musl: update to latest git to fix MIPS and PowerPC TLS issues

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 46134

1 files changed, 392 insertions, 137 deletions

diff --git a/toolchain/musl/patches/001-git-2015-06-20.patch b/toolchain/musl/patches/001-git-2015-06-25.patch
index 33768a59d8..abb4a9d135 100644
--- a/toolchain/musl/patches/001-git-2015-06-20.patch
+++ b/toolchain/musl/patches/001-git-2015-06-25.patch
@@ -1,20 +1,107 @@
-From bafa38541e911806b74a1ab094a404bbdd692ade Mon Sep 17 00:00:00 2001
-From: Steven Barth <steven@midlink.org>
-Date: Sat, 20 Jun 2015 16:59:48 +0200
-Subject: [PATCH] commit 55d061f031085f24d138664c897791aebe9a2fab Author: Rich
- Felker <dalias@aerifal.cx> Date:   Sat Jun 20 03:01:07 2015 +0000
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
+commit 6ba5517a460c6c438f64d69464fdfc3269a4c91a
+Author: Rich Felker <dalias@aerifal.cx>
+Date:   Thu Jun 25 22:22:00 2015 +0000
+
+    fix local-dynamic model TLS on mips and powerpc
+    
+    the TLS ABI spec for mips, powerpc, and some other (presently
+    unsupported) RISC archs has the return value of __tls_get_addr offset
+    by +0x8000 and the result of DTPOFF relocations offset by -0x8000. I
+    had previously assumed this part of the ABI was actually just an
+    implementation detail, since the adjustments cancel out. however, when
+    the local dynamic model is used for accessing TLS that's known to be
+    in the same DSO, either of the following may happen:
+    
+    1. the -0x8000 offset may already be applied to the argument structure
+    passed to __tls_get_addr at ld time, without any opportunity for
+    runtime relocations.
+    
+    2. __tls_get_addr may be used with a zero offset argument to obtain a
+    base address for the module's TLS, to which the caller then applies
+    immediate offsets for individual objects accessed using the local
+    dynamic model. since the immediate offsets have the -0x8000 adjustment
+    applied to them, the base address they use needs to include the
+    +0x8000 offset.
+    
+    it would be possible, but more complex, to store the pointers in the
+    dtv[] array with the +0x8000 offset pre-applied, to avoid the runtime
+    cost of adding 0x8000 on each call to __tls_get_addr. this change
+    could be made later if measurements show that it would help.
+
+commit ce337daa00e42d4f2d9a4d9ae0ed51b20249d924
+Author: Rich Felker <dalias@aerifal.cx>
+Date:   Tue Jun 23 04:03:42 2015 +0000
 
-    provide __stack_chk_fail_local in libc.a
+    make dynamic linker work around MAP_FAILED mmap failure on nommu kernels
+    
+    previously, loading of additional libraries beyond libc/ldso did not
+    work on nommu kernels, nor did loading programs via invocation of the
+    dynamic linker as a command.
+
+commit a59341420fdedb288d9ff80e73609ae44e9cf258
+Author: Rich Felker <dalias@aerifal.cx>
+Date:   Tue Jun 23 00:12:25 2015 +0000
+
+    reimplement strverscmp to fix corner cases
+    
+    this interface is non-standardized and is a GNU invention, and as
+    such, our implementation should match the behavior of the GNU
+    function. one peculiarity the old implementation got wrong was the
+    handling of all-zero digit sequences: they are supposed to compare
+    greater than digit sequences of which they are a proper prefix, as in
+    009 < 00.
+    
+    in addition, high bytes were treated with char signedness rather than
+    as unsigned. this was wrong regardless of what the GNU function does
+    since the resulting order relation varied by arch.
+    
+    the new strverscmp implementation makes explicit the cases where the
+    order differs from what strcmp would produce, of which there are only
+    two.
+
+commit 153e952e1a688859d7095345b17e6c1df74a295c
+Author: Rich Felker <dalias@aerifal.cx>
+Date:   Mon Jun 22 20:33:28 2015 +0000
+
+    fix regression/typo that disabled __simple_malloc when calloc is used
+    
+    commit ba819787ee93ceae94efd274f7849e317c1bff58 introduced this
+    regression. since the __malloc0 weak alias was not properly provided
+    by __simple_malloc, use of calloc forced the full malloc to be linked.
 
