Catch up diff

Change-Id: Ie11e070d33e9dc83e96f7ae783fcc2e5e0273a40
Signed-off-by: Abhijit Trivedi <[email protected]>

drivers/cam_cdm/cam_cdm_hw_core.c

@@ -1899,7 +1899,7 @@ int cam_hw_cdm_get_cdm_config(struct cam_hw_info *cdm_hw)
 {
 	struct cam_hw_soc_info *soc_info = NULL;
 	struct cam_cdm *core = NULL;
-	int rc = 0;
+	int rc = 0, ret = 0;
 
 	core = (struct cam_cdm *)cdm_hw->core_info;
 	soc_info = &cdm_hw->soc_info;
@@ -1978,9 +1978,9 @@ int cam_hw_cdm_get_cdm_config(struct cam_hw_info *cdm_hw)
 	}
 
 disable_platform_resource:
-	rc = cam_soc_util_disable_platform_resource(soc_info, true, true);
+	ret = cam_soc_util_disable_platform_resource(soc_info, true, true);
 
-	if (rc) {
+	if (ret) {
 		CAM_ERR(CAM_CDM, "disable platform failed for dev %s",
 				soc_info->dev_name);
 	} else {

drivers/cam_cpas/cam_cpas_intf.c

@@ -341,8 +341,14 @@ int cam_cpas_get_hw_info(uint32_t *camera_family,
 	struct cam_hw_version *camera_version,
 	struct cam_hw_version *cpas_version,
 	uint32_t *cam_caps,
-	struct cam_cpas_fuse_info *cam_fuse_info)
+	struct cam_cpas_fuse_info *cam_fuse_info,
+	struct cam_cpas_domain_id_caps *domain_id_info)
 {
+	struct cam_hw_info              *cpas_hw;
+	struct cam_cpas_private_soc     *soc_private;
+	struct cam_cpas_domain_id_info   cpas_domain_id;
+	int i;
+
 	if (!CAM_CPAS_INTF_INITIALIZED()) {
 		CAM_ERR(CAM_CPAS, "cpas intf not initialized");
 		return -ENODEV;
@@ -354,14 +360,38 @@ int cam_cpas_get_hw_info(uint32_t *camera_family,
 		return -EINVAL;
 	}
 
+	cpas_hw = g_cpas_intf->hw_intf->hw_priv;
+	soc_private = (struct cam_cpas_private_soc *)
+		cpas_hw->soc_info.soc_private;
+
 	*camera_family  = g_cpas_intf->hw_caps.camera_family;
 	*camera_version = g_cpas_intf->hw_caps.camera_version;
 	*cpas_version   = g_cpas_intf->hw_caps.cpas_version;
 	*cam_caps       = g_cpas_intf->hw_caps.camera_capability;
 	if (cam_fuse_info)
 		*cam_fuse_info  = g_cpas_intf->hw_caps.fuse_info;
+	if (domain_id_info) {
+		cpas_domain_id = soc_private->domain_id_info;
 
-	CAM_DBG(CAM_CPAS, "Family %d, version %d.%d cam_caps %d",
+		if (!soc_private->domain_id_info.domain_id_supported) {
+			domain_id_info->num_mapping = 0;
+			domain_id_info->is_supported = 0;
+		} else {
+			domain_id_info->is_supported = 1;
+			domain_id_info->num_mapping =
+				soc_private->domain_id_info.num_domain_ids;
+
+			for (i = 0; i < domain_id_info->num_mapping; i++) {
+				domain_id_info->entries[i].domain_type =
+					cpas_domain_id.domain_id_entries[i].domain_type;
+				domain_id_info->entries[i].mapping_id =
+					cpas_domain_id.domain_id_entries[i].mapping_id;
+			}
+		}
+	}
+
+	CAM_DBG(CAM_CPAS, "Family %d, version %d.%d cam_caps %d, domain_id: %s",
+		CAM_BOOL_TO_YESNO(soc_private->domain_id_info.domain_id_supported),
 		*camera_family, camera_version->major,
 		camera_version->minor, *cam_caps);
 
@@ -847,7 +877,7 @@ int cam_cpas_subdev_cmd(struct cam_cpas_intf *cpas_intf,
 
 		rc = cam_cpas_get_hw_info(&query.camera_family,
 			&query.camera_version, &query.cpas_version,
-			&query.reserved, NULL);
+			&query.reserved, NULL, NULL);
 		if (rc)
 			break;
 
@@ -872,7 +902,32 @@ int cam_cpas_subdev_cmd(struct cam_cpas_intf *cpas_intf,
 		rc = cam_cpas_get_hw_info(&query.camera_family,
 			&query.camera_version, &query.cpas_version,
 			&query.reserved,
-			&query.fuse_info);
+			&query.fuse_info, NULL);
+		if (rc)
+			break;
+
+		rc = copy_to_user(u64_to_user_ptr(cmd->handle), &query,
+			sizeof(query));
+		if (rc)
+			CAM_ERR(CAM_CPAS, "Failed in copy to user, rc=%d", rc);
+
+		break;
+	}
+	case CAM_QUERY_CAP_V3: {
+		struct cam_cpas_query_cap_v3 query;
+
+		rc = copy_from_user(&query, u64_to_user_ptr(cmd->handle),
+			sizeof(query));
+		if (rc) {
+			CAM_ERR(CAM_CPAS, "Failed in copy from user, rc=%d",
+				rc);
+			break;
+		}
+
+		rc = cam_cpas_get_hw_info(&query.camera_family,
+			&query.camera_version, &query.cpas_version,
+			&query.camera_caps, &query.fuse_info,
+			&query.domain_id_info);
 		if (rc)
 			break;
 

