Merge "app: aboot: Read boot image header only once from mmc into RAM"
diff --git a/AndroidBoot.mk b/AndroidBoot.mk
index dbe8a92..104f4de 100644
--- a/AndroidBoot.mk
+++ b/AndroidBoot.mk
@@ -7,8 +7,12 @@
 CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/arm-eabi-$(2ND_TARGET_GCC_VERSION)/bin/arm-eabi-
 endif
 else # BOOTLOADER_GCC_VERSION defined
+ifeq ($(BOOTLOADER_GCC_VERSION),arm-linux-androideabi-4.9)
+CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/$(BOOTLOADER_GCC_VERSION)/bin/arm-linux-androideabi-
+else
 CROSS_COMPILE := ../../../prebuilts/gcc/linux-x86/arm/$(BOOTLOADER_GCC_VERSION)/bin/arm-eabi-
 endif
+endif
 
 # Set flags if we need to include security libs
 ifeq ($(TARGET_BOOTIMG_SIGNED),true)
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 50a2e29..396099f 100755
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -2,7 +2,7 @@
  * Copyright (c) 2009, Google Inc.
  * All rights reserved.
  *
- * Copyright (c) 2009-2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2009-2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -105,8 +105,11 @@
 void write_device_info_flash(device_info *dev);
 static int aboot_save_boot_hash_mmc(uint32_t image_addr, uint32_t image_size);
 static int aboot_frp_unlock(char *pname, void *data, unsigned sz);
+static inline uint64_t validate_partition_size();
 bool pwr_key_is_pressed = false;
 
+static bool is_systemd_present=false;
+
 /* fastboot command function pointer */
 typedef void (*fastboot_cmd_fn) (const char *, void *, unsigned);
 
@@ -159,6 +162,8 @@
 #endif
 static const char *usb_sn_cmdline = " androidboot.serialno=";
 static const char *androidboot_mode = " androidboot.mode=";
+
+static const char *systemd_ffbm_mode = " systemd.unit=ffbm.target";
 static const char *alarmboot_cmdline = " androidboot.alarmboot=true";
 static const char *loglevel         = " quiet";
 static const char *battchg_pause = " androidboot.mode=charger";
@@ -338,6 +343,11 @@
 	int have_target_boot_params = 0;
 	char *boot_dev_buf = NULL;
     bool is_mdtp_activated = 0;
+
+#if USE_LE_SYSTEMD
+	is_systemd_present=true;
+#endif
+
 #if VERIFIED_BOOT
 #if !VBOOT_MOTA
     uint32_t boot_state = boot_verify_get_state();
@@ -386,6 +396,10 @@
 
 	if (boot_into_ffbm) {
 		cmdline_len += strlen(androidboot_mode);
+
+		if(is_systemd_present)
+			cmdline_len += strlen(systemd_ffbm_mode);
+
 		cmdline_len += strlen(ffbm_mode_string);
 		/* reduce kernel console messages to speed-up boot */
 		cmdline_len += strlen(loglevel);
@@ -564,6 +578,13 @@
 			src = ffbm_mode_string;
 			if (have_cmdline) --dst;
 			while ((*dst++ = *src++));
+
+			if(is_systemd_present) {
+				src = systemd_ffbm_mode;
+				if (have_cmdline) --dst;
+				while ((*dst++ = *src++));
+			}
+
 			src = loglevel;
 			if (have_cmdline) --dst;
 			while ((*dst++ = *src++));
@@ -2246,7 +2267,7 @@
 
 	/* wipe data */
 	struct recovery_message msg;
-
+	memset(&msg, 0, sizeof(msg));
 	snprintf(msg.recovery, sizeof(msg.recovery), "recovery\n--wipe_data");
 	write_misc(0, &msg, sizeof(msg));
 
@@ -2372,6 +2393,7 @@
 	uint32_t image_actual;
 	uint32_t dt_actual = 0;
 	uint32_t sig_actual = 0;
+	uint32_t sig_size = 0;
 	struct boot_img_hdr *hdr = NULL;
 	struct kernel64_hdr *kptr = NULL;
 	char *ptr = ((char*) data);
@@ -2426,17 +2448,23 @@
 	image_actual = ADD_OF(image_actual, ramdisk_actual);
 	image_actual = ADD_OF(image_actual, dt_actual);
 
+	/* Checking to prevent oob access in read_der_message_length */
+	if (image_actual > sz) {
+		fastboot_fail("bootimage header fields are invalid");
+		goto boot_failed;
+	}
+	sig_size = sz - image_actual;
+
 	if (target_use_signed_kernel() && (!device.is_unlocked)) {
 		/* Calculate the signature length from boot image */
 		sig_actual = read_der_message_length(
-				(unsigned char*)(data + image_actual),sz);
+				(unsigned char*)(data + image_actual), sig_size);
 		image_actual = ADD_OF(image_actual, sig_actual);
-	}
 
-	/* sz should have atleast raw boot image */
-	if (image_actual > sz) {
-		fastboot_fail("bootimage: incomplete or not signed");
-		goto boot_failed;
+		if (image_actual > sz) {
+			fastboot_fail("bootimage header fields are invalid");
+			goto boot_failed;
+		}
 	}
 
 	// Initialize boot state before trying to verify boot.img
@@ -2721,14 +2749,6 @@
 		cmd_erase_nand(arg, data, sz);
 }
 
-static uint32_t aboot_get_secret_key()
-{
-	/* 0 is invalid secret key, update this implementation to return
-	 * device specific unique secret key
-	 */
-	return 0;
-}
-
 void cmd_flash_mmc_img(const char *arg, void *data, unsigned sz)
 {
 	unsigned long long ptn = 0;
@@ -2883,7 +2903,14 @@
 			(img_header_entry[i].start_offset == 0) ||
 			(img_header_entry[i].size == 0))
 			break;
-
+		if ((UINT_MAX - img_header_entry[i].start_offset) < (uintptr_t)data) {
+			fastboot_fail("Integer overflow detected in start_offset of img");
+			break;
+		}
+		else if ((UINT_MAX - (img_header_entry[i].start_offset + (uintptr_t)data)) < img_header_entry[i].size) {
+			fastboot_fail("Integer overflow detected in size of img");
+			break;
+		}
 		if( data_end < ((uintptr_t)data + img_header_entry[i].start_offset
 						+ img_header_entry[i].size) )
 		{
@@ -3315,6 +3342,13 @@
 	struct ptable *ptable;
 	unsigned extra = 0;
 	uint64_t partition_size = 0;
+	unsigned bytes_to_round_page = 0;
+	unsigned rounded_size = 0;
+
+	if((uintptr_t)data > (UINT_MAX - sz)) {
+		fastboot_fail("Cannot flash: image header corrupt");
+                return;
+        }
 
