+void gpio_config_uart_dm(uint8_t id)
+{
+    /* configure rx gpio */
+	gpio_tlmm_config(5, 2, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_8MA, GPIO_DISABLE);
+
+    /* configure tx gpio */
+	gpio_tlmm_config(4, 2, GPIO_OUTPUT, GPIO_NO_PULL,
+				GPIO_8MA, GPIO_DISABLE);
+}
diff --git a/platform/thulium/include/platform/clock.h b/platform/thulium/include/platform/clock.h
new file mode 100644
index 0000000..0a5836c
--- /dev/null
+++ b/platform/thulium/include/platform/clock.h
@@ -0,0 +1,51 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __MSM8996_CLOCK_H
+#define __MSM8996_CLOCK_H
+
+#include <clock.h>
+#include <clock_lib2.h>
+
+#define UART_DM_CLK_RX_TX_BIT_RATE 0xCC
+
+
+void platform_clock_init(void);
+
+void clock_init_mmc(uint32_t interface);
+void clock_config_mmc(uint32_t interface, uint32_t freq);
+void clock_config_uart_dm(uint8_t id);
+void hsusb_clock_init(void);
+void clock_config_ce(uint8_t instance);
+void mdp_clock_init(void);
+void clock_ce_enable(uint8_t instance);
+void clock_ce_disable(uint8_t instance);
+void clock_usb30_init(void);
+void clock_reset_usb_phy();
+
+#endif
diff --git a/platform/thulium/include/platform/gpio.h b/platform/thulium/include/platform/gpio.h
new file mode 100644
index 0000000..c00512b
--- /dev/null
+++ b/platform/thulium/include/platform/gpio.h
@@ -0,0 +1,60 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials provided
+ *    with the distribution.
+ *  * Neither the name of The Linux Foundation, Inc. nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __PLATFORM_MSM8996_GPIO_H
+#define __PLATFORM_MSM8996_GPIO_H
+
+#include <gpio.h>
+
+/* GPIO TLMM: Direction */
+#define GPIO_INPUT      0
+#define GPIO_OUTPUT     1
+
+/* GPIO TLMM: Pullup/Pulldown */
+#define GPIO_NO_PULL    0
+#define GPIO_PULL_DOWN  1
+#define GPIO_KEEPER     2
+#define GPIO_PULL_UP    3
+
+/* GPIO TLMM: Drive Strength */
+#define GPIO_2MA        0
+#define GPIO_4MA        1
+#define GPIO_6MA        2
+#define GPIO_8MA        3
+#define GPIO_10MA       4
+#define GPIO_12MA       5
+#define GPIO_14MA       6
+#define GPIO_16MA       7
+
+/* GPIO TLMM: Status */
+#define GPIO_ENABLE     0
+#define GPIO_DISABLE    1
+
+void gpio_config_uart_dm(uint8_t id);
+void gpio_config_blsp_i2c(uint8_t, uint8_t);
+#endif
diff --git a/platform/thulium/include/platform/iomap.h b/platform/thulium/include/platform/iomap.h
new file mode 100644
index 0000000..2c17d12
--- /dev/null
+++ b/platform/thulium/include/platform/iomap.h
@@ -0,0 +1,176 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _PLATFORM_THULIUM_IOMAP_H_
+#define _PLATFORM_THULIUM_IOMAP_H_
+
+#define MSM_SHARED_BASE             0x86000000
+
+#define MSM_IOMAP_HMSS_START        0x09800000
+
+#define MSM_IOMAP_BASE              0x00000000
+#define MSM_IOMAP_END               0x10000000
+
+#define MSM_SHARED_IMEM_BASE        0x066BF000
+#define RESTART_REASON_ADDR         (MSM_SHARED_IMEM_BASE + 0x65C)
+
+#define MSM_GIC_DIST_BASE           (MSM_IOMAP_HMSS_START + 0x003C0000)
+#define MSM_GIC_REDIST_BASE         (MSM_IOMAP_HMSS_START + 0x00400000)
+
+#define HMSS_APCS_F0_QTMR_V1_BASE   (MSM_IOMAP_HMSS_START + 0x00050000)
+#define QTMR_BASE                   HMSS_APCS_F0_QTMR_V1_BASE
+
+#define PERIPH_SS_BASE              0x07400000
+
+#define MSM_SDC1_BASE               (PERIPH_SS_BASE + 0x00064000)
+#define MSM_SDC1_SDHCI_BASE         (PERIPH_SS_BASE + 0x00064900)
+#define MSM_SDC2_BASE               (PERIPH_SS_BASE + 0x000A4000)
+#define MSM_SDC2_SDHCI_BASE         (PERIPH_SS_BASE + 0x000A4900)
+
+#define BLSP1_UART0_BASE            (PERIPH_SS_BASE + 0x0016F000)
+#define BLSP1_UART1_BASE            (PERIPH_SS_BASE + 0x00170000)
+#define BLSP1_UART2_BASE            (PERIPH_SS_BASE + 0x00171000)
+#define BLSP1_UART3_BASE            (PERIPH_SS_BASE + 0x00172000)
+#define BLSP1_UART4_BASE            (PERIPH_SS_BASE + 0x00173000)
+#define BLSP1_UART5_BASE            (PERIPH_SS_BASE + 0x00174000)
+
+#define BLSP2_UART1_BASE            (PERIPH_SS_BASE + 0x001B0000)
+
+/* USB3.0 */
+#define MSM_USB30_BASE              0x6A00000
+#define MSM_USB30_QSCRATCH_BASE     0x6AF8800
+/* SS QMP (Qulacomm Multi Protocol) */
+#define QMP_PHY_BASE                0x7410000
+
+/* QUSB2 PHY */
+#define QUSB2_PHY_BASE              0x7411000
+#define QUSB2PHY_PORT_POWERDOWN     (QUSB2_PHY_BASE + 0x000000B4)
+#define GCC_QUSB2_PHY_BCR           (CLK_CTL_BASE + 0x00012038)
+#define QUSB2PHY_PORT_UTMI_CTRL2    (QUSB2_PHY_BASE + 0x000000C4)
+#define QUSB2PHY_PORT_TUNE1         (QUSB2_PHY_BASE + 0x00000080)
+#define QUSB2PHY_PORT_TUNE2         (QUSB2_PHY_BASE + 0x00000084)
+#define QUSB2PHY_PORT_TUNE3         (QUSB2_PHY_BASE + 0x00000088)
+#define QUSB2PHY_PORT_TUNE4         (QUSB2_PHY_BASE + 0x0000008C)
+
+/* Clocks */
+#define CLK_CTL_BASE                0x300000
+
+/* GPLL */
+#define GPLL0_MODE                  (CLK_CTL_BASE + 0x0000)
+#define GPLL4_MODE                  (CLK_CTL_BASE + 0x77000)
+#define APCS_GPLL_ENA_VOTE          (CLK_CTL_BASE + 0x52000)
+#define APCS_CLOCK_BRANCH_ENA_VOTE  (CLK_CTL_BASE + 0x52004)
+
+/* UART Clocks */
+#define BLSP1_AHB_CBCR              (CLK_CTL_BASE + 0x17004)
+#define BLSP1_UART2_APPS_CBCR       (CLK_CTL_BASE + 0x1C004)
+#define BLSP1_UART2_APPS_CMD_RCGR   (CLK_CTL_BASE + 0x1C00C)
+#define BLSP1_UART2_APPS_CFG_RCGR   (CLK_CTL_BASE + 0x1C010)
+#define BLSP1_UART2_APPS_M          (CLK_CTL_BASE + 0x1C014)
+#define BLSP1_UART2_APPS_N          (CLK_CTL_BASE + 0x1C018)
+#define BLSP1_UART2_APPS_D          (CLK_CTL_BASE + 0x1C01C)
+
+/* USB3 clocks */
+#define USB_30_BCR                  (CLK_CTL_BASE + 0xF000)
+#define USB30_MASTER_CBCR           (CLK_CTL_BASE + 0xF008)
+#define USB30_MASTER_CMD_RCGR       (CLK_CTL_BASE + 0xF014)
+#define USB30_MASTER_CFG_RCGR       (CLK_CTL_BASE + 0xF018)
+#define USB30_MASTER_M              (CLK_CTL_BASE + 0xF01C)
+#define USB30_MASTER_N              (CLK_CTL_BASE + 0xF020)
+#define USB30_MASTER_D              (CLK_CTL_BASE + 0xF024)
+#define SYS_NOC_USB3_AXI_CBCR       (CLK_CTL_BASE + 0xF03C)
+
+#define USB30_MOCK_UTMI_CMD_RCGR    (CLK_CTL_BASE + 0xF014)
+#define USB30_MOCK_UTMI_CFG_RCGR    (CLK_CTL_BASE + 0xF018)
+#define USB30_MOCK_UTMI_CBCR        (CLK_CTL_BASE + 0xF010)
+#define USB30_SLEEP_CBCR            (CLK_CTL_BASE + 0xF00C)
+#define USB30_PHY_AUX_CMD_RCGR      (CLK_CTL_BASE + 0x5000C)
+#define USB30_PHY_AUX_CFG_RCGR      (CLK_CTL_BASE + 0x50010)
+#define USB30_PHY_AUX_CBCR          (CLK_CTL_BASE + 0x50000)
+#define USB30_PHY_PIPE_CBCR         (CLK_CTL_BASE + 0x50004)
+#define USB30_PHY_BCR               (CLK_CTL_BASE + 0x50020)
+#define USB30PHY_PHY_BCR            (CLK_CTL_BASE + 0x50024)
+#define GCC_USB30_GDSCR             (CLK_CTL_BASE + 0xF004)
+#define USB_PHY_CFG_AHB2PHY_CBCR    (CLK_CTL_BASE + 0x6A004)
+
+/* SDCC */
+#define SDCC1_BCR                   (CLK_CTL_BASE + 0x13000) /* block reset */
+#define SDCC1_APPS_CBCR             (CLK_CTL_BASE + 0x13004) /* branch control */
+#define SDCC1_AHB_CBCR              (CLK_CTL_BASE + 0x13008)
+#define SDCC1_CMD_RCGR              (CLK_CTL_BASE + 0x13010) /* cmd */
+#define SDCC1_CFG_RCGR              (CLK_CTL_BASE + 0x13014) /* cfg */
+#define SDCC1_M                     (CLK_CTL_BASE + 0x13018) /* m */
+#define SDCC1_N                     (CLK_CTL_BASE + 0x1301C) /* n */
+#define SDCC1_D                     (CLK_CTL_BASE + 0x13020) /* d */
+
+/* SDCC2 */
+#define SDCC2_BCR                   (CLK_CTL_BASE + 0x14000) /* block reset */
+#define SDCC2_APPS_CBCR             (CLK_CTL_BASE + 0x14004) /* branch control */
+#define SDCC2_AHB_CBCR              (CLK_CTL_BASE + 0x14008)
+#define SDCC2_CMD_RCGR              (CLK_CTL_BASE + 0x14010) /* cmd */
+#define SDCC2_CFG_RCGR              (CLK_CTL_BASE + 0x14014) /* cfg */
+#define SDCC2_M                     (CLK_CTL_BASE + 0x14018) /* m */
+#define SDCC2_N                     (CLK_CTL_BASE + 0x1401C) /* n */
+#define SDCC2_D                     (CLK_CTL_BASE + 0x14020) /* d */
+
+#define UFS_BASE                    0x624000
+
+#define SPMI_BASE                   0x4000000
+#define SPMI_GENI_BASE              (SPMI_BASE + 0xA000)
+#define SPMI_PIC_BASE               (SPMI_BASE + 0x1800000)
+
+#define MSM_CE_BAM_BASE             0x67A000
+#define MSM_CE_BASE                 0x644000
+
+#define TLMM_BASE_ADDR              0x1010000
+#define GPIO_CONFIG_ADDR(x)         (TLMM_BASE_ADDR + (x)*0x1000)
+#define GPIO_IN_OUT_ADDR(x)         (TLMM_BASE_ADDR + 0x4 + (x)*0x1000)
+
+#define MPM2_MPM_CTRL_BASE                   0x4A1000
+#define MPM2_MPM_PS_HOLD                     0x4AB000