drivers/cam_cpas/cam_cpas_soc.c

@@ -895,6 +895,15 @@ static int cam_cpas_parse_domain_id_mapping(struct device_node *of_node,
 	}
 
 	soc_private->domain_id_info.num_domain_ids = count / 2;
+
+	if (soc_private->domain_id_info.num_domain_ids > CAM_CPAS_DOMAIN_ID_MAX) {
+		CAM_ERR(CAM_CPAS,
+			"Number of domain id types: %u more than supported: %d",
+			soc_private->domain_id_info.num_domain_ids, CAM_CPAS_DOMAIN_ID_MAX);
+		rc = -EINVAL;
+		goto err;
+	}
+
 	soc_private->domain_id_info.domain_id_entries =
 		kcalloc(soc_private->domain_id_info.num_domain_ids,
 			sizeof(struct cam_cpas_domain_id_mapping), GFP_KERNEL);
@@ -918,7 +927,7 @@ static int cam_cpas_parse_domain_id_mapping(struct device_node *of_node,
 			goto err;
 		}
 
-		if (domain_id_entry->domain_type > CAM_CPAS_NON_SECURE_DOMAIN) {
+		if (domain_id_entry->domain_type > CAM_CPAS_SECURE_DOMAIN) {
 			CAM_ERR(CAM_CPAS, "Unexpected domain id type: %u",
 				domain_id_entry->domain_type);
 			rc =  -EINVAL;
@@ -1019,6 +1028,7 @@ int cam_cpas_get_custom_dt_info(struct cam_hw_info *cpas_hw,
 	int count = 0, i = 0, rc = 0, num_bw_values = 0, num_levels = 0;
 	uint32_t cam_drv_en_mask_val = 0;
 	struct cam_cpas *cpas_core = (struct cam_cpas *) cpas_hw->core_info;
+	uint32_t ahb_bus_client_ab = 0, ahb_bus_client_ib = 0;
 
 	if (!soc_private || !pdev) {
 		CAM_ERR(CAM_CPAS, "invalid input arg %pK %pK",
@@ -1155,26 +1165,26 @@ int cam_cpas_get_custom_dt_info(struct cam_hw_info *cpas_hw,
 			rc = of_property_read_u32_index(of_node,
 				"cam-ahb-bw-KBps",
 				(i * 2),
-				(uint32_t *) &cpas_core->ahb_bus_client
-				.common_data.bw_pair[i].ab);
+				&ahb_bus_client_ab);
 			if (rc) {
 				CAM_ERR(CAM_UTIL,
 					"Error reading ab bw value, rc=%d",
 					rc);
 				return rc;
 			}
+			cpas_core->ahb_bus_client.common_data.bw_pair[i].ab = ahb_bus_client_ab;
 
 			rc = of_property_read_u32_index(of_node,
 				"cam-ahb-bw-KBps",
 				((i * 2) + 1),
-				(uint32_t *) &cpas_core->ahb_bus_client
-				.common_data.bw_pair[i].ib);
+				&ahb_bus_client_ib);
 			if (rc) {
 				CAM_ERR(CAM_UTIL,
 					"Error reading ib bw value, rc=%d",
 					rc);
 				return rc;
 			}
+			cpas_core->ahb_bus_client.common_data.bw_pair[i].ib = ahb_bus_client_ib;
 
 			CAM_DBG(CAM_CPAS,
 				"AHB: Level: %d, ab_value %llu, ib_value: %llu",

drivers/cam_cpas/include/cam_cpas_api.h

@@ -691,16 +691,18 @@ int cam_cpas_reg_read(
  * @cpas_version   : Camera cpas version
  * @cam_caps       : Camera capability
  * @cam_fuse_info  : Camera fuse info
+ * @domain_id_info : Domain id info
  *
  * @return 0 on success.
  *
  */
 int cam_cpas_get_hw_info(
-	uint32_t                  *camera_family,
-	struct cam_hw_version     *camera_version,
-	struct cam_hw_version     *cpas_version,
-	uint32_t                  *cam_caps,
-	struct cam_cpas_fuse_info *cam_fuse_info);
+	uint32_t                       *camera_family,
+	struct cam_hw_version          *camera_version,
+	struct cam_hw_version          *cpas_version,
+	uint32_t                       *cam_caps,
+	struct cam_cpas_fuse_info      *cam_fuse_info,
+	struct cam_cpas_domain_id_caps *domain_id_info);
 
 /**
  * cam_cpas_get_cpas_hw_version()

drivers/cam_cre/cam_cre_hw_mgr/cam_cre_hw_mgr.c

@@ -1488,7 +1488,8 @@ static int cam_cre_mgr_pkt_validation(struct cam_packet *packet)
 		return -EINVAL;
 	}
 
-	if (packet->num_io_configs > CRE_MAX_IO_BUFS) {
+	if (!packet->num_io_configs ||
+		packet->num_io_configs > CRE_MAX_IO_BUFS) {
 		CAM_ERR(CAM_CRE, "Invalid number of io configs: %d %d",
 			CRE_MAX_IO_BUFS, packet->num_io_configs);
 		return -EINVAL;
@@ -2151,13 +2152,13 @@ static int cam_cre_process_generic_cmd_buffer(
 		if (!cmd_desc[i].length)
 			continue;
 
-	if (cmd_desc[i].meta_data != CAM_CRE_CMD_META_GENERIC_BLOB)
-		continue;
+		if (cmd_desc[i].meta_data != CAM_CRE_CMD_META_GENERIC_BLOB)
+			continue;
 