 	ptable = flash_get_ptable();
 	if (ptable == NULL) {
@@ -3331,8 +3365,10 @@
 	}
 
 	if (!strcmp(ptn->name, "boot") || !strcmp(ptn->name, "recovery")) {
-		if (memcmp((void *)data, BOOT_MAGIC, BOOT_MAGIC_SIZE)) {
-			fastboot_fail("image is not a boot image");
+		if((sz > BOOT_MAGIC_SIZE) && (!memcmp((void *)data, BOOT_MAGIC, BOOT_MAGIC_SIZE))) {
+			dprintf(INFO, "Verified the BOOT_MAGIC in image header  \n");
+		} else {
+			fastboot_fail("Image is not a boot image");
 			return;
 		}
 	}
@@ -3343,22 +3379,36 @@
 		|| !strcmp(ptn->name, "recoveryfs")
 		|| !strcmp(ptn->name, "modem"))
 		extra = 1;
-	else
-		sz = ROUND_TO_PAGE(sz, page_mask);
-
-	partition_size = (uint64_t)ptn->length * (uint64_t)flash_num_pages_per_blk() *  (uint64_t)flash_page_size();
-	if (partition_size > UINT_MAX) {
-		fastboot_fail("Invalid partition size");
-		return;
+	else {
+		rounded_size = ROUNDUP(sz, page_size);
+		bytes_to_round_page = rounded_size - sz;
+		if (bytes_to_round_page) {
+			if (((uintptr_t)data + sz ) > (UINT_MAX - bytes_to_round_page)) {
+				fastboot_fail("Integer overflow detected");
+				return;
+			}
+			if (((uintptr_t)data + sz + bytes_to_round_page) >
+				((uintptr_t)target_get_scratch_address() + target_get_max_flash_size())) {
+				fastboot_fail("Buffer size is not aligned to page_size");
+				return;
+			}
+			else {
+				memset(data + sz, 0, bytes_to_round_page);
+				sz = rounded_size;
+			}
+		}
 	}
 
+	/*Checking partition_size for the possible integer overflow */
+	partition_size = validate_partition_size(ptn);
+
 	if (sz > partition_size) {
 		fastboot_fail("Image size too large");
 		return;
 	}
 
 	dprintf(INFO, "writing %d bytes to '%s'\n", sz, ptn->name);
-	if (!memcmp((void *)data, UBI_MAGIC, UBI_MAGIC_SIZE)) {
+	if ((sz > UBI_MAGIC_SIZE) && (!memcmp((void *)data, UBI_MAGIC, UBI_MAGIC_SIZE))) {
 		if (flash_ubi_img(ptn, data, sz)) {
 			fastboot_fail("flash write failure");
 			return;
@@ -3373,6 +3423,18 @@
 	fastboot_okay("");
 }
 
+
+static inline uint64_t validate_partition_size(struct ptentry *ptn)
+{
+	if (ptn->length && flash_num_pages_per_blk() && page_size) {
+		if ((ptn->length < ( UINT_MAX / flash_num_pages_per_blk())) && ((ptn->length * flash_num_pages_per_blk()) < ( UINT_MAX / page_size))) {
+			return ptn->length * flash_num_pages_per_blk() * page_size;
+		}
+        }
+	return 0;
+}
+
+
 void cmd_flash(const char *arg, void *data, unsigned sz)
 {
 	if(target_is_emmc_boot())
@@ -3484,7 +3546,7 @@
 
 		/* wipe data */
 		struct recovery_message msg;
-
+	        memset(&msg, 0, sizeof(msg));
 		snprintf(msg.recovery, sizeof(msg.recovery), "recovery\n--wipe_data");
 		write_misc(0, &msg, sizeof(msg));
 
@@ -3496,20 +3558,24 @@
 
 static int aboot_frp_unlock(char *pname, void *data, unsigned sz)
 {
-	int ret = 1;
-	uint32_t secret_key;
-	char seckey_buffer[MAX_RSP_SIZE];
+	int ret=1;
+	bool authentication_success=false;
 
-	secret_key = aboot_get_secret_key();
-	if (secret_key)
+	/*
+		Authentication method not  implemented.
+
+		OEM to implement, authentication system which on successful validataion,
+		calls write_allow_oem_unlock() with is_allow_unlock.
+	*/
+#if 0
+	authentication_success = oem_specific_auth_mthd();
+#endif
+
+	if (authentication_success)
 	{
-		snprintf((char *) seckey_buffer, MAX_RSP_SIZE, "%x", secret_key);
-		if (!memcmp((void *)data, (void *)seckey_buffer, sz))
-		{
-			is_allow_unlock = true;
-			write_allow_oem_unlock(is_allow_unlock);
-			ret = 0;
-		}
+		is_allow_unlock = true;
+		write_allow_oem_unlock(is_allow_unlock);
+		ret = 0;
 	}
 	return ret;
 }
diff --git a/app/aboot/recovery.c b/app/aboot/recovery.c
index 8aa4a8c..71006bd 100644
--- a/app/aboot/recovery.c
+++ b/app/aboot/recovery.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -130,82 +130,6 @@
 	return 0;
 }
 
-int read_update_header_for_bootloader(struct update_header *header)
-{
-	struct ptentry *ptn;
-	struct ptable *ptable;
-	unsigned offset = 0;
-	unsigned pagesize = flash_page_size();
-
-	ptable = flash_get_ptable();
-	if (ptable == NULL) {
-		dprintf(CRITICAL, "ERROR: Partition table not found\n");
-		return -1;
-	}
-	ptn = ptable_find(ptable, "cache");
-
-	if (ptn == NULL) {
-		dprintf(CRITICAL, "ERROR: No cache partition found\n");
-		return -1;
-	}
-	if (flash_read(ptn, offset, buf, pagesize)) {
-		dprintf(CRITICAL, "ERROR: Cannot read recovery_header\n");
-		return -1;
-	}
-	memcpy(header, buf, sizeof(*header));
-
-	if (strncmp((char *) header->MAGIC, UPDATE_MAGIC, UPDATE_MAGIC_SIZE))
-	{
-		return -1;
-	}
-	return 0;
-}
-
-int update_firmware_image (struct update_header *header, char *name)
-{
-	struct ptentry *ptn;
-	struct ptable *ptable;
-	unsigned offset = 0;
-	unsigned pagesize = flash_page_size();
-	unsigned pagemask = pagesize -1;
-	unsigned n = 0;
-	void *scratch_addr = target_get_scratch_address();
-
-	ptable = flash_get_ptable();
-	if (ptable == NULL) {
-		dprintf(CRITICAL, "ERROR: Partition table not found\n");
-		return -1;
-	}
-
-	ptn = ptable_find(ptable, "cache");
-	if (ptn == NULL) {
-		dprintf(CRITICAL, "ERROR: No cache partition found\n");
-		return -1;
-	}
-
-	offset += header->image_offset;
-	n = (header->image_length + pagemask) & (~pagemask);
-
-	if (flash_read(ptn, offset, scratch_addr, n)) {
-		dprintf(CRITICAL, "ERROR: Cannot read radio image\n");
-		return -1;
-	}
-
-	ptn = ptable_find(ptable, name);
-	if (ptn == NULL) {
-		dprintf(CRITICAL, "ERROR: No %s partition found\n", name);
-		return -1;
-	}
-
-	if (flash_write(ptn, 0, scratch_addr, n)) {
-		dprintf(CRITICAL, "ERROR: flash write fail!\n");
-		return -1;
-	}
-
-	dprintf(INFO, "Partition writen successfully!");
-	return 0;
-}
-
 static int set_ssd_radio_update (char *name)
 {
 	struct ptentry *ptn;
@@ -353,17 +277,6 @@
 		return 0; // Boot in normal mode
 	}
 
