Merge git://git.denx.de/u-boot-x86
diff --git a/arch/arm/include/asm/arch-sunxi/clock_sun6i.h b/arch/arm/include/asm/arch-sunxi/clock_sun6i.h
index 8afeaf8..3a59016 100644
--- a/arch/arm/include/asm/arch-sunxi/clock_sun6i.h
+++ b/arch/arm/include/asm/arch-sunxi/clock_sun6i.h
@@ -275,9 +275,13 @@
  * These are EHCI1 - EHCI3 in the datasheet (EHCI0 is for the OTG) we call
  * them 0 - 2 like they were called on older SoCs.
  */
+#define AHB_GATE_OFFSET_USB_OHCI3	31
+#define AHB_GATE_OFFSET_USB_OHCI2	30
+#define AHB_GATE_OFFSET_USB_OHCI1	29
 #define AHB_GATE_OFFSET_USB_OHCI0	28
-#define AHB_GATE_OFFSET_USB_EHCI2	27
-#define AHB_GATE_OFFSET_USB_EHCI1	26
+#define AHB_GATE_OFFSET_USB_EHCI3	27
+#define AHB_GATE_OFFSET_USB_EHCI2	26
+#define AHB_GATE_OFFSET_USB_EHCI1	25
 #define AHB_GATE_OFFSET_USB_EHCI0	24
 #elif defined(CONFIG_MACH_SUN50I)
 #define AHB_GATE_OFFSET_USB_OHCI0	28
@@ -290,7 +294,7 @@
 #define AHB_GATE_OFFSET_USB_EHCI1	27
 #define AHB_GATE_OFFSET_USB_EHCI0	26
 #endif
-#ifdef CONFIG_MACH_SUN50I
+#if defined(CONFIG_MACH_SUN50I) || defined(CONFIG_MACH_SUNXI_H3_H5)
 #define AHB_GATE_OFFSET_USB0		23
 #elif !defined(CONFIG_MACH_SUN8I_R40)
 #define AHB_GATE_OFFSET_USB0		24
diff --git a/arch/arm/include/asm/arch-sunxi/cpu_sun4i.h b/arch/arm/include/asm/arch-sunxi/cpu_sun4i.h
index ee64836..02ce739 100644
--- a/arch/arm/include/asm/arch-sunxi/cpu_sun4i.h
+++ b/arch/arm/include/asm/arch-sunxi/cpu_sun4i.h
@@ -63,10 +63,11 @@
 #ifdef CONFIG_SUNXI_GEN_SUN6I
 #if defined(CONFIG_MACH_SUNXI_H3_H5) || defined(CONFIG_MACH_SUN50I)
 #define SUNXI_USBPHY_BASE		0x01c19000
-#define SUNXI_USB0_BASE			0x01c1a000
-#define SUNXI_USB1_BASE			0x01c1b000
-#define SUNXI_USB2_BASE			0x01c1c000
-#define SUNXI_USB3_BASE			0x01c1d000
+#define SUNXI_USB0_BASE			SUNXI_USBPHY_BASE
+#define SUNXI_USB1_BASE			0x01c1a000
+#define SUNXI_USB2_BASE			0x01c1b000
+#define SUNXI_USB3_BASE			0x01c1c000
+#define SUNXI_USB4_BASE			0x01c1d000
 #else
 #define SUNXI_USB0_BASE			0x01c19000
 #define SUNXI_USB1_BASE			0x01c1a000
diff --git a/arch/arm/mach-imx/mx5/Kconfig b/arch/arm/mach-imx/mx5/Kconfig
index 06322b2..100257b 100644
--- a/arch/arm/mach-imx/mx5/Kconfig
+++ b/arch/arm/mach-imx/mx5/Kconfig
@@ -8,9 +8,11 @@
 config MX51
 	bool
 	select SYS_FSL_ERRATUM_ESDHC_A001
+	select ARM_CORTEX_A8_CVE_2017_5715
 
 config MX53
 	bool
+	select ARM_CORTEX_A8_CVE_2017_5715
 
 choice
 	prompt "MX5 board select"
diff --git a/drivers/usb/host/ehci-sunxi.c b/drivers/usb/host/ehci-sunxi.c
index 97d06d5..7a79931 100644
--- a/drivers/usb/host/ehci-sunxi.c
+++ b/drivers/usb/host/ehci-sunxi.c
@@ -17,8 +17,10 @@
 #include <generic-phy.h>
 
 #ifdef CONFIG_SUNXI_GEN_SUN4I
+#define BASE_DIST		0x8000
 #define AHB_CLK_DIST		2
 #else
+#define BASE_DIST		0x1000
 #define AHB_CLK_DIST		1
 #endif
 