+#define MPM2_MPM_SLEEP_TIMETICK_COUNT_VAL    0x4A3000
+
+/* DRV strength for sdcc */
+#define SDC1_HDRV_PULL_CTL           (TLMM_BASE_ADDR + 0x0003C000)
+
+/* SDHCI - power control registers */
+#define SDCC_MCI_HC_MODE            (0x00000078)
+#define SDCC_HC_PWRCTL_STATUS_REG   (0x000000DC)
+#define SDCC_HC_PWRCTL_MASK_REG     (0x000000E0)
+#define SDCC_HC_PWRCTL_CLEAR_REG    (0x000000E4)
+#define SDCC_HC_PWRCTL_CTL_REG      (0x000000E8)
+
+/* Boot config */
+#define SEC_CTRL_CORE_BASE          0x70000
+#define BOOT_CONFIG_OFFSET          0x00006044
+#define BOOT_CONFIG_REG             (SEC_CTRL_CORE_BASE + BOOT_CONFIG_OFFSET)
+
+/* Fix This */
+#define PLATFORM_QMP_OFFSET                  0x8
+
+#endif
diff --git a/platform/thulium/include/platform/irqs.h b/platform/thulium/include/platform/irqs.h
new file mode 100644
index 0000000..dd0f31a
--- /dev/null
+++ b/platform/thulium/include/platform/irqs.h
@@ -0,0 +1,68 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *   * Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above
+ *     copyright notice, this list of conditions and the following
+ *     disclaimer in the documentation and/or other materials provided
+ *     with the distribution.
+ *   * Neither the name of The Linux Foundation, Inc. nor the names of its
+ *     contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef __IRQS_THULIUM_H
+#define __IRQS_THULIUM_H
+
+/* MSM ACPU Interrupt Numbers */
+
+/* 0-15:  STI/SGI (software triggered/generated interrupts)
+ * 16-31: PPI (private peripheral interrupts)
+ * 32+:   SPI (shared peripheral interrupts)
+ */
+
+#define GIC_PPI_START                          16
+#define GIC_SPI_START                          32
+
+#define INT_QTMR_NON_SECURE_PHY_TIMER_EXP      (GIC_PPI_START + 3)
+#define INT_QTMR_VIRTUAL_TIMER_EXP             (GIC_PPI_START + 4)
+
+#define INT_QTMR_FRM_0_PHYSICAL_TIMER_EXP      (GIC_SPI_START + 31)
+
+#define USB30_EE1_IRQ                          (GIC_SPI_START + 131)
+
+/* Retrofit universal macro names */
+#define INT_USB_HS                             USB30_EE1_IRQ
+
+#define SDCC1_PWRCTL_IRQ                       (GIC_SPI_START + 134)
+#define SDCC2_PWRCTL_IRQ                       (GIC_SPI_START + 221)
+
+#define UFS_IRQ                                (GIC_SPI_START + 265)
+
+#define EE0_KRAIT_HLOS_SPMI_PERIPH_IRQ         (GIC_SPI_START + 265)
+
+/* Fix this: where this comes from? */
+#define NR_MSM_IRQS                            256
+#define NR_GPIO_IRQS                           173
+#define NR_BOARD_IRQS                          0
+
+#define NR_IRQS                                (NR_MSM_IRQS + NR_GPIO_IRQS + \
+                                               NR_BOARD_IRQS)
+
+#endif	/* __IRQS_THULIUM_H */
diff --git a/platform/thulium/platform.c b/platform/thulium/platform.c
new file mode 100644
index 0000000..1dad8cc
--- /dev/null
+++ b/platform/thulium/platform.c
@@ -0,0 +1,132 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <reg.h>
+#include <platform/iomap.h>
+#include <qgic.h>
+#include <qtimer.h>
+#include <platform/clock.h>
+#include <mmu.h>
+#include <arch/arm/mmu.h>
+#include <smem.h>
+#include <board.h>
+
+#define MSM_IOMAP_SIZE     ((MSM_IOMAP_END - MSM_IOMAP_BASE)/MB)
+#define MSM_SHARED_SIZE    2
+
+/* LK memory - cacheable, write through */
+#define LK_MEMORY         (MMU_MEMORY_TYPE_NORMAL_WRITE_THROUGH | \
+                           MMU_MEMORY_AP_READ_WRITE)
+
+/* Peripherals - non-shared device */
+#define IOMAP_MEMORY      (MMU_MEMORY_TYPE_DEVICE_SHARED | \
+                           MMU_MEMORY_AP_READ_WRITE | MMU_MEMORY_XN)
+
+/* SCRATCH memory - cacheable, write through */
+#define SCRATCH_MEMORY       (MMU_MEMORY_TYPE_NORMAL_WRITE_THROUGH | \
+                           MMU_MEMORY_AP_READ_WRITE | MMU_MEMORY_XN)
+
+static mmu_section_t mmu_section_table[] = {
+/*       Physical addr,    Virtual addr,     Size (in MB),       Flags */
+	{    MEMBASE,           MEMBASE,          (MEMSIZE / MB),    LK_MEMORY},
+	{    MSM_IOMAP_BASE,    MSM_IOMAP_BASE,    MSM_IOMAP_SIZE,   IOMAP_MEMORY},
+	{    KERNEL_ADDR,       KERNEL_ADDR,       KERNEL_SIZE,      SCRATCH_MEMORY},
+	{    SCRATCH_ADDR,      SCRATCH_ADDR,      SCRATCH_SIZE,     SCRATCH_MEMORY},
+	{    MSM_SHARED_BASE,   MSM_SHARED_BASE,   MSM_SHARED_SIZE,  SCRATCH_MEMORY},
+};
+
+void platform_early_init(void)
+{
+	board_init();
+	platform_clock_init();
+	qgic_init();
+	qtimer_init();
+	scm_init();
+}
+
+void platform_init(void)
+{
+	dprintf(INFO, "platform_init()\n");
+}
+
+void platform_uninit(void)
+{
+#if DISPLAY_SPLASH_SCREEN
+	display_shutdown();
+#endif
+
+	qtimer_uninit();
+}
+
+int platform_use_identity_mmu_mappings(void)
+{
+	/* Use only the mappings specified in this file. */
+	return 0;
+}
+
+/* Setup memory for this platform */
+void platform_init_mmu_mappings(void)
+{
+	uint32_t i;
+	uint32_t sections;
+	uint32_t table_size = ARRAY_SIZE(mmu_section_table);
+
+	/* Configure the MMU page entries for memory read from the
+	   mmu_section_table */
+	for (i = 0; i < table_size; i++)
+	{
+		sections = mmu_section_table[i].num_of_sections;
+
+		while (sections--)
+		{
+			arm_mmu_map_section(mmu_section_table[i].paddress +
+								sections * MB,
+								mmu_section_table[i].vaddress +
+								sections * MB,
+								mmu_section_table[i].flags);
+		}
+	}
+}
+
+addr_t platform_get_virt_to_phys_mapping(addr_t virt_addr)
+{
+	/* Using 1-1 mapping on this platform. */
+	return virt_addr;
+}
+
+addr_t platform_get_phys_to_virt_mapping(addr_t phys_addr)
+{
+	/* Using 1-1 mapping on this platform. */
+	return phys_addr;
+}
+
+uint32_t platform_get_sclk_count(void)
+{
+	return readl(MPM2_MPM_SLEEP_TIMETICK_COUNT_VAL);
+}
diff --git a/platform/thulium/rules.mk b/platform/thulium/rules.mk
new file mode 100644
index 0000000..10afc50
--- /dev/null
+++ b/platform/thulium/rules.mk
@@ -0,0 +1,28 @@
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+ARCH    := arm
+ARM_CPU := cortex-a8
+CPU     := generic
+
+DEFINES += ARM_CPU_CORE_KRAIT
+
+MMC_SLOT         := 1
+
+DEFINES += PERIPH_BLK_BLSP=1
+DEFINES += WITH_CPU_EARLY_INIT=0 WITH_CPU_WARM_BOOT=0 \
+	   MMC_SLOT=$(MMC_SLOT)
+
+INCLUDES += -I$(LOCAL_DIR)/include -I$(LK_TOP_DIR)/platform/msm_shared/include
+
+DEVS += fbcon
+MODULES += dev/fbcon
+
+OBJS += \
+	$(LOCAL_DIR)/platform.o \
+	$(LOCAL_DIR)/acpuclock.o \
+	$(LOCAL_DIR)/thulium-clock.o \
+	$(LOCAL_DIR)/gpio.o
+
+LINKER_SCRIPT += $(BUILDDIR)/system-onesegment.ld
+
+include platform/msm_shared/rules.mk
diff --git a/platform/thulium/thulium-clock.c b/platform/thulium/thulium-clock.c
new file mode 100644
index 0000000..b02bec4
--- /dev/null
+++ b/platform/thulium/thulium-clock.c
@@ -0,0 +1,419 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <reg.h>
+#include <err.h>
+#include <clock.h>
+#include <clock_pll.h>
+#include <clock_lib2.h>
+#include <platform/clock.h>
+#include <platform/iomap.h>
+
+
+/* Mux source select values */
+#define cxo_source_val    0
+#define gpll0_source_val  1
+#define gpll4_source_val  5
+#define cxo_mm_source_val 0
+#define mmpll0_mm_source_val 1
+#define mmpll1_mm_source_val 2
+#define mmpll3_mm_source_val 3
+#define gpll0_mm_source_val 5
+
+struct clk_freq_tbl rcg_dummy_freq = F_END;
+
+
+/* Clock Operations */
+static struct clk_ops clk_ops_rst =
+{
+	.reset     = clock_lib2_reset_clk_reset,
+};
+
+static struct clk_ops clk_ops_branch =
+{
+	.enable     = clock_lib2_branch_clk_enable,
+	.disable    = clock_lib2_branch_clk_disable,
+	.set_rate   = clock_lib2_branch_set_rate,
+	.reset      = clock_lib2_branch_clk_reset,
+};
+
+static struct clk_ops clk_ops_rcg_mnd =
+{
+	.enable     = clock_lib2_rcg_enable,
+	.set_rate   = clock_lib2_rcg_set_rate,
+};
+
+static struct clk_ops clk_ops_rcg =
+{
+	.enable     = clock_lib2_rcg_enable,
+	.set_rate   = clock_lib2_rcg_set_rate,
+};
+
+static struct clk_ops clk_ops_cxo =
+{
+	.enable     = cxo_clk_enable,
+	.disable    = cxo_clk_disable,
+};
+
+static struct clk_ops clk_ops_pll_vote =
+{
+	.enable     = pll_vote_clk_enable,
+	.disable    = pll_vote_clk_disable,
+	.auto_off   = pll_vote_clk_disable,
+	.is_enabled = pll_vote_clk_is_enabled,
+};
+
+static struct clk_ops clk_ops_vote =
+{
+	.enable     = clock_lib2_vote_clk_enable,
+	.disable    = clock_lib2_vote_clk_disable,
+};
+
+/* Clock Sources */
+static struct fixed_clk cxo_clk_src =
+{
+	.c = {
+		.rate     = 19200000,
+		.dbg_name = "cxo_clk_src",
+		.ops      = &clk_ops_cxo,
+	},
+};
+
+static struct pll_vote_clk gpll0_clk_src =
+{
+	.en_reg       = (void *) APCS_GPLL_ENA_VOTE,
