39 files changed, 1850 insertions, 307 deletions

diff --git a/lib/Kconfig b/lib/Kconfig
index f0df318104e7..133ebc0c1773 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -210,9 +210,11 @@ config RANDOM32_SELFTEST
 # compression support is select'ed if needed
 #
 config 842_COMPRESS
+        select CRC32
         tristate
 
 config 842_DECOMPRESS
+        select CRC32
         tristate
 
 config ZLIB_INFLATE
@@ -475,6 +477,11 @@ config DDR
           information. This data is useful for drivers handling
           DDR SDRAM controllers.
 
+config IRQ_POLL
+        bool "IRQ polling library"
+        help
+          Helper library to poll interrupt mitigation using polling.
+
 config MPILIB
         tristate
         select CLZ_TAB
@@ -512,9 +519,9 @@ source "lib/fonts/Kconfig"
 config SG_SPLIT
         def_bool n
         help
-         Provides a heler to split scatterlists into chunks, each chunk being a
-         scatterlist. This should be selected by a driver or an API which
-         whishes to split a scatterlist amongst multiple DMA channel.
+         Provides a helper to split scatterlists into chunks, each chunk being
+         a scatterlist. This should be selected by a driver or an API which
+         whishes to split a scatterlist amongst multiple DMA channels.
 
 #
 # sg chaining option
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index e2a236a7341f..f28f7fad452f 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -580,6 +580,14 @@ config DEBUG_VM_RB
 
           If unsure, say N.
 
+config DEBUG_VM_PGFLAGS
+        bool "Debug page-flags operations"
+        depends on DEBUG_VM
+        help
+          Enables extra validation on page flags operations.
+
+          If unsure, say N.
+
 config DEBUG_VIRTUAL
         bool "Debug VM translations"
         depends on DEBUG_KERNEL && X86
@@ -1392,6 +1400,21 @@ config RCU_EQS_DEBUG
 
 endmenu # "RCU Debugging"
 
+config DEBUG_WQ_FORCE_RR_CPU
+        bool "Force round-robin CPU selection for unbound work items"
+        depends on DEBUG_KERNEL
+        default n
+        help
+          Workqueue used to implicitly guarantee that work items queued
+          without explicit CPU specified are put on the local CPU.  This
+          guarantee is no longer true and while local CPU is still
+          preferred work items may be put on foreign CPUs.  Kernel
+          parameter "workqueue.debug_force_rr_cpu" is added to force
+          round-robin CPU selection to flush out usages which depend on the
+          now broken guarantee.  This config option enables the debug
+          feature by default.  When enabled, memory and cache locality will
+          be impacted.
+
 config DEBUG_BLOCK_EXT_DEVT
         bool "Force extended block device numbers and spread them"
         depends on DEBUG_KERNEL
@@ -1419,6 +1442,19 @@ config DEBUG_BLOCK_EXT_DEVT
 
           Say N if you are unsure.
 
+config CPU_HOTPLUG_STATE_CONTROL
+        bool "Enable CPU hotplug state control"
+        depends on DEBUG_KERNEL
+        depends on HOTPLUG_CPU
+        default n
+        help
+          Allows to write steps between "offline" and "online" to the CPUs
+          sysfs target file so states can be stepped granular. This is a debug
+          option for now as the hotplug machinery cannot be stopped and
+          restarted at arbitrary points yet.
+
+          Say N if your are unsure.
+
 config NOTIFIER_ERROR_INJECTION
         tristate "Notifier error injection"
         depends on DEBUG_KERNEL
@@ -1589,7 +1625,6 @@ config FAULT_INJECTION_STACKTRACE_FILTER
 
 config LATENCYTOP
         bool "Latency measuring infrastructure"
-        depends on HAVE_LATENCYTOP_SUPPORT
         depends on DEBUG_KERNEL
         depends on STACKTRACE_SUPPORT
         depends on PROC_FS
@@ -1886,3 +1921,43 @@ source "samples/Kconfig"
 
 source "lib/Kconfig.kgdb"
 
+source "lib/Kconfig.ubsan"
+
+config ARCH_HAS_DEVMEM_IS_ALLOWED
+        bool
+
+config STRICT_DEVMEM
+        bool "Filter access to /dev/mem"
+        depends on MMU
+        depends on ARCH_HAS_DEVMEM_IS_ALLOWED
+        default y if TILE || PPC
+        ---help---
+          If this option is disabled, you allow userspace (root) access to all
+          of memory, including kernel and userspace memory. Accidental
+          access to this is obviously disastrous, but specific access can
+          be used by people debugging the kernel. Note that with PAT support
+          enabled, even in this case there are restrictions on /dev/mem
+          use due to the cache aliasing requirements.
+
+          If this option is switched on, and IO_STRICT_DEVMEM=n, the /dev/mem
+          file only allows userspace access to PCI space and the BIOS code and
+          data regions.  This is sufficient for dosemu and X and all common
+          users of /dev/mem.
+
+          If in doubt, say Y.
+
+config IO_STRICT_DEVMEM
+        bool "Filter I/O access to /dev/mem"
+        depends on STRICT_DEVMEM
+        ---help---
+          If this option is disabled, you allow userspace (root) access to all
+          io-memory regardless of whether a driver is actively using that
+          range.  Accidental access to this is obviously disastrous, but
+          specific access can be used by people debugging kernel drivers.
+
+          If this option is switched on, the /dev/mem file only allows
+          userspace access to *idle* io-memory ranges (see /proc/iomem) This
+          may break traditional users of /dev/mem (dosemu, legacy X, etc...)
+          if the driver using a given range cannot be disabled.
+
+          If in doubt, say Y.
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
new file mode 100644
index 000000000000..e07c1ba9ba13
--- /dev/null
+++ b/lib/Kconfig.ubsan
@@ -0,0 +1,31 @@
+config ARCH_HAS_UBSAN_SANITIZE_ALL
+        bool
+
+config UBSAN
+        bool "Undefined behaviour sanity checker"
+        help
+          This option enables undefined behaviour sanity checker
+          Compile-time instrumentation is used to detect various undefined
+          behaviours in runtime. Various types of checks may be enabled
+          via boot parameter ubsan_handle (see: Documentation/ubsan.txt).
+
+config UBSAN_SANITIZE_ALL
+        bool "Enable instrumentation for the entire kernel"
+        depends on UBSAN
+        depends on ARCH_HAS_UBSAN_SANITIZE_ALL
+        default y
+        help
+          This option activates instrumentation for the entire kernel.
+          If you don't enable this option, you have to explicitly specify
+          UBSAN_SANITIZE := y for the files/directories you want to check for UB.
+          Enabling this option will get kernel image size increased
+          significantly.
+
+config UBSAN_ALIGNMENT
+        bool "Enable checking of pointers alignment"
+        depends on UBSAN
+        default y if !HAVE_EFFICIENT_UNALIGNED_ACCESS
+        help
+          This option enables detection of unaligned memory accesses.
+          Enabling this option on architectures that support unaligned
+          accesses may produce a lot of false positives.
diff --git a/lib/Makefile b/lib/Makefile
index 180dd4d0dd41..a7c26a41a738 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -31,7 +31,7 @@ obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
 obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += hexdump.o
-obj-$(CONFIG_TEST_HEXDUMP) += test-hexdump.o
+obj-$(CONFIG_TEST_HEXDUMP) += test_hexdump.o
 obj-y += kstrtox.o
 obj-$(CONFIG_TEST_BPF) += test_bpf.o
 obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
@@ -154,7 +154,7 @@ obj-$(CONFIG_GLOB) += glob.o
 obj-$(CONFIG_MPILIB) += mpi/
 obj-$(CONFIG_SIGNATURE) += digsig.o
 
-obj-$(CONFIG_CLZ_TAB) += clz_tab.o
+lib-$(CONFIG_CLZ_TAB) += clz_tab.o
 
 obj-$(CONFIG_DDR) += jedec_ddr_data.o
 
@@ -165,6 +165,7 @@ obj-$(CONFIG_GENERIC_NET_UTILS) += net_utils.o
 
 obj-$(CONFIG_SG_SPLIT) += sg_split.o
 obj-$(CONFIG_STMP_DEVICE) += stmp_device.o
+obj-$(CONFIG_IRQ_POLL) += irq_poll.o
 
 libfdt_files = fdt.o fdt_ro.o fdt_wip.o fdt_rw.o fdt_sw.o fdt_strerror.o \
                fdt_empty_tree.o
@@ -209,3 +210,6 @@ quiet_cmd_build_OID_registry = GEN     $@
 clean-files     += oid_registry_data.c
 
 obj-$(CONFIG_UCS2_STRING) += ucs2_string.o
+obj-$(CONFIG_UBSAN) += ubsan.o
+
+UBSAN_SANITIZE_ubsan.o := n
diff --git a/lib/atomic64_test.c b/lib/atomic64_test.c
index d62de8bf022d..123481814320 100644
--- a/lib/atomic64_test.c
+++ b/lib/atomic64_test.c
@@ -17,7 +17,7 @@
 #include <linux/atomic.h>
 
 #ifdef CONFIG_X86
-#include <asm/processor.h>      /* for boot_cpu_has below */
+#include <asm/cpufeature.h>     /* for boot_cpu_has below */
 #endif
 
 #define TEST(bit, op, c_op, val)                                \
diff --git a/lib/cpumask.c b/lib/cpumask.c
index 5a70f6196f57..81dedaab36cc 100644
--- a/lib/cpumask.c
+++ b/lib/cpumask.c
@@ -41,6 +41,7 @@ int cpumask_any_but(const struct cpumask *mask, unsigned int cpu)
                         break;
         return i;
 }
+EXPORT_SYMBOL(cpumask_any_but);
 
 /* These are not inline because of header tangles. */
 #ifdef CONFIG_CPUMASK_OFFSTACK
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 547f7f923dbc..519b5a10fd70 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -21,7 +21,7 @@
 #define ODEBUG_HASH_BITS        14
 #define ODEBUG_HASH_SIZE        (1 << ODEBUG_HASH_BITS)
 
-#define ODEBUG_POOL_SIZE        512
+#define ODEBUG_POOL_SIZE        1024
 #define ODEBUG_POOL_MIN_LEVEL   256
 
 #define ODEBUG_CHUNK_SHIFT      PAGE_SHIFT
diff --git a/lib/devres.c b/lib/devres.c
index 8c85672639d3..cb1464c411a2 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -236,7 +236,7 @@ struct pcim_iomap_devres {
 
 static void pcim_iomap_release(struct device *gendev, void *res)
 {
-        struct pci_dev *dev = container_of(gendev, struct pci_dev, dev);
+        struct pci_dev *dev = to_pci_dev(gendev);
         struct pcim_iomap_devres *this = res;
         int i;
 
diff --git a/lib/div64.c b/lib/div64.c
index 62a698a432bc..7f345259c32f 100644
--- a/lib/div64.c
+++ b/lib/div64.c
@@ -13,7 +13,8 @@
  *
  * Code generated for this function might be very inefficient
  * for some CPUs. __div64_32() can be overridden by linking arch-specific
- * assembly versions such as arch/ppc/lib/div64.S and arch/sh/lib/div64.S.
+ * assembly versions such as arch/ppc/lib/div64.S and arch/sh/lib/div64.S
+ * or by defining a preprocessor macro in arch/include/asm/div64.h.
  */
 
 #include <linux/export.h>
@@ -23,6 +24,7 @@
 /* Not needed on 64bit architectures */
 #if BITS_PER_LONG == 32
 
+#ifndef __div64_32
 uint32_t __attribute__((weak)) __div64_32(uint64_t *n, uint32_t base)
 {
         uint64_t rem = *n;
@@ -55,8 +57,8 @@ uint32_t __attribute__((weak)) __div64_32(uint64_t *n, uint32_t base)
         *n = res;
         return rem;
 }
-
 EXPORT_SYMBOL(__div64_32);
+#endif
 
 #ifndef div_s64_rem
 s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder)
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index d34bd24c2c84..4a1515f4b452 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1181,7 +1181,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end
 
 static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
 {
-        if (overlap(addr, len, _text, _etext) ||
+        if (overlap(addr, len, _stext, _etext) ||
             overlap(addr, len, __start_rodata, __end_rodata))
                 err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
 }
diff --git a/lib/dump_stack.c b/lib/dump_stack.c
index 6745c6230db3..c30d07e99dba 100644
--- a/lib/dump_stack.c
+++ b/lib/dump_stack.c
@@ -25,6 +25,7 @@ static atomic_t dump_lock = ATOMIC_INIT(-1);
 
 asmlinkage __visible void dump_stack(void)
 {
+        unsigned long flags;
         int was_locked;
         int old;
         int cpu;
@@ -33,9 +34,8 @@ asmlinkage __visible void dump_stack(void)
          * Permit this cpu to perform nested stack dumps while serialising
          * against other CPUs
          */
-        preempt_disable();
-
 retry:
+        local_irq_save(flags);
         cpu = smp_processor_id();
         old = atomic_cmpxchg(&dump_lock, -1, cpu);
         if (old == -1) {
@@ -43,6 +43,7 @@ retry:
         } else if (old == cpu) {
                 was_locked = 1;
         } else {
+                local_irq_restore(flags);
                 cpu_relax();
                 goto retry;
         }
@@ -52,7 +53,7 @@ retry:
         if (!was_locked)
                 atomic_set(&dump_lock, -1);
 
