Merge "sdm : Allow configurable sdm layer limit for external"
diff --git a/libgralloc/alloc_controller.cpp b/libgralloc/alloc_controller.cpp
index c5ec276..ae167ba 100644
--- a/libgralloc/alloc_controller.cpp
+++ b/libgralloc/alloc_controller.cpp
@@ -59,16 +59,24 @@
 #define ION_FLAG_ALLOW_NON_CONTIG 0
 #endif
 
+#ifndef ION_FLAG_CP_CAMERA_PREVIEW
+#define ION_FLAG_CP_CAMERA_PREVIEW 0
+#endif
+
 #ifdef MASTER_SIDE_CP
 #define CP_HEAP_ID ION_SECURE_HEAP_ID
 #define SD_HEAP_ID ION_SECURE_DISPLAY_HEAP_ID
 #define ION_CP_FLAGS (ION_SECURE | ION_FLAG_CP_PIXEL)
 #define ION_SD_FLAGS (ION_SECURE | ION_FLAG_CP_SEC_DISPLAY)
+#define ION_SC_FLAGS (ION_SECURE | ION_FLAG_CP_CAMERA)
+#define ION_SC_PREVIEW_FLAGS (ION_SECURE | ION_FLAG_CP_CAMERA_PREVIEW)
 #else // SLAVE_SIDE_CP
 #define CP_HEAP_ID ION_CP_MM_HEAP_ID
 #define SD_HEAP_ID CP_HEAP_ID
 #define ION_CP_FLAGS (ION_SECURE | ION_FLAG_ALLOW_NON_CONTIG)
 #define ION_SD_FLAGS ION_SECURE
+#define ION_SC_FLAGS ION_SECURE
+#define ION_SC_PREVIEW_FLAGS ION_SECURE
 #endif
 
 using namespace gralloc;
@@ -473,6 +481,9 @@
              * VM. Please add it to the define once available.
              */
             ionFlags |= ION_SD_FLAGS;
+        } else if (usage & GRALLOC_USAGE_HW_CAMERA_MASK) {
+            ionHeapId = ION_HEAP(SD_HEAP_ID);
+            ionFlags |= (usage & GRALLOC_USAGE_HW_COMPOSER) ? ION_SC_PREVIEW_FLAGS : ION_SC_FLAGS;
         } else {
             ionHeapId = ION_HEAP(CP_HEAP_ID);
             ionFlags |= ION_CP_FLAGS;
diff --git a/libgralloc/gpu.cpp b/libgralloc/gpu.cpp
index 8bae926..545903a 100644
--- a/libgralloc/gpu.cpp
+++ b/libgralloc/gpu.cpp
@@ -74,7 +74,8 @@
         data.align = getpagesize();
 
     if (usage & GRALLOC_USAGE_PROTECTED) {
-            if (usage & GRALLOC_USAGE_PRIVATE_SECURE_DISPLAY) {
+            if ((usage & GRALLOC_USAGE_PRIVATE_SECURE_DISPLAY) ||
+                (usage & GRALLOC_USAGE_HW_CAMERA_MASK)) {
                 /* The alignment here reflects qsee mmu V7L/V8L requirement */
                 data.align = SZ_2M;
             } else {
diff --git a/libgralloc/mapper.cpp b/libgralloc/mapper.cpp
index d8880ef..15bb71a 100644
--- a/libgralloc/mapper.cpp
+++ b/libgralloc/mapper.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 The Android Open Source Project
- * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -55,6 +55,27 @@
     return memalloc;
 }
 
+static int gralloc_map_metadata(buffer_handle_t handle) {
+    private_handle_t* hnd = (private_handle_t*)handle;
+    hnd->base_metadata = 0;
+    IMemAlloc* memalloc = getAllocator(hnd->flags) ;
+    void *mappedAddress = MAP_FAILED;
+    unsigned int size = 0;
+    if (!(hnd->flags & private_handle_t::PRIV_FLAGS_FRAMEBUFFER)) {
+        mappedAddress = MAP_FAILED;
+        size = ROUND_UP_PAGESIZE(sizeof(MetaData_t));
+        int ret = memalloc->map_buffer(&mappedAddress, size,
+                                       hnd->offset_metadata, hnd->fd_metadata);
+        if(ret || mappedAddress == MAP_FAILED) {
+            ALOGE("Could not mmap metadata for handle %p, fd=%d (%s)",
+                  hnd, hnd->fd_metadata, strerror(errno));
+            return -errno;
+        }
+        hnd->base_metadata = uint64_t(mappedAddress) + hnd->offset_metadata;
+    }
+    return 0;
+}
+
 static int gralloc_map(gralloc_module_t const* module,
                        buffer_handle_t handle)
 {
@@ -68,7 +89,6 @@
     IMemAlloc* memalloc = getAllocator(hnd->flags) ;
     void *mappedAddress = MAP_FAILED;
     hnd->base = 0;
-    hnd->base_metadata = 0;
 