-#ifdef OLD_FOTA_UPGRADE
-	if (read_update_header_for_bootloader(&header)) {
-		strlcpy(msg.status, "invalid-update", sizeof(msg.status));
-		goto SEND_RECOVERY_MSG;
-	}
-
-	if (update_firmware_image (&header, partition_name)) {
-		strlcpy(msg.status, "failed-update", sizeof(msg.status));
-		goto SEND_RECOVERY_MSG;
-	}
-#else
 	if (set_ssd_radio_update(partition_name)) {
 		/* If writing to FOTA partition fails */
 		strlcpy(msg.command, "", sizeof(msg.command));
@@ -376,7 +289,6 @@
 		strlcpy(msg.status, "RADIO", sizeof(msg.status));
 		goto SEND_RECOVERY_MSG;
 	}
-#endif
 	strlcpy(msg.status, "OKAY", sizeof(msg.status));
 
 SEND_RECOVERY_MSG:
diff --git a/app/aboot/recovery.h b/app/aboot/recovery.h
index 204312b..177148a 100644
--- a/app/aboot/recovery.h
+++ b/app/aboot/recovery.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -79,9 +79,6 @@
 int get_recovery_message(struct recovery_message *out);
 int set_recovery_message(const struct recovery_message *in);
 
-int read_update_header_for_bootloader(struct update_header *header);
-int update_firmware_image (struct update_header *header, char *name);
-
 int recovery_init (void);
 /* This function will look for the ffbm cookie in the misc partition.
  * Upon finding a valid cookie it will return 1 and place the cookie
diff --git a/dev/gcdb/display/gcdb_display.c b/dev/gcdb/display/gcdb_display.c
index b144433..945839c 100644
--- a/dev/gcdb/display/gcdb_display.c
+++ b/dev/gcdb/display/gcdb_display.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -240,9 +240,13 @@
 	dprintf(SPEW, "enable=%d cnt=%d\n", dfps->panel_dfps.enabled,
 		dfps->panel_dfps.frame_rate_cnt);
 
-	if (!dfps->panel_dfps.enabled || (dfps->panel_dfps.frame_rate_cnt >
-		DFPS_MAX_FRAME_RATE) || (dfps->dfps_fb_base !=
-		pinfo->dfps.dfps_fb_base)) {
+	dprintf(CRITICAL, "chip serial splash =%d\n", dfps->chip_serial);
+	dprintf(CRITICAL, "chip serial pinfo =%d\n", pinfo->dfps.chip_serial);
+
+	if (!dfps->panel_dfps.enabled ||
+		(dfps->panel_dfps.frame_rate_cnt > DFPS_MAX_FRAME_RATE) ||
+		(dfps->dfps_fb_base != pinfo->dfps.dfps_fb_base) ||
+		(pinfo->dfps.chip_serial != dfps->chip_serial)) {
 		ret = ERROR;
 		free(dfps);
 		goto splash_err;
@@ -295,11 +299,14 @@
 	if (!pinfo->dfps.panel_dfps.enabled)
 		goto dfps_done;
 
+	pinfo->dfps.chip_serial = board_chip_serial();
+
 	if (!mdss_dsi_dfps_get_stored_pll_codes(pinfo)) {
-		dprintf(SPEW, "Found stored PLL codes!\n");
+		dprintf(CRITICAL, "Found stored PLL codes!\n");
 		goto dfps_cal_done;
 	}
 
