CVE-2013-2595: Untrested memory mapping in camera driver

The camera driver provides several interfaces to user space
clients. The user space clients communicate to the kernel via
syscalls such as ioctl or mmap. The camera driver provides an
uncontrolled mmap interface that allows an application with
access to the device file to map physical memory exceeding the
camera driver.s memory into user space. A locally installed,
unprivileged application can use this flaw to escalate privileges.

Code to handle MSM_CAM_IOCTL_SET_MEM_MAP_INFO IOCTL and associated
code was removed, as it is obsolete.

See:

https://www.codeaurora.org/projects/security-advisories/security-advisory-cve-2013-2595
Disable perflock and HTC PNP manager

Change-Id: Ic20ab3a058d0ae4fc54d6f6f0ce191a48947e4bd
cpufreq: Remove two phase ondemand governor

Change-Id: Ibcc055fa914dddf551cd5a79f99f99e8f8a7d5b7
cpufreq: Add interactive governor

Change-Id: I080e9cecb5c097e4ef8393566f643097918f9cff
msm: cpufreq: fix a race between hotplug and cpufreq

When msm_cpufreq_target() is called without holding the policy
semaphore, there is a rare chance that the cpu gets hotplugged in
the acpuclk_set_rate. The probability of this issue increases
when cross-calling is used or using interactive governor which
tries to set all cpu frequencies from a single thread.

Add a hotplug notifier and set the device_suspended flag holding
the suspend mutex, when cpu is going down. This mutex is always
held when frequency changes are done.

Change-Id: Ide3aa6927ad60d2512d63761c51bb15117461250
Signed-off-by: Narayanan Gopalakrishnan <nargop@codeaurora.org>
(cherry picked from commit 56f5a6de7f2ab48ed0538da727ad52673fb801a2)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: cpufreq: Remove cross-calling limitation

Remove cross-calling limitations imposed by cpufreq. Clock drivers
and SPM driver now allow changing of frequencies from any core. Using
cpus_allowed mask to check for core affinity works well with workqueues
but do not port so well when the core requesting frequency change is a
kthread with the flag PF_TASK_BOUND not set.

Change-Id: Iab664ce8657780814440a11dff77cc925df597f8
Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
(cherry picked from commit be01a17afb6b6e85456217caa1ac11eb0b6674e1)
(cherry picked from commit bd97cdfeb87eda0373721baaea744b02a27822f5)
msm: cpufreq: Implement suspend/resume for cpufreq driver

Cpufreq suspend variable get's updated in kernel pm notifier
callback which gets called in process context. This will create
window where cpufreq governor may try to change the frequency
before suspend variable is updated while resume.

Define suspend/resume for cpufreq driver to update suspend variable
in atomic context.

Don't update the policy->cur upon cpufreq driver failure.

CRs-fixed: 423791
Change-Id: Id78705f5c3b8bf801c6253e9362299280903769f
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
Revert "msm: cpufreq: Remove cross-calling limitation"

This reverts commit be01a17afb6b6e85456217caa1ac11eb0b6674e1.

Re-introduce cross calling in cpufreq to prevent race conditions in the
hardware when changing PLLs.

A core could be in retention, while another core, could try and set the
frequency of the core in retention, causing a change in PLL and when the
core exits retention, the PLL mismatch could hang the SPM state machine.

Change-Id: I99b454a0f146652f2d8a369f79f6d35748160dcb
Signed-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>
msm: cpufreq: increase priority of thread that increases frequencies

When the cpufreq governors request for increase in frequency from kworker
threads, there is chance that the kworker thread is cpu starved due to
other high priority threads, leading to undesirable increase in frequency
ramp-up latency. Add the calling thread to SCHED_FIFO policy when
requesting for increase in frequency and restore back to original policy
after ramp-up is completed.

Change-Id: Ie4fa199b7f9087717cb94dfcc2eddea27cc0012b
Signed-off-by: Narayanan Gopalakrishnan <nargop@codeaurora.org>

Conflicts:
	arch/arm/mach-msm/cpufreq.c
Revert "cpufreq: fix interactive bug during hotplug."

