diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index 11d64c4..31b5315 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -2548,23 +2548,21 @@
 	}
 
 	/* status is true, it means to unlock device */
-	if (status) {
-		if(!is_allow_unlock) {
-			fastboot_fail("oem unlock is not allowed");
-			return;
-		}
+	if (status && !is_allow_unlock) {
+		fastboot_fail("oem unlock is not allowed");
+		return;
+	}
 
 #if FBCON_DISPLAY_MSG
-		display_unlock_menu(type);
-		fastboot_okay("");
-		return;
+	display_unlock_menu(type, status);
+	fastboot_okay("");
+	return;
 #else
-		if (type == UNLOCK) {
-			fastboot_fail("Need wipe userdata. Do 'fastboot oem unlock-go'");
-			return;
-		}
-#endif
+	if (status && type == UNLOCK) {
+		fastboot_fail("Need wipe userdata. Do 'fastboot oem unlock-go'");
+		return;
 	}
+#endif
 
 	set_device_unlock_value(type, status);
 
diff --git a/dev/qpnp_haptic/qpnp_vib_ldo.c b/dev/qpnp_haptic/qpnp_vib_ldo.c
index 7b327cf..1506ed8 100644
--- a/dev/qpnp_haptic/qpnp_vib_ldo.c
+++ b/dev/qpnp_haptic/qpnp_vib_ldo.c
@@ -53,8 +53,8 @@
 
 #define MAX_WAIT_FOR_VREG_READY_US	1000
 #define VREG_READY_STEP_DELAY_US	100
-#define VIB_LDO_OVERDRIVE_VOLTAGE_MV	3000
-#define VIB_LDO_NOMINAL_VOLTAGE_MV	1500
+#define VIB_LDO_OVERDRIVE_VOLTAGE_MV	3500
+#define VIB_LDO_NOMINAL_VOLTAGE_MV	3000
 #define OVERDRIVE_TIME_US		30000
 
 /* Turn on vibrator */
diff --git a/platform/msm8952/platform.c b/platform/msm8952/platform.c
index cd771de..184f5e2 100644
--- a/platform/msm8952/platform.c
+++ b/platform/msm8952/platform.c
@@ -268,6 +268,7 @@
 	switch(platform)
 	{
 	case SDM429:
+	case SDA429:
 		ret = 1;
 		break;
 	default:
@@ -285,6 +286,7 @@
 	switch(platform)
 	{
 	case SDM439:
+	case SDA439:
 		ret = 1;
 		break;
 	default:
diff --git a/platform/msm_shared/avb/VerifiedBoot.c b/platform/msm_shared/avb/VerifiedBoot.c
index df10f35..554f250 100644
--- a/platform/msm_shared/avb/VerifiedBoot.c
+++ b/platform/msm_shared/avb/VerifiedBoot.c
@@ -110,17 +110,6 @@
 	return (GetAVBVersion() > NO_AVB);
 }
 
-static int GetCurrentSlotSuffix(Slot *CurrentSlot)
-{
-	if (!partition_multislot_is_supported())
-		return ERR_INVALID_ARGS;
-
-	strlcpy(CurrentSlot->Suffix,
-			SUFFIX_SLOT(partition_find_active_slot()),
-			MAX_SLOT_SUFFIX_SZ);
-	return 0;
-}
-
 static int check_img_header(void *ImageHdrBuffer, uint32_t ImageHdrSize, uint32_t *imgsizeActual)
 {
     /* These checks are already done before calling auth remove from here */
@@ -130,50 +119,6 @@
 	return 0;
 }
 