+commit ba819787ee93ceae94efd274f7849e317c1bff58
+Author: Rich Felker <dalias@aerifal.cx>
+Date:   Mon Jun 22 18:50:09 2015 +0000
+
+    fix calloc when __simple_malloc implementation is used
+    
+    previously, calloc's implementation encoded assumptions about the
+    implementation of malloc, accessing a size_t word just prior to the
+    allocated memory to determine if it was obtained by mmap to optimize
+    out the zero-filling. when __simple_malloc is used (static linking a
+    program with no realloc/free), it doesn't matter if the result of this
+    check is wrong, since all allocations are zero-initialized anyway. but
+    the access could be invalid if it crosses a page boundary or if the
+    pointer is not sufficiently aligned, which can happen for very small
+    allocations.
+    
+    this patch fixes the issue by moving the zero-fill logic into malloc.c
+    with the full malloc, as a new function named __malloc0, which is
+    provided by a weak alias to __simple_malloc (which always gives
+    zero-filled memory) when the full malloc is not in use.
+
+commit 55d061f031085f24d138664c897791aebe9a2fab
+Author: Rich Felker <dalias@aerifal.cx>
+Date:   Sat Jun 20 03:01:07 2015 +0000
+
+    provide __stack_chk_fail_local in libc.a
+    
     this symbol is needed only on archs where the PLT call ABI is klunky,
     and only for position-independent code compiled with stack protector.
     thus references usually only appear in shared libraries or PIE
     executables, but they can also appear when linking statically if some
     of the object files being linked were built as PIC/PIE.
-
+    
     normally libssp_nonshared.a from the compiler toolchain should provide
     __stack_chk_fail_local, but reportedly it appears prior to -lc in the
     link order, thus failing to satisfy references from libc itself (which
@@ -26,7 +113,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sat Jun 20 02:54:30 2015 +0000
 
     work around mips detached thread exit breakage due to kernel regression
-
+    
     linux kernel commit 46e12c07b3b9603c60fc1d421ff18618241cb081 caused
     the mips syscall mechanism to fail with EFAULT when the userspace
     stack pointer is invalid, breaking __unmapself used for detached
@@ -39,7 +126,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Wed Jun 17 17:21:46 2015 +0000
 
     ignore ENOSYS error from mprotect in pthread_create and dynamic linker
-
+    
     this error simply indicated a system without memory protection (NOMMU)
     and should not cause failure in the caller.
 
@@ -48,16 +135,16 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 15:25:02 2015 +0000
 
     switch to using trap number 31 for syscalls on sh
-
+    
     nominally the low bits of the trap number on sh are the number of
     syscall arguments, but they have never been used by the kernel, and
     some code making syscalls does not even know the number of arguments
     and needs to pass an arbitrary high number anyway.
-
+    
     sh3/sh4 traditionally used the trap range 16-31 for syscalls, but part
     of this range overlapped with hardware exceptions/interrupts on sh2
     hardware, so an incompatible range 32-47 was chosen for sh2.
-
+    
     using trap number 31 everywhere, since it's in the existing sh3/sh4
     range and does not conflict with sh2 hardware, is a proposed
     unification of the kernel syscall convention that will allow binaries
@@ -71,13 +158,13 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 14:55:06 2015 +0000
 
     switch sh port's __unmapself to generic version when running on sh2/nommu
-
+    
     due to the way the interrupt and syscall trap mechanism works,
     userspace on sh2 must never set the stack pointer to an invalid value.
     thus, the approach used on most archs, where __unmapself executes with
     no stack for the interval between SYS_munmap and SYS_exit, is not
     viable on sh2.
-
+    
     in order not to pessimize sh3/sh4, the sh asm version of __unmapself
     is not removed. instead it's renamed and redirected through code that
     calls either the generic (safe) __unmapself or the sh3/sh4 asm,
@@ -88,20 +175,20 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 14:28:30 2015 +0000
 
     add support for sh2 interrupt-masking-based atomics to sh port
-
+    
     the sh2 target is being considered an ISA subset of sh3/sh4, in the
     sense that binaries built for sh2 are intended to be usable on later
     cpu models/kernels with mmu support. so rather than hard-coding
     sh2-specific atomics, the runtime atomic selection mechanisms that was
     already in place has been extended to add sh2 atomics.
-
+    
     at this time, the sh2 atomics are not SMP-compatible; since the ISA
     lacks actual atomic operations, the new code instead masks interrupts
     for the duration of the atomic operation, producing an atomic result
     on single-core. this is only possible because the kernel/hardware does
     not impose protections against userspace doing so. additional changes
     will be needed to support future SMP systems.
-
+    
     care has been taken to avoid producing significant additional code
     size in the case where it's known at compile-time that the target is
     not sh2 and does not need sh2-specific code.
@@ -111,15 +198,15 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 07:11:19 2015 +0000
 
     refactor stdio open file list handling, move it out of global libc struct
-
+    
     functions which open in-memory FILE stream variants all shared a tail
     with __fdopen, adding the FILE structure to stdio's open file list.
     replacing this common tail with a function call reduces code size and
     duplication of logic. the list is also partially encapsulated now.
-
+    
     function signatures were chosen to facilitate tail call optimization
     and reduce the need for additional accessor functions.
-
+    
     with these changes, static linked programs that do not use stdio no
     longer have an open file list at all.
 