-        preempt_enable();
+        local_irq_restore(flags);
 }
 #else
 asmlinkage __visible void dump_stack(void)
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 116a166b096f..0a1139644d32 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -270,6 +270,25 @@ EXPORT_SYMBOL(gen_pool_destroy);
  */
 unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
 {
+        return gen_pool_alloc_algo(pool, size, pool->algo, pool->data);
+}
+EXPORT_SYMBOL(gen_pool_alloc);
+
+/**
+ * gen_pool_alloc_algo - allocate special memory from the pool
+ * @pool: pool to allocate from
+ * @size: number of bytes to allocate from the pool
+ * @algo: algorithm passed from caller
+ * @data: data passed to algorithm
+ *
+ * Allocate the requested number of bytes from the specified pool.
+ * Uses the pool allocation function (with first-fit algorithm by default).
+ * Can not be used in NMI handler on architectures without
+ * NMI-safe cmpxchg implementation.
+ */
+unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+                genpool_algo_t algo, void *data)
+{
         struct gen_pool_chunk *chunk;
         unsigned long addr = 0;
         int order = pool->min_alloc_order;
@@ -290,8 +309,8 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
 
                 end_bit = chunk_size(chunk) >> order;
 retry:
-                start_bit = pool->algo(chunk->bits, end_bit, start_bit, nbits,
-                                pool->data);
+                start_bit = algo(chunk->bits, end_bit, start_bit,
+                                 nbits, data, pool);
                 if (start_bit >= end_bit)
                         continue;
                 remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
@@ -310,7 +329,7 @@ retry:
         rcu_read_unlock();
         return addr;
 }
-EXPORT_SYMBOL(gen_pool_alloc);
+EXPORT_SYMBOL(gen_pool_alloc_algo);
 
 /**
  * gen_pool_dma_alloc - allocate special memory from the pool for DMA usage
@@ -501,15 +520,74 @@ EXPORT_SYMBOL(gen_pool_set_algo);
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @data: additional data - unused
+ * @pool: pool to find the fit region memory from
  */
 unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
-                unsigned long start, unsigned int nr, void *data)
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
 {
         return bitmap_find_next_zero_area(map, size, start, nr, 0);
 }
 EXPORT_SYMBOL(gen_pool_first_fit);
 
 /**
+ * gen_pool_first_fit_align - find the first available region
+ * of memory matching the size requirement (alignment constraint)
+ * @map: The address to base the search on
+ * @size: The bitmap size in bits
+ * @start: The bitnumber to start searching at
+ * @nr: The number of zeroed bits we're looking for
+ * @data: data for alignment
+ * @pool: pool to get order from
+ */
+unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
+{
+        struct genpool_data_align *alignment;
+        unsigned long align_mask;
+        int order;
+
+        alignment = data;
+        order = pool->min_alloc_order;
+        align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+        return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
+}
+EXPORT_SYMBOL(gen_pool_first_fit_align);
+
+/**
+ * gen_pool_fixed_alloc - reserve a specific region
+ * @map: The address to base the search on
+ * @size: The bitmap size in bits
+ * @start: The bitnumber to start searching at
+ * @nr: The number of zeroed bits we're looking for
+ * @data: data for alignment
+ * @pool: pool to get order from
+ */
+unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
+{
+        struct genpool_data_fixed *fixed_data;
+        int order;
+        unsigned long offset_bit;
+        unsigned long start_bit;
+
+        fixed_data = data;
+        order = pool->min_alloc_order;
+        offset_bit = fixed_data->offset >> order;
+        if (WARN_ON(fixed_data->offset & ((1UL << order) - 1)))
+                return size;
+
+        start_bit = bitmap_find_next_zero_area(map, size,
+                        start + offset_bit, nr, 0);
+        if (start_bit != offset_bit)
+                start_bit = size;
+        return start_bit;
+}
+EXPORT_SYMBOL(gen_pool_fixed_alloc);
+
+/**
  * gen_pool_first_fit_order_align - find the first available region
  * of memory matching the size requirement. The region will be aligned
  * to the order of the size specified.
@@ -518,10 +596,11 @@ EXPORT_SYMBOL(gen_pool_first_fit);
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @data: additional data - unused
+ * @pool: pool to find the fit region memory from
  */
 unsigned long gen_pool_first_fit_order_align(unsigned long *map,
                 unsigned long size, unsigned long start,
-                unsigned int nr, void *data)
+                unsigned int nr, void *data, struct gen_pool *pool)
 {
         unsigned long align_mask = roundup_pow_of_two(nr) - 1;
 
@@ -537,12 +616,14 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @data: additional data - unused
+ * @pool: pool to find the fit region memory from
  *
  * Iterate over the bitmap to find the smallest free region
  * which we can allocate the memory.
  */
 unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
-                unsigned long start, unsigned int nr, void *data)
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
 {
         unsigned long start_bit = size;
         unsigned long len = size + 1;
diff --git a/lib/iomap_copy.c b/lib/iomap_copy.c
index 4527e751b5e0..b8f1d6cbb200 100644
--- a/lib/iomap_copy.c
+++ b/lib/iomap_copy.c
@@ -42,6 +42,27 @@ void __attribute__((weak)) __iowrite32_copy(void __iomem *to,
 EXPORT_SYMBOL_GPL(__iowrite32_copy);
 
 /**
+ * __ioread32_copy - copy data from MMIO space, in 32-bit units
+ * @to: destination (must be 32-bit aligned)
+ * @from: source, in MMIO space (must be 32-bit aligned)
+ * @count: number of 32-bit quantities to copy
+ *
+ * Copy data from MMIO space to kernel space, in units of 32 bits at a
+ * time.  Order of access is not guaranteed, nor is a memory barrier
+ * performed afterwards.
+ */
+void __ioread32_copy(void *to, const void __iomem *from, size_t count)
+{
+        u32 *dst = to;
+        const u32 __iomem *src = from;
+        const u32 __iomem *end = src + count;
+
+        while (src < end)
+                *dst++ = __raw_readl(src++);
+}
+EXPORT_SYMBOL_GPL(__ioread32_copy);
+
+/**
  * __iowrite64_copy - copy data to MMIO space, in 64-bit or 32-bit units
  * @to: destination, in MMIO space (must be 64-bit aligned)
  * @from: source (must be 64-bit aligned)
diff --git a/lib/irq_poll.c b/lib/irq_poll.c
new file mode 100644
index 000000000000..836f7db4e548
--- /dev/null
+++ b/lib/irq_poll.c
@@ -0,0 +1,222 @@
+/*
+ * Functions related to interrupt-poll handling in the block layer. This
+ * is similar to NAPI for network devices.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/bio.h>
+#include <linux/interrupt.h>
+#include <linux/cpu.h>
+#include <linux/irq_poll.h>
+#include <linux/delay.h>
+
+static unsigned int irq_poll_budget __read_mostly = 256;
+
+static DEFINE_PER_CPU(struct list_head, blk_cpu_iopoll);
+
+/**
+ * irq_poll_sched - Schedule a run of the iopoll handler
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     Add this irq_poll structure to the pending poll list and trigger the
+ *     raise of the blk iopoll softirq.
+ **/
+void irq_poll_sched(struct irq_poll *iop)
+{
+        unsigned long flags;
+
+        if (test_bit(IRQ_POLL_F_DISABLE, &iop->state))
+                return;
+        if (test_and_set_bit(IRQ_POLL_F_SCHED, &iop->state))
+                return;
+
+        local_irq_save(flags);
+        list_add_tail(&iop->list, this_cpu_ptr(&blk_cpu_iopoll));
+        __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(irq_poll_sched);
+
+/**
+ * __irq_poll_complete - Mark this @iop as un-polled again
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     See irq_poll_complete(). This function must be called with interrupts
+ *     disabled.
+ **/
+static void __irq_poll_complete(struct irq_poll *iop)
+{
+        list_del(&iop->list);
+        smp_mb__before_atomic();
+        clear_bit_unlock(IRQ_POLL_F_SCHED, &iop->state);
+}
+
+/**
+ * irq_poll_complete - Mark this @iop as un-polled again
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     If a driver consumes less than the assigned budget in its run of the
+ *     iopoll handler, it'll end the polled mode by calling this function. The
+ *     iopoll handler will not be invoked again before irq_poll_sched()
+ *     is called.
+ **/
+void irq_poll_complete(struct irq_poll *iop)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __irq_poll_complete(iop);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(irq_poll_complete);
+
+static void irq_poll_softirq(struct softirq_action *h)
+{
+        struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
+        int rearm = 0, budget = irq_poll_budget;
+        unsigned long start_time = jiffies;
+
+        local_irq_disable();
+
+        while (!list_empty(list)) {
+                struct irq_poll *iop;
+                int work, weight;
+
+                /*
+                 * If softirq window is exhausted then punt.
+                 */
+                if (budget <= 0 || time_after(jiffies, start_time)) {
+                        rearm = 1;
+                        break;
+                }
+
+                local_irq_enable();
+
+                /* Even though interrupts have been re-enabled, this
+                 * access is safe because interrupts can only add new
+                 * entries to the tail of this list, and only ->poll()
+                 * calls can remove this head entry from the list.
+                 */
+                iop = list_entry(list->next, struct irq_poll, list);
+
+                weight = iop->weight;
+                work = 0;
+                if (test_bit(IRQ_POLL_F_SCHED, &iop->state))
+                        work = iop->poll(iop, weight);
+
+                budget -= work;
+
+                local_irq_disable();
+
+                /*
+                 * Drivers must not modify the iopoll state, if they
+                 * consume their assigned weight (or more, some drivers can't
+                 * easily just stop processing, they have to complete an
+                 * entire mask of commands).In such cases this code
+                 * still "owns" the iopoll instance and therefore can
+                 * move the instance around on the list at-will.
+                 */
+                if (work >= weight) {
+                        if (test_bit(IRQ_POLL_F_DISABLE, &iop->state))
+                                __irq_poll_complete(iop);
+                        else
+                                list_move_tail(&iop->list, list);
+                }
+        }
+
+        if (rearm)
+                __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+
+        local_irq_enable();
+}
+
+/**
+ * irq_poll_disable - Disable iopoll on this @iop
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     Disable io polling and wait for any pending callbacks to have completed.
+ **/
+void irq_poll_disable(struct irq_poll *iop)
+{
+        set_bit(IRQ_POLL_F_DISABLE, &iop->state);
+        while (test_and_set_bit(IRQ_POLL_F_SCHED, &iop->state))
+                msleep(1);
+        clear_bit(IRQ_POLL_F_DISABLE, &iop->state);
+}
+EXPORT_SYMBOL(irq_poll_disable);
+
+/**
+ * irq_poll_enable - Enable iopoll on this @iop
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     Enable iopoll on this @iop. Note that the handler run will not be
+ *     scheduled, it will only mark it as active.
+ **/
+void irq_poll_enable(struct irq_poll *iop)
+{
+        BUG_ON(!test_bit(IRQ_POLL_F_SCHED, &iop->state));
+        smp_mb__before_atomic();
+        clear_bit_unlock(IRQ_POLL_F_SCHED, &iop->state);
+}
+EXPORT_SYMBOL(irq_poll_enable);
+
+/**
+ * irq_poll_init - Initialize this @iop
+ * @iop:      The parent iopoll structure
+ * @weight:   The default weight (or command completion budget)
+ * @poll_fn:  The handler to invoke
+ *
+ * Description:
+ *     Initialize and enable this irq_poll structure.
+ **/
+void irq_poll_init(struct irq_poll *iop, int weight, irq_poll_fn *poll_fn)
+{
+        memset(iop, 0, sizeof(*iop));
+        INIT_LIST_HEAD(&iop->list);
+        iop->weight = weight;
+        iop->poll = poll_fn;
+}
+EXPORT_SYMBOL(irq_poll_init);
+
+static int irq_poll_cpu_notify(struct notifier_block *self,
+                                 unsigned long action, void *hcpu)
+{
+        /*
+         * If a CPU goes away, splice its entries to the current CPU
+         * and trigger a run of the softirq
+         */
+        if (action == CPU_DEAD || action == CPU_DEAD_FROZEN) {
+                int cpu = (unsigned long) hcpu;
+
+                local_irq_disable();
+                list_splice_init(&per_cpu(blk_cpu_iopoll, cpu),
+                                 this_cpu_ptr(&blk_cpu_iopoll));
+                __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+                local_irq_enable();
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block irq_poll_cpu_notifier = {
+        .notifier_call  = irq_poll_cpu_notify,
+};
+
+static __init int irq_poll_setup(void)
+{
+        int i;
+
+        for_each_possible_cpu(i)
+                INIT_LIST_HEAD(&per_cpu(blk_cpu_iopoll, i));
+
+        open_softirq(IRQ_POLL_SOFTIRQ, irq_poll_softirq);
+        register_hotcpu_notifier(&irq_poll_cpu_notifier);
+        return 0;
+}
+subsys_initcall(irq_poll_setup);
diff --git a/lib/kasprintf.c b/lib/kasprintf.c
index f194e6e593e1..7f6c506a4942 100644
--- a/lib/kasprintf.c
+++ b/lib/kasprintf.c
@@ -13,19 +13,21 @@
 /* Simplified asprintf. */
 char *kvasprintf(gfp_t gfp, const char *fmt, va_list ap)
 {
-        unsigned int len;
+        unsigned int first, second;
         char *p;
         va_list aq;
 
         va_copy(aq, ap);
-        len = vsnprintf(NULL, 0, fmt, aq);
+        first = vsnprintf(NULL, 0, fmt, aq);
         va_end(aq);
 
-        p = kmalloc_track_caller(len+1, gfp);
+        p = kmalloc_track_caller(first+1, gfp);
         if (!p)
                 return NULL;
 
-        vsnprintf(p, len+1, fmt, ap);
+        second = vsnprintf(p, first+1, fmt, ap);
+        WARN(first != second, "different return values (%u and %u) from vsnprintf(\"%s\", ...)",
+             first, second, fmt);
 
         return p;
 }
diff --git a/lib/klist.c b/lib/klist.c
index d74cf7a29afd..0507fa5d84c5 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -282,9 +282,9 @@ void klist_iter_init_node(struct klist *k, struct klist_iter *i,
                           struct klist_node *n)
 {
         i->i_klist = k;
-        i->i_cur = n;
-        if (n)
-                kref_get(&n->n_ref);
+        i->i_cur = NULL;
+        if (n && kref_get_unless_zero(&n->n_ref))
+                i->i_cur = n;
 }
 EXPORT_SYMBOL_GPL(klist_iter_init_node);
 
diff --git a/lib/kobject.c b/lib/kobject.c
index 7cbccd2b4c72..445dcaeb0f56 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -861,6 +861,7 @@ struct kobject *kset_find_obj(struct kset *kset, const char *name)
         spin_unlock(&kset->list_lock);
         return ret;
 }
+EXPORT_SYMBOL_GPL(kset_find_obj);
 
 static void kset_release(struct kobject *kobj)
 {
diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
index 6a08ce7d6adc..74a54b7f2562 100644
--- a/lib/libcrc32c.c
+++ b/lib/libcrc32c.c
@@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/crc32c.h>
 
 static struct crypto_shash *tfm;
 
