Merge tag 'staging-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging/IIO fixes from Greg KH:
 "Here are some small staging/IIO driver fixes for 4.14-rc4

  Most of these have been in my tree for a while due to travels, sorry
  for the delay. They resolve a number of small issues reported by
  people, mostly for the iio drivers. Nothing major in here, full
  details are in the shortlog.

  All have been linux-next for a few weeks with no reported issues"

* tag 'staging-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (23 commits)
  staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
  iio: core: Return error for failed read_reg
  iio: ad7793: Fix the serial interface reset
  iio: ad_sigma_delta: Implement a dedicated reset function
  IIO: BME280: Updates to Humidity readings need ctrl_reg write!
  iio: adc: mcp320x: Fix readout of negative voltages
  iio: adc: mcp320x: Fix oops on module unload
  iio: adc: stm32: fix bad error check on max_channels
  iio: trigger: stm32-timer: fix a corner case to write preset
  iio: trigger: stm32-timer: preset shouldn't be buffered
  iio: adc: twl4030: Return an error if we can not enable the vusb3v1 regulator in 'twl4030_madc_probe()'
  iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
  iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
  staging: rtl8723bs: avoid null pointer dereference on pmlmepriv
  staging: rtl8723bs: add missing range check on id
  staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
  staging: speakup: fix speakup-r empty line lockup
  staging: pi433: Move limit check to switch default to kill warning
  staging: r8822be: fix null pointer dereferences with a null driver_adapter
  staging: mt29f_spinand: Enable the read ECC before program the page
  ...

22 files changed, 126 insertions, 51 deletions

diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index e6706a09e100..47c3d7f32900 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
         unsigned int vref_mv)
 {
         struct ad7793_state *st = iio_priv(indio_dev);
-        int i, ret = -1;
+        int i, ret;
         unsigned long long scale_uv;
         u32 id;
 
@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
                 return ret;
 
         /* reset the serial interface */
-        ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret));
+        ret = ad_sd_reset(&st->sd, 32);
         if (ret < 0)
                 goto out;
         usleep_range(500, 2000); /* Wait for at least 500us */
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index d10bd0c97233..22c4c17cd996 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -177,6 +177,34 @@ out:
 }
 EXPORT_SYMBOL_GPL(ad_sd_read_reg);
 
+/**
+ * ad_sd_reset() - Reset the serial interface
+ *
+ * @sigma_delta: The sigma delta device
+ * @reset_length: Number of SCLKs with DIN = 1
+ *
+ * Returns 0 on success, an error code otherwise.
+ **/
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length)
+{
+        uint8_t *buf;
+        unsigned int size;
+        int ret;
+
+        size = DIV_ROUND_UP(reset_length, 8);
+        buf = kcalloc(size, sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        memset(buf, 0xff, size);
+        ret = spi_write(sigma_delta->spi, buf, size);
+        kfree(buf);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ad_sd_reset);
+
 static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta,
         unsigned int mode, unsigned int channel)
 {
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index 634717ae12f3..071dd23a33d9 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -17,6 +17,8 @@
  * MCP3204
  * MCP3208
  * ------------
+ * 13 bit converter
+ * MCP3301
  *
  * Datasheet can be found here:
  * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf  mcp3001
@@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index,
 }
 
 static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
-                                  bool differential, int device_index)
+                                  bool differential, int device_index, int *val)
 {
         int ret;
 
@@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
 
         switch (device_index) {
         case mcp3001:
-                return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                return 0;
         case mcp3002:
         case mcp3004:
         case mcp3008:
-                return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                return 0;
         case mcp3201:
-                return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                return 0;
         case mcp3202:
         case mcp3204:
         case mcp3208:
-                return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                return 0;
         case mcp3301:
-                return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12);
+                *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8
+                                    | adc->rx_buf[1], 12);
+                return 0;
         default:
                 return -EINVAL;
         }
@@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev,
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 ret = mcp320x_adc_conversion(adc, channel->address,
-                        channel->differential, device_index);
-
+                        channel->differential, device_index, val);
                 if (ret < 0)
                         goto out;
 
-                *val = ret;
                 ret = IIO_VAL_INT;
                 break;
 
@@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi)
         indio_dev->name = spi_get_device_id(spi)->name;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &mcp320x_info;
+        spi_set_drvdata(spi, indio_dev);
 
         chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data];
         indio_dev->channels = chip_info->channels;
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index e3c15f88075f..4df32cf1650e 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1666,7 +1666,7 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev)
 
         num_channels = of_property_count_u32_elems(node, "st,adc-channels");
         if (num_channels < 0 ||
-            num_channels >= adc_info->max_channels) {
+            num_channels > adc_info->max_channels) {
                 dev_err(&indio_dev->dev, "Bad st,adc-channels?\n");
                 return num_channels < 0 ? num_channels : -EINVAL;
         }
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index d1210024f6bc..e0dc20488335 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -52,7 +52,7 @@
 
