Merge remote-tracking branches 'asoc/topic/da7213', 'asoc/topic/da732x', 'asoc/topic/da9055', 'asoc/topic/davinci', 'asoc/topic/fsl', 'asoc/topic/fsl-esai', 'asoc/topic/fsl-sai' and 'asoc/topic/fsl-spdif' into asoc-next

Merge remote-tracking branches 'asoc/topic/arizona', 'asoc/topic/atmel', 'asoc/topic/cirrus', 'asoc/topic/cs4271', 'asoc/topic/cs42l51', 'asoc/topic/cs42l52', 'asoc/topic/cs42l73' and 'asoc/topic/da7210' into asoc-next

Merge remote-tracking branches 'asoc/topic/88pm860x', 'asoc/topic/ad1836', 'asoc/topic/ad193x', 'asoc/topic/adau1977', 'asoc/topic/ak4104', 'asoc/topic/ak4641', 'asoc/topic/ak4671' and 'asoc/topic/alc5623' into asoc-next

ASoC: Fixes for v3.14

A few things here:
 - Avoid memory leaks in error cases with DPCM, this code has never been
   that well tested in mainline due to the lack of mainline drivers but
   we now have one queued for the merge window!
 - Fix the N810 audio driver to load when booted with DT since the
   platform was converted to DT during the merge window.
 - Fixes for initialisation of some MFD drivers that are probably unused
   in mainline

# gpg: Signature made Mon 10 Mar 2014 18:21:32 GMT using RSA key ID 7EA229BD
# gpg: Good signature from "Mark Brown <broonie@sirena.org.uk>"
# gpg:                 aka "Mark Brown <broonie@debian.org>"
# gpg:                 aka "Mark Brown <broonie@kernel.org>"
# gpg:                 aka "Mark Brown <broonie@tardis.ed.ac.uk>"
# gpg:                 aka "Mark Brown <broonie@linaro.org>"
# gpg:                 aka "Mark Brown <Mark.Brown@linaro.org>"

Freeing the current list element while iterating over the list will cause a use
after free since the iterator function will still use the current element to
look up the next. Use list_for_each_safe() and remove the element from the list
before freeing it to avoid this.

Fixes: 1438c2f6 ("ASoC: Add a per component dai list")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>

For controls registers with snd_soc_add_dai_controls snd_kcontrol_chip() returns
a pointer to the DAI, not to the CODEC.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>

Try to spot locking issues by asserting that the DAPM mutex is held when
it should be. There's a bit of fun due to us not requiring the lock to be
held prior to the card being instantiated which mean we need to wrap the
assert in some paths and this isn't methodical by any stretch of the
imagination.
Signed-off-by: Mark Brown <broonie@linaro.org>

The function is not called outside soc-dapm.c so there is no need for it
to be exported.
Signed-off-by: Mark Brown <broonie@linaro.org>

Now that every DAI has a component we can track the DAIs on a per component
basis. This simplifies the DAI lookup when we are only interested in DAIs of a
specific component and also makes it possible to have multiple components with
the same parent device and also register DAIs.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>

snd_soc_register_dais() looks up the CODEC that is registering the DAIs by
looping over all registered CODECs. This patch updates the code to
simply pass the CODEC that registers the DAIs to snd_soc_register_dais() thus
avoiding the lookup.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>

snd_soc_register_dais() has basically the same code as snd_soc_register_dai(),
but running in a loop. The only difference is that snd_soc_register_dai() calls
fmt_single_name() to generate the DAIs name and snd_soc_register_dais() calls
fmt_multiple_name(). This patch pushes the check in __snd_soc_register_component()
which decides whether to call snd_soc_register_dai() or snd_soc_register_dais()
to snd_soc_register_dais() to decide which naming scheme to use. This allows us
to remove snd_soc_register_dai().

The patch also updates snd_soc_register_dais() to unregister every DAI it finds
for the component rather than trying to unregister one DAI for each DAI that was
registered. Both have the same result since there won't be more DAIs than what
have been registered, but the former is easier to implement.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>

Merge branch 'topic/pcm' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-core

Merge remote-tracking branches 'asoc/fix/88pm860', 'asoc/fix/omap' and 'asoc/fix/si476x' into asoc-linus

The 88pm860 is a MFD device and the CODEC driver is using the regmap struct of
the parent device, hence automatic IO setup will not work and we need to
manually call snd_soc_codec_set_cache_io(). The issue was introduced in commit
f9ded3b2 ("ASoC: 88pm860x: Use regmap for I/O").

Fixes: f9ded3b2 ("ASoC: 88pm860x: Use regmap for I/O").
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org

The si476x is a MFD device and the CODEC driver is using the regmap struct of
the parent device, hence automatic IO setup will not work and we need to
manually call snd_soc_codec_set_cache_io(). The issue was introduced commit
d6173df3 ("ASoC: si476x: Remove custom register I/O implementation")

Fixes: d6173df3 ("ASoC: si476x: Remove custom register I/O implementation")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org

Use table based setup to register the DAPM widgets and routes. This on one hand
makes the code a bit shorter and cleaner and on the other hand the board level
DAPM elements get registered in the card's DAPM context rather than in the
CODEC's DAPM context.

While we are at it also remove the snd_soc_dapm_enable_pin() in the init
callback. Pins are enabled by default.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Tested-by: Bo Shen <voice.shen@atmel.com>
Acked-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

Pull ARM SoC fixes from from Olof Johansson:
 "A collection of fixes for ARM platforms.  A little large due to us
  missing to do one last week, but there's nothing in particular here
  that is in itself large and scary.

  Mostly a handful of smaller fixes all over the place.  The majority is
  made up of fixes for OMAP, but there are a few for others as well.  In
  particular, there was a decision to rename a binding for the Broadcom
  pinctrl block that we need to go in before the final release since we
  then treat it as ABI"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: dts: omap3-gta04: Add ti,omap36xx to compatible property to avoid problems with booting
  ARM: tegra: add LED options back into tegra_defconfig
  ARM: dts: omap3-igep: fix boot fail due wrong compatible match
  ARM: OMAP3: Fix pinctrl interrupts for core2
  pinctrl: Rename Broadcom Capri pinctrl binding
  pinctrl: refer to updated dt binding string.
  Update dtsi with new pinctrl compatible string
  ARM: OMAP: Kill warning in CPUIDLE code with !CONFIG_SMP
  ARM: OMAP2+: Add support for thumb mode on DT booted N900
  ARM: OMAP2+: clock: fix clkoutx2 with CLK_SET_RATE_PARENT
  ARM: OMAP4: hwmod: Fix SOFTRESET logic for OMAP4
  ARM: DRA7: hwmod data: correct the sysc data for spinlock
  ARM: OMAP5: PRM: Fix reboot handling
  ARM: sunxi: dt: Change the touchscreen compatibles
  ARM: sun7i: dt: Fix interrupt trigger types

Pull NFS client bugfixes from Trond Myklebust:
 "Highlights include:

   - Fix another nfs4_sequence corruptor in RELEASE_LOCKOWNER
   - Fix an Oopsable delegation callback race
   - Fix another bad stateid infinite loop
   - Fail the data server I/O is the stateid represents a lost lock
   - Fix an Oopsable sunrpc trace event"

* tag 'nfs-for-3.14-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  SUNRPC: Fix oops when trace sunrpc_task events in nfs client
  NFSv4: Fail the truncate() if the lock/open stateid is invalid
  NFSv4.1 Fail data server I/O if stateid represents a lost lock
  NFSv4: Fix the return value of nfs4_select_rw_stateid
  NFSv4: nfs4_stateid_is_current should return 'true' for an invalid stateid
  NFS: Fix a delegation callback race
  NFSv4: Fix another nfs4_sequence corruptor

Pull USB fixes from Greg KH:
 "Here are 4 USB fixes for your current tree.

  Two of them are reverts to hopefully resolve the nasty XHCI
  regressions we have been having on some types of devices.  The other
  two are quirks for some Logitech video devices"

* tag 'usb-3.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  Revert "USBNET: ax88179_178a: enable tso if usb host supports sg dma"
  Revert "xhci 1.0: Limit arbitrarily-aligned scatter gather."
  usb: Make DELAY_INIT quirk wait 100ms between Get Configuration requests
  usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e

Pull staging driver tree fix from Greg KH:
 "Here is a single staging driver fix for your tree.

  It resolves an issue with arbritary writes to memory if a specific
  driver is loaded"

* tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()

This fixes CVE-2014-0102.

The following command sequence produces an oops:

	keyctl new_session
	i=`keyctl newring _ses @s`
	keyctl link @s $i

The problem is that search_nested_keyrings() sees two keyrings that have
matching type and description, so keyring_compare_object() returns true.
s_n_k() then passes the key to the iterator function -
keyring_detect_cycle_iterator() - which *should* check to see whether this is
the keyring of interest, not just one with the same name.

Because assoc_array_find() will return one and only one match, I assumed that
the iterator function would only see an exact match or never be called - but
the iterator isn't only called from assoc_array_find()...

The oops looks something like this:

	kernel BUG at /data/fs/linux-2.6-fscache/security/keys/keyring.c:1003!
	invalid opcode: 0000 [#1] SMP
	...
	RIP: keyring_detect_cycle_iterator+0xe/0x1f
	...
	Call Trace:
	  search_nested_keyrings+0x76/0x2aa
	  __key_link_check_live_key+0x50/0x5f
	  key_link+0x4e/0x85
	  keyctl_keyring_link+0x60/0x81
	  SyS_keyctl+0x65/0xe4
	  tracesys+0xdd/0xe2

The fix is to make keyring_detect_cycle_iterator() check that the key it
has is the key it was actually looking for rather than calling BUG_ON().

