Revert "ARM: shmobile: lager: correct memory map value and syntax"

This reverts commit a50e8a65200bbcea50d83d7f0195577636411020.
ARM: shmobile: lager: correct memory map

The base address of the second memory region on the lager
board is 0x140000000. Update the tag used in the dts file accordingly.

This is a documentation fix and should have no run-time affect.

This problem was introduced when the second memory region
was added to the lager dts file by 62bc32a2573c4219
("ARM: shmobile: Include all 4 GiB of memory on Lager)"
in v3.14.

Reported-by: NAOYA SHIIBA <naoya.shiiba.nx@renesas.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
(cherry picked from commit 126f998e4ae8bc45cd72c7e62c53767c007fc319)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
ARM: Remove cpuinit annotation from secondary_startup

This is part of a set of changes to remove cpuinit annotations from symbols
used directly or indirectly by shmobile_smp_apmu_enter_suspend() as it may
may be called after init.

Introduced by  commit a06b303de318bbb01 ("ARM: shmobile: APMU: Add
Core-Standby-state for Suspend to RAM") which is a backport of commit
d36004c0359f3365c.

This problem is not present in mainline as cpuinit annotations have
been removed entirely there. They were, however, present in v3.10.

Reported-by: Yoshifumi Hosoya <yoshifumi.hosoya.wj@renesas.com>
(Not present in mainline)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
ARM: shmobile: Remove cpuinit annotations for suspend

Remove cpuinit annotations from symbols used directly or indirectly by
shmobile_smp_apmu_enter_suspend() as it may may be called after init.

Introduced by  commit a06b303de318bbb01 ("ARM: shmobile: APMU: Add
Core-Standby-state for Suspend to RAM") which is a backport of commit
d36004c0359f3365c.

This problem is not present in mainline as cpuinit annotations have
been removed entirely there. They were, however, present in v3.10.

Reported-by: Yoshifumi Hosoya <yoshifumi.hosoya.wj@renesas.com>
(Not present in mainline)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
DMA: shdma: fix a bad merge - remove free_irq()

A bad merge resulted in a left-over free_irq() call. This patch removes it.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski+renesas@gmail.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
(cherry picked from commit e5ffa401eacd0e74178e20ba932200fc9fe41c07)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
spi: rspi: Remove unused variable in rspi_rz_transfer_one()

Introduced by commit 8b983e90ea1a3dd82070f96c062ad521a06b7cc0 ("spi: rspi:
Extract rspi_common_transfer()"), which removed its users.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 95029a00886f0c8d79e700cb8983b881c75af0f1)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
dma: of: Remove restriction that #dma-cells can't be 0

There is no sensible reason why #dma-cells shouldn't be allowed to be 0. It is
completely up to the DMA controller how many additional parameters, besides the
phandle, it needs to identify a channel. E.g. for DMA controller with only one
channel or for DMA controllers which don't have a restriction on which channel
can be used for which peripheral it completely legitimate to not require any
additional parameters.

Also fixes the following warning:
	drivers/dma/of-dma.c: In function 'of_dma_controller_register':
	drivers/dma/of-dma.c:67:7: warning: 'nbcells' may be used uninitialized in this function

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
(cherry picked from commit ff0e0f4f568e8d7593e0035c0c58067bcaf4ab07)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas: gadget: fixup: complete STATUS stage after receiving

Current usbhs gadget driver didn't complete STATUS stage after receiving.
It wasn't problem for us before, because some USB class doesn't use
DATA OUT stage in control transfer.
But, it is required on some device.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 3fe15505296cb563362e2cf6d3aed73e123e0df0)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: fix usbhs_pipe_malloc() to re-enable a pipe.

This patch fixes an issue that the driver cannot push a new data when
a pipe is re-enabled after the pipe is queued.

Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 6a0541599f54b556442d6130e4f9faaad91bf3a2)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: gadget: fix re-enabling pipe without re-connecting

This patch fixes an issue that the renesas_usbhs driver in gadget mode
cannot work correctly even if I disabled DMAC of the driver when I used
the g_zero driver and the testusb tool.

When a usb cable is re-connected, the renesas_usbhs driver calls the
usbhsp_flags_init() (via usbhs_hotplug() --> usbhs_mod_call(start) -->
usbhsg_try_start() --> usbhs_pipe_init()). However, the driver doesn't
call the usbhsp_flags_init() when usbhsg_ep_disable() is called.
So, if a gadget driver calls usb_ep_enable() and usb_ep_disable() again
and again, the renesas_usbhs driver will output the following log:

  renesas_usbhs renesas_usbhs: can't get pipe (BULK)
  renesas_usbhs renesas_usbhs: wrong recip request

Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit dfb87b8bfe09f933abaf387693992089f6f9053e)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: add R-Car Gen. 2 init and power control

In preparation for DT conversion to reduce reliance on platform device
callbacks.