 #define ADS1015_CFG_COMP_QUE_MASK       GENMASK(1, 0)
 #define ADS1015_CFG_COMP_LAT_MASK       BIT(2)
-#define ADS1015_CFG_COMP_POL_MASK       BIT(2)
+#define ADS1015_CFG_COMP_POL_MASK       BIT(3)
 #define ADS1015_CFG_COMP_MODE_MASK      BIT(4)
 #define ADS1015_CFG_DR_MASK     GENMASK(7, 5)
 #define ADS1015_CFG_MOD_MASK    BIT(8)
@@ -1017,10 +1017,12 @@ static int ads1015_probe(struct i2c_client *client,
 
                 switch (irq_trig) {
                 case IRQF_TRIGGER_LOW:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                         break;
                 case IRQF_TRIGGER_HIGH:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 1edd99f0c5e5..e3cfb91bffc6 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -887,21 +887,27 @@ static int twl4030_madc_probe(struct platform_device *pdev)
 
         /* Enable 3v1 bias regulator for MADC[3:6] */
         madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1");
-        if (IS_ERR(madc->usb3v1))
-                return -ENODEV;
+        if (IS_ERR(madc->usb3v1)) {
+                ret = -ENODEV;
+                goto err_i2c;
+        }
 
         ret = regulator_enable(madc->usb3v1);
-        if (ret)
+        if (ret) {
                 dev_err(madc->dev, "could not enable 3v1 bias regulator\n");
+                goto err_i2c;
+        }
 
         ret = iio_device_register(iio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "could not register iio device\n");
-                goto err_i2c;
+                goto err_usb3v1;
         }
 
         return 0;
 
+err_usb3v1:
+        regulator_disable(madc->usb3v1);
 err_i2c:
         twl4030_madc_set_current_generator(madc, 0, 0);
 err_current_generator:
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index d99bb1460fe2..02e833b14db0 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -463,8 +463,17 @@ int st_sensors_set_dataready_irq(struct iio_dev *indio_dev, bool enable)
         u8 drdy_mask;
         struct st_sensor_data *sdata = iio_priv(indio_dev);
 
-        if (!sdata->sensor_settings->drdy_irq.addr)
+        if (!sdata->sensor_settings->drdy_irq.addr) {
+                /*
+                 * there are some devices (e.g. LIS3MDL) where drdy line is
+                 * routed to a given pin and it is not possible to select a
+                 * different one. Take into account irq status register
+                 * to understand if irq trigger can be properly supported
+                 */
+                if (sdata->sensor_settings->drdy_irq.addr_stat_drdy)
+                        sdata->hw_irq_trigger = enable;
                 return 0;
+        }
 
         /* Enable/Disable the interrupt generator 1. */
         if (sdata->sensor_settings->drdy_irq.ig1.en_addr > 0) {
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 17ec4cee51dc..a47428b4d31b 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -310,8 +310,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf,
         ret = indio_dev->info->debugfs_reg_access(indio_dev,
                                                   indio_dev->cached_reg_addr,
                                                   0, &val);
-        if (ret)
+        if (ret) {
                 dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__);
+                return ret;
+        }
 
         len = snprintf(buf, sizeof(buf), "0x%X\n", val);
 
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index e68368b5b2a3..08aafba4481c 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -315,6 +315,10 @@ static const struct st_sensor_settings st_magn_sensors_settings[] = {
                                 },
                         },
                 },
+                .drdy_irq = {
+                        /* drdy line is routed drdy pin */
+                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 0d2ea3ee371b..8f26428804a2 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -573,7 +573,7 @@ static int bmp280_chip_config(struct bmp280_data *data)
         u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) |
                   BMP280_OSRS_PRESS_X(data->oversampling_press + 1);
 
-        ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS,
+        ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS,
                                  BMP280_OSRS_TEMP_MASK |
                                  BMP280_OSRS_PRESS_MASK |
                                  BMP280_MODE_MASK,
diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
index 9b9053494daf..eb212f8c8879 100644
--- a/drivers/iio/trigger/stm32-timer-trigger.c
+++ b/drivers/iio/trigger/stm32-timer-trigger.c
@@ -174,6 +174,7 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv)
                 clk_disable(priv->clk);
 
         /* Stop timer */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
         regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
         regmap_write(priv->regmap, TIM_PSC, 0);
         regmap_write(priv->regmap, TIM_ARR, 0);
@@ -715,8 +716,9 @@ static ssize_t stm32_count_set_preset(struct iio_dev *indio_dev,
         if (ret)
                 return ret;
 