+	dprintf(CRITICAL, "Calculate PLL codes!\n");
 	ret = mdss_dsi_dfps_get_pll_codes_cal(pinfo);
 	if (ret) {
 		dprintf(CRITICAL, "Cannot cal pll codes!\n");
diff --git a/dev/gcdb/display/include/panel_auo_400p_cmd.h b/dev/gcdb/display/include/panel_auo_400p_cmd.h
new file mode 100644
index 0000000..f772f2d
--- /dev/null
+++ b/dev/gcdb/display/include/panel_auo_400p_cmd.h
@@ -0,0 +1,183 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials provided
+ *    with the distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _PANEL_AUO_400P_CMD_H_
+#define _PANEL_AUO_400P_CMD_H_
+/*---------------------------------------------------------------------------*/
+/* HEADER files                                                              */
+/*---------------------------------------------------------------------------*/
+#include "panel.h"
+
+/*---------------------------------------------------------------------------*/
+/* Panel configuration                                                       */
+/*---------------------------------------------------------------------------*/
+static struct panel_config auo_400p_cmd_panel_data = {
+	"qcom,mdss_dsi_auo_400p_cmd", "dsi:0:", "qcom,mdss-dsi-panel",
+	10, 1, "DISPLAY_1", 0, 0, 60, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ""
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel resolution                                                          */
+/*---------------------------------------------------------------------------*/
+static struct panel_resolution auo_400p_cmd_panel_res = {
+	400, 400, 4, 4, 4, 0, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel color information                                                   */
+/*---------------------------------------------------------------------------*/
+static struct color_info auo_400p_cmd_color = {
+	24, 0, 0xff, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel on/off command information                                          */
+/*---------------------------------------------------------------------------*/
+static char auo_400p_cmd_on_cmd0[] = {
+	0xFE, 0x05, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd1[] = {
+	0x05, 0x00, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd2[] = {
+	0xFE, 0x07, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd3[] = {
+	0x07, 0x6D, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd4[] = {
+	0xFE, 0x0A, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd5[] = {
+	0x1C, 0x1B, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd6[] = {
+	0xFE, 0x00, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd7[] = {
+	0x35, 0x00, 0x15, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd8[] = {
+	0x11, 0x00, 0x05, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd9[] = {
+	0x00, 0x00, 0x32, 0x80,
+};
+
+static char auo_400p_cmd_on_cmd10[] = {
+	0x29, 0x00, 0x05, 0x80,
+};
+
+static struct mipi_dsi_cmd auo_400p_cmd_on_command[] = {
+	{0x4, auo_400p_cmd_on_cmd0, 0x00},
+	{0x4, auo_400p_cmd_on_cmd1, 0x00},
+	{0x4, auo_400p_cmd_on_cmd2, 0x00},
+	{0x4, auo_400p_cmd_on_cmd3, 0x10},
+	{0x4, auo_400p_cmd_on_cmd4, 0x00},
+	{0x4, auo_400p_cmd_on_cmd5, 0x00},
+	{0x4, auo_400p_cmd_on_cmd6, 0x00},
+	{0x4, auo_400p_cmd_on_cmd7, 0x00},
+	{0x4, auo_400p_cmd_on_cmd8, 0x00},
+	{0x4, auo_400p_cmd_on_cmd9, 0xFF},
+	{0x4, auo_400p_cmd_on_cmd10, 0x00},
+};
+
+#define auo_400P_CMD_ON_COMMAND 11
+
+static char auo_400p_cmdoff_cmd0[] = {
+	0x28, 0x00, 0x05, 0x80
+};
+
+static char auo_400p_cmdoff_cmd1[] = {
+	0x10, 0x00, 0x05, 0x80
+};
+
+static struct mipi_dsi_cmd auo_400p_cmd_off_command[] = {
+	{0x4, auo_400p_cmdoff_cmd0, 0x32},
+	{0x4, auo_400p_cmdoff_cmd1, 0x78}
+};
+
+#define auo_400P_CMD_OFF_COMMAND 2
+
+static struct command_state auo_400p_cmd_state = {
+	0, 1
+};
+
+/*---------------------------------------------------------------------------*/
+/* Command mode panel information                                            */
+/*---------------------------------------------------------------------------*/
+static struct commandpanel_info auo_400p_cmd_command_panel = {
+	1, 1, 1, 0, 0, 0x2c, 0, 0, 0, 1, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Video mode panel information                                              */
+/*---------------------------------------------------------------------------*/
+static struct videopanel_info auo_400p_cmd_video_panel = {
+	1, 0, 0, 0, 1, 1, 2, 0, 0x9
+};
+
+/*---------------------------------------------------------------------------*/
+/* Lane configuration                                                        */
+/*---------------------------------------------------------------------------*/
+static struct lane_configuration auo_400p_cmd_lane_config = {
+	1, 0, 1, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel timing                                                              */
+/*---------------------------------------------------------------------------*/
+static const uint32_t auo_400p_cmd_timings[] = {
+	0x5F, 0x12, 0x0A, 0x00, 0x32, 0x34, 0x10, 0x16, 0x0F, 0x03, 0x04, 0x00
+};
+
+static struct panel_timing auo_400p_cmd_timing_info = {
+	0, 4, 0x05, 0x15
+};
+
+static struct panel_reset_sequence auo_400p_cmd_panel_reset_seq = {
+	{ 1, 0, 1, }, { 20, 20, 20, }, 2
+};
+
+/*---------------------------------------------------------------------------*/
+/* Backlight setting                                                         */
+/*---------------------------------------------------------------------------*/
+static struct backlight auo_400p_cmd_backlight = {
+	2, 1, 255, 100, 1, "PMIC_8941"
+};
+
+#endif /*_PANEL_AUO_400P_CMD_H_*/
diff --git a/dev/gcdb/display/include/panel_auo_cx_qvga_cmd.h b/dev/gcdb/display/include/panel_auo_cx_qvga_cmd.h
new file mode 100644
index 0000000..b0ac9c3
--- /dev/null
+++ b/dev/gcdb/display/include/panel_auo_cx_qvga_cmd.h
@@ -0,0 +1,391 @@
+/* Copyright (c) 2015, 2017, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name of The Linux Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef _PANEL_AUO_CX_QVGA_CMD_H_
+#define _PANEL_AUO_CX_QVGA_CMD_H_
+/*---------------------------------------------------------------------------*/
+/* HEADER files                                                              */
+/*---------------------------------------------------------------------------*/
+#include "panel.h"
+
+/*---------------------------------------------------------------------------*/
+/* Panel configuration                                                       */
+/*---------------------------------------------------------------------------*/
+static struct panel_config auo_cx_qvga_cmd_panel_data = {
+	"qcom,mdss_dsi_auo_cx_qvga_cmd", "dsi:0:", "qcom,mdss-dsi-panel",
+	10, 1, "DISPLAY_1", 0, 0, 60, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ""
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel resolution                                                          */
+/*---------------------------------------------------------------------------*/
+static struct panel_resolution auo_cx_qvga_cmd_panel_res = {
+	320, 320, 4, 4, 4, 0, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel color information                                                   */
+/*---------------------------------------------------------------------------*/
+static struct color_info auo_cx_qvga_cmd_color = {
+	24, 0, 0xff, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel on/off command information                                          */
+/*---------------------------------------------------------------------------*/
+static char auo_cx_qvga_cmd_on_cmd0[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xF0, 0x55, 0xAA, 0x52,
+	0x08, 0x00, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd1[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xBD, 0x03, 0x20, 0x14,
+	0x4B, 0x00, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd2[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xBE, 0x03, 0x20, 0x14,
+	0x4B, 0x01, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd3[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xBF, 0x03, 0x20, 0x14,
+	0x4B, 0x00, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd4[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xBB, 0x07, 0x07, 0x07,
+};
+
+static char auo_cx_qvga_cmd_on_cmd5[] = {
+	0x02, 0x00, 0x39, 0xC0,
+	0xC7, 0x40, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd6[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xF0, 0x55, 0xAA, 0x52,
+	0x08, 0x02, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd7[] = {
+	0xEB, 0x02, 0x15, 0x80,
+};
+