@@ -74,3 +75,4 @@ module_exit(libcrc32c_mod_fini);
 MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
 MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations");
 MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: crc32c");
diff --git a/lib/lru_cache.c b/lib/lru_cache.c
index 028f5d996eef..28ba40b99337 100644
--- a/lib/lru_cache.c
+++ b/lib/lru_cache.c
@@ -238,7 +238,7 @@ void lc_reset(struct lru_cache *lc)
  * @seq: the seq_file to print into
  * @lc: the lru cache to print statistics of
  */
-size_t lc_seq_printf_stats(struct seq_file *seq, struct lru_cache *lc)
+void lc_seq_printf_stats(struct seq_file *seq, struct lru_cache *lc)
 {
         /* NOTE:
          * total calls to lc_get are
@@ -250,8 +250,6 @@ size_t lc_seq_printf_stats(struct seq_file *seq, struct lru_cache *lc)
         seq_printf(seq, "\t%s: used:%u/%u hits:%lu misses:%lu starving:%lu locked:%lu changed:%lu\n",
                    lc->name, lc->used, lc->nr_elements,
                    lc->hits, lc->misses, lc->starving, lc->locked, lc->changed);
-
-        return 0;
 }
 
 static struct hlist_head *lc_hash_slot(struct lru_cache *lc, unsigned int enr)
diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
index b90e255c2a68..93336502af08 100644
--- a/lib/mpi/longlong.h
+++ b/lib/mpi/longlong.h
@@ -216,7 +216,7 @@ extern UDItype __udiv_qrnnd(UDItype *, UDItype, UDItype, UDItype);
         __asm__ ("%@ Inlined umul_ppmm\n" \
                 "umull %r1, %r0, %r2, %r3" \
         : "=&r" ((USItype)(xh)), \
-                        "=r" ((USItype)(xl)) \
+                        "=&r" ((USItype)(xl)) \
         : "r" ((USItype)(a)), \
                         "r" ((USItype)(b)) \
         : "r0", "r1")
diff --git a/lib/mpi/mpi-inline.h b/lib/mpi/mpi-inline.h
index e2b39852b30a..c245ea31f785 100644
--- a/lib/mpi/mpi-inline.h
+++ b/lib/mpi/mpi-inline.h
@@ -30,7 +30,7 @@
 #define G10_MPI_INLINE_H
 
 #ifndef G10_MPI_INLINE_DECL
-#define G10_MPI_INLINE_DECL  extern inline
+#define G10_MPI_INLINE_DECL  static inline
 #endif
 
 G10_MPI_INLINE_DECL mpi_limb_t
diff --git a/lib/mpi/mpi-internal.h b/lib/mpi/mpi-internal.h
index c65dd1bff45a..7eceeddb3fb8 100644
--- a/lib/mpi/mpi-internal.h
+++ b/lib/mpi/mpi-internal.h
@@ -168,19 +168,19 @@ void mpi_rshift_limbs(MPI a, unsigned int count);
 int mpi_lshift_limbs(MPI a, unsigned int count);
 
 /*-- mpihelp-add.c --*/
-mpi_limb_t mpihelp_add_1(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr,
+static inline mpi_limb_t mpihelp_add_1(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr,
                          mpi_size_t s1_size, mpi_limb_t s2_limb);
 mpi_limb_t mpihelp_add_n(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr,
                          mpi_ptr_t s2_ptr, mpi_size_t size);
-mpi_limb_t mpihelp_add(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr, mpi_size_t s1_size,
+static inline mpi_limb_t mpihelp_add(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr, mpi_size_t s1_size,
                        mpi_ptr_t s2_ptr, mpi_size_t s2_size);
 
 /*-- mpihelp-sub.c --*/
-mpi_limb_t mpihelp_sub_1(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr,
+static inline mpi_limb_t mpihelp_sub_1(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr,
                          mpi_size_t s1_size, mpi_limb_t s2_limb);
 mpi_limb_t mpihelp_sub_n(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr,
                          mpi_ptr_t s2_ptr, mpi_size_t size);
-mpi_limb_t mpihelp_sub(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr, mpi_size_t s1_size,
+static inline mpi_limb_t mpihelp_sub(mpi_ptr_t res_ptr, mpi_ptr_t s1_ptr, mpi_size_t s1_size,
                        mpi_ptr_t s2_ptr, mpi_size_t s2_size);
 
 /*-- mpihelp-cmp.c --*/
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index ec533a6c77b5..eb15e7dc7b65 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -128,6 +128,23 @@ leave:
 }
 EXPORT_SYMBOL_GPL(mpi_read_from_buffer);
 
+static int count_lzeros(MPI a)
+{
+        mpi_limb_t alimb;
+        int i, lzeros = 0;
+
+        for (i = a->nlimbs - 1; i >= 0; i--) {
+                alimb = a->d[i];
+                if (alimb == 0) {
+                        lzeros += sizeof(mpi_limb_t);
+                } else {
+                        lzeros += count_leading_zeros(alimb) / 8;
+                        break;
+                }
+        }
+        return lzeros;
+}
+
 /**
  * mpi_read_buffer() - read MPI to a bufer provided by user (msb first)
  *
@@ -148,7 +165,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
         uint8_t *p;
         mpi_limb_t alimb;
         unsigned int n = mpi_get_size(a);
-        int i, lzeros = 0;
+        int i, lzeros;
 
         if (!buf || !nbytes)
                 return -EINVAL;
@@ -156,14 +173,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
         if (sign)
                 *sign = a->sign;
 
-        p = (void *)&a->d[a->nlimbs] - 1;
-
-        for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
-                if (!*p)
-                        lzeros++;
-                else
-                        break;
-        }
+        lzeros = count_lzeros(a);
 
         if (buf_len < n - lzeros) {
                 *nbytes = n - lzeros;
@@ -351,7 +361,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
         u8 *p, *p2;
         mpi_limb_t alimb, alimb2;
         unsigned int n = mpi_get_size(a);
-        int i, x, y = 0, lzeros = 0, buf_len;
+        int i, x, y = 0, lzeros, buf_len;
 
         if (!nbytes)
                 return -EINVAL;
@@ -359,14 +369,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
         if (sign)
                 *sign = a->sign;
 
-        p = (void *)&a->d[a->nlimbs] - 1;
-
-        for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
-                if (!*p)
-                        lzeros++;
-                else
-                        break;
-        }
+        lzeros = count_lzeros(a);
 
         if (*nbytes < n - lzeros) {
                 *nbytes = n - lzeros;
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index fcf5d98574ce..6b79e9026e24 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -1019,9 +1019,13 @@ radix_tree_gang_lookup(struct radix_tree_root *root, void **results,
                 return 0;
 
         radix_tree_for_each_slot(slot, root, &iter, first_index) {
-                results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
+                results[ret] = rcu_dereference_raw(*slot);
                 if (!results[ret])
                         continue;
+                if (radix_tree_is_indirect_ptr(results[ret])) {
+                        slot = radix_tree_iter_retry(&iter);
+                        continue;
+                }
                 if (++ret == max_items)
                         break;
         }
@@ -1098,9 +1102,13 @@ radix_tree_gang_lookup_tag(struct radix_tree_root *root, void **results,
                 return 0;
 
         radix_tree_for_each_tagged(slot, root, &iter, first_index, tag) {
-                results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
+                results[ret] = rcu_dereference_raw(*slot);
                 if (!results[ret])
                         continue;
+                if (radix_tree_is_indirect_ptr(results[ret])) {
+                        slot = radix_tree_iter_retry(&iter);
+                        continue;
+                }
                 if (++ret == max_items)
                         break;
         }
diff --git a/lib/raid6/altivec.uc b/lib/raid6/altivec.uc
index bec27fce7501..682aae8a1fef 100644
--- a/lib/raid6/altivec.uc
+++ b/lib/raid6/altivec.uc
@@ -101,6 +101,7 @@ static void raid6_altivec$#_gen_syndrome(int disks, size_t bytes, void **ptrs)
 
         raid6_altivec$#_gen_syndrome_real(disks, bytes, ptrs);
 
+        disable_kernel_altivec();
         preempt_enable();
 }
 
diff --git a/lib/ratelimit.c b/lib/ratelimit.c
index 40e03ea2a967..2c5de86460c5 100644
--- a/lib/ratelimit.c
+++ b/lib/ratelimit.c
@@ -49,7 +49,7 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
                 if (rs->missed)
                         printk(KERN_WARNING "%s: %d callbacks suppressed\n",
                                 func, rs->missed);
-                rs->begin   = 0;
+                rs->begin   = jiffies;
                 rs->printed = 0;
                 rs->missed  = 0;
         }
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index bafa9933fa76..004fc70fc56a 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -598,9 +598,9 @@ EXPORT_SYMBOL(sg_miter_next);
  *
  * Description:
  *   Stops mapping iterator @miter.  @miter should have been started
- *   started using sg_miter_start().  A stopped iteration can be
- *   resumed by calling sg_miter_next() on it.  This is useful when
- *   resources (kmap) need to be released during iteration.
+ *   using sg_miter_start().  A stopped iteration can be resumed by
+ *   calling sg_miter_next() on it.  This is useful when resources (kmap)
+ *   need to be released during iteration.
  *
  * Context:
  *   Preemption disabled if the SG_MITER_ATOMIC is set.  Don't care
diff --git a/lib/string_helpers.c b/lib/string_helpers.c
index 5939f63d90cd..5c88204b6f1f 100644
--- a/lib/string_helpers.c
+++ b/lib/string_helpers.c
@@ -43,50 +43,73 @@ void string_get_size(u64 size, u64 blk_size, const enum string_size_units units,
                 [STRING_UNITS_10] = 1000,
                 [STRING_UNITS_2] = 1024,
         };
-        int i, j;
-        u32 remainder = 0, sf_cap, exp;
+        static const unsigned int rounding[] = { 500, 50, 5 };
+        int i = 0, j;
+        u32 remainder = 0, sf_cap;
         char tmp[8];
         const char *unit;
 
         tmp[0] = '\0';
-        i = 0;
-        if (!size)
+
+        if (blk_size == 0)
+                size = 0;
+        if (size == 0)
                 goto out;
 
-        while (blk_size >= divisor[units]) {
-                remainder = do_div(blk_size, divisor[units]);
+        /* This is Napier's algorithm.  Reduce the original block size to
+         *
+         * coefficient * divisor[units]^i
+         *
+         * we do the reduction so both coefficients are just under 32 bits so
+         * that multiplying them together won't overflow 64 bits and we keep
+         * as much precision as possible in the numbers.
+         *
+         * Note: it's safe to throw away the remainders here because all the
+         * precision is in the coefficients.
+         */
+        while (blk_size >> 32) {
+                do_div(blk_size, divisor[units]);
                 i++;
         }
 
-        exp = divisor[units] / (u32)blk_size;
-        /*
-         * size must be strictly greater than exp here to ensure that remainder
-         * is greater than divisor[units] coming out of the if below.
-         */
-        if (size > exp) {
-                remainder = do_div(size, divisor[units]);
-                remainder *= blk_size;
+        while (size >> 32) {
+                do_div(size, divisor[units]);
                 i++;
-        } else {
-                remainder *= size;
         }
 
+        /* now perform the actual multiplication keeping i as the sum of the
+         * two logarithms */
         size *= blk_size;
-        size += remainder / divisor[units];
-        remainder %= divisor[units];
 
+        /* and logarithmically reduce it until it's just under the divisor */
         while (size >= divisor[units]) {
                 remainder = do_div(size, divisor[units]);
                 i++;
         }
 
+        /* work out in j how many digits of precision we need from the
+         * remainder */
         sf_cap = size;
         for (j = 0; sf_cap*10 < 1000; j++)
                 sf_cap *= 10;
 
-        if (j) {
+        if (units == STRING_UNITS_2) {
+                /* express the remainder as a decimal.  It's currently the
+                 * numerator of a fraction whose denominator is
+                 * divisor[units], which is 1 << 10 for STRING_UNITS_2 */
                 remainder *= 1000;
-                remainder /= divisor[units];
+                remainder >>= 10;
+        }
+
+        /* add a 5 to the digit below what will be printed to ensure
+         * an arithmetical round up and carry it through to size */
+        remainder += rounding[j];
+        if (remainder >= 1000) {
+                remainder -= 1000;
+                size += 1;
+        }
+
+        if (j) {
                 snprintf(tmp, sizeof(tmp), ".%03u", remainder);
                 tmp[j+1] = '\0';
         }
diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index e0af6ff73d14..33840324138c 100644
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -39,7 +39,7 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src, long
                 unsigned long c, data;
 
                 /* Fall back to byte-at-a-time if we get a page fault */
-                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+                if (unlikely(unsafe_get_user(c,(unsigned long __user *)(src+res))))
                         break;
                 *(unsigned long *)(dst+res) = c;
                 if (has_zero(c, &data, &constants)) {
@@ -55,7 +55,7 @@ byte_at_a_time:
         while (max) {
                 char c;
 
-                if (unlikely(__get_user(c,src+res)))
+                if (unlikely(unsafe_get_user(c,src+res)))
                         return -EFAULT;
                 dst[res] = c;
                 if (!c)
@@ -107,7 +107,12 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
         src_addr = (unsigned long)src;
         if (likely(src_addr < max_addr)) {
                 unsigned long max = max_addr - src_addr;
-                return do_strncpy_from_user(dst, src, count, max);
+                long retval;
+
+                user_access_begin();
+                retval = do_strncpy_from_user(dst, src, count, max);
+                user_access_end();
+                return retval;
         }
         return -EFAULT;
 }
diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
index 3a5f2b366d84..2625943625d7 100644
--- a/lib/strnlen_user.c
+++ b/lib/strnlen_user.c
@@ -45,7 +45,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
         src -= align;
         max += align;
 