@@ -128,7 +215,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 06:18:00 2015 +0000
 
     byte-based C locale, phase 3: make MB_CUR_MAX variable to activate code
-
+    
     this patch activates the new byte-based C locale (high bytes treated
     as abstract code unit "characters" rather than decoded as multibyte
     characters) by making the value of MB_CUR_MAX depend on the active
@@ -140,25 +227,25 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 05:35:31 2015 +0000
 
     byte-based C locale, phase 2: stdio and iconv (multibyte callers)
-
+    
     this patch adjusts libc components which use the multibyte functions
     internally, and which depend on them operating in a particular
     encoding, to make the appropriate locale changes before calling them
     and restore the calling thread's locale afterwards. activating the
     byte-based C locale without these changes would cause regressions in
     stdio and iconv.
-
+    
     in the case of iconv, the current implementation was simply using the
     multibyte functions as UTF-8 conversions. setting a multibyte UTF-8
     locale for the duration of the iconv operation allows the code to
     continue working.
-
+    
     in the case of stdio, POSIX requires that FILE streams have an
     encoding rule bound at the time of setting wide orientation. as long
     as all locales, including the C locale, used the same encoding,
     treating high bytes as UTF-8, there was no need to store an encoding
     rule as part of the stream's state.
-
+    
     a new locale field in the FILE structure points to the locale that
     should be made active during fgetwc/fputwc/ungetwc on the stream. it
     cannot point to the locale active at the time the stream becomes
@@ -174,14 +261,14 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 04:44:17 2015 +0000
 
     byte-based C locale, phase 1: multibyte character handling functions
-
+    
     this patch makes the functions which work directly on multibyte
     characters treat the high bytes as individual abstract code units
     rather than as multibyte sequences when MB_CUR_MAX is 1. since
     MB_CUR_MAX is presently defined as a constant 4, all of the new code
     added is dead code, and optimizing compilers' code generation should
     not be affected at all. a future commit will activate the new code.
-
+    
     as abstract code units, bytes 0x80 to 0xff are represented by wchar_t
     values 0xdf80 to 0xdfff, at the end of the surrogates range. this
     ensures that they will never be misinterpreted as Unicode characters,
@@ -196,7 +283,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 16 04:21:38 2015 +0000
 
     fix btowc corner case
-
+    
     btowc is required to interpret its argument by conversion to unsigned
     char, unless the argument is equal to EOF. since the conversion to
     produces a non-character value anyway, we can just unconditionally
@@ -207,7 +294,7 @@ Author: Szabolcs Nagy <nsz@port70.net>
 Date:   Wed Jun 3 10:32:14 2015 +0100
 
     arm: add vdso support
-
+    
     vdso will be available on arm in linux v4.2, the user-space code
     for it is in kernel commit 8512287a8165592466cb9cb347ba94892e9c56a5
 
@@ -216,16 +303,16 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sun Jun 14 01:59:02 2015 +0000
 
     refactor malloc's expand_heap to share with __simple_malloc
-
+    
     this extends the brk/stack collision protection added to full malloc
     in commit 276904c2f6bde3a31a24ebfa201482601d18b4f9 to also protect the
     __simple_malloc function used in static-linked programs that don't
     reference the free function.
-
+    
     it also extends support for using mmap when brk fails, which full
     malloc got in commit 5446303328adf4b4e36d9fba21848e6feb55fab4, to
     __simple_malloc.
-
+    
     since __simple_malloc may expand the heap by arbitrarily large
     increments, the stack collision detection is enhanced to detect
     interval overlap rather than just proximity of a single address to the
@@ -239,7 +326,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sat Jun 13 20:53:02 2015 +0000
 
