diff --git a/device/testing/device-samsung-hero2lte/APKBUILD b/device/testing/device-samsung-hero2lte/APKBUILD
index a159569bc..2f0be2e06 100644
--- a/device/testing/device-samsung-hero2lte/APKBUILD
+++ b/device/testing/device-samsung-hero2lte/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=device-samsung-hero2lte
 pkgdesc="Samsung Galaxy S7 edge"
 pkgver=0.1
-pkgrel=4
+pkgrel=5
 url="https://postmarketos.org"
 license="MIT"
 arch="aarch64"
@@ -10,6 +10,7 @@ options="!check !archcheck"
 depends="postmarketos-base linux-samsung-hero2lte mkbootimg mesa-dri-swrast msm-fb-refresher"
 makedepends="devicepkg-dev"
 source="deviceinfo initfs-hook.sh"
+subpackages="$pkgname-nonfree-firmware:nonfree_firmware"
 
 build() {
 	devicepkg_build $startdir $pkgname
@@ -19,6 +20,11 @@ package() {
 	devicepkg_package $startdir $pkgname
 }
 
+nonfree_firmware() {
+	pkgdesc="Non-free firmware for Wi-Fi on the Samsung Galaxy S7 (edge)"
+	depends="firmware-samsung-hero"
+	mkdir "$subpkgdir"
+}
 
 sha512sums="30fb43383b8149ce9fc67cee4b4abaabcbb04e0e9e53475c5d3cd82f64f1ea90ea744c9b4ee659211e83054c51c2eb6d713235c8f6d955c2097370f204b9dbe3  deviceinfo
 5a7be3cb8835ffb3783fcd4539de04f7f006c726ac9aea35cdca9e90b2877dc36cf4e314851bf9078f4b2dac061b7265866792d92a79f5232c56a0e17f7910b1  initfs-hook.sh"
diff --git a/device/testing/linux-samsung-hero2lte/02-fix-dtbtool.patch b/device/testing/linux-samsung-hero2lte/02-fix-dtbtool.patch
deleted file mode 100644
index 681b6ee86..000000000
--- a/device/testing/linux-samsung-hero2lte/02-fix-dtbtool.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-Exynos devices have a special device tree image format, which the built in
-script in this kernel source facilitates.
-Unfortunately, the script is badly written in the part where command line
-arguments are parsed, so this fixes it to create a valid dtb.
-
-diff --git a/scripts/dtbtool_exynos/dtbtool.c b/scripts/dtbtool_exynos/dtbtool.c
-index f72fe8662ee..cacd8c69a32 100644
---- a/scripts/dtbtool_exynos/dtbtool.c
-+++ b/scripts/dtbtool_exynos/dtbtool.c
-@@ -378,13 +378,14 @@ int main(int argc, char **argv)
- 			dt_subtype_code = strtoul(val, 0, 16);
- 		} else if (*arg != '-') {
- 			/* skip over already allocated file names */
--			for (; dtb_files[dt_count]; dt_count++)
--				if (dt_count >= DTB_MAX)
--					fail("reached dtb file limit (%d)", DTB_MAX);
--
--			dtb_files[dt_count] = strdup(arg);
--			if (!dtb_files[dt_count])
--				fail("failed to allocate memory");
-+			for (; dtb_files[dt_count]; dt_count++) {
-+                if (dt_count >= DTB_MAX) {
-+                    fail("reached dtb file limit (%d)", DTB_MAX);
-+                } else {
-+                    dtb_files[dt_count] = strdup(arg);
-+                    if (!dtb_files[dt_count]) fail("failed to allocate memory");
-+                }
-+            }
- 		} else
- 			usage();
- 	}
diff --git a/device/testing/linux-samsung-hero2lte/APKBUILD b/device/testing/linux-samsung-hero2lte/APKBUILD
index 005ff212a..7891a46be 100644
--- a/device/testing/linux-samsung-hero2lte/APKBUILD
+++ b/device/testing/linux-samsung-hero2lte/APKBUILD
@@ -2,7 +2,7 @@
 # Kernel config based on: arch/arm64/configs/exynos8890-hero2lte_defconfig
 
 pkgname=linux-samsung-hero2lte
-pkgver=3.18.133
+pkgver=3.18.140
 pkgrel=0
 pkgdesc="Samsung Galaxy S7 edge kernel fork"
 arch="aarch64"
@@ -11,17 +11,16 @@ _flavor="samsung-hero2lte"
 url="https://kernel.org"
 license="GPL-2.0-only"
 options="!strip !check !tracedeps pmb:cross-native"
-makedepends="perl sed installkernel bash gmp-dev bc linux-headers elfutils-dev devicepkg-dev dtbtool"
+makedepends="perl sed installkernel bash gmp-dev bc linux-headers elfutils-dev devicepkg-dev dtbtool-exynos"
 
 # Source - use Ivan Meler's 3.18 upstream kernel
 _repository="android_kernel_samsung_herolte"
-_commit="24b577569468748591f7be6435af67e17b532886"
+_commit="4f50ed696fc6ec36d277ba1af73e98d34e7bc0d6"
 _config="config-$_flavor.$arch"
 source="
 	$pkgname-$_commit.tar.gz::https://github.com/ivanmeler/$_repository/archive/$_commit.tar.gz
 	$_config
 	01-remove-android-defines.patch
-	02-fix-dtbtool.patch
 "
 builddir="$srcdir/$_repository-$_commit"
 
@@ -34,18 +33,23 @@ build() {
 	unset LDFLAGS
 	make ARCH="$_carch" CC="${CC:-gcc}" \
 		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-postmarketOS"
-	# Note: the DTB for this kernel is built in tree, we just need to copy it.
+
+	# Build dt image with exynos dtbtool
+	dtbTool-exynos --pagesize 2048 \
+		--platform 0x50a6 \
+		--subtype 0x217584da \
+		-o "arch/arm64/boot/dt.img" \
+		"arch/arm64/boot/dts/exynos8890-hero2lte_eur_open_08.dtb"
 }
 
 package() {
 	downstreamkernel_package "$builddir" "$pkgdir" "$_carch" "$_flavor"
 
 	# Copy the in-tree DTBH block image
-	install -Dm644 "$builddir/arch/arm64/boot/dtb.img" \
+	install -Dm644 "$builddir/arch/arm64/boot/dt.img" \
 		"$pkgdir/boot/dt.img"
 }
 
-sha512sums="59c128754698259ad7f759def8a82b3f0756404bfe8b474df375c6af0a45b9875ba9a00acca5605b8dcebff4fa5ca1cd20d84d3f398999fe38c3f5837690848c  linux-samsung-hero2lte-24b577569468748591f7be6435af67e17b532886.tar.gz
-5d70395fec802bc2f925ec2b5f2f138ae988aa61720c82b986310a23ed401949bdca263401918a4f769a477aa98ca4ec2aab1b3dbe0eabfbb856af9f2d99e129  config-samsung-hero2lte.aarch64
-66e27a174e12d56f5b77932985f0001b551c834d68b2a1bcc1d0b7d04e555757fc9137c182bd4cf5ffd57bf2cb0918d758dfe153a6140b77f02e7b9f33ecfb2c  01-remove-android-defines.patch
-59b7151edece9fec879c12fe53fa4a7d34563c9b7ed45fa5e96036bde7616cac0976adeef54a5f36d883d51747831881b2586ac02ac47db4123c399cf98e93d8  02-fix-dtbtool.patch"
+sha512sums="28a447fca84c3c1bc95b505362a989964e652ff0c11a8f99e151225c4a29971c7698c846c7826552fcdc4acff799b3150e577892df88697776ce13cd0e76ac5f  linux-samsung-hero2lte-4f50ed696fc6ec36d277ba1af73e98d34e7bc0d6.tar.gz
+82229708af7c4b310a36d54fae49419d4028ff2e08ed953628b06afce5d6247e28e3d9342292b2ac9f00bb63f9ac4f4131dbedab5be494bb91ea595c1264bc87  config-samsung-hero2lte.aarch64
+66e27a174e12d56f5b77932985f0001b551c834d68b2a1bcc1d0b7d04e555757fc9137c182bd4cf5ffd57bf2cb0918d758dfe153a6140b77f02e7b9f33ecfb2c  01-remove-android-defines.patch"
diff --git a/device/testing/linux-samsung-hero2lte/config-samsung-hero2lte.aarch64 b/device/testing/linux-samsung-hero2lte/config-samsung-hero2lte.aarch64
index acd3536ac..01136b1bc 100644
--- a/device/testing/linux-samsung-hero2lte/config-samsung-hero2lte.aarch64
+++ b/device/testing/linux-samsung-hero2lte/config-samsung-hero2lte.aarch64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 3.18.133 Kernel Configuration
+# Linux/arm64 3.18.140 Kernel Configuration
 #
 CONFIG_ARM64=y
 CONFIG_64BIT=y
@@ -563,10 +563,7 @@ CONFIG_EXYNOS_BIG_FREQ_BOOST=y
 # Control Flow Protection
 #
 CONFIG_RKP_CFP_JOPP_MAGIC=0xb3ea3bad
-CONFIG_EXYNOS_DTBTOOL=y
-CONFIG_EXYNOS_DTBH_PLATFORM_CODE=0x50a6
-CONFIG_EXYNOS_DTBH_SUBTYPE_CODE=0x217584da
-CONFIG_EXYNOS_DTBH_PAGE_SIZE=2048
+# CONFIG_EXYNOS_DTBTOOL is not set
 CONFIG_NET=y
 CONFIG_COMPAT_NETLINK_MESSAGES=y
 
@@ -1688,8 +1685,8 @@ CONFIG_BCM4359=y
 # CONFIG_BCM43455 is not set
 # CONFIG_BCM4334W is not set
 # CONFIG_BCM43454 is not set
-CONFIG_BCMDHD_FW_PATH="/vendor/etc/wifi/bcmdhd_sta.bin"
-CONFIG_BCMDHD_NVRAM_PATH="/vendor/etc/wifi/nvram_net.txt"
+CONFIG_BCMDHD_FW_PATH="/lib/firmware/postmarketos/bcmdhd_sta.bin"
+CONFIG_BCMDHD_NVRAM_PATH="/lib/firmware/postmarketos/nvram_net.txt"
 CONFIG_BROADCOM_WIFI_RESERVED_MEM=y
 # CONFIG_WIFI_BROADCOM_COB is not set
 CONFIG_WLAN_REGION_CODE=100
@@ -1950,6 +1947,7 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_NOZOMI is not set
 # CONFIG_N_GSM is not set
 # CONFIG_TRACE_SINK is not set
+CONFIG_LDISC_AUTOLOAD=y
 # CONFIG_DEVMEM is not set
 # CONFIG_DEVKMEM is not set
 
@@ -1994,7 +1992,6 @@ CONFIG_EXYRNG_FIPS_COMPLIANCE=y
 # CONFIG_EXYRNG_FAIL_POLICY_DISABLE is not set
 CONFIG_EXYRNG_FAIL_POLICY_RESET=y
 CONFIG_EXYRNG_USE_CRYPTOMANAGER=y
-# CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
 
 #