+        /* TIMx_ARR register shouldn't be buffered (ARPE=0) */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
         regmap_write(priv->regmap, TIM_ARR, preset);
-        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE);
 
         return len;
 }
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index d11c6de9c777..6150d2780e22 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -223,11 +223,9 @@ static int ad7192_setup(struct ad7192_state *st,
         struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi);
         unsigned long long scale_uv;
         int i, ret, id;
-        u8 ones[6];
 
         /* reset the serial interface */
-        memset(&ones, 0xFF, 6);
-        ret = spi_write(st->sd.spi, &ones, 6);
+        ret = ad_sd_reset(&st->sd, 48);
         if (ret < 0)
                 goto out;
         usleep_range(500, 1000); /* Wait for at least 500us */
diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
index 13eaf16ecd16..87595c594b12 100644
--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
+++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
@@ -496,8 +496,12 @@ static int spinand_program_page(struct spi_device *spi_nand,
         if (!wbuf)
                 return -ENOMEM;
 
-        enable_read_hw_ecc = 0;
-        spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        enable_read_hw_ecc = 1;
+        retval = spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        if (retval < 0) {
+                dev_err(&spi_nand->dev, "ecc error on read page!!!\n");
+                return retval;
+        }
 
         for (i = offset, j = 0; i < len; i++, j++)
                 wbuf[i] &= buf[j];
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index c4b1b218ea38..290b419aa9dd 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -570,12 +570,6 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
                 dev_dbg(&spi->dev, "set: DIO mapping");
         #endif
 
-        // check DIO number
-        if (DIONumber > 5) {
-                dev_dbg(&spi->dev, "set: illegal input param");
-                return -EINVAL;
-        }
-
         switch (DIONumber) {
         case 0: mask=MASK_DIO0; shift=SHIFT_DIO0; regaddr=REG_DIOMAPPING1; break;
         case 1: mask=MASK_DIO1; shift=SHIFT_DIO1; regaddr=REG_DIOMAPPING1; break;
@@ -583,6 +577,9 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
         case 3: mask=MASK_DIO3; shift=SHIFT_DIO3; regaddr=REG_DIOMAPPING1; break;
         case 4: mask=MASK_DIO4; shift=SHIFT_DIO4; regaddr=REG_DIOMAPPING2; break;
         case 5: mask=MASK_DIO5; shift=SHIFT_DIO5; regaddr=REG_DIOMAPPING2; break;
+        default:
+                dev_dbg(&spi->dev, "set: illegal input param");
+                return -EINVAL;
         }
 
         // read reg
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 6b778206a1a3..cb8a95aabd6c 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -119,9 +119,8 @@ void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
 
 void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
 {
-        rtw_free_mlme_priv_ie_data(pmlmepriv);
-
         if (pmlmepriv) {
+                rtw_free_mlme_priv_ie_data(pmlmepriv);
                 if (pmlmepriv->free_bss_buf) {
                         vfree(pmlmepriv->free_bss_buf);
                 }
diff --git a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
index 92277457aba4..ce1dd6f9036f 100644
--- a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
+++ b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
@@ -311,6 +311,8 @@ static ssize_t proc_set_cam(struct file *file, const char __user *buffer, size_t
 
                 if (num < 2)
                         return count;
+                if (id >= TOTAL_CAM_ENTRY)
+                        return -EINVAL;
 
                 if (strcmp("c", cmd) == 0) {
                         _clear_cam_entry(adapter, id);
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
index 5f84526cb5b5..edbf6af1c8b7 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
@@ -2901,11 +2901,11 @@ halmac_update_datapack_88xx(struct halmac_adapter *halmac_adapter,
         if (halmac_adapter->fw_version.h2c_version < 4)
                 return HALMAC_RET_FW_NO_SUPPORT;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "[TRACE]%s ==========>\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
-
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "[TRACE]%s <==========\n", __func__);
 
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index f33024e4d853..544f638ed3ef 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -1618,10 +1618,11 @@ halmac_send_h2c_set_pwr_mode_88xx(struct halmac_adapter *halmac_adapter,
         void *driver_adapter = NULL;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "%s!!\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
         h2c_header = h2c_buff;
         h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
 
@@ -1713,10 +1714,11 @@ halmac_media_status_rpt_88xx(struct halmac_adapter *halmac_adapter, u8 op_mode,
         void *driver_adapter = NULL;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "halmac_send_h2c_set_pwr_mode_88xx!!\n");
 
-        driver_adapter = halmac_adapter->driver_adapter;
         h2c_header = H2c_buff;
         h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
 
@@ -2143,10 +2145,11 @@ halmac_func_ctrl_ch_switch_88xx(struct halmac_adapter *halmac_adapter,
         enum halmac_cmd_process_status *process_status =
                 &halmac_adapter->halmac_state.scan_state_set.process_status;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "halmac_ctrl_ch_switch!!\n");
 