+	.en_mask      = BIT(0),
+	.status_reg     = (void *) GPLL0_MODE,
+	.status_mask    = BIT(30),
+	.parent       = &cxo_clk_src.c,
+
+	.c = {
+		.rate     = 600000000,
+		.dbg_name = "gpll0_clk_src",
+		.ops      = &clk_ops_pll_vote,
+	},
+};
+
+static struct pll_vote_clk gpll4_clk_src =
+{
+	.en_reg       = (void *) APCS_GPLL_ENA_VOTE,
+	.en_mask      = BIT(4),
+	.status_reg   = (void *) GPLL4_MODE,
+	.status_mask  = BIT(30),
+	.parent       = &cxo_clk_src.c,
+
+	.c = {
+		.rate     = 1600000000,
+		.dbg_name = "gpll4_clk_src",
+		.ops      = &clk_ops_pll_vote,
+	},
+};
+
+/* UART Clocks */
+static struct clk_freq_tbl ftbl_gcc_blsp1_2_uart1_6_apps_clk[] =
+{
+	F( 3686400,  gpll0,    1,  96,  15625),
+	F( 7372800,  gpll0,    1, 192,  15625),
+	F(14745600,  gpll0,    1, 384,  15625),
+	F(16000000,  gpll0,    5,   2,     15),
+	F(19200000,    cxo,    1,   0,      0),
+	F(24000000,  gpll0,    5,   1,      5),
+	F(32000000,  gpll0,    1,   4,     75),
+	F(40000000,  gpll0,   15,   0,      0),
+	F(46400000,  gpll0,    1,  29,    375),
+	F(48000000,  gpll0, 12.5,   0,      0),
+	F(51200000,  gpll0,    1,  32,    375),
+	F(56000000,  gpll0,    1,   7,     75),
+	F(58982400,  gpll0,    1, 1536, 15625),
+	F(60000000,  gpll0,   10,   0,      0),
+	F(63160000,  gpll0,  9.5,   0,      0),
+	F_END
+};
+
+static struct rcg_clk blsp1_uart2_apps_clk_src =
+{
+	.cmd_reg      = (uint32_t *) BLSP1_UART2_APPS_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) BLSP1_UART2_APPS_CFG_RCGR,
+	.m_reg        = (uint32_t *) BLSP1_UART2_APPS_M,
+	.n_reg        = (uint32_t *) BLSP1_UART2_APPS_N,
+	.d_reg        = (uint32_t *) BLSP1_UART2_APPS_D,
+
+	.set_rate     = clock_lib2_rcg_set_rate_mnd,
+	.freq_tbl     = ftbl_gcc_blsp1_2_uart1_6_apps_clk,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "blsp1_uart2_apps_clk",
+		.ops      = &clk_ops_rcg_mnd,
+	},
+};
+
+static struct branch_clk gcc_blsp1_uart2_apps_clk =
+{
+	.cbcr_reg     = (uint32_t *) BLSP1_UART2_APPS_CBCR,
+	.parent       = &blsp1_uart2_apps_clk_src.c,
+
+	.c = {
+		.dbg_name = "gcc_blsp1_uart2_apps_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct vote_clk gcc_blsp1_ahb_clk = {
+	.cbcr_reg     = (uint32_t *) BLSP1_AHB_CBCR,
+	.vote_reg     = (uint32_t *) APCS_CLOCK_BRANCH_ENA_VOTE,
+	.en_mask      = BIT(17),
+
+	.c = {
+		.dbg_name = "gcc_blsp1_ahb_clk",
+		.ops      = &clk_ops_vote,
+	},
+};
+
+/* SDCC Clocks */
+static struct clk_freq_tbl ftbl_gcc_sdcc1_4_apps_clk[] =
+{
+	F(   144000,    cxo,  16,   3,  25),
+	F(   400000,    cxo,  12,   1,   4),
+	F( 20000000,  gpll0,  15,   1,   2),
+	F( 25000000,  gpll0,  12,   1,   2),
+	F( 50000000,  gpll0,  12,   0,   0),
+	F( 96000000,  gpll4,  16,   0,   0),
+	F(192000000,  gpll4,   8,   0,   0),
+	F(384000000,  gpll4,   4,   0,   0),
+	F_END
+};
+
+static struct rcg_clk sdcc1_apps_clk_src =
+{
+	.cmd_reg      = (uint32_t *) SDCC1_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) SDCC1_CFG_RCGR,
+	.m_reg        = (uint32_t *) SDCC1_M,
+	.n_reg        = (uint32_t *) SDCC1_N,
+	.d_reg        = (uint32_t *) SDCC1_D,
+
+	.set_rate     = clock_lib2_rcg_set_rate_mnd,
+	.freq_tbl     = ftbl_gcc_sdcc1_4_apps_clk,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "sdc1_clk",
+		.ops      = &clk_ops_rcg_mnd,
+	},
+};
+
+static struct branch_clk gcc_sdcc1_apps_clk =
+{
+	.cbcr_reg     = (uint32_t *) SDCC1_APPS_CBCR,
+	.parent       = &sdcc1_apps_clk_src.c,
+
+	.c = {
+		.dbg_name = "gcc_sdcc1_apps_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk gcc_sdcc1_ahb_clk =
+{
+	.cbcr_reg     = (uint32_t *) SDCC1_AHB_CBCR,
+	.has_sibling  = 1,
+
+	.c = {
+		.dbg_name = "gcc_sdcc1_ahb_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk gcc_sys_noc_usb30_axi_clk = {
+	.cbcr_reg    = (uint32_t *) SYS_NOC_USB3_AXI_CBCR,
+	.has_sibling = 1,
+
+	.c = {
+		.dbg_name = "sys_noc_usb30_axi_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct clk_freq_tbl ftbl_gcc_usb30_master_clk[] = {
+	F( 125000000, gpll0,    1,    5,    24),
+	F_END
+};
+
+static struct rcg_clk usb30_master_clk_src = {
+	.cmd_reg      = (uint32_t *) USB30_MASTER_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) USB30_MASTER_CFG_RCGR,
+	.m_reg        = (uint32_t *) USB30_MASTER_M,
+	.n_reg        = (uint32_t *) USB30_MASTER_N,
+	.d_reg        = (uint32_t *) USB30_MASTER_D,
+
+	.set_rate     = clock_lib2_rcg_set_rate_mnd,
+	.freq_tbl     = ftbl_gcc_usb30_master_clk,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "usb30_master_clk_src",
+		.ops      = &clk_ops_rcg,
+	},
+};
+
+static struct branch_clk gcc_usb30_master_clk = {
+	.cbcr_reg = (uint32_t *) USB30_MASTER_CBCR,
+	.bcr_reg  = (uint32_t *) USB_30_BCR,
+	.parent   = &usb30_master_clk_src.c,
+
+	.c = {
+		.dbg_name = "usb30_master_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct clk_freq_tbl ftbl_gcc_usb30_mock_utmi_clk_src[] = {
+	F(  60000000, gpll0,   10,    0,     0),
+	F_END
+};
+
+static struct rcg_clk usb30_mock_utmi_clk_src = {
+	.cmd_reg      = (uint32_t *) USB30_MOCK_UTMI_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) USB30_MOCK_UTMI_CFG_RCGR,
+	.set_rate     = clock_lib2_rcg_set_rate_hid,
+	.freq_tbl     = ftbl_gcc_usb30_mock_utmi_clk_src,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "usb30_mock_utmi_clk_src",
+		.ops      = &clk_ops_rcg,
+	},
+};
+
+static struct branch_clk gcc_usb30_mock_utmi_clk = {
+	.cbcr_reg    = (uint32_t *) USB30_MOCK_UTMI_CBCR,
+	.has_sibling = 0,
+	.parent      = &usb30_mock_utmi_clk_src.c,
+
+	.c = {
+		.dbg_name = "usb30_mock_utmi_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk gcc_usb30_sleep_clk = {
+	.cbcr_reg    = (uint32_t *) USB30_SLEEP_CBCR,
+	.has_sibling = 1,
+
+	.c = {
+		.dbg_name = "usb30_sleep_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct clk_freq_tbl ftbl_gcc_usb30_phy_aux_clk_src[] = {
+	F(   1200000,         cxo,   16,    0,     0),
+	F_END
+};
+
+static struct rcg_clk usb30_phy_aux_clk_src = {
+	.cmd_reg      = (uint32_t *) USB30_PHY_AUX_CMD_RCGR,
+	.cfg_reg      = (uint32_t *) USB30_PHY_AUX_CFG_RCGR,
+	.set_rate     = clock_lib2_rcg_set_rate_hid,
+	.freq_tbl     = ftbl_gcc_usb30_phy_aux_clk_src,
+	.current_freq = &rcg_dummy_freq,
+
+	.c = {
+		.dbg_name = "usb30_phy_aux_clk_src",
+		.ops      = &clk_ops_rcg,
+	},
+};
+
+static struct branch_clk gcc_usb30_phy_aux_clk = {
+	.cbcr_reg    = (uint32_t *)USB30_PHY_AUX_CBCR,
+	.has_sibling = 0,
+	.parent      = &usb30_phy_aux_clk_src.c,
+
+	.c = {
+		.dbg_name = "usb30_phy_aux_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct branch_clk gcc_usb30_pipe_clk = {
+	.bcr_reg      = (uint32_t *) USB30PHY_PHY_BCR,
+	.cbcr_reg     = (uint32_t *) USB30_PHY_PIPE_CBCR,
+	.has_sibling  = 1,
+
+	.c = {
+		.dbg_name = "usb30_pipe_clk",
+		.ops      = &clk_ops_branch,
+	},
+};
+
+static struct reset_clk gcc_usb30_phy_reset = {
+	.bcr_reg = (uint32_t )USB30_PHY_BCR,
+
+	.c = {
+		.dbg_name = "usb30_phy_reset",
+		.ops      = &clk_ops_rst,
+	},
+};
+
+static struct branch_clk gcc_usb_phy_cfg_ahb2phy_clk = {
+	.cbcr_reg = (uint32_t *)USB_PHY_CFG_AHB2PHY_CBCR,
+	.has_sibling = 1,
+
+	.c = {
+		.dbg_name = "usb_phy_cfg_ahb2phy_clk",
+		.ops = &clk_ops_branch,
+	},
+};
+
+
+/* Clock lookup table */
+static struct clk_lookup msm_thulium_clocks[] =
+{
+	CLK_LOOKUP("sdc1_iface_clk", gcc_sdcc1_ahb_clk.c),
+	CLK_LOOKUP("sdc1_core_clk",  gcc_sdcc1_apps_clk.c),
+
+	CLK_LOOKUP("uart2_iface_clk", gcc_blsp1_ahb_clk.c),
+	CLK_LOOKUP("uart2_core_clk",  gcc_blsp1_uart2_apps_clk.c),
+
+	/* USB30 clocks */
+	CLK_LOOKUP("usb30_master_clk",    gcc_usb30_master_clk.c),
+	CLK_LOOKUP("usb30_iface_clk",     gcc_sys_noc_usb30_axi_clk.c),
+	CLK_LOOKUP("usb30_mock_utmi_clk", gcc_usb30_mock_utmi_clk.c),
+	CLK_LOOKUP("usb30_sleep_clk",     gcc_usb30_sleep_clk.c),
+	CLK_LOOKUP("usb30_phy_aux_clk",   gcc_usb30_phy_aux_clk.c),
+	CLK_LOOKUP("usb30_pipe_clk",      gcc_usb30_pipe_clk.c),
+	CLK_LOOKUP("usb30_phy_reset",     gcc_usb30_phy_reset.c),
+
+	CLK_LOOKUP("usb_phy_cfg_ahb2phy_clk",     gcc_usb_phy_cfg_ahb2phy_clk.c),
+};
+
+void platform_clock_init(void)
+{
+	clk_init(msm_thulium_clocks, ARRAY_SIZE(msm_thulium_clocks));
+}
diff --git a/project/mdm9635.mk b/project/mdm9635.mk
index 076a6d8..e83f0c1 100644
--- a/project/mdm9635.mk
+++ b/project/mdm9635.mk
@@ -24,3 +24,9 @@
 ifeq ($(ENABLE_USB30_SUPPORT),1)
 DEFINES += USB30_SUPPORT=1
 endif
+
+ENABLE_SMD_SUPPORT := 1
+
+ifeq ($(ENABLE_SMD_SUPPORT),1)
+DEFINES += SMD_SUPPORT=1
+endif
diff --git a/project/msm8909.mk b/project/msm8909.mk
index 0ffce48..410e13a 100644
--- a/project/msm8909.mk
+++ b/project/msm8909.mk
@@ -6,18 +6,26 @@
 