-        if (unlikely(__get_user(c,(unsigned long __user *)src)))
+        if (unlikely(unsafe_get_user(c,(unsigned long __user *)src)))
                 return 0;
         c |= aligned_byte_mask(align);
 
@@ -61,7 +61,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
                 if (unlikely(max <= sizeof(unsigned long)))
                         break;
                 max -= sizeof(unsigned long);
-                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+                if (unlikely(unsafe_get_user(c,(unsigned long __user *)(src+res))))
                         return 0;
         }
         res -= align;
@@ -112,7 +112,12 @@ long strnlen_user(const char __user *str, long count)
         src_addr = (unsigned long)str;
         if (likely(src_addr < max_addr)) {
                 unsigned long max = max_addr - src_addr;
-                return do_strnlen_user(str, count, max);
+                long retval;
+
+                user_access_begin();
+                retval = do_strnlen_user(str, count, max);
+                user_access_end();
+                return retval;
         }
         return 0;
 }
@@ -141,7 +146,12 @@ long strlen_user(const char __user *str)
         src_addr = (unsigned long)str;
         if (likely(src_addr < max_addr)) {
                 unsigned long max = max_addr - src_addr;
-                return do_strnlen_user(str, ~0ul, max);
+                long retval;
+
+                user_access_begin();
+                retval = do_strnlen_user(str, ~0ul, max);
+                user_access_end();
+                return retval;
         }
         return 0;
 }
diff --git a/lib/test-string_helpers.c b/lib/test-string_helpers.c
index 98866a770770..25b5cbfb7615 100644
--- a/lib/test-string_helpers.c
+++ b/lib/test-string_helpers.c
@@ -327,36 +327,67 @@ out:
 }
 
 #define string_get_size_maxbuf 16
-#define test_string_get_size_one(size, blk_size, units, exp_result)            \
+#define test_string_get_size_one(size, blk_size, exp_result10, exp_result2)    \
         do {                                                                   \
-                BUILD_BUG_ON(sizeof(exp_result) >= string_get_size_maxbuf);    \
-                __test_string_get_size((size), (blk_size), (units),            \
-                                       (exp_result));                          \
+                BUILD_BUG_ON(sizeof(exp_result10) >= string_get_size_maxbuf);  \
+                BUILD_BUG_ON(sizeof(exp_result2) >= string_get_size_maxbuf);   \
+                __test_string_get_size((size), (blk_size), (exp_result10),     \
+                                       (exp_result2));                         \
         } while (0)
 
 
-static __init void __test_string_get_size(const u64 size, const u64 blk_size,
-                                          const enum string_size_units units,
-                                          const char *exp_result)
+static __init void test_string_get_size_check(const char *units,
+                                              const char *exp,
+                                              char *res,
+                                              const u64 size,
+                                              const u64 blk_size)
 {
-        char buf[string_get_size_maxbuf];
-
-        string_get_size(size, blk_size, units, buf, sizeof(buf));
-        if (!memcmp(buf, exp_result, strlen(exp_result) + 1))
+        if (!memcmp(res, exp, strlen(exp) + 1))
                 return;
 
-        buf[sizeof(buf) - 1] = '\0';
-        pr_warn("Test 'test_string_get_size_one' failed!\n");
-        pr_warn("string_get_size(size = %llu, blk_size = %llu, units = %d\n",
+        res[string_get_size_maxbuf - 1] = '\0';
+
+        pr_warn("Test 'test_string_get_size' failed!\n");
+        pr_warn("string_get_size(size = %llu, blk_size = %llu, units = %s)\n",
                 size, blk_size, units);
-        pr_warn("expected: '%s', got '%s'\n", exp_result, buf);
+        pr_warn("expected: '%s', got '%s'\n", exp, res);
+}
+
+static __init void __test_string_get_size(const u64 size, const u64 blk_size,
+                                          const char *exp_result10,
+                                          const char *exp_result2)
+{
+        char buf10[string_get_size_maxbuf];
+        char buf2[string_get_size_maxbuf];
+
+        string_get_size(size, blk_size, STRING_UNITS_10, buf10, sizeof(buf10));
+        string_get_size(size, blk_size, STRING_UNITS_2, buf2, sizeof(buf2));
+
+        test_string_get_size_check("STRING_UNITS_10", exp_result10, buf10,
+                                   size, blk_size);
+
+        test_string_get_size_check("STRING_UNITS_2", exp_result2, buf2,
+                                   size, blk_size);
 }
 
 static __init void test_string_get_size(void)
 {
-        test_string_get_size_one(16384, 512, STRING_UNITS_2, "8.00 MiB");
-        test_string_get_size_one(8192, 4096, STRING_UNITS_10, "32.7 MB");
-        test_string_get_size_one(1, 512, STRING_UNITS_10, "512 B");
+        /* small values */
+        test_string_get_size_one(0, 512, "0 B", "0 B");
+        test_string_get_size_one(1, 512, "512 B", "512 B");
+        test_string_get_size_one(1100, 1, "1.10 kB", "1.07 KiB");
+
+        /* normal values */
+        test_string_get_size_one(16384, 512, "8.39 MB", "8.00 MiB");
+        test_string_get_size_one(500118192, 512, "256 GB", "238 GiB");
+        test_string_get_size_one(8192, 4096, "33.6 MB", "32.0 MiB");
+
+        /* weird block sizes */
+        test_string_get_size_one(3000, 1900, "5.70 MB", "5.44 MiB");
+
+        /* huge values */
+        test_string_get_size_one(U64_MAX, 4096, "75.6 ZB", "64.0 ZiB");
+        test_string_get_size_one(4096, U64_MAX, "75.6 ZB", "64.0 ZiB");
 }
 
 static int __init test_string_helpers_init(void)
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index 86374c1c49a4..a3e8ec3fb1c5 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/printk.h>
+#include <linux/completion.h>
 #include <linux/firmware.h>
 #include <linux/device.h>
 #include <linux/fs.h>
@@ -54,10 +55,9 @@ static ssize_t trigger_request_store(struct device *dev,
         int rc;
         char *name;
 
-        name = kzalloc(count + 1, GFP_KERNEL);
+        name = kstrndup(buf, count, GFP_KERNEL);
         if (!name)
                 return -ENOSPC;
-        memcpy(name, buf, count);
 
         pr_info("loading '%s'\n", name);
 
@@ -65,17 +65,73 @@ static ssize_t trigger_request_store(struct device *dev,
         release_firmware(test_firmware);
         test_firmware = NULL;
         rc = request_firmware(&test_firmware, name, dev);
-        if (rc)
+        if (rc) {
                 pr_info("load of '%s' failed: %d\n", name, rc);
-        pr_info("loaded: %zu\n", test_firmware ? test_firmware->size : 0);
+                goto out;
+        }
+        pr_info("loaded: %zu\n", test_firmware->size);
+        rc = count;
+
+out:
         mutex_unlock(&test_fw_mutex);
 
         kfree(name);
 
-        return count;
+        return rc;
 }
 static DEVICE_ATTR_WO(trigger_request);
 
+static DECLARE_COMPLETION(async_fw_done);
+
+static void trigger_async_request_cb(const struct firmware *fw, void *context)
+{
+        test_firmware = fw;
+        complete(&async_fw_done);
+}
+
+static ssize_t trigger_async_request_store(struct device *dev,
+                                           struct device_attribute *attr,
+                                           const char *buf, size_t count)
+{
+        int rc;
+        char *name;
+
+        name = kstrndup(buf, count, GFP_KERNEL);
+        if (!name)
+                return -ENOSPC;
+
+        pr_info("loading '%s'\n", name);
+
+        mutex_lock(&test_fw_mutex);
+        release_firmware(test_firmware);
+        test_firmware = NULL;
+        rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
+                                     NULL, trigger_async_request_cb);
+        if (rc) {
+                pr_info("async load of '%s' failed: %d\n", name, rc);
+                kfree(name);
+                goto out;
+        }
+        /* Free 'name' ASAP, to test for race conditions */
+        kfree(name);
+
+        wait_for_completion(&async_fw_done);
+
+        if (test_firmware) {
+                pr_info("loaded: %zu\n", test_firmware->size);
+                rc = count;
+        } else {
+                pr_err("failed to async load firmware\n");
+                rc = -ENODEV;
+        }
+
+out:
+        mutex_unlock(&test_fw_mutex);
+
+        return rc;
+}
+static DEVICE_ATTR_WO(trigger_async_request);
+
 static int __init test_firmware_init(void)
 {
         int rc;
@@ -92,9 +148,20 @@ static int __init test_firmware_init(void)
                 goto dereg;
         }
 
+        rc = device_create_file(test_fw_misc_device.this_device,
+                                &dev_attr_trigger_async_request);
+        if (rc) {
+                pr_err("could not create async sysfs interface: %d\n", rc);
+                goto remove_file;
+        }
+
         pr_warn("interface ready\n");
 
         return 0;
+
+remove_file:
+        device_remove_file(test_fw_misc_device.this_device,
+                           &dev_attr_trigger_async_request);
 dereg:
         misc_deregister(&test_fw_misc_device);
         return rc;
@@ -106,6 +173,8 @@ static void __exit test_firmware_exit(void)
 {
         release_firmware(test_firmware);
         device_remove_file(test_fw_misc_device.this_device,
+                           &dev_attr_trigger_async_request);
+        device_remove_file(test_fw_misc_device.this_device,
                            &dev_attr_trigger_request);
         misc_deregister(&test_fw_misc_device);
         pr_warn("removed interface\n");
diff --git a/lib/test-hexdump.c b/lib/test_hexdump.c
index 5241df36eedf..3f415d8101f3 100644
--- a/lib/test-hexdump.c
+++ b/lib/test_hexdump.c
@@ -42,19 +42,21 @@ static const char * const test_data_8_le[] __initconst = {
         "e9ac0f9cad319ca6", "0cafb1439919d14c",
 };
 
-static void __init test_hexdump(size_t len, int rowsize, int groupsize,
-                                bool ascii)
+#define FILL_CHAR       '#'
+
+static unsigned total_tests __initdata;
+static unsigned failed_tests __initdata;
+
+static void __init test_hexdump_prepare_test(size_t len, int rowsize,
+                                             int groupsize, char *test,
+                                             size_t testlen, bool ascii)
 {
-        char test[32 * 3 + 2 + 32 + 1];
-        char real[32 * 3 + 2 + 32 + 1];
         char *p;
         const char * const *result;
         size_t l = len;
         int gs = groupsize, rs = rowsize;
         unsigned int i;
 
-        hex_dump_to_buffer(data_b, l, rs, gs, real, sizeof(real), ascii);
-
         if (rs != 16 && rs != 32)
                 rs = 16;
 
@@ -73,8 +75,6 @@ static void __init test_hexdump(size_t len, int rowsize, int groupsize,
         else
                 result = test_data_1_le;
 
-        memset(test, ' ', sizeof(test));
-
         /* hex dump */
         p = test;
         for (i = 0; i < l / gs; i++) {
@@ -82,24 +82,49 @@ static void __init test_hexdump(size_t len, int rowsize, int groupsize,
                 size_t amount = strlen(q);
 
                 strncpy(p, q, amount);
-                p += amount + 1;
+                p += amount;
+
+                *p++ = ' ';
         }
         if (i)
                 p--;
 
         /* ASCII part */
         if (ascii) {
-                p = test + rs * 2 + rs / gs + 1;
+                do {
+                        *p++ = ' ';
+                } while (p < test + rs * 2 + rs / gs + 1);
+
                 strncpy(p, data_a, l);
                 p += l;
         }
 
         *p = '\0';
+}
 
-        if (strcmp(test, real)) {
+#define TEST_HEXDUMP_BUF_SIZE           (32 * 3 + 2 + 32 + 1)
+
+static void __init test_hexdump(size_t len, int rowsize, int groupsize,
+                                bool ascii)
+{
+        char test[TEST_HEXDUMP_BUF_SIZE];
+        char real[TEST_HEXDUMP_BUF_SIZE];
+
+        total_tests++;
+
+        memset(real, FILL_CHAR, sizeof(real));
+        hex_dump_to_buffer(data_b, len, rowsize, groupsize, real, sizeof(real),
+                           ascii);
+
+        memset(test, FILL_CHAR, sizeof(test));
+        test_hexdump_prepare_test(len, rowsize, groupsize, test, sizeof(test),
+                                  ascii);
+
+        if (memcmp(test, real, TEST_HEXDUMP_BUF_SIZE)) {
                 pr_err("Len: %zu row: %d group: %d\n", len, rowsize, groupsize);
                 pr_err("Result: '%s'\n", real);
                 pr_err("Expect: '%s'\n", test);
+                failed_tests++;
         }
 }
 
@@ -114,52 +139,72 @@ static void __init test_hexdump_set(int rowsize, bool ascii)
         test_hexdump(len, rowsize, 1, ascii);
 }
 
-static void __init test_hexdump_overflow(bool ascii)
+static void __init test_hexdump_overflow(size_t buflen, size_t len,
+                                         int rowsize, int groupsize,
+                                         bool ascii)
 {
-        char buf[56];
-        const char *t = test_data_1_le[0];
-        size_t l = get_random_int() % sizeof(buf);
+        char test[TEST_HEXDUMP_BUF_SIZE];
+        char buf[TEST_HEXDUMP_BUF_SIZE];
+        int rs = rowsize, gs = groupsize;
+        int ae, he, e, f, r;
         bool a;
-        int e, r;
 
-        memset(buf, ' ', sizeof(buf));
+        total_tests++;
+
+        memset(buf, FILL_CHAR, sizeof(buf));
 