+static char auo_cx_qvga_cmd_on_cmd8[] = {
+	0x03, 0x00, 0x39, 0xC0,
+	0xFE, 0x08, 0x50, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd9[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xC3, 0xF2, 0x95, 0x04,
+};
+
+static char auo_cx_qvga_cmd_on_cmd10[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xE9, 0x00, 0x36, 0x38,
+};
+
+static char auo_cx_qvga_cmd_on_cmd11[] = {
+	0xCA, 0x04, 0x15, 0x80,
+};
+
+static char auo_cx_qvga_cmd_on_cmd12[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xF0, 0x55, 0xAA, 0x52,
+	0x08, 0x01, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd13[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB0, 0x03, 0x03, 0x03,
+};
+
+static char auo_cx_qvga_cmd_on_cmd14[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB1, 0x05, 0x05, 0x05,
+};
+
+static char auo_cx_qvga_cmd_on_cmd15[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB2, 0x01, 0x01, 0x01,
+};
+
+static char auo_cx_qvga_cmd_on_cmd16[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB4, 0x07, 0x07, 0x07,
+};
+
+static char auo_cx_qvga_cmd_on_cmd17[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB5, 0x03, 0x03, 0x03,
+};
+
+static char auo_cx_qvga_cmd_on_cmd18[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB6, 0x55, 0x55, 0x56,
+};
+
+static char auo_cx_qvga_cmd_on_cmd19[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB7, 0x36, 0x36, 0x36,
+};
+
+static char auo_cx_qvga_cmd_on_cmd20[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB8, 0x23, 0x23, 0x23,
+};
+
+static char auo_cx_qvga_cmd_on_cmd21[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xB9, 0x03, 0x03, 0x03,
+};
+
+static char auo_cx_qvga_cmd_on_cmd22[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xBA, 0x03, 0x03, 0x03,
+};
+
+static char auo_cx_qvga_cmd_on_cmd23[] = {
+	0x04, 0x00, 0x39, 0xC0,
+	0xBE, 0x32, 0x30, 0x70,
+};
+
+static char auo_cx_qvga_cmd_on_cmd24[] = {
+	0x08, 0x00, 0x39, 0xC0,
+	0xCF, 0xFF, 0xD4, 0x95,
+	0xE8, 0x4F, 0x00, 0x04,
+};
+
+static char auo_cx_qvga_cmd_on_cmd25[] = {
+	0x35, 0x01, 0x15, 0x80,
+};
+
+static char auo_cx_qvga_cmd_on_cmd26[] = {
+	0x36, 0x00, 0x15, 0x80,
+};
+
+static char auo_cx_qvga_cmd_on_cmd27[] = {
+	0xC0, 0x20, 0x15, 0x80,
+};
+
+static char auo_cx_qvga_cmd_on_cmd28[] = {
+	0x07, 0x00, 0x39, 0xC0,
+	0xC2, 0x17, 0x17, 0x17,
+	0x17, 0x17, 0x0B, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd29[] = {
+	0x00, 0x00, 0x32, 0x80,
+};
+
+
+static char auo_cx_qvga_cmd_on_cmd30[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xF0, 0x55, 0xAA, 0x52,
+	0x08, 0x02, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd31[] = {
+	0x09, 0x00, 0x39, 0xC0,
+	0xED, 0x48, 0x00, 0xFF,
+	0x13, 0x08, 0x30, 0x0C,
+        0x00, 0xFF, 0xFF, 0xFF,
+};
+static char auo_cx_qvga_cmd_on_cmd32[] = {
+	0x11, 0x00, 0x05, 0x80,
+};
+
+
+static char auo_cx_qvga_cmd_on_cmd33[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xF0, 0x55, 0xAA, 0x52,
+	0x08, 0x02, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd34[] = {
+	0x09, 0x00, 0x39, 0xC0,
+	0xED, 0x48, 0x00, 0xFE,
+	0x13, 0x08, 0x30, 0x0C,
+        0x00, 0xFF, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd35[] = {
+	0x09, 0x00, 0x39, 0xC0,
+	0xED, 0x48, 0x00, 0xE6,
+	0x13, 0x08, 0x30, 0x0C,
+        0x00, 0xFF, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd36[] = {
+	0x09, 0x00, 0x39, 0xC0,
+	0xED, 0x48, 0x00, 0xE2,
+	0x13, 0x08, 0x30, 0x0C,
+        0x00, 0xFF, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd37[] = {
+	0x09, 0x00, 0x39, 0xC0,
+	0xED, 0x48, 0x00, 0xE0,
+	0x13, 0x08, 0x30, 0x0C,
+        0x00, 0xFF, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd38[] = {
+	0x09, 0x00, 0x39, 0xC0,
+	0xED, 0x48, 0x00, 0xE0,
+	0x13, 0x08, 0x00, 0x0C,
+        0x00, 0xFF, 0xFF, 0xFF,
+};
+
+static char auo_cx_qvga_cmd_on_cmd39[] = {
+	0x29, 0x00, 0x05, 0x80,
+};
+
+static char auo_cx_qvga_cmd_on_cmd40[] = {
+	0x06, 0x00, 0x39, 0xC0,
+	0xF0, 0x55, 0xAA, 0x52,
+	0x08, 0x00, 0xFF, 0xFF,
+};
+
+static struct mipi_dsi_cmd auo_cx_qvga_cmd_on_command[] = {
+	{0xc, auo_cx_qvga_cmd_on_cmd0, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd1, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd2, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd3, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd4, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd5, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd6, 0x00},
+	{0x4, auo_cx_qvga_cmd_on_cmd7, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd8, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd9, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd10, 0x00},
+	{0x4, auo_cx_qvga_cmd_on_cmd11, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd12, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd13, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd14, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd15, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd16, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd17, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd18, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd19, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd20, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd21, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd22, 0x00},
+	{0x8, auo_cx_qvga_cmd_on_cmd23, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd24, 0x00},
+	{0x4, auo_cx_qvga_cmd_on_cmd25, 0x00},
+	{0x4, auo_cx_qvga_cmd_on_cmd26, 0x00},
+	{0x4, auo_cx_qvga_cmd_on_cmd27, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd28, 0xFF},
+	{0x4, auo_cx_qvga_cmd_on_cmd29, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd30, 0x00},
+	{0x10, auo_cx_qvga_cmd_on_cmd31, 0x20},
+	{0x4, auo_cx_qvga_cmd_on_cmd32, 0x12C}, // Need 300ms delay
+	{0xc, auo_cx_qvga_cmd_on_cmd33, 0x00},
+	{0x10, auo_cx_qvga_cmd_on_cmd34,0x20},
+	{0x10, auo_cx_qvga_cmd_on_cmd35, 0x20},
+	{0x10, auo_cx_qvga_cmd_on_cmd36, 0x20},
+	{0x10, auo_cx_qvga_cmd_on_cmd37, 0x20},
+	{0x10, auo_cx_qvga_cmd_on_cmd38, 0x20},
+	{0x4, auo_cx_qvga_cmd_on_cmd39, 0x00},
+	{0xc, auo_cx_qvga_cmd_on_cmd40, 0x00},
+};
+
+#define auo_cx_QVGA_CMD_ON_COMMAND 41
+
+static char auo_cx_qvga_cmdoff_cmd0[] = {
+	0x28, 0x00, 0x05, 0x80
+};
+
+static char auo_cx_qvga_cmdoff_cmd1[] = {
+	0x10, 0x00, 0x05, 0x80
+};
+
+static struct mipi_dsi_cmd auo_cx_qvga_cmd_off_command[] = {
+	{0x4, auo_cx_qvga_cmdoff_cmd0, 0x32},
+	{0x4, auo_cx_qvga_cmdoff_cmd1, 0x78}
+};
+
+#define auo_cx_QVGA_CMD_OFF_COMMAND 2
+
+static struct command_state auo_cx_qvga_cmd_state = {
+	0, 1
+};
+
+/*---------------------------------------------------------------------------*/
+/* Command mode panel information                                            */
+/*---------------------------------------------------------------------------*/
+static struct commandpanel_info auo_cx_qvga_cmd_command_panel = {
+	1, 1, 1, 0, 0, 0x2c, 0, 0, 0, 1, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Video mode panel information                                              */
+/*---------------------------------------------------------------------------*/
+static struct videopanel_info auo_cx_qvga_cmd_video_panel = {
+	1, 0, 0, 0, 1, 1, 2, 0, 0x9
+};
+
+/*---------------------------------------------------------------------------*/
+/* Lane configuration                                                        */
+/*---------------------------------------------------------------------------*/
+static struct lane_configuration auo_cx_qvga_cmd_lane_config = {
+	1, 0, 1, 0, 0, 0
+};
+
+/*---------------------------------------------------------------------------*/
+/* Panel timing                                                              */
+/*---------------------------------------------------------------------------*/
+static const uint32_t auo_cx_qvga_cmd_timings[] = {
+	0x5F, 0x12, 0x0A, 0x00, 0x32, 0x34, 0x10, 0x16, 0x0F, 0x03, 0x04, 0x00
+};
+
+static struct panel_timing auo_cx_qvga_cmd_timing_info = {
+	0, 4, 0x05, 0x15
+};
+
+static struct panel_reset_sequence auo_cx_qvga_cmd_panel_reset_seq = {
+	{ 1, 0, 1, }, { 20, 20, 20, }, 2
+};
+
+/*---------------------------------------------------------------------------*/
+/* Backlight setting                                                         */
+/*---------------------------------------------------------------------------*/
+static struct backlight auo_cx_qvga_cmd_backlight = {
+	2, 1, 255, 100, 1, "PMIC_8941"
+};
+
+#endif /*_PANEL_AUO_QVGA_CMD_H_*/
diff --git a/makefile b/makefile
index 7082311..b6c1ddb 100644
--- a/makefile
+++ b/makefile
@@ -121,6 +121,12 @@
   DEFINES += USER_BUILD_VARIANT=1
 endif
 