 MODULES += app/aboot
 
+ifeq ($(TARGET_BUILD_VARIANT),user)
+DEBUG := 0
+else
 DEBUG := 1
+endif
+
 EMMC_BOOT := 1
 
-ENABLE_SMD_SUPPORT := 1
+#ENABLE_SMD_SUPPORT := 1
 ENABLE_BOOT_CONFIG_SUPPORT := 1
+ENABLE_PWM_SUPPORT := true
 
 #DEFINES += WITH_DEBUG_DCC=1
+DEFINES += WITH_DEBUG_LOG_BUF=1
 DEFINES += WITH_DEBUG_UART=1
 #DEFINES += WITH_DEBUG_FBCON=1
 DEFINES += DEVICE_TREE=1
 #DEFINES += MMC_BOOT_BAM=1
 #DEFINES += CRYPTO_BAM=1
+DEFINES += SPMI_CORE_V2=1
 DEFINES += ABOOT_IGNORE_BOOT_HEADER_ADDRS=1
 
 DEFINES += ABOOT_FORCE_KERNEL_ADDR=0x80008000
diff --git a/project/msm8994.mk b/project/msm8994.mk
index 743e7eb..26b097e 100644
--- a/project/msm8994.mk
+++ b/project/msm8994.mk
@@ -5,6 +5,7 @@
 TARGET := msm8994
 
 MODULES += app/aboot
+MODULES += app/rpmbtests
 
 ifeq ($(TARGET_BUILD_VARIANT),user)
 DEBUG := 0
diff --git a/project/thulium.mk b/project/thulium.mk
new file mode 100644
index 0000000..e86a6c7
--- /dev/null
+++ b/project/thulium.mk
@@ -0,0 +1,48 @@
+# top level project rules for the thulium project
+#
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+TARGET := thulium
+
+MODULES += app/aboot
+
+DEBUG := 1
+EMMC_BOOT := 1
+ENABLE_SDHCI_SUPPORT := 1
+ENABLE_UFS_SUPPORT   := 1
+ENABLE_BOOT_CONFIG_SUPPORT := 1
+ENABLE_USB30_SUPPORT := 1
+ENABLE_QGIC3 := 1
+
+DEFINES +=VIRTIO=1
+
+#DEFINES += WITH_DEBUG_DCC=1
+DEFINES += WITH_DEBUG_UART=1
+#DEFINES += WITH_DEBUG_FBCON=1
+DEFINES += DEVICE_TREE=1
+DEFINES += ABOOT_IGNORE_BOOT_HEADER_ADDRS=1
+
+DEFINES += ABOOT_FORCE_KERNEL_ADDR=0x00008000
+DEFINES += ABOOT_FORCE_RAMDISK_ADDR=0x82200000
+DEFINES += ABOOT_FORCE_TAGS_ADDR=0x82000000
+DEFINES += ABOOT_FORCE_KERNEL64_ADDR=0x80080000
+DEFINES += USB_RESET_FROM_CLK=1
+
+#Disable thumb mode
+ENABLE_THUMB := false
+
+ifeq ($(EMMC_BOOT),1)
+DEFINES += _EMMC_BOOT=1
+endif
+
+ifeq ($(ENABLE_SDHCI_SUPPORT),1)
+DEFINES += MMC_SDHCI_SUPPORT=1
+endif
+
+ifeq ($(ENABLE_UFS_SUPPORT),1)
+DEFINES += UFS_SUPPORT=1
+endif
+
+ifeq ($(ENABLE_USB30_SUPPORT),1)
+DEFINES += USB30_SUPPORT=1
+endif
diff --git a/target/apq8084/include/target/display.h b/target/apq8084/include/target/display.h
index d89b797..c1d78f0 100644
--- a/target/apq8084/include/target/display.h
+++ b/target/apq8084/include/target/display.h
@@ -114,7 +114,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x03, 0x09, 0x03, 0x00, 0x20, 0x07, 0x01
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/apq8084/target_display.c b/target/apq8084/target_display.c
index 334cb32..b077038 100755
--- a/target/apq8084/target_display.c
+++ b/target/apq8084/target_display.c
@@ -509,11 +509,13 @@
 
 	panel_name += strspn(panel_name, " ");
 
-	if ((!strcmp(panel_name, NO_PANEL_CONFIG))
-			|| (!strcmp(panel_name, SIM_VIDEO_PANEL))
-			|| (!strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL))) {
+	if (!strcmp(panel_name, NO_PANEL_CONFIG)
+		|| !strcmp(panel_name, SIM_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_CMD_PANEL)
+		|| !strcmp(panel_name, SIM_DUALDSI_CMD_PANEL)) {
 		dprintf(INFO, "Selected panel: %s\nSkip panel configuration\n",
-								panel_name);
+			panel_name);
 		return;
 	} else if (!strcmp(panel_name, HDMI_PANEL_NAME)) {
 		dprintf(INFO, "%s: HDMI is primary\n", __func__);
diff --git a/target/fsm9010/rules.mk b/target/fsm9010/rules.mk
index 63f02b5..36cdc57 100644
--- a/target/fsm9010/rules.mk
+++ b/target/fsm9010/rules.mk
@@ -7,7 +7,7 @@
 MEMBASE := 0x0F900000 # SDRAM
 MEMSIZE := 0x00100000 # 1MB
 
-BASE_ADDR        := 0x00000000
+BASE_ADDR        := 0x0b600000
 
 TAGS_ADDR        := BASE_ADDR+0x01e00000
 KERNEL_ADDR      := BASE_ADDR+0x00008000
diff --git a/target/fsm9900/init.c b/target/fsm9900/init.c
index 43100e1..aff6aa6 100644
--- a/target/fsm9900/init.c
+++ b/target/fsm9900/init.c
@@ -162,37 +162,35 @@
 #if MMC_SDHCI_SUPPORT
 static void target_mmc_sdhci_init()
 {
+	static uint32_t mmc_clks[] = {
+		MMC_CLK_96MHZ, MMC_CLK_50MHZ };
+
 	struct mmc_config_data config = {0};
+	int i;
 
 	config.bus_width = DATA_BUS_WIDTH_8BIT;
-	config.max_clk_rate = MMC_CLK_96MHZ;
 
 	/* Trying Slot 1*/
 	config.slot = 1;
 	config.sdhc_base = mmc_sdhci_base[config.slot - 1];
 	config.pwrctl_base = mmc_sdc_base[config.slot - 1];
 	config.pwr_irq     = mmc_sdc_pwrctl_irq[config.slot - 1];
+	config.hs400_support = 0;
 
-	if (!(dev = mmc_init(&config))) {
-		/* Trying Slot 2 next */
-		config.slot = 2;
-		config.sdhc_base = mmc_sdhci_base[config.slot - 1];
-		config.pwrctl_base = mmc_sdc_base[config.slot - 1];
-		config.pwr_irq     = mmc_sdc_pwrctl_irq[config.slot - 1];
-
-		if (!(dev = mmc_init(&config))) {
-			dprintf(CRITICAL, "mmc init failed!");
-			ASSERT(0);
-		}
+	for (i = 0; i < ARRAY_SIZE(mmc_clks); ++i) {
+		config.max_clk_rate = mmc_clks[i];
+		dprintf(INFO, "SDHC Running at %u MHz\n",
+			config.max_clk_rate / 1000000);
+		dev = mmc_init(&config);
+		if (dev && partition_read_table() == 0)
+			return;
 	}
 
-	/*
-	 * MMC initialization is complete, read the partition table info
-	 */
-	if (partition_read_table()) {
+	if (dev == NULL)
+		dprintf(CRITICAL, "mmc init failed!");
+	else
 		dprintf(CRITICAL, "Error reading the partition table info\n");
-		ASSERT(0);
-	}
+	ASSERT(0);
 }
 
 void *target_mmc_device()
diff --git a/target/mdm9635/init.c b/target/mdm9635/init.c
index 9409e81..7557d75 100644
--- a/target/mdm9635/init.c
+++ b/target/mdm9635/init.c
@@ -44,6 +44,7 @@
 #include <bits.h>
 #include <qmp_phy.h>
 #include <scm.h>
+#include <rpm-smd.h>
 
 extern void smem_ptable_init(void);
 extern void smem_add_modem_partitions(struct ptable *flash_ptable);
@@ -145,6 +146,25 @@
 	update_ptable_names();
 
 	flash_set_ptable(&flash_ptable);
+	rpm_smd_init();
+}
+
+int target_cont_splash_screen()
+{
+	/*
+	 * FOR OEMs - Set cont_splash_screen to keep the splash enable after LK.
+	 * By default: the cont-splash-screen is ON
+	 */
+	return false;
+}
+
+void target_uninit()
+{
+#if DISPLAY_SPLASH_SCREEN
+	/* target_display_shutdown will uninitialize it in case of cont-splash */
+	if(target_cont_splash_screen())
+#endif
+		rpm_smd_uninit();
 }
 
 /* Do target specific usb initialization */
diff --git a/target/mdm9635/qpic_panel_drv.c b/target/mdm9635/qpic_panel_drv.c
new file mode 100644
index 0000000..c5a7c20
--- /dev/null
+++ b/target/mdm9635/qpic_panel_drv.c
@@ -0,0 +1,186 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <err.h>
+#include <endian.h>
+#include <platform/gpio.h>
+#include <platform/clock.h>
+#include <regulator.h>
+#include <rpm-smd.h>
+#include <platform/timer.h>
+
+#include "qpic.h"
+#include "qpic_panel.h"
+
+#define GPIOMUX_FUNC_1 1
+#define GPIOMUX_FUNC_GPIO 0
+
+#define RST_GPIO_ID 23
+#define CS_GPIO_ID 21
+#define AD8_GPIO_ID 20
+#define TE_GPIO_ID 22
+#define BL_GPIO_ID 84
+
+#define MEM_ACCESS_MODE 0x48
+#define MEM_ACCESS_FORMAT 0x66
+
+static uint32_t ldo6[][11] = {
+	{
+		LDOA_RES_TYPE, 6,
+		KEY_SOFTWARE_ENABLE, 4, GENERIC_DISABLE,
+		KEY_LDO_SOFTWARE_MODE, 4, SW_MODE_LDO_IPEAK,
+		KEY_MICRO_VOLT, 4, 0,
+	},
+	{
+		LDOA_RES_TYPE, 6,
+		KEY_SOFTWARE_ENABLE, 4, GENERIC_ENABLE,
+		KEY_LDO_SOFTWARE_MODE, 4, SW_MODE_LDO_IPEAK,
+		KEY_MICRO_VOLT, 4, 1800000,
+	},
+};
+
+static uint32_t ldo12[][11] = {
+	{
+		LDOA_RES_TYPE, 12,
+		KEY_SOFTWARE_ENABLE, 4, GENERIC_DISABLE,
+		KEY_LDO_SOFTWARE_MODE, 4, SW_MODE_LDO_IPEAK,
+		KEY_MICRO_VOLT, 4, 0,
+	},
+	{
+		LDOA_RES_TYPE, 12,
+		KEY_SOFTWARE_ENABLE, 4, GENERIC_ENABLE,
+		KEY_LDO_SOFTWARE_MODE, 4, SW_MODE_LDO_IPEAK,
+		KEY_MICRO_VOLT, 4, 2700000,
+	},
+};
+
+static void panel_io_off(struct qpic_panel_io_desc *qpic_panel_io)
+{
+	/* Turning off all gpios */
+	gpio_tlmm_config(RST_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_10MA, GPIO_DISABLE);
+	gpio_tlmm_config(CS_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_10MA, GPIO_DISABLE);
+	gpio_tlmm_config(AD8_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_10MA, GPIO_DISABLE);
+	gpio_tlmm_config(TE_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_10MA, GPIO_DISABLE);
+	gpio_tlmm_config(BL_GPIO_ID, GPIOMUX_FUNC_GPIO, GPIO_INPUT, GPIO_NO_PULL,
+				GPIO_10MA, GPIO_ENABLE);
+	gpio_set(BL_GPIO_ID, 0x0);
+
+	/* Disabling vdd & avdd voltage */
+	rpm_send_data(&ldo6[GENERIC_DISABLE][0], 36, RPM_REQUEST_TYPE);
+	rpm_send_data(&ldo12[GENERIC_DISABLE][0], 36, RPM_REQUEST_TYPE);
+
+	/* uninitializing smd */
+	rpm_smd_uninit();
+
+	return;
+}
+
+void ili9341_off(struct qpic_panel_io_desc *qpic_panel_io)
+{
+	panel_io_off(qpic_panel_io);
+}
+
+static int panel_io_on(struct qpic_panel_io_desc *qpic_panel_io)
+{
+	int rc = 0;
+
+	/* Setting vdd & avdd voltage */
+	rpm_send_data(&ldo6[GENERIC_ENABLE][0], 36, RPM_REQUEST_TYPE);
+	rpm_send_data(&ldo12[GENERIC_ENABLE][0], 36, RPM_REQUEST_TYPE);
+
+	/* Turning on all gpios */
+	gpio_tlmm_config(RST_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT,GPIO_NO_PULL,
+			GPIO_10MA, GPIO_ENABLE);
+	gpio_tlmm_config(CS_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT,GPIO_NO_PULL,
+			GPIO_10MA, GPIO_ENABLE);
+	gpio_tlmm_config(AD8_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT,GPIO_NO_PULL,
+			GPIO_10MA, GPIO_ENABLE);
+	gpio_tlmm_config(TE_GPIO_ID, GPIOMUX_FUNC_1, GPIO_INPUT,GPIO_NO_PULL,
+			GPIO_10MA, GPIO_ENABLE);
+	gpio_tlmm_config(BL_GPIO_ID, GPIOMUX_FUNC_GPIO, GPIO_INPUT, GPIO_NO_PULL,
+			GPIO_10MA, GPIO_DISABLE);
+	gpio_set(BL_GPIO_ID, 0x2);
+
+	mdelay(20);
+	return rc;
+}
+
+int ili9341_on(struct qpic_panel_io_desc *qpic_panel_io)
+{
+	uint8_t param[4];
+	int ret;
+
+	ret = panel_io_on(qpic_panel_io);
+	if (ret)
+		return ret;
+	qpic_send_pkt(OP_SOFT_RESET, NULL, 0);
+	/* wait for 120 ms after reset as panel spec suggests */
+	mdelay(120);
+	qpic_send_pkt(OP_SET_DISPLAY_OFF, NULL, 0);
+	/* wait for 20 ms after disply off */
+	mdelay(20);
+
+	/* set memory access control */
+	param[0] = MEM_ACCESS_MODE;
+	qpic_send_pkt(OP_SET_ADDRESS_MODE, param, 1);
+	/* wait for 20 ms after command sent as panel spec suggests */
+	mdelay(20);
+
+	param[0] = MEM_ACCESS_FORMAT;
+	qpic_send_pkt(OP_SET_PIXEL_FORMAT, param, 1);
+	mdelay(20);
+
+	/* set interface */
+	param[0] = 1;
+	param[1] = 0;
+	param[2] = 0;
+	qpic_send_pkt(OP_ILI9341_INTERFACE_CONTROL, param, 3);
+	mdelay(20);
+
+	qpic_send_pkt(OP_EXIT_SLEEP_MODE, NULL, 0);
+	mdelay(20);
+
+	qpic_send_pkt(OP_ENTER_NORMAL_MODE, NULL, 0);
+	mdelay(20);
+
+	qpic_send_pkt(OP_SET_DISPLAY_ON, NULL, 0);
+	mdelay(20);
+
+	param[0] = 0;
+	qpic_send_pkt(OP_ILI9341_TEARING_EFFECT_LINE_ON, param, 1);
+
+	param[0] = qpic_read_data(OP_GET_PIXEL_FORMAT, 1);
+
+	return 0;
+}
diff --git a/target/mdm9635/rules.mk b/target/mdm9635/rules.mk
index 62fb3e2..0c84c38 100644
--- a/target/mdm9635/rules.mk
+++ b/target/mdm9635/rules.mk
@@ -12,14 +12,17 @@
 SCRATCH_REGION2                     := 0x01300000
 SCRATCH_REGION2_SIZE                := 0x06B00000 # 107MB
 