-	rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
-		cam_cre_packet_generic_blob_handler, &cmd_generic_blob);
-	if (rc)
-		CAM_ERR(CAM_CRE, "Failed in processing blobs %d", rc);
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+				cam_cre_packet_generic_blob_handler, &cmd_generic_blob);
+		if (rc)
+			CAM_ERR(CAM_CRE, "Failed in processing blobs %d", rc);
 	}
 
 	return rc;

drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c

@@ -55,7 +55,7 @@ static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet,
 	}
 
 	/* All buffers must come through io config, do not support patching */
-	if (packet->num_patches || !packet->num_io_configs) {
+	if (packet->num_patches || !packet->num_io_configs || !packet->num_cmd_buf) {
 		CAM_ERR(CAM_FD, "wrong number of cmd/patch info: %u %u",
 			packet->num_cmd_buf, packet->num_patches);
 		return -EINVAL;

drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

@@ -4923,13 +4923,13 @@ static int cam_icp_mgr_pkt_validation(struct cam_packet *packet)
 		return -EINVAL;
 	}
 
-	if (packet->num_io_configs > IPE_IO_IMAGES_MAX) {
+	if (!packet->num_io_configs || packet->num_io_configs > IPE_IO_IMAGES_MAX) {
 		CAM_ERR(CAM_ICP, "Invalid number of io configs: %d %d",
 			IPE_IO_IMAGES_MAX, packet->num_io_configs);
 		return -EINVAL;
 	}
 
-	if (packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {
+	if (!packet->num_cmd_buf || packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {
 		CAM_ERR(CAM_ICP, "Invalid number of cmd buffers: %d %d",
 			CAM_ICP_CTX_MAX_CMD_BUFFERS, packet->num_cmd_buf);
 		return -EINVAL;
@@ -7025,7 +7025,7 @@ int cam_icp_hw_mgr_init(struct device_node *of_node, uint64_t *hw_mgr_hdl,
 
 	rc = cam_cpas_get_hw_info(&query.camera_family,
 			&query.camera_version, &query.cpas_version,
-			&cam_caps, NULL);
+			&cam_caps, NULL, NULL);
 	if (rc) {
 		CAM_ERR(CAM_ICP, "failed to get hw info rc=%d", rc);
 		goto destroy_mutex;

drivers/cam_icp/icp_hw/ipe_hw/ipe_dev.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/module.h>
@@ -87,7 +88,7 @@ static int cam_ipe_component_bind(struct device *dev,
 
 	rc = cam_cpas_get_hw_info(&query.camera_family,
 			&query.camera_version, &query.cpas_version,
-			&cam_caps, NULL);
+			&cam_caps, NULL, NULL);
 	if (rc) {
 		CAM_ERR(CAM_ICP, "failed to get hw info rc=%d", rc);
 		return rc;

drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

@@ -5853,7 +5853,8 @@ static int cam_isp_classify_vote_info(
 	uint32_t                                hw_type,
 	uint32_t                                split_idx,
 	bool                                   *nrdi_l_bw_updated,
-	bool                                   *nrdi_r_bw_updated)
+	bool                                   *nrdi_r_bw_updated,
+	bool                                    is_sfe_shdr)
 {
 	int                                   rc = 0, i, j = 0;
 
@@ -5925,11 +5926,10 @@ static int cam_isp_classify_vote_info(
 			}
 		}
 	} else {
-		if (hw_mgr_res->res_id == CAM_ISP_HW_SFE_IN_PIX) {
-			if (split_idx == CAM_ISP_HW_SPLIT_LEFT) {
-				if (*nrdi_l_bw_updated)
-					return rc;
-
+		if (is_sfe_shdr ||
+			(hw_mgr_res->res_id == CAM_ISP_HW_SFE_IN_PIX)) {
+			if ((split_idx == CAM_ISP_HW_SPLIT_LEFT) &&
+				(!(*nrdi_l_bw_updated))) {
 				for (i = 0; i < bw_config->num_paths; i++) {
 					if (bw_config->axi_path[i].usage_data ==
 						CAM_ISP_USAGE_SFE_LEFT) {
@@ -5943,10 +5943,7 @@ static int cam_isp_classify_vote_info(
 				isp_vote->num_paths = j;
 
 				*nrdi_l_bw_updated = true;
-			} else {
-				if (*nrdi_r_bw_updated)
-					return rc;
-
+			} else if (!(*nrdi_r_bw_updated)) {
 				for (i = 0; i < bw_config->num_paths; i++) {
 					if (bw_config->axi_path[i].usage_data ==
 						CAM_ISP_USAGE_SFE_RIGHT) {
@@ -5961,7 +5958,9 @@ static int cam_isp_classify_vote_info(
 
 				*nrdi_r_bw_updated = true;
 			}
-		} else if ((hw_mgr_res->res_id >= CAM_ISP_HW_SFE_IN_RDI0)
+		}
+
+		if ((hw_mgr_res->res_id >= CAM_ISP_HW_SFE_IN_RDI0)
 			&& (hw_mgr_res->res_id <=
 			CAM_ISP_HW_SFE_IN_RDI4)) {
 			for (i = 0; i < bw_config->num_paths; i++) {
@@ -5979,14 +5978,6 @@ static int cam_isp_classify_vote_info(
 				}
 			}
 			isp_vote->num_paths = j;
-
-		} else {
-			if (hw_mgr_res->hw_res[split_idx]) {
-				CAM_ERR(CAM_ISP, "Invalid res_id %u, split_idx: %u",
-					hw_mgr_res->res_id, split_idx);
-				rc = -EINVAL;
-				return rc;
-			}
 		}
 	}
 