-        r = hex_dump_to_buffer(data_b, 1, 16, 1, buf, l, ascii);
+        r = hex_dump_to_buffer(data_b, len, rs, gs, buf, buflen, ascii);
+
+        /*
+         * Caller must provide the data length multiple of groupsize. The
+         * calculations below are made with that assumption in mind.
+         */
+        ae = rs * 2 /* hex */ + rs / gs /* spaces */ + 1 /* space */ + len /* ascii */;
+        he = (gs * 2 /* hex */ + 1 /* space */) * len / gs - 1 /* no trailing space */;
 
         if (ascii)
-                e = 50;
+                e = ae;
         else
-                e = 2;
-        buf[e + 2] = '\0';
-
-        if (!l) {
-                a = r == e && buf[0] == ' ';
-        } else if (l < 3) {
-                a = r == e && buf[0] == '\0';
-        } else if (l < 4) {
-                a = r == e && !strcmp(buf, t);
-        } else if (ascii) {
-                if (l < 51)
-                        a = r == e && buf[l - 1] == '\0' && buf[l - 2] == ' ';
-                else
-                        a = r == e && buf[50] == '\0' && buf[49] == '.';
-        } else {
-                a = r == e && buf[e] == '\0';
+                e = he;
+
+        f = min_t(int, e + 1, buflen);
+        if (buflen) {
+                test_hexdump_prepare_test(len, rs, gs, test, sizeof(test), ascii);
+                test[f - 1] = '\0';
         }
+        memset(test + f, FILL_CHAR, sizeof(test) - f);
+
+        a = r == e && !memcmp(test, buf, TEST_HEXDUMP_BUF_SIZE);
+
+        buf[sizeof(buf) - 1] = '\0';
 
         if (!a) {
-                pr_err("Len: %zu rc: %u strlen: %zu\n", l, r, strlen(buf));
-                pr_err("Result: '%s'\n", buf);
+                pr_err("Len: %zu buflen: %zu strlen: %zu\n",
+                        len, buflen, strnlen(buf, sizeof(buf)));
+                pr_err("Result: %d '%s'\n", r, buf);
+                pr_err("Expect: %d '%s'\n", e, test);
+                failed_tests++;
         }
 }
 
+static void __init test_hexdump_overflow_set(size_t buflen, bool ascii)
+{
+        unsigned int i = 0;
+        int rs = (get_random_int() % 2 + 1) * 16;
+
+        do {
+                int gs = 1 << i;
+                size_t len = get_random_int() % rs + gs;
+
+                test_hexdump_overflow(buflen, rounddown(len, gs), rs, gs, ascii);
+        } while (i++ < 3);
+}
+
 static int __init test_hexdump_init(void)
 {
         unsigned int i;
         int rowsize;
 
-        pr_info("Running tests...\n");
-
         rowsize = (get_random_int() % 2 + 1) * 16;
         for (i = 0; i < 16; i++)
                 test_hexdump_set(rowsize, false);
@@ -168,13 +213,26 @@ static int __init test_hexdump_init(void)
         for (i = 0; i < 16; i++)
                 test_hexdump_set(rowsize, true);
 
-        for (i = 0; i < 16; i++)
-                test_hexdump_overflow(false);
+        for (i = 0; i <= TEST_HEXDUMP_BUF_SIZE; i++)
+                test_hexdump_overflow_set(i, false);
 
-        for (i = 0; i < 16; i++)
-                test_hexdump_overflow(true);
+        for (i = 0; i <= TEST_HEXDUMP_BUF_SIZE; i++)
+                test_hexdump_overflow_set(i, true);
+
+        if (failed_tests == 0)
+                pr_info("all %u tests passed\n", total_tests);
+        else
+                pr_err("failed %u out of %u tests\n", failed_tests, total_tests);
 
-        return -EINVAL;
+        return failed_tests ? -EINVAL : 0;
 }
 module_init(test_hexdump_init);
+
+static void __exit test_hexdump_exit(void)
+{
+        /* do nothing */
+}
+module_exit(test_hexdump_exit);
+
+MODULE_AUTHOR("Andy Shevchenko <andriy.shevchenko@linux.intel.com>");
 MODULE_LICENSE("Dual BSD/GPL");
diff --git a/lib/test_printf.c b/lib/test_printf.c
index c5a666af9ba5..563f10e6876a 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -12,10 +12,16 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 
+#include <linux/bitmap.h>
+#include <linux/dcache.h>
 #include <linux/socket.h>
 #include <linux/in.h>
 
+#include <linux/gfp.h>
+#include <linux/mm.h>
+
 #define BUF_SIZE 256
+#define PAD_SIZE 16
 #define FILL_CHAR '$'
 
 #define PTR1 ((void*)0x01234567)
@@ -39,6 +45,7 @@
 static unsigned total_tests __initdata;
 static unsigned failed_tests __initdata;
 static char *test_buffer __initdata;
+static char *alloced_buffer __initdata;
 
 static int __printf(4, 0) __init
 do_test(int bufsize, const char *expect, int elen,
@@ -49,7 +56,7 @@ do_test(int bufsize, const char *expect, int elen,
 
         total_tests++;
 
-        memset(test_buffer, FILL_CHAR, BUF_SIZE);
+        memset(alloced_buffer, FILL_CHAR, BUF_SIZE + 2*PAD_SIZE);
         va_copy(aq, ap);
         ret = vsnprintf(test_buffer, bufsize, fmt, aq);
         va_end(aq);
@@ -60,8 +67,13 @@ do_test(int bufsize, const char *expect, int elen,
                 return 1;
         }
 
+        if (memchr_inv(alloced_buffer, FILL_CHAR, PAD_SIZE)) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote before buffer\n", bufsize, fmt);
+                return 1;
+        }
+
         if (!bufsize) {
-                if (memchr_inv(test_buffer, FILL_CHAR, BUF_SIZE)) {
+                if (memchr_inv(test_buffer, FILL_CHAR, BUF_SIZE + PAD_SIZE)) {
                         pr_warn("vsnprintf(buf, 0, \"%s\", ...) wrote to buffer\n",
                                 fmt);
                         return 1;
@@ -76,6 +88,12 @@ do_test(int bufsize, const char *expect, int elen,
                 return 1;
         }
 
+        if (memchr_inv(test_buffer + written + 1, FILL_CHAR, BUF_SIZE + PAD_SIZE - (written + 1))) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote beyond the nul-terminator\n",
+                        bufsize, fmt);
+                return 1;
+        }
+
         if (memcmp(test_buffer, expect, written)) {
                 pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote '%s', expected '%.*s'\n",
                         bufsize, fmt, test_buffer, written, expect);
@@ -91,7 +109,12 @@ __test(const char *expect, int elen, const char *fmt, ...)
         int rand;
         char *p;
 
-        BUG_ON(elen >= BUF_SIZE);
+        if (elen >= BUF_SIZE) {
+                pr_err("error in test suite: expected output length %d too long. Format was '%s'.\n",
+                       elen, fmt);
+                failed_tests++;
+                return;
+        }
 
         va_start(ap, fmt);
 
@@ -109,6 +132,7 @@ __test(const char *expect, int elen, const char *fmt, ...)
 
         p = kvasprintf(GFP_KERNEL, fmt, ap);
         if (p) {
+                total_tests++;
                 if (memcmp(p, expect, elen+1)) {
                         pr_warn("kvasprintf(..., \"%s\", ...) returned '%s', expected '%s'\n",
                                 fmt, p, expect);
@@ -140,6 +164,30 @@ test_number(void)
         test("0x1234abcd  ", "%#-12x", 0x1234abcd);
         test("  0x1234abcd", "%#12x", 0x1234abcd);
         test("0|001| 12|+123| 1234|-123|-1234", "%d|%03d|%3d|%+d|% d|%+d|% d", 0, 1, 12, 123, 1234, -123, -1234);
+        test("0|1|1|128|255", "%hhu|%hhu|%hhu|%hhu|%hhu", 0, 1, 257, 128, -1);
+        test("0|1|1|-128|-1", "%hhd|%hhd|%hhd|%hhd|%hhd", 0, 1, 257, 128, -1);
+        test("2015122420151225", "%ho%ho%#ho", 1037, 5282, -11627);
+        /*
+         * POSIX/C99: »The result of converting zero with an explicit
+         * precision of zero shall be no characters.« Hence the output
+         * from the below test should really be "00|0||| ". However,
+         * the kernel's printf also produces a single 0 in that
+         * case. This test case simply documents the current
+         * behaviour.
+         */
+        test("00|0|0|0|0", "%.2d|%.1d|%.0d|%.*d|%1.0d", 0, 0, 0, 0, 0, 0);
+#ifndef __CHAR_UNSIGNED__
+        {
+                /*
+                 * Passing a 'char' to a %02x specifier doesn't do
+                 * what was presumably the intention when char is
+                 * signed and the value is negative. One must either &
+                 * with 0xff or cast to u8.
+                 */
+                char val = -16;
+                test("0xfffffff0|0xf0|0xf0", "%#02x|%#02x|%#02x", val, val & 0xff, (u8)val);
+        }
+#endif
 }
 
 static void __init
@@ -148,14 +196,23 @@ test_string(void)
         test("", "%s%.0s", "", "123");
         test("ABCD|abc|123", "%s|%.3s|%.*s", "ABCD", "abcdef", 3, "123456");
         test("1  |  2|3  |  4|5  ", "%-3s|%3s|%-*s|%*s|%*s", "1", "2", 3, "3", 3, "4", -3, "5");
+        test("1234      ", "%-10.4s", "123456");
+        test("      1234", "%10.4s", "123456");
         /*
-         * POSIX and C99 say that a missing precision should be
-         * treated as a precision of 0. However, the kernel's printf
-         * implementation treats this case as if the . wasn't
-         * present. Let's add a test case documenting the current
-         * behaviour; should anyone ever feel the need to follow the
-         * standards more closely, this can be revisited.
+         * POSIX and C99 say that a negative precision (which is only
+         * possible to pass via a * argument) should be treated as if
+         * the precision wasn't present, and that if the precision is
+         * omitted (as in %.s), the precision should be taken to be
+         * 0. However, the kernel's printf behave exactly opposite,
+         * treating a negative precision as 0 and treating an omitted
+         * precision specifier as if no precision was given.
+         *
+         * These test cases document the current behaviour; should
+         * anyone ever feel the need to follow the standards more
+         * closely, this can be revisited.
          */
+        test("    ", "%4.*s", -5, "123456");
+        test("123456", "%.s", "123456");
         test("a||", "%.s|%.0s|%.*s", "a", "b", 0, "c");
         test("a  |   |   ", "%-3.s|%-3.0s|%-3.*s", "a", "b", 0, "c");
 }
@@ -273,9 +330,35 @@ uuid(void)
         test("03020100-0504-0706-0809-0A0B0C0D0E0F", "%pUL", uuid);
 }
 
+static struct dentry test_dentry[4] __initdata = {
+        { .d_parent = &test_dentry[0],
+          .d_name = QSTR_INIT(test_dentry[0].d_iname, 3),
+          .d_iname = "foo" },
+        { .d_parent = &test_dentry[0],
+          .d_name = QSTR_INIT(test_dentry[1].d_iname, 5),
+          .d_iname = "bravo" },
+        { .d_parent = &test_dentry[1],
+          .d_name = QSTR_INIT(test_dentry[2].d_iname, 4),
+          .d_iname = "alfa" },
+        { .d_parent = &test_dentry[2],
+          .d_name = QSTR_INIT(test_dentry[3].d_iname, 5),
+          .d_iname = "romeo" },
+};
+
 static void __init
 dentry(void)
 {
+        test("foo", "%pd", &test_dentry[0]);
+        test("foo", "%pd2", &test_dentry[0]);
+
+        test("romeo", "%pd", &test_dentry[3]);
+        test("alfa/romeo", "%pd2", &test_dentry[3]);
+        test("bravo/alfa/romeo", "%pd3", &test_dentry[3]);
+        test("/bravo/alfa/romeo", "%pd4", &test_dentry[3]);
+        test("/bravo/alfa", "%pd4", &test_dentry[2]);
+
+        test("bravo/alfa  |bravo/alfa  ", "%-12pd2|%*pd2", &test_dentry[2], -12, &test_dentry[2]);
+        test("  bravo/alfa|  bravo/alfa", "%12pd2|%*pd2", &test_dentry[2], 12, &test_dentry[2]);
 }
 
 static void __init
@@ -289,6 +372,20 @@ struct_clk(void)
 }
 
 static void __init
+large_bitmap(void)
+{
+        const int nbits = 1 << 16;
+        unsigned long *bits = kcalloc(BITS_TO_LONGS(nbits), sizeof(long), GFP_KERNEL);
+        if (!bits)
+                return;
+
+        bitmap_set(bits, 1, 20);
+        bitmap_set(bits, 60000, 15);
+        test("1-20,60000-60014", "%*pbl", nbits, bits);
+        kfree(bits);
+}
+
+static void __init
 bitmap(void)
 {
         DECLARE_BITMAP(bits, 20);
@@ -307,6 +404,8 @@ bitmap(void)
         bitmap_fill(bits, 20);
         test("fffff|fffff", "%20pb|%*pb", bits, 20, bits);
         test("0-19|0-19", "%20pbl|%*pbl", bits, 20, bits);
+
+        large_bitmap();
 }
 
 static void __init
@@ -315,6 +414,55 @@ netdev_features(void)
 }
 
 static void __init
+flags(void)
+{
+        unsigned long flags;
+        gfp_t gfp;
+        char *cmp_buffer;
+
+        flags = 0;
+        test("", "%pGp", &flags);
+
+        /* Page flags should filter the zone id */
+        flags = 1UL << NR_PAGEFLAGS;
+        test("", "%pGp", &flags);
+
+        flags |= 1UL << PG_uptodate | 1UL << PG_dirty | 1UL << PG_lru
+                | 1UL << PG_active | 1UL << PG_swapbacked;
+        test("uptodate|dirty|lru|active|swapbacked", "%pGp", &flags);
+
+
+        flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC
+                        | VM_DENYWRITE;
+        test("read|exec|mayread|maywrite|mayexec|denywrite", "%pGv", &flags);
+
+        gfp = GFP_TRANSHUGE;
+        test("GFP_TRANSHUGE", "%pGg", &gfp);
+
+        gfp = GFP_ATOMIC|__GFP_DMA;
+        test("GFP_ATOMIC|GFP_DMA", "%pGg", &gfp);
+
+        gfp = __GFP_ATOMIC;
+        test("__GFP_ATOMIC", "%pGg", &gfp);
+
+        cmp_buffer = kmalloc(BUF_SIZE, GFP_KERNEL);
+        if (!cmp_buffer)
+                return;
+
+        /* Any flags not translated by the table should remain numeric */
+        gfp = ~__GFP_BITS_MASK;
+        snprintf(cmp_buffer, BUF_SIZE, "%#lx", (unsigned long) gfp);
+        test(cmp_buffer, "%pGg", &gfp);
+
+        snprintf(cmp_buffer, BUF_SIZE, "__GFP_ATOMIC|%#lx",
+                                                        (unsigned long) gfp);
+        gfp |= __GFP_ATOMIC;
+        test(cmp_buffer, "%pGg", &gfp);
+
+        kfree(cmp_buffer);
+}
+
+static void __init
 test_pointer(void)
 {
         plain();
@@ -332,21 +480,23 @@ test_pointer(void)
         struct_clk();
         bitmap();
         netdev_features();
+        flags();
 }
 
 static int __init
 test_printf_init(void)
 {
-        test_buffer = kmalloc(BUF_SIZE, GFP_KERNEL);
-        if (!test_buffer)
+        alloced_buffer = kmalloc(BUF_SIZE + 2*PAD_SIZE, GFP_KERNEL);
+        if (!alloced_buffer)
                 return -ENOMEM;
+        test_buffer = alloced_buffer + PAD_SIZE;
 
         test_basic();
         test_number();
         test_string();
         test_pointer();
 
