cpufreq: Fix sysfs deadlock with concurrent hotplug/frequency switch

Running one program that continuously hotplugs and replugs a cpu
concurrently with another program that continuously writes to the
scaling_set_speed node eventually deadlocks with:

=============================================
[ INFO: possible recursive locking detected ]
3.4.0 #37 Tainted: G        W
---------------------------------------------
filemonkey/122 is trying to acquire lock:
 (s_active#13){++++.+}, at: [<c01a3d28>] sysfs_remove_dir+0x9c/0xb4

but task is already holding lock:
 (s_active#13){++++.+}, at: [<c01a22f0>] sysfs_write_file+0xe8/0x140

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(s_active#13);
  lock(s_active#13);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

2 locks held by filemonkey/122:
 #0:  (&buffer->mutex){+.+.+.}, at: [<c01a2230>] sysfs_write_file+0x28/0x140
 #1:  (s_active#13){++++.+}, at: [<c01a22f0>] sysfs_write_file+0xe8/0x140

stack backtrace:
[<c0014fcc>] (unwind_backtrace+0x0/0x120) from [<c00ca600>] (validate_chain+0x6f8/0x1054)
[<c00ca600>] (validate_chain+0x6f8/0x1054) from [<c00cb778>] (__lock_acquire+0x81c/0x8d8)
[<c00cb778>] (__lock_acquire+0x81c/0x8d8) from [<c00cb9c0>] (lock_acquire+0x18c/0x1e8)
[<c00cb9c0>] (lock_acquire+0x18c/0x1e8) from [<c01a3ba8>] (sysfs_addrm_finish+0xd0/0x180)
[<c01a3ba8>] (sysfs_addrm_finish+0xd0/0x180) from [<c01a3d28>] (sysfs_remove_dir+0x9c/0xb4)
[<c01a3d28>] (sysfs_remove_dir+0x9c/0xb4) from [<c02d0e5c>] (kobject_del+0x10/0x38)
[<c02d0e5c>] (kobject_del+0x10/0x38) from [<c02d0f74>] (kobject_release+0xf0/0x194)
[<c02d0f74>] (kobject_release+0xf0/0x194) from [<c0565a98>] (cpufreq_cpu_put+0xc/0x24)
[<c0565a98>] (cpufreq_cpu_put+0xc/0x24) from [<c05683f0>] (store+0x6c/0x74)
[<c05683f0>] (store+0x6c/0x74) from [<c01a2314>] (sysfs_write_file+0x10c/0x140)
[<c01a2314>] (sysfs_write_file+0x10c/0x140) from [<c014af44>] (vfs_write+0xb0/0x128)
[<c014af44>] (vfs_write+0xb0/0x128) from [<c014b06c>] (sys_write+0x3c/0x68)
[<c014b06c>] (sys_write+0x3c/0x68) from [<c000e0e0>] (ret_fast_syscall+0x0/0x3c)

This is because store() in cpufreq.c indirectly grabs a kobject
with kobject_get() and is the last one to call kobject_put()
indirectly via cpufreq_cpu_put().

Fix this deadlock by introducing two new functions,
cpufreq_cpu_get_sysfs() and cpufreq_cpu_put_sysfs() which do the
same thing as cpufreq_cpu_{get,put}() but don't grab the kobject.

CRs-fixed: 366560

Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
(cherry picked from commit ddda0cf21dc6cb487aacd81fdb1a7343d2746d94)

Change-Id: I6ac89789e89099cff315d7a02de216423376b7f7
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>

Conflicts:

	drivers/cpufreq/cpufreq.c
sysfs: handle 'parent deleted before child added'

In scsi at least two cases of the parent device being deleted before the
child is added have been observed.

1/ scsi is performing async scans and the device is removed prior to the
   async can thread running (can happen with an in-opportune / unlikely
   unplug during initial scan).

2/ libsas discovery event running after the parent port has been torn
   down (this is a bug in libsas).