@@ -6021,6 +6012,7 @@ static int cam_isp_blob_bw_update_v2(
 	uint32_t                               i, split_idx = INT_MIN;
 	bool                                   nrdi_l_bw_updated = false;
 	bool                                   nrdi_r_bw_updated = false;
+	bool                                   is_sfe_shdr = false;
 
 	for (i = 0; i < bw_config->num_paths; i++) {
 		CAM_DBG(CAM_PERF,
@@ -6049,7 +6041,8 @@ static int cam_isp_blob_bw_update_v2(
 				sizeof(struct cam_axi_vote));
 			rc = cam_isp_classify_vote_info(hw_mgr_res, bw_config,
 				&bw_upd_args.isp_vote, CAM_ISP_HW_TYPE_VFE,
-				split_idx, &nrdi_l_bw_updated, &nrdi_r_bw_updated);
+				split_idx, &nrdi_l_bw_updated, &nrdi_r_bw_updated,
+				false);
 			if (rc)
 				return rc;
 
@@ -6082,6 +6075,9 @@ static int cam_isp_blob_bw_update_v2(
 
 	nrdi_l_bw_updated = false;
 	nrdi_r_bw_updated = false;
+	if ((ctx->flags.is_sfe_fs) || (ctx->flags.is_sfe_shdr))
+		is_sfe_shdr = true;
+
 	list_for_each_entry(hw_mgr_res, &ctx->res_list_sfe_src, list) {
 		for (split_idx = 0; split_idx < CAM_ISP_HW_SPLIT_MAX;
 			split_idx++) {
@@ -6092,7 +6088,8 @@ static int cam_isp_blob_bw_update_v2(
 				sizeof(struct cam_axi_vote));
 			rc = cam_isp_classify_vote_info(hw_mgr_res, bw_config,
 				&sfe_bw_update_args.sfe_vote, CAM_ISP_HW_TYPE_SFE,
-				split_idx, &nrdi_l_bw_updated, &nrdi_r_bw_updated);
+				split_idx, &nrdi_l_bw_updated, &nrdi_r_bw_updated,
+				is_sfe_shdr);
 			if (rc)
 				return rc;
 

drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.c

@@ -2786,9 +2786,16 @@ int cam_ife_csid_ver1_init_hw(void *hw_priv,
 	default:
 		CAM_ERR(CAM_ISP, "CSID:%d Invalid Res id %d",
 			csid_hw->hw_intf->hw_idx, res->res_id);
+		rc = -EINVAL;
 		break;
 	}
 
+	if (rc < 0) {
+		CAM_ERR(CAM_ISP, "CSID:%d res_id:%d path init configuration failed with rc: %d",
+			csid_hw->hw_intf->hw_idx, res->res_id, rc);
+		goto end;
+	}
+
 	rc = cam_ife_csid_ver1_hw_reset(csid_hw);
 
 	if (rc < 0)

drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.c

@@ -1367,9 +1367,11 @@ void cam_ife_csid_hw_ver2_rdi_line_buffer_conflict_handler(
 		soc_info->reg_map[CAM_IFE_CSID_CLC_MEM_BASE_ID].mem_base;
 	const struct cam_ife_csid_ver2_path_reg_info *path_reg;
 	uint32_t i = 0, rdi_cfg = 0;
-	uint8_t *log_buf = NULL;
+	uint8_t *log_buf = csid_hw->log_buf;
 	size_t len = 0;
 
+	memset(log_buf, 0x0, sizeof(uint8_t) * CAM_IFE_CSID_LOG_BUF_LEN);
+
 	for (i = CAM_IFE_PIX_PATH_RES_RDI_0; i < CAM_IFE_PIX_PATH_RES_RDI_4;
 		i++) {
 		path_reg = csid_reg->path_reg[i - CAM_IFE_PIX_PATH_RES_RDI_0];

drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.h

@@ -549,7 +549,7 @@ struct cam_ife_csid_ver2_common_reg_info {
 struct cam_ife_csid_secure_info {
 	uint32_t phy_sel;
 	uint32_t lane_cfg;
-	uint64_t vc_mask;
+	uint32_t vc_mask;
 	uint32_t csid_hw_idx_mask;
 	uint32_t cdm_hw_idx_mask;
 };

drivers/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h

@@ -43,6 +43,13 @@ enum cam_isp_bw_control_action {
 	CAM_ISP_BW_CONTROL_INCLUDE       = 1
 };
 
+enum cam_isp_multi_ctxt_idx {
+	CAM_ISP_MULTI_CTXT_0,
+	CAM_ISP_MULTI_CTXT_1,
+	CAM_ISP_MULTI_CTXT_2,
+	CAM_ISP_MULTI_CTXT_MAX
+};
+
 /*
  * struct cam_isp_bw_control_args:
  *

drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/cam_sfe_dev.c

@@ -162,14 +162,12 @@ static void cam_sfe_component_unbind(struct device *dev,
 	sfe_info = sfe_hw_intf->hw_priv;
 	if (!sfe_info) {
 		CAM_ERR(CAM_SFE, "HW data is NULL");
-		rc = -ENODEV;
 		goto free_sfe_hw_intf;
 	}
 
 	core_info = (struct cam_sfe_hw_core_info *)sfe_info->core_info;
 	if (!core_info) {
 		CAM_ERR(CAM_SFE, "core data NULL");
-		rc = -EINVAL;
 		goto deinit_soc;
 	}
 

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

@@ -1024,7 +1024,8 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
 		return rc;
 	}
 
-	if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) ||
+	if (!packet->num_cmd_buf ||
+		(packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) ||
 		!packet->num_patches || !packet->num_io_configs ||
 		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
 		CAM_ERR(CAM_JPEG,

drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

@@ -114,6 +114,11 @@ static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet,
 		return -EINVAL;
 	}
 