+DEFINES += DISPLAY_SPLASH_SCREEN=0
 DEFINES += NO_KEYPAD_DRIVER=1
 DEFINES += PERIPH_BLK_BLSP=1
 
+DEVS += fbcon
 MODULES += \
 	dev/keys \
-	lib/ptable \
 	dev/pmic/pm8x41 \
-	lib/libfdt
+	lib/ptable \
+	lib/libfdt \
+	dev/fbcon
 
 DEFINES += \
 	MEMBASE=$(MEMBASE) \
@@ -33,4 +36,6 @@
 OBJS += \
 	$(LOCAL_DIR)/init.o \
 	$(LOCAL_DIR)/meminfo.o \
+	$(LOCAL_DIR)/target_display.o \
+	$(LOCAL_DIR)/qpic_panel_drv.o \
 	$(LOCAL_DIR)/keypad.o
diff --git a/target/mdm9635/target_display.c b/target/mdm9635/target_display.c
new file mode 100644
index 0000000..de54ea3
--- /dev/null
+++ b/target/mdm9635/target_display.c
@@ -0,0 +1,72 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <err.h>
+#include <msm_panel.h>
+#include "splash.h"
+
+/* PANEL INFO */
+#define QVGA_PANEL_XRES 240
+#define QVGA_PANEL_YRES 320
+#define BPP_16 16
+
+/* FB Base Address */
+#define QPIC_FB_ADDR  0x06D00000
+
+static struct msm_fb_panel_data panel;
+
+void target_display_init(const char *panel_name)
+{
+	uint32_t ret = 0;
+	dprintf(SPEW, "%s: Panel name = %s\n", __func__, panel_name);
+
+	/* Setting panel info */
+	panel.panel_info.xres = QVGA_PANEL_XRES;
+	panel.panel_info.yres = QVGA_PANEL_YRES;
+	panel.panel_info.bpp = BPP_16;
+	panel.panel_info.type = QPIC_PANEL;
+
+	/* Setting FB info */
+	panel.fb.width =  panel.panel_info.xres;
+	panel.fb.height =  panel.panel_info.yres;
+	panel.fb.stride =  panel.panel_info.xres;
+	panel.fb.bpp =  panel.panel_info.bpp;
+	panel.fb.format = FB_FORMAT_RGB565;
+	panel.fb.base = QPIC_FB_ADDR;
+
+	ret = msm_display_init(&panel);
+	if (ret)
+		dprintf(CRITICAL, "%s: ERROR: Display init failed\n", __func__);
+}
+
+void target_display_shutdown(void)
+{
+	msm_display_off();
+}
diff --git a/target/msm8226/include/target/display.h b/target/msm8226/include/target/display.h
index 8e87a7a..91d1e57 100755
--- a/target/msm8226/include/target/display.h
+++ b/target/msm8226/include/target/display.h
@@ -77,7 +77,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x07, 0x08, 0x07, 0x00, 0x20, 0x07, 0x01
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8226/target_display.c b/target/msm8226/target_display.c
index d385340..ca4623c 100755
--- a/target/msm8226/target_display.c
+++ b/target/msm8226/target_display.c
@@ -398,10 +398,11 @@
         uint32_t ret = 0;
 	uint32_t fb_addr = MIPI_FB_ADDR;
 
-	if ((!strcmp(panel_name, NO_PANEL_CONFIG))
-			|| (!strcmp(panel_name, SIM_VIDEO_PANEL))) {
+	if (!strcmp(panel_name, NO_PANEL_CONFIG)
+		|| !strcmp(panel_name, SIM_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_CMD_PANEL)) {
 		dprintf(INFO, "Selected panel: %s\nSkip panel configuration\n",
-								panel_name);
+			panel_name);
 		return;
 	}
 
diff --git a/target/msm8909/include/target/display.h b/target/msm8909/include/target/display.h
index 74613c0..cc2b4c2 100644
--- a/target/msm8909/include/target/display.h
+++ b/target/msm8909/include/target/display.h
@@ -46,7 +46,7 @@
 };
 
 static struct gpio_pin bkl_gpio = {
-  "msmgpio", 98, 3, 1, 0, 1
+  "msmgpio", 37, 3, 1, 0, 1
 };
 
 static struct gpio_pin enp_gpio = {
@@ -78,7 +78,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x00, 0x01, 0x01, 0x00, 0x20, 0x07, 0x00
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index b0eed95..3186c82 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -115,6 +115,7 @@
 	{ SDCC1_PWRCTL_IRQ, SDCC2_PWRCTL_IRQ };
 
 static void set_sdc_power_ctrl(void);
+static void set_ebi2_config(void);
 
 void update_ptable_names(void)
 {
@@ -237,17 +238,17 @@
 	/* Drive strength configs for sdc pins */
 	struct tlmm_cfgs sdc1_hdrv_cfg[] =
 	{
-		{ SDC1_CLK_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK },
-		{ SDC1_CMD_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK },
-		{ SDC1_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_6MA, TLMM_HDRV_MASK },
+		{ SDC1_CLK_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CMD_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_6MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
 	};
 
 	/* Pull configs for sdc pins */
 	struct tlmm_cfgs sdc1_pull_cfg[] =
 	{
-		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK },
-		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK },
-		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK },
+		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
 	};
 
 	/* Set the drive strength & pull control values */
@@ -255,6 +256,37 @@
 	tlmm_set_pull_ctrl(sdc1_pull_cfg, ARRAY_SIZE(sdc1_pull_cfg));
 }
 
+static void set_ebi2_config()
+{
+	/* Drive strength configs for ebi2 pins */
+	struct tlmm_cfgs ebi2_hdrv_cfg[] =
+	{
+		{ EBI2_BUSY_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_WE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_OE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CLE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_ALE_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CS_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_6MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	/* Pull configs for ebi2 pins */
+	struct tlmm_cfgs ebi2_pull_cfg[] =
+	{
+		{ EBI2_BUSY_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_WE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_OE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CLE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_ALE_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_CS_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, TLMM_EBI2_EMMC_GPIO_CFG },
+		{ EBI2_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	/* Set the drive strength & pull control values */
+	tlmm_set_hdrive_ctrl(ebi2_hdrv_cfg, ARRAY_SIZE(ebi2_hdrv_cfg));
+	tlmm_set_pull_ctrl(ebi2_pull_cfg, ARRAY_SIZE(ebi2_pull_cfg));
+
+}
 void target_init(void)
 {
 	uint32_t base_addr;
@@ -266,7 +298,9 @@
 
 	target_keystatus();
 
+#if ENABLE_BOOT_CONFIG_SUPPORT
 	platform_read_boot_config();
+#endif
 
 	if (platform_boot_dev_isemmc()) {
 		target_sdc_init();
@@ -277,6 +311,7 @@
 		}
 
 	} else {
+		set_ebi2_config();
 		config.pipes.read_pipe = DATA_PRODUCER_PIPE;
 		config.pipes.write_pipe = DATA_CONSUMER_PIPE;
 		config.pipes.cmd_pipe = CMD_PIPE;
@@ -313,7 +348,9 @@
 	if (target_use_signed_kernel())
 		target_crypto_init_params();
 
+#if ENABLE_SMD_SUPPORT
 	rpm_smd_init();
+#endif
 }
 
 void target_serialno(unsigned char *buf)
@@ -595,7 +632,9 @@
 	if (target_is_ssd_enabled())
 		clock_ce_disable(CE1_INSTANCE);
 
+#if ENABLE_SMD_SUPPORT
 	rpm_smd_uninit();
+#endif
 }
 
 /* Do any target specific intialization needed before entering fastboot mode */
diff --git a/target/msm8909/oem_panel.c b/target/msm8909/oem_panel.c
index b18c74a..7feabc6 100644
--- a/target/msm8909/oem_panel.c
+++ b/target/msm8909/oem_panel.c
@@ -38,9 +38,16 @@
 #include "panel_display.h"
 
 #include "include/panel_hx8394d_720p_video.h"
+#include "include/panel_hx8379a_fwvga_skua_video.h"
 
 #define DISPLAY_MAX_PANEL_DETECTION 0
 
+enum {
+	QRD_SKUA = 0x00,
+	QRD_SKUC = 0x08,
+	QRD_SKUE = 0x09,
+};
+
 /*---------------------------------------------------------------------------*/
 /* static panel selection variable                                           */
 /*---------------------------------------------------------------------------*/
@@ -48,6 +55,7 @@
 
 enum {
 	HX8394D_720P_VIDEO_PANEL,
+	HX8379A_FWVGA_SKUA_VIDEO_PANEL,
 	UNKNOWN_PANEL
 };
 