     // Dont map framebuffer and secure buffers
     if (!(hnd->flags & private_handle_t::PRIV_FLAGS_FRAMEBUFFER) &&
@@ -83,23 +103,21 @@
         }
 
         hnd->base = uint64_t(mappedAddress) + hnd->offset;
+    } else {
+        // Cannot map secure buffers or framebuffers, but still need to map
+        // metadata for secure buffers.
+        // If mapping a secure buffers fails, the framework needs to get
+        // an error code.
+        err = -EACCES;
     }
 
     //Allow mapping of metadata for all buffers including secure ones, but not
     //of framebuffer
-    if (!(hnd->flags & private_handle_t::PRIV_FLAGS_FRAMEBUFFER)) {
-        mappedAddress = MAP_FAILED;
-        size = ROUND_UP_PAGESIZE(sizeof(MetaData_t));
-        err = memalloc->map_buffer(&mappedAddress, size,
-                                       hnd->offset_metadata, hnd->fd_metadata);
-        if(err || mappedAddress == MAP_FAILED) {
-            ALOGE("Could not mmap handle %p, fd=%d (%s)",
-                  handle, hnd->fd_metadata, strerror(errno));
-            return -errno;
-        }
-        hnd->base_metadata = uint64_t(mappedAddress) + hnd->offset_metadata;
+    int metadata_err = gralloc_map_metadata(handle);
+    if (!err) {
+        err = metadata_err;
     }
-    return 0;
+    return err;
 }
 
 static int gralloc_unmap(gralloc_module_t const* module,
@@ -153,20 +171,11 @@
     if (!module || private_handle_t::validate(handle) < 0)
         return -EINVAL;
 
-    /* NOTE: we need to initialize the buffer as not mapped/not locked
-     * because it shouldn't when this function is called the first time
-     * in a new process. Ideally these flags shouldn't be part of the
-     * handle, but instead maintained in the kernel or at least
-     * out-of-line
-     */
-
-    int err = gralloc_map(module, handle);
-    if (err) {
-        ALOGE("%s: gralloc_map failed", __FUNCTION__);
-        return err;
-    }
-
-    return 0;
+    int err =  gralloc_map(module, handle);
+    /* Do not fail register_buffer for secure buffers*/
+    if (err == -EACCES)
+        err = 0;
+    return err;
 }
 
 int gralloc_unregister_buffer(gralloc_module_t const* module,
diff --git a/libgralloc1/gr_allocator.cpp b/libgralloc1/gr_allocator.cpp
index 1a269be..32bc4ef 100644
--- a/libgralloc1/gr_allocator.cpp
+++ b/libgralloc1/gr_allocator.cpp
@@ -48,16 +48,24 @@
 #define ION_FLAG_ALLOW_NON_CONTIG 0
 #endif
 
+#ifndef ION_FLAG_CP_CAMERA_PREVIEW
+#define ION_FLAG_CP_CAMERA_PREVIEW 0
+#endif
+
 #ifdef MASTER_SIDE_CP
 #define CP_HEAP_ID ION_SECURE_HEAP_ID
 #define SD_HEAP_ID ION_SECURE_DISPLAY_HEAP_ID
 #define ION_CP_FLAGS (ION_SECURE | ION_FLAG_CP_PIXEL)
 #define ION_SD_FLAGS (ION_SECURE | ION_FLAG_CP_SEC_DISPLAY)
+#define ION_SC_FLAGS (ION_SECURE | ION_FLAG_CP_CAMERA)
+#define ION_SC_PREVIEW_FLAGS (ION_SECURE | ION_FLAG_CP_CAMERA_PREVIEW)
 #else  // SLAVE_SIDE_CP
 #define CP_HEAP_ID ION_CP_MM_HEAP_ID
 #define SD_HEAP_ID CP_HEAP_ID
 #define ION_CP_FLAGS (ION_SECURE | ION_FLAG_ALLOW_NON_CONTIG)
 #define ION_SD_FLAGS ION_SECURE
+#define ION_SC_FLAGS ION_SECURE
+#define ION_SC_PREVIEW_FLAGS ION_SECURE
 #endif
 