+ifeq ($(USE_LE_SYSTEMD),true)
+  DEFINES += USE_LE_SYSTEMD=1
+else
+  DEFINES += USE_LE_SYSTEMD=0
+endif
+
 # these need to be filled out by the project/target/platform rules.mk files
 TARGET :=
 PLATFORM :=
diff --git a/platform/msm8909/include/platform/iomap.h b/platform/msm8909/include/platform/iomap.h
index 2f0ca98..f0a7db9 100644
--- a/platform/msm8909/include/platform/iomap.h
+++ b/platform/msm8909/include/platform/iomap.h
@@ -179,6 +179,18 @@
 #define USB_HS_SYSTEM_CFG_RCGR      (CLK_CTL_BASE + 0x41014)
 
 
+/* RPMB send receive buffer needs to be mapped
+ * as device memory, define the start address
+ * and size in MB
+ */
+#define RPMB_SND_RCV_BUF            0x90000000
+#define RPMB_SND_RCV_BUF_SZ         0x1
+
+/* QSEECOM: Secure app region notification */
+#define APP_REGION_ADDR 0x87b00000
+#define APP_REGION_SIZE 0x100000
+
+
 /* MDSS */
 #define MIPI_DSI_BASE               (0x1AC8000)
 #define MIPI_DSI0_BASE              MIPI_DSI_BASE
diff --git a/platform/msm8909/platform.c b/platform/msm8909/platform.c
index e59f69e..7003275 100644
--- a/platform/msm8909/platform.c
+++ b/platform/msm8909/platform.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2015, 2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -65,6 +65,7 @@
 	{    SYSTEM_IMEM_BASE,  SYSTEM_IMEM_BASE, 1,                IMEM_MEMORY},
 	{    MSM_SHARED_BASE,   MSM_SHARED_BASE,  1,                COMMON_MEMORY},
 	{    MIPI_FB_ADDR,      MIPI_FB_ADDR,     10,              COMMON_MEMORY},
+	{    RPMB_SND_RCV_BUF,  RPMB_SND_RCV_BUF, RPMB_SND_RCV_BUF_SZ,    IOMAP_MEMORY},
 };
 
 static struct smem_ram_ptable ram_ptable;
diff --git a/platform/msm_shared/include/msm_panel.h b/platform/msm_shared/include/msm_panel.h
index 4c44cc4..f458328 100644
--- a/platform/msm_shared/include/msm_panel.h
+++ b/platform/msm_shared/include/msm_panel.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -247,6 +247,7 @@
 	struct dfps_panel_info panel_dfps;
 	struct dfps_codes_info codes_dfps[DFPS_MAX_FRAME_RATE];
 	void *dfps_fb_base;
+	uint32_t chip_serial;
 };
 
 /* intf timing settings */
diff --git a/platform/msm_shared/include/qseecomi_lk.h b/platform/msm_shared/include/qseecomi_lk.h
index ee442be..0a919de 100644
--- a/platform/msm_shared/include/qseecomi_lk.h
+++ b/platform/msm_shared/include/qseecomi_lk.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2014, 2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2014, 2015, 2017 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -46,7 +46,8 @@
 
 enum qseecom_command_scm_resp_type {
 	QSEOS_APP_ID = 0xEE01,
-	QSEOS_LISTENER_ID
+	QSEOS_LISTENER_ID,
+	QSEE_RESERVED = INT_MAX /**< Required to make the enum 4 bytes. */
 };
 
 typedef enum
diff --git a/platform/msm_shared/menu_keys_detect.c b/platform/msm_shared/menu_keys_detect.c
index 8ffbacb..3a81b70 100644
--- a/platform/msm_shared/menu_keys_detect.c
+++ b/platform/msm_shared/menu_keys_detect.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -45,6 +45,7 @@
 #include <sys/types.h>
 #include <../../../app/aboot/recovery.h>
 #include <../../../app/aboot/devinfo.h>
+#include <string.h>
 
 #define KEY_DETECT_FREQUENCY		50
 
@@ -128,6 +129,7 @@
 				/* wipe data */
 				struct recovery_message msg;
 
+				memset(&msg, 0, sizeof(msg));
 				snprintf(msg.recovery, sizeof(msg.recovery), "recovery\n--wipe_data");
 				write_misc(0, &msg, sizeof(msg));
 			}
@@ -154,6 +156,7 @@
 
 			break;
 		case FFBM:
+			memset(&ffbm_page_buffer, 0, sizeof(ffbm_page_buffer));
 			snprintf(ffbm_page_buffer, sizeof(ffbm_page_buffer), "ffbm-00");
 			write_misc(0, ffbm_page_buffer, sizeof(ffbm_page_buffer));
 
diff --git a/platform/msm_shared/partition_parser.c b/platform/msm_shared/partition_parser.c
index c7e91a1..1c3cc72 100644
--- a/platform/msm_shared/partition_parser.c
+++ b/platform/msm_shared/partition_parser.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -1174,8 +1174,9 @@
 	if (!flashing_gpt) {
 		partition_0 = GET_LLWORD_FROM_BYTE(&buffer[PARTITION_ENTRIES_OFFSET]);
 		/*start LBA should always be 2 in primary GPT*/
-		if(partition_0 != 0x2) {
+		if(partition_0 != 0x2 && !parse_secondary_gpt) {
 			dprintf(CRITICAL, "Starting LBA mismatch\n");
+			ret = 1;
 			goto fail;
 
 		}
diff --git a/platform/msm_shared/rules.mk b/platform/msm_shared/rules.mk
index 957f78d..c5067b8 100755
--- a/platform/msm_shared/rules.mk
+++ b/platform/msm_shared/rules.mk
@@ -1,7 +1,7 @@
 LOCAL_DIR := $(GET_LOCAL_DIR)
 