-        kfree(test_buffer);
+        kfree(alloced_buffer);
 
         if (failed_tests == 0)
                 pr_info("all %u tests passed\n", total_tests);
diff --git a/lib/test_static_keys.c b/lib/test_static_keys.c
index c61b299e367f..915d75df2086 100644
--- a/lib/test_static_keys.c
+++ b/lib/test_static_keys.c
@@ -46,8 +46,11 @@ struct test_key {
         bool                    (*test_key)(void);
 };
 
-#define test_key_func(key, branch) \
-        ({bool func(void) { return branch(key); } func; })
+#define test_key_func(key, branch)      \
+static bool key ## _ ## branch(void)    \
+{                                       \
+        return branch(&key);            \
+}
 
 static void invert_key(struct static_key *key)
 {
@@ -92,6 +95,25 @@ static int verify_keys(struct test_key *keys, int size, bool invert)
         return 0;
 }
 
+test_key_func(old_true_key, static_key_true)
+test_key_func(old_false_key, static_key_false)
+test_key_func(true_key, static_branch_likely)
+test_key_func(true_key, static_branch_unlikely)
+test_key_func(false_key, static_branch_likely)
+test_key_func(false_key, static_branch_unlikely)
+test_key_func(base_old_true_key, static_key_true)
+test_key_func(base_inv_old_true_key, static_key_true)
+test_key_func(base_old_false_key, static_key_false)
+test_key_func(base_inv_old_false_key, static_key_false)
+test_key_func(base_true_key, static_branch_likely)
+test_key_func(base_true_key, static_branch_unlikely)
+test_key_func(base_inv_true_key, static_branch_likely)
+test_key_func(base_inv_true_key, static_branch_unlikely)
+test_key_func(base_false_key, static_branch_likely)
+test_key_func(base_false_key, static_branch_unlikely)
+test_key_func(base_inv_false_key, static_branch_likely)
+test_key_func(base_inv_false_key, static_branch_unlikely)
+
 static int __init test_static_key_init(void)
 {
         int ret;
@@ -102,95 +124,95 @@ static int __init test_static_key_init(void)
                 {
                         .init_state     = true,
                         .key            = &old_true_key,
-                        .test_key       = test_key_func(&old_true_key, static_key_true),
+                        .test_key       = &old_true_key_static_key_true,
                 },
                 {
                         .init_state     = false,
                         .key            = &old_false_key,
-                        .test_key       = test_key_func(&old_false_key, static_key_false),
+                        .test_key       = &old_false_key_static_key_false,
                 },
                 /* internal keys - new keys */
                 {
                         .init_state     = true,
                         .key            = &true_key.key,
-                        .test_key       = test_key_func(&true_key, static_branch_likely),
+                        .test_key       = &true_key_static_branch_likely,
                 },
                 {
                         .init_state     = true,
                         .key            = &true_key.key,
-                        .test_key       = test_key_func(&true_key, static_branch_unlikely),
+                        .test_key       = &true_key_static_branch_unlikely,
                 },
                 {
                         .init_state     = false,
                         .key            = &false_key.key,
-                        .test_key       = test_key_func(&false_key, static_branch_likely),
+                        .test_key       = &false_key_static_branch_likely,
                 },
                 {
                         .init_state     = false,
                         .key            = &false_key.key,
-                        .test_key       = test_key_func(&false_key, static_branch_unlikely),
+                        .test_key       = &false_key_static_branch_unlikely,
                 },
                 /* external keys - old keys */
                 {
                         .init_state     = true,
                         .key            = &base_old_true_key,
-                        .test_key       = test_key_func(&base_old_true_key, static_key_true),
+                        .test_key       = &base_old_true_key_static_key_true,
                 },
                 {
                         .init_state     = false,
                         .key            = &base_inv_old_true_key,
-                        .test_key       = test_key_func(&base_inv_old_true_key, static_key_true),
+                        .test_key       = &base_inv_old_true_key_static_key_true,
                 },
                 {
                         .init_state     = false,
                         .key            = &base_old_false_key,
-                        .test_key       = test_key_func(&base_old_false_key, static_key_false),
+                        .test_key       = &base_old_false_key_static_key_false,
                 },
                 {
                         .init_state     = true,
                         .key            = &base_inv_old_false_key,
-                        .test_key       = test_key_func(&base_inv_old_false_key, static_key_false),
+                        .test_key       = &base_inv_old_false_key_static_key_false,
                 },
                 /* external keys - new keys */
                 {
                         .init_state     = true,
                         .key            = &base_true_key.key,
-                        .test_key       = test_key_func(&base_true_key, static_branch_likely),
+                        .test_key       = &base_true_key_static_branch_likely,
                 },
                 {
                         .init_state     = true,
                         .key            = &base_true_key.key,
-                        .test_key       = test_key_func(&base_true_key, static_branch_unlikely),
+                        .test_key       = &base_true_key_static_branch_unlikely,
                 },
                 {
                         .init_state     = false,
                         .key            = &base_inv_true_key.key,
-                        .test_key       = test_key_func(&base_inv_true_key, static_branch_likely),
+                        .test_key       = &base_inv_true_key_static_branch_likely,
                 },
                 {
                         .init_state     = false,
                         .key            = &base_inv_true_key.key,
-                        .test_key       = test_key_func(&base_inv_true_key, static_branch_unlikely),
+                        .test_key       = &base_inv_true_key_static_branch_unlikely,
                 },
                 {
                         .init_state     = false,
                         .key            = &base_false_key.key,
-                        .test_key       = test_key_func(&base_false_key, static_branch_likely),
+                        .test_key       = &base_false_key_static_branch_likely,
                 },
                 {
                         .init_state     = false,
                         .key            = &base_false_key.key,
-                        .test_key       = test_key_func(&base_false_key, static_branch_unlikely),
+                        .test_key       = &base_false_key_static_branch_unlikely,
                 },
                 {
                         .init_state     = true,
                         .key            = &base_inv_false_key.key,
-                        .test_key       = test_key_func(&base_inv_false_key, static_branch_likely),
+                        .test_key       = &base_inv_false_key_static_branch_likely,
                 },
                 {
                         .init_state     = true,
                         .key            = &base_inv_false_key.key,
-                        .test_key       = test_key_func(&base_inv_false_key, static_branch_unlikely),
+                        .test_key       = &base_inv_false_key_static_branch_unlikely,
                 },
         };
 