@@ -56,7 +64,8 @@
  * Any panel in this list can be selected using fastboot oem command.
  */
 static struct panel_list supp_panels[] = {
-	{"hx8394d_720p_video", HX8394D_720P_VIDEO_PANEL}
+	{"hx8394d_720p_video", HX8394D_720P_VIDEO_PANEL},
+	{"hx8379a_fwvga_skua_video", HX8379A_FWVGA_SKUA_VIDEO_PANEL},
 };
 
 static uint32_t panel_id;
@@ -112,6 +121,28 @@
 				hx8394d_720p_video_timings, TIMING_SIZE);
 		pinfo->mipi.signature = HX8394D_720P_VIDEO_SIGNATURE;
 		break;
+	case HX8379A_FWVGA_SKUA_VIDEO_PANEL:
+		panelstruct->paneldata	  = &hx8379a_fwvga_skua_video_panel_data;
+		panelstruct->panelres	  = &hx8379a_fwvga_skua_video_panel_res;
+		panelstruct->color	  = &hx8379a_fwvga_skua_video_color;
+		panelstruct->videopanel   = &hx8379a_fwvga_skua_video_video_panel;
+		panelstruct->commandpanel = &hx8379a_fwvga_skua_video_command_panel;
+		panelstruct->state	  = &hx8379a_fwvga_skua_video_state;
+		panelstruct->laneconfig   = &hx8379a_fwvga_skua_video_lane_config;
+		panelstruct->paneltiminginfo
+					 = &hx8379a_fwvga_skua_video_timing_info;
+		panelstruct->panelresetseq
+					 = &hx8379a_fwvga_skua_video_reset_seq;
+		panelstruct->backlightinfo = &hx8379a_fwvga_skua_video_backlight;
+		pinfo->mipi.panel_cmds
+					= hx8379a_fwvga_skua_video_on_command;
+		pinfo->mipi.num_of_panel_cmds
+					= HX8379A_FWVGA_SKUA_VIDEO_ON_COMMAND;
+		memcpy(phy_db->timing,
+				hx8379a_fwvga_skua_video_timings, TIMING_SIZE);
+		pinfo->mipi.signature = HX8379A_FWVGA_SKUA_VIDEO_SIGNATURE;
+		break;
+
 	case UNKNOWN_PANEL:
 	default:
 		memset(panelstruct, 0, sizeof(struct panel_struct));
@@ -135,6 +166,7 @@
 			struct mdss_dsi_phy_ctrl *phy_db)
 {
 	uint32_t hw_id = board_hardware_id();
+	uint32_t platform_subtype = board_hardware_subtype();
 	int32_t panel_override_id;
 
 	if (panel_name) {
@@ -155,8 +187,22 @@
 	}
 	switch (hw_id) {
 	case HW_PLATFORM_SURF:
+	case HW_PLATFORM_MTP:
 		panel_id = HX8394D_720P_VIDEO_PANEL;
 		break;
+	case HW_PLATFORM_QRD:
+		switch (platform_subtype) {
+			case QRD_SKUA:
+				panel_id = HX8379A_FWVGA_SKUA_VIDEO_PANEL;
+				break;
+			case QRD_SKUC:
+			case QRD_SKUE:
+			default:
+				dprintf(CRITICAL, "QRD Display not enabled for %d type\n",
+						platform_subtype);
+				return PANEL_TYPE_UNKNOWN;
+		}
+		break;
 	default:
 		dprintf(CRITICAL, "Display not enabled for %d HW type\n",
 			hw_id);
@@ -164,5 +210,6 @@
 	}
 
 panel_init:
+	phy_db->regulator_mode = DSI_PHY_REGULATOR_LDO_MODE;
 	return init_panel_data(panelstruct, pinfo, phy_db);
 }
diff --git a/target/msm8909/rules.mk b/target/msm8909/rules.mk
index 58d841a..b076247 100644
--- a/target/msm8909/rules.mk
+++ b/target/msm8909/rules.mk
@@ -11,7 +11,7 @@
 BASE_ADDR        := 0x80000000
 SCRATCH_ADDR     := 0x90000000
 
-DEFINES += DISPLAY_SPLASH_SCREEN=0
+DEFINES += DISPLAY_SPLASH_SCREEN=1
 DEFINES += DISPLAY_TYPE_MIPI=1
 DEFINES += DISPLAY_TYPE_DSI6G=1
 
diff --git a/target/msm8909/target_display.c b/target/msm8909/target_display.c
index 338c5da..93837f9 100755
--- a/target/msm8909/target_display.c
+++ b/target/msm8909/target_display.c
@@ -33,6 +33,7 @@
 #include <msm_panel.h>
 #include <mipi_dsi.h>
 #include <pm8x41.h>
+#include <pm8x41_wled.h>
 #include <board.h>
 #include <mdp3.h>
 #include <scm.h>
@@ -97,7 +98,7 @@
 	if (bl->bl_interface_type == BL_DCS)
 		return 0;
 
-	mpp.base = PM8x41_MMP4_BASE;
+	mpp.base = PM8x41_MMP2_BASE;
 	mpp.vin = MPP_VIN0;
 	if (enable) {
 		pm_pwm_enable(false);
@@ -131,6 +132,12 @@
 		mdp_gdsc_ctrl(enable);
 		mdss_bus_clocks_enable();
 		mdp_clock_enable();
+
+		/*
+		 * Enable auto functional gating
+		 * on DSI CMD AXI fetch from DDR
+		 */
+		writel(0x3ffff, MDP_CGC_EN);
 		ret = restore_secure_cfg(SECURE_DEVICE_MDSS);
 		if (ret) {
 			dprintf(CRITICAL,
@@ -173,35 +180,35 @@
 				enable_gpio.pin_strength,
 				enable_gpio.pin_state);
 
-			gpio_set_dir(enable_gpio.pin_id, 2);
+			gpio_set(enable_gpio.pin_id, 2);
 		}
 
-		if (hw_id == HW_PLATFORM_SURF) {
-			/* configure backlight gpio for CDP */
+		if (hw_id == HW_PLATFORM_SURF || (hw_id == HW_PLATFORM_MTP)) {
+			/* configure backlight gpio for CDP and MTP */
 			gpio_tlmm_config(bkl_gpio.pin_id, 0,
 				bkl_gpio.pin_direction, bkl_gpio.pin_pull,
 				bkl_gpio.pin_strength, bkl_gpio.pin_state);
-			gpio_set_dir(bkl_gpio.pin_id, 2);
+			gpio_set(bkl_gpio.pin_id, 2);
 		}
 
 		gpio_tlmm_config(reset_gpio.pin_id, 0,
 				reset_gpio.pin_direction, reset_gpio.pin_pull,
 				reset_gpio.pin_strength, reset_gpio.pin_state);
 
-		gpio_set_dir(reset_gpio.pin_id, 2);
+		gpio_set(reset_gpio.pin_id, 2);
 
 		/* reset */
 		for (int i = 0; i < RESET_GPIO_SEQ_LEN; i++) {
 			if (resetseq->pin_state[i] == GPIO_STATE_LOW)
-				gpio_set_dir(reset_gpio.pin_id, GPIO_STATE_LOW);
+				gpio_set(reset_gpio.pin_id, GPIO_STATE_LOW);
 			else
-				gpio_set_dir(reset_gpio.pin_id, GPIO_STATE_HIGH);
+				gpio_set(reset_gpio.pin_id, GPIO_STATE_HIGH);
 			mdelay(resetseq->sleep[i]);
 		}
 	} else if(!target_cont_splash_screen()) {
-		gpio_set_dir(reset_gpio.pin_id, 0);
+		gpio_set(reset_gpio.pin_id, 0);
 		if (pinfo->mipi.use_enable_gpio)
-			gpio_set_dir(enable_gpio.pin_id, 0);
+			gpio_set(enable_gpio.pin_id, 0);
 	}
 
 	return ret;
@@ -218,7 +225,7 @@
 
 bool target_display_panel_node(char *panel_name, char *pbuf, uint16_t buf_size)
 {
-	return gcdb_display_cmdline_arg(pbuf, buf_size);
+	return gcdb_display_cmdline_arg(panel_name, pbuf, buf_size);
 }
 
 void target_display_init(const char *panel_name)
diff --git a/target/msm8916/include/target/display.h b/target/msm8916/include/target/display.h
index d904966..5b90130 100755
--- a/target/msm8916/include/target/display.h
+++ b/target/msm8916/include/target/display.h
@@ -93,8 +93,14 @@
   0x00, 0x00, 0xb1, 0xff, 0x00, 0x00
 };
 
-static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+extern uint32_t panel_regulator_settings[7];
+
+static const uint32_t dcdc_regulator_settings[] = {
+  0x03, 0x08, 0x07, 0x00, 0x20, 0x07, 0x01
+};
+
+static const uint32_t ldo_regulator_settings[] = {
+  0x00, 0x01, 0x01, 0x00, 0x20, 0x07, 0x00
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8916/oem_panel.c b/target/msm8916/oem_panel.c
index 82bcdad..a8e919f 100755
--- a/target/msm8916/oem_panel.c
+++ b/target/msm8916/oem_panel.c
@@ -63,6 +63,10 @@
 /*---------------------------------------------------------------------------*/
 static uint32_t auto_pan_loop = 0;
 
+uint32_t panel_regulator_settings[] = {
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
 enum {
 JDI_1080P_VIDEO_PANEL,
 NT35590_720P_VIDEO_PANEL,
@@ -494,9 +498,18 @@
 	}
 
 panel_init:
-	/* Set LDO mode */
-	if (platform_is_msm8939() || (hw_id == HW_PLATFORM_QRD))
+	/*
+	 * Update all data structures after 'panel_init' label. Only panel
+	 * selection is supposed to happen before that.
+	 */
+	if (platform_is_msm8939() || (hw_id == HW_PLATFORM_QRD)) {
 		phy_db->regulator_mode = DSI_PHY_REGULATOR_LDO_MODE;
+		memcpy(panel_regulator_settings,
+				ldo_regulator_settings, REGULATOR_SIZE);
+	} else {
+		memcpy(panel_regulator_settings,
+				dcdc_regulator_settings, REGULATOR_SIZE);
+	}
 
 	pinfo->pipe_type = MDSS_MDP_PIPE_TYPE_RGB;
 	return init_panel_data(panelstruct, pinfo, phy_db);
diff --git a/target/msm8916/target_display.c b/target/msm8916/target_display.c
index b47f1e0..ea69e86 100755
--- a/target/msm8916/target_display.c
+++ b/target/msm8916/target_display.c
@@ -376,10 +376,12 @@
 	uint32_t ret = 0;
 
 	panel_name += strspn(panel_name, " ");
-	if ((!strcmp(panel_name, NO_PANEL_CONFIG))
-			|| (!strcmp(panel_name, SIM_VIDEO_PANEL))) {
+
+	if (!strcmp(panel_name, NO_PANEL_CONFIG)
+		|| !strcmp(panel_name, SIM_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_CMD_PANEL)) {
 		dprintf(INFO, "Selected panel: %s\nSkip panel configuration\n",
-								panel_name);
+			panel_name);
 		return;
 	}
 
diff --git a/target/msm8974/include/target/display.h b/target/msm8974/include/target/display.h
index 420636d..953a1af 100644
--- a/target/msm8974/include/target/display.h
+++ b/target/msm8974/include/target/display.h
@@ -73,7 +73,7 @@
 };
 
 static const uint32_t panel_regulator_settings[] = {
-  0x07, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
+  0x03, 0x09, 0x03, 0x00, 0x20, 0x00, 0x01
 };
 
 static const char panel_lane_config[] = {
diff --git a/target/msm8974/target_display.c b/target/msm8974/target_display.c
index 6e8a9f4..fbfaeb8 100755
--- a/target/msm8974/target_display.c
+++ b/target/msm8974/target_display.c
@@ -399,11 +399,13 @@
 
 	panel_name += strspn(panel_name, " ");
 