 INCLUDES += \
-			-I$(LOCAL_DIR)/include -I$(LK_TOP_DIR)/dev/panel/msm
+			-I$(LOCAL_DIR)/include -I$(LK_TOP_DIR)/dev/panel/msm -I$(LK_TOP_DIR)/app/aboot
 
 DEFINES += $(TARGET_XRES)
 DEFINES += $(TARGET_YRES)
@@ -523,6 +523,7 @@
 			$(LOCAL_DIR)/certificate.o \
 			$(LOCAL_DIR)/image_verify.o \
 			$(LOCAL_DIR)/i2c_qup.o \
+			$(LOCAL_DIR)/qseecom_lk.o \
 			$(LOCAL_DIR)/mdp3.o \
 			$(LOCAL_DIR)/display.o \
 			$(LOCAL_DIR)/mipi_dsi.o \
diff --git a/project/msm8909.mk b/project/msm8909.mk
index d8e5280..bdf593e 100644
--- a/project/msm8909.mk
+++ b/project/msm8909.mk
@@ -14,6 +14,16 @@
 
 EMMC_BOOT := 1
 
+ifeq ($(VERIFIED_BOOT),1)
+ENABLE_SECAPP_LOADER := 1
+ENABLE_RPMB_SUPPORT := 1
+
+ifneq (,$(findstring DISPLAY_SPLASH_SCREEN,$(DEFINES)))
+#enable fbcon display menu
+ENABLE_FBCON_DISPLAY_MSG := 1
+endif
+endif
+
 ENABLE_SMD_SUPPORT := 1
 ENABLE_PWM_SUPPORT := true
 ENABLE_BOOT_CONFIG_SUPPORT := 1
@@ -34,11 +44,15 @@
 DEFINES += ABOOT_FORCE_KERNEL64_ADDR=0x00080000
 
 DEFINES += BAM_V170=1
-DEFINES += ENABLE_FBCON_LOGGING=1
+#DEFINES += ENABLE_FBCON_LOGGING=1
 
 #Enable the feature of long press power on
 DEFINES += LONG_PRESS_POWER_ON=1
 
+ifeq ($(ENABLE_RPMB_SUPPORT),1)
+DEFINES += USE_RPMB_FOR_DEVINFO=1
+endif
+
 #Disable thumb mode
 ENABLE_THUMB := false
 
@@ -76,5 +90,10 @@
 #Use PON register for reboot reason
 DEFINES += USE_PON_REBOOT_REG=1
 
+#Enable fbcon display for verified boot.
+ifeq ($(ENABLE_FBCON_DISPLAY_MSG),1)
+DEFINES += FBCON_DISPLAY_MSG=1
+endif
+
 #enable battery voltage check
 DEFINES += CHECK_BAT_VOLTAGE=1
diff --git a/target/msm8909/init.c b/target/msm8909/init.c
index f3e9361..2203e01 100644
--- a/target/msm8909/init.c
+++ b/target/msm8909/init.c
@@ -50,6 +50,8 @@
 #include <rpm-smd.h>
 #include <qpic_nand.h>
 #include <smem.h>
+#include <secapp_loader.h>
+#include <rpmb.h>
 
 #if LONG_PRESS_POWER_ON
 #include <shutdown_detect.h>
@@ -120,6 +122,19 @@
 static void set_sdc_power_ctrl(void);
 static void set_ebi2_config(void);
 
+#if VERIFIED_BOOT
+/**
+* Check if keymaster partition is present to test
+* if we have VB on this target.
+**/
+static bool target_is_vb_enabled()
+{
+	if (partition_get_index("keymaster") == INVALID_PTN)
+		return false;
+	return true;
+}
+#endif
+
 void update_ptable_names(void)
 {
 	uint32_t ptn_index;
@@ -322,7 +337,9 @@
 {
 	uint32_t base_addr;
 	uint8_t slot;
-
+#if VERIFIED_BOOT
+	int ret = 0;
+#endif
 	dprintf(INFO, "target_init()\n");
 
 	spmi_init(PMIC_ARB_CHANNEL_NUM, PMIC_ARB_OWNER_ID);
@@ -373,12 +390,52 @@
 #if PON_VIB_SUPPORT
 
 	/* turn on vibrator to indicate that phone is booting up to end user */
-		vib_timed_turn_on(VIBRATE_TIME);
+	vib_timed_turn_on(VIBRATE_TIME);
 #endif
 
 	if (target_use_signed_kernel())
 		target_crypto_init_params();
 
+#if VERIFIED_BOOT
+	if (target_is_vb_enabled())
+	{
+		clock_ce_enable(CE1_INSTANCE);
+
+		/* Initialize Qseecom */
+		ret = qseecom_init();
+
+		if (ret < 0)
+		{
+			dprintf(CRITICAL, "Failed to initialize qseecom, error: %d\n", ret);
+			ASSERT(0);
+		}
+
+		/* Start Qseecom */
+		ret = qseecom_tz_init();
+
+		if (ret < 0)
+		{
+			dprintf(CRITICAL, "Failed to start qseecom, error: %d\n", ret);
+			ASSERT(0);
+		}
+
+		if (rpmb_init() < 0)
+		{
+			dprintf(CRITICAL, "RPMB init failed\n");
+			ASSERT(0);
+		}
+
+		/*
+		 * Load the sec app for first time
+		*/
+		if (load_sec_app() < 0)
+		{
+			dprintf(CRITICAL, "Failed to load App for verified\n");
+			ASSERT(0);
+		}
+	}
+#endif
+
 #if SMD_SUPPORT
 	rpm_smd_init();
 #endif
@@ -644,6 +701,28 @@
 	if (target_is_ssd_enabled())
 		clock_ce_disable(CE1_INSTANCE);
 
+#if VERIFIED_BOOT
+	if(target_is_vb_enabled())
+	{
+		if (is_sec_app_loaded())
+		{
+			if (send_milestone_call_to_tz() < 0)
+			{
+				dprintf(CRITICAL, "Failed to unload App for rpmb\n");
+				ASSERT(0);
+			}
+		}
+
+		if (rpmb_uninit() < 0)
+		{
+			dprintf(CRITICAL, "RPMB uninit failed\n");
+			ASSERT(0);
+		}
+
+		clock_ce_disable(CE1_INSTANCE);
+	}
+#endif
+
 #if SMD_SUPPORT
 	rpm_smd_uninit();
 #endif
diff --git a/target/msm8909/meminfo.c b/target/msm8909/meminfo.c
index 9d76bf6..ee48937 100644
--- a/target/msm8909/meminfo.c
+++ b/target/msm8909/meminfo.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -81,5 +81,5 @@
 
 unsigned target_get_max_flash_size(void)
 {
-	return (256 * 1024 * 1024);
+	return (250 * 1024 * 1024);
 }
diff --git a/target/msm8909/oem_panel.c b/target/msm8909/oem_panel.c
index 7b6e473..6e12a6c 100644
--- a/target/msm8909/oem_panel.c
+++ b/target/msm8909/oem_panel.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2015, 2017, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,6 +45,9 @@
 #include "include/panel_hx8379c_fwvga_video.h"
 #include "include/panel_hx8394d_qhd_video.h"
 #include "include/panel_fl10802_fwvga_video.h"
+#include "include/panel_auo_qvga_cmd.h"
+#include "include/panel_auo_cx_qvga_cmd.h"
+#include "include/panel_auo_400p_cmd.h"
 