A testcase has been included in the keyutils testsuite for this:

	http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/commit/?id=891f3365d07f1996778ade0e3428f01878a1790bReported-by: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull thermal fixes from Zhang Rui:
 "Specifics:

   - Update the help text of INT3403 Thermal driver, which was not
     friendly to users.  From Zhang Rui.

   - The "type" sysfs attribute of x86_pkg_temp_thermal registered
     thermal zones includes an instance number, which makes the
     thermal-to-hwmon bridge fails to group them all in a single hwmon
     device.  Fixed by Jean Delvare.

   - The hwmon device registered by x86_pkg_temp_thermal driver is
     redundant because the temperature value reported by
     x86_pkg_temp_thermal is already reported by the coretemp driver.
     Fixed by Jean Delvare.

   - Fix a problem that the cooling device can not be updated properly
     if it is initialized at max cooling state.  From Ni Wade.

   - Fix a problem that OF registered thermal zones are running without
     thermal governors.  From Zhang Rui.

   - Commit beeb5a1e ("thermal: rcar-thermal: Enable driver
     compilation with COMPILE_TEST") broke build on archs wihout io
     memory.  Thus make it depend on HAS_IOMEM to bypass build failures.
     Fixed by Richard Weinberger"

* 'for-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  Thermal: thermal zone governor fix
  Thermal: Allow first update of cooling device state
  thermal,rcar_thermal: Add dependency on HAS_IOMEM
  x86_pkg_temp_thermal: Fix the thermal zone type
  x86_pkg_temp_thermal: Do not expose as a hwmon device
  Thermal: update INT3404 thermal driver help text

Pull spi fixes from Mark Brown:
 "A scattering of driver specific fixes here.

  The fixes from Axel cover bitrot in apparently unmaintained drivers,
  the at79 bug is fixing a glitch on /CS during initialisation of some
  devices which could break some slaves and the remainder are fixes for
  recently introduced bugs from the past release cycle or so"

* tag 'spi-v3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: atmel: add missing spi_master_{resume,suspend} calls to PM callbacks
  spi: coldfire-qspi: Fix getting correct address for *mcfqspi
  spi: fsl-dspi: Fix getting correct address for master
  spi: spi-ath79: fix initial GPIO CS line setup
  spi: spi-imx: spi_imx_remove: do not disable disabled clocks
  spi-topcliff-pch: Fix probing when DMA mode is used
  spi/topcliff-pch: Fix DMA channel

Pull SCSI target fixes from Nicholas Bellinger:
 "This series addresses a number of outstanding issues wrt to active I/O
  shutdown using iser-target.  This includes:

   - Fix a long standing tpg_state bug where a tpg could be referenced
     during explicit shutdown (v3.1+ stable)
   - Use list_del_init for iscsi_cmd->i_conn_node so list_empty checks
     work as expected (v3.10+ stable)
   - Fix a isert_conn->state related hung task bug + ensure outstanding
     I/O completes during session shutdown.  (v3.10+ stable)
   - Fix isert_conn->post_send_buf_count accounting for RDMA READ/WRITEs
     (v3.10+ stable)
   - Ignore FRWR completions during active I/O shutdown (v3.12+ stable)
   - Fix command leakage for interrupt coalescing during active I/O
     shutdown (v3.13+ stable)

  Also included is another DIF emulation fix from Sagi specific to
  v3.14-rc code"

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  Target/sbc: Fix sbc_copy_prot for offset scatters
  iser-target: Fix command leak for tx_desc->comp_llnode_batch
  iser-target: Ignore completions for FRWRs in isert_cq_tx_work
  iser-target: Fix post_send_buf_count for RDMA READ/WRITE
  iscsi/iser-target: Fix isert_conn->state hung shutdown issues
  iscsi/iser-target: Use list_del_init for ->i_conn_node
  iscsi-target: Fix iscsit_get_tpg_from_np tpg_state bug

Revert commit 3130497f ("ACPI / sleep: pm_power_off needs more
sanity checks to be installed") that breaks power ACPI power off on a
lot of systems, because it checks wrong registers.

Fixes: 3130497f ("ACPI / sleep: pm_power_off needs more sanity checks to be installed")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It is quite confusing to name the pointer to davinci_pcm_dma_params as
dma_data. Rename the pointer to avoid confusion.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

The reference clock path on newer IP FLLs requires a different
configuration, and should avoid integer mode operation. This patch adds
support for both the new encoding and updates the calculation.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

Newer IP has an expanded encoding for the fratio bits. As the additional
used bits are unused on older IP simply expand the field to the new
size.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

No part of the FLL calculation depends on the value determined for the
gain but the gain does depend on other values. In preparation for future
updates this patch moves the gain to be the last thing calculated.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

OUTDIV will remain unchanged whilst the rest of the FLL configuration is
calculated so do this first.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

As we now calculate the FLL configuration at a later stage in the
process the fout member of the FLL structure will contain the desired
Fout frequency so no need to pass this in seperately.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>