-static int GetActiveSlot(Slot *ActiveSlot)
-{
-	if (!partition_multislot_is_supported())
-		return ERR_INVALID_ARGS;
-	int idx = partition_find_active_slot();
-	if (idx != INVALID)
-	{
-		strlcpy(ActiveSlot->Suffix,
-			SUFFIX_SLOT(partition_find_active_slot()),
-			MAX_SLOT_SUFFIX_SZ);
-		return 0;
-	}
-	return ERR_NOT_FOUND;
-}
-
-static int FindBootableSlot(Slot *BootableSlot)
-{
-   int Status = 0;
-
-   if (BootableSlot == NULL) {
-       dprintf(CRITICAL,"FindBootableSlot: input parameter invalid\n");
-       return -ERR_INVALID_ARGS;
-   }
-
-   Status = GetActiveSlot(BootableSlot);
-   if (Status != 0) {
-       /* clear bootable slot */
-       BootableSlot->Suffix[0] = '\0';
-   }
-   return Status;
-}
-
-bool IsSuffixEmpty(Slot *CheckSlot)
-{
-	if (CheckSlot == NULL) {
-		return TRUE;
-	}
-
-	if (strlen((char *)CheckSlot->Suffix) == 0) {
-		return TRUE;
-	}
-	return FALSE;
-}
-
 static int HandleActiveSlotUnbootable()
 {
    int curr_slot;
@@ -193,11 +138,9 @@
 	INT32 Index;
 	UINT32 Lun;
 	CHAR8 PartitionName[MAX_GPT_NAME_SIZE];
-	Slot CurSlot;
 	CHAR8 LunCharMapping[] = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'};
-
-	if (GetCurrentSlotSuffix(&CurSlot))
-		return 0;
+	const char *current_slot_suffix;
+	int current_active_slot;
 
 	*SysPath = malloc(sizeof(char) * MAX_PATH_SIZE);
 	if (!*SysPath) {
@@ -206,7 +149,13 @@
 	}
 
 	strlcpy(PartitionName, "system", strlen("system") + 1);
-	strlcat(PartitionName, CurSlot.Suffix, MAX_GPT_NAME_SIZE - 1);
+	current_active_slot = partition_find_active_slot();
+	if (partition_multislot_is_supported()) {
+		if (current_active_slot == INVALID)
+			return 0;
+		current_slot_suffix = SUFFIX_SLOT(current_active_slot);
+		strncat(PartitionName, current_slot_suffix, MAX_GPT_NAME_SIZE - 1);
+	}
 
 	Index = partition_get_index(PartitionName);
 	if (Index == INVALID_PTN || Index >= NUM_PARTITIONS) {
@@ -487,6 +436,11 @@
 		Info->boot_state = RED;
 		goto out;
 	}
+	if (SlotData == NULL) {
+		Status = EFI_LOAD_ERROR;
+		Info->boot_state = RED;
+		goto out;
+	}
 
 	for (UINTN ReqIndex = 0; ReqIndex < NumRequestedPartition; ReqIndex++) {
 		dprintf(DEBUG, "Requested Partition: %s\n",
@@ -672,6 +626,8 @@
 	BOOLEAN MdtpActive = FALSE;
 	UINT32 AVBVersion = NO_AVB;
 	mdtp_ext_partition_verification_t ext_partition;
+	const char *current_slot_suffix;
+	int current_active_slot;
 
 	if (Info == NULL) {
 		dprintf(CRITICAL, "Invalid parameter Info\n");
@@ -687,15 +643,16 @@
 			strlcpy(Info->pname, "boot", strlen("boot"));
 		}
 	} else {
-		Slot CurrentSlot = {{0}};
-
-		GUARD(FindBootableSlot(&CurrentSlot));
-		if (IsSuffixEmpty(&CurrentSlot)) {
-			dprintf(CRITICAL, "No bootable slot\n");
-			return EFI_LOAD_ERROR;
-		}
 		strlcpy(Info->pname, "boot", strlen("boot"));
-		strlcat(Info->pname, CurrentSlot.Suffix, strlen(CurrentSlot.Suffix));
+		current_active_slot = partition_find_active_slot();
+		if (current_active_slot != INVALID ) {
+			current_slot_suffix = SUFFIX_SLOT(current_active_slot);
+			if (strlen(current_slot_suffix) == 0) {
+				dprintf(CRITICAL, "No bootable slot\n");
+				return EFI_LOAD_ERROR;
+			}
+			strlcat(Info->pname, current_slot_suffix, strlen(current_slot_suffix));
+		}
 	}
 