 namespace gralloc1 {
@@ -599,6 +607,13 @@
        * VM. Please add it to the define once available.
        */
       flags |= ION_SD_FLAGS;
+    } else if (prod_usage & GRALLOC1_PRODUCER_USAGE_CAMERA) {
+      heap_id = ION_HEAP(SD_HEAP_ID);
+      if (cons_usage & GRALLOC1_CONSUMER_USAGE_HWCOMPOSER) {
+        flags |= ION_SC_PREVIEW_FLAGS;
+      } else {
+        flags |= ION_SC_FLAGS;
+      }
     } else {
       heap_id = ION_HEAP(CP_HEAP_ID);
       flags |= ION_CP_FLAGS;
diff --git a/libgralloc1/gr_buf_mgr.cpp b/libgralloc1/gr_buf_mgr.cpp
index 9bba82b..6c36345 100644
--- a/libgralloc1/gr_buf_mgr.cpp
+++ b/libgralloc1/gr_buf_mgr.cpp
@@ -285,7 +285,8 @@
   }
 
   if (prod_usage & GRALLOC1_PRODUCER_USAGE_PROTECTED) {
-    if (cons_usage & GRALLOC1_CONSUMER_USAGE_PRIVATE_SECURE_DISPLAY) {
+    if ((prod_usage & GRALLOC1_PRODUCER_USAGE_CAMERA) ||
+        (cons_usage & GRALLOC1_CONSUMER_USAGE_PRIVATE_SECURE_DISPLAY)) {
       // The alignment here reflects qsee mmu V7L/V8L requirement
       align = SZ_2M;
     } else {
diff --git a/sdm/include/core/buffer_allocator.h b/sdm/include/core/buffer_allocator.h
index 1b47f79..86cc02a 100644
--- a/sdm/include/core/buffer_allocator.h
+++ b/sdm/include/core/buffer_allocator.h
@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+* Copyright (c) 2015 - 2016, The Linux Foundation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -52,6 +52,8 @@
   bool secure = false;                        //!< Specifies buffer to be allocated from
                                               //!< secure region.
   bool cache = false;                         //!< Specifies whether the buffer needs to be cache.
+  bool secure_camera = false;                 //!< Specifies buffer to be allocated from specific
+                                              //!< secure heap and with a specific alignment.
 };
 
 /*! @brief Holds the information about the allocated buffer.
diff --git a/sdm/include/core/layer_buffer.h b/sdm/include/core/layer_buffer.h
index 55318eb..4f80f86 100644
--- a/sdm/include/core/layer_buffer.h
+++ b/sdm/include/core/layer_buffer.h
@@ -208,6 +208,10 @@
       uint32_t secure_display : 1;  //!< This flag shall be set by the client to indicate that the
                                     //!< secure display session is in progress. Secure display
                                     //!< session can not coexist with non-secure session.
+
+      uint32_t secure_camera : 1;   //!< This flag shall be set by the client to indicate that the
+                                    //!< buffer is associated with secure camera session. A secure
+                                    //!< camera layer can co-exist with non-secure layer(s).
     };
 
     uint32_t flags = 0;             //!< For initialization purpose only.
diff --git a/sdm/include/private/hw_info_types.h b/sdm/include/private/hw_info_types.h
index e3bd579..88384a8 100644
--- a/sdm/include/private/hw_info_types.h
+++ b/sdm/include/private/hw_info_types.h
@@ -265,6 +265,7 @@
   bool secure = false;
   uint32_t frame_rate = 0;
   LayerTransform transform;
+  bool secure_camera = false;
 
   bool operator==(const HWSessionConfig& config) const {
     return (src_rect == config.src_rect &&
@@ -272,7 +273,8 @@
             buffer_count == config.buffer_count &&
             secure == config.secure &&
             frame_rate == config.frame_rate &&
-            transform == config.transform);
+            transform == config.transform &&
+            secure_camera == config.secure_camera);
   }
 
   bool operator!=(const HWSessionConfig& config) const {
diff --git a/sdm/libs/core/fb/hw_device.cpp b/sdm/libs/core/fb/hw_device.cpp
index ecb5889..d06b161 100644
--- a/sdm/libs/core/fb/hw_device.cpp
+++ b/sdm/libs/core/fb/hw_device.cpp
@@ -744,7 +744,9 @@
     }
   }
 