     remove cancellation points in stdio
-
+    
     commit 58165923890865a6ac042fafce13f440ee986fd9 added these optional
     cancellation points on the basis that cancellable stdio could be
     useful, to unblock threads stuck on stdio operations that will never
@@ -248,7 +335,7 @@ Date:   Sat Jun 13 20:53:02 2015 +0000
     cancellation is acted upon, discarding knowledge of any partial data
     transfer already completed. our implementation exhibited this behavior
     and was thus non-conforming.
-
+    
     in addition to improving correctness, removing these cancellation
     points moderately reduces code size, and should significantly improve
     performance on i386, where sysenter/syscall instructions can be used
@@ -259,7 +346,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sat Jun 13 05:17:16 2015 +0000
 
     fix idiom for setting stdio stream orientation to wide
-
+    
     the old idiom, f->mode |= f->mode+1, was adapted from the idiom for
     setting byte orientation, f->mode |= f->mode-1, but the adaptation was
     incorrect. unless the stream was alreasdy set byte-oriented, this code
@@ -275,7 +362,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sat Jun 13 04:42:38 2015 +0000
 
     add printing of null %s arguments as "(null)" in wide printf
-
+    
     this is undefined, but supported in our implementation of the normal
     printf, so for consistency the wide variant should support it too.
 
@@ -296,11 +383,11 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Wed Jun 10 02:27:40 2015 +0000
 
     implement arch-generic version of __unmapself
-
+    
     this can be used to put off writing an asm version of __unmapself for
     new archs, or as a permanent solution on archs where it's not
     practical or even possible to run momentarily with no stack.
-
+    
     the concept here is simple: the caller takes a lock on a global shared
     stack and uses it to make the munmap and exit syscalls. the only trick
     is unlocking, which must be done after the thread exits, and this is
@@ -312,14 +399,14 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 9 20:30:35 2015 +0000
 
     in malloc, refuse to use brk if it grows into stack
-
+    
     the linux/nommu fdpic ELF loader sets up the brk range to overlap
     entirely with the main thread's stack (but growing from opposite
     ends), so that the resulting failure mode for malloc is not to return
     a null pointer but to start returning pointers to memory that overlaps
     with the caller's stack. needless to say this extremely dangerous and
     makes brk unusable.
-
+    
     since it's non-trivial to detect execution environments that might be
     affected by this kernel bug, and since the severity of the bug makes
     any sort of detection that might yield false-negatives unsafe, we
@@ -329,7 +416,7 @@ Date:   Tue Jun 9 20:30:35 2015 +0000
     arbitrary gap distance of 8 MB is imposed, chosen to be larger than
     linux default main-thread stack reservation sizes and larger than any
     reasonable stack configuration on nommu.
-
+    
     the effeciveness of this patch relies on an assumption that the amount
     by which the brk is being grown is smaller than the gap limit, which
     is always true for malloc's use of brk. reliance on this assumption is
@@ -340,14 +427,14 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Tue Jun 9 20:09:27 2015 +0000
 
     fix spurious errors from pwd/grp functions when nscd backend is absent
-
+    
     for several pwd/grp functions, the only way the caller can distinguish
     between a successful negative result ("no such user/group") and an
     internal error is by clearing errno before the call and checking errno
     afterwards. the nscd backend support code correctly simulated a
     not-found response on systems where such a backend is not running, but
     failed to restore errno.
-
+    
     this commit also fixed an outdated/incorrect comment.
 
 commit 75ce4503950621b11fcc7f1fd1187dbcf3cde312
@@ -355,7 +442,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sun Jun 7 20:55:23 2015 +0000
 
     fix regression in pre-v7 arm on kernels with kuser helper removed
-
+    
     the arm atomics/TLS runtime selection code is called from
     __set_thread_area and depends on having libc.auxv and __hwcap
     available. commit 71f099cb7db821c51d8f39dfac622c61e54d794c moved the
@@ -363,9 +450,9 @@ Date:   Sun Jun 7 20:55:23 2015 +0000
     before this data is made available, causing the runtime detection code
     to always see __hwcap as zero and thereby select the atomics/TLS
     implementations based on kuser helper.
-
+    
     upcoming work on superh will use similar runtime detection.
-
+    
     ideally this early-init code should be cleanly refactored and shared
     between the dynamic linker and static-linked startup.
 