Signed-off-by: Ulrich Hecht <ulrich.hecht+renesas@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 8ecef00fe1f33658ee36e902dba6850b51312073)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle

Some gadget drivers will call usb_ep_queue() more than once before
the first queue doesn't finish. However, this driver didn't handle
it correctly. So, this patch fixes the behavior of some
usbhs_pkt_handle using the "running" flag. Otherwise, the oops below
happens if we use g_ncm driver and when the "iperf -u -c host -b 200M"
is running.

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 80000007 [#1] SMP ARM
Modules linked in: usb_f_ncm g_ncm libcomposite u_ether
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W      3.17.0-rc1-00008-g8b2be8a-dirty #20
task: c051c7e0 ti: c0512000 task.ti: c0512000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xa8/0x114
pc : [<00000000>]    lr : [<c0278fb4>]    psr: 60000193
sp : c0513ce8  ip : c0513c58  fp : c0513d24
r10: 00000001  r9 : 00000193  r8 : eebec4a0
r7 : eebec410  r6 : eebe0c6c  r5 : 00000000  r4 : ee4a2774
r3 : 00000000  r2 : ee251e00  r1 : c0513cf4  r0 : ee4a2774

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 8355b2b3082d302091506703d2e4e239f7deed7f)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: protect mod->irq_{bemp,brdy}sts by spin lock

This patch protects the mod->irq_bempsts and mod->irq_brdysts by
spin lock in the usbhs_status_get_each_irq() because other functions
will write them during spin lock. Otherwise, the driver will clears
the BRDYSTS and/or BEMPSTS wrongly, and then, the transaction will not
finish.
Also since the driver should use the INTSTS0 and BRDYSTS and BEMPSTS
as the same timing, the patch protects them.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit c4d8199ba1a7aa390b06db23f4532e2c1875aefb)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: fix the condition of is_done in usbhsf_dma_push_done

This patch fixes the condition of is_done in usbhsf_dma_push_done().
This function will be called after a transmission finished by DMAC.
So, the function should check if the transmission packet is short packet
or not. Also the function should call try_run to send the zero packet
by the pio handler if the "*is_done" is not set. Otherwize, the
transaction will not finish if a gadget driver sets the "zero" flag
in a transmission.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit c0ed8b23b257a84d103764cdbd490ee5e2749da3)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: fix the usb_pkt_pop()

This patch fixes the usb_pkt_pop(). If a gadget driver calls
usb_ep_dequeue(), this driver will call the usb_pkt_pop().
So, the usb_pkt_pop() should cancel the transaction.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 2743e7f90dc08282d027dbc2f6486f5cb85aa493)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
usb: renesas_usbhs: Add device tree support for R-Car H2 and M2

This driver supports other SoCs, but they need boards/Soc depend code.
So, this patch adds device tree support for R-Car H2 and M2 initially.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit b854100eda59a1df9eaf7454cc7c297910055f42)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
soc_camera: Support VIDIOC_EXPBUF ioctl

This patch allows for exporting a dmabuf descriptor from soc_camera drivers.

Signed-off-by: Kazunori Kobayashi <kkobayas@igel.co.jp>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
(cherry picked from commit 0c87b375d25fa05bb9686f28eb3d720df0428866)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
mx2-camera: potential negative underflow bug

My static checker complains:

	drivers/media/platform/soc_camera/mx2_camera.c:1070
	mx2_emmaprp_resize() warn: no lower bound on 'num'

The heuristic is that it's looking for values which the user can
influence and we put an upper bound on them but we (perhaps
accidentally) allow negative numbers.

I am not very familiar with this code but I have looked at it and think
there might be a bug.  Making the variable unsigned seems like a safe
option either way and this silences the static checker warning.

The call tree is:
  -> subdev_do_ioctl()
     -> mx2_camera_set_fmt()
        -> mx2_emmaprp_resize()
The check:
	if (num > RESIZE_NUM_MAX)
can underflow and then we use "num" on the else path.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
(cherry picked from commit 6a73ba027ff5c439994a43d0d9faf53c6af0cd9b)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
rcar_vin: fix error message in rcar_vin_get_formats()

The dev_err() call is supposed to output <width>x<height> in decimal but one of
the format specifiers is "%x" instead of "%u" (most probably due  to a typo).

Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
(cherry picked from commit 33d9aca0b8daeeb71b4bfd6d2cc7778170f9eed1)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>