-  if (input_buffer->flags.secure) {
+  if (input_buffer->flags.secure_camera) {
+    *mdp_flags |= MDP_LAYER_SECURE_CAMERA_SESSION;
+  } else if (input_buffer->flags.secure) {
     *mdp_flags |= MDP_LAYER_SECURE_SESSION;
   }
 
diff --git a/sdm/libs/core/fb/hw_device.h b/sdm/libs/core/fb/hw_device.h
index dce7648..72c7a13 100644
--- a/sdm/libs/core/fb/hw_device.h
+++ b/sdm/libs/core/fb/hw_device.h
@@ -45,6 +45,10 @@
 #define MDP_LAYER_MULTIRECT_PARALLEL_MODE 0
 #endif
 
+#ifndef MDP_LAYER_SECURE_CAMERA_SESSION
+#define MDP_LAYER_SECURE_CAMERA_SESSION 0
+#endif
+
 namespace sdm {
 class HWInfoInterface;
 
diff --git a/sdm/libs/hwc/hwc_buffer_allocator.cpp b/sdm/libs/hwc/hwc_buffer_allocator.cpp
index 7873627..906b96d 100644
--- a/sdm/libs/hwc/hwc_buffer_allocator.cpp
+++ b/sdm/libs/hwc/hwc_buffer_allocator.cpp
@@ -64,7 +64,11 @@
   int height = INT(buffer_config.height);
   int format;
 
-  if (buffer_config.secure) {
+  if (buffer_config.secure_camera) {
+    alloc_flags = GRALLOC_USAGE_HW_CAMERA_WRITE;
+    alloc_flags |= (GRALLOC_USAGE_PROTECTED | GRALLOC_USAGE_HW_COMPOSER);
+    data.align = SZ_2M;
+  } else if (buffer_config.secure) {
     alloc_flags = INT(GRALLOC_USAGE_PRIVATE_MM_HEAP);
     alloc_flags |= INT(GRALLOC_USAGE_PROTECTED);
     data.align = SECURE_ALIGN;
@@ -166,7 +170,11 @@
   int height = INT(buffer_config.height);
   int format;
 
-  if (buffer_config.secure) {
+  if (buffer_config.secure_camera) {
+    alloc_flags = GRALLOC_USAGE_HW_CAMERA_WRITE;
+    alloc_flags |= (GRALLOC_USAGE_PROTECTED | GRALLOC_USAGE_HW_COMPOSER);
+    align = SZ_2M;
+  } else if (buffer_config.secure) {
     alloc_flags = INT(GRALLOC_USAGE_PRIVATE_MM_HEAP);
     alloc_flags |= INT(GRALLOC_USAGE_PROTECTED);
     align = SECURE_ALIGN;
diff --git a/sdm/libs/hwc/hwc_display.cpp b/sdm/libs/hwc/hwc_display.cpp
index 3dafeb6..383aaa9 100644
--- a/sdm/libs/hwc/hwc_display.cpp
+++ b/sdm/libs/hwc/hwc_display.cpp
@@ -371,6 +371,9 @@
     if (pvt_handle->flags & private_handle_t::PRIV_FLAGS_SECURE_BUFFER) {
       layer_stack_.flags.secure_present = true;
       layer_buffer->flags.secure = true;
+      if (pvt_handle->flags & private_handle_t::PRIV_FLAGS_CAMERA_WRITE) {
+        layer_buffer->flags.secure_camera = true;
+      }
     }
     // Gralloc Usage Protected Buffer - L3 - which needs to be treated as Secure & avoid fallback
     if (pvt_handle->flags & private_handle_t::PRIV_FLAGS_PROTECTED_BUFFER) {
@@ -451,6 +454,7 @@
   for (size_t i = 0; i < num_hw_layers; i++) {
     hwc_layer_1_t &hwc_layer = content_list->hwLayers[i];
 