-	if ((!strcmp(panel_name, NO_PANEL_CONFIG))
-			|| (!strcmp(panel_name, SIM_VIDEO_PANEL))
-			|| (!strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL))) {
-		dprintf(INFO, "Selected panel: %s\nSkip panel configuration",
-								panel_name);
+	if (!strcmp(panel_name, NO_PANEL_CONFIG)
+		|| !strcmp(panel_name, SIM_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_CMD_PANEL)
+		|| !strcmp(panel_name, SIM_DUALDSI_CMD_PANEL)) {
+		dprintf(INFO, "Selected panel: %s\nSkip panel configuration\n",
+			panel_name);
 		return;
 	} else if (!strcmp(panel_name, HDMI_PANEL_NAME)) {
 		dprintf(INFO, "%s: HDMI is primary\n", __func__);
diff --git a/target/msm8994/init.c b/target/msm8994/init.c
index 2e0b5c2..bb3198e 100644
--- a/target/msm8994/init.c
+++ b/target/msm8994/init.c
@@ -197,7 +197,7 @@
 	if (is_cold_boot &&
 			(!(pon_reason & HARD_RST)) &&
 			(!(pon_reason & KPDPWR_N)) &&
-			((pon_reason & USB_CHG) || (pon_reason & DC_CHG)))
+			((pon_reason & PON1)))
 		return 1;
 	else
 		return 0;
@@ -327,11 +327,7 @@
 	}
 
 	/* Storage initialization is complete, read the partition table info */
-	if (partition_read_table())
-	{
-		dprintf(CRITICAL, "Error reading the partition table info\n");
-		ASSERT(0);
-	}
+	mmc_read_partition_table(0);
 
 	rpm_smd_init();
 
@@ -362,6 +358,7 @@
 			case HW_PLATFORM_SURF:
 			case HW_PLATFORM_MTP:
 			case HW_PLATFORM_FLUID:
+			case HW_PLATFORM_LIQUID:
 				dprintf(SPEW, "Target_cont_splash=1\n");
 				splash_screen = 1;
 				break;
@@ -558,12 +555,6 @@
 	ASSERT(0);
 }
 
-void target_fastboot_init(void)
-{
-	/* We are entering fastboot mode, so read partition table */
-	mmc_read_partition_table(1);
-}
-
 uint32_t target_ddr_cfg_val()
 {
 	return DDR_CFG_DLY_VAL;
diff --git a/target/msm8994/oem_panel.c b/target/msm8994/oem_panel.c
index 2d95439..afbe07b 100644
--- a/target/msm8994/oem_panel.c
+++ b/target/msm8994/oem_panel.c
@@ -43,6 +43,7 @@
 #include "include/panel_sharp_wqxga_dualdsi_video.h"
 #include "include/panel_jdi_qhd_dualdsi_video.h"
 #include "include/panel_jdi_qhd_dualdsi_cmd.h"
+#include "include/panel_jdi_4k_dualdsi_video.h"
 
 /*---------------------------------------------------------------------------*/
 /* static panel selection variable                                           */
@@ -51,6 +52,7 @@
 SHARP_WQXGA_DUALDSI_VIDEO_PANEL,
 JDI_QHD_DUALDSI_VIDEO_PANEL,
 JDI_QHD_DUALDSI_CMD_PANEL,
+JDI_4K_DUALDSI_VIDEO_PANEL,
 UNKNOWN_PANEL
 };
 
@@ -62,6 +64,7 @@
 	{"sharp_wqxga_dualdsi_video", SHARP_WQXGA_DUALDSI_VIDEO_PANEL},
 	{"jdi_qhd_dualdsi_video", JDI_QHD_DUALDSI_VIDEO_PANEL},
 	{"jdi_qhd_dualdsi_cmd", JDI_QHD_DUALDSI_CMD_PANEL},
+	{"jdi_4k_dualdsi_video", JDI_4K_DUALDSI_VIDEO_PANEL},
 };
 
 static uint32_t panel_id;
@@ -169,6 +172,31 @@
 		memcpy(phy_db->timing,
 			jdi_qhd_dualdsi_cmd_timings, TIMING_SIZE);
 		break;
+	case JDI_4K_DUALDSI_VIDEO_PANEL:
+		pan_type = PANEL_TYPE_DSI;
+		pinfo->lcd_reg_en = 1;
+		pinfo->mipi.cmds_post_tg = 1;
+		panelstruct->paneldata    = &jdi_4k_dualdsi_video_panel_data;
+		panelstruct->panelres     = &jdi_4k_dualdsi_video_panel_res;
+		panelstruct->color        = &jdi_4k_dualdsi_video_color;
+		panelstruct->videopanel   = &jdi_4k_dualdsi_video_video_panel;
+		panelstruct->commandpanel = &jdi_4k_dualdsi_video_command_panel;
+		panelstruct->state        = &jdi_4k_dualdsi_video_state;
+		panelstruct->laneconfig   = &jdi_4k_dualdsi_video_lane_config;
+		panelstruct->paneltiminginfo
+			= &jdi_4k_dualdsi_video_timing_info;
+		panelstruct->panelresetseq
+					 = &jdi_4k_dualdsi_video_reset_seq;
+		panelstruct->backlightinfo = &jdi_4k_dualdsi_video_backlight;
+		pinfo->mipi.panel_cmds
+			= jdi_4k_dualdsi_video_on_command;
+		pinfo->mipi.num_of_panel_cmds
+			= JDI_4K_DUALDSI_VIDEO_ON_COMMAND;
+		memcpy(phy_db->timing,
+			jdi_4k_dualdsi_video_timings, TIMING_SIZE);
+		memcpy(&panelstruct->fbcinfo, &jdi_4k_dualdsi_video_fbc,
+				sizeof(struct fb_compression));
+		break;
 	default:
 	case UNKNOWN_PANEL:
 		pan_type = PANEL_TYPE_UNKNOWN;
@@ -207,6 +235,9 @@
 	case HW_PLATFORM_SURF:
 		panel_id = SHARP_WQXGA_DUALDSI_VIDEO_PANEL;
 		break;
+	case HW_PLATFORM_LIQUID:
+		panel_id = JDI_4K_DUALDSI_VIDEO_PANEL;
+		break;
 	default:
 		dprintf(CRITICAL, "Display not enabled for %d HW type\n"
 					, hw_id);
@@ -214,5 +245,7 @@
 	}
 
 panel_init:
+	if (panel_id == JDI_4K_DUALDSI_VIDEO_PANEL)
+		phy_db->regulator_mode = DSI_PHY_REGULATOR_LDO_MODE;
 	return init_panel_data(panelstruct, pinfo, phy_db);
 }
diff --git a/platform/msm_shared/regulator.c b/target/msm8994/regulator.c
similarity index 94%
rename from platform/msm_shared/regulator.c
rename to target/msm8994/regulator.c
index 440049b..8a8d1e1 100644
--- a/platform/msm_shared/regulator.c
+++ b/target/msm8994/regulator.c
@@ -30,12 +30,6 @@
 #include <regulator.h>
 #include <rpm-smd.h>
 
-#define GENERIC_DISABLE 0
-#define GENERIC_ENABLE  1
-#define SW_MODE_LDO_IPEAK 1
-#define LDOA_RES_TYPE 0x616F646C //aodl
-#define SMPS_RES_TYPE 0x61706D73 //apms
-
 static uint32_t ldo2[][11]=
 {
 	{
@@ -116,7 +110,6 @@
 	rpm_send_data(&ldo28[GENERIC_ENABLE][0], 36, RPM_REQUEST_TYPE);
 }
 
-
 void regulator_disable()
 {
 
diff --git a/target/msm8994/rules.mk b/target/msm8994/rules.mk
index 509c91a..ec35e53 100644
--- a/target/msm8994/rules.mk
+++ b/target/msm8994/rules.mk
@@ -39,3 +39,8 @@
     $(LOCAL_DIR)/meminfo.o \
     $(LOCAL_DIR)/target_display.o \
     $(LOCAL_DIR)/oem_panel.o
+
+ifeq ($(ENABLE_SMD_SUPPORT),1)
+OBJS += \
+    $(LOCAL_DIR)/regulator.o
+endif
diff --git a/target/msm8994/target_display.c b/target/msm8994/target_display.c
index 2463515..bb22fa4 100644
--- a/target/msm8994/target_display.c
+++ b/target/msm8994/target_display.c
@@ -89,7 +89,7 @@
          * PLL power up sequence.
          * Add necessary delays recommeded by hardware.
          */
-        writel(0x0D, pll_base + 0x9c); /* MMSS_DSI_PHY_PLL_PLLLOCK_CMP_EN */
+        writel(0x01, pll_base + 0x9c); /* MMSS_DSI_PHY_PLL_PLLLOCK_CMP_EN */
         writel(0x07, pll_base + 0x14); /* MMSS_DSI_PHY_PLL_PLL_CNTRL */
         writel(0x00, pll_base + 0x2c); /* MMSS_DSI_PHY_PLL_PLL_BKG_KVCO_CAL_EN */
         udelay(500);
@@ -375,11 +375,15 @@
 