 	dprintf(DEBUG, "MultiSlot %s, partition name %s\n",
diff --git a/platform/msm_shared/avb/libavb/avb_slot_verify.c b/platform/msm_shared/avb/libavb/avb_slot_verify.c
index 0594fab..ea4ecec 100644
--- a/platform/msm_shared/avb/libavb/avb_slot_verify.c
+++ b/platform/msm_shared/avb/libavb/avb_slot_verify.c
@@ -190,6 +190,12 @@
     uint32_t complete_len = hash_desc.salt_len + hash_desc.image_size;
     uint8_t *complete_buf = (uint8_t *)target_get_scratch_address()+0x08000000;
     digest = avb_malloc(AVB_SHA256_DIGEST_SIZE);
+    if(digest == NULL)
+    {
+        avb_errorv(part_name, ": Failed to allocate memory\n", NULL);
+        ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+        goto out;
+    }
     avb_memcpy(complete_buf, desc_salt, hash_desc.salt_len);
     avb_memcpy(complete_buf + hash_desc.salt_len, image_buf, hash_desc.image_size);
     hash_find(complete_buf, complete_len, digest, CRYPTO_AUTH_ALG_SHA256);
@@ -198,6 +204,12 @@
     AvbSHA512Ctx sha512_ctx;
     uint8_t *dig;
     digest = avb_malloc(AVB_SHA512_DIGEST_SIZE);
+    if(digest == NULL)
+    {
+        avb_errorv(part_name, ": Failed to allocate memory\n", NULL);
+        ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+        goto out;
+    }
     avb_sha512_init(&sha512_ctx);
     avb_sha512_update(&sha512_ctx, desc_salt, hash_desc.salt_len);
     avb_sha512_update(&sha512_ctx, image_buf, hash_desc.image_size);
@@ -1133,6 +1145,12 @@
       uint8_t* tbuf = NULL;
 
       digest = avb_malloc(AVB_SHA256_DIGEST_SIZE);
+      if(digest == NULL)
+      {
+        avb_error("Failed to allocate memory\n");
+        ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+        goto out;
+      }
       for (n = 0; n < slot_data->num_vbmeta_images; n++) {
         total_size += slot_data->vbmeta_images[n].vbmeta_size;
       }
diff --git a/platform/msm_shared/avb/libavb/avb_vbmeta_image.c b/platform/msm_shared/avb/libavb/avb_vbmeta_image.c
index b95d8b6..7915aac 100644
--- a/platform/msm_shared/avb/libavb/avb_vbmeta_image.c
+++ b/platform/msm_shared/avb/libavb/avb_vbmeta_image.c
@@ -181,7 +181,17 @@
     case AVB_ALGORITHM_TYPE_SHA256_RSA8192:
       total_len = sizeof(AvbVBMetaImageHeader) + h.auxiliary_data_block_size;
       tbuf = avb_malloc_(total_len);
+      if(tbuf == NULL)
+      {
+           avb_error("Failed to allocate memory.\n");
+           goto out;
+      }
       computed_hash = avb_malloc_(AVB_SHA256_DIGEST_SIZE);
+      if(computed_hash == NULL)
+      {
+           avb_error("Failed to allocate memory.\n");
+           goto out;
+      }
       avb_memcpy(tbuf, header_block, sizeof(AvbVBMetaImageHeader));
       avb_memcpy(tbuf + sizeof(AvbVBMetaImageHeader), auxiliary_block, h.auxiliary_data_block_size);
       hash_find(tbuf, total_len, computed_hash, CRYPTO_AUTH_ALG_SHA256);
@@ -192,6 +202,11 @@
     case AVB_ALGORITHM_TYPE_SHA512_RSA4096:
     case AVB_ALGORITHM_TYPE_SHA512_RSA8192:
       computed_hash = avb_malloc(AVB_SHA512_DIGEST_SIZE);
+      if(computed_hash == NULL)
+      {
+           avb_error("Failed to allocate memory.\n");
+           goto out;
+      }
       avb_sha512_init(&sha512_ctx);
       avb_sha512_update(
           &sha512_ctx, header_block, sizeof(AvbVBMetaImageHeader));
diff --git a/platform/msm_shared/boot_verifier.c b/platform/msm_shared/boot_verifier.c
index 95feec5..b89e792 100644
--- a/platform/msm_shared/boot_verifier.c
+++ b/platform/msm_shared/boot_verifier.c
@@ -647,9 +647,10 @@
 