+    const private_handle_t *pvt_handle = static_cast<const private_handle_t *>(hwc_layer.handle);
     Layer *layer = layer_stack_.layers.at(i);
     int ret = PrepareLayerParams(&content_list->hwLayers[i], layer);
 
@@ -468,6 +472,15 @@
     ApplyScanAdjustment(&scaled_display_frame);
 
     SetRect(scaled_display_frame, &layer->dst_rect);
+    if (pvt_handle) {
+        bool NonIntegralSourceCrop =  IsNonIntegralSourceCrop(hwc_layer.sourceCropf);
+        bool secure = (pvt_handle->flags & private_handle_t::PRIV_FLAGS_SECURE_BUFFER) ||
+                (pvt_handle->flags & private_handle_t::PRIV_FLAGS_PROTECTED_BUFFER) ||
+                (pvt_handle->flags & private_handle_t::PRIV_FLAGS_SECURE_DISPLAY);
+        if (NonIntegralSourceCrop && !secure) {
+            layer->flags.skip = true;
+        }
+    }
     SetRect(hwc_layer.sourceCropf, &layer->src_rect);
     ApplyDeInterlaceAdjustment(layer);
 
@@ -796,6 +809,17 @@
          (layer_stack_.flags.geometry_changed));
 }
 
+bool HWCDisplay::IsNonIntegralSourceCrop(const hwc_frect_t &source) {
+     if ((source.left != roundf(source.left)) ||
+         (source.top != roundf(source.top)) ||
+         (source.right != roundf(source.right)) ||
+         (source.bottom != roundf(source.bottom))) {
+         return true;
+     } else {
+         return false;
+     }
+}
+
 void HWCDisplay::SetRect(const hwc_rect_t &source, LayerRect *target) {
   target->left = FLOAT(source.left);
   target->top = FLOAT(source.top);
@@ -1328,7 +1352,7 @@
   return 0;
 }
 
-void HWCDisplay::SetSecureDisplay(bool secure_display_active) {
+void HWCDisplay::SetSecureDisplay(bool secure_display_active, bool force_flush) {
   secure_display_active_ = secure_display_active;
   return;
 }
diff --git a/sdm/libs/hwc/hwc_display.h b/sdm/libs/hwc/hwc_display.h
index 5b59fb8..47f2390 100644
--- a/sdm/libs/hwc/hwc_display.h
+++ b/sdm/libs/hwc/hwc_display.h
@@ -85,7 +85,7 @@
   virtual int OnMinHdcpEncryptionLevelChange(uint32_t min_enc_level);
   virtual int Perform(uint32_t operation, ...);
   virtual int SetCursorPosition(int x, int y);
-  virtual void SetSecureDisplay(bool secure_display_active);
+  virtual void SetSecureDisplay(bool secure_display_active, bool force_flush);
   virtual DisplayError SetMixerResolution(uint32_t width, uint32_t height);
   virtual DisplayError GetMixerResolution(uint32_t *width, uint32_t *height);
   virtual void GetPanelResolution(uint32_t *width, uint32_t *height);
@@ -175,6 +175,7 @@
   DisplayError SetMetaData(const private_handle_t *pvt_handle, Layer *layer);
   bool NeedsFrameBufferRefresh(hwc_display_contents_1_t *content_list);
   bool IsLayerUpdating(hwc_display_contents_1_t *content_list, const Layer *layer);
+  bool IsNonIntegralSourceCrop(const hwc_frect_t &source);
   uint32_t GetUpdatingLayersCount(uint32_t app_layer_count);
   bool SingleVideoLayerUpdating(uint32_t app_layer_count);
   bool IsSurfaceUpdated(const std::vector<LayerRect> &dirty_regions);
diff --git a/sdm/libs/hwc/hwc_display_external.cpp b/sdm/libs/hwc/hwc_display_external.cpp
index ed916d4..8a3a591 100644
--- a/sdm/libs/hwc/hwc_display_external.cpp
+++ b/sdm/libs/hwc/hwc_display_external.cpp
@@ -214,7 +214,7 @@
                           + y_offset;
 }
 