+	if (!packet->num_cmd_buf) {
+		CAM_ERR(CAM_LRME, "no cmd bufs");
+		return -EINVAL;
+	}
+
 	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)&packet->payload +
 		packet->cmd_buf_offset);
 

drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c

@@ -2389,13 +2389,15 @@ static int cam_ope_mgr_pkt_validation(struct cam_packet *packet)
 		return -EINVAL;
 	}
 
-	if (packet->num_io_configs > OPE_MAX_IO_BUFS) {
+	if (!packet->num_io_configs ||
+		packet->num_io_configs > OPE_MAX_IO_BUFS) {
 		CAM_ERR(CAM_OPE, "Invalid number of io configs: %d %d",
 			OPE_MAX_IO_BUFS, packet->num_io_configs);
 		return -EINVAL;
 	}
 
-	if (packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) {
+	if (!packet->num_cmd_buf ||
+		packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) {
 		CAM_ERR(CAM_OPE, "Invalid number of cmd buffers: %d %d",
 			OPE_PACKET_MAX_CMD_BUFS, packet->num_cmd_buf);
 		return -EINVAL;

drivers/cam_req_mgr/cam_req_mgr_core.c

@@ -72,6 +72,7 @@ void cam_req_mgr_core_link_reset(struct cam_req_mgr_core_link *link)
 	link->is_sending_req = false;
 	atomic_set(&link->eof_event_cnt, 0);
 	link->properties_mask = CAM_LINK_PROPERTY_NONE;
+	link->cont_empty_slots = 0;
 	__cam_req_mgr_reset_apply_data(link);
 
 	for (i = 0; i < MAXIMUM_LINKS_PER_SESSION - 1; i++)
@@ -433,7 +434,7 @@ static int __cam_req_mgr_notify_error_on_link(
 	struct cam_req_mgr_connected_device *dev)
 {
 	struct cam_req_mgr_core_session *session = NULL;
-	struct cam_req_mgr_message       msg;
+	struct cam_req_mgr_message       msg = {0};
 	int rc = 0, pd;
 
 	session = (struct cam_req_mgr_core_session *)link->parent;
@@ -794,6 +795,7 @@ static void __cam_req_mgr_flush_req_slot(
 	link->trigger_cnt[0][CAM_TRIGGER_POINT_EOF] = 0;
 	link->trigger_cnt[1][CAM_TRIGGER_POINT_SOF] = 0;
 	link->trigger_cnt[1][CAM_TRIGGER_POINT_EOF] = 0;
+	link->cont_empty_slots = 0;
 }
 
 /**
@@ -863,7 +865,7 @@ static void __cam_req_mgr_validate_crm_wd_timer(
 	struct cam_req_mgr_core_link *link)
 {
 	int idx = 0;
-	int next_frame_timeout = 0, current_frame_timeout = 0;
+	int next_frame_timeout, current_frame_timeout, max_frame_timeout;
 	int64_t current_req_id, next_req_id;
 	struct cam_req_mgr_req_queue *in_q = link->req.in_q;
 
@@ -899,9 +901,13 @@ static void __cam_req_mgr_validate_crm_wd_timer(
 			"Skip modifying wd timer, continue with same timeout");
 		return;
 	}
+
+	max_frame_timeout = (current_frame_timeout > next_frame_timeout) ?
+		current_frame_timeout : next_frame_timeout;
+
 	spin_lock_bh(&link->link_state_spin_lock);
 	if (link->watchdog) {
-		if ((next_frame_timeout + CAM_REQ_MGR_WATCHDOG_TIMEOUT) >
+		if ((max_frame_timeout + CAM_REQ_MGR_WATCHDOG_TIMEOUT) >
 			link->watchdog->expires) {
 			CAM_DBG(CAM_CRM,
 				"Modifying wd timer expiry from %d ms to %d ms",
@@ -909,18 +915,18 @@ static void __cam_req_mgr_validate_crm_wd_timer(
 				(next_frame_timeout +
 				 CAM_REQ_MGR_WATCHDOG_TIMEOUT));
 			crm_timer_modify(link->watchdog,
-				next_frame_timeout +
+				max_frame_timeout +
 				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
-		} else if (current_frame_timeout) {
+		} else if (max_frame_timeout) {
 			CAM_DBG(CAM_CRM,
 				"Reset wd timer to frame from %d ms to %d ms",
 				link->watchdog->expires,
-				(current_frame_timeout +
+				(max_frame_timeout +
 				 CAM_REQ_MGR_WATCHDOG_TIMEOUT));
 			crm_timer_modify(link->watchdog,
-				current_frame_timeout +
+				max_frame_timeout +
 				CAM_REQ_MGR_WATCHDOG_TIMEOUT);
-		} else if (!next_frame_timeout && (link->watchdog->expires >
+		} else if (!max_frame_timeout && (link->watchdog->expires >
 			CAM_REQ_MGR_WATCHDOG_TIMEOUT)) {
 			CAM_DBG(CAM_CRM,
 				"Reset wd timer to default from %d ms to %d ms",
@@ -960,16 +966,18 @@ static int __cam_req_mgr_check_for_lower_pd_devices(
 }
 
 /**
- * __cam_req_mgr_check_next_req_slot()
+ * __cam_req_mgr_move_to_next_req_slot()
  *
  * @brief    : While streaming if input queue does not contain any pending
  *             request, req mgr still needs to submit pending request ids to
- *             devices with lower pipeline delay value.
+ *             devices with lower pipeline delay value. But if there are
+ *             continuous max_delay empty slots, we don't need to move to
+ *             next slot since the last request is applied to all devices.
  * @in_q     : Pointer to input queue where req mgr wil peep into
  *
  * @return   : 0 for success, negative for failure
  */
-static int __cam_req_mgr_check_next_req_slot(
+static int __cam_req_mgr_move_to_next_req_slot(
 	struct cam_req_mgr_core_link *link)
 {
 	int rc = 0;
@@ -1008,6 +1016,13 @@ static int __cam_req_mgr_check_next_req_slot(
 				link->link_hdl);
 			return rc;
 		}
+
+		if (link->cont_empty_slots++ >= link->max_delay) {
+			CAM_DBG(CAM_CRM, "There are %d continuous empty slots on link 0x%x",
+				link->cont_empty_slots, link->link_hdl);
+			return -EAGAIN;
+		}
+
 		__cam_req_mgr_in_q_skip_idx(in_q, idx);
 		slot->status = CRM_SLOT_STATUS_REQ_ADDED;
 		if (in_q->wr_idx != idx)
@@ -1015,7 +1030,10 @@ static int __cam_req_mgr_check_next_req_slot(
 				"CHECK here wr %d, rd %d", in_q->wr_idx, idx);
 		else
 			__cam_req_mgr_inc_idx(&in_q->wr_idx, 1, in_q->num_slots);
-	}
+	} else
+		link->cont_empty_slots = 0;
+
+	__cam_req_mgr_inc_idx(&in_q->rd_idx, 1, in_q->num_slots);
 
 	return rc;
 }
@@ -2423,7 +2441,7 @@ static int __cam_req_mgr_process_sof_freeze(void *priv, void *data)
 	struct cam_req_mgr_core_link    *link = NULL;
 	struct cam_req_mgr_req_queue    *in_q = NULL;
 	struct cam_req_mgr_core_session *session = NULL;
-	struct cam_req_mgr_message       msg;
+	struct cam_req_mgr_message       msg = {0};
 	int rc = 0;
 	int64_t last_applied_req_id = -EINVAL;
 
@@ -3630,17 +3648,14 @@ static int cam_req_mgr_process_trigger(void *priv, void *data)
 		 */
 		CAM_DBG(CAM_CRM, "link[%x] Req[%lld] invalidating slot",
 			link->link_hdl, in_q->slot[in_q->rd_idx].req_id);
-		rc = __cam_req_mgr_check_next_req_slot(link);
+		rc = __cam_req_mgr_move_to_next_req_slot(link);
 		if (rc) {
 			CAM_DBG(CAM_REQ,
 				"No pending req to apply to lower pd devices");
 			rc = 0;
 			__cam_req_mgr_notify_frame_skip(link, trigger_data->trigger);
-			__cam_req_mgr_inc_idx(&in_q->rd_idx,
-				1, in_q->num_slots);
 			goto release_lock;
 		}
-		__cam_req_mgr_inc_idx(&in_q->rd_idx, 1, in_q->num_slots);
 	}
 
 	rc = __cam_req_mgr_process_req(link, trigger_data);

drivers/cam_req_mgr/cam_req_mgr_core.h

@@ -411,6 +411,7 @@ struct cam_req_mgr_connected_device {
  * @wq_congestion        : Indicates if WQ congestion is detected or not
  * @try_for_internal_recovery : If the link stalls try for RT internal recovery
  * @properties_mask      : Indicates if current link enables some special properties
+ * @cont_empty_slots     : Continuous empty slots
  */
 struct cam_req_mgr_core_link {
 	int32_t                              link_hdl;
@@ -452,6 +453,7 @@ struct cam_req_mgr_core_link {
 	bool                                 try_for_internal_recovery;
 	bool                                 is_sending_req;
 	uint32_t                             properties_mask;
+	uint32_t                             cont_empty_slots;
 };
 
 /**

drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c

@@ -914,9 +914,15 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev,
 		return rc;
 	}
 
-	cmd_desc = (struct cam_cmd_buf_desc *)
-		((uint32_t *)&csl_packet->payload +
-		csl_packet->cmd_buf_offset / 4);
+	if (csl_packet->num_cmd_buf)
+		cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint32_t *)&csl_packet->payload +
+			csl_packet->cmd_buf_offset / 4);
+	else {
+		CAM_ERR(CAM_CSIPHY, "num_cmd_buffer = %d", csl_packet->num_cmd_buf);
+		rc = -EINVAL;
+		return rc;
+	}
 
 	CAM_DBG(CAM_CSIPHY, "CSIPHY:%u num cmd buffers received: %u",
 		csiphy_dev->soc_info.index, csl_packet->num_cmd_buf);

drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c

@@ -33,6 +33,7 @@ int cam_csiphy_format_secure_phy_lane_info(
 {
 	struct cam_csiphy_tz_secure_info *tz_secure_info;
 	struct cam_csiphy_param *param;
+	uint64_t phy_lane_sel_mask = 0;
 
 	if (!csiphy_dev) {
 		CAM_ERR(CAM_CSIPHY, "Invalid param, csiphy_dev: %s",
@@ -51,29 +52,30 @@ int cam_csiphy_format_secure_phy_lane_info(
 
 	if (param->csiphy_3phase) {
 		if (param->lane_enable & CPHY_LANE_0)
-			tz_secure_info->phy_lane_sel_mask |= LANE_0_SEL;
+			phy_lane_sel_mask |= LANE_0_SEL;
 		if (param->lane_enable & CPHY_LANE_1)
-			tz_secure_info->phy_lane_sel_mask |= LANE_1_SEL;
+			phy_lane_sel_mask |= LANE_1_SEL;
 		if (param->lane_enable & CPHY_LANE_2)
-			tz_secure_info->phy_lane_sel_mask |= LANE_2_SEL;
-		tz_secure_info->phy_lane_sel_mask <<= CPHY_LANE_SELECTION_SHIFT;
+			phy_lane_sel_mask |= LANE_2_SEL;
+		phy_lane_sel_mask <<= CPHY_LANE_SELECTION_SHIFT;
 	} else {
 		if (param->lane_enable & DPHY_LANE_0)
-			tz_secure_info->phy_lane_sel_mask |= LANE_0_SEL;
+			phy_lane_sel_mask |= LANE_0_SEL;
 		if (param->lane_enable & DPHY_LANE_1)
-			tz_secure_info->phy_lane_sel_mask |= LANE_1_SEL;
+			phy_lane_sel_mask |= LANE_1_SEL;
 		if (param->lane_enable & DPHY_LANE_2)
-			tz_secure_info->phy_lane_sel_mask |= LANE_2_SEL;
+			phy_lane_sel_mask |= LANE_2_SEL;
 		if (param->lane_enable & DPHY_LANE_3)
-			tz_secure_info->phy_lane_sel_mask |= LANE_3_SEL;
-		tz_secure_info->phy_lane_sel_mask <<= DPHY_LANE_SELECTION_SHIFT;
+			phy_lane_sel_mask |= LANE_3_SEL;
+		phy_lane_sel_mask <<= DPHY_LANE_SELECTION_SHIFT;
 	}
 	if (csiphy_dev->soc_info.index > MAX_SUPPORTED_PHY_IDX) {
 		CAM_ERR(CAM_CSIPHY, "Invalid PHY index: %u",
 			csiphy_dev->soc_info.index);
 			return -EINVAL;
 	}
-	tz_secure_info->phy_lane_sel_mask |= BIT(csiphy_dev->soc_info.index);
+	phy_lane_sel_mask |= BIT(csiphy_dev->soc_info.index);
+	tz_secure_info->phy_lane_sel_mask  |= phy_lane_sel_mask;
 
 	CAM_DBG(CAM_CSIPHY, "Formatted PHY[%u] phy_lane_sel_mask: 0x%llx",
 		csiphy_dev->soc_info.index,

drivers/cam_sensor_module/cam_csiphy/cam_csiphy_dev.h

@@ -75,8 +75,8 @@
 #define LANE_1_SEL                   BIT(1)
 #define LANE_2_SEL                   BIT(2)
 #define LANE_3_SEL                   BIT(3)
-#define CPHY_LANE_SELECTION_SHIFT    8
-#define DPHY_LANE_SELECTION_SHIFT    16
+#define CPHY_LANE_SELECTION_SHIFT    16
+#define DPHY_LANE_SELECTION_SHIFT    24
 #define MAX_SUPPORTED_PHY_IDX        7
 
 /* PRBS Pattern Macros */
@@ -118,7 +118,7 @@ enum cam_csiphy_common_reg_program {
 struct cam_csiphy_secure_info {
 	uint32_t phy_lane_sel_mask;
 	uint32_t lane_assign;
-	uint64_t vc_mask;
+	uint32_t vc_mask;
 	uint32_t csid_hw_idx_mask;
 	uint32_t cdm_hw_idx_mask;
 };
@@ -141,8 +141,8 @@ struct cam_csiphy_tz_secure_info {
 	uint64_t phy_lane_sel_mask;
 	uint32_t csid_hw_idx_mask;
 	uint32_t cdm_hw_idx_mask;
-	uint64_t vc_mask;
-	bool     protect;
+	uint32_t vc_mask;
+	uint32_t protect;
 };
 
 /**

drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c

@@ -21,7 +21,7 @@ static int cam_sensor_notify_v4l2_error_event(
 	uint32_t error_type, uint32_t error_code)
 {
 	int                        rc = 0;
-	struct cam_req_mgr_message req_msg;
+	struct cam_req_mgr_message req_msg = {0};
 
 	req_msg.session_hdl = s_ctrl->bridge_intf.session_hdl;
 	req_msg.u.err_msg.device_hdl = s_ctrl->bridge_intf.device_hdl;

drivers/cam_utils/cam_packet_util.c

@@ -70,6 +70,12 @@ int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr,
 
 int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc)
 {
+
+	if (!cmd_desc) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd desc");
+		return -EINVAL;
+	}
+
 	if ((cmd_desc->length > cmd_desc->size) ||
 		(cmd_desc->mem_handle <= 0)) {
 		CAM_ERR(CAM_UTIL, "invalid cmd arg %d %d %d %d",
@@ -110,6 +116,7 @@ int cam_packet_util_validate_packet(struct cam_packet *packet,
 	pkt_wo_payload = offsetof(struct cam_packet, payload);
 
 	if ((!packet->header.size) ||
+		((size_t)packet->header.size <= pkt_wo_payload) ||
 		((pkt_wo_payload + (size_t)packet->cmd_buf_offset +
 		sum_cmd_desc) > (size_t)packet->header.size) ||
 		((pkt_wo_payload + (size_t)packet->io_configs_offset +
@@ -139,6 +146,11 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet,
 		return -EINVAL;
 	}
 