 void target_display_init(const char *panel_name)
 {
-	if ((!strcmp(panel_name, NO_PANEL_CONFIG))
-			|| (!strcmp(panel_name, SIM_VIDEO_PANEL))
-			|| (!strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL))) {
+	panel_name += strspn(panel_name, " ");
+
+	if (!strcmp(panel_name, NO_PANEL_CONFIG)
+		|| !strcmp(panel_name, SIM_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_DUALDSI_VIDEO_PANEL)
+		|| !strcmp(panel_name, SIM_CMD_PANEL)
+		|| !strcmp(panel_name, SIM_DUALDSI_CMD_PANEL)) {
 		dprintf(INFO, "Selected panel: %s\nSkip panel configuration\n",
-				panel_name);
+			panel_name);
 		return;
 	}
 	if (gcdb_display_init(panel_name, MDP_REV_50, MIPI_FB_ADDR)) {
diff --git a/target/msmzirc/init.c b/target/msmzirc/init.c
index 22e03df..ef2ebf7 100644
--- a/target/msmzirc/init.c
+++ b/target/msmzirc/init.c
@@ -246,7 +246,7 @@
 		}
 		else {
 			/* Below is for emmc boot */
-			system_ptn_index = partition_get_index(part);
+			system_ptn_index = partition_get_index(part) + 1; /* Adding +1 as offsets for eMMC start at 1 and NAND at 0 */
 			if (system_ptn_index < 0) {
 				dprintf(CRITICAL,
 						"WARN: Cannot get partition index for %s\n", part);
diff --git a/target/thulium/init.c b/target/thulium/init.c
new file mode 100644
index 0000000..c1b13bb
--- /dev/null
+++ b/target/thulium/init.c
@@ -0,0 +1,351 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <debug.h>
+#include <platform/iomap.h>
+#include <platform/irqs.h>
+#include <platform/gpio.h>
+#include <reg.h>
+#include <target.h>
+#include <platform.h>
+#include <dload_util.h>
+#include <uart_dm.h>
+#include <mmc.h>
+#include <spmi.h>
+#include <board.h>
+#include <smem.h>
+#include <baseband.h>
+#include <dev/keys.h>
+#include <pm8x41.h>
+#include <crypto5_wrapper.h>
+#include <clock.h>
+#include <partition_parser.h>
+#include <scm.h>
+#include <platform/clock.h>
+#include <platform/gpio.h>
+#include <platform/timer.h>
+#include <stdlib.h>
+#include <ufs.h>
+#include <boot_device.h>
+#include <qmp_phy.h>
+
+#define PMIC_ARB_CHANNEL_NUM    0
+#define PMIC_ARB_OWNER_ID       0
+
+static void set_sdc_power_ctrl(void);
+static uint32_t mmc_pwrctl_base[] =
+	{ MSM_SDC1_BASE, MSM_SDC2_BASE };
+
+static uint32_t mmc_sdhci_base[] =
+	{ MSM_SDC1_SDHCI_BASE, MSM_SDC2_SDHCI_BASE };
+
+static uint32_t  mmc_sdc_pwrctl_irq[] =
+	{ SDCC1_PWRCTL_IRQ, SDCC2_PWRCTL_IRQ };
+
+struct mmc_device *dev;
+struct ufs_dev ufs_device;
+
+extern void ulpi_write(unsigned val, unsigned reg);
+
+void target_early_init(void)
+{
+#if WITH_DEBUG_UART
+	uart_dm_init(2, 0, BLSP1_UART1_BASE);
+#endif
+}
+
+/* Return 1 if vol_up pressed */
+static int target_volume_up()
+{
+	uint8_t status = 0;
+	struct pm8x41_gpio gpio;
+
+	/* Configure the GPIO */
+	gpio.direction = PM_GPIO_DIR_IN;
+	gpio.function  = 0;
+	gpio.pull      = PM_GPIO_PULL_UP_30;
+	gpio.vin_sel   = 2;
+
+	pm8x41_gpio_config(2, &gpio);
+
+	/* Wait for the pmic gpio config to take effect */
+	thread_sleep(1);
+
+	/* Get status of P_GPIO_5 */
+	pm8x41_gpio_get(3, &status);
+
+	return !status; /* active low */
+}
+
+/* Return 1 if vol_down pressed */
+uint32_t target_volume_down()
+{
+	return pm8x41_resin_status();
+}
+
+static void target_keystatus()
+{
+	keys_init();
+
+	if(target_volume_down())
+		keys_post_event(KEY_VOLUMEDOWN, 1);
+
+	if(target_volume_up())
+		keys_post_event(KEY_VOLUMEUP, 1);
+}
+
+void target_uninit(void)
+{
+	if (platform_boot_dev_isemmc())
+	{
+		mmc_put_card_to_sleep(dev);
+		/* Disable HC mode before jumping to kernel */
+		sdhci_mode_disable(&dev->host);
+	}
+}
+
+static void set_sdc_power_ctrl()
+{
+	/* Drive strength configs for sdc pins */
+	struct tlmm_cfgs sdc1_hdrv_cfg[] =
+	{
+		{ SDC1_CLK_HDRV_CTL_OFF,  TLMM_CUR_VAL_16MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CMD_HDRV_CTL_OFF,  TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_DATA_HDRV_CTL_OFF, TLMM_CUR_VAL_10MA, TLMM_HDRV_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	/* Pull configs for sdc pins */
+	struct tlmm_cfgs sdc1_pull_cfg[] =
+	{
+		{ SDC1_CLK_PULL_CTL_OFF,  TLMM_NO_PULL, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_CMD_PULL_CTL_OFF,  TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+		{ SDC1_DATA_PULL_CTL_OFF, TLMM_PULL_UP, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	struct tlmm_cfgs sdc1_rclk_cfg[] =
+	{
+		{ SDC1_RCLK_PULL_CTL_OFF, TLMM_PULL_DOWN, TLMM_PULL_MASK, SDC1_HDRV_PULL_CTL },
+	};
+
+	/* Set the drive strength & pull control values */
+	tlmm_set_hdrive_ctrl(sdc1_hdrv_cfg, ARRAY_SIZE(sdc1_hdrv_cfg));
+	tlmm_set_pull_ctrl(sdc1_pull_cfg, ARRAY_SIZE(sdc1_pull_cfg));
+	tlmm_set_pull_ctrl(sdc1_rclk_cfg, ARRAY_SIZE(sdc1_rclk_cfg));
+}
+
+void target_sdc_init()
+{
+	struct mmc_config_data config = {0};
+
+	/* Set drive strength & pull ctrl values */
+	set_sdc_power_ctrl();
+
+	config.bus_width = DATA_BUS_WIDTH_8BIT;
+	config.max_clk_rate = MMC_CLK_192MHZ;
+
+	/* Try slot 1*/
+	config.slot = 1;
+	config.sdhc_base = mmc_sdhci_base[config.slot - 1];
+	config.pwrctl_base = mmc_pwrctl_base[config.slot - 1];
+	config.pwr_irq     = mmc_sdc_pwrctl_irq[config.slot - 1];
+
+	if (!(dev = mmc_init(&config)))
+	{
+		/* Try slot 2 */
+		config.slot = 2;
+		config.max_clk_rate = MMC_CLK_200MHZ;
+		config.sdhc_base = mmc_sdhci_base[config.slot - 1];
+		config.pwrctl_base = mmc_pwrctl_base[config.slot - 1];
+		config.pwr_irq     = mmc_sdc_pwrctl_irq[config.slot - 1];
+
+		if (!(dev = mmc_init(&config)))
+		{
+			dprintf(CRITICAL, "mmc init failed!");
+			ASSERT(0);
+		}
+	}
+}
+
+void *target_mmc_device()
+{
+	if (platform_boot_dev_isemmc())
+		return (void *) dev;
+	else
+		return (void *) &ufs_device;
+}
+
+void target_init(void)
+{
+	dprintf(INFO, "target_init()\n");
+
+	spmi_init(PMIC_ARB_CHANNEL_NUM, PMIC_ARB_OWNER_ID);
+
+	target_keystatus();
+
+	if (target_use_signed_kernel())
+		target_crypto_init_params();
+
+	platform_read_boot_config();
+
+	if (platform_boot_dev_isemmc())
+	{
+		target_sdc_init();
+	}
+	else
+	{
+		ufs_device.base = UFS_BASE;
+		ufs_init(&ufs_device);
+	}
+
+	/* Storage initialization is complete, read the partition table info */
+	if (partition_read_table())
+	{
+		dprintf(CRITICAL, "Error reading the partition table info\n");
+		ASSERT(0);
+	}
+}
+
+unsigned board_machtype(void)
+{
+	return LINUX_MACHTYPE_UNKNOWN;
+}
+
+/* Detect the target type */
+void target_detect(struct board_data *board)
+{
+	/* This is filled from board.c */
+}
+
+/* Detect the modem type */
+void target_baseband_detect(struct board_data *board)
+{
+	uint32_t platform;
+
+	platform = board->platform;
+
+	switch(platform) {
+	case MSMTHULIUM:
+		board->baseband = BASEBAND_MSM;
+		break;
+	default:
+		dprintf(CRITICAL, "Platform type: %u is not supported\n",platform);
+		ASSERT(0);
+	};
+}
+unsigned target_baseband()
+{
+	return board_baseband();
+}
+
+void target_serialno(unsigned char *buf)
+{
+	unsigned int serialno;
+	if (target_is_emmc_boot()) {
+		serialno = mmc_get_psn();
+		snprintf((char *)buf, 13, "%x", serialno);
+	}
+}
+
+unsigned check_reboot_mode(void)
+{
+	uint32_t restart_reason = 0;
+	uint32_t restart_reason_addr;
+
+	restart_reason_addr = RESTART_REASON_ADDR;
+
+	/* Read reboot reason and scrub it */
+	restart_reason = readl(restart_reason_addr);
+	writel(0x00, restart_reason_addr);
+
+	return restart_reason;
+}
+
+void reboot_device(unsigned reboot_reason)
+{
+	uint8_t reset_type = 0;
+
+	/* Write the reboot reason */
+	writel(reboot_reason, RESTART_REASON_ADDR);
+
+	if(reboot_reason)
+		reset_type = PON_PSHOLD_WARM_RESET;
+	else
+		reset_type = PON_PSHOLD_HARD_RESET;
+
+	pm8x41_reset_configure(reset_type);
+
+	/* Drop PS_HOLD for MSM */
+	writel(0x00, MPM2_MPM_PS_HOLD);
+
+	mdelay(5000);
+
+	dprintf(CRITICAL, "Rebooting failed\n");
+}
+
+int emmc_recovery_init(void)
+{
+	return _emmc_recovery_init();
+}
+
+void target_usb_phy_reset()
+{
+	usb30_qmp_phy_reset();
+	qusb2_phy_reset();
+}
+
+target_usb_iface_t* target_usb30_init()
+{
+	target_usb_iface_t *t_usb_iface;
+
+	t_usb_iface = calloc(1, sizeof(target_usb_iface_t));
+	ASSERT(t_usb_iface);
+
+	t_usb_iface->phy_init   = usb30_qmp_phy_init;
+	t_usb_iface->phy_reset  = target_usb_phy_reset;
+	t_usb_iface->clock_init = clock_usb30_init;
+	t_usb_iface->vbus_override = 1;
+
+	return t_usb_iface;
+}
+
+/* identify the usb controller to be used for the target */
+const char * target_usb_controller()
+{
+	return "dwc";
+}
+
+uint32_t target_override_pll()
+{
+	return 1;
+}
+
+void target_fastboot_init(void)
+{
+	/* We are entering fastboot mode, so read partition table */
+	mmc_read_partition_table(1);
+}
diff --git a/target/thulium/meminfo.c b/target/thulium/meminfo.c
new file mode 100644
index 0000000..9aa1dd5
--- /dev/null
+++ b/target/thulium/meminfo.c
@@ -0,0 +1,88 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <reg.h>
+#include <debug.h>
+#include <malloc.h>
+#include <smem.h>
+#include <stdint.h>
+#include <libfdt.h>
+#include <platform/iomap.h>
+#include <dev_tree.h>
+
+uint32_t target_dev_tree_mem(void *fdt, uint32_t memory_node_offset)
+{
+	ram_partition ptn_entry;
+	unsigned int index;
+	int ret = 0;
+	uint32_t len = 0;
+
+	/* Make sure RAM partition table is initialized */
+	ASSERT(smem_ram_ptable_init_v1());
+
+	len = smem_get_ram_ptable_len();
+
+	/* Calculating the size of the mem_info_ptr */
+	for (index = 0 ; index < len; index++)
+	{
+		smem_get_ram_ptable_entry(&ptn_entry, index);
+
+		if((ptn_entry.category == SDRAM) &&
+			(ptn_entry.type == SYS_MEMORY))
+		{
+
+			/* Pass along all other usable memory regions to Linux */
+			ret = dev_tree_add_mem_info(fdt,
+							memory_node_offset,
+							ptn_entry.start,
+							ptn_entry.size);
+
+			if (ret)
+			{
+				dprintf(CRITICAL, "Failed to add secondary banks memory addresses\n"
+);
+				goto target_dev_tree_mem_err;
+			}
+
+		}
+	}
+
+target_dev_tree_mem_err:
+
+	return ret;
+}
+
+void *target_get_scratch_address(void)
+{
+	return ((void *)SCRATCH_ADDR);
+}
+
+unsigned target_get_max_flash_size(void)
+{
+	return (512 * 1024 * 1024);
+}
diff --git a/target/thulium/rules.mk b/target/thulium/rules.mk
new file mode 100644
index 0000000..5ec0e88
--- /dev/null
+++ b/target/thulium/rules.mk
@@ -0,0 +1,41 @@
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+INCLUDES += -I$(LOCAL_DIR)/include -I$(LK_TOP_DIR)/platform/msm_shared
+
+PLATFORM := thulium
+
+MEMBASE := 0x8F000000 # SDRAM
+MEMSIZE := 0x00100000 # 1MB
+
+BASE_ADDR    := 0x0000000
+
+SCRATCH_ADDR := 0x8F100000
+SCRATCH_SIZE := 512
+KERNEL_ADDR  := 0x80000000
+KERNEL_SIZE  := 62
+
+DEFINES += DISPLAY_SPLASH_SCREEN=0
+DEFINES += DISPLAY_TYPE_MIPI=1
+DEFINES += DISPLAY_TYPE_DSI6G=1
+
+MODULES += \
+	dev/keys \
+	dev/pmic/pm8x41 \
+	lib/ptable \
+	lib/libfdt
+
+DEFINES += \
+	MEMSIZE=$(MEMSIZE) \
+	MEMBASE=$(MEMBASE) \
+	BASE_ADDR=$(BASE_ADDR) \
+	TAGS_ADDR=$(TAGS_ADDR) \
+	KERNEL_ADDR=$(KERNEL_ADDR) \
+	KERNEL_SIZE=$(KERNEL_SIZE) \
+	RAMDISK_ADDR=$(RAMDISK_ADDR) \
+	SCRATCH_ADDR=$(SCRATCH_ADDR) \
+	SCRATCH_SIZE=$(SCRATCH_SIZE)
+
+
+OBJS += \
+	$(LOCAL_DIR)/init.o \
+	$(LOCAL_DIR)/meminfo.o \
diff --git a/target/thulium/tools/makefile b/target/thulium/tools/makefile
new file mode 100644
index 0000000..8297318
--- /dev/null
+++ b/target/thulium/tools/makefile
@@ -0,0 +1,13 @@
+#Makefile to generate appsboot.mbn
+
+ifeq ($(BOOTLOADER_OUT),.)
+APPSBOOTOUT_DIR  := $(BUILDDIR)
+else
+APPSBOOTOUT_DIR := $(BOOTLOADER_OUT)/../..
+endif
+
+ABOOTMBN := emmc_appsboot.mbn
+APPSBOOTHEADER: $(ABOOTMBN)
+
+$(ABOOTMBN): $(OUTELF_STRIP)
+	$(hide) cp -f $(OUTELF_STRIP) $(APPSBOOTOUT_DIR)/$(ABOOTMBN)