diff --git a/lib/ubsan.c b/lib/ubsan.c
new file mode 100644
index 000000000000..8799ae5e2e42
--- /dev/null
+++ b/lib/ubsan.c
@@ -0,0 +1,456 @@
+/*
+ * UBSAN error reporting functions
+ *
+ * Copyright (c) 2014 Samsung Electronics Co., Ltd.
+ * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/bitops.h>
+#include <linux/bug.h>
+#include <linux/ctype.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+
+#include "ubsan.h"
+
+const char *type_check_kinds[] = {
+        "load of",
+        "store to",
+        "reference binding to",
+        "member access within",
+        "member call on",
+        "constructor call on",
+        "downcast of",
+        "downcast of"
+};
+
+#define REPORTED_BIT 31
+
+#if (BITS_PER_LONG == 64) && defined(__BIG_ENDIAN)
+#define COLUMN_MASK (~(1U << REPORTED_BIT))
+#define LINE_MASK   (~0U)
+#else
+#define COLUMN_MASK   (~0U)
+#define LINE_MASK (~(1U << REPORTED_BIT))
+#endif
+
+#define VALUE_LENGTH 40
+
+static bool was_reported(struct source_location *location)
+{
+        return test_and_set_bit(REPORTED_BIT, &location->reported);
+}
+
+static void print_source_location(const char *prefix,
+                                struct source_location *loc)
+{
+        pr_err("%s %s:%d:%d\n", prefix, loc->file_name,
+                loc->line & LINE_MASK, loc->column & COLUMN_MASK);
+}
+
+static bool suppress_report(struct source_location *loc)
+{
+        return current->in_ubsan || was_reported(loc);
+}
+
+static bool type_is_int(struct type_descriptor *type)
+{
+        return type->type_kind == type_kind_int;
+}
+
+static bool type_is_signed(struct type_descriptor *type)
+{
+        WARN_ON(!type_is_int(type));
+        return  type->type_info & 1;
+}
+
+static unsigned type_bit_width(struct type_descriptor *type)
+{
+        return 1 << (type->type_info >> 1);
+}
+
+static bool is_inline_int(struct type_descriptor *type)
+{
+        unsigned inline_bits = sizeof(unsigned long)*8;
+        unsigned bits = type_bit_width(type);
+
+        WARN_ON(!type_is_int(type));
+
+        return bits <= inline_bits;
+}
+
+static s_max get_signed_val(struct type_descriptor *type, unsigned long val)
+{
+        if (is_inline_int(type)) {
+                unsigned extra_bits = sizeof(s_max)*8 - type_bit_width(type);
+                return ((s_max)val) << extra_bits >> extra_bits;
+        }
+
+        if (type_bit_width(type) == 64)
+                return *(s64 *)val;
+
+        return *(s_max *)val;
+}
+
+static bool val_is_negative(struct type_descriptor *type, unsigned long val)
+{
+        return type_is_signed(type) && get_signed_val(type, val) < 0;
+}
+
+static u_max get_unsigned_val(struct type_descriptor *type, unsigned long val)
+{
+        if (is_inline_int(type))
+                return val;
+
+        if (type_bit_width(type) == 64)
+                return *(u64 *)val;
+
+        return *(u_max *)val;
+}
+
+static void val_to_string(char *str, size_t size, struct type_descriptor *type,
+        unsigned long value)
+{
+        if (type_is_int(type)) {
+                if (type_bit_width(type) == 128) {
+#if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
+                        u_max val = get_unsigned_val(type, value);
+
+                        scnprintf(str, size, "0x%08x%08x%08x%08x",
+                                (u32)(val >> 96),
+                                (u32)(val >> 64),
+                                (u32)(val >> 32),
+                                (u32)(val));
+#else
+                        WARN_ON(1);
+#endif
+                } else if (type_is_signed(type)) {
+                        scnprintf(str, size, "%lld",
+                                (s64)get_signed_val(type, value));
+                } else {
+                        scnprintf(str, size, "%llu",
+                                (u64)get_unsigned_val(type, value));
+                }
+        }
+}
+
+static bool location_is_valid(struct source_location *loc)
+{
+        return loc->file_name != NULL;
+}
+
+static DEFINE_SPINLOCK(report_lock);
+
+static void ubsan_prologue(struct source_location *location,
+                        unsigned long *flags)
+{
+        current->in_ubsan++;
+        spin_lock_irqsave(&report_lock, *flags);
+
+        pr_err("========================================"
+                "========================================\n");
+        print_source_location("UBSAN: Undefined behaviour in", location);
+}
+
+static void ubsan_epilogue(unsigned long *flags)
+{
+        dump_stack();
+        pr_err("========================================"
+                "========================================\n");
+        spin_unlock_irqrestore(&report_lock, *flags);
+        current->in_ubsan--;
+}
+
+static void handle_overflow(struct overflow_data *data, unsigned long lhs,
+                        unsigned long rhs, char op)
+{
+
+        struct type_descriptor *type = data->type;
+        unsigned long flags;
+        char lhs_val_str[VALUE_LENGTH];
+        char rhs_val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);
+        val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);
+        pr_err("%s integer overflow:\n",
+                type_is_signed(type) ? "signed" : "unsigned");
+        pr_err("%s %c %s cannot be represented in type %s\n",
+                lhs_val_str,
+                op,
+                rhs_val_str,
+                type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+
+void __ubsan_handle_add_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+
+        handle_overflow(data, lhs, rhs, '+');
+}
+EXPORT_SYMBOL(__ubsan_handle_add_overflow);
+
+void __ubsan_handle_sub_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+        handle_overflow(data, lhs, rhs, '-');
+}
+EXPORT_SYMBOL(__ubsan_handle_sub_overflow);
+
+void __ubsan_handle_mul_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+        handle_overflow(data, lhs, rhs, '*');
+}
+EXPORT_SYMBOL(__ubsan_handle_mul_overflow);
+
+void __ubsan_handle_negate_overflow(struct overflow_data *data,
+                                unsigned long old_val)
+{
+        unsigned long flags;
+        char old_val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
+
+        pr_err("negation of %s cannot be represented in type %s:\n",
+                old_val_str, data->type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
+
+
+void __ubsan_handle_divrem_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+        unsigned long flags;
+        char rhs_val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
+
+        if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1)
+                pr_err("division of %s by -1 cannot be represented in type %s\n",
+                        rhs_val_str, data->type->type_name);
+        else
+                pr_err("division by zero\n");
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_divrem_overflow);
+
+static void handle_null_ptr_deref(struct type_mismatch_data *data)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        pr_err("%s null pointer of type %s\n",
+                type_check_kinds[data->type_check_kind],
+                data->type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+
+static void handle_missaligned_access(struct type_mismatch_data *data,
+                                unsigned long ptr)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        pr_err("%s misaligned address %p for type %s\n",
+                type_check_kinds[data->type_check_kind],
+                (void *)ptr, data->type->type_name);
+        pr_err("which requires %ld byte alignment\n", data->alignment);
+
+        ubsan_epilogue(&flags);
+}
+
+static void handle_object_size_mismatch(struct type_mismatch_data *data,
+                                        unsigned long ptr)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+        pr_err("%s address %pk with insufficient space\n",
+                type_check_kinds[data->type_check_kind],
+                (void *) ptr);
+        pr_err("for an object of type %s\n", data->type->type_name);
+        ubsan_epilogue(&flags);
+}
+
+void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
+                                unsigned long ptr)
+{
+
+        if (!ptr)
+                handle_null_ptr_deref(data);
+        else if (data->alignment && !IS_ALIGNED(ptr, data->alignment))
+                handle_missaligned_access(data, ptr);
+        else
+                handle_object_size_mismatch(data, ptr);
+}
+EXPORT_SYMBOL(__ubsan_handle_type_mismatch);
+
+void __ubsan_handle_nonnull_return(struct nonnull_return_data *data)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        pr_err("null pointer returned from function declared to never return null\n");
+
+        if (location_is_valid(&data->attr_location))
+                print_source_location("returns_nonnull attribute specified in",
+                                &data->attr_location);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_nonnull_return);
+
+void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data,
+                                        unsigned long bound)
+{
+        unsigned long flags;
+        char bound_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(bound_str, sizeof(bound_str), data->type, bound);
+        pr_err("variable length array bound value %s <= 0\n", bound_str);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive);
+
+void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data,
+                                unsigned long index)
+{
+        unsigned long flags;
+        char index_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(index_str, sizeof(index_str), data->index_type, index);
+        pr_err("index %s is out of range for type %s\n", index_str,
+                data->array_type->type_name);
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
+
+void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+                                        unsigned long lhs, unsigned long rhs)
+{
+        unsigned long flags;
+        struct type_descriptor *rhs_type = data->rhs_type;
+        struct type_descriptor *lhs_type = data->lhs_type;
+        char rhs_str[VALUE_LENGTH];
+        char lhs_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
+        val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
+
+        if (val_is_negative(rhs_type, rhs))
+                pr_err("shift exponent %s is negative\n", rhs_str);
+
+        else if (get_unsigned_val(rhs_type, rhs) >=
+                type_bit_width(lhs_type))
+                pr_err("shift exponent %s is too large for %u-bit type %s\n",
+                        rhs_str,
+                        type_bit_width(lhs_type),
+                        lhs_type->type_name);
+        else if (val_is_negative(lhs_type, lhs))
+                pr_err("left shift of negative value %s\n",
+                        lhs_str);
+        else
+                pr_err("left shift of %s by %s places cannot be"
+                        " represented in type %s\n",
+                        lhs_str, rhs_str,
+                        lhs_type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
+
+
+void __noreturn
+__ubsan_handle_builtin_unreachable(struct unreachable_data *data)
+{
+        unsigned long flags;
+
+        ubsan_prologue(&data->location, &flags);
+        pr_err("calling __builtin_unreachable()\n");
+        ubsan_epilogue(&flags);
+        panic("can't return from __builtin_unreachable()");
+}
+EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
+
+void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
+                                unsigned long val)
+{
+        unsigned long flags;
+        char val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(val_str, sizeof(val_str), data->type, val);
+
+        pr_err("load of value %s is not a valid value for type %s\n",
+                val_str, data->type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_load_invalid_value);
diff --git a/lib/ubsan.h b/lib/ubsan.h
new file mode 100644
index 000000000000..b2d18d4a53f5
--- /dev/null
+++ b/lib/ubsan.h
@@ -0,0 +1,84 @@
+#ifndef _LIB_UBSAN_H
+#define _LIB_UBSAN_H
+
+enum {
+        type_kind_int = 0,
+        type_kind_float = 1,
+        type_unknown = 0xffff
+};
+
+struct type_descriptor {
+        u16 type_kind;
+        u16 type_info;
+        char type_name[1];
+};
+
+struct source_location {
+        const char *file_name;
+        union {
+                unsigned long reported;
+                struct {
+                        u32 line;
+                        u32 column;
+                };
+        };
+};
+
+struct overflow_data {
+        struct source_location location;
+        struct type_descriptor *type;
+};
+
+struct type_mismatch_data {
+        struct source_location location;
+        struct type_descriptor *type;
+        unsigned long alignment;
+        unsigned char type_check_kind;
+};
+
+struct nonnull_arg_data {
+        struct source_location location;
+        struct source_location attr_location;
+        int arg_index;
+};
+
+struct nonnull_return_data {
+        struct source_location location;
+        struct source_location attr_location;
+};
+
+struct vla_bound_data {
+        struct source_location location;
+        struct type_descriptor *type;
+};
+
+struct out_of_bounds_data {
+        struct source_location location;
+        struct type_descriptor *array_type;
+        struct type_descriptor *index_type;
+};
+
+struct shift_out_of_bounds_data {
+        struct source_location location;
+        struct type_descriptor *lhs_type;
+        struct type_descriptor *rhs_type;
+};
+
+struct unreachable_data {
+        struct source_location location;
+};
+
+struct invalid_value_data {
+        struct source_location location;
+        struct type_descriptor *type;
+};
+
+#if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
+typedef __int128 s_max;
+typedef unsigned __int128 u_max;
+#else
+typedef s64 s_max;
+typedef u64 u_max;
+#endif
+
+#endif
diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c
index 6f500ef2301d..f0b323abb4c6 100644
--- a/lib/ucs2_string.c
+++ b/lib/ucs2_string.c
@@ -49,3 +49,65 @@ ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len)
         }
 }
 EXPORT_SYMBOL(ucs2_strncmp);
+
+unsigned long
+ucs2_utf8size(const ucs2_char_t *src)
+{
+        unsigned long i;
+        unsigned long j = 0;
+
+        for (i = 0; i < ucs2_strlen(src); i++) {
+                u16 c = src[i];
+
+                if (c >= 0x800)
+                        j += 3;
+                else if (c >= 0x80)
+                        j += 2;
+                else
+                        j += 1;
+        }
+
+        return j;
+}
+EXPORT_SYMBOL(ucs2_utf8size);
+
+/*
+ * copy at most maxlength bytes of whole utf8 characters to dest from the
+ * ucs2 string src.
+ *
+ * The return value is the number of characters copied, not including the
+ * final NUL character.
+ */
+unsigned long
+ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, unsigned long maxlength)
+{
+        unsigned int i;
+        unsigned long j = 0;
+        unsigned long limit = ucs2_strnlen(src, maxlength);
+
+        for (i = 0; maxlength && i < limit; i++) {
+                u16 c = src[i];
+
+                if (c >= 0x800) {
+                        if (maxlength < 3)
+                                break;
+                        maxlength -= 3;
+                        dest[j++] = 0xe0 | (c & 0xf000) >> 12;
+                        dest[j++] = 0x80 | (c & 0x0fc0) >> 6;
+                        dest[j++] = 0x80 | (c & 0x003f);
+                } else if (c >= 0x80) {
+                        if (maxlength < 2)
+                                break;
+                        maxlength -= 2;
+                        dest[j++] = 0xc0 | (c & 0x7c0) >> 6;
+                        dest[j++] = 0x80 | (c & 0x03f);
+                } else {
+                        maxlength -= 1;
+                        dest[j++] = c & 0x7f;
+                }
+        }
+        if (maxlength)
+                dest[j] = '\0';
+        return j;
+}
+EXPORT_SYMBOL(ucs2_as_utf8);
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index ac3f9476b776..525c8e19bda2 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -35,6 +35,8 @@
 #include <linux/blkdev.h>
 #endif
 
+#include "../mm/internal.h"     /* For the trace_print_flags arrays */
+
 #include <asm/page.h>           /* for PAGE_SIZE */
 #include <asm/sections.h>       /* for dereference_function_descriptor() */
 #include <asm/byteorder.h>      /* cpu_to_le16 */
@@ -383,13 +385,14 @@ enum format_type {
 };
 
 struct printf_spec {
-        u8      type;           /* format_type enum */
-        u8      flags;          /* flags to number() */
-        u8      base;           /* number base, 8, 10 or 16 only */
-        u8      qualifier;      /* number qualifier, one of 'hHlLtzZ' */
-        s16     field_width;    /* width of output field */
-        s16     precision;      /* # of digits/chars */
-};
+        unsigned int    type:8;         /* format_type enum */
+        signed int      field_width:24; /* width of output field */
+        unsigned int    flags:8;        /* flags to number() */
+        unsigned int    base:8;         /* number base, 8, 10 or 16 only */
+        signed int      precision:16;   /* # of digits/chars */
+} __packed;
+#define FIELD_WIDTH_MAX ((1 << 23) - 1)
+#define PRECISION_MAX ((1 << 15) - 1)
 
 static noinline_for_stack
 char *number(char *buf, char *end, unsigned long long num,
@@ -402,6 +405,10 @@ char *number(char *buf, char *end, unsigned long long num,
         int need_pfx = ((spec.flags & SPECIAL) && spec.base != 10);
         int i;
         bool is_zero = num == 0LL;
+        int field_width = spec.field_width;
+        int precision = spec.precision;
+
+        BUILD_BUG_ON(sizeof(struct printf_spec) != 8);
 
         /* locase = 0 or 0x20. ORing digits or letters with 'locase'
          * produces same digits or (maybe lowercased) letters */
@@ -413,20 +420,20 @@ char *number(char *buf, char *end, unsigned long long num,
                 if ((signed long long)num < 0) {
                         sign = '-';
                         num = -(signed long long)num;
-                        spec.field_width--;
+                        field_width--;
                 } else if (spec.flags & PLUS) {
                         sign = '+';
-                        spec.field_width--;
+                        field_width--;
                 } else if (spec.flags & SPACE) {
                         sign = ' ';
-                        spec.field_width--;
+                        field_width--;
                 }
         }
         if (need_pfx) {
                 if (spec.base == 16)
-                        spec.field_width -= 2;
+                        field_width -= 2;
                 else if (!is_zero)
-                        spec.field_width--;
+                        field_width--;
         }
 
         /* generate full string in tmp[], in reverse order */
@@ -448,12 +455,12 @@ char *number(char *buf, char *end, unsigned long long num,
         }
 
         /* printing 100 using %2d gives "100", not "00" */
-        if (i > spec.precision)
-                spec.precision = i;
+        if (i > precision)
+                precision = i;
         /* leading space padding */
-        spec.field_width -= spec.precision;
+        field_width -= precision;
         if (!(spec.flags & (ZEROPAD | LEFT))) {
-                while (--spec.field_width >= 0) {
+                while (--field_width >= 0) {
                         if (buf < end)
                                 *buf = ' ';
                         ++buf;
@@ -482,14 +489,14 @@ char *number(char *buf, char *end, unsigned long long num,
         if (!(spec.flags & LEFT)) {
                 char c = ' ' + (spec.flags & ZEROPAD);
                 BUILD_BUG_ON(' ' + ZEROPAD != '0');
-                while (--spec.field_width >= 0) {
+                while (--field_width >= 0) {
                         if (buf < end)
                                 *buf = c;
                         ++buf;
                 }
         }
         /* hmm even more zero padding? */
-        while (i <= --spec.precision) {
+        while (i <= --precision) {
                 if (buf < end)
                         *buf = '0';
                 ++buf;
@@ -501,7 +508,7 @@ char *number(char *buf, char *end, unsigned long long num,
                 ++buf;
         }
         /* trailing space padding */
-        while (--spec.field_width >= 0) {
+        while (--field_width >= 0) {
                 if (buf < end)
                         *buf = ' ';
                 ++buf;
@@ -511,37 +518,20 @@ char *number(char *buf, char *end, unsigned long long num,
 }
 
 static noinline_for_stack
-char *string(char *buf, char *end, const char *s, struct printf_spec spec)
+char *special_hex_number(char *buf, char *end, unsigned long long num, int size)
 {
-        int len, i;
+        struct printf_spec spec;
 
-        if ((unsigned long)s < PAGE_SIZE)
-                s = "(null)";
-
-        len = strnlen(s, spec.precision);
-
-        if (!(spec.flags & LEFT)) {
-                while (len < spec.field_width--) {
-                        if (buf < end)
-                                *buf = ' ';
-                        ++buf;
-                }
-        }
-        for (i = 0; i < len; ++i) {
-                if (buf < end)
-                        *buf = *s;
-                ++buf; ++s;
-        }
-        while (len < spec.field_width--) {
-                if (buf < end)
-                        *buf = ' ';
-                ++buf;
-        }
+        spec.type = FORMAT_TYPE_PTR;
+        spec.field_width = 2 + 2 * size;        /* 0x + hex */
+        spec.flags = SPECIAL | SMALL | ZEROPAD;
+        spec.base = 16;
+        spec.precision = -1;
 