 	if(sig != NULL)
 		VERIFIED_BOOT_SIG_free(sig);
-	*bootstate = dev_boot_state;
+
 	if(bootstate == NULL)
 		goto verify_image_error;
+	*bootstate = dev_boot_state;
 
 verify_image_error:
 	free(signature);
diff --git a/platform/msm_shared/display_menu.c b/platform/msm_shared/display_menu.c
index b45b61f..5f4582f 100644
--- a/platform/msm_shared/display_menu.c
+++ b/platform/msm_shared/display_menu.c
@@ -41,19 +41,30 @@
 #include <target.h>
 #include <sys/types.h>
 #include <../../../app/aboot/devinfo.h>
+#include <../../../app/aboot/recovery.h>
 
-static const char *unlock_menu_common_msg = "If you unlock the bootloader, "\
-				"you will be able to install "\
-				"custom operating system on this phone.\n\n"\
-				"A custom OS is not subject to the same testing "\
-				"as the original OS, "\
-				"and can cause your phone and installed "\
-				"applications to stop working properly.\n\n"\
+static const char *unlock_menu_common_msg = "By unlocking the bootloader, you will be able to install "\
+				"custom operating system on this phone. "\
+				"A custom OS is not subject to the same level of testing "\
+				"as the original OS, and can cause your phone "\
+				"and installed applications to stop working properly.\n\n"\
+				"Software integrity cannot be guaranteed with a custom OS, "\
+				"so any data stored on the phone while the bootloader "\
+				"is unlocked may be at risk.\n\n"\
 				"To prevent unauthorized access to your personal data, "\
 				"unlocking the bootloader will also delete all personal "\
-				"data from your phone(a \"factory data reset\").\n\n"\
-				"Press the Volume Up/Down buttons to select Yes "\
-				"or No. Then press the Power button to continue.\n";
+				"data on your phone.\n\n"\
+				"Press the Volume keys to select whether to unlock the bootloader, "\
+				"then the Power Button to continue.\n\n";
+
+static const char *lock_menu_common_msg = "If you lock the bootloader, "\
+				"you will not be able to install "\
+				"custom operating system on this phone.\n\n"\
+				"To prevent unauthorized access to your personal data, "\
+				"locking the bootloader will also delete all personal "\
+				"data on your phone.\n\n"\
+				"Press the Volume keys to select whether to "\
+				"lock the bootloader, then the power button to continue.\n\n";
 
 #define YELLOW_WARNING_MSG	"Your device has loaded a different operating system\n\n "\
 				"Visit this link on another device:\n"
@@ -107,6 +118,18 @@
 		[3] = "Power off\n",
 		[4] = "Boot to FFBM\n"};
 
+static struct unlock_info munlock_info[] = {
+		[DISPLAY_MENU_LOCK] = {UNLOCK, FALSE},
+		[DISPLAY_MENU_UNLOCK] = {UNLOCK, TRUE},
+		[DISPLAY_MENU_LOCK_CRITICAL] = {UNLOCK_CRITICAL, FALSE},
+		[DISPLAY_MENU_UNLOCK_CRITICAL] = {UNLOCK_CRITICAL, TRUE},
+};
+
+struct unlock_option_msg munlock_option_msg[] = {
+		[TRUE] = {"DO NOT UNLOCK THE BOOTLOADER \n", "UNLOCK THE BOOTLOADER \n"},
+		[FALSE] = {"DO NOT LOCK THE BOOTLOADER \n", "LOCK THE BOOTLOADER \n"},
+};
+
 static int big_factor = 2;
 static int common_factor = 1;
 