-void HWCDisplayExternal::SetSecureDisplay(bool secure_display_active) {
+void HWCDisplayExternal::SetSecureDisplay(bool secure_display_active, bool force_flush) {
   if (secure_display_active_ != secure_display_active) {
     secure_display_active_ = secure_display_active;
 
diff --git a/sdm/libs/hwc/hwc_display_external.h b/sdm/libs/hwc/hwc_display_external.h
index ac70489..c5ac3d7 100644
--- a/sdm/libs/hwc/hwc_display_external.h
+++ b/sdm/libs/hwc/hwc_display_external.h
@@ -39,7 +39,7 @@
   static void Destroy(HWCDisplay *hwc_display);
   virtual int Prepare(hwc_display_contents_1_t *content_list);
   virtual int Commit(hwc_display_contents_1_t *content_list);
-  virtual void SetSecureDisplay(bool secure_display_active);
+  virtual void SetSecureDisplay(bool secure_display_active, bool force_flush);
   virtual int Perform(uint32_t operation, ...);
 
  protected:
diff --git a/sdm/libs/hwc/hwc_display_null.h b/sdm/libs/hwc/hwc_display_null.h
index 297e870..f1e0e5e 100644
--- a/sdm/libs/hwc/hwc_display_null.h
+++ b/sdm/libs/hwc/hwc_display_null.h
@@ -74,7 +74,7 @@
   virtual int OnMinHdcpEncryptionLevelChange(uint32_t min_enc_level) { return 0; }
   virtual int Perform(uint32_t operation, ...) { return 0; }
   virtual int SetCursorPosition(int x, int y) { return 0; }
-  virtual void SetSecureDisplay(bool secure_display_active) { return; }
+  virtual void SetSecureDisplay(bool secure_display_active, bool force_flush) { return; }
 
   // Display Configurations
   virtual int SetActiveDisplayConfig(int config) { return 0; }
diff --git a/sdm/libs/hwc/hwc_display_primary.cpp b/sdm/libs/hwc/hwc_display_primary.cpp
index 783f322..0028ed9 100644
--- a/sdm/libs/hwc/hwc_display_primary.cpp
+++ b/sdm/libs/hwc/hwc_display_primary.cpp
@@ -297,7 +297,7 @@
   }
 }
 
-void HWCDisplayPrimary::SetSecureDisplay(bool secure_display_active) {
+void HWCDisplayPrimary::SetSecureDisplay(bool secure_display_active, bool force_flush) {
   if (secure_display_active_ != secure_display_active) {
     // Skip Prepare and call Flush for null commit
     DLOGI("SecureDisplay state changed from %d to %d Needs Flush!!", secure_display_active_,
@@ -305,10 +305,10 @@
     secure_display_active_ = secure_display_active;
     skip_prepare_ = true;
 
-    // Avoid flush for command mode panels
+    // Avoid flush for command mode panels when no external displays are connected
     DisplayConfigFixedInfo display_config;
     display_intf_->GetConfig(&display_config);
-    if (display_config.is_cmdmode) {
+    if ((display_config.is_cmdmode) && (force_flush == false)) {
       DLOGI("Avoid flush for command mode panel");
       skip_prepare_ = false;
     }
diff --git a/sdm/libs/hwc/hwc_display_primary.h b/sdm/libs/hwc/hwc_display_primary.h
index 901d856..07f6c55 100644
--- a/sdm/libs/hwc/hwc_display_primary.h
+++ b/sdm/libs/hwc/hwc_display_primary.h
@@ -40,7 +40,7 @@
   virtual int Prepare(hwc_display_contents_1_t *content_list);
   virtual int Commit(hwc_display_contents_1_t *content_list);
   virtual int Perform(uint32_t operation, ...);
-  virtual void SetSecureDisplay(bool secure_display_active);
+  virtual void SetSecureDisplay(bool secure_display_active, bool force_flush);
   virtual DisplayError Refresh();
   virtual void SetIdleTimeoutMs(uint32_t timeout_ms);
   virtual void SetFrameDumpConfig(uint32_t count, uint32_t bit_mask_layer_type);
diff --git a/sdm/libs/hwc/hwc_session.cpp b/sdm/libs/hwc/hwc_session.cpp
index 0f36c7e..56c4a6f 100644
--- a/sdm/libs/hwc/hwc_session.cpp
+++ b/sdm/libs/hwc/hwc_session.cpp
@@ -184,6 +184,7 @@
     return -errno;
   }
 