 #define DISPLAY_MAX_PANEL_DETECTION 0
 #define ILI9806E_FWVGA_VIDEO_PANEL_POST_INIT_DELAY 68
@@ -70,6 +73,9 @@
 	HX8379C_FWVGA_VIDEO_PANEL,
 	HX8394D_QHD_VIDEO_PANEL,
 	FL10802_FWVGA_VIDEO_PANEL,
+	AUO_QVGA_CMD_PANEL,
+	AUO_CX_QVGA_CMD_PANEL,
+	AUO_400P_CMD_PANEL,
 	UNKNOWN_PANEL
 };
 
@@ -85,7 +91,10 @@
 	{"ili9806e_fwvga_video",ILI9806E_FWVGA_VIDEO_PANEL},
 	{"hx8379c_fwvga_video",HX8379C_FWVGA_VIDEO_PANEL},
 	{"hx8394d_qhd_video", HX8394D_QHD_VIDEO_PANEL},
-	{"fl10802_fwvga_video", FL10802_FWVGA_VIDEO_PANEL}
+	{"fl10802_fwvga_video", FL10802_FWVGA_VIDEO_PANEL},
+	{"auo_qvga_cmd", AUO_QVGA_CMD_PANEL},
+	{"auo_cx_qvga_cmd", AUO_CX_QVGA_CMD_PANEL},
+	{"auo_400p_cmd", AUO_400P_CMD_PANEL},
 };
 
 static uint32_t panel_id;
@@ -321,6 +330,78 @@
 		pinfo->mipi.signature = FL10802_FWVGA_VIDEO_SIGNATURE;
 		pinfo->mipi.cmds_post_tg = 1;
 		break;
+	case AUO_QVGA_CMD_PANEL:
+		panelstruct->paneldata    = &auo_qvga_cmd_panel_data;
+		panelstruct->panelres     = &auo_qvga_cmd_panel_res;
+		panelstruct->color        = &auo_qvga_cmd_color;
+		panelstruct->videopanel   = &auo_qvga_cmd_video_panel;
+		panelstruct->commandpanel = &auo_qvga_cmd_command_panel;
+		panelstruct->state        = &auo_qvga_cmd_state;
+		panelstruct->laneconfig   = &auo_qvga_cmd_lane_config;
+		panelstruct->paneltiminginfo
+					= &auo_qvga_cmd_timing_info;
+		panelstruct->panelresetseq
+					= &auo_qvga_cmd_panel_reset_seq;
+		panelstruct->backlightinfo
+					= &auo_qvga_cmd_backlight;
+		pinfo->mipi.panel_on_cmds
+					= auo_qvga_cmd_on_command;
+		pinfo->mipi.num_of_panel_on_cmds
+					= auo_QVGA_CMD_ON_COMMAND;
+		pinfo->mipi.panel_off_cmds
+					= auo_qvga_cmd_off_command;
+		pinfo->mipi.num_of_panel_off_cmds
+					= auo_QVGA_CMD_OFF_COMMAND;
+		memcpy(phy_db->timing, auo_qvga_cmd_timings, TIMING_SIZE);
+		break;
+	case AUO_CX_QVGA_CMD_PANEL:
+		panelstruct->paneldata    = &auo_cx_qvga_cmd_panel_data;
+		panelstruct->panelres     = &auo_cx_qvga_cmd_panel_res;
+		panelstruct->color        = &auo_cx_qvga_cmd_color;
+		panelstruct->videopanel   = &auo_cx_qvga_cmd_video_panel;
+		panelstruct->commandpanel = &auo_cx_qvga_cmd_command_panel;
+		panelstruct->state        = &auo_cx_qvga_cmd_state;
+		panelstruct->laneconfig   = &auo_cx_qvga_cmd_lane_config;
+		panelstruct->paneltiminginfo
+					= &auo_cx_qvga_cmd_timing_info;
+		panelstruct->panelresetseq
+					= &auo_cx_qvga_cmd_panel_reset_seq;
+		panelstruct->backlightinfo
+					= &auo_cx_qvga_cmd_backlight;
+		pinfo->mipi.panel_on_cmds
+					= auo_cx_qvga_cmd_on_command;
+		pinfo->mipi.num_of_panel_on_cmds
+					= auo_cx_QVGA_CMD_ON_COMMAND;
+		pinfo->mipi.panel_off_cmds
+					= auo_cx_qvga_cmd_off_command;
+		pinfo->mipi.num_of_panel_off_cmds
+					= auo_cx_QVGA_CMD_OFF_COMMAND;
+		memcpy(phy_db->timing, auo_cx_qvga_cmd_timings, TIMING_SIZE);
+		break;
+	case AUO_400P_CMD_PANEL:
+		panelstruct->paneldata    = &auo_400p_cmd_panel_data;
+		panelstruct->panelres     = &auo_400p_cmd_panel_res;
+		panelstruct->color        = &auo_400p_cmd_color;
+		panelstruct->videopanel   = &auo_400p_cmd_video_panel;
+		panelstruct->commandpanel = &auo_400p_cmd_command_panel;
+		panelstruct->state        = &auo_400p_cmd_state;
+		panelstruct->laneconfig   = &auo_400p_cmd_lane_config;
+		panelstruct->paneltiminginfo
+					= &auo_400p_cmd_timing_info;
+		panelstruct->panelresetseq
+					= &auo_400p_cmd_panel_reset_seq;
+		panelstruct->backlightinfo
+					= &auo_400p_cmd_backlight;
+		pinfo->mipi.panel_on_cmds
+					= auo_400p_cmd_on_command;
+		pinfo->mipi.num_of_panel_on_cmds
+					= auo_400P_CMD_ON_COMMAND;
+		pinfo->mipi.panel_off_cmds
+					= auo_400p_cmd_off_command;
+		pinfo->mipi.num_of_panel_off_cmds
+					= auo_400P_CMD_OFF_COMMAND;
+		memcpy(phy_db->timing, auo_400p_cmd_timings, TIMING_SIZE);
+		break;
 	case UNKNOWN_PANEL:
 	default:
 		memset(panelstruct, 0, sizeof(struct panel_struct));
diff --git a/target/msm8909/rules.mk b/target/msm8909/rules.mk
index 508609f..f2ae532 100644
--- a/target/msm8909/rules.mk
+++ b/target/msm8909/rules.mk
@@ -9,7 +9,7 @@
 MEMSIZE := 0x00100000 # 1MB
 
 BASE_ADDR        := 0x80000000
-SCRATCH_ADDR     := 0x90000000
+SCRATCH_ADDR     := 0x90100000
 
 DEFINES += DISPLAY_SPLASH_SCREEN=1
 DEFINES += DISPLAY_TYPE_MIPI=1