@@ -212,40 +235,71 @@
 	return str_target;
 }
 
+/**
+  Reset device unlock status
+  @param[in] Type    The type of the unlock.
+                     [DISPLAY_MENU_UNLOCK]: unlock the device
+                     [DISPLAY_MENU_UNLOCK_CRITICAL]: critical unlock the device
+                     [DISPLAY_MENU_LOCK]: lock the device
+                     [DISPLAY_MENU_LOCK_CRITICAL]: critical lock the device
+ **/
+void reset_device_unlock_status (int type)
+{
+	struct recovery_message msg;
+
+	if (type == DISPLAY_MENU_LOCK ||
+		type == DISPLAY_MENU_UNLOCK ||
+		type == DISPLAY_MENU_LOCK_CRITICAL ||
+		type == DISPLAY_MENU_UNLOCK_CRITICAL) {
+		set_device_unlock_value (munlock_info[type].unlock_type,
+				munlock_info[type].unlock_value);
+		memset(&msg, 0, sizeof(msg));
+		snprintf(msg.recovery, sizeof(msg.recovery), "recovery\n--wipe_data");
+		write_misc(0, &msg, sizeof(msg));
+	}
+}
+
 /* msg_lock need to be holded when call this function. */
-void display_unlock_menu_renew(struct select_msg_info *unlock_msg_info, int type)
+static void display_unlock_menu_renew(struct select_msg_info *unlock_msg_info,
+                                      int type, bool status)
 {
 	fbcon_clear();
 	memset(&unlock_msg_info->info, 0, sizeof(struct menu_info));
 
-	display_fbcon_menu_message("Unlock bootloader?\n",
+	display_fbcon_menu_message("<!>\n\n",
 		FBCON_UNLOCK_TITLE_MSG, big_factor);
-	fbcon_draw_line(FBCON_COMMON_MSG);
 
-	display_fbcon_menu_message((char*)unlock_menu_common_msg,
-		FBCON_COMMON_MSG, common_factor);
+	if (status) {
+		display_fbcon_menu_message((char*)unlock_menu_common_msg,
+			FBCON_COMMON_MSG, common_factor);
+	} else {
+		display_fbcon_menu_message((char*)lock_menu_common_msg,
+			FBCON_COMMON_MSG, common_factor);
+	}
+
 	fbcon_draw_line(FBCON_COMMON_MSG);
 	unlock_msg_info->info.option_start[0] = fbcon_get_current_line();
-	display_fbcon_menu_message("Yes\n",
-		FBCON_COMMON_MSG, big_factor);
+	display_fbcon_menu_message((char *)munlock_option_msg[status].ignore_msg,
+                               FBCON_COMMON_MSG, common_factor);
 	unlock_msg_info->info.option_bg[0] = fbcon_get_current_bg();
-	display_fbcon_menu_message("Unlock bootloader(may void warranty)\n",
-		FBCON_COMMON_MSG, common_factor);
 	unlock_msg_info->info.option_end[0] = fbcon_get_current_line();
 	fbcon_draw_line(FBCON_COMMON_MSG);
 	unlock_msg_info->info.option_start[1] = fbcon_get_current_line();
-	display_fbcon_menu_message("No\n",
-		FBCON_COMMON_MSG, big_factor);
+	display_fbcon_menu_message((char *)munlock_option_msg[status].comfirm_msg,
+                               FBCON_COMMON_MSG, common_factor);
 	unlock_msg_info->info.option_bg[1] = fbcon_get_current_bg();
-	display_fbcon_menu_message("Do not unlock bootloader and restart phone\n",
-		FBCON_COMMON_MSG, common_factor);
 	unlock_msg_info->info.option_end[1] = fbcon_get_current_line();
 	fbcon_draw_line(FBCON_COMMON_MSG);
 