@@ -47,6 +49,7 @@
 	struct ehci_hccr *hccr = (struct ehci_hccr *)devfdt_get_addr(dev);
 	struct ehci_hcor *hcor;
 	int extra_ahb_gate_mask = 0;
+	u8 reg_mask = 0;
 	int phys, ret;
 
 	priv->cfg = (const struct ehci_sunxi_cfg *)dev_get_driver_data(dev);
@@ -86,10 +89,11 @@
 	 * This should go away once we've moved to the driver model for
 	 * clocks resp. phys.
 	 */
+	reg_mask = ((uintptr_t)hccr - SUNXI_USB1_BASE) / BASE_DIST;
 	priv->ahb_gate_mask = 1 << AHB_GATE_OFFSET_USB_EHCI0;
 	extra_ahb_gate_mask = priv->cfg->extra_ahb_gate_mask;
-	priv->ahb_gate_mask <<= phys * AHB_CLK_DIST;
-	extra_ahb_gate_mask <<= phys * AHB_CLK_DIST;
+	priv->ahb_gate_mask <<= reg_mask * AHB_CLK_DIST;
+	extra_ahb_gate_mask <<= reg_mask * AHB_CLK_DIST;
 
 	setbits_le32(&priv->ccm->ahb_gate0,
 		     priv->ahb_gate_mask | extra_ahb_gate_mask);
diff --git a/drivers/usb/host/ohci-sunxi.c b/drivers/usb/host/ohci-sunxi.c
index e13f6ec..0ddbdbe 100644
--- a/drivers/usb/host/ohci-sunxi.c
+++ b/drivers/usb/host/ohci-sunxi.c
@@ -17,8 +17,10 @@
 #include <generic-phy.h>
 
 #ifdef CONFIG_SUNXI_GEN_SUN4I
+#define BASE_DIST		0x8000
 #define AHB_CLK_DIST		2
 #else
+#define BASE_DIST		0x1000
 #define AHB_CLK_DIST		1
 #endif
 
@@ -33,9 +35,9 @@
 };
 
 struct ohci_sunxi_priv {
+	ohci_t ohci;
 	struct sunxi_ccm_reg *ccm;
 	u32 *reset0_cfg;
-	ohci_t ohci;
 	int ahb_gate_mask; /* Mask of ahb_gate0 clk gate bits for this hcd */
 	int usb_gate_mask; /* Mask of usb_clk_cfg clk gate bits for this hcd */
 	struct phy phy;
@@ -48,6 +50,7 @@
 	struct ohci_sunxi_priv *priv = dev_get_priv(dev);
 	struct ohci_regs *regs = (struct ohci_regs *)devfdt_get_addr(dev);
 	int extra_ahb_gate_mask = 0;
+	u8 reg_mask = 0;
 	int phys, ret;
 
 	priv->cfg = (const struct ohci_sunxi_cfg *)dev_get_driver_data(dev);
@@ -89,12 +92,13 @@
 	 * This should go away once we've moved to the driver model for
 	 * clocks resp. phys.
 	 */
+	reg_mask = ((uintptr_t)regs - (SUNXI_USB1_BASE + 0x400)) / BASE_DIST;
 	priv->ahb_gate_mask = 1 << AHB_GATE_OFFSET_USB_OHCI0;
 	extra_ahb_gate_mask = priv->cfg->extra_ahb_gate_mask;
 	priv->usb_gate_mask = CCM_USB_CTRL_OHCI0_CLK;
-	priv->ahb_gate_mask <<= phys * AHB_CLK_DIST;
-	extra_ahb_gate_mask <<= phys * AHB_CLK_DIST;
-	priv->usb_gate_mask <<= phys;
+	priv->ahb_gate_mask <<= reg_mask * AHB_CLK_DIST;
+	extra_ahb_gate_mask <<= reg_mask * AHB_CLK_DIST;
+	priv->usb_gate_mask <<= reg_mask;
 
 	setbits_le32(&priv->ccm->ahb_gate0,
 		     priv->ahb_gate_mask | extra_ahb_gate_mask);
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 2350831..fba78dc 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -359,7 +359,7 @@
 } urb_priv_t;
 #define URB_DEL 1
 
-#define NUM_EDS 8		/* num of preallocated endpoint descriptors */
+#define NUM_EDS 32		/* num of preallocated endpoint descriptors */
 
 #define NUM_TD 64		/* we need more TDs than EDs */
 
diff --git a/tools/env/fw_env.c b/tools/env/fw_env.c
index 3a5ad02..a5d7595 100644
--- a/tools/env/fw_env.c
+++ b/tools/env/fw_env.c
@@ -1427,21 +1427,14 @@
 	}
 
 	dev_current = 0;
-
-	if (!flash_io(O_RDONLY)) {
-		crc0 = crc32(0, (uint8_t *)environment.data, ENV_SIZE);
-		crc0_ok = (crc0 == *environment.crc);
-	} else if (have_redund_env) {
-		/*
-		 * to give the redundant env a chance, maybe it's good:
-		 * mark env crc0 invalid then test below if crc1 is ok
-		 */
-		crc0_ok = 0;
-	} else {
+	if (flash_io(O_RDONLY)) {
 		ret = -EIO;
 		goto open_cleanup;
 	}
 
+	crc0 = crc32(0, (uint8_t *)environment.data, ENV_SIZE);
+
+	crc0_ok = (crc0 == *environment.crc);
 	if (!have_redund_env) {
 		if (!crc0_ok) {
 			fprintf(stderr,
@@ -1469,10 +1462,8 @@
 		 */
 		environment.image = addr1;
 		if (flash_io(O_RDONLY)) {
-			crc1_ok = 0;
-		} else {
-			crc1 = crc32(0, (uint8_t *)redundant->data, ENV_SIZE);
-			crc1_ok = (crc1 == redundant->crc);
+			ret = -EIO;
+			goto open_cleanup;
 		}
 
 		/* Check flag scheme compatibility */
@@ -1498,6 +1489,9 @@
 			goto open_cleanup;
 		}
 
+		crc1 = crc32(0, (uint8_t *)redundant->data, ENV_SIZE);
+
+		crc1_ok = (crc1 == redundant->crc);
 		flag1 = redundant->flags;
 
 		if (crc0_ok && !crc1_ok) {