36 files changed, 1938 insertions, 343 deletions

diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 8881dad2a6a0..a7f278d2ed8f 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -69,7 +69,7 @@ struct sw842_param {
         ((s) == 2 ? be16_to_cpu(get_unaligned((__be16 *)d)) :   \
          (s) == 4 ? be32_to_cpu(get_unaligned((__be32 *)d)) :   \
          (s) == 8 ? be64_to_cpu(get_unaligned((__be64 *)d)) :   \
-         WARN(1, "pr_debug param err invalid size %x\n", s))
+         0)
 
 static int next_bits(struct sw842_param *p, u64 *d, u8 n);
 
@@ -202,10 +202,14 @@ static int __do_index(struct sw842_param *p, u8 size, u8 bits, u64 fsize)
                 return -EINVAL;
         }
 
-        pr_debug("index%x to %lx off %lx adjoff %lx tot %lx data %lx\n",
-                 size, (unsigned long)index, (unsigned long)(index * size),
-                 (unsigned long)offset, (unsigned long)total,
-                 (unsigned long)beN_to_cpu(&p->ostart[offset], size));
+        if (size != 2 && size != 4 && size != 8)
+                WARN(1, "__do_index invalid size %x\n", size);
+        else
+                pr_debug("index%x to %lx off %lx adjoff %lx tot %lx data %lx\n",
+                         size, (unsigned long)index,
+                         (unsigned long)(index * size), (unsigned long)offset,
+                         (unsigned long)total,
+                         (unsigned long)beN_to_cpu(&p->ostart[offset], size));
 
         memcpy(p->out, &p->ostart[offset], size);
         p->out += size;
diff --git a/lib/Kconfig b/lib/Kconfig
index f0df318104e7..133ebc0c1773 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -210,9 +210,11 @@ config RANDOM32_SELFTEST
 # compression support is select'ed if needed
 #
 config 842_COMPRESS
+        select CRC32
         tristate
 
 config 842_DECOMPRESS
+        select CRC32
         tristate
 
 config ZLIB_INFLATE
@@ -475,6 +477,11 @@ config DDR
           information. This data is useful for drivers handling
           DDR SDRAM controllers.
 
+config IRQ_POLL
+        bool "IRQ polling library"
+        help
+          Helper library to poll interrupt mitigation using polling.
+
 config MPILIB
         tristate
         select CLZ_TAB
@@ -512,9 +519,9 @@ source "lib/fonts/Kconfig"
 config SG_SPLIT
         def_bool n
         help
-         Provides a heler to split scatterlists into chunks, each chunk being a
-         scatterlist. This should be selected by a driver or an API which
-         whishes to split a scatterlist amongst multiple DMA channel.
+         Provides a helper to split scatterlists into chunks, each chunk being
+         a scatterlist. This should be selected by a driver or an API which
+         whishes to split a scatterlist amongst multiple DMA channels.
 
 #
 # sg chaining option
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 8c15b29d5adc..ecb9e75614bf 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -580,6 +580,14 @@ config DEBUG_VM_RB
 
           If unsure, say N.
 
+config DEBUG_VM_PGFLAGS
+        bool "Debug page-flags operations"
+        depends on DEBUG_VM
+        help
+          Enables extra validation on page flags operations.
+
+          If unsure, say N.
+
 config DEBUG_VIRTUAL
         bool "Debug VM translations"
         depends on DEBUG_KERNEL && X86
@@ -812,6 +820,17 @@ config BOOTPARAM_HUNG_TASK_PANIC_VALUE
         default 0 if !BOOTPARAM_HUNG_TASK_PANIC
         default 1 if BOOTPARAM_HUNG_TASK_PANIC
 
+config WQ_WATCHDOG
+        bool "Detect Workqueue Stalls"
+        depends on DEBUG_KERNEL
+        help
+          Say Y here to enable stall detection on workqueues.  If a
+          worker pool doesn't make forward progress on a pending work
+          item for over a given amount of time, 30s by default, a
+          warning message is printed along with dump of workqueue
+          state.  This can be configured through kernel parameter
+          "workqueue.watchdog_thresh" and its sysfs counterpart.
+
 endmenu # "Debug lockups and hangs"
 
 config PANIC_ON_OOPS
@@ -1484,6 +1503,29 @@ config OF_RECONFIG_NOTIFIER_ERROR_INJECT
 
           If unsure, say N.
 
+config NETDEV_NOTIFIER_ERROR_INJECT
+        tristate "Netdev notifier error injection module"
+        depends on NET && NOTIFIER_ERROR_INJECTION
+        help
+          This option provides the ability to inject artificial errors to
+          netdevice notifier chain callbacks.  It is controlled through debugfs
+          interface /sys/kernel/debug/notifier-error-inject/netdev
+
+          If the notifier call chain should be failed with some events
+          notified, write the error code to "actions/<notifier event>/error".
+
+          Example: Inject netdevice mtu change error (-22 = -EINVAL)
+
+          # cd /sys/kernel/debug/notifier-error-inject/netdev
+          # echo -22 > actions/NETDEV_CHANGEMTU/error
+          # ip link set eth0 mtu 1024
+          RTNETLINK answers: Invalid argument
+
+          To compile this code as a module, choose M here: the module will
+          be called netdev-notifier-error-inject.
+
+          If unsure, say N.
+
 config FAULT_INJECTION
         bool "Fault-injection framework"
         depends on DEBUG_KERNEL
@@ -1523,8 +1565,7 @@ config FAIL_IO_TIMEOUT
 
 config FAIL_MMC_REQUEST
         bool "Fault-injection capability for MMC IO"
-        select DEBUG_FS
-        depends on FAULT_INJECTION && MMC
+        depends on FAULT_INJECTION_DEBUG_FS && MMC
         help
           Provide fault-injection capability for MMC IO.
           This will make the mmc core return data errors. This is
@@ -1556,7 +1597,6 @@ config FAULT_INJECTION_STACKTRACE_FILTER
 
 config LATENCYTOP
         bool "Latency measuring infrastructure"
-        depends on HAVE_LATENCYTOP_SUPPORT
         depends on DEBUG_KERNEL
         depends on STACKTRACE_SUPPORT
         depends on PROC_FS
@@ -1853,3 +1893,43 @@ source "samples/Kconfig"
 
 source "lib/Kconfig.kgdb"
 
+source "lib/Kconfig.ubsan"
+
+config ARCH_HAS_DEVMEM_IS_ALLOWED
+        bool
+
+config STRICT_DEVMEM
+        bool "Filter access to /dev/mem"
+        depends on MMU
+        depends on ARCH_HAS_DEVMEM_IS_ALLOWED
+        default y if TILE || PPC
+        ---help---
+          If this option is disabled, you allow userspace (root) access to all
+          of memory, including kernel and userspace memory. Accidental
+          access to this is obviously disastrous, but specific access can
+          be used by people debugging the kernel. Note that with PAT support
+          enabled, even in this case there are restrictions on /dev/mem
+          use due to the cache aliasing requirements.
+
+          If this option is switched on, and IO_STRICT_DEVMEM=n, the /dev/mem
+          file only allows userspace access to PCI space and the BIOS code and
+          data regions.  This is sufficient for dosemu and X and all common
+          users of /dev/mem.
+
+          If in doubt, say Y.
+
+config IO_STRICT_DEVMEM
+        bool "Filter I/O access to /dev/mem"
+        depends on STRICT_DEVMEM
+        ---help---
+          If this option is disabled, you allow userspace (root) access to all
+          io-memory regardless of whether a driver is actively using that
+          range.  Accidental access to this is obviously disastrous, but
+          specific access can be used by people debugging kernel drivers.
+
+          If this option is switched on, the /dev/mem file only allows
+          userspace access to *idle* io-memory ranges (see /proc/iomem) This
+          may break traditional users of /dev/mem (dosemu, legacy X, etc...)
+          if the driver using a given range cannot be disabled.
+
+          If in doubt, say Y.
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
new file mode 100644
index 000000000000..49518fb48cab
--- /dev/null
+++ b/lib/Kconfig.ubsan
@@ -0,0 +1,29 @@
+config ARCH_HAS_UBSAN_SANITIZE_ALL
+        bool
+
+config UBSAN
+        bool "Undefined behaviour sanity checker"
+        help
+          This option enables undefined behaviour sanity checker
+          Compile-time instrumentation is used to detect various undefined
+          behaviours in runtime. Various types of checks may be enabled
+          via boot parameter ubsan_handle (see: Documentation/ubsan.txt).
+
+config UBSAN_SANITIZE_ALL
+        bool "Enable instrumentation for the entire kernel"
+        depends on UBSAN
+        depends on ARCH_HAS_UBSAN_SANITIZE_ALL
+        default y
+        help
+          This option activates instrumentation for the entire kernel.
+          If you don't enable this option, you have to explicitly specify
+          UBSAN_SANITIZE := y for the files/directories you want to check for UB.
+
+config UBSAN_ALIGNMENT
+        bool "Enable checking of pointers alignment"
+        depends on UBSAN
+        default y if !HAVE_EFFICIENT_UNALIGNED_ACCESS
+        help
+          This option enables detection of unaligned memory accesses.
+          Enabling this option on architectures that support unalligned
+          accesses may produce a lot of false positives.
diff --git a/lib/Makefile b/lib/Makefile
index 7f1de26613d2..a7c26a41a738 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -31,7 +31,7 @@ obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
 obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += hexdump.o
-obj-$(CONFIG_TEST_HEXDUMP) += test-hexdump.o
+obj-$(CONFIG_TEST_HEXDUMP) += test_hexdump.o
 obj-y += kstrtox.o
 obj-$(CONFIG_TEST_BPF) += test_bpf.o
 obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
@@ -120,6 +120,7 @@ obj-$(CONFIG_FAULT_INJECTION) += fault-inject.o
 obj-$(CONFIG_NOTIFIER_ERROR_INJECTION) += notifier-error-inject.o
 obj-$(CONFIG_CPU_NOTIFIER_ERROR_INJECT) += cpu-notifier-error-inject.o
 obj-$(CONFIG_PM_NOTIFIER_ERROR_INJECT) += pm-notifier-error-inject.o
+obj-$(CONFIG_NETDEV_NOTIFIER_ERROR_INJECT) += netdev-notifier-error-inject.o
 obj-$(CONFIG_MEMORY_NOTIFIER_ERROR_INJECT) += memory-notifier-error-inject.o
 obj-$(CONFIG_OF_RECONFIG_NOTIFIER_ERROR_INJECT) += \
         of-reconfig-notifier-error-inject.o
@@ -153,7 +154,7 @@ obj-$(CONFIG_GLOB) += glob.o
 obj-$(CONFIG_MPILIB) += mpi/
 obj-$(CONFIG_SIGNATURE) += digsig.o
 
-obj-$(CONFIG_CLZ_TAB) += clz_tab.o
+lib-$(CONFIG_CLZ_TAB) += clz_tab.o
 
 obj-$(CONFIG_DDR) += jedec_ddr_data.o
 
@@ -164,6 +165,7 @@ obj-$(CONFIG_GENERIC_NET_UTILS) += net_utils.o
 
 obj-$(CONFIG_SG_SPLIT) += sg_split.o
 obj-$(CONFIG_STMP_DEVICE) += stmp_device.o
+obj-$(CONFIG_IRQ_POLL) += irq_poll.o
 
 libfdt_files = fdt.o fdt_ro.o fdt_wip.o fdt_rw.o fdt_sw.o fdt_strerror.o \
                fdt_empty_tree.o
@@ -208,3 +210,6 @@ quiet_cmd_build_OID_registry = GEN     $@
 clean-files     += oid_registry_data.c
 
 obj-$(CONFIG_UCS2_STRING) += ucs2_string.o
+obj-$(CONFIG_UBSAN) += ubsan.o
+
+UBSAN_SANITIZE_ubsan.o := n
diff --git a/lib/atomic64_test.c b/lib/atomic64_test.c
index 83c33a5bcffb..d62de8bf022d 100644
--- a/lib/atomic64_test.c
+++ b/lib/atomic64_test.c
@@ -16,6 +16,10 @@
 #include <linux/kernel.h>
 #include <linux/atomic.h>
 
+#ifdef CONFIG_X86
+#include <asm/processor.h>      /* for boot_cpu_has below */
+#endif
+
 #define TEST(bit, op, c_op, val)                                \
 do {                                                            \
         atomic##bit##_set(&v, v0);                              \
@@ -27,6 +31,65 @@ do {								\
                 (unsigned long long)r);                         \
 } while (0)
 
+/*
+ * Test for a atomic operation family,
+ * @test should be a macro accepting parameters (bit, op, ...)
+ */
+
+#define FAMILY_TEST(test, bit, op, args...)     \
+do {                                            \
+        test(bit, op, ##args);          \
+        test(bit, op##_acquire, ##args);        \
+        test(bit, op##_release, ##args);        \
+        test(bit, op##_relaxed, ##args);        \
+} while (0)
+
+#define TEST_RETURN(bit, op, c_op, val)                         \
+do {                                                            \
+        atomic##bit##_set(&v, v0);                              \
+        r = v0;                                                 \
+        r c_op val;                                             \
+        BUG_ON(atomic##bit##_##op(val, &v) != r);               \
+        BUG_ON(atomic##bit##_read(&v) != r);                    \
+} while (0)
+
+#define RETURN_FAMILY_TEST(bit, op, c_op, val)                  \
+do {                                                            \
+        FAMILY_TEST(TEST_RETURN, bit, op, c_op, val);           \
+} while (0)
+
+#define TEST_ARGS(bit, op, init, ret, expect, args...)          \
+do {                                                            \
+        atomic##bit##_set(&v, init);                            \
+        BUG_ON(atomic##bit##_##op(&v, ##args) != ret);          \
+        BUG_ON(atomic##bit##_read(&v) != expect);               \
+} while (0)
+
+#define XCHG_FAMILY_TEST(bit, init, new)                                \
+do {                                                                    \
+        FAMILY_TEST(TEST_ARGS, bit, xchg, init, init, new, new);        \
+} while (0)
+
+#define CMPXCHG_FAMILY_TEST(bit, init, new, wrong)                      \
+do {                                                                    \
+        FAMILY_TEST(TEST_ARGS, bit, cmpxchg,                            \
+                        init, init, new, init, new);                    \
+        FAMILY_TEST(TEST_ARGS, bit, cmpxchg,                            \
+                        init, init, init, wrong, new);                  \
+} while (0)
+
+#define INC_RETURN_FAMILY_TEST(bit, i)                  \
+do {                                                    \
+        FAMILY_TEST(TEST_ARGS, bit, inc_return,         \
+                        i, (i) + one, (i) + one);       \
+} while (0)
+
+#define DEC_RETURN_FAMILY_TEST(bit, i)                  \
+do {                                                    \
+        FAMILY_TEST(TEST_ARGS, bit, dec_return,         \
+                        i, (i) - one, (i) - one);       \
+} while (0)
+
 static __init void test_atomic(void)
 {
         int v0 = 0xaaa31337;
@@ -45,6 +108,18 @@ static __init void test_atomic(void)
         TEST(, and, &=, v1);
         TEST(, xor, ^=, v1);
         TEST(, andnot, &= ~, v1);
+
+        RETURN_FAMILY_TEST(, add_return, +=, onestwos);
+        RETURN_FAMILY_TEST(, add_return, +=, -one);
+        RETURN_FAMILY_TEST(, sub_return, -=, onestwos);
+        RETURN_FAMILY_TEST(, sub_return, -=, -one);
+
+        INC_RETURN_FAMILY_TEST(, v0);
+        DEC_RETURN_FAMILY_TEST(, v0);
+
+        XCHG_FAMILY_TEST(, v0, v1);
+        CMPXCHG_FAMILY_TEST(, v0, v1, onestwos);
+
 }
 
 #define INIT(c) do { atomic64_set(&v, c); r = c; } while (0)
@@ -74,25 +149,10 @@ static __init void test_atomic64(void)
         TEST(64, xor, ^=, v1);
         TEST(64, andnot, &= ~, v1);
 
-        INIT(v0);
-        r += onestwos;
-        BUG_ON(atomic64_add_return(onestwos, &v) != r);
-        BUG_ON(v.counter != r);
-
-        INIT(v0);
-        r += -one;
-        BUG_ON(atomic64_add_return(-one, &v) != r);
-        BUG_ON(v.counter != r);
-
-        INIT(v0);
-        r -= onestwos;
-        BUG_ON(atomic64_sub_return(onestwos, &v) != r);
-        BUG_ON(v.counter != r);
-
-        INIT(v0);
-        r -= -one;
-        BUG_ON(atomic64_sub_return(-one, &v) != r);
-        BUG_ON(v.counter != r);
+        RETURN_FAMILY_TEST(64, add_return, +=, onestwos);
+        RETURN_FAMILY_TEST(64, add_return, +=, -one);
+        RETURN_FAMILY_TEST(64, sub_return, -=, onestwos);
+        RETURN_FAMILY_TEST(64, sub_return, -=, -one);
 
         INIT(v0);
         atomic64_inc(&v);
@@ -100,33 +160,15 @@ static __init void test_atomic64(void)
         BUG_ON(v.counter != r);
 
         INIT(v0);
-        r += one;
-        BUG_ON(atomic64_inc_return(&v) != r);
-        BUG_ON(v.counter != r);
-
-        INIT(v0);
         atomic64_dec(&v);
         r -= one;
         BUG_ON(v.counter != r);
 
-        INIT(v0);
-        r -= one;
-        BUG_ON(atomic64_dec_return(&v) != r);
-        BUG_ON(v.counter != r);
+        INC_RETURN_FAMILY_TEST(64, v0);
+        DEC_RETURN_FAMILY_TEST(64, v0);
 
-        INIT(v0);
-        BUG_ON(atomic64_xchg(&v, v1) != v0);
-        r = v1;
-        BUG_ON(v.counter != r);
-
-        INIT(v0);
-        BUG_ON(atomic64_cmpxchg(&v, v0, v1) != v0);
-        r = v1;
-        BUG_ON(v.counter != r);
-
-        INIT(v0);
-        BUG_ON(atomic64_cmpxchg(&v, v2, v1) != v0);
-        BUG_ON(v.counter != r);
+        XCHG_FAMILY_TEST(64, v0, v1);
+        CMPXCHG_FAMILY_TEST(64, v0, v1, v2);
 
         INIT(v0);
         BUG_ON(atomic64_add_unless(&v, one, v0));
diff --git a/lib/btree.c b/lib/btree.c
index 4264871ea1a0..f93a945274af 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -5,7 +5,7 @@
  *
  * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
  * Bits and pieces stolen from Peter Zijlstra's code, which is
- * Copyright 2007, Red Hat Inc. Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright 2007, Red Hat Inc. Peter Zijlstra
  * GPLv2
  *
  * see http://programming.kicks-ass.net/kernel-patches/vma_lookup/btree.patch
diff --git a/lib/div64.c b/lib/div64.c
index 62a698a432bc..7f345259c32f 100644
--- a/lib/div64.c
+++ b/lib/div64.c
@@ -13,7 +13,8 @@
  *
  * Code generated for this function might be very inefficient
  * for some CPUs. __div64_32() can be overridden by linking arch-specific
- * assembly versions such as arch/ppc/lib/div64.S and arch/sh/lib/div64.S.
+ * assembly versions such as arch/ppc/lib/div64.S and arch/sh/lib/div64.S
+ * or by defining a preprocessor macro in arch/include/asm/div64.h.
  */
 
 #include <linux/export.h>
@@ -23,6 +24,7 @@
 /* Not needed on 64bit architectures */
 #if BITS_PER_LONG == 32
 
+#ifndef __div64_32
 uint32_t __attribute__((weak)) __div64_32(uint64_t *n, uint32_t base)
 {
         uint64_t rem = *n;
@@ -55,8 +57,8 @@ uint32_t __attribute__((weak)) __div64_32(uint64_t *n, uint32_t base)
         *n = res;
         return rem;
 }
-
 EXPORT_SYMBOL(__div64_32);
+#endif
 
 #ifndef div_s64_rem
 s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder)
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 8855f019ebe8..4a1515f4b452 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1181,7 +1181,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end
 
 static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
 {
-        if (overlap(addr, len, _text, _etext) ||
+        if (overlap(addr, len, _stext, _etext) ||
             overlap(addr, len, __start_rodata, __end_rodata))
                 err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
 }
@@ -1464,7 +1464,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
         entry->type      = dma_debug_coherent;
         entry->dev       = dev;
         entry->pfn       = page_to_pfn(virt_to_page(virt));
-        entry->offset    = (size_t) virt & PAGE_MASK;
+        entry->offset    = (size_t) virt & ~PAGE_MASK;
         entry->size      = size;
         entry->dev_addr  = dma_addr;
         entry->direction = DMA_BIDIRECTIONAL;
@@ -1480,7 +1480,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
                 .type           = dma_debug_coherent,
                 .dev            = dev,
                 .pfn            = page_to_pfn(virt_to_page(virt)),
-                .offset         = (size_t) virt & PAGE_MASK,
+                .offset         = (size_t) virt & ~PAGE_MASK,
                 .dev_addr       = addr,
                 .size           = size,
                 .direction      = DMA_BIDIRECTIONAL,
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index e3952e9c8ec0..fe42b6ec3f0c 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -657,14 +657,9 @@ static ssize_t ddebug_proc_write(struct file *file, const char __user *ubuf,
                 pr_warn("expected <%d bytes into control\n", USER_BUF_PAGE);
                 return -E2BIG;
         }
-        tmpbuf = kmalloc(len + 1, GFP_KERNEL);
-        if (!tmpbuf)
-                return -ENOMEM;
-        if (copy_from_user(tmpbuf, ubuf, len)) {
-                kfree(tmpbuf);
-                return -EFAULT;
-        }
-        tmpbuf[len] = '\0';
+        tmpbuf = memdup_user_nul(ubuf, len);
+        if (IS_ERR(tmpbuf))
+                return PTR_ERR(tmpbuf);
         vpr_info("read %d bytes from userspace\n", (int)len);
 
         ret = ddebug_exec_queries(tmpbuf, NULL);
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 116a166b096f..0a1139644d32 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -270,6 +270,25 @@ EXPORT_SYMBOL(gen_pool_destroy);
  */
 unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
 {
+        return gen_pool_alloc_algo(pool, size, pool->algo, pool->data);
+}
+EXPORT_SYMBOL(gen_pool_alloc);
+
+/**
+ * gen_pool_alloc_algo - allocate special memory from the pool
+ * @pool: pool to allocate from
+ * @size: number of bytes to allocate from the pool
+ * @algo: algorithm passed from caller
+ * @data: data passed to algorithm
+ *
+ * Allocate the requested number of bytes from the specified pool.
+ * Uses the pool allocation function (with first-fit algorithm by default).
+ * Can not be used in NMI handler on architectures without
+ * NMI-safe cmpxchg implementation.
+ */
+unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+                genpool_algo_t algo, void *data)
+{
         struct gen_pool_chunk *chunk;
         unsigned long addr = 0;
         int order = pool->min_alloc_order;
@@ -290,8 +309,8 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
 
                 end_bit = chunk_size(chunk) >> order;
 retry:
-                start_bit = pool->algo(chunk->bits, end_bit, start_bit, nbits,
-                                pool->data);
+                start_bit = algo(chunk->bits, end_bit, start_bit,
+                                 nbits, data, pool);
                 if (start_bit >= end_bit)
                         continue;
                 remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
@@ -310,7 +329,7 @@ retry:
         rcu_read_unlock();
         return addr;
 }
-EXPORT_SYMBOL(gen_pool_alloc);
+EXPORT_SYMBOL(gen_pool_alloc_algo);
 
 /**
  * gen_pool_dma_alloc - allocate special memory from the pool for DMA usage
@@ -501,15 +520,74 @@ EXPORT_SYMBOL(gen_pool_set_algo);
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @data: additional data - unused
+ * @pool: pool to find the fit region memory from
  */
 unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
-                unsigned long start, unsigned int nr, void *data)
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
 {
         return bitmap_find_next_zero_area(map, size, start, nr, 0);
 }
 EXPORT_SYMBOL(gen_pool_first_fit);
 
 /**
+ * gen_pool_first_fit_align - find the first available region
+ * of memory matching the size requirement (alignment constraint)
+ * @map: The address to base the search on
+ * @size: The bitmap size in bits
+ * @start: The bitnumber to start searching at
+ * @nr: The number of zeroed bits we're looking for
+ * @data: data for alignment
+ * @pool: pool to get order from
+ */
+unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
+{
+        struct genpool_data_align *alignment;
+        unsigned long align_mask;
+        int order;
+
+        alignment = data;
+        order = pool->min_alloc_order;
+        align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+        return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
+}
+EXPORT_SYMBOL(gen_pool_first_fit_align);
+
+/**
+ * gen_pool_fixed_alloc - reserve a specific region
+ * @map: The address to base the search on
+ * @size: The bitmap size in bits
+ * @start: The bitnumber to start searching at
+ * @nr: The number of zeroed bits we're looking for
+ * @data: data for alignment
+ * @pool: pool to get order from
+ */
+unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
+{
+        struct genpool_data_fixed *fixed_data;
+        int order;
+        unsigned long offset_bit;
+        unsigned long start_bit;
+
+        fixed_data = data;
+        order = pool->min_alloc_order;
+        offset_bit = fixed_data->offset >> order;
+        if (WARN_ON(fixed_data->offset & ((1UL << order) - 1)))
+                return size;
+
+        start_bit = bitmap_find_next_zero_area(map, size,
+                        start + offset_bit, nr, 0);
+        if (start_bit != offset_bit)
+                start_bit = size;
+        return start_bit;
+}
+EXPORT_SYMBOL(gen_pool_fixed_alloc);
+
+/**
  * gen_pool_first_fit_order_align - find the first available region
  * of memory matching the size requirement. The region will be aligned
  * to the order of the size specified.
@@ -518,10 +596,11 @@ EXPORT_SYMBOL(gen_pool_first_fit);
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @data: additional data - unused
+ * @pool: pool to find the fit region memory from
  */
 unsigned long gen_pool_first_fit_order_align(unsigned long *map,
                 unsigned long size, unsigned long start,
-                unsigned int nr, void *data)
+                unsigned int nr, void *data, struct gen_pool *pool)
 {
         unsigned long align_mask = roundup_pow_of_two(nr) - 1;
 
@@ -537,12 +616,14 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @data: additional data - unused
+ * @pool: pool to find the fit region memory from
  *
  * Iterate over the bitmap to find the smallest free region
  * which we can allocate the memory.
  */
 unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
-                unsigned long start, unsigned int nr, void *data)
+                unsigned long start, unsigned int nr, void *data,
+                struct gen_pool *pool)
 {
         unsigned long start_bit = size;
         unsigned long len = size + 1;
diff --git a/lib/iomap_copy.c b/lib/iomap_copy.c
index 4527e751b5e0..b8f1d6cbb200 100644
--- a/lib/iomap_copy.c
+++ b/lib/iomap_copy.c
@@ -42,6 +42,27 @@ void __attribute__((weak)) __iowrite32_copy(void __iomem *to,
 EXPORT_SYMBOL_GPL(__iowrite32_copy);
 
 /**
+ * __ioread32_copy - copy data from MMIO space, in 32-bit units
+ * @to: destination (must be 32-bit aligned)
+ * @from: source, in MMIO space (must be 32-bit aligned)
+ * @count: number of 32-bit quantities to copy
+ *
+ * Copy data from MMIO space to kernel space, in units of 32 bits at a
+ * time.  Order of access is not guaranteed, nor is a memory barrier
+ * performed afterwards.
+ */
+void __ioread32_copy(void *to, const void __iomem *from, size_t count)
+{
+        u32 *dst = to;
+        const u32 __iomem *src = from;
+        const u32 __iomem *end = src + count;
+
+        while (src < end)
+                *dst++ = __raw_readl(src++);
+}
+EXPORT_SYMBOL_GPL(__ioread32_copy);
+
+/**
  * __iowrite64_copy - copy data to MMIO space, in 64-bit or 32-bit units
  * @to: destination, in MMIO space (must be 64-bit aligned)
  * @from: source (must be 64-bit aligned)
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 75232ad0a5e7..5fecddc32b1b 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -369,7 +369,7 @@ static void memcpy_from_page(char *to, struct page *page, size_t offset, size_t
         kunmap_atomic(from);
 }
 
-static void memcpy_to_page(struct page *page, size_t offset, char *from, size_t len)
+static void memcpy_to_page(struct page *page, size_t offset, const char *from, size_t len)
 {
         char *to = kmap_atomic(page);
         memcpy(to + offset, from, len);
@@ -383,9 +383,9 @@ static void memzero_page(struct page *page, size_t offset, size_t len)
         kunmap_atomic(addr);
 }
 
-size_t copy_to_iter(void *addr, size_t bytes, struct iov_iter *i)
+size_t copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
 {
-        char *from = addr;
+        const char *from = addr;
         if (unlikely(bytes > i->count))
                 bytes = i->count;
 
@@ -704,10 +704,10 @@ size_t csum_and_copy_from_iter(void *addr, size_t bytes, __wsum *csum,
 }
 EXPORT_SYMBOL(csum_and_copy_from_iter);
 
-size_t csum_and_copy_to_iter(void *addr, size_t bytes, __wsum *csum,
+size_t csum_and_copy_to_iter(const void *addr, size_t bytes, __wsum *csum,
                              struct iov_iter *i)
 {
-        char *from = addr;
+        const char *from = addr;
         __wsum sum, next;
         size_t off = 0;
         if (unlikely(bytes > i->count))
@@ -849,3 +849,4 @@ int import_single_range(int rw, void __user *buf, size_t len,
         iov_iter_init(i, rw, iov, 1, len);
         return 0;
 }
+EXPORT_SYMBOL(import_single_range);
diff --git a/lib/irq_poll.c b/lib/irq_poll.c
new file mode 100644
index 000000000000..836f7db4e548
--- /dev/null
+++ b/lib/irq_poll.c
@@ -0,0 +1,222 @@
+/*
+ * Functions related to interrupt-poll handling in the block layer. This
+ * is similar to NAPI for network devices.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/bio.h>
+#include <linux/interrupt.h>
+#include <linux/cpu.h>
+#include <linux/irq_poll.h>
+#include <linux/delay.h>
+
+static unsigned int irq_poll_budget __read_mostly = 256;
+
+static DEFINE_PER_CPU(struct list_head, blk_cpu_iopoll);
+
+/**
+ * irq_poll_sched - Schedule a run of the iopoll handler
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     Add this irq_poll structure to the pending poll list and trigger the
+ *     raise of the blk iopoll softirq.
+ **/
+void irq_poll_sched(struct irq_poll *iop)
+{
+        unsigned long flags;
+
+        if (test_bit(IRQ_POLL_F_DISABLE, &iop->state))
+                return;
+        if (test_and_set_bit(IRQ_POLL_F_SCHED, &iop->state))
+                return;
+
+        local_irq_save(flags);
+        list_add_tail(&iop->list, this_cpu_ptr(&blk_cpu_iopoll));
+        __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(irq_poll_sched);
+
+/**
+ * __irq_poll_complete - Mark this @iop as un-polled again
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     See irq_poll_complete(). This function must be called with interrupts
+ *     disabled.
+ **/
+static void __irq_poll_complete(struct irq_poll *iop)
+{
+        list_del(&iop->list);
+        smp_mb__before_atomic();
+        clear_bit_unlock(IRQ_POLL_F_SCHED, &iop->state);
+}
+
+/**
+ * irq_poll_complete - Mark this @iop as un-polled again
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     If a driver consumes less than the assigned budget in its run of the
+ *     iopoll handler, it'll end the polled mode by calling this function. The
+ *     iopoll handler will not be invoked again before irq_poll_sched()
+ *     is called.
+ **/
+void irq_poll_complete(struct irq_poll *iop)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __irq_poll_complete(iop);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(irq_poll_complete);
+
+static void irq_poll_softirq(struct softirq_action *h)
+{
+        struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
+        int rearm = 0, budget = irq_poll_budget;
+        unsigned long start_time = jiffies;
+
+        local_irq_disable();
+
+        while (!list_empty(list)) {
+                struct irq_poll *iop;
+                int work, weight;
+
+                /*
+                 * If softirq window is exhausted then punt.
+                 */
+                if (budget <= 0 || time_after(jiffies, start_time)) {
+                        rearm = 1;
+                        break;
+                }
+
+                local_irq_enable();
+
+                /* Even though interrupts have been re-enabled, this
+                 * access is safe because interrupts can only add new
+                 * entries to the tail of this list, and only ->poll()
+                 * calls can remove this head entry from the list.
+                 */
+                iop = list_entry(list->next, struct irq_poll, list);
+
+                weight = iop->weight;
+                work = 0;
+                if (test_bit(IRQ_POLL_F_SCHED, &iop->state))
+                        work = iop->poll(iop, weight);
+
+                budget -= work;
+
+                local_irq_disable();
+
+                /*
+                 * Drivers must not modify the iopoll state, if they
+                 * consume their assigned weight (or more, some drivers can't
+                 * easily just stop processing, they have to complete an
+                 * entire mask of commands).In such cases this code
+                 * still "owns" the iopoll instance and therefore can
+                 * move the instance around on the list at-will.
+                 */
+                if (work >= weight) {
+                        if (test_bit(IRQ_POLL_F_DISABLE, &iop->state))
+                                __irq_poll_complete(iop);
+                        else
+                                list_move_tail(&iop->list, list);
+                }
+        }
+
+        if (rearm)
+                __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+
+        local_irq_enable();
+}
+
+/**
+ * irq_poll_disable - Disable iopoll on this @iop
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     Disable io polling and wait for any pending callbacks to have completed.
+ **/
+void irq_poll_disable(struct irq_poll *iop)
+{
+        set_bit(IRQ_POLL_F_DISABLE, &iop->state);
+        while (test_and_set_bit(IRQ_POLL_F_SCHED, &iop->state))
+                msleep(1);
+        clear_bit(IRQ_POLL_F_DISABLE, &iop->state);
+}
+EXPORT_SYMBOL(irq_poll_disable);
+
+/**
+ * irq_poll_enable - Enable iopoll on this @iop
+ * @iop:      The parent iopoll structure
+ *
+ * Description:
+ *     Enable iopoll on this @iop. Note that the handler run will not be
+ *     scheduled, it will only mark it as active.
+ **/
+void irq_poll_enable(struct irq_poll *iop)
+{
+        BUG_ON(!test_bit(IRQ_POLL_F_SCHED, &iop->state));
+        smp_mb__before_atomic();
+        clear_bit_unlock(IRQ_POLL_F_SCHED, &iop->state);
+}
+EXPORT_SYMBOL(irq_poll_enable);
+
+/**
+ * irq_poll_init - Initialize this @iop
+ * @iop:      The parent iopoll structure
+ * @weight:   The default weight (or command completion budget)
+ * @poll_fn:  The handler to invoke
+ *
+ * Description:
+ *     Initialize and enable this irq_poll structure.
+ **/
+void irq_poll_init(struct irq_poll *iop, int weight, irq_poll_fn *poll_fn)
+{
+        memset(iop, 0, sizeof(*iop));
+        INIT_LIST_HEAD(&iop->list);
+        iop->weight = weight;
+        iop->poll = poll_fn;
+}
+EXPORT_SYMBOL(irq_poll_init);
+
+static int irq_poll_cpu_notify(struct notifier_block *self,
+                                 unsigned long action, void *hcpu)
+{
+        /*
+         * If a CPU goes away, splice its entries to the current CPU
+         * and trigger a run of the softirq
+         */
+        if (action == CPU_DEAD || action == CPU_DEAD_FROZEN) {
+                int cpu = (unsigned long) hcpu;
+
+                local_irq_disable();
+                list_splice_init(&per_cpu(blk_cpu_iopoll, cpu),
+                                 this_cpu_ptr(&blk_cpu_iopoll));
+                __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+                local_irq_enable();
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block irq_poll_cpu_notifier = {
+        .notifier_call  = irq_poll_cpu_notify,
+};
+
+static __init int irq_poll_setup(void)
+{
+        int i;
+
+        for_each_possible_cpu(i)
+                INIT_LIST_HEAD(&per_cpu(blk_cpu_iopoll, i));
+
+        open_softirq(IRQ_POLL_SOFTIRQ, irq_poll_softirq);
+        register_hotcpu_notifier(&irq_poll_cpu_notifier);
+        return 0;
+}
+subsys_initcall(irq_poll_setup);
diff --git a/lib/kasprintf.c b/lib/kasprintf.c
index f194e6e593e1..7f6c506a4942 100644
--- a/lib/kasprintf.c
+++ b/lib/kasprintf.c
@@ -13,19 +13,21 @@
 /* Simplified asprintf. */
 char *kvasprintf(gfp_t gfp, const char *fmt, va_list ap)
 {
-        unsigned int len;
+        unsigned int first, second;
         char *p;
         va_list aq;
 
         va_copy(aq, ap);
-        len = vsnprintf(NULL, 0, fmt, aq);
+        first = vsnprintf(NULL, 0, fmt, aq);
         va_end(aq);
 
-        p = kmalloc_track_caller(len+1, gfp);
+        p = kmalloc_track_caller(first+1, gfp);
         if (!p)
                 return NULL;
 
-        vsnprintf(p, len+1, fmt, ap);
+        second = vsnprintf(p, first+1, fmt, ap);
+        WARN(first != second, "different return values (%u and %u) from vsnprintf(\"%s\", ...)",
+             first, second, fmt);
 
         return p;
 }
diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
index 6a08ce7d6adc..74a54b7f2562 100644
--- a/lib/libcrc32c.c
+++ b/lib/libcrc32c.c
@@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/crc32c.h>
 
 static struct crypto_shash *tfm;
 
@@ -74,3 +75,4 @@ module_exit(libcrc32c_mod_fini);
 MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
 MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations");
 MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: crc32c");
diff --git a/lib/list_debug.c b/lib/list_debug.c
index c24c2f7e296f..3345a089ef7b 100644
--- a/lib/list_debug.c
+++ b/lib/list_debug.c
@@ -12,6 +12,13 @@
 #include <linux/kernel.h>
 #include <linux/rculist.h>
 
+static struct list_head force_poison;
+void list_force_poison(struct list_head *entry)
+{
+        entry->next = &force_poison;
+        entry->prev = &force_poison;
+}
+
 /*
  * Insert a new entry between two known consecutive entries.
  *
@@ -23,6 +30,8 @@ void __list_add(struct list_head *new,
                               struct list_head *prev,
                               struct list_head *next)
 {
+        WARN(new->next == &force_poison || new->prev == &force_poison,
+                "list_add attempted on force-poisoned entry\n");
         WARN(next->prev != prev,
                 "list_add corruption. next->prev should be "
                 "prev (%p), but was %p. (next=%p).\n",
@@ -37,7 +46,7 @@ void __list_add(struct list_head *new,
         next->prev = new;
         new->next = next;
         new->prev = prev;
-        prev->next = new;
+        WRITE_ONCE(prev->next, new);
 }
 EXPORT_SYMBOL(__list_add);
 
diff --git a/lib/lru_cache.c b/lib/lru_cache.c
index 028f5d996eef..28ba40b99337 100644
--- a/lib/lru_cache.c
+++ b/lib/lru_cache.c
@@ -238,7 +238,7 @@ void lc_reset(struct lru_cache *lc)
  * @seq: the seq_file to print into
  * @lc: the lru cache to print statistics of
  */
-size_t lc_seq_printf_stats(struct seq_file *seq, struct lru_cache *lc)
+void lc_seq_printf_stats(struct seq_file *seq, struct lru_cache *lc)
 {
         /* NOTE:
          * total calls to lc_get are
@@ -250,8 +250,6 @@ size_t lc_seq_printf_stats(struct seq_file *seq, struct lru_cache *lc)
         seq_printf(seq, "\t%s: used:%u/%u hits:%lu misses:%lu starving:%lu locked:%lu changed:%lu\n",
                    lc->name, lc->used, lc->nr_elements,
                    lc->hits, lc->misses, lc->starving, lc->locked, lc->changed);
-
-        return 0;
 }
 
 static struct hlist_head *lc_hash_slot(struct lru_cache *lc, unsigned int enr)
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 3db76b8c1115..ec533a6c77b5 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -135,7 +135,9 @@ EXPORT_SYMBOL_GPL(mpi_read_from_buffer);
  * @buf:        bufer to which the output will be written to. Needs to be at
  *              leaset mpi_get_size(a) long.
  * @buf_len:    size of the buf.
- * @nbytes:     receives the actual length of the data written.
+ * @nbytes:     receives the actual length of the data written on success and
+ *              the data to-be-written on -EOVERFLOW in case buf_len was too
+ *              small.
  * @sign:       if not NULL, it will be set to the sign of a.
  *
  * Return:      0 on success or error code in case of error
@@ -148,7 +150,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
         unsigned int n = mpi_get_size(a);
         int i, lzeros = 0;
 
-        if (buf_len < n || !buf || !nbytes)
+        if (!buf || !nbytes)
                 return -EINVAL;
 
         if (sign)
@@ -163,6 +165,11 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
                         break;
         }
 
+        if (buf_len < n - lzeros) {
+                *nbytes = n - lzeros;
+                return -EOVERFLOW;
+        }
+
         p = buf;
         *nbytes = n - lzeros;
 
@@ -332,7 +339,8 @@ EXPORT_SYMBOL_GPL(mpi_set_buffer);
  * @nbytes:     in/out param - it has the be set to the maximum number of
  *              bytes that can be written to sgl. This has to be at least
  *              the size of the integer a. On return it receives the actual
- *              length of the data written.
+ *              length of the data written on success or the data that would
+ *              be written if buffer was too small.
  * @sign:       if not NULL, it will be set to the sign of a.
  *
  * Return:      0 on success or error code in case of error
@@ -345,7 +353,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
         unsigned int n = mpi_get_size(a);
         int i, x, y = 0, lzeros = 0, buf_len;
 
-        if (!nbytes || *nbytes < n)
+        if (!nbytes)
                 return -EINVAL;
 
         if (sign)
@@ -360,6 +368,11 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
                         break;
         }
 
+        if (*nbytes < n - lzeros) {
+                *nbytes = n - lzeros;
+                return -EOVERFLOW;
+        }
+
         *nbytes = n - lzeros;
         buf_len = sgl->length;
         p2 = sg_virt(sgl);
diff --git a/lib/netdev-notifier-error-inject.c b/lib/netdev-notifier-error-inject.c
new file mode 100644
index 000000000000..13e9c62e216f
--- /dev/null
+++ b/lib/netdev-notifier-error-inject.c
@@ -0,0 +1,55 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include "notifier-error-inject.h"
+
+static int priority;
+module_param(priority, int, 0);
+MODULE_PARM_DESC(priority, "specify netdevice notifier priority");
+
+static struct notifier_err_inject netdev_notifier_err_inject = {
+        .actions = {
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_REGISTER) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_CHANGEMTU) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_CHANGENAME) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_PRE_UP) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_PRE_TYPE_CHANGE) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_POST_INIT) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_PRECHANGEMTU) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_PRECHANGEUPPER) },
+                { NOTIFIER_ERR_INJECT_ACTION(NETDEV_CHANGEUPPER) },
+                {}
+        }
+};
+
+static struct dentry *dir;
+
+static int netdev_err_inject_init(void)
+{
+        int err;
+
+        dir = notifier_err_inject_init("netdev", notifier_err_inject_dir,
+                                       &netdev_notifier_err_inject, priority);
+        if (IS_ERR(dir))
+                return PTR_ERR(dir);
+
+        err = register_netdevice_notifier(&netdev_notifier_err_inject.nb);
+        if (err)
+                debugfs_remove_recursive(dir);
+
+        return err;
+}
+
+static void netdev_err_inject_exit(void)
+{
+        unregister_netdevice_notifier(&netdev_notifier_err_inject.nb);
+        debugfs_remove_recursive(dir);
+}
+
+module_init(netdev_err_inject_init);
+module_exit(netdev_err_inject_exit);
+
+MODULE_DESCRIPTION("Netdevice notifier error injection module");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nikolay Aleksandrov <razor@blackwall.org>");
diff --git a/lib/proportions.c b/lib/proportions.c
index 6f724298f67a..efa54f259ea9 100644
--- a/lib/proportions.c
+++ b/lib/proportions.c
@@ -1,7 +1,7 @@
 /*
  * Floating proportions
  *
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
  *
  * Description:
  *
diff --git a/lib/raid6/altivec.uc b/lib/raid6/altivec.uc
index bec27fce7501..682aae8a1fef 100644
--- a/lib/raid6/altivec.uc
+++ b/lib/raid6/altivec.uc
@@ -101,6 +101,7 @@ static void raid6_altivec$#_gen_syndrome(int disks, size_t bytes, void **ptrs)
 
         raid6_altivec$#_gen_syndrome_real(disks, bytes, ptrs);
 
+        disable_kernel_altivec();
         preempt_enable();
 }
 
diff --git a/lib/ratelimit.c b/lib/ratelimit.c
index 40e03ea2a967..2c5de86460c5 100644
--- a/lib/ratelimit.c
+++ b/lib/ratelimit.c
@@ -49,7 +49,7 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
                 if (rs->missed)
                         printk(KERN_WARNING "%s: %d callbacks suppressed\n",
                                 func, rs->missed);
-                rs->begin   = 0;
+                rs->begin   = jiffies;
                 rs->printed = 0;
                 rs->missed  = 0;
         }
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index a54ff8949f91..cc808707d1cf 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -231,9 +231,6 @@ static int rhashtable_rehash_attach(struct rhashtable *ht,
          */
         rcu_assign_pointer(old_tbl->future_tbl, new_tbl);
 
-        /* Ensure the new table is visible to readers. */
-        smp_wmb();
-
         spin_unlock_bh(old_tbl->locks);
 
         return 0;
@@ -389,33 +386,31 @@ static bool rhashtable_check_elasticity(struct rhashtable *ht,
         return false;
 }
 
-int rhashtable_insert_rehash(struct rhashtable *ht)
+int rhashtable_insert_rehash(struct rhashtable *ht,
+                             struct bucket_table *tbl)
 {
         struct bucket_table *old_tbl;
         struct bucket_table *new_tbl;
-        struct bucket_table *tbl;
         unsigned int size;
         int err;
 
         old_tbl = rht_dereference_rcu(ht->tbl, ht);
-        tbl = rhashtable_last_table(ht, old_tbl);
 
         size = tbl->size;
 
+        err = -EBUSY;
+
         if (rht_grow_above_75(ht, tbl))
                 size *= 2;
         /* Do not schedule more than one rehash */
         else if (old_tbl != tbl)
-                return -EBUSY;
+                goto fail;
+
+        err = -ENOMEM;
 
         new_tbl = bucket_table_alloc(ht, size, GFP_ATOMIC);
-        if (new_tbl == NULL) {
-                /* Schedule async resize/rehash to try allocation
-                 * non-atomic context.
-                 */
-                schedule_work(&ht->run_work);
-                return -ENOMEM;
-        }
+        if (new_tbl == NULL)
+                goto fail;
 
         err = rhashtable_rehash_attach(ht, tbl, new_tbl);
         if (err) {
@@ -426,12 +421,24 @@ int rhashtable_insert_rehash(struct rhashtable *ht)
                 schedule_work(&ht->run_work);
 
         return err;
+
+fail:
+        /* Do not fail the insert if someone else did a rehash. */
+        if (likely(rcu_dereference_raw(tbl->future_tbl)))
+                return 0;
+
+        /* Schedule async rehash to retry allocation in process context. */
+        if (err == -ENOMEM)
+                schedule_work(&ht->run_work);
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_rehash);
 
-int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
-                           struct rhash_head *obj,
-                           struct bucket_table *tbl)
+struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht,
+                                            const void *key,
+                                            struct rhash_head *obj,
+                                            struct bucket_table *tbl)
 {
         struct rhash_head *head;
         unsigned int hash;
@@ -467,7 +474,12 @@ int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
 exit:
         spin_unlock(rht_bucket_lock(tbl, hash));
 
-        return err;
+        if (err == 0)
+                return NULL;
+        else if (err == -EAGAIN)
+                return tbl;
+        else
+                return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_slow);
 
@@ -503,10 +515,11 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
         if (!iter->walker)
                 return -ENOMEM;
 
-        mutex_lock(&ht->mutex);
-        iter->walker->tbl = rht_dereference(ht->tbl, ht);
+        spin_lock(&ht->lock);
+        iter->walker->tbl =
+                rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
         list_add(&iter->walker->list, &iter->walker->tbl->walkers);
-        mutex_unlock(&ht->mutex);
+        spin_unlock(&ht->lock);
 
         return 0;
 }
@@ -520,10 +533,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
  */
 void rhashtable_walk_exit(struct rhashtable_iter *iter)
 {
-        mutex_lock(&iter->ht->mutex);
+        spin_lock(&iter->ht->lock);
         if (iter->walker->tbl)
                 list_del(&iter->walker->list);
-        mutex_unlock(&iter->ht->mutex);
+        spin_unlock(&iter->ht->lock);
         kfree(iter->walker);
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
@@ -547,14 +560,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
 {
         struct rhashtable *ht = iter->ht;
 
-        mutex_lock(&ht->mutex);
+        rcu_read_lock();
 
+        spin_lock(&ht->lock);
         if (iter->walker->tbl)
                 list_del(&iter->walker->list);
-
-        rcu_read_lock();
-
-        mutex_unlock(&ht->mutex);
+        spin_unlock(&ht->lock);
 
         if (!iter->walker->tbl) {
                 iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);
@@ -723,9 +734,6 @@ int rhashtable_init(struct rhashtable *ht,
         if (params->nulls_base && params->nulls_base < (1U << RHT_BASE_SHIFT))
                 return -EINVAL;
 
-        if (params->nelem_hint)
-                size = rounded_hashtable_size(params);
-
         memset(ht, 0, sizeof(*ht));
         mutex_init(&ht->mutex);
         spin_lock_init(&ht->lock);
@@ -745,6 +753,9 @@ int rhashtable_init(struct rhashtable *ht,
 
         ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE);
 
+        if (params->nelem_hint)
+                size = rounded_hashtable_size(&ht->p);
+
         /* The maximum (not average) chain length grows with the
          * size of the hash table, at a rate of (log N)/(log log N).
          * The value of 16 is selected so that even if the hash
diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 5c94e1012a91..cb18469e1f49 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -306,10 +306,12 @@ int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt)
         if (!cnt)
                 return 0;
 
-        if (s->len <= s->readpos)
+        len = seq_buf_used(s);
+
+        if (len <= s->readpos)
                 return -EBUSY;
 
-        len = seq_buf_used(s) - s->readpos;
+        len -= s->readpos;
         if (cnt > len)
                 cnt = len;
         ret = copy_to_user(ubuf, s->buffer + s->readpos, cnt);
diff --git a/lib/string_helpers.c b/lib/string_helpers.c
index 5939f63d90cd..5c88204b6f1f 100644
--- a/lib/string_helpers.c
+++ b/lib/string_helpers.c
@@ -43,50 +43,73 @@ void string_get_size(u64 size, u64 blk_size, const enum string_size_units units,
                 [STRING_UNITS_10] = 1000,
                 [STRING_UNITS_2] = 1024,
         };
-        int i, j;
-        u32 remainder = 0, sf_cap, exp;
+        static const unsigned int rounding[] = { 500, 50, 5 };
+        int i = 0, j;
+        u32 remainder = 0, sf_cap;
         char tmp[8];
         const char *unit;
 
         tmp[0] = '\0';
-        i = 0;
-        if (!size)
+
+        if (blk_size == 0)
+                size = 0;
+        if (size == 0)
                 goto out;
 
-        while (blk_size >= divisor[units]) {
-                remainder = do_div(blk_size, divisor[units]);
+        /* This is Napier's algorithm.  Reduce the original block size to
+         *
+         * coefficient * divisor[units]^i
+         *
+         * we do the reduction so both coefficients are just under 32 bits so
+         * that multiplying them together won't overflow 64 bits and we keep
+         * as much precision as possible in the numbers.
+         *
+         * Note: it's safe to throw away the remainders here because all the
+         * precision is in the coefficients.
+         */
+        while (blk_size >> 32) {
+                do_div(blk_size, divisor[units]);
                 i++;
         }
 
-        exp = divisor[units] / (u32)blk_size;
-        /*
-         * size must be strictly greater than exp here to ensure that remainder
-         * is greater than divisor[units] coming out of the if below.
-         */
-        if (size > exp) {
-                remainder = do_div(size, divisor[units]);
-                remainder *= blk_size;
+        while (size >> 32) {
+                do_div(size, divisor[units]);
                 i++;
-        } else {
-                remainder *= size;
         }
 
+        /* now perform the actual multiplication keeping i as the sum of the
+         * two logarithms */
         size *= blk_size;
-        size += remainder / divisor[units];
-        remainder %= divisor[units];
 
+        /* and logarithmically reduce it until it's just under the divisor */
         while (size >= divisor[units]) {
                 remainder = do_div(size, divisor[units]);
                 i++;
         }
 
+        /* work out in j how many digits of precision we need from the
+         * remainder */
         sf_cap = size;
         for (j = 0; sf_cap*10 < 1000; j++)
                 sf_cap *= 10;
 
-        if (j) {
+        if (units == STRING_UNITS_2) {
+                /* express the remainder as a decimal.  It's currently the
+                 * numerator of a fraction whose denominator is
+                 * divisor[units], which is 1 << 10 for STRING_UNITS_2 */
                 remainder *= 1000;
-                remainder /= divisor[units];
+                remainder >>= 10;
+        }
+
+        /* add a 5 to the digit below what will be printed to ensure
+         * an arithmetical round up and carry it through to size */
+        remainder += rounding[j];
+        if (remainder >= 1000) {
+                remainder -= 1000;
+                size += 1;
+        }
+
+        if (j) {
                 snprintf(tmp, sizeof(tmp), ".%03u", remainder);
                 tmp[j+1] = '\0';
         }
diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index e0af6ff73d14..33840324138c 100644
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -39,7 +39,7 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src, long
                 unsigned long c, data;
 
                 /* Fall back to byte-at-a-time if we get a page fault */
-                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+                if (unlikely(unsafe_get_user(c,(unsigned long __user *)(src+res))))
                         break;
                 *(unsigned long *)(dst+res) = c;
                 if (has_zero(c, &data, &constants)) {
@@ -55,7 +55,7 @@ byte_at_a_time:
         while (max) {
                 char c;
 
-                if (unlikely(__get_user(c,src+res)))
+                if (unlikely(unsafe_get_user(c,src+res)))
                         return -EFAULT;
                 dst[res] = c;
                 if (!c)
@@ -107,7 +107,12 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
         src_addr = (unsigned long)src;
         if (likely(src_addr < max_addr)) {
                 unsigned long max = max_addr - src_addr;
-                return do_strncpy_from_user(dst, src, count, max);
+                long retval;
+
+                user_access_begin();
+                retval = do_strncpy_from_user(dst, src, count, max);
+                user_access_end();
+                return retval;
         }
         return -EFAULT;
 }
diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
index 3a5f2b366d84..2625943625d7 100644
--- a/lib/strnlen_user.c
+++ b/lib/strnlen_user.c
@@ -45,7 +45,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
         src -= align;
         max += align;
 
-        if (unlikely(__get_user(c,(unsigned long __user *)src)))
+        if (unlikely(unsafe_get_user(c,(unsigned long __user *)src)))
                 return 0;
         c |= aligned_byte_mask(align);
 
@@ -61,7 +61,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
                 if (unlikely(max <= sizeof(unsigned long)))
                         break;
                 max -= sizeof(unsigned long);
-                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+                if (unlikely(unsafe_get_user(c,(unsigned long __user *)(src+res))))
                         return 0;
         }
         res -= align;
@@ -112,7 +112,12 @@ long strnlen_user(const char __user *str, long count)
         src_addr = (unsigned long)str;
         if (likely(src_addr < max_addr)) {
                 unsigned long max = max_addr - src_addr;
-                return do_strnlen_user(str, count, max);
+                long retval;
+
+                user_access_begin();
+                retval = do_strnlen_user(str, count, max);
+                user_access_end();
+                return retval;
         }
         return 0;
 }
@@ -141,7 +146,12 @@ long strlen_user(const char __user *str)
         src_addr = (unsigned long)str;
         if (likely(src_addr < max_addr)) {
                 unsigned long max = max_addr - src_addr;
-                return do_strnlen_user(str, ~0ul, max);
+                long retval;
+
+                user_access_begin();
+                retval = do_strnlen_user(str, ~0ul, max);
+                user_access_end();
+                return retval;
         }
         return 0;
 }
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 10cd1860e5b0..27a7a26b1ece 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -1685,6 +1685,126 @@ static struct bpf_test tests[] = {
                 { },
                 { { 0, 0x35d97ef2 } }
         },
+        {       /* Mainly checking JIT here. */
+                "MOV REG64",
+                .u.insns_int = {
+                        BPF_LD_IMM64(R0, 0xffffffffffffffffLL),
+                        BPF_MOV64_REG(R1, R0),
+                        BPF_MOV64_REG(R2, R1),
+                        BPF_MOV64_REG(R3, R2),
+                        BPF_MOV64_REG(R4, R3),
+                        BPF_MOV64_REG(R5, R4),
+                        BPF_MOV64_REG(R6, R5),
+                        BPF_MOV64_REG(R7, R6),
+                        BPF_MOV64_REG(R8, R7),
+                        BPF_MOV64_REG(R9, R8),
+                        BPF_ALU64_IMM(BPF_MOV, R0, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R1, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R2, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R3, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R4, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R5, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R6, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R7, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R8, 0),
+                        BPF_ALU64_IMM(BPF_MOV, R9, 0),
+                        BPF_ALU64_REG(BPF_ADD, R0, R0),
+                        BPF_ALU64_REG(BPF_ADD, R0, R1),
+                        BPF_ALU64_REG(BPF_ADD, R0, R2),
+                        BPF_ALU64_REG(BPF_ADD, R0, R3),
+                        BPF_ALU64_REG(BPF_ADD, R0, R4),
+                        BPF_ALU64_REG(BPF_ADD, R0, R5),
+                        BPF_ALU64_REG(BPF_ADD, R0, R6),
+                        BPF_ALU64_REG(BPF_ADD, R0, R7),
+                        BPF_ALU64_REG(BPF_ADD, R0, R8),
+                        BPF_ALU64_REG(BPF_ADD, R0, R9),
+                        BPF_ALU64_IMM(BPF_ADD, R0, 0xfefe),
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 0xfefe } }
+        },
+        {       /* Mainly checking JIT here. */
+                "MOV REG32",
+                .u.insns_int = {
+                        BPF_LD_IMM64(R0, 0xffffffffffffffffLL),
+                        BPF_MOV64_REG(R1, R0),
+                        BPF_MOV64_REG(R2, R1),
+                        BPF_MOV64_REG(R3, R2),
+                        BPF_MOV64_REG(R4, R3),
+                        BPF_MOV64_REG(R5, R4),
+                        BPF_MOV64_REG(R6, R5),
+                        BPF_MOV64_REG(R7, R6),
+                        BPF_MOV64_REG(R8, R7),
+                        BPF_MOV64_REG(R9, R8),
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R1, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R2, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R3, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R4, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R5, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R6, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R7, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R8, 0),
+                        BPF_ALU32_IMM(BPF_MOV, R9, 0),
+                        BPF_ALU64_REG(BPF_ADD, R0, R0),
+                        BPF_ALU64_REG(BPF_ADD, R0, R1),
+                        BPF_ALU64_REG(BPF_ADD, R0, R2),
+                        BPF_ALU64_REG(BPF_ADD, R0, R3),
+                        BPF_ALU64_REG(BPF_ADD, R0, R4),
+                        BPF_ALU64_REG(BPF_ADD, R0, R5),
+                        BPF_ALU64_REG(BPF_ADD, R0, R6),
+                        BPF_ALU64_REG(BPF_ADD, R0, R7),
+                        BPF_ALU64_REG(BPF_ADD, R0, R8),
+                        BPF_ALU64_REG(BPF_ADD, R0, R9),
+                        BPF_ALU64_IMM(BPF_ADD, R0, 0xfefe),
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 0xfefe } }
+        },
+        {       /* Mainly checking JIT here. */
+                "LD IMM64",
+                .u.insns_int = {
+                        BPF_LD_IMM64(R0, 0xffffffffffffffffLL),
+                        BPF_MOV64_REG(R1, R0),
+                        BPF_MOV64_REG(R2, R1),
+                        BPF_MOV64_REG(R3, R2),
+                        BPF_MOV64_REG(R4, R3),
+                        BPF_MOV64_REG(R5, R4),
+                        BPF_MOV64_REG(R6, R5),
+                        BPF_MOV64_REG(R7, R6),
+                        BPF_MOV64_REG(R8, R7),
+                        BPF_MOV64_REG(R9, R8),
+                        BPF_LD_IMM64(R0, 0x0LL),
+                        BPF_LD_IMM64(R1, 0x0LL),
+                        BPF_LD_IMM64(R2, 0x0LL),
+                        BPF_LD_IMM64(R3, 0x0LL),
+                        BPF_LD_IMM64(R4, 0x0LL),
+                        BPF_LD_IMM64(R5, 0x0LL),
+                        BPF_LD_IMM64(R6, 0x0LL),
+                        BPF_LD_IMM64(R7, 0x0LL),
+                        BPF_LD_IMM64(R8, 0x0LL),
+                        BPF_LD_IMM64(R9, 0x0LL),
+                        BPF_ALU64_REG(BPF_ADD, R0, R0),
+                        BPF_ALU64_REG(BPF_ADD, R0, R1),
+                        BPF_ALU64_REG(BPF_ADD, R0, R2),
+                        BPF_ALU64_REG(BPF_ADD, R0, R3),
+                        BPF_ALU64_REG(BPF_ADD, R0, R4),
+                        BPF_ALU64_REG(BPF_ADD, R0, R5),
+                        BPF_ALU64_REG(BPF_ADD, R0, R6),
+                        BPF_ALU64_REG(BPF_ADD, R0, R7),
+                        BPF_ALU64_REG(BPF_ADD, R0, R8),
+                        BPF_ALU64_REG(BPF_ADD, R0, R9),
+                        BPF_ALU64_IMM(BPF_ADD, R0, 0xfefe),
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 0xfefe } }
+        },
         {
                 "INT: ALU MIX",
                 .u.insns_int = {
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index 86374c1c49a4..a3e8ec3fb1c5 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/printk.h>
+#include <linux/completion.h>
 #include <linux/firmware.h>
 #include <linux/device.h>
 #include <linux/fs.h>
@@ -54,10 +55,9 @@ static ssize_t trigger_request_store(struct device *dev,
         int rc;
         char *name;
 
-        name = kzalloc(count + 1, GFP_KERNEL);
+        name = kstrndup(buf, count, GFP_KERNEL);
         if (!name)
                 return -ENOSPC;
-        memcpy(name, buf, count);
 
         pr_info("loading '%s'\n", name);
 
@@ -65,17 +65,73 @@ static ssize_t trigger_request_store(struct device *dev,
         release_firmware(test_firmware);
         test_firmware = NULL;
         rc = request_firmware(&test_firmware, name, dev);
-        if (rc)
+        if (rc) {
                 pr_info("load of '%s' failed: %d\n", name, rc);
-        pr_info("loaded: %zu\n", test_firmware ? test_firmware->size : 0);
+                goto out;
+        }
+        pr_info("loaded: %zu\n", test_firmware->size);
+        rc = count;
+
+out:
         mutex_unlock(&test_fw_mutex);
 
         kfree(name);
 
-        return count;
+        return rc;
 }
 static DEVICE_ATTR_WO(trigger_request);
 
+static DECLARE_COMPLETION(async_fw_done);
+
+static void trigger_async_request_cb(const struct firmware *fw, void *context)
+{
+        test_firmware = fw;
+        complete(&async_fw_done);
+}
+
+static ssize_t trigger_async_request_store(struct device *dev,
+                                           struct device_attribute *attr,
+                                           const char *buf, size_t count)
+{
+        int rc;
+        char *name;
+
+        name = kstrndup(buf, count, GFP_KERNEL);
+        if (!name)
+                return -ENOSPC;
+
+        pr_info("loading '%s'\n", name);
+
+        mutex_lock(&test_fw_mutex);
+        release_firmware(test_firmware);
+        test_firmware = NULL;
+        rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
+                                     NULL, trigger_async_request_cb);
+        if (rc) {
+                pr_info("async load of '%s' failed: %d\n", name, rc);
+                kfree(name);
+                goto out;
+        }
+        /* Free 'name' ASAP, to test for race conditions */
+        kfree(name);
+
+        wait_for_completion(&async_fw_done);
+
+        if (test_firmware) {
+                pr_info("loaded: %zu\n", test_firmware->size);
+                rc = count;
+        } else {
+                pr_err("failed to async load firmware\n");
+                rc = -ENODEV;
+        }
+
+out:
+        mutex_unlock(&test_fw_mutex);
+
+        return rc;
+}
+static DEVICE_ATTR_WO(trigger_async_request);
+
 static int __init test_firmware_init(void)
 {
         int rc;
@@ -92,9 +148,20 @@ static int __init test_firmware_init(void)
                 goto dereg;
         }
 
+        rc = device_create_file(test_fw_misc_device.this_device,
+                                &dev_attr_trigger_async_request);
+        if (rc) {
+                pr_err("could not create async sysfs interface: %d\n", rc);
+                goto remove_file;
+        }
+
         pr_warn("interface ready\n");
 
         return 0;
+
+remove_file:
+        device_remove_file(test_fw_misc_device.this_device,
+                           &dev_attr_trigger_async_request);
 dereg:
         misc_deregister(&test_fw_misc_device);
         return rc;
@@ -106,6 +173,8 @@ static void __exit test_firmware_exit(void)
 {
         release_firmware(test_firmware);
         device_remove_file(test_fw_misc_device.this_device,
+                           &dev_attr_trigger_async_request);
+        device_remove_file(test_fw_misc_device.this_device,
                            &dev_attr_trigger_request);
         misc_deregister(&test_fw_misc_device);
         pr_warn("removed interface\n");
diff --git a/lib/test-hexdump.c b/lib/test_hexdump.c
index 5241df36eedf..3f415d8101f3 100644
--- a/lib/test-hexdump.c
+++ b/lib/test_hexdump.c
@@ -42,19 +42,21 @@ static const char * const test_data_8_le[] __initconst = {
         "e9ac0f9cad319ca6", "0cafb1439919d14c",
 };
 
-static void __init test_hexdump(size_t len, int rowsize, int groupsize,
-                                bool ascii)
+#define FILL_CHAR       '#'
+
+static unsigned total_tests __initdata;
+static unsigned failed_tests __initdata;
+
+static void __init test_hexdump_prepare_test(size_t len, int rowsize,
+                                             int groupsize, char *test,
+                                             size_t testlen, bool ascii)
 {
-        char test[32 * 3 + 2 + 32 + 1];
-        char real[32 * 3 + 2 + 32 + 1];
         char *p;
         const char * const *result;
         size_t l = len;
         int gs = groupsize, rs = rowsize;
         unsigned int i;
 
-        hex_dump_to_buffer(data_b, l, rs, gs, real, sizeof(real), ascii);
-
         if (rs != 16 && rs != 32)
                 rs = 16;
 
@@ -73,8 +75,6 @@ static void __init test_hexdump(size_t len, int rowsize, int groupsize,
         else
                 result = test_data_1_le;
 
-        memset(test, ' ', sizeof(test));
-
         /* hex dump */
         p = test;
         for (i = 0; i < l / gs; i++) {
@@ -82,24 +82,49 @@ static void __init test_hexdump(size_t len, int rowsize, int groupsize,
                 size_t amount = strlen(q);
 
                 strncpy(p, q, amount);
-                p += amount + 1;
+                p += amount;
+
+                *p++ = ' ';
         }
         if (i)
                 p--;
 
         /* ASCII part */
         if (ascii) {
-                p = test + rs * 2 + rs / gs + 1;
+                do {
+                        *p++ = ' ';
+                } while (p < test + rs * 2 + rs / gs + 1);
+
                 strncpy(p, data_a, l);
                 p += l;
         }
 
         *p = '\0';
+}
 
-        if (strcmp(test, real)) {
+#define TEST_HEXDUMP_BUF_SIZE           (32 * 3 + 2 + 32 + 1)
+
+static void __init test_hexdump(size_t len, int rowsize, int groupsize,
+                                bool ascii)
+{
+        char test[TEST_HEXDUMP_BUF_SIZE];
+        char real[TEST_HEXDUMP_BUF_SIZE];
+
+        total_tests++;
+
+        memset(real, FILL_CHAR, sizeof(real));
+        hex_dump_to_buffer(data_b, len, rowsize, groupsize, real, sizeof(real),
+                           ascii);
+
+        memset(test, FILL_CHAR, sizeof(test));
+        test_hexdump_prepare_test(len, rowsize, groupsize, test, sizeof(test),
+                                  ascii);
+
+        if (memcmp(test, real, TEST_HEXDUMP_BUF_SIZE)) {
                 pr_err("Len: %zu row: %d group: %d\n", len, rowsize, groupsize);
                 pr_err("Result: '%s'\n", real);
                 pr_err("Expect: '%s'\n", test);
+                failed_tests++;
         }
 }
 
@@ -114,52 +139,72 @@ static void __init test_hexdump_set(int rowsize, bool ascii)
         test_hexdump(len, rowsize, 1, ascii);
 }
 
-static void __init test_hexdump_overflow(bool ascii)
+static void __init test_hexdump_overflow(size_t buflen, size_t len,
+                                         int rowsize, int groupsize,
+                                         bool ascii)
 {
-        char buf[56];
-        const char *t = test_data_1_le[0];
-        size_t l = get_random_int() % sizeof(buf);
+        char test[TEST_HEXDUMP_BUF_SIZE];
+        char buf[TEST_HEXDUMP_BUF_SIZE];
+        int rs = rowsize, gs = groupsize;
+        int ae, he, e, f, r;
         bool a;
-        int e, r;
 
-        memset(buf, ' ', sizeof(buf));
+        total_tests++;
+
+        memset(buf, FILL_CHAR, sizeof(buf));
 
-        r = hex_dump_to_buffer(data_b, 1, 16, 1, buf, l, ascii);
+        r = hex_dump_to_buffer(data_b, len, rs, gs, buf, buflen, ascii);
+
+        /*
+         * Caller must provide the data length multiple of groupsize. The
+         * calculations below are made with that assumption in mind.
+         */
+        ae = rs * 2 /* hex */ + rs / gs /* spaces */ + 1 /* space */ + len /* ascii */;
+        he = (gs * 2 /* hex */ + 1 /* space */) * len / gs - 1 /* no trailing space */;
 
         if (ascii)
-                e = 50;
+                e = ae;
         else
-                e = 2;
-        buf[e + 2] = '\0';
-
-        if (!l) {
-                a = r == e && buf[0] == ' ';
-        } else if (l < 3) {
-                a = r == e && buf[0] == '\0';
-        } else if (l < 4) {
-                a = r == e && !strcmp(buf, t);
-        } else if (ascii) {
-                if (l < 51)
-                        a = r == e && buf[l - 1] == '\0' && buf[l - 2] == ' ';
-                else
-                        a = r == e && buf[50] == '\0' && buf[49] == '.';
-        } else {
-                a = r == e && buf[e] == '\0';
+                e = he;
+
+        f = min_t(int, e + 1, buflen);
+        if (buflen) {
+                test_hexdump_prepare_test(len, rs, gs, test, sizeof(test), ascii);
+                test[f - 1] = '\0';
         }
+        memset(test + f, FILL_CHAR, sizeof(test) - f);
+
+        a = r == e && !memcmp(test, buf, TEST_HEXDUMP_BUF_SIZE);
+
+        buf[sizeof(buf) - 1] = '\0';
 
         if (!a) {
-                pr_err("Len: %zu rc: %u strlen: %zu\n", l, r, strlen(buf));
-                pr_err("Result: '%s'\n", buf);
+                pr_err("Len: %zu buflen: %zu strlen: %zu\n",
+                        len, buflen, strnlen(buf, sizeof(buf)));
+                pr_err("Result: %d '%s'\n", r, buf);
+                pr_err("Expect: %d '%s'\n", e, test);
+                failed_tests++;
         }
 }
 
+static void __init test_hexdump_overflow_set(size_t buflen, bool ascii)
+{
+        unsigned int i = 0;
+        int rs = (get_random_int() % 2 + 1) * 16;
+
+        do {
+                int gs = 1 << i;
+                size_t len = get_random_int() % rs + gs;
+
+                test_hexdump_overflow(buflen, rounddown(len, gs), rs, gs, ascii);
+        } while (i++ < 3);
+}
+
 static int __init test_hexdump_init(void)
 {
         unsigned int i;
         int rowsize;
 
-        pr_info("Running tests...\n");
-
         rowsize = (get_random_int() % 2 + 1) * 16;
         for (i = 0; i < 16; i++)
                 test_hexdump_set(rowsize, false);
@@ -168,13 +213,26 @@ static int __init test_hexdump_init(void)
         for (i = 0; i < 16; i++)
                 test_hexdump_set(rowsize, true);
 
-        for (i = 0; i < 16; i++)
-                test_hexdump_overflow(false);
+        for (i = 0; i <= TEST_HEXDUMP_BUF_SIZE; i++)
+                test_hexdump_overflow_set(i, false);
 
-        for (i = 0; i < 16; i++)
-                test_hexdump_overflow(true);
+        for (i = 0; i <= TEST_HEXDUMP_BUF_SIZE; i++)
+                test_hexdump_overflow_set(i, true);
+
+        if (failed_tests == 0)
+                pr_info("all %u tests passed\n", total_tests);
+        else
+                pr_err("failed %u out of %u tests\n", failed_tests, total_tests);
 
-        return -EINVAL;
+        return failed_tests ? -EINVAL : 0;
 }
 module_init(test_hexdump_init);
+
+static void __exit test_hexdump_exit(void)
+{
+        /* do nothing */
+}
+module_exit(test_hexdump_exit);
+
+MODULE_AUTHOR("Andy Shevchenko <andriy.shevchenko@linux.intel.com>");
 MODULE_LICENSE("Dual BSD/GPL");
diff --git a/lib/test_printf.c b/lib/test_printf.c
index c5a666af9ba5..4f6ae60433bc 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -12,10 +12,13 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 
+#include <linux/bitmap.h>
+#include <linux/dcache.h>
 #include <linux/socket.h>
 #include <linux/in.h>
 
 #define BUF_SIZE 256
+#define PAD_SIZE 16
 #define FILL_CHAR '$'
 
 #define PTR1 ((void*)0x01234567)
@@ -39,6 +42,7 @@
 static unsigned total_tests __initdata;
 static unsigned failed_tests __initdata;
 static char *test_buffer __initdata;
+static char *alloced_buffer __initdata;
 
 static int __printf(4, 0) __init
 do_test(int bufsize, const char *expect, int elen,
@@ -49,7 +53,7 @@ do_test(int bufsize, const char *expect, int elen,
 
         total_tests++;
 
-        memset(test_buffer, FILL_CHAR, BUF_SIZE);
+        memset(alloced_buffer, FILL_CHAR, BUF_SIZE + 2*PAD_SIZE);
         va_copy(aq, ap);
         ret = vsnprintf(test_buffer, bufsize, fmt, aq);
         va_end(aq);
@@ -60,8 +64,13 @@ do_test(int bufsize, const char *expect, int elen,
                 return 1;
         }
 
+        if (memchr_inv(alloced_buffer, FILL_CHAR, PAD_SIZE)) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote before buffer\n", bufsize, fmt);
+                return 1;
+        }
+
         if (!bufsize) {
-                if (memchr_inv(test_buffer, FILL_CHAR, BUF_SIZE)) {
+                if (memchr_inv(test_buffer, FILL_CHAR, BUF_SIZE + PAD_SIZE)) {
                         pr_warn("vsnprintf(buf, 0, \"%s\", ...) wrote to buffer\n",
                                 fmt);
                         return 1;
@@ -76,6 +85,12 @@ do_test(int bufsize, const char *expect, int elen,
                 return 1;
         }
 
+        if (memchr_inv(test_buffer + written + 1, FILL_CHAR, BUF_SIZE + PAD_SIZE - (written + 1))) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote beyond the nul-terminator\n",
+                        bufsize, fmt);
+                return 1;
+        }
+
         if (memcmp(test_buffer, expect, written)) {
                 pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote '%s', expected '%.*s'\n",
                         bufsize, fmt, test_buffer, written, expect);
@@ -91,7 +106,12 @@ __test(const char *expect, int elen, const char *fmt, ...)
         int rand;
         char *p;
 
-        BUG_ON(elen >= BUF_SIZE);
+        if (elen >= BUF_SIZE) {
+                pr_err("error in test suite: expected output length %d too long. Format was '%s'.\n",
+                       elen, fmt);
+                failed_tests++;
+                return;
+        }
 
         va_start(ap, fmt);
 
@@ -109,6 +129,7 @@ __test(const char *expect, int elen, const char *fmt, ...)
 
         p = kvasprintf(GFP_KERNEL, fmt, ap);
         if (p) {
+                total_tests++;
                 if (memcmp(p, expect, elen+1)) {
                         pr_warn("kvasprintf(..., \"%s\", ...) returned '%s', expected '%s'\n",
                                 fmt, p, expect);
@@ -140,6 +161,30 @@ test_number(void)
         test("0x1234abcd  ", "%#-12x", 0x1234abcd);
         test("  0x1234abcd", "%#12x", 0x1234abcd);
         test("0|001| 12|+123| 1234|-123|-1234", "%d|%03d|%3d|%+d|% d|%+d|% d", 0, 1, 12, 123, 1234, -123, -1234);
+        test("0|1|1|128|255", "%hhu|%hhu|%hhu|%hhu|%hhu", 0, 1, 257, 128, -1);
+        test("0|1|1|-128|-1", "%hhd|%hhd|%hhd|%hhd|%hhd", 0, 1, 257, 128, -1);
+        test("2015122420151225", "%ho%ho%#ho", 1037, 5282, -11627);
+        /*
+         * POSIX/C99: »The result of converting zero with an explicit
+         * precision of zero shall be no characters.« Hence the output
+         * from the below test should really be "00|0||| ". However,
+         * the kernel's printf also produces a single 0 in that
+         * case. This test case simply documents the current
+         * behaviour.
+         */
+        test("00|0|0|0|0", "%.2d|%.1d|%.0d|%.*d|%1.0d", 0, 0, 0, 0, 0, 0);
+#ifndef __CHAR_UNSIGNED__
+        {
+                /*
+                 * Passing a 'char' to a %02x specifier doesn't do
+                 * what was presumably the intention when char is
+                 * signed and the value is negative. One must either &
+                 * with 0xff or cast to u8.
+                 */
+                char val = -16;
+                test("0xfffffff0|0xf0|0xf0", "%#02x|%#02x|%#02x", val, val & 0xff, (u8)val);
+        }
+#endif
 }
 
 static void __init
@@ -148,14 +193,23 @@ test_string(void)
         test("", "%s%.0s", "", "123");
         test("ABCD|abc|123", "%s|%.3s|%.*s", "ABCD", "abcdef", 3, "123456");
         test("1  |  2|3  |  4|5  ", "%-3s|%3s|%-*s|%*s|%*s", "1", "2", 3, "3", 3, "4", -3, "5");
+        test("1234      ", "%-10.4s", "123456");
+        test("      1234", "%10.4s", "123456");
         /*
-         * POSIX and C99 say that a missing precision should be
-         * treated as a precision of 0. However, the kernel's printf
-         * implementation treats this case as if the . wasn't
-         * present. Let's add a test case documenting the current
-         * behaviour; should anyone ever feel the need to follow the
-         * standards more closely, this can be revisited.
+         * POSIX and C99 say that a negative precision (which is only
+         * possible to pass via a * argument) should be treated as if
+         * the precision wasn't present, and that if the precision is
+         * omitted (as in %.s), the precision should be taken to be
+         * 0. However, the kernel's printf behave exactly opposite,
+         * treating a negative precision as 0 and treating an omitted
+         * precision specifier as if no precision was given.
+         *
+         * These test cases document the current behaviour; should
+         * anyone ever feel the need to follow the standards more
+         * closely, this can be revisited.
          */
+        test("    ", "%4.*s", -5, "123456");
+        test("123456", "%.s", "123456");
         test("a||", "%.s|%.0s|%.*s", "a", "b", 0, "c");
         test("a  |   |   ", "%-3.s|%-3.0s|%-3.*s", "a", "b", 0, "c");
 }
@@ -273,9 +327,35 @@ uuid(void)
         test("03020100-0504-0706-0809-0A0B0C0D0E0F", "%pUL", uuid);
 }
 
+static struct dentry test_dentry[4] __initdata = {
+        { .d_parent = &test_dentry[0],
+          .d_name = QSTR_INIT(test_dentry[0].d_iname, 3),
+          .d_iname = "foo" },
+        { .d_parent = &test_dentry[0],
+          .d_name = QSTR_INIT(test_dentry[1].d_iname, 5),
+          .d_iname = "bravo" },
+        { .d_parent = &test_dentry[1],
+          .d_name = QSTR_INIT(test_dentry[2].d_iname, 4),
+          .d_iname = "alfa" },
+        { .d_parent = &test_dentry[2],
+          .d_name = QSTR_INIT(test_dentry[3].d_iname, 5),
+          .d_iname = "romeo" },
+};
+
 static void __init
 dentry(void)
 {
+        test("foo", "%pd", &test_dentry[0]);
+        test("foo", "%pd2", &test_dentry[0]);
+
+        test("romeo", "%pd", &test_dentry[3]);
+        test("alfa/romeo", "%pd2", &test_dentry[3]);
+        test("bravo/alfa/romeo", "%pd3", &test_dentry[3]);
+        test("/bravo/alfa/romeo", "%pd4", &test_dentry[3]);
+        test("/bravo/alfa", "%pd4", &test_dentry[2]);
+
+        test("bravo/alfa  |bravo/alfa  ", "%-12pd2|%*pd2", &test_dentry[2], -12, &test_dentry[2]);
+        test("  bravo/alfa|  bravo/alfa", "%12pd2|%*pd2", &test_dentry[2], 12, &test_dentry[2]);
 }
 
 static void __init
@@ -289,6 +369,20 @@ struct_clk(void)
 }
 
 static void __init
+large_bitmap(void)
+{
+        const int nbits = 1 << 16;
+        unsigned long *bits = kcalloc(BITS_TO_LONGS(nbits), sizeof(long), GFP_KERNEL);
+        if (!bits)
+                return;
+
+        bitmap_set(bits, 1, 20);
+        bitmap_set(bits, 60000, 15);
+        test("1-20,60000-60014", "%*pbl", nbits, bits);
+        kfree(bits);
+}
+
+static void __init
 bitmap(void)
 {
         DECLARE_BITMAP(bits, 20);
@@ -307,6 +401,8 @@ bitmap(void)
         bitmap_fill(bits, 20);
         test("fffff|fffff", "%20pb|%*pb", bits, 20, bits);
         test("0-19|0-19", "%20pbl|%*pbl", bits, 20, bits);
+
+        large_bitmap();
 }
 
 static void __init
@@ -337,16 +433,17 @@ test_pointer(void)
 static int __init
 test_printf_init(void)
 {
-        test_buffer = kmalloc(BUF_SIZE, GFP_KERNEL);
-        if (!test_buffer)
+        alloced_buffer = kmalloc(BUF_SIZE + 2*PAD_SIZE, GFP_KERNEL);
+        if (!alloced_buffer)
                 return -ENOMEM;
+        test_buffer = alloced_buffer + PAD_SIZE;
 
         test_basic();
         test_number();
         test_string();
         test_pointer();
 
-        kfree(test_buffer);
+        kfree(alloced_buffer);
 
         if (failed_tests == 0)
                 pr_info("all %u tests passed\n", total_tests);
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 8c1ad1ced72c..270bf7289b1e 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -36,9 +36,9 @@ static int runs = 4;
 module_param(runs, int, 0);
 MODULE_PARM_DESC(runs, "Number of test runs per variant (default: 4)");
 
-static int max_size = 65536;
+static int max_size = 0;
 module_param(max_size, int, 0);
-MODULE_PARM_DESC(runs, "Maximum table size (default: 65536)");
+MODULE_PARM_DESC(runs, "Maximum table size (default: calculated)");
 
 static bool shrinking = false;
 module_param(shrinking, bool, 0);
@@ -52,6 +52,10 @@ static int tcount = 10;
 module_param(tcount, int, 0);
 MODULE_PARM_DESC(tcount, "Number of threads to spawn (default: 10)");
 
+static bool enomem_retry = false;
+module_param(enomem_retry, bool, 0);
+MODULE_PARM_DESC(enomem_retry, "Retry insert even if -ENOMEM was returned (default: off)");
+
 struct test_obj {
         int                     value;
         struct rhash_head       node;
@@ -76,6 +80,28 @@ static struct rhashtable_params test_rht_params = {
 static struct semaphore prestart_sem;
 static struct semaphore startup_sem = __SEMAPHORE_INITIALIZER(startup_sem, 0);
 
+static int insert_retry(struct rhashtable *ht, struct rhash_head *obj,
+                        const struct rhashtable_params params)
+{
+        int err, retries = -1, enomem_retries = 0;
+
+        do {
+                retries++;
+                cond_resched();
+                err = rhashtable_insert_fast(ht, obj, params);
+                if (err == -ENOMEM && enomem_retry) {
+                        enomem_retries++;
+                        err = -EBUSY;
+                }
+        } while (err == -EBUSY);
+
+        if (enomem_retries)
+                pr_info(" %u insertions retried after -ENOMEM\n",
+                        enomem_retries);
+
+        return err ? : retries;
+}
+
 static int __init test_rht_lookup(struct rhashtable *ht)
 {
         unsigned int i;
@@ -157,7 +183,7 @@ static s64 __init test_rhashtable(struct rhashtable *ht)
 {
         struct test_obj *obj;
         int err;
-        unsigned int i, insert_fails = 0;
+        unsigned int i, insert_retries = 0;
         s64 start, end;
 
         /*
@@ -170,22 +196,16 @@ static s64 __init test_rhashtable(struct rhashtable *ht)
                 struct test_obj *obj = &array[i];
 
                 obj->value = i * 2;
-
-                err = rhashtable_insert_fast(ht, &obj->node, test_rht_params);
-                if (err == -ENOMEM || err == -EBUSY) {
-                        /* Mark failed inserts but continue */
-                        obj->value = TEST_INSERT_FAIL;
-                        insert_fails++;
-                } else if (err) {
+                err = insert_retry(ht, &obj->node, test_rht_params);
+                if (err > 0)
+                        insert_retries += err;
+                else if (err)
                         return err;
-                }
-
-                cond_resched();
         }
 
-        if (insert_fails)
-                pr_info("  %u insertions failed due to memory pressure\n",
-                        insert_fails);
+        if (insert_retries)
+                pr_info("  %u insertions retried due to memory pressure\n",
+                        insert_retries);
 
         test_bucket_stats(ht);
         rcu_read_lock();
@@ -236,13 +256,15 @@ static int thread_lookup_test(struct thread_data *tdata)
                                obj->value, key);
                         err++;
                 }
+
+                cond_resched();
         }
         return err;
 }
 
 static int threadfunc(void *data)
 {
-        int i, step, err = 0, insert_fails = 0;
+        int i, step, err = 0, insert_retries = 0;
         struct thread_data *tdata = data;
 
         up(&prestart_sem);
@@ -251,20 +273,18 @@ static int threadfunc(void *data)
 
         for (i = 0; i < entries; i++) {
                 tdata->objs[i].value = (tdata->id << 16) | i;
-                err = rhashtable_insert_fast(&ht, &tdata->objs[i].node,
-                                             test_rht_params);
-                if (err == -ENOMEM || err == -EBUSY) {
-                        tdata->objs[i].value = TEST_INSERT_FAIL;
-                        insert_fails++;
+                err = insert_retry(&ht, &tdata->objs[i].node, test_rht_params);
+                if (err > 0) {
+                        insert_retries += err;
                 } else if (err) {
                         pr_err("  thread[%d]: rhashtable_insert_fast failed\n",
                                tdata->id);
                         goto out;
                 }
         }
-        if (insert_fails)
-                pr_info("  thread[%d]: %d insert failures\n",
-                        tdata->id, insert_fails);
+        if (insert_retries)
+                pr_info("  thread[%d]: %u insertions retried due to memory pressure\n",
+                        tdata->id, insert_retries);
 
         err = thread_lookup_test(tdata);
         if (err) {
@@ -285,6 +305,8 @@ static int threadfunc(void *data)
                                 goto out;
                         }
                         tdata->objs[i].value = TEST_INSERT_FAIL;
+
+                        cond_resched();
                 }
                 err = thread_lookup_test(tdata);
                 if (err) {
@@ -311,7 +333,7 @@ static int __init test_rht_init(void)
         entries = min(entries, MAX_ENTRIES);
 
         test_rht_params.automatic_shrinking = shrinking;
-        test_rht_params.max_size = max_size;
+        test_rht_params.max_size = max_size ? : roundup_pow_of_two(entries);
         test_rht_params.nelem_hint = size;
 
         pr_info("Running rhashtable test nelem=%d, max_size=%d, shrinking=%d\n",
@@ -357,6 +379,8 @@ static int __init test_rht_init(void)
                 return -ENOMEM;
         }
 
+        test_rht_params.max_size = max_size ? :
+                                   roundup_pow_of_two(tcount * entries);
         err = rhashtable_init(&ht, &test_rht_params);
         if (err < 0) {
                 pr_warn("Test failed: Unable to initialize hashtable: %d\n",
diff --git a/lib/ubsan.c b/lib/ubsan.c
new file mode 100644
index 000000000000..8799ae5e2e42
--- /dev/null
+++ b/lib/ubsan.c
@@ -0,0 +1,456 @@
+/*
+ * UBSAN error reporting functions
+ *
+ * Copyright (c) 2014 Samsung Electronics Co., Ltd.
+ * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/bitops.h>
+#include <linux/bug.h>
+#include <linux/ctype.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+
+#include "ubsan.h"
+
+const char *type_check_kinds[] = {
+        "load of",
+        "store to",
+        "reference binding to",
+        "member access within",
+        "member call on",
+        "constructor call on",
+        "downcast of",
+        "downcast of"
+};
+
+#define REPORTED_BIT 31
+
+#if (BITS_PER_LONG == 64) && defined(__BIG_ENDIAN)
+#define COLUMN_MASK (~(1U << REPORTED_BIT))
+#define LINE_MASK   (~0U)
+#else
+#define COLUMN_MASK   (~0U)
+#define LINE_MASK (~(1U << REPORTED_BIT))
+#endif
+
+#define VALUE_LENGTH 40
+
+static bool was_reported(struct source_location *location)
+{
+        return test_and_set_bit(REPORTED_BIT, &location->reported);
+}
+
+static void print_source_location(const char *prefix,
+                                struct source_location *loc)
+{
+        pr_err("%s %s:%d:%d\n", prefix, loc->file_name,
+                loc->line & LINE_MASK, loc->column & COLUMN_MASK);
+}
+
+static bool suppress_report(struct source_location *loc)
+{
+        return current->in_ubsan || was_reported(loc);
+}
+
+static bool type_is_int(struct type_descriptor *type)
+{
+        return type->type_kind == type_kind_int;
+}
+
+static bool type_is_signed(struct type_descriptor *type)
+{
+        WARN_ON(!type_is_int(type));
+        return  type->type_info & 1;
+}
+
+static unsigned type_bit_width(struct type_descriptor *type)
+{
+        return 1 << (type->type_info >> 1);
+}
+
+static bool is_inline_int(struct type_descriptor *type)
+{
+        unsigned inline_bits = sizeof(unsigned long)*8;
+        unsigned bits = type_bit_width(type);
+
+        WARN_ON(!type_is_int(type));
+
+        return bits <= inline_bits;
+}
+
+static s_max get_signed_val(struct type_descriptor *type, unsigned long val)
+{
+        if (is_inline_int(type)) {
+                unsigned extra_bits = sizeof(s_max)*8 - type_bit_width(type);
+                return ((s_max)val) << extra_bits >> extra_bits;
+        }
+
+        if (type_bit_width(type) == 64)
+                return *(s64 *)val;
+
+        return *(s_max *)val;
+}
+
+static bool val_is_negative(struct type_descriptor *type, unsigned long val)
+{
+        return type_is_signed(type) && get_signed_val(type, val) < 0;
+}
+
+static u_max get_unsigned_val(struct type_descriptor *type, unsigned long val)
+{
+        if (is_inline_int(type))
+                return val;
+
+        if (type_bit_width(type) == 64)
+                return *(u64 *)val;
+
+        return *(u_max *)val;
+}
+
+static void val_to_string(char *str, size_t size, struct type_descriptor *type,
+        unsigned long value)
+{
+        if (type_is_int(type)) {
+                if (type_bit_width(type) == 128) {
+#if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
+                        u_max val = get_unsigned_val(type, value);
+
+                        scnprintf(str, size, "0x%08x%08x%08x%08x",
+                                (u32)(val >> 96),
+                                (u32)(val >> 64),
+                                (u32)(val >> 32),
+                                (u32)(val));
+#else
+                        WARN_ON(1);
+#endif
+                } else if (type_is_signed(type)) {
+                        scnprintf(str, size, "%lld",
+                                (s64)get_signed_val(type, value));
+                } else {
+                        scnprintf(str, size, "%llu",
+                                (u64)get_unsigned_val(type, value));
+                }
+        }
+}
+
+static bool location_is_valid(struct source_location *loc)
+{
+        return loc->file_name != NULL;
+}
+
+static DEFINE_SPINLOCK(report_lock);
+
+static void ubsan_prologue(struct source_location *location,
+                        unsigned long *flags)
+{
+        current->in_ubsan++;
+        spin_lock_irqsave(&report_lock, *flags);
+
+        pr_err("========================================"
+                "========================================\n");
+        print_source_location("UBSAN: Undefined behaviour in", location);
+}
+
+static void ubsan_epilogue(unsigned long *flags)
+{
+        dump_stack();
+        pr_err("========================================"
+                "========================================\n");
+        spin_unlock_irqrestore(&report_lock, *flags);
+        current->in_ubsan--;
+}
+
+static void handle_overflow(struct overflow_data *data, unsigned long lhs,
+                        unsigned long rhs, char op)
+{
+
+        struct type_descriptor *type = data->type;
+        unsigned long flags;
+        char lhs_val_str[VALUE_LENGTH];
+        char rhs_val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);
+        val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);
+        pr_err("%s integer overflow:\n",
+                type_is_signed(type) ? "signed" : "unsigned");
+        pr_err("%s %c %s cannot be represented in type %s\n",
+                lhs_val_str,
+                op,
+                rhs_val_str,
+                type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+
+void __ubsan_handle_add_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+
+        handle_overflow(data, lhs, rhs, '+');
+}
+EXPORT_SYMBOL(__ubsan_handle_add_overflow);
+
+void __ubsan_handle_sub_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+        handle_overflow(data, lhs, rhs, '-');
+}
+EXPORT_SYMBOL(__ubsan_handle_sub_overflow);
+
+void __ubsan_handle_mul_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+        handle_overflow(data, lhs, rhs, '*');
+}
+EXPORT_SYMBOL(__ubsan_handle_mul_overflow);
+
+void __ubsan_handle_negate_overflow(struct overflow_data *data,
+                                unsigned long old_val)
+{
+        unsigned long flags;
+        char old_val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
+
+        pr_err("negation of %s cannot be represented in type %s:\n",
+                old_val_str, data->type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
+
+
+void __ubsan_handle_divrem_overflow(struct overflow_data *data,
+                                unsigned long lhs,
+                                unsigned long rhs)
+{
+        unsigned long flags;
+        char rhs_val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
+
+        if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1)
+                pr_err("division of %s by -1 cannot be represented in type %s\n",
+                        rhs_val_str, data->type->type_name);
+        else
+                pr_err("division by zero\n");
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_divrem_overflow);
+
+static void handle_null_ptr_deref(struct type_mismatch_data *data)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        pr_err("%s null pointer of type %s\n",
+                type_check_kinds[data->type_check_kind],
+                data->type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+
+static void handle_missaligned_access(struct type_mismatch_data *data,
+                                unsigned long ptr)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        pr_err("%s misaligned address %p for type %s\n",
+                type_check_kinds[data->type_check_kind],
+                (void *)ptr, data->type->type_name);
+        pr_err("which requires %ld byte alignment\n", data->alignment);
+
+        ubsan_epilogue(&flags);
+}
+
+static void handle_object_size_mismatch(struct type_mismatch_data *data,
+                                        unsigned long ptr)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+        pr_err("%s address %pk with insufficient space\n",
+                type_check_kinds[data->type_check_kind],
+                (void *) ptr);
+        pr_err("for an object of type %s\n", data->type->type_name);
+        ubsan_epilogue(&flags);
+}
+
+void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
+                                unsigned long ptr)
+{
+
+        if (!ptr)
+                handle_null_ptr_deref(data);
+        else if (data->alignment && !IS_ALIGNED(ptr, data->alignment))
+                handle_missaligned_access(data, ptr);
+        else
+                handle_object_size_mismatch(data, ptr);
+}
+EXPORT_SYMBOL(__ubsan_handle_type_mismatch);
+
+void __ubsan_handle_nonnull_return(struct nonnull_return_data *data)
+{
+        unsigned long flags;
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        pr_err("null pointer returned from function declared to never return null\n");
+
+        if (location_is_valid(&data->attr_location))
+                print_source_location("returns_nonnull attribute specified in",
+                                &data->attr_location);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_nonnull_return);
+
+void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data,
+                                        unsigned long bound)
+{
+        unsigned long flags;
+        char bound_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(bound_str, sizeof(bound_str), data->type, bound);
+        pr_err("variable length array bound value %s <= 0\n", bound_str);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive);
+
+void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data,
+                                unsigned long index)
+{
+        unsigned long flags;
+        char index_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(index_str, sizeof(index_str), data->index_type, index);
+        pr_err("index %s is out of range for type %s\n", index_str,
+                data->array_type->type_name);
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
+
+void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+                                        unsigned long lhs, unsigned long rhs)
+{
+        unsigned long flags;
+        struct type_descriptor *rhs_type = data->rhs_type;
+        struct type_descriptor *lhs_type = data->lhs_type;
+        char rhs_str[VALUE_LENGTH];
+        char lhs_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
+        val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
+
+        if (val_is_negative(rhs_type, rhs))
+                pr_err("shift exponent %s is negative\n", rhs_str);
+
+        else if (get_unsigned_val(rhs_type, rhs) >=
+                type_bit_width(lhs_type))
+                pr_err("shift exponent %s is too large for %u-bit type %s\n",
+                        rhs_str,
+                        type_bit_width(lhs_type),
+                        lhs_type->type_name);
+        else if (val_is_negative(lhs_type, lhs))
+                pr_err("left shift of negative value %s\n",
+                        lhs_str);
+        else
+                pr_err("left shift of %s by %s places cannot be"
+                        " represented in type %s\n",
+                        lhs_str, rhs_str,
+                        lhs_type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
+
+
+void __noreturn
+__ubsan_handle_builtin_unreachable(struct unreachable_data *data)
+{
+        unsigned long flags;
+
+        ubsan_prologue(&data->location, &flags);
+        pr_err("calling __builtin_unreachable()\n");
+        ubsan_epilogue(&flags);
+        panic("can't return from __builtin_unreachable()");
+}
+EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
+
+void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
+                                unsigned long val)
+{
+        unsigned long flags;
+        char val_str[VALUE_LENGTH];
+
+        if (suppress_report(&data->location))
+                return;
+
+        ubsan_prologue(&data->location, &flags);
+
+        val_to_string(val_str, sizeof(val_str), data->type, val);
+
+        pr_err("load of value %s is not a valid value for type %s\n",
+                val_str, data->type->type_name);
+
+        ubsan_epilogue(&flags);
+}
+EXPORT_SYMBOL(__ubsan_handle_load_invalid_value);
diff --git a/lib/ubsan.h b/lib/ubsan.h
new file mode 100644
index 000000000000..b2d18d4a53f5
--- /dev/null
+++ b/lib/ubsan.h
@@ -0,0 +1,84 @@
+#ifndef _LIB_UBSAN_H
+#define _LIB_UBSAN_H
+
+enum {
+        type_kind_int = 0,
+        type_kind_float = 1,
+        type_unknown = 0xffff
+};
+
+struct type_descriptor {
+        u16 type_kind;
+        u16 type_info;
+        char type_name[1];
+};
+
+struct source_location {
+        const char *file_name;
+        union {
+                unsigned long reported;
+                struct {
+                        u32 line;
+                        u32 column;
+                };
+        };
+};
+
+struct overflow_data {
+        struct source_location location;
+        struct type_descriptor *type;
+};
+
+struct type_mismatch_data {
+        struct source_location location;
+        struct type_descriptor *type;
+        unsigned long alignment;
+        unsigned char type_check_kind;
+};
+
+struct nonnull_arg_data {
+        struct source_location location;
+        struct source_location attr_location;
+        int arg_index;
+};
+
+struct nonnull_return_data {
+        struct source_location location;
+        struct source_location attr_location;
+};
+
+struct vla_bound_data {
+        struct source_location location;
+        struct type_descriptor *type;
+};
+
+struct out_of_bounds_data {
+        struct source_location location;
+        struct type_descriptor *array_type;
+        struct type_descriptor *index_type;
+};
+
+struct shift_out_of_bounds_data {
+        struct source_location location;
+        struct type_descriptor *lhs_type;
+        struct type_descriptor *rhs_type;
+};
+
+struct unreachable_data {
+        struct source_location location;
+};
+
+struct invalid_value_data {
+        struct source_location location;
+        struct type_descriptor *type;
+};
+
+#if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
+typedef __int128 s_max;
+typedef unsigned __int128 u_max;
+#else
+typedef s64 s_max;
+typedef u64 u_max;
+#endif
+
+#endif
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index f9cee8e1233c..48ff9c36644d 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -31,6 +31,9 @@
 #include <linux/dcache.h>
 #include <linux/cred.h>
 #include <net/addrconf.h>
+#ifdef CONFIG_BLOCK
+#include <linux/blkdev.h>
+#endif
 
 #include <asm/page.h>           /* for PAGE_SIZE */
 #include <asm/sections.h>       /* for dereference_function_descriptor() */
@@ -380,13 +383,14 @@ enum format_type {
 };
 
 struct printf_spec {
-        u8      type;           /* format_type enum */
-        u8      flags;          /* flags to number() */
-        u8      base;           /* number base, 8, 10 or 16 only */
-        u8      qualifier;      /* number qualifier, one of 'hHlLtzZ' */
-        s16     field_width;    /* width of output field */
-        s16     precision;      /* # of digits/chars */
-};
+        unsigned int    type:8;         /* format_type enum */
+        signed int      field_width:24; /* width of output field */
+        unsigned int    flags:8;        /* flags to number() */
+        unsigned int    base:8;         /* number base, 8, 10 or 16 only */
+        signed int      precision:16;   /* # of digits/chars */
+} __packed;
+#define FIELD_WIDTH_MAX ((1 << 23) - 1)
+#define PRECISION_MAX ((1 << 15) - 1)
 
 static noinline_for_stack
 char *number(char *buf, char *end, unsigned long long num,
@@ -399,6 +403,10 @@ char *number(char *buf, char *end, unsigned long long num,
         int need_pfx = ((spec.flags & SPECIAL) && spec.base != 10);
         int i;
         bool is_zero = num == 0LL;
+        int field_width = spec.field_width;
+        int precision = spec.precision;
+
+        BUILD_BUG_ON(sizeof(struct printf_spec) != 8);
 
         /* locase = 0 or 0x20. ORing digits or letters with 'locase'
          * produces same digits or (maybe lowercased) letters */
@@ -410,20 +418,20 @@ char *number(char *buf, char *end, unsigned long long num,
                 if ((signed long long)num < 0) {
                         sign = '-';
                         num = -(signed long long)num;
-                        spec.field_width--;
+                        field_width--;
                 } else if (spec.flags & PLUS) {
                         sign = '+';
-                        spec.field_width--;
+                        field_width--;
                 } else if (spec.flags & SPACE) {
                         sign = ' ';
-                        spec.field_width--;
+                        field_width--;
                 }
         }
         if (need_pfx) {
                 if (spec.base == 16)
-                        spec.field_width -= 2;
+                        field_width -= 2;
                 else if (!is_zero)
-                        spec.field_width--;
+                        field_width--;
         }
 
         /* generate full string in tmp[], in reverse order */
@@ -445,12 +453,12 @@ char *number(char *buf, char *end, unsigned long long num,
         }
 
         /* printing 100 using %2d gives "100", not "00" */
-        if (i > spec.precision)
-                spec.precision = i;
+        if (i > precision)
+                precision = i;
         /* leading space padding */
-        spec.field_width -= spec.precision;
+        field_width -= precision;
         if (!(spec.flags & (ZEROPAD | LEFT))) {
-                while (--spec.field_width >= 0) {
+                while (--field_width >= 0) {
                         if (buf < end)
                                 *buf = ' ';
                         ++buf;
@@ -479,14 +487,14 @@ char *number(char *buf, char *end, unsigned long long num,
         if (!(spec.flags & LEFT)) {
                 char c = ' ' + (spec.flags & ZEROPAD);
                 BUILD_BUG_ON(' ' + ZEROPAD != '0');
-                while (--spec.field_width >= 0) {
+                while (--field_width >= 0) {
                         if (buf < end)
                                 *buf = c;
                         ++buf;
                 }
         }
         /* hmm even more zero padding? */
-        while (i <= --spec.precision) {
+        while (i <= --precision) {
                 if (buf < end)
                         *buf = '0';
                 ++buf;
@@ -498,7 +506,7 @@ char *number(char *buf, char *end, unsigned long long num,
                 ++buf;
         }
         /* trailing space padding */
-        while (--spec.field_width >= 0) {
+        while (--field_width >= 0) {
                 if (buf < end)
                         *buf = ' ';
                 ++buf;
@@ -508,37 +516,20 @@ char *number(char *buf, char *end, unsigned long long num,
 }
 
 static noinline_for_stack
-char *string(char *buf, char *end, const char *s, struct printf_spec spec)
+char *special_hex_number(char *buf, char *end, unsigned long long num, int size)
 {
-        int len, i;
-
-        if ((unsigned long)s < PAGE_SIZE)
-                s = "(null)";
-
-        len = strnlen(s, spec.precision);
+        struct printf_spec spec;
 
-        if (!(spec.flags & LEFT)) {
-                while (len < spec.field_width--) {
-                        if (buf < end)
-                                *buf = ' ';
-                        ++buf;
-                }
-        }
-        for (i = 0; i < len; ++i) {
-                if (buf < end)
-                        *buf = *s;
-                ++buf; ++s;
-        }
-        while (len < spec.field_width--) {
-                if (buf < end)
-                        *buf = ' ';
-                ++buf;
-        }
+        spec.type = FORMAT_TYPE_PTR;
+        spec.field_width = 2 + 2 * size;        /* 0x + hex */
+        spec.flags = SPECIAL | SMALL | ZEROPAD;
+        spec.base = 16;
+        spec.precision = -1;
 
-        return buf;
+        return number(buf, end, num, spec);
 }
 
-static void widen(char *buf, char *end, unsigned len, unsigned spaces)
+static void move_right(char *buf, char *end, unsigned len, unsigned spaces)
 {
         size_t size;
         if (buf >= end) /* nowhere to put anything */
@@ -556,6 +547,56 @@ static void widen(char *buf, char *end, unsigned len, unsigned spaces)
         memset(buf, ' ', spaces);
 }
 
+/*
+ * Handle field width padding for a string.
+ * @buf: current buffer position
+ * @n: length of string
+ * @end: end of output buffer
+ * @spec: for field width and flags
+ * Returns: new buffer position after padding.
+ */
+static noinline_for_stack
+char *widen_string(char *buf, int n, char *end, struct printf_spec spec)
+{
+        unsigned spaces;
+
+        if (likely(n >= spec.field_width))
+                return buf;
+        /* we want to pad the sucker */
+        spaces = spec.field_width - n;
+        if (!(spec.flags & LEFT)) {
+                move_right(buf - n, end, n, spaces);
+                return buf + spaces;
+        }
+        while (spaces--) {
+                if (buf < end)
+                        *buf = ' ';
+                ++buf;
+        }
+        return buf;
+}
+
+static noinline_for_stack
+char *string(char *buf, char *end, const char *s, struct printf_spec spec)
+{
+        int len = 0;
+        size_t lim = spec.precision;
+
+        if ((unsigned long)s < PAGE_SIZE)
+                s = "(null)";
+
+        while (lim--) {
+                char c = *s++;
+                if (!c)
+                        break;
+                if (buf < end)
+                        *buf = c;
+                ++buf;
+                ++len;
+        }
+        return widen_string(buf, len, end, spec);
+}
+
 static noinline_for_stack
 char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_spec spec,
                   const char *fmt)
@@ -597,21 +638,28 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp
                         *buf = c;
         }
         rcu_read_unlock();
-        if (n < spec.field_width) {
-                /* we want to pad the sucker */
-                unsigned spaces = spec.field_width - n;
-                if (!(spec.flags & LEFT)) {
-                        widen(buf - n, end, n, spaces);
-                        return buf + spaces;
-                }
-                while (spaces--) {
+        return widen_string(buf, n, end, spec);
+}
+
+#ifdef CONFIG_BLOCK
+static noinline_for_stack
+char *bdev_name(char *buf, char *end, struct block_device *bdev,
+                struct printf_spec spec, const char *fmt)
+{
+        struct gendisk *hd = bdev->bd_disk;
+        
+        buf = string(buf, end, hd->disk_name, spec);
+        if (bdev->bd_part->partno) {
+                if (isdigit(hd->disk_name[strlen(hd->disk_name)-1])) {
                         if (buf < end)
-                                *buf = ' ';
-                        ++buf;
+                                *buf = 'p';
+                        buf++;
                 }
+                buf = number(buf, end, bdev->bd_part->partno, spec);
         }
         return buf;
 }
+#endif
 
 static noinline_for_stack
 char *symbol_string(char *buf, char *end, void *ptr,
@@ -636,11 +684,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
 
         return string(buf, end, sym, spec);
 #else
-        spec.field_width = 2 * sizeof(void *);
-        spec.flags |= SPECIAL | SMALL | ZEROPAD;
-        spec.base = 16;
-
-        return number(buf, end, value, spec);
+        return special_hex_number(buf, end, value, sizeof(void *));
 #endif
 }
 
@@ -1301,40 +1345,45 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
         return string(buf, end, uuid, spec);
 }
 
-static
-char *netdev_feature_string(char *buf, char *end, const u8 *addr,
-                      struct printf_spec spec)
+static noinline_for_stack
+char *netdev_bits(char *buf, char *end, const void *addr, const char *fmt)
 {
-        spec.flags |= SPECIAL | SMALL | ZEROPAD;
-        if (spec.field_width == -1)
-                spec.field_width = 2 + 2 * sizeof(netdev_features_t);
-        spec.base = 16;
+        unsigned long long num;
+        int size;
 
-        return number(buf, end, *(const netdev_features_t *)addr, spec);
+        switch (fmt[1]) {
+        case 'F':
+                num = *(const netdev_features_t *)addr;
+                size = sizeof(netdev_features_t);
+                break;
+        default:
+                num = (unsigned long)addr;
+                size = sizeof(unsigned long);
+                break;
+        }
+
+        return special_hex_number(buf, end, num, size);
 }
 
 static noinline_for_stack
-char *address_val(char *buf, char *end, const void *addr,
-                  struct printf_spec spec, const char *fmt)
+char *address_val(char *buf, char *end, const void *addr, const char *fmt)
 {
         unsigned long long num;
-
-        spec.flags |= SPECIAL | SMALL | ZEROPAD;
-        spec.base = 16;
+        int size;
 
         switch (fmt[1]) {
         case 'd':
                 num = *(const dma_addr_t *)addr;
-                spec.field_width = sizeof(dma_addr_t) * 2 + 2;
+                size = sizeof(dma_addr_t);
                 break;
         case 'p':
         default:
                 num = *(const phys_addr_t *)addr;
-                spec.field_width = sizeof(phys_addr_t) * 2 + 2;
+                size = sizeof(phys_addr_t);
                 break;
         }
 
-        return number(buf, end, num, spec);
+        return special_hex_number(buf, end, num, size);
 }
 
 static noinline_for_stack
@@ -1353,10 +1402,7 @@ char *clock(char *buf, char *end, struct clk *clk, struct printf_spec spec,
 #ifdef CONFIG_COMMON_CLK
                 return string(buf, end, __clk_get_name(clk), spec);
 #else
-                spec.base = 16;
-                spec.field_width = sizeof(unsigned long) * 2 + 2;
-                spec.flags |= SPECIAL | SMALL | ZEROPAD;
-                return number(buf, end, (unsigned long)clk, spec);
+                return special_hex_number(buf, end, (unsigned long)clk, sizeof(unsigned long));
 #endif
         }
 }
@@ -1443,6 +1489,7 @@ int kptr_restrict __read_mostly;
  *           (default assumed to be phys_addr_t, passed by reference)
  * - 'd[234]' For a dentry name (optionally 2-4 last components)
  * - 'D[234]' Same as 'd' but for a struct file
+ * - 'g' For block_device name (gendisk + partition number)
  * - 'C' For a clock, it prints the name (Common Clock Framework) or address
  *       (legacy clock framework) of the clock
  * - 'Cn' For a clock, it prints the name (Common Clock Framework) or address
@@ -1585,13 +1632,9 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                 break;
 
         case 'N':
-                switch (fmt[1]) {
-                case 'F':
-                        return netdev_feature_string(buf, end, ptr, spec);
-                }
-                break;
+                return netdev_bits(buf, end, ptr, fmt);
         case 'a':
-                return address_val(buf, end, ptr, spec, fmt);
+                return address_val(buf, end, ptr, fmt);
         case 'd':
                 return dentry_name(buf, end, ptr, spec, fmt);
         case 'C':
@@ -1600,6 +1643,11 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                 return dentry_name(buf, end,
                                    ((const struct file *)ptr)->f_path.dentry,
                                    spec, fmt);
+#ifdef CONFIG_BLOCK
+        case 'g':
+                return bdev_name(buf, end, ptr, spec, fmt);
+#endif
+
         }
         spec.flags |= SMALL;
         if (spec.field_width == -1) {
@@ -1635,6 +1683,7 @@ static noinline_for_stack
 int format_decode(const char *fmt, struct printf_spec *spec)
 {
         const char *start = fmt;
+        char qualifier;
 
         /* we finished early by reading the field width */
         if (spec->type == FORMAT_TYPE_WIDTH) {
@@ -1717,16 +1766,16 @@ precision:
 
 qualifier:
         /* get the conversion qualifier */
-        spec->qualifier = -1;
+        qualifier = 0;
         if (*fmt == 'h' || _tolower(*fmt) == 'l' ||
             _tolower(*fmt) == 'z' || *fmt == 't') {
-                spec->qualifier = *fmt++;
-                if (unlikely(spec->qualifier == *fmt)) {
-                        if (spec->qualifier == 'l') {
-                                spec->qualifier = 'L';
+                qualifier = *fmt++;
+                if (unlikely(qualifier == *fmt)) {
+                        if (qualifier == 'l') {
+                                qualifier = 'L';
                                 ++fmt;
-                        } else if (spec->qualifier == 'h') {
-                                spec->qualifier = 'H';
+                        } else if (qualifier == 'h') {
+                                qualifier = 'H';
                                 ++fmt;
                         }
                 }
@@ -1783,19 +1832,19 @@ qualifier:
                 return fmt - start;
         }
 
-        if (spec->qualifier == 'L')
+        if (qualifier == 'L')
                 spec->type = FORMAT_TYPE_LONG_LONG;
-        else if (spec->qualifier == 'l') {
+        else if (qualifier == 'l') {
                 BUILD_BUG_ON(FORMAT_TYPE_ULONG + SIGN != FORMAT_TYPE_LONG);
                 spec->type = FORMAT_TYPE_ULONG + (spec->flags & SIGN);
-        } else if (_tolower(spec->qualifier) == 'z') {
+        } else if (_tolower(qualifier) == 'z') {
                 spec->type = FORMAT_TYPE_SIZE_T;
-        } else if (spec->qualifier == 't') {
+        } else if (qualifier == 't') {
                 spec->type = FORMAT_TYPE_PTRDIFF;
-        } else if (spec->qualifier == 'H') {
+        } else if (qualifier == 'H') {
                 BUILD_BUG_ON(FORMAT_TYPE_UBYTE + SIGN != FORMAT_TYPE_BYTE);
                 spec->type = FORMAT_TYPE_UBYTE + (spec->flags & SIGN);
-        } else if (spec->qualifier == 'h') {
+        } else if (qualifier == 'h') {
                 BUILD_BUG_ON(FORMAT_TYPE_USHORT + SIGN != FORMAT_TYPE_SHORT);
                 spec->type = FORMAT_TYPE_USHORT + (spec->flags & SIGN);
         } else {
@@ -1806,6 +1855,24 @@ qualifier:
         return ++fmt - start;
 }
 
+static void
+set_field_width(struct printf_spec *spec, int width)
+{
+        spec->field_width = width;
+        if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
+                spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
+        }
+}
+
+static void
+set_precision(struct printf_spec *spec, int prec)
+{
+        spec->precision = prec;
+        if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
+                spec->precision = clamp(prec, 0, PRECISION_MAX);
+        }
+}
+
 /**
  * vsnprintf - Format a string and place it in a buffer
  * @buf: The buffer to place the result into
@@ -1873,11 +1940,11 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                 }
 
                 case FORMAT_TYPE_WIDTH:
-                        spec.field_width = va_arg(args, int);
+                        set_field_width(&spec, va_arg(args, int));
                         break;
 
                 case FORMAT_TYPE_PRECISION:
-                        spec.precision = va_arg(args, int);
+                        set_precision(&spec, va_arg(args, int));
                         break;
 
                 case FORMAT_TYPE_CHAR: {
@@ -2317,11 +2384,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                 }
 
                 case FORMAT_TYPE_WIDTH:
-                        spec.field_width = get_arg(int);
+                        set_field_width(&spec, get_arg(int));
                         break;
 
                 case FORMAT_TYPE_PRECISION:
-                        spec.precision = get_arg(int);
+                        set_precision(&spec, get_arg(int));
                         break;
 
                 case FORMAT_TYPE_CHAR: {