-	if (type == UNLOCK)
+	if (type == UNLOCK) {
 		unlock_msg_info->info.msg_type = DISPLAY_MENU_UNLOCK;
-	else if (type == UNLOCK_CRITICAL)
+		if (!status)
+			unlock_msg_info->info.msg_type = DISPLAY_MENU_LOCK;
+	} else if (type == UNLOCK_CRITICAL) {
 		unlock_msg_info->info.msg_type = DISPLAY_MENU_UNLOCK_CRITICAL;
+		if (!status)
+			unlock_msg_info->info.msg_type = DISPLAY_MENU_LOCK_CRITICAL;
+	}
 
 	unlock_msg_info->info.option_num = 2;
 
@@ -477,7 +531,7 @@
 /* The fuction be called after device in fastboot mode,
  * so it's no need to initialize the msg_lock again
  */
-void display_unlock_menu(int type)
+void display_unlock_menu(int type, bool status)
 {
 	struct select_msg_info *unlock_menu_msg_info;
 	unlock_menu_msg_info = &msg_info;
@@ -494,10 +548,11 @@
 	unlock_menu_msg_info->last_msg_type =
 		unlock_menu_msg_info->info.msg_type;
 
-	display_unlock_menu_renew(unlock_menu_msg_info, type);
+	display_unlock_menu_renew(unlock_menu_msg_info, type, status);
 	mutex_release(&unlock_menu_msg_info->msg_lock);
 
-	dprintf(INFO, "creating unlock keys detect thread\n");
+	dprintf(INFO, "creating %s keys detect thread\n",
+		status ? "unlock":"lock");
 	display_menu_thread_start(unlock_menu_msg_info);
 }
 
diff --git a/platform/msm_shared/include/display_menu.h b/platform/msm_shared/include/display_menu.h
index 5320be6..f063f03 100644
--- a/platform/msm_shared/include/display_menu.h
+++ b/platform/msm_shared/include/display_menu.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2016, 2018, The Linux Foundation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -44,6 +44,8 @@
 	DISPLAY_MENU_UNLOCK_CRITICAL,
 	DISPLAY_MENU_LOGGING,
 	DISPLAY_MENU_EIO,
+	DISPLAY_MENU_LOCK,
+	DISPLAY_MENU_LOCK_CRITICAL,
 };
 
 struct menu_info {
@@ -64,14 +66,24 @@
 	mutex_t			msg_lock;
 };
 
+struct unlock_option_msg {
+	const char *ignore_msg;
+	const char *comfirm_msg;
+};
+
+struct unlock_info{
+	int unlock_type;
+	boolean unlock_value;
+ };
+
 void wait_for_users_action(void);
-void display_unlock_menu_renew(struct select_msg_info *msg_info, int type);
+void reset_device_unlock_status (int type);
 void display_bootverify_menu_renew(struct select_msg_info *msg_info, int type);
 void display_bootverify_option_menu_renew(struct select_msg_info *msg_info);
 void display_fastboot_menu_renew(struct select_msg_info *fastboot_msg_info);
 void display_bootverify_menu(int type);
 void display_fastboot_menu();
-void display_unlock_menu(int type);
+void display_unlock_menu(int type, bool status);
 void msg_lock_init();
 void exit_menu_keys_detection();
 #endif				/* __PLATFORM_MSM_SHARED_DISPLAY_MENU_H */
diff --git a/platform/msm_shared/menu_keys_detect.c b/platform/msm_shared/menu_keys_detect.c
index 3a81b70..6b552e8 100644
--- a/platform/msm_shared/menu_keys_detect.c
+++ b/platform/msm_shared/menu_keys_detect.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -94,8 +94,8 @@
 };
 