This reverts commit c5d82e843dc210898d67edc3362cfece50016c77.
cpufreq: interactive: take idle notifications only when active

Register an idle notifier only when the governor is active.  Also
short-circuit work of idle end if the governor is not enabled.

Signed-off-by: Sam Leffler <sleffler@chromium.org>
Change-Id: I4cae36dd2e7389540d337d74745ffbaa0131870f
cpufreq: interactive: keep freezer happy when not current governor

Fix a problem where the hung task mechanism was deeming the interactive
clock boost thread as hung.  This was because the thread is created at
module init but never run/woken up until needed.  If the governor is not
being used this can be forever.  To workaround this explicitly wake up
the thread once all the necessary data structures are initialized.  The
latter required some minor code shuffle.

Signed-off-by: Sam Leffler <sleffler@chromium.org>
Change-Id: Ie2c058dd75dcb6460ea10e7ac997e46baf66b1fe
cpufreq: interactive: handle speed up and down in the realtime task

Not useful to have a separate, non-realtime workqueue for speed down
events, avoid priority inversion for speed up events.

Change-Id: Iddcd05545245c847aa1bbe0b8790092914c813d2
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: remove input_boost handling

Now handled in userspace Power HAL instead.

Change-Id: I78a4a2fd471308bfcd785bbefcc65fede27314cf
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: always limit initial speed bump to hispeed

First bump speed up to hispeed_freq whenever the current speed is below
hispeed_freq, instead of only when the current speed is the minimum speed.
The previous code made it too difficult to use hispeed_freq as a common
intermediate speed on systems that frequently run at speeds between
minimum and hispeed_freq.

Change-Id: I04ec30bafabf5741e267ff289209b8c2d846824b
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: run at fraction of hispeed_freq when load is low

When load is below go_hispeed_load, apply the percentage of CPU load to
a max frequency of hispeed_freq instead of the max speed.  This avoids
jumping too quickly to hispeed_freq when it is a relatively low
percentage of max speed.  This also allows go_hispeed_load to be set to
a high percentage relative to hispeed_freq (as a percentage of max speed,
again useful when hispeed_freq is a low fraction of max speed), to cap
larger loads at hispeed_freq.  For example, a load of 60% will typically
move to 60% of hispeed_freq, not 60% of max speed.  This causes the
governor to apply two different speed caps, depending on whether load is
below or above go_hispeed_load.

Also fix the type of hispeed_freq, which was u64, to match other
speed data types (and avoid overhead and allow division).

Change-Id: Ie2d0668be161c074aaad77db2037505431457b3a
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: pin timers to associated CPU

Helps avoid waking up other CPUs to react to activity on the local CPU.

Change-Id: Ife272aaa7916894a437705d44521b1a1693fbe8e
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: use deferrable timer by default

Avoid wakeups only to handle the governor timer when the system is otherwise
idle.

For platforms where the power cost of remaining in idle at higher CPU
speed may outweigh the cost of a governor wakeup from idle to lower the speed,
set parameter cpufreq_interactive.governidle=1.

Change-Id: Id6c43eb35caecf9b0574fcdd5b769711bc7e6de6
Signed-off-by: LianWei WANG <a22439@motorola.com>
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: kick timer on idle exit past expiry

The deferrable timer list isn't checked on all idle exits, such as when
hi-res timers expire or ISRs schedule workers.  If the idle loop is
exited and it's past time to run the governor load polling timer,
run it immediately.  This ensures we handle load spikes caused by actvity
that does not run the normal timer list.

Rename the field that timestamps the "time_in_idle" value to be more
accurate.

Change-Id: Ied590ecbefc83c9a9ec5eb9e31903557f6fa1614
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: trace actual speed in target speed decisions

Tracing adds actual speed since this is expected to be key to the
choice of target speed.

Change-Id: Iec936102d0010c4e9dfa143c38a9fd0d551189c3
Signed-off-by: Todd Poynor <toddpoynor@google.com>