Result in crash signatures like:
 BUG: unable to handle kernel NULL pointer dereference at 0000000000000098
 IP: [<ffffffff8115e100>] sysfs_create_dir+0x32/0xb6
 ...
 Process scsi_scan_8 (pid: 5417, threadinfo ffff88080bd16000, task ffff880801b8a0b0)
 Stack:
  00000000fffffffe ffff880813470628 ffff88080bd17cd0 ffff88080614b7e8
  ffff88080b45c108 00000000fffffffe ffff88080bd17d20 ffffffff8125e4a8
  ffff88080bd17cf0 ffffffff81075149 ffff88080bd17d30 ffff88080614b7e8
 Call Trace:
  [<ffffffff8125e4a8>] kobject_add_internal+0x120/0x1e3
  [<ffffffff81075149>] ? trace_hardirqs_on+0xd/0xf
  [<ffffffff8125e641>] kobject_add_varg+0x41/0x50
  [<ffffffff8125e70b>] kobject_add+0x64/0x66
  [<ffffffff8131122b>] device_add+0x12d/0x63a

In this scenario the parent is still valid (because we have a
reference), but it has been device_del()'d which means its kobj->sd
pointer is NULL'd via:

 device_del()->kobject_del()->sysfs_remove_dir()

...and then sysfs_create_dir() (without this fix) goes ahead and
de-references parent_sd via sysfs_ns_type():

 return (sd->s_flags & SYSFS_NS_TYPE_MASK) >> SYSFS_NS_TYPE_SHIFT;

This scenario is being fixed in scsi/libsas, but if other subsystems
present the same ordering the system need not immediately crash.

Change-Id: I435d14af35fa7cb4d4017890af9411299a9a8455
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: James Bottomley <JBottomley@parallels.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
gpu: ion: Add check for overlapping heaps

During bootup add check to ensure heap addresses are not overlapping
with each other. If a heap is found to be overlapping with another
heap boot will be stopped with a call to panic.

Change-Id: Id37aefa2e09aa165ec376e241e282faf5f3c5737
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: Ensure ioctl return correct error codes

Under certain error conditions the following ION ioctl's would return
success even when the operation failed:

-ION_IOC_CLEAN_CACHES
-ION_IOC_INV_CACHES
-ION_IOC_CLEAN_INV_CACHES

Add return of correct error codes when an error occurs.

Change-Id: Ie8824bfecbb423c23d32c6a3d7058f06d8322906
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: IOCTL return success when error occurs

ION_IOC_MAP, ION_IOC_SHARE, and ION_IOC_IMPORT may return
success when an error occurs.

Add correct error handling to ION_IOC_MAP, ION_IOC_SHARE, and
ION_IOC_IMPORT.

Change-Id: Idb7e58c94dab53fd82dd49150af9eaec78430c40
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: Check for null name argument

Add check for null argument to avoid dereferencing
a null-pointer.

Change-Id: Icb452d0764e375bf2684e013c51d260de98e8583
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: Add more debug info to client debugfs IF

Add logging of buffer physical address (if allocation
is from physically contiguous heap) and iommu mapping
information to the ion client debug interface.

Change-Id: Id3a77c1b5e3c5d15b11b3612f07d10092922cdff
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: Add lock around debug routine

Access to rb tree of user and kernel ION clients
must be protected by a mutex.

Change-Id: Ie27eba65f8cab3a7c20c041eb46429ba62c5c00f
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: Add dump of memory map

Add dump of physical memory map, showing allocated and
free areas, to debugfs interface for heaps with carveout memory.

Change-Id: I9bda9f3e555e55570c95e652616ca1fcc25eb0ab
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: ion: Check return code of msm_allocate_iova_address

In the IOMMU heap, the return value of msm_allocate_iova_address
needs to be checked instead of the value of the iova address.
Check the return value instead.

Change-Id: I4554515d17c926a7dd738824aff21eb65d2ba56a
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

Conflicts:

	drivers/gpu/ion/ion_iommu_heap.c
gpu: ion: Fix fragmentation debug message cond.

If an ion allocation fails because of memory fragmentation a debug
message should be printed. However, the logic that decides whether
the debug message should be printed or not is incorrect causing
the debug message to not be printed when the amount of space
available in the heap is equal to the requested size.

Change-Id: Iaaf8cd6742aeffab7bcb4806e485326fb9690945
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
gpu: msm: Upgrade Adreno driver

 * Match ICS_STRAWBERRY from 08/11/2012

Change-Id: I04cba20ae9c8a2038a2573ab2cbf8d2cbfae940b