 static uint32_t unlock_index_action[] = {
-		[0] = RECOVER,
-		[1] = RESTART,
+		[0] = RESTART,
+		[1] = RECOVER,
 };
 
 static int is_key_pressed(int keys_type)
@@ -118,21 +118,7 @@
 	fbcon_clear();
 	switch (reason) {
 		case RECOVER:
-			if (msg_info->info.msg_type == DISPLAY_MENU_UNLOCK) {
-				set_device_unlock_value(UNLOCK, TRUE);
-			} else if (msg_info->info.msg_type == DISPLAY_MENU_UNLOCK_CRITICAL) {
-				set_device_unlock_value(UNLOCK_CRITICAL, TRUE);
-			}
-
-			if (msg_info->info.msg_type == DISPLAY_MENU_UNLOCK ||
-				msg_info->info.msg_type == DISPLAY_MENU_UNLOCK_CRITICAL) {
-				/* wipe data */
-				struct recovery_message msg;
-
-				memset(&msg, 0, sizeof(msg));
-				snprintf(msg.recovery, sizeof(msg.recovery), "recovery\n--wipe_data");
-				write_misc(0, &msg, sizeof(msg));
-			}
+			reset_device_unlock_status(msg_info->info.msg_type);
 			reboot_device(RECOVERY_MODE);
 			break;
 		case RESTART:
@@ -145,8 +131,6 @@
 			reboot_device(FASTBOOT_MODE);
 			break;
 		case CONTINUE:
-			display_image_on_screen();
-
 			/* Continue boot, no need to detect the keys'status */
 			msg_info->info.is_exit = true;
 			break;
@@ -267,6 +251,8 @@
 			break;
 		case DISPLAY_MENU_UNLOCK:
 		case DISPLAY_MENU_UNLOCK_CRITICAL:
+		case DISPLAY_MENU_LOCK:
+		case DISPLAY_MENU_LOCK_CRITICAL:
 			if(msg_info->info.option_index < ARRAY_SIZE(unlock_index_action))
 				reason = unlock_index_action[msg_info->info.option_index];
 			break;
@@ -308,6 +294,16 @@
 		menu_volume_down_func,
 		power_key_func,
 	},
+	[DISPLAY_MENU_LOCK] = {
+		menu_volume_up_func,
+		menu_volume_down_func,
+		power_key_func,
+	},
+	[DISPLAY_MENU_LOCK_CRITICAL] = {
+		menu_volume_up_func,
+		menu_volume_down_func,
+		power_key_func,
+	},
 	[DISPLAY_MENU_YELLOW] = {
 		boot_warning_volume_keys_func,
 		boot_warning_volume_keys_func,
diff --git a/platform/msm_shared/smem.h b/platform/msm_shared/smem.h
index 7f0095b..51692e0 100644
--- a/platform/msm_shared/smem.h
+++ b/platform/msm_shared/smem.h
@@ -471,7 +471,9 @@
 	SDM632 = 349,
 	SDA632 = 350,
 	SDM429 = 354,
-	SDM439 = 353
+	SDM439 = 353,
+	SDA429 = 364,
+	SDA439 = 363
 };
 
 enum platform {
diff --git a/project/msm8952.mk b/project/msm8952.mk
index 7bfc1b5..668d241 100644
--- a/project/msm8952.mk
+++ b/project/msm8952.mk
@@ -19,10 +19,11 @@
 DEFINES += DISPLAY_SPLASH_SCREEN=1
 endif
 
-ifeq ($(VERIFIED_BOOT),1)
-ENABLE_MDTP_SUPPORT := 1
 ENABLE_SECAPP_LOADER := 1
 ENABLE_RPMB_SUPPORT := 1
+
+ifeq ($(VERIFIED_BOOT),1)
+ENABLE_MDTP_SUPPORT := 1
 #enable fbcon display menu
 ifneq (,$(findstring DISPLAY_SPLASH_SCREEN,$(DEFINES)))
 ENABLE_FBCON_DISPLAY_MSG := 1
@@ -31,7 +32,12 @@
 endif #DISPLAY_SPLASH_SCREEN END
 endif #VERIFIED_BOOT
 