+  connected_displays_[HWC_DISPLAY_PRIMARY] = 1;
   return 0;
 }
 
@@ -201,6 +202,7 @@
     DLOGE("Display core de-initialization failed. Error = %d", error);
   }
 
+  connected_displays_[HWC_DISPLAY_PRIMARY] = 0;
   return 0;
 }
 
@@ -636,16 +638,18 @@
   if (disp == HWC_DISPLAY_EXTERNAL) {
     status = HWCDisplayExternal::Create(core_intf_, &hwc_procs_, primary_width, primary_height,
                                         qservice_, false, &hwc_display_[disp]);
+    connected_displays_[HWC_DISPLAY_EXTERNAL] = 1;
   } else if (disp == HWC_DISPLAY_VIRTUAL) {
     status = HWCDisplayVirtual::Create(core_intf_, &hwc_procs_, primary_width, primary_height,
                                        content_list, &hwc_display_[disp]);
+    connected_displays_[HWC_DISPLAY_VIRTUAL] = 1;
   } else {
     DLOGE("Invalid display type");
     return -1;
   }
 
   if (!status) {
-    hwc_display_[disp]->SetSecureDisplay(secure_display_active_);
+    hwc_display_[disp]->SetSecureDisplay(secure_display_active_, true);
   }
 
   return status;
@@ -656,8 +660,10 @@
 
   if (disp == HWC_DISPLAY_EXTERNAL) {
     HWCDisplayExternal::Destroy(hwc_display_[disp]);
+    connected_displays_[HWC_DISPLAY_EXTERNAL] = 0;
   } else if (disp == HWC_DISPLAY_VIRTUAL) {
     HWCDisplayVirtual::Destroy(hwc_display_[disp]);
+    connected_displays_[HWC_DISPLAY_VIRTUAL] = 0;
   } else {
     DLOGE("Invalid display type");
     return -1;
@@ -1580,9 +1586,18 @@
     }
   }
 
+  // Force flush on primary during transitions(secure<->non secure)
+  // when external displays are connected.
+  bool force_flush = false;
+  if ((connected_displays_[HWC_DISPLAY_PRIMARY] == 1) &&
+     ((connected_displays_[HWC_DISPLAY_EXTERNAL] == 1) ||
+      (connected_displays_[HWC_DISPLAY_VIRTUAL] == 1))) {
+    force_flush = true;
+  }
+
   for (ssize_t dpy = static_cast<ssize_t>(HWC_NUM_DISPLAY_TYPES - 1); dpy >= 0; dpy--) {
     if (hwc_display_[dpy]) {
-      hwc_display_[dpy]->SetSecureDisplay(secure_display_active_);
+      hwc_display_[dpy]->SetSecureDisplay(secure_display_active_, force_flush);
     }
   }
 }
diff --git a/sdm/libs/hwc/hwc_session.h b/sdm/libs/hwc/hwc_session.h
index 54b7260..4519c29 100644
--- a/sdm/libs/hwc/hwc_session.h
+++ b/sdm/libs/hwc/hwc_session.h
@@ -146,6 +146,7 @@
   qService::QService *qservice_ = NULL;
   bool is_hdmi_primary_ = false;
   bool is_hdmi_yuv_ = false;
+  std::bitset<HWC_NUM_DISPLAY_TYPES> connected_displays_;  // Bit mask of connected displays
 };
 
 }  // namespace sdm
diff --git a/sdm/libs/hwc2/hwc_layers.cpp b/sdm/libs/hwc2/hwc_layers.cpp
index 3624c41..f4ae584 100644
--- a/sdm/libs/hwc2/hwc_layers.cpp
+++ b/sdm/libs/hwc2/hwc_layers.cpp
@@ -98,6 +98,9 @@
   // TZ Protected Buffer - L1
   if (handle->flags & private_handle_t::PRIV_FLAGS_SECURE_BUFFER) {
     layer_buffer->flags.secure = true;
+    if (handle->flags & private_handle_t::PRIV_FLAGS_CAMERA_WRITE) {
+      layer_buffer->flags.secure_camera = true;
+    }
   }
   if (handle->flags & private_handle_t::PRIV_FLAGS_SECURE_DISPLAY) {
     layer_buffer->flags.secure_display = true;