-        return buf;
+        return number(buf, end, num, spec);
 }
 
-static void widen(char *buf, char *end, unsigned len, unsigned spaces)
+static void move_right(char *buf, char *end, unsigned len, unsigned spaces)
 {
         size_t size;
         if (buf >= end) /* nowhere to put anything */
@@ -559,6 +549,56 @@ static void widen(char *buf, char *end, unsigned len, unsigned spaces)
         memset(buf, ' ', spaces);
 }
 
+/*
+ * Handle field width padding for a string.
+ * @buf: current buffer position
+ * @n: length of string
+ * @end: end of output buffer
+ * @spec: for field width and flags
+ * Returns: new buffer position after padding.
+ */
+static noinline_for_stack
+char *widen_string(char *buf, int n, char *end, struct printf_spec spec)
+{
+        unsigned spaces;
+
+        if (likely(n >= spec.field_width))
+                return buf;
+        /* we want to pad the sucker */
+        spaces = spec.field_width - n;
+        if (!(spec.flags & LEFT)) {
+                move_right(buf - n, end, n, spaces);
+                return buf + spaces;
+        }
+        while (spaces--) {
+                if (buf < end)
+                        *buf = ' ';
+                ++buf;
+        }
+        return buf;
+}
+
+static noinline_for_stack
+char *string(char *buf, char *end, const char *s, struct printf_spec spec)
+{
+        int len = 0;
+        size_t lim = spec.precision;
+
+        if ((unsigned long)s < PAGE_SIZE)
+                s = "(null)";
+
+        while (lim--) {
+                char c = *s++;
+                if (!c)
+                        break;
+                if (buf < end)
+                        *buf = c;
+                ++buf;
+                ++len;
+        }
+        return widen_string(buf, len, end, spec);
+}
+
 static noinline_for_stack
 char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_spec spec,
                   const char *fmt)
@@ -600,20 +640,7 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp
                         *buf = c;
         }
         rcu_read_unlock();
-        if (n < spec.field_width) {
-                /* we want to pad the sucker */
-                unsigned spaces = spec.field_width - n;
-                if (!(spec.flags & LEFT)) {
-                        widen(buf - n, end, n, spaces);
-                        return buf + spaces;
-                }
-                while (spaces--) {
-                        if (buf < end)
-                                *buf = ' ';
-                        ++buf;
-                }
-        }
-        return buf;
+        return widen_string(buf, n, end, spec);
 }
 
 #ifdef CONFIG_BLOCK
@@ -659,11 +686,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
 
         return string(buf, end, sym, spec);
 #else
-        spec.field_width = 2 * sizeof(void *);
-        spec.flags |= SPECIAL | SMALL | ZEROPAD;
-        spec.base = 16;
-
-        return number(buf, end, value, spec);
+        return special_hex_number(buf, end, value, sizeof(void *));
 #endif
 }
 
@@ -1324,40 +1347,45 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
         return string(buf, end, uuid, spec);
 }
 
-static
-char *netdev_feature_string(char *buf, char *end, const u8 *addr,
-                      struct printf_spec spec)
+static noinline_for_stack
+char *netdev_bits(char *buf, char *end, const void *addr, const char *fmt)
 {
-        spec.flags |= SPECIAL | SMALL | ZEROPAD;
-        if (spec.field_width == -1)
-                spec.field_width = 2 + 2 * sizeof(netdev_features_t);
-        spec.base = 16;
+        unsigned long long num;
+        int size;
+
+        switch (fmt[1]) {
+        case 'F':
+                num = *(const netdev_features_t *)addr;
+                size = sizeof(netdev_features_t);
+                break;
+        default:
+                num = (unsigned long)addr;
+                size = sizeof(unsigned long);
+                break;
+        }
 
-        return number(buf, end, *(const netdev_features_t *)addr, spec);
+        return special_hex_number(buf, end, num, size);
 }
 
 static noinline_for_stack
-char *address_val(char *buf, char *end, const void *addr,
-                  struct printf_spec spec, const char *fmt)
+char *address_val(char *buf, char *end, const void *addr, const char *fmt)
 {
         unsigned long long num;
-
-        spec.flags |= SPECIAL | SMALL | ZEROPAD;
-        spec.base = 16;
+        int size;
 
         switch (fmt[1]) {
         case 'd':
                 num = *(const dma_addr_t *)addr;
-                spec.field_width = sizeof(dma_addr_t) * 2 + 2;
+                size = sizeof(dma_addr_t);
                 break;
         case 'p':
         default:
                 num = *(const phys_addr_t *)addr;
-                spec.field_width = sizeof(phys_addr_t) * 2 + 2;
+                size = sizeof(phys_addr_t);
                 break;
         }
 
-        return number(buf, end, num, spec);
+        return special_hex_number(buf, end, num, size);
 }
 
 static noinline_for_stack
@@ -1376,14 +1404,77 @@ char *clock(char *buf, char *end, struct clk *clk, struct printf_spec spec,
 #ifdef CONFIG_COMMON_CLK
                 return string(buf, end, __clk_get_name(clk), spec);
 #else
-                spec.base = 16;
-                spec.field_width = sizeof(unsigned long) * 2 + 2;
-                spec.flags |= SPECIAL | SMALL | ZEROPAD;
-                return number(buf, end, (unsigned long)clk, spec);
+                return special_hex_number(buf, end, (unsigned long)clk, sizeof(unsigned long));
 #endif
         }
 }
 
+static
+char *format_flags(char *buf, char *end, unsigned long flags,
+                                        const struct trace_print_flags *names)
+{
+        unsigned long mask;
+        const struct printf_spec strspec = {
+                .field_width = -1,
+                .precision = -1,
+        };
+        const struct printf_spec numspec = {
+                .flags = SPECIAL|SMALL,
+                .field_width = -1,
+                .precision = -1,
+                .base = 16,
+        };
+
+        for ( ; flags && names->name; names++) {
+                mask = names->mask;
+                if ((flags & mask) != mask)
+                        continue;
+
+                buf = string(buf, end, names->name, strspec);
+
+                flags &= ~mask;
+                if (flags) {
+                        if (buf < end)
+                                *buf = '|';
+                        buf++;
+                }
+        }
+
+        if (flags)
+                buf = number(buf, end, flags, numspec);
+
+        return buf;
+}
+
+static noinline_for_stack
+char *flags_string(char *buf, char *end, void *flags_ptr, const char *fmt)
+{
+        unsigned long flags;
+        const struct trace_print_flags *names;
+
+        switch (fmt[1]) {
+        case 'p':
+                flags = *(unsigned long *)flags_ptr;
+                /* Remove zone id */
+                flags &= (1UL << NR_PAGEFLAGS) - 1;
+                names = pageflag_names;
+                break;
+        case 'v':
+                flags = *(unsigned long *)flags_ptr;
+                names = vmaflag_names;
+                break;
+        case 'g':
+                flags = *(gfp_t *)flags_ptr;
+                names = gfpflag_names;
+                break;
+        default:
+                WARN_ONCE(1, "Unsupported flags modifier: %c\n", fmt[1]);
+                return buf;
+        }
+
+        return format_flags(buf, end, flags, names);
+}
+
 int kptr_restrict __read_mostly;
 
 /*
@@ -1472,6 +1563,11 @@ int kptr_restrict __read_mostly;
  * - 'Cn' For a clock, it prints the name (Common Clock Framework) or address
  *        (legacy clock framework) of the clock
  * - 'Cr' For a clock, it prints the current rate of the clock
+ * - 'G' For flags to be printed as a collection of symbolic strings that would
+ *       construct the specific value. Supported flags given by option:
+ *       p page flags (see struct page) given as pointer to unsigned long
+ *       g gfp flags (GFP_* and __GFP_*) given as pointer to gfp_t
+ *       v vma flags (VM_*) given as pointer to unsigned long
  *
  * ** Please update also Documentation/printk-formats.txt when making changes **
  *
@@ -1567,22 +1663,23 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                         return buf;
                 }
         case 'K':
-                /*
-                 * %pK cannot be used in IRQ context because its test
-                 * for CAP_SYSLOG would be meaningless.
-                 */
-                if (kptr_restrict && (in_irq() || in_serving_softirq() ||
-                                      in_nmi())) {
-                        if (spec.field_width == -1)
-                                spec.field_width = default_width;
-                        return string(buf, end, "pK-error", spec);
-                }
-
                 switch (kptr_restrict) {
                 case 0:
                         /* Always print %pK values */
                         break;
                 case 1: {
+                        const struct cred *cred;
+
+                        /*
+                         * kptr_restrict==1 cannot be used in IRQ context
+                         * because its test for CAP_SYSLOG would be meaningless.
+                         */
+                        if (in_irq() || in_serving_softirq() || in_nmi()) {
+                                if (spec.field_width == -1)
+                                        spec.field_width = default_width;
+                                return string(buf, end, "pK-error", spec);
+                        }
+
                         /*
                          * Only print the real pointer value if the current
                          * process has CAP_SYSLOG and is running with the
@@ -1592,8 +1689,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                          * leak pointer values if a binary opens a file using
                          * %pK and then elevates privileges before reading it.
                          */
-                        const struct cred *cred = current_cred();
-
+                        cred = current_cred();
                         if (!has_capability_noaudit(current, CAP_SYSLOG) ||
                             !uid_eq(cred->euid, cred->uid) ||
                             !gid_eq(cred->egid, cred->gid))
@@ -1609,13 +1705,9 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                 break;
 
         case 'N':
-                switch (fmt[1]) {
-                case 'F':
-                        return netdev_feature_string(buf, end, ptr, spec);
-                }
-                break;
+                return netdev_bits(buf, end, ptr, fmt);
         case 'a':
-                return address_val(buf, end, ptr, spec, fmt);
+                return address_val(buf, end, ptr, fmt);
         case 'd':
                 return dentry_name(buf, end, ptr, spec, fmt);
         case 'C':
@@ -1629,6 +1721,8 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                 return bdev_name(buf, end, ptr, spec, fmt);
 #endif
 
+        case 'G':
+                return flags_string(buf, end, ptr, fmt);
         }
         spec.flags |= SMALL;
         if (spec.field_width == -1) {
@@ -1664,6 +1758,7 @@ static noinline_for_stack
 int format_decode(const char *fmt, struct printf_spec *spec)
 {
         const char *start = fmt;
+        char qualifier;
 
         /* we finished early by reading the field width */
         if (spec->type == FORMAT_TYPE_WIDTH) {
@@ -1746,16 +1841,16 @@ precision:
 
 qualifier:
         /* get the conversion qualifier */
-        spec->qualifier = -1;
+        qualifier = 0;
         if (*fmt == 'h' || _tolower(*fmt) == 'l' ||
             _tolower(*fmt) == 'z' || *fmt == 't') {
-                spec->qualifier = *fmt++;
-                if (unlikely(spec->qualifier == *fmt)) {
-                        if (spec->qualifier == 'l') {
-                                spec->qualifier = 'L';
+                qualifier = *fmt++;
+                if (unlikely(qualifier == *fmt)) {
+                        if (qualifier == 'l') {
+                                qualifier = 'L';
                                 ++fmt;
-                        } else if (spec->qualifier == 'h') {
-                                spec->qualifier = 'H';
+                        } else if (qualifier == 'h') {
+                                qualifier = 'H';
                                 ++fmt;
                         }
                 }
@@ -1812,19 +1907,19 @@ qualifier:
                 return fmt - start;
         }
 
-        if (spec->qualifier == 'L')
+        if (qualifier == 'L')
                 spec->type = FORMAT_TYPE_LONG_LONG;
-        else if (spec->qualifier == 'l') {
+        else if (qualifier == 'l') {
                 BUILD_BUG_ON(FORMAT_TYPE_ULONG + SIGN != FORMAT_TYPE_LONG);
                 spec->type = FORMAT_TYPE_ULONG + (spec->flags & SIGN);
-        } else if (_tolower(spec->qualifier) == 'z') {
+        } else if (_tolower(qualifier) == 'z') {
                 spec->type = FORMAT_TYPE_SIZE_T;
-        } else if (spec->qualifier == 't') {
+        } else if (qualifier == 't') {
                 spec->type = FORMAT_TYPE_PTRDIFF;
-        } else if (spec->qualifier == 'H') {
+        } else if (qualifier == 'H') {
                 BUILD_BUG_ON(FORMAT_TYPE_UBYTE + SIGN != FORMAT_TYPE_BYTE);
                 spec->type = FORMAT_TYPE_UBYTE + (spec->flags & SIGN);
-        } else if (spec->qualifier == 'h') {
+        } else if (qualifier == 'h') {
                 BUILD_BUG_ON(FORMAT_TYPE_USHORT + SIGN != FORMAT_TYPE_SHORT);
                 spec->type = FORMAT_TYPE_USHORT + (spec->flags & SIGN);
         } else {
@@ -1835,6 +1930,24 @@ qualifier:
         return ++fmt - start;
 }
 
+static void
+set_field_width(struct printf_spec *spec, int width)
+{
+        spec->field_width = width;
+        if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
+                spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
+        }
+}
+
+static void
+set_precision(struct printf_spec *spec, int prec)
+{
+        spec->precision = prec;
+        if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
+                spec->precision = clamp(prec, 0, PRECISION_MAX);
+        }
+}
+
 /**
  * vsnprintf - Format a string and place it in a buffer
  * @buf: The buffer to place the result into
@@ -1902,11 +2015,11 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                 }
 
                 case FORMAT_TYPE_WIDTH:
-                        spec.field_width = va_arg(args, int);
+                        set_field_width(&spec, va_arg(args, int));
                         break;
 
                 case FORMAT_TYPE_PRECISION:
-                        spec.precision = va_arg(args, int);
+                        set_precision(&spec, va_arg(args, int));
                         break;
 
                 case FORMAT_TYPE_CHAR: {
@@ -2346,11 +2459,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                 }
 
                 case FORMAT_TYPE_WIDTH:
-                        spec.field_width = get_arg(int);
+                        set_field_width(&spec, get_arg(int));
                         break;
 
                 case FORMAT_TYPE_PRECISION:
-                        spec.precision = get_arg(int);
+                        set_precision(&spec, get_arg(int));
                         break;
 
                 case FORMAT_TYPE_CHAR: {