-
+ifeq ($(VERIFIED_BOOT_2),1)
+ifneq (,$(findstring DISPLAY_SPLASH_SCREEN,$(DEFINES)))
+#enable fbcon display menu
+  ENABLE_FBCON_DISPLAY_MSG := 1
+endif
+endif
 
 ENABLE_SMD_SUPPORT := 1
 ENABLE_PWM_SUPPORT := true
diff --git a/target/init.c b/target/init.c
index 5ec4ab6..80c95c3 100644
--- a/target/init.c
+++ b/target/init.c
@@ -292,6 +292,8 @@
 		case SDA632:
 		case SDM429:
 		case SDM439:
+		case SDA429:
+		case SDA439:
 		/* SDCC HC DDR CONFIG has shifted by 4 bytes for these platform */
 			ret += 4;
 			break;
@@ -378,6 +380,8 @@
 		case SDA632:
 		case SDM429:
 		case SDM439:
+		case SDA429:
+		case SDA439:
 			config->vib_type = VIB_LRA_TYPE;
 			config->hap_rate_cfg1 = QPNP_HAP_RATE_CFG1_41;
 			config->hap_rate_cfg2 = QPNP_HAP_RATE_CFG2_03;
diff --git a/target/msm8909/oem_panel.c b/target/msm8909/oem_panel.c
index deb6024..bb3bc07 100644
--- a/target/msm8909/oem_panel.c
+++ b/target/msm8909/oem_panel.c
@@ -431,6 +431,7 @@
 		pinfo->mipi.num_of_panel_off_cmds
 					= AUO_390P_CMD_OFF_COMMAND;
 		memcpy(phy_db->timing, auo_390p_cmd_timings, TIMING_SIZE);
+		panelstruct->paneldata->panel_with_enable_gpio = 1;
 		break;
 	case ST7789v2_QVGA_SPI_CMD_PANEL:
 		panelstruct->paneldata		= &st7789v2_qvga_cmd_panel_data;
diff --git a/target/msm8909/target_display.c b/target/msm8909/target_display.c
index a3d5848..c7c0ee0 100644
--- a/target/msm8909/target_display.c
+++ b/target/msm8909/target_display.c
@@ -325,6 +325,7 @@
 		};
 
 		pm8x41_gpio_config(bob_pmic_gpio, &bobgpio_param);
+		enable_gpio.pin_id = 59;
 	}
 
 	if (enable) {
diff --git a/target/msm8952/init.c b/target/msm8952/init.c
index b748803..1489467 100644
--- a/target/msm8952/init.c
+++ b/target/msm8952/init.c
@@ -329,7 +329,6 @@
 	if (target_use_signed_kernel())
 		target_crypto_init_params();
 
-#if VERIFIED_BOOT
 	if (VB_M <= target_get_vb_version())
 	{
 		clock_ce_enable(CE1_INSTANCE);
@@ -363,7 +362,6 @@
 			ASSERT(0);
 		}
 	}
-#endif
 
 #if SMD_SUPPORT
 	rpm_smd_init();
@@ -416,6 +414,8 @@
 	case APQ8076:
 	case APQ8037:
 	case APQ8017:
+	case SDA429:
+	case SDA439:
 		board->baseband = BASEBAND_APQ;
 		break;
 	default:
@@ -494,7 +494,6 @@
 	if (target_is_ssd_enabled())
 		clock_ce_disable(CE1_INSTANCE);
 
-#if VERIFIED_BOOT
 	if (VB_M <= target_get_vb_version())
 	{
 		if (is_sec_app_loaded())
@@ -514,7 +513,6 @@
 
 		clock_ce_disable(CE1_INSTANCE);
 	}
-#endif
 
 #if SMD_SUPPORT
 	rpm_smd_uninit();