-        driver_adapter = halmac_adapter->driver_adapter;
         halmac_api = (struct halmac_api *)halmac_adapter->halmac_api;
 
         if (halmac_transition_scan_state_88xx(
@@ -2276,15 +2279,13 @@ enum halmac_ret_status halmac_send_h2c_update_bcn_parse_info_88xx(
 {
         u8 h2c_buff[HALMAC_H2C_CMD_SIZE_88XX] = {0};
         u16 h2c_seq_mum = 0;
-        void *driver_adapter = NULL;
+        void *driver_adapter = halmac_adapter->driver_adapter;
         struct halmac_h2c_header_info h2c_header_info;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "%s!!\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
-
         UPDATE_BEACON_PARSING_INFO_SET_FUNC_EN(h2c_buff, bcn_ie_info->func_en);
         UPDATE_BEACON_PARSING_INFO_SET_SIZE_TH(h2c_buff, bcn_ie_info->size_th);
         UPDATE_BEACON_PARSING_INFO_SET_TIMEOUT(h2c_buff, bcn_ie_info->timeout);
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 67956e24779c..56f7be6af1f6 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1376,6 +1376,8 @@ static void reset_highlight_buffers(struct vc_data *);
 
 static int read_all_key;
 
+static int in_keyboard_notifier;
+
 static void start_read_all_timer(struct vc_data *vc, int command);
 
 enum {
@@ -1408,7 +1410,10 @@ static void read_all_doc(struct vc_data *vc)
         cursor_track = read_all_mode;
         spk_reset_index_count(0);
         if (get_sentence_buf(vc, 0) == -1) {
-                kbd_fakekey2(vc, RA_DOWN_ARROW);
+                del_timer(&cursor_timer);
+                if (!in_keyboard_notifier)
+                        speakup_fake_down_arrow();
+                start_read_all_timer(vc, RA_DOWN_ARROW);
         } else {
                 say_sentence_num(0, 0);
                 synth_insert_next_index(0);
@@ -2212,8 +2217,10 @@ static int keyboard_notifier_call(struct notifier_block *nb,
         int ret = NOTIFY_OK;
         static int keycode;     /* to hold the current keycode */
 
+        in_keyboard_notifier = 1;
+
         if (vc->vc_mode == KD_GRAPHICS)
-                return ret;
+                goto out;
 
         /*
          * First, determine whether we are handling a fake keypress on
@@ -2225,7 +2232,7 @@ static int keyboard_notifier_call(struct notifier_block *nb,
          */
 
         if (speakup_fake_key_pressed())
-                return ret;
+                goto out;
 
         switch (code) {
         case KBD_KEYCODE:
@@ -2266,6 +2273,8 @@ static int keyboard_notifier_call(struct notifier_block *nb,
                         break;
                 }
         }
+out:
+        in_keyboard_notifier = 0;
         return ret;
 }
 
diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c
index 74cce4f1a7bd..27ecf6fb49fd 100644
--- a/drivers/staging/unisys/visorbus/visorchipset.c
+++ b/drivers/staging/unisys/visorbus/visorchipset.c
@@ -1826,7 +1826,7 @@ static __init int visorutil_spar_detect(void)
         return 0;
 }
 
-static int init_unisys(void)
+static int __init init_unisys(void)
 {
         int result;
 
@@ -1841,7 +1841,7 @@ static int init_unisys(void)
         return 0;
 };
 
-static void exit_unisys(void)
+static void __exit exit_unisys(void)
 {
         acpi_bus_unregister_driver(&unisys_acpi_driver);
 }
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 0159ca4407d8..be08849175ea 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -612,18 +612,20 @@ free_pagelist(struct vchiq_pagelist_info *pagelistinfo,
                         if (head_bytes > actual)
                                 head_bytes = actual;
 
-                        memcpy((char *)page_address(pages[0]) +
+                        memcpy((char *)kmap(pages[0]) +
                                 pagelist->offset,
                                 fragments,
                                 head_bytes);
+                        kunmap(pages[0]);
                 }
                 if ((actual >= 0) && (head_bytes < actual) &&
                         (tail_bytes != 0)) {
-                        memcpy((char *)page_address(pages[num_pages - 1]) +
+                        memcpy((char *)kmap(pages[num_pages - 1]) +
                                 ((pagelist->offset + actual) &
                                 (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)),
                                 fragments + g_cache_line_size,
                                 tail_bytes);
+                        kunmap(pages[num_pages - 1]);
                 }
 
                 down(&g_free_fragments_mutex);
diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h
index 5ba430cc9a87..1fc7abd28b0b 100644
--- a/include/linux/iio/adc/ad_sigma_delta.h
+++ b/include/linux/iio/adc/ad_sigma_delta.h
@@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
 int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
         unsigned int size, unsigned int *val);
 
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length);
+
 int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
         const struct iio_chan_spec *chan, int *val);
 int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta,