17 files changed, 557 insertions, 165 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 4e35a5d767ed..5f2ce616c046 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -227,6 +227,22 @@ config UNUSED_SYMBOLS
           you really need it, and what the merge plan to the mainline kernel for
           your module is.
 
+config PAGE_OWNER
+        bool "Track page owner"
+        depends on DEBUG_KERNEL && STACKTRACE_SUPPORT
+        select DEBUG_FS
+        select STACKTRACE
+        select PAGE_EXTENSION
+        help
+          This keeps track of what call chain is the owner of a page, may
+          help to find bare alloc_page(s) leaks. Even if you include this
+          feature on your build, it is disabled in default. You should pass
+          "page_owner=on" to boot parameter in order to enable it. Eats
+          a fair amount of memory if enabled. See tools/vm/page_owner_sort.c
+          for user-space helper.
+
+          If unsure, say N.
+
 config DEBUG_FS
         bool "Debug Filesystem"
         help
@@ -1238,21 +1254,9 @@ config RCU_CPU_STALL_TIMEOUT
           RCU grace period persists, additional CPU stall warnings are
           printed at more widely spaced intervals.
 
-config RCU_CPU_STALL_VERBOSE
-        bool "Print additional per-task information for RCU_CPU_STALL_DETECTOR"
-        depends on TREE_PREEMPT_RCU
-        default y
-        help
-          This option causes RCU to printk detailed per-task information
-          for any tasks that are stalling the current RCU grace period.
-
-          Say N if you are unsure.
-
-          Say Y if you want to enable such checks.
-
 config RCU_CPU_STALL_INFO
         bool "Print additional diagnostics on RCU CPU stall"
-        depends on (TREE_RCU || TREE_PREEMPT_RCU) && DEBUG_KERNEL
+        depends on (TREE_RCU || PREEMPT_RCU) && DEBUG_KERNEL
         default n
         help
           For each stalled CPU that is aware of the current RCU grace
diff --git a/lib/Makefile b/lib/Makefile
index 7512dc978f18..3c3b30b9e020 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -10,10 +10,10 @@ endif
 lib-y := ctype.o string.o vsprintf.o cmdline.o \
          rbtree.o radix-tree.o dump_stack.o timerqueue.o\
          idr.o int_sqrt.o extable.o \
-         sha1.o md5.o irq_regs.o reciprocal_div.o argv_split.o \
+         sha1.o md5.o irq_regs.o argv_split.o \
          proportions.o flex_proportions.o ratelimit.o show_mem.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
-         earlycpio.o
+         earlycpio.o seq_buf.o
 
 obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o
 lib-$(CONFIG_MMU) += ioremap.o
@@ -26,7 +26,7 @@ obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
          gcd.o lcm.o list_sort.o uuid.o flex_array.o iovec.o clz_ctz.o \
          bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o \
-         percpu-refcount.o percpu_ida.o hash.o rhashtable.o
+         percpu-refcount.o percpu_ida.o rhashtable.o reciprocal_div.o
 obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += kstrtox.o
diff --git a/lib/audit.c b/lib/audit.c
index 1d726a22565b..b8fb5ee81e26 100644
--- a/lib/audit.c
+++ b/lib/audit.c
@@ -54,6 +54,9 @@ int audit_classify_syscall(int abi, unsigned syscall)
         case __NR_socketcall:
                 return 4;
 #endif
+#ifdef __NR_execveat
+        case __NR_execveat:
+#endif
         case __NR_execve:
                 return 5;
         default:
diff --git a/lib/bitmap.c b/lib/bitmap.c
index 5bc7a1128fe8..324ea9eab8c1 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -328,30 +328,32 @@ void bitmap_clear(unsigned long *map, unsigned int start, int len)
 }
 EXPORT_SYMBOL(bitmap_clear);
 
-/*
- * bitmap_find_next_zero_area - find a contiguous aligned zero area
+/**
+ * bitmap_find_next_zero_area_off - find a contiguous aligned zero area
  * @map: The address to base the search on
  * @size: The bitmap size in bits
  * @start: The bitnumber to start searching at
  * @nr: The number of zeroed bits we're looking for
  * @align_mask: Alignment mask for zero area
+ * @align_offset: Alignment offset for zero area.
  *
  * The @align_mask should be one less than a power of 2; the effect is that
- * the bit offset of all zero areas this function finds is multiples of that
- * power of 2. A @align_mask of 0 means no alignment is required.
+ * the bit offset of all zero areas this function finds plus @align_offset
+ * is multiple of that power of 2.
  */
-unsigned long bitmap_find_next_zero_area(unsigned long *map,
-                                         unsigned long size,
-                                         unsigned long start,
-                                         unsigned int nr,
-                                         unsigned long align_mask)
+unsigned long bitmap_find_next_zero_area_off(unsigned long *map,
+                                             unsigned long size,
+                                             unsigned long start,
+                                             unsigned int nr,
+                                             unsigned long align_mask,
+                                             unsigned long align_offset)
 {
         unsigned long index, end, i;
 again:
         index = find_next_zero_bit(map, size, start);
 
         /* Align allocation */
-        index = __ALIGN_MASK(index, align_mask);
+        index = __ALIGN_MASK(index + align_offset, align_mask) - align_offset;
 
         end = index + nr;
         if (end > size)
@@ -363,7 +365,7 @@ again:
         }
         return index;
 }
-EXPORT_SYMBOL(bitmap_find_next_zero_area);
+EXPORT_SYMBOL(bitmap_find_next_zero_area_off);
 
 /*
  * Bitmap printing & parsing functions: first version by Nadia Yvette Chambers,
diff --git a/lib/decompress.c b/lib/decompress.c
index 37f3c786348f..528ff932d8e4 100644
--- a/lib/decompress.c
+++ b/lib/decompress.c
@@ -44,8 +44,8 @@ struct compress_format {
 };
 
 static const struct compress_format compressed_formats[] __initconst = {
-        { {037, 0213}, "gzip", gunzip },
-        { {037, 0236}, "gzip", gunzip },
+        { {0x1f, 0x8b}, "gzip", gunzip },
+        { {0x1f, 0x9e}, "gzip", gunzip },
         { {0x42, 0x5a}, "bzip2", bunzip2 },
         { {0x5d, 0x00}, "lzma", unlzma },
         { {0xfd, 0x37}, "xz", unxz },
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 8290e0bef7ea..6dd0335ea61b 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
         if (get_bits(bd, 1))
                 return RETVAL_OBSOLETE_INPUT;
         origPtr = get_bits(bd, 24);
-        if (origPtr > dbufSize)
+        if (origPtr >= dbufSize)
                 return RETVAL_DATA_ERROR;
         /* mapping table: if some byte values are never used (encoding things
            like ascii text), the compression code removes the gaps to have fewer
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index add80cc02dbe..9722bd2dbc9b 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -102,6 +102,14 @@ static DEFINE_SPINLOCK(free_entries_lock);
 /* Global disable flag - will be set in case of an error */
 static u32 global_disable __read_mostly;
 
+/* Early initialization disable flag, set at the end of dma_debug_init */
+static bool dma_debug_initialized __read_mostly;
+
+static inline bool dma_debug_disabled(void)
+{
+        return global_disable || !dma_debug_initialized;
+}
+
 /* Global error count */
 static u32 error_count;
 
@@ -945,7 +953,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
         struct dma_debug_entry *uninitialized_var(entry);
         int count;
 
-        if (global_disable)
+        if (dma_debug_disabled())
                 return 0;
 
         switch (action) {
@@ -973,7 +981,7 @@ void dma_debug_add_bus(struct bus_type *bus)
 {
         struct notifier_block *nb;
 
-        if (global_disable)
+        if (dma_debug_disabled())
                 return;
 
         nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
@@ -994,6 +1002,9 @@ void dma_debug_init(u32 num_entries)
 {
         int i;
 
+        /* Do not use dma_debug_initialized here, since we really want to be
+         * called to set dma_debug_initialized
+         */
         if (global_disable)
                 return;
 
@@ -1021,6 +1032,8 @@ void dma_debug_init(u32 num_entries)
 
         nr_total_entries = num_free_entries;
 
+        dma_debug_initialized = true;
+
         pr_info("DMA-API: debugging enabled by kernel config\n");
 }
 
@@ -1243,7 +1256,7 @@ void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
 {
         struct dma_debug_entry *entry;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         if (dma_mapping_error(dev, dma_addr))
@@ -1283,7 +1296,7 @@ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
         struct hash_bucket *bucket;
         unsigned long flags;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         ref.dev = dev;
@@ -1325,7 +1338,7 @@ void debug_dma_unmap_page(struct device *dev, dma_addr_t addr,
                 .direction      = direction,
         };
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         if (map_single)
@@ -1342,7 +1355,7 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
         struct scatterlist *s;
         int i;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         for_each_sg(sg, s, mapped_ents, i) {
@@ -1395,7 +1408,7 @@ void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
         struct scatterlist *s;
         int mapped_ents = 0, i;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         for_each_sg(sglist, s, nelems, i) {
@@ -1427,7 +1440,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
 {
         struct dma_debug_entry *entry;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         if (unlikely(virt == NULL))
@@ -1462,7 +1475,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
                 .direction      = DMA_BIDIRECTIONAL,
         };
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         check_unmap(&ref);
@@ -1474,7 +1487,7 @@ void debug_dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
 {
         struct dma_debug_entry ref;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         ref.type         = dma_debug_single;
@@ -1494,7 +1507,7 @@ void debug_dma_sync_single_for_device(struct device *dev,
 {
         struct dma_debug_entry ref;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         ref.type         = dma_debug_single;
@@ -1515,7 +1528,7 @@ void debug_dma_sync_single_range_for_cpu(struct device *dev,
 {
         struct dma_debug_entry ref;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         ref.type         = dma_debug_single;
@@ -1536,7 +1549,7 @@ void debug_dma_sync_single_range_for_device(struct device *dev,
 {
         struct dma_debug_entry ref;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         ref.type         = dma_debug_single;
@@ -1556,7 +1569,7 @@ void debug_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
         struct scatterlist *s;
         int mapped_ents = 0, i;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         for_each_sg(sg, s, nelems, i) {
@@ -1589,7 +1602,7 @@ void debug_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
         struct scatterlist *s;
         int mapped_ents = 0, i;
 
-        if (unlikely(global_disable))
+        if (unlikely(dma_debug_disabled()))
                 return;
 
         for_each_sg(sg, s, nelems, i) {
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index dfba05521748..527799d44476 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -576,7 +576,7 @@ void __dynamic_dev_dbg(struct _ddebug *descriptor,
         } else {
                 char buf[PREFIX_SIZE];
 
-                dev_printk_emit(7, dev, "%s%s %s: %pV",
+                dev_printk_emit(LOGLEVEL_DEBUG, dev, "%s%s %s: %pV",
                                 dynamic_emit_prefix(descriptor, buf),
                                 dev_driver_string(dev), dev_name(dev),
                                 &vaf);
@@ -605,7 +605,7 @@ void __dynamic_netdev_dbg(struct _ddebug *descriptor,
         if (dev && dev->dev.parent) {
                 char buf[PREFIX_SIZE];
 
-                dev_printk_emit(7, dev->dev.parent,
+                dev_printk_emit(LOGLEVEL_DEBUG, dev->dev.parent,
                                 "%s%s %s %s%s: %pV",
                                 dynamic_emit_prefix(descriptor, buf),
                                 dev_driver_string(dev->dev.parent),
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index d7d501ea856d..f1cdeb024d17 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -40,10 +40,16 @@ EXPORT_SYMBOL_GPL(setup_fault_attr);
 
 static void fail_dump(struct fault_attr *attr)
 {
-        if (attr->verbose > 0)
-                printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure\n");
-        if (attr->verbose > 1)
-                dump_stack();
+        if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) {
+                printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
+                       "name %pd, interval %lu, probability %lu, "
+                       "space %d, times %d\n", attr->dname,
+                       attr->probability, attr->interval,
+                       atomic_read(&attr->space),
+                       atomic_read(&attr->times));
+                if (attr->verbose > 1)
+                        dump_stack();
+        }
 }
 
 #define atomic_dec_not_zero(v)          atomic_add_unless((v), -1, 0)
@@ -202,6 +208,12 @@ struct dentry *fault_create_debugfs_attr(const char *name,
                 goto fail;
         if (!debugfs_create_ul("verbose", mode, dir, &attr->verbose))
                 goto fail;
+        if (!debugfs_create_u32("verbose_ratelimit_interval_ms", mode, dir,
+                                &attr->ratelimit_state.interval))
+                goto fail;
+        if (!debugfs_create_u32("verbose_ratelimit_burst", mode, dir,
+                                &attr->ratelimit_state.burst))
+                goto fail;
         if (!debugfs_create_bool("task-filter", mode, dir, &attr->task_filter))
                 goto fail;
 
@@ -222,6 +234,7 @@ struct dentry *fault_create_debugfs_attr(const char *name,
 
 #endif /* CONFIG_FAULT_INJECTION_STACKTRACE_FILTER */
 
+        attr->dname = dget(dir);
         return dir;
 fail:
         debugfs_remove_recursive(dir);
diff --git a/lib/genalloc.c b/lib/genalloc.c
index cce4dd68c40d..2e65d206b01c 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -598,6 +598,7 @@ struct gen_pool *devm_gen_pool_create(struct device *dev, int min_alloc_order,
 
         return pool;
 }
+EXPORT_SYMBOL(devm_gen_pool_create);
 
 /**
  * dev_get_gen_pool - Obtain the gen_pool (if any) for a device
diff --git a/lib/hash.c b/lib/hash.c
deleted file mode 100644
index fea973f4bd57..000000000000
--- a/lib/hash.c
+++ /dev/null
@@ -1,39 +0,0 @@
-/* General purpose hashing library
- *
- * That's a start of a kernel hashing library, which can be extended
- * with further algorithms in future. arch_fast_hash{2,}() will
- * eventually resolve to an architecture optimized implementation.
- *
- * Copyright 2013 Francesco Fusco <ffusco@redhat.com>
- * Copyright 2013 Daniel Borkmann <dborkman@redhat.com>
- * Copyright 2013 Thomas Graf <tgraf@redhat.com>
- * Licensed under the GNU General Public License, version 2.0 (GPLv2)
- */
-
-#include <linux/jhash.h>
-#include <linux/hash.h>
-#include <linux/cache.h>
-
-static struct fast_hash_ops arch_hash_ops __read_mostly = {
-        .hash  = jhash,
-        .hash2 = jhash2,
-};
-
-u32 arch_fast_hash(const void *data, u32 len, u32 seed)
-{
-        return arch_hash_ops.hash(data, len, seed);
-}
-EXPORT_SYMBOL_GPL(arch_fast_hash);
-
-u32 arch_fast_hash2(const u32 *data, u32 len, u32 seed)
-{
-        return arch_hash_ops.hash2(data, len, seed);
-}
-EXPORT_SYMBOL_GPL(arch_fast_hash2);
-
-static int __init hashlib_init(void)
-{
-        setup_arch_fast_hash(&arch_hash_ops);
-        return 0;
-}
-early_initcall(hashlib_init);
diff --git a/lib/iovec.c b/lib/iovec.c
index df3abd1eaa4a..2d99cb4a5006 100644
--- a/lib/iovec.c
+++ b/lib/iovec.c
@@ -29,31 +29,6 @@ EXPORT_SYMBOL(memcpy_fromiovec);
 
 /*
  *      Copy kernel to iovec. Returns -EFAULT on error.
- *
- *      Note: this modifies the original iovec.
- */
-
-int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len)
-{
-        while (len > 0) {
-                if (iov->iov_len) {
-                        int copy = min_t(unsigned int, iov->iov_len, len);
-                        if (copy_to_user(iov->iov_base, kdata, copy))
-                                return -EFAULT;
-                        kdata += copy;
-                        len -= copy;
-                        iov->iov_len -= copy;
-                        iov->iov_base += copy;
-                }
-                iov++;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_toiovec);
-
-/*
- *      Copy kernel to iovec. Returns -EFAULT on error.
  */
 
 int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
diff --git a/lib/lcm.c b/lib/lcm.c
index b9c8de461e9e..51cc6b13cd52 100644
--- a/lib/lcm.c
+++ b/lib/lcm.c
@@ -7,10 +7,8 @@
 unsigned long lcm(unsigned long a, unsigned long b)
 {
         if (a && b)
-                return (a * b) / gcd(a, b);
-        else if (b)
-                return b;
-
-        return a;
+                return (a / gcd(a, b)) * b;
+        else
+                return 0;
 }
 EXPORT_SYMBOL_GPL(lcm);
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 081be3ba9ea8..6c3c723e902b 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -20,7 +20,7 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
-#include <linux/hash.h>
+#include <linux/jhash.h>
 #include <linux/random.h>
 #include <linux/rhashtable.h>
 
@@ -32,7 +32,7 @@
 #ifdef CONFIG_PROVE_LOCKING
 int lockdep_rht_mutex_is_held(const struct rhashtable *ht)
 {
-        return ht->p.mutex_is_held();
+        return ht->p.mutex_is_held(ht->p.parent);
 }
 EXPORT_SYMBOL_GPL(lockdep_rht_mutex_is_held);
 #endif
@@ -107,13 +107,13 @@ static u32 head_hashfn(const struct rhashtable *ht,
         return obj_hashfn(ht, rht_obj(ht, he), hsize);
 }
 
-static struct bucket_table *bucket_table_alloc(size_t nbuckets, gfp_t flags)
+static struct bucket_table *bucket_table_alloc(size_t nbuckets)
 {
         struct bucket_table *tbl;
         size_t size;
 
         size = sizeof(*tbl) + nbuckets * sizeof(tbl->buckets[0]);
-        tbl = kzalloc(size, flags);
+        tbl = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
         if (tbl == NULL)
                 tbl = vzalloc(size);
 
@@ -200,7 +200,6 @@ static void hashtable_chain_unzip(const struct rhashtable *ht,
 /**
  * rhashtable_expand - Expand hash table while allowing concurrent lookups
  * @ht:         the hash table to expand
- * @flags:      allocation flags
  *
  * A secondary bucket array is allocated and the hash entries are migrated
  * while keeping them on both lists until the end of the RCU grace period.
@@ -211,7 +210,7 @@ static void hashtable_chain_unzip(const struct rhashtable *ht,
  * The caller must ensure that no concurrent table mutations take place.
  * It is however valid to have concurrent lookups if they are RCU protected.
  */
-int rhashtable_expand(struct rhashtable *ht, gfp_t flags)
+int rhashtable_expand(struct rhashtable *ht)
 {
         struct bucket_table *new_tbl, *old_tbl = rht_dereference(ht->tbl, ht);
         struct rhash_head *he;
@@ -223,14 +222,14 @@ int rhashtable_expand(struct rhashtable *ht, gfp_t flags)
         if (ht->p.max_shift && ht->shift >= ht->p.max_shift)
                 return 0;
 
-        new_tbl = bucket_table_alloc(old_tbl->size * 2, flags);
+        new_tbl = bucket_table_alloc(old_tbl->size * 2);
         if (new_tbl == NULL)
                 return -ENOMEM;
 
         ht->shift++;
 
         /* For each new bucket, search the corresponding old bucket
-         * for the first entry that hashes to the new bucket, and
+         * for the first entry that hashes to the new bucket, and
          * link the new bucket to that entry. Since all the entries
          * which will end up in the new bucket appear in the same
          * old bucket, this constructs an entirely valid new hash
@@ -248,8 +247,8 @@ int rhashtable_expand(struct rhashtable *ht, gfp_t flags)
         }
 
         /* Publish the new table pointer. Lookups may now traverse
-         * the new table, but they will not benefit from any
-         * additional efficiency until later steps unzip the buckets.
+         * the new table, but they will not benefit from any
+         * additional efficiency until later steps unzip the buckets.
          */
         rcu_assign_pointer(ht->tbl, new_tbl);
 
@@ -281,7 +280,6 @@ EXPORT_SYMBOL_GPL(rhashtable_expand);
 /**
  * rhashtable_shrink - Shrink hash table while allowing concurrent lookups
  * @ht:         the hash table to shrink
- * @flags:      allocation flags
  *
  * This function may only be called in a context where it is safe to call
  * synchronize_rcu(), e.g. not within a rcu_read_lock() section.
@@ -289,7 +287,7 @@ EXPORT_SYMBOL_GPL(rhashtable_expand);
  * The caller must ensure that no concurrent table mutations take place.
  * It is however valid to have concurrent lookups if they are RCU protected.
  */
-int rhashtable_shrink(struct rhashtable *ht, gfp_t flags)
+int rhashtable_shrink(struct rhashtable *ht)
 {
         struct bucket_table *ntbl, *tbl = rht_dereference(ht->tbl, ht);
         struct rhash_head __rcu **pprev;
@@ -300,20 +298,20 @@ int rhashtable_shrink(struct rhashtable *ht, gfp_t flags)
         if (ht->shift <= ht->p.min_shift)
                 return 0;
 
-        ntbl = bucket_table_alloc(tbl->size / 2, flags);
+        ntbl = bucket_table_alloc(tbl->size / 2);
         if (ntbl == NULL)
                 return -ENOMEM;
 
         ht->shift--;
 
-        /* Link each bucket in the new table to the first bucket
+        /* Link each bucket in the new table to the first bucket
          * in the old table that contains entries which will hash
          * to the new bucket.
          */
         for (i = 0; i < ntbl->size; i++) {
                 ntbl->buckets[i] = tbl->buckets[i];
 
-                /* Link each bucket in the new table to the first bucket
+                /* Link each bucket in the new table to the first bucket
                  * in the old table that contains entries which will hash
                  * to the new bucket.
                  */
@@ -341,7 +339,6 @@ EXPORT_SYMBOL_GPL(rhashtable_shrink);
  * rhashtable_insert - insert object into hash hash table
  * @ht:         hash table
  * @obj:        pointer to hash head inside object
- * @flags:      allocation flags (table expansion)
  *
  * Will automatically grow the table via rhashtable_expand() if the the
  * grow_decision function specified at rhashtable_init() returns true.
@@ -349,8 +346,7 @@ EXPORT_SYMBOL_GPL(rhashtable_shrink);
  * The caller must ensure that no concurrent table mutations occur. It is
  * however valid to have concurrent lookups if they are RCU protected.
  */
-void rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
-                       gfp_t flags)
+void rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj)
 {
         struct bucket_table *tbl = rht_dereference(ht->tbl, ht);
         u32 hash;
@@ -363,7 +359,7 @@ void rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
         ht->nelems++;
 
         if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size))
-                rhashtable_expand(ht, flags);
+                rhashtable_expand(ht);
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert);
 
@@ -372,14 +368,13 @@ EXPORT_SYMBOL_GPL(rhashtable_insert);
  * @ht:         hash table
  * @obj:        pointer to hash head inside object
  * @pprev:      pointer to previous element
- * @flags:      allocation flags (table expansion)
  *
  * Identical to rhashtable_remove() but caller is alreayd aware of the element
  * in front of the element to be deleted. This is in particular useful for
  * deletion when combined with walking or lookup.
  */
 void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
-                             struct rhash_head __rcu **pprev, gfp_t flags)
+                             struct rhash_head __rcu **pprev)
 {
         struct bucket_table *tbl = rht_dereference(ht->tbl, ht);
 
@@ -390,7 +385,7 @@ void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
 
         if (ht->p.shrink_decision &&
             ht->p.shrink_decision(ht, tbl->size))
-                rhashtable_shrink(ht, flags);
+                rhashtable_shrink(ht);
 }
 EXPORT_SYMBOL_GPL(rhashtable_remove_pprev);
 
@@ -398,7 +393,6 @@ EXPORT_SYMBOL_GPL(rhashtable_remove_pprev);
  * rhashtable_remove - remove object from hash table
  * @ht:         hash table
  * @obj:        pointer to hash head inside object
- * @flags:      allocation flags (table expansion)
  *
  * Since the hash chain is single linked, the removal operation needs to
  * walk the bucket chain upon removal. The removal operation is thus
@@ -410,8 +404,7 @@ EXPORT_SYMBOL_GPL(rhashtable_remove_pprev);
  * The caller must ensure that no concurrent table mutations occur. It is
  * however valid to have concurrent lookups if they are RCU protected.
  */
-bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *obj,
-                       gfp_t flags)
+bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *obj)
 {
         struct bucket_table *tbl = rht_dereference(ht->tbl, ht);
         struct rhash_head __rcu **pprev;
@@ -429,7 +422,7 @@ bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *obj,
                         continue;
                 }
 
-                rhashtable_remove_pprev(ht, he, pprev, flags);
+                rhashtable_remove_pprev(ht, he, pprev);
                 return true;
         }
 
@@ -531,8 +524,10 @@ static size_t rounded_hashtable_size(struct rhashtable_params *params)
  *      .head_offset = offsetof(struct test_obj, node),
  *      .key_offset = offsetof(struct test_obj, key),
  *      .key_len = sizeof(int),
- *      .hashfn = arch_fast_hash,
+ *      .hashfn = jhash,
+ * #ifdef CONFIG_PROVE_LOCKING
  *      .mutex_is_held = &my_mutex_is_held,
+ * #endif
  * };
  *
  * Configuration Example 2: Variable length keys
@@ -550,9 +545,11 @@ static size_t rounded_hashtable_size(struct rhashtable_params *params)
  *
  * struct rhashtable_params params = {
  *      .head_offset = offsetof(struct test_obj, node),
- *      .hashfn = arch_fast_hash,
+ *      .hashfn = jhash,
  *      .obj_hashfn = my_hash_fn,
+ * #ifdef CONFIG_PROVE_LOCKING
  *      .mutex_is_held = &my_mutex_is_held,
+ * #endif
  * };
  */
 int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params)
@@ -572,7 +569,7 @@ int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params)
         if (params->nelem_hint)
                 size = rounded_hashtable_size(params);
 
-        tbl = bucket_table_alloc(size, GFP_KERNEL);
+        tbl = bucket_table_alloc(size);
         if (tbl == NULL)
                 return -ENOMEM;
 
@@ -613,10 +610,12 @@ EXPORT_SYMBOL_GPL(rhashtable_destroy);
 #define TEST_PTR        ((void *) 0xdeadbeef)
 #define TEST_NEXPANDS   4
 
-static int test_mutex_is_held(void)
+#ifdef CONFIG_PROVE_LOCKING
+static int test_mutex_is_held(void *parent)
 {
         return 1;
 }
+#endif
 
 struct test_obj {
         void                    *ptr;
@@ -654,15 +653,15 @@ static int __init test_rht_lookup(struct rhashtable *ht)
         return 0;
 }
 
-static void test_bucket_stats(struct rhashtable *ht,
-                                     struct bucket_table *tbl,
-                                     bool quiet)
+static void test_bucket_stats(struct rhashtable *ht, bool quiet)
 {
-        unsigned int cnt, i, total = 0;
+        unsigned int cnt, rcu_cnt, i, total = 0;
         struct test_obj *obj;
+        struct bucket_table *tbl;
 
+        tbl = rht_dereference_rcu(ht->tbl, ht);
         for (i = 0; i < tbl->size; i++) {
-                cnt = 0;
+                rcu_cnt = cnt = 0;
 
                 if (!quiet)
                         pr_info(" [%#4x/%zu]", i, tbl->size);
@@ -674,6 +673,13 @@ static void test_bucket_stats(struct rhashtable *ht,
                                 pr_cont(" [%p],", obj);
                 }
 
+                rht_for_each_entry_rcu(obj, tbl->buckets[i], node)
+                        rcu_cnt++;
+
+                if (rcu_cnt != cnt)
+                        pr_warn("Test failed: Chain count mismach %d != %d",
+                                cnt, rcu_cnt);
+
                 if (!quiet)
                         pr_cont("\n  [%#x] first element: %p, chain length: %u\n",
                                 i, tbl->buckets[i], cnt);
@@ -681,6 +687,9 @@ static void test_bucket_stats(struct rhashtable *ht,
 
         pr_info("  Traversal complete: counted=%u, nelems=%zu, entries=%d\n",
                 total, ht->nelems, TEST_ENTRIES);
+
+        if (total != ht->nelems || total != TEST_ENTRIES)
+                pr_warn("Test failed: Total count mismatch ^^^");
 }
 
 static int __init test_rhashtable(struct rhashtable *ht)
@@ -707,18 +716,17 @@ static int __init test_rhashtable(struct rhashtable *ht)
                 obj->ptr = TEST_PTR;
                 obj->value = i * 2;
 
-                rhashtable_insert(ht, &obj->node, GFP_KERNEL);
+                rhashtable_insert(ht, &obj->node);
         }
 
         rcu_read_lock();
-        tbl = rht_dereference_rcu(ht->tbl, ht);
-        test_bucket_stats(ht, tbl, true);
+        test_bucket_stats(ht, true);
         test_rht_lookup(ht);
         rcu_read_unlock();
 
         for (i = 0; i < TEST_NEXPANDS; i++) {
                 pr_info("  Table expansion iteration %u...\n", i);
-                rhashtable_expand(ht, GFP_KERNEL);
+                rhashtable_expand(ht);
 
                 rcu_read_lock();
                 pr_info("  Verifying lookups...\n");
@@ -728,7 +736,7 @@ static int __init test_rhashtable(struct rhashtable *ht)
 
         for (i = 0; i < TEST_NEXPANDS; i++) {
                 pr_info("  Table shrinkage iteration %u...\n", i);
-                rhashtable_shrink(ht, GFP_KERNEL);
+                rhashtable_shrink(ht);
 
                 rcu_read_lock();
                 pr_info("  Verifying lookups...\n");
@@ -736,6 +744,10 @@ static int __init test_rhashtable(struct rhashtable *ht)
                 rcu_read_unlock();
         }
 
+        rcu_read_lock();
+        test_bucket_stats(ht, true);
+        rcu_read_unlock();
+
         pr_info("  Deleting %d keys\n", TEST_ENTRIES);
         for (i = 0; i < TEST_ENTRIES; i++) {
                 u32 key = i * 2;
@@ -743,7 +755,7 @@ static int __init test_rhashtable(struct rhashtable *ht)
                 obj = rhashtable_lookup(ht, &key);
                 BUG_ON(!obj);
 
-                rhashtable_remove(ht, &obj->node, GFP_KERNEL);
+                rhashtable_remove(ht, &obj->node);
                 kfree(obj);
         }
 
@@ -766,8 +778,10 @@ static int __init test_rht_init(void)
                 .head_offset = offsetof(struct test_obj, node),
                 .key_offset = offsetof(struct test_obj, value),
                 .key_len = sizeof(int),
-                .hashfn = arch_fast_hash,
+                .hashfn = jhash,
+#ifdef CONFIG_PROVE_LOCKING
                 .mutex_is_held = &test_mutex_is_held,
+#endif
                 .grow_decision = rht_grow_above_75,
                 .shrink_decision = rht_shrink_below_30,
         };
diff --git a/lib/seq_buf.c b/lib/seq_buf.c
new file mode 100644
index 000000000000..4eedfedb9e31
--- /dev/null
+++ b/lib/seq_buf.c
@@ -0,0 +1,359 @@
+/*
+ * seq_buf.c
+ *
+ * Copyright (C) 2014 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * The seq_buf is a handy tool that allows you to pass a descriptor around
+ * to a buffer that other functions can write to. It is similar to the
+ * seq_file functionality but has some differences.
+ *
+ * To use it, the seq_buf must be initialized with seq_buf_init().
+ * This will set up the counters within the descriptor. You can call
+ * seq_buf_init() more than once to reset the seq_buf to start
+ * from scratch.
+ */
+#include <linux/uaccess.h>
+#include <linux/seq_file.h>
+#include <linux/seq_buf.h>
+
+/**
+ * seq_buf_can_fit - can the new data fit in the current buffer?
+ * @s: the seq_buf descriptor
+ * @len: The length to see if it can fit in the current buffer
+ *
+ * Returns true if there's enough unused space in the seq_buf buffer
+ * to fit the amount of new data according to @len.
+ */
+static bool seq_buf_can_fit(struct seq_buf *s, size_t len)
+{
+        return s->len + len <= s->size;
+}
+
+/**
+ * seq_buf_print_seq - move the contents of seq_buf into a seq_file
+ * @m: the seq_file descriptor that is the destination
+ * @s: the seq_buf descriptor that is the source.
+ *
+ * Returns zero on success, non zero otherwise
+ */
+int seq_buf_print_seq(struct seq_file *m, struct seq_buf *s)
+{
+        unsigned int len = seq_buf_used(s);
+
+        return seq_write(m, s->buffer, len);
+}
+
+/**
+ * seq_buf_vprintf - sequence printing of information.
+ * @s: seq_buf descriptor
+ * @fmt: printf format string
+ * @args: va_list of arguments from a printf() type function
+ *
+ * Writes a vnprintf() format into the sequencce buffer.
+ *
+ * Returns zero on success, -1 on overflow.
+ */
+int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args)
+{
+        int len;
+
+        WARN_ON(s->size == 0);
+
+        if (s->len < s->size) {
+                len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
+                if (seq_buf_can_fit(s, len)) {
+                        s->len += len;
+                        return 0;
+                }
+        }
+        seq_buf_set_overflow(s);
+        return -1;
+}
+
+/**
+ * seq_buf_printf - sequence printing of information
+ * @s: seq_buf descriptor
+ * @fmt: printf format string
+ *
+ * Writes a printf() format into the sequence buffer.
+ *
+ * Returns zero on success, -1 on overflow.
+ */
+int seq_buf_printf(struct seq_buf *s, const char *fmt, ...)
+{
+        va_list ap;
+        int ret;
+
+        va_start(ap, fmt);
+        ret = seq_buf_vprintf(s, fmt, ap);
+        va_end(ap);
+
+        return ret;
+}
+
+/**
+ * seq_buf_bitmask - write a bitmask array in its ASCII representation
+ * @s:          seq_buf descriptor
+ * @maskp:      points to an array of unsigned longs that represent a bitmask
+ * @nmaskbits:  The number of bits that are valid in @maskp
+ *
+ * Writes a ASCII representation of a bitmask string into @s.
+ *
+ * Returns zero on success, -1 on overflow.
+ */
+int seq_buf_bitmask(struct seq_buf *s, const unsigned long *maskp,
+                    int nmaskbits)
+{
+        unsigned int len = seq_buf_buffer_left(s);
+        int ret;
+
+        WARN_ON(s->size == 0);
+
+        /*
+         * Note, because bitmap_scnprintf() only returns the number of bytes
+         * written and not the number that would be written, we use the last
+         * byte of the buffer to let us know if we overflowed. There's a small
+         * chance that the bitmap could have fit exactly inside the buffer, but
+         * it's not that critical if that does happen.
+         */
+        if (len > 1) {
+                ret = bitmap_scnprintf(s->buffer + s->len, len, maskp, nmaskbits);
+                if (ret < len) {
+                        s->len += ret;
+                        return 0;
+                }
+        }
+        seq_buf_set_overflow(s);
+        return -1;
+}
+
+#ifdef CONFIG_BINARY_PRINTF
+/**
+ * seq_buf_bprintf - Write the printf string from binary arguments
+ * @s: seq_buf descriptor
+ * @fmt: The format string for the @binary arguments
+ * @binary: The binary arguments for @fmt.
+ *
+ * When recording in a fast path, a printf may be recorded with just
+ * saving the format and the arguments as they were passed to the
+ * function, instead of wasting cycles converting the arguments into
+ * ASCII characters. Instead, the arguments are saved in a 32 bit
+ * word array that is defined by the format string constraints.
+ *
+ * This function will take the format and the binary array and finish
+ * the conversion into the ASCII string within the buffer.
+ *
+ * Returns zero on success, -1 on overflow.
+ */
+int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary)
+{
+        unsigned int len = seq_buf_buffer_left(s);
+        int ret;
+
+        WARN_ON(s->size == 0);
+
+        if (s->len < s->size) {
+                ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
+                if (seq_buf_can_fit(s, ret)) {
+                        s->len += ret;
+                        return 0;
+                }
+        }
+        seq_buf_set_overflow(s);
+        return -1;
+}
+#endif /* CONFIG_BINARY_PRINTF */
+
+/**
+ * seq_buf_puts - sequence printing of simple string
+ * @s: seq_buf descriptor
+ * @str: simple string to record
+ *
+ * Copy a simple string into the sequence buffer.
+ *
+ * Returns zero on success, -1 on overflow
+ */
+int seq_buf_puts(struct seq_buf *s, const char *str)
+{
+        unsigned int len = strlen(str);
+
+        WARN_ON(s->size == 0);
+
+        if (seq_buf_can_fit(s, len)) {
+                memcpy(s->buffer + s->len, str, len);
+                s->len += len;
+                return 0;
+        }
+        seq_buf_set_overflow(s);
+        return -1;
+}
+
+/**
+ * seq_buf_putc - sequence printing of simple character
+ * @s: seq_buf descriptor
+ * @c: simple character to record
+ *
+ * Copy a single character into the sequence buffer.
+ *
+ * Returns zero on success, -1 on overflow
+ */
+int seq_buf_putc(struct seq_buf *s, unsigned char c)
+{
+        WARN_ON(s->size == 0);
+
+        if (seq_buf_can_fit(s, 1)) {
+                s->buffer[s->len++] = c;
+                return 0;
+        }
+        seq_buf_set_overflow(s);
+        return -1;
+}
+
+/**
+ * seq_buf_putmem - write raw data into the sequenc buffer
+ * @s: seq_buf descriptor
+ * @mem: The raw memory to copy into the buffer
+ * @len: The length of the raw memory to copy (in bytes)
+ *
+ * There may be cases where raw memory needs to be written into the
+ * buffer and a strcpy() would not work. Using this function allows
+ * for such cases.
+ *
+ * Returns zero on success, -1 on overflow
+ */
+int seq_buf_putmem(struct seq_buf *s, const void *mem, unsigned int len)
+{
+        WARN_ON(s->size == 0);
+
+        if (seq_buf_can_fit(s, len)) {
+                memcpy(s->buffer + s->len, mem, len);
+                s->len += len;
+                return 0;
+        }
+        seq_buf_set_overflow(s);
+        return -1;
+}
+
+#define MAX_MEMHEX_BYTES        8U
+#define HEX_CHARS               (MAX_MEMHEX_BYTES*2 + 1)
+
+/**
+ * seq_buf_putmem_hex - write raw memory into the buffer in ASCII hex
+ * @s: seq_buf descriptor
+ * @mem: The raw memory to write its hex ASCII representation of
+ * @len: The length of the raw memory to copy (in bytes)
+ *
+ * This is similar to seq_buf_putmem() except instead of just copying the
+ * raw memory into the buffer it writes its ASCII representation of it
+ * in hex characters.
+ *
+ * Returns zero on success, -1 on overflow
+ */
+int seq_buf_putmem_hex(struct seq_buf *s, const void *mem,
+                       unsigned int len)
+{
+        unsigned char hex[HEX_CHARS];
+        const unsigned char *data = mem;
+        unsigned int start_len;
+        int i, j;
+
+        WARN_ON(s->size == 0);
+
+        while (len) {
+                start_len = min(len, HEX_CHARS - 1);
+#ifdef __BIG_ENDIAN
+                for (i = 0, j = 0; i < start_len; i++) {
+#else
+                for (i = start_len-1, j = 0; i >= 0; i--) {
+#endif
+                        hex[j++] = hex_asc_hi(data[i]);
+                        hex[j++] = hex_asc_lo(data[i]);
+                }
+                if (WARN_ON_ONCE(j == 0 || j/2 > len))
+                        break;
+
+                /* j increments twice per loop */
+                len -= j / 2;
+                hex[j++] = ' ';
+
+                seq_buf_putmem(s, hex, j);
+                if (seq_buf_has_overflowed(s))
+                        return -1;
+        }
+        return 0;
+}
+
+/**
+ * seq_buf_path - copy a path into the sequence buffer
+ * @s: seq_buf descriptor
+ * @path: path to write into the sequence buffer.
+ * @esc: set of characters to escape in the output
+ *
+ * Write a path name into the sequence buffer.
+ *
+ * Returns the number of written bytes on success, -1 on overflow
+ */
+int seq_buf_path(struct seq_buf *s, const struct path *path, const char *esc)
+{
+        char *buf;
+        size_t size = seq_buf_get_buf(s, &buf);
+        int res = -1;
+
+        WARN_ON(s->size == 0);
+
+        if (size) {
+                char *p = d_path(path, buf, size);
+                if (!IS_ERR(p)) {
+                        char *end = mangle_path(buf, p, esc);
+                        if (end)
+                                res = end - buf;
+                }
+        }
+        seq_buf_commit(s, res);
+
+        return res;
+}
+
+/**
+ * seq_buf_to_user - copy the squence buffer to user space
+ * @s: seq_buf descriptor
+ * @ubuf: The userspace memory location to copy to
+ * @cnt: The amount to copy
+ *
+ * Copies the sequence buffer into the userspace memory pointed to
+ * by @ubuf. It starts from the last read position (@s->readpos)
+ * and writes up to @cnt characters or till it reaches the end of
+ * the content in the buffer (@s->len), which ever comes first.
+ *
+ * On success, it returns a positive number of the number of bytes
+ * it copied.
+ *
+ * On failure it returns -EBUSY if all of the content in the
+ * sequence has been already read, which includes nothing in the
+ * sequence (@s->len == @s->readpos).
+ *
+ * Returns -EFAULT if the copy to userspace fails.
+ */
+int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt)
+{
+        int len;
+        int ret;
+
+        if (!cnt)
+                return 0;
+
+        if (s->len <= s->readpos)
+                return -EBUSY;
+
+        len = seq_buf_used(s) - s->readpos;
+        if (cnt > len)
+                cnt = len;
+        ret = copy_to_user(ubuf, s->buffer + s->readpos, cnt);
+        if (ret == cnt)
+                return -EFAULT;
+
+        cnt -= ret;
+
+        s->readpos += cnt;
+        return cnt;
+}
diff --git a/lib/show_mem.c b/lib/show_mem.c
index 09225796991a..5e256271b47b 100644
--- a/lib/show_mem.c
+++ b/lib/show_mem.c
@@ -28,7 +28,7 @@ void show_mem(unsigned int filter)
                                 continue;
 
                         total += zone->present_pages;
-                        reserved = zone->present_pages - zone->managed_pages;
+                        reserved += zone->present_pages - zone->managed_pages;
 
                         if (is_highmem_idx(zoneid))
                                 highmem += zone->present_pages;
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 23e070bcf72d..80d78c51f65f 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -124,7 +124,7 @@ static struct bpf_test tests[] = {
                 { { 0, 0xfffffffd } }
         },
         {
-                "DIV_KX",
+                "DIV_MOD_KX",
                 .u.insns = {
                         BPF_STMT(BPF_LD | BPF_IMM, 8),
                         BPF_STMT(BPF_ALU | BPF_DIV | BPF_K, 2),
@@ -134,12 +134,18 @@ static struct bpf_test tests[] = {
                         BPF_STMT(BPF_MISC | BPF_TAX, 0),
                         BPF_STMT(BPF_LD | BPF_IMM, 0xffffffff),
                         BPF_STMT(BPF_ALU | BPF_DIV | BPF_K, 0x70000000),
+                        BPF_STMT(BPF_MISC | BPF_TAX, 0),
+                        BPF_STMT(BPF_LD | BPF_IMM, 0xffffffff),
+                        BPF_STMT(BPF_ALU | BPF_MOD | BPF_X, 0),
+                        BPF_STMT(BPF_MISC | BPF_TAX, 0),
+                        BPF_STMT(BPF_LD | BPF_IMM, 0xffffffff),
+                        BPF_STMT(BPF_ALU | BPF_MOD | BPF_K, 0x70000000),
                         BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
                         BPF_STMT(BPF_RET | BPF_A, 0)
                 },
                 CLASSIC | FLAG_NO_DATA,
                 { },
-                { { 0, 0x40000001 } }
+                { { 0, 0x20000000 } }
         },
         {
                 "AND_OR_LSH_K",
@@ -1756,6 +1762,49 @@ static struct bpf_test tests[] = {
                 { },
                 { { 0, 1 } }
         },
+        {
+                "nmap reduced",
+                .u.insns_int = {
+                        BPF_MOV64_REG(R6, R1),
+                        BPF_LD_ABS(BPF_H, 12),
+                        BPF_JMP_IMM(BPF_JNE, R0, 0x806, 28),
+                        BPF_LD_ABS(BPF_H, 12),
+                        BPF_JMP_IMM(BPF_JNE, R0, 0x806, 26),
+                        BPF_MOV32_IMM(R0, 18),
+                        BPF_STX_MEM(BPF_W, R10, R0, -64),
+                        BPF_LDX_MEM(BPF_W, R7, R10, -64),
+                        BPF_LD_IND(BPF_W, R7, 14),
+                        BPF_STX_MEM(BPF_W, R10, R0, -60),
+                        BPF_MOV32_IMM(R0, 280971478),
+                        BPF_STX_MEM(BPF_W, R10, R0, -56),
+                        BPF_LDX_MEM(BPF_W, R7, R10, -56),
+                        BPF_LDX_MEM(BPF_W, R0, R10, -60),
+                        BPF_ALU32_REG(BPF_SUB, R0, R7),
+                        BPF_JMP_IMM(BPF_JNE, R0, 0, 15),
+                        BPF_LD_ABS(BPF_H, 12),
+                        BPF_JMP_IMM(BPF_JNE, R0, 0x806, 13),
+                        BPF_MOV32_IMM(R0, 22),
+                        BPF_STX_MEM(BPF_W, R10, R0, -56),
+                        BPF_LDX_MEM(BPF_W, R7, R10, -56),
+                        BPF_LD_IND(BPF_H, R7, 14),
+                        BPF_STX_MEM(BPF_W, R10, R0, -52),
+                        BPF_MOV32_IMM(R0, 17366),
+                        BPF_STX_MEM(BPF_W, R10, R0, -48),
+                        BPF_LDX_MEM(BPF_W, R7, R10, -48),
+                        BPF_LDX_MEM(BPF_W, R0, R10, -52),
+                        BPF_ALU32_REG(BPF_SUB, R0, R7),
+                        BPF_JMP_IMM(BPF_JNE, R0, 0, 2),
+                        BPF_MOV32_IMM(R0, 256),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV32_IMM(R0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0, 0,
+                  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                  0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6},
+                { { 38, 256 } }
+        },
 };
 
 static struct net_device dev;