+	if (!packet->num_cmd_buf) {
+		CAM_ERR(CAM_UTIL, "Invalid num_cmd_buf = %d", packet->num_cmd_buf);
+		return -EINVAL;
+	}
+
 	if ((packet->kmd_cmd_buf_index < 0) ||
 		(packet->kmd_cmd_buf_index >= packet->num_cmd_buf)) {
 		CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",

drivers/camera_main.h

@@ -52,8 +52,8 @@ extern struct platform_driver cam_icp_v1_driver;
 extern struct platform_driver cam_icp_v2_driver;
 extern struct platform_driver cam_ipe_driver;
 extern struct platform_driver cam_bps_driver;
-extern struct platform_driver cam_icp_driver;
 extern struct platform_driver cam_ofe_driver;
+extern struct platform_driver cam_icp_driver;
 #endif
 #ifdef CONFIG_SPECTRA_OPE
 extern struct platform_driver cam_ope_driver;
@@ -124,8 +124,8 @@ static struct platform_driver *const cam_component_platform_drivers[] = {
 	&cam_icp_v2_driver,
 	&cam_ipe_driver,
 	&cam_bps_driver,
-	&cam_icp_driver,
 	&cam_ofe_driver,
+	&cam_icp_driver,
 #endif
 #ifdef CONFIG_SPECTRA_OPE
 	&cam_ope_driver,

dt-bindings/msm-camera.h

@@ -121,7 +121,7 @@
 #define CAM_CPAS_PORT_DRV_DYN     32
 
 /* Domain ID types */
-#define CAM_CPAS_SECURE_DOMAIN      0
-#define CAM_CPAS_NON_SECURE_DOMAIN  1
+#define CAM_CPAS_NON_SECURE_DOMAIN  0
+#define CAM_CPAS_SECURE_DOMAIN      1
 
 #endif

include/uapi/camera/media/cam_cpas.h

@@ -73,11 +73,16 @@
 
 #define CAM_AXI_PATH_DATA_ALL  256
 #define CAM_CPAS_FUSES_MAX     32
+#define CAM_CPAS_DOMAIN_ID_MAX 5
 
 /* DRV Vote level */
 #define CAM_CPAS_VOTE_LEVEL_HIGH   1
 #define CAM_CPAS_VOTE_LEVEL_LOW    2
 
+/* Domain id types */
+#define CAM_CPAS_NON_SECURE_DOMAIN  0
+#define CAM_CPAS_SECURE_DOMAIN      1
+
 /**
  * struct cam_cpas_fuse_value - CPAS fuse value
  *
@@ -100,6 +105,41 @@ struct cam_cpas_fuse_info {
 	struct cam_cpas_fuse_value fuse_val[CAM_CPAS_FUSES_MAX];
 };
 
+/**
+ * struct cam_cpas_domain_id_pairing - CPAS domain id mapping
+ *
+ * @domain_type    : Domain type
+ * @mapping_id     : ID of domain type
+ */
+struct cam_cpas_domain_id_pairing {
+	__u32 domain_type;
+	__u32 mapping_id;
+	__u32 num_valid_params;
+	__u32 valid_param_mask;
+	__u32 params[4];
+};
+
+/**
+ * struct cam_cpas_domain_id_caps - CPAS domain id info
+ *
+ * @is_supported      : If domain id is supported on target
+ * @num_mapping       : Number of domain id types supported, if any
+ * @entries           : Stores mapping between domain type and its ID
+ * @num_valid_params  : Number of valid params
+ * @valid_param_mask  : Valid param mask
+ * @params            : These fields are reserved for future extensions
+ *                      to this structure.
+ */
+struct cam_cpas_domain_id_caps {
+	__u32  is_supported;
+	__u32  num_mapping;
+	struct cam_cpas_domain_id_pairing entries[CAM_CPAS_DOMAIN_ID_MAX];
+	__u32  num_valid_params;
+	__u32  valid_param_mask;
+	__u32  params[6];
+};
+
+
 /**
  * struct cam_cpas_query_cap - CPAS query device capability payload
  *
@@ -134,6 +174,34 @@ struct cam_cpas_query_cap_v2 {
 	struct cam_cpas_fuse_info fuse_info;
 };
 
+/**
+ * struct cam_cpas_query_cap - CPAS query device capability payload
+ *
+ * @version           : Struct version
+ * @camera_family     : Camera family type
+ * @camera_caps       : Camera capability
+ * @camera_version    : Camera platform version
+ * @cpas_version      : Camera CPAS version within camera platform
+ * @fuse_info         : Camera fuse info
+ * @domain_id_info    : Domain id info
+ * @num_valid_params  : Number of valid params
+ * @valid_param_mask  : Valid param mask
+ * @params            : Reserved fields to make this query cap
+ *                      extendable in the future
+ */
+struct cam_cpas_query_cap_v3 {
+	__u32                             version;
+	__u32                             camera_family;
+	__u32                             camera_caps;
+	struct cam_hw_version             camera_version;
+	struct cam_hw_version             cpas_version;
+	struct cam_cpas_fuse_info         fuse_info;
+	struct cam_cpas_domain_id_caps    domain_id_info;
+	__u32                             num_valid_params;
+	__u32                             valid_param_mask;
+	__u32                             params[10];
+};
+
 /**
  * struct cam_axi_per_path_bw_vote_v2 - Per path bandwidth vote information
  *

include/uapi/camera/media/cam_defs.h

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
 /*
  * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef __UAPI_CAM_DEFS_H__
@@ -28,6 +29,7 @@
 #define CAM_ACQUIRE_HW                      (CAM_COMMON_OPCODE_BASE_v2 + 0x1)
 #define CAM_RELEASE_HW                      (CAM_COMMON_OPCODE_BASE_v2 + 0x2)
 #define CAM_DUMP_REQ                        (CAM_COMMON_OPCODE_BASE_v2 + 0x3)
+#define CAM_QUERY_CAP_V3                    (CAM_COMMON_OPCODE_BASE_v2 + 0x4)
 
 #define CAM_EXT_OPCODE_BASE                     0x200
 #define CAM_CONFIG_DEV_EXTERNAL                 (CAM_EXT_OPCODE_BASE + 0x1)