diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 8ef8857..c35147b 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -2666,6 +2666,26 @@
 		return;
 	}
 
+	/* If device is locked:
+	 * Forbid to flash image to avoid the device to bypass the image
+	 * which with "any" name other than bootloader. Because it maybe
+	 * a meta package of all partitions.
+	 */
+#if VERIFIED_BOOT
+	if (target_build_variant_user()) {
+		if (!device.is_unlocked) {
+			fastboot_fail("Device is locked, meta image flashing is not allowed");
+			return;
+		}
+#if !VBOOT_MOTA
+		if(!device.is_unlock_critical) {
+			fastboot_fail("Device is critical locked, Meta image flashing is not allowed");
+			return;
+		}
+#endif
+	}
+#endif
+
 	meta_header = (meta_header_t*) data;
 	if( data_end < ((uintptr_t)data + meta_header->img_hdr_sz))
 	{
diff --git a/platform/msm8953/platform.c b/platform/msm8953/platform.c
index cd39620..2e275b8 100644
--- a/platform/msm8953/platform.c
+++ b/platform/msm8953/platform.c
@@ -154,6 +154,11 @@
 	return phys_addr;
 }
 
+uint32_t platform_get_max_periph()
+{
+        return 256;
+}
+
 /* DYNAMIC SMEM REGION feature enables LK to dynamically
  * read the SMEM addr info from TCSR_TZ_WONCE register.
  * The first word read, if indicates a MAGIC number, then
diff --git a/platform/msm_shared/display_menu.c b/platform/msm_shared/display_menu.c
index c955e1b..fb4e0a8 100644
--- a/platform/msm_shared/display_menu.c
+++ b/platform/msm_shared/display_menu.c
@@ -94,7 +94,8 @@
 		[0] = "START\n",
 		[1] = "Restart bootloader\n",
 		[2] = "Recovery mode\n",
-		[3] = "Power off\n"};
+		[3] = "Power off\n",
+		[4] = "Boot to FFBM\n"};
 
 static int big_factor = 2;
 static int common_factor = 1;
@@ -362,6 +363,7 @@
 			msg_type = FBCON_RED_MSG;
 			break;
 		case 3:
+		case 4:
 			msg_type = FBCON_COMMON_MSG;
 			break;
 	}
diff --git a/platform/msm_shared/include/menu_keys_detect.h b/platform/msm_shared/include/menu_keys_detect.h
index 2d51aa1..4f904c4 100644
--- a/platform/msm_shared/include/menu_keys_detect.h
+++ b/platform/msm_shared/include/menu_keys_detect.h
@@ -37,6 +37,7 @@
 	BACK,
 
 	CONTINUE,
+	FFBM,
 };
 
 enum keys_option {
diff --git a/platform/msm_shared/menu_keys_detect.c b/platform/msm_shared/menu_keys_detect.c
index d3bc107..7430329 100644
--- a/platform/msm_shared/menu_keys_detect.c
+++ b/platform/msm_shared/menu_keys_detect.c
@@ -88,6 +88,7 @@
 		[1] = FASTBOOT,
 		[2] = RECOVER,
 		[3] = POWEROFF,
+		[4] = FFBM,
 };
 
 static uint32_t unlock_index_action[] = {
@@ -111,6 +112,7 @@
 
 static void update_device_status(struct select_msg_info* msg_info, int reason)
 {
+	char ffbm_page_buffer[FFBM_MODE_BUF_SIZE];
 	fbcon_clear();
 	switch (reason) {
 		case RECOVER:
@@ -150,6 +152,12 @@
 			before_time = current_time();
 
 			break;
+		case FFBM:
+			snprintf(ffbm_page_buffer, sizeof(ffbm_page_buffer), "ffbm-00");
+			write_misc(0, ffbm_page_buffer, sizeof(ffbm_page_buffer));
+
+			reboot_device(0);
+			break;
 	}
 }
 
diff --git a/platform/msm_shared/sdhci.c b/platform/msm_shared/sdhci.c
index 8744751..c0f307e 100644
--- a/platform/msm_shared/sdhci.c
+++ b/platform/msm_shared/sdhci.c
@@ -766,7 +766,7 @@
 	 * may not be aligned to cache boundary due to
 	 * certain image formats like sparse image.
 	 */
-	if (cmd->trans_mode == SDHCI_MMC_READ)
+	if (cmd->trans_mode == SDHCI_READ_MODE)
 		ASSERT(IS_CACHE_LINE_ALIGNED(cmd->data.data_ptr));
 
 	do {