@@ -380,7 +467,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sun Jun 7 02:59:49 2015 +0000
 
     remove redefinition of MB_CUR_MAX in locale_impl.h
-
+    
     unless/until the byte-based C locale is implemented, defining
     MB_CUR_MAX to 1 in the C locale is wrong. no internal code currently
     uses the MB_CUR_MAX macro, but having it defined inconsistently is
@@ -404,7 +491,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sat Jun 6 18:16:22 2015 +0000
 
     add macro version of ctype.h isascii function
-
+    
     presumably internal code (ungetwc and fputwc) was written assuming a
     macro implementation existed; otherwise use of isascii is just a
     pessimization.
@@ -414,7 +501,7 @@ Author: Rich Felker <dalias@aerifal.cx>
 Date:   Sat Jun 6 18:11:17 2015 +0000
 
     remove invalid skip of locking in ungetwc
-
+    
     aside from being invalid, the early check only optimized the error
     case, and likely pessimized the common case by separating the
     two branches on isascii(c) at opposite ends of the function.
@@ -424,82 +511,9 @@ Author: Timo Teräs <timo.teras@iki.fi>
 Date:   Fri Jun 5 10:39:42 2015 +0300
 
     fix uselocale((locale_t)0) not to modify locale
-
+    
     commit 68630b55c0c7219fe9df70dc28ffbf9efc8021d8 made the new locale to
     be assigned unconditonally resulting in crashes later on.
----
- arch/arm/syscall_arch.h            |  4 ++
- arch/sh/src/__set_thread_area.c    | 34 ++++++++++++++++
- arch/sh/src/__unmapself.c          | 19 +++++++++
- arch/sh/src/atomic.c               | 72 ++++++++++++++++++++++++++++++----
- arch/sh/src/sh_atomic.h            | 15 +++++++
- arch/sh/syscall_arch.h             |  2 +-
- include/ctype.h                    |  1 +
- include/stdlib.h                   |  3 +-
- src/ctype/__ctype_get_mb_cur_max.c |  5 ++-
- src/ctype/isascii.c                |  1 +
- src/env/__stack_chk_fail.c         |  4 ++
- src/internal/libc.h                |  2 -
- src/internal/locale_impl.h         | 12 ++++++
- src/internal/sh/syscall.s          |  2 +-
- src/internal/stdio_impl.h          |  6 ++-
- src/ldso/dynlink.c                 | 37 +++++++++---------
- src/locale/c_locale.c              | 15 +++++++
- src/locale/iconv.c                 |  6 +++
- src/locale/langinfo.c              |  3 +-
- src/locale/locale_map.c            | 12 +-----
- src/locale/newlocale.c             | 15 ++-----
- src/locale/uselocale.c             |  4 +-
- src/malloc/expand_heap.c           | 72 ++++++++++++++++++++++++++++++++++
- src/malloc/lite_malloc.c           | 49 ++++++++++++-----------
- src/malloc/malloc.c                | 80 ++++++++++++++------------------------
- src/multibyte/btowc.c              |  5 ++-
- src/multibyte/internal.h           |  7 ++++
- src/multibyte/mbrtowc.c            |  2 +
- src/multibyte/mbsrtowcs.c          | 19 +++++++++
- src/multibyte/mbtowc.c             |  2 +
- src/multibyte/wcrtomb.c            |  9 +++++
- src/multibyte/wctob.c              |  4 +-
- src/passwd/nscd_query.c            | 12 ++++--
- src/process/sh/vfork.s             | 23 +++++++++++
- src/regex/fnmatch.c                |  3 +-
- src/signal/sh/restore.s            |  4 +-
- src/stdio/__fdopen.c               |  8 +---
- src/stdio/__stdio_exit.c           |  3 +-
- src/stdio/__stdio_read.c           | 11 +-----
- src/stdio/__stdio_write.c          | 14 +------
- src/stdio/fclose.c                 |  6 +--
- src/stdio/fflush.c                 |  5 +--
- src/stdio/fgetwc.c                 | 15 +++++--
- src/stdio/fmemopen.c               |  8 +---
- src/stdio/fopen.c                  |  2 +-
- src/stdio/fputwc.c                 |  7 +++-
- src/stdio/fputws.c                 |  7 +++-
- src/stdio/fwide.c                  | 11 +++---
- src/stdio/ofl.c                    | 16 ++++++++
- src/stdio/ofl_add.c                | 11 ++++++
- src/stdio/open_memstream.c         |  8 +---
- src/stdio/open_wmemstream.c        |  8 +---
- src/stdio/ungetwc.c                | 18 ++++-----
- src/stdio/vfwprintf.c              |  5 ++-
- src/stdio/vfwscanf.c               |  2 +-
- src/thread/__unmapself.c           | 29 ++++++++++++++
- src/thread/mips/__unmapself.s      |  1 +
- src/thread/pthread_create.c        |  6 ++-
- src/thread/sh/__set_thread_area.s  |  6 ---
- src/thread/sh/__unmapself.s        | 10 ++---
- src/thread/sh/clone.s              |  4 +-
- src/thread/sh/syscall_cp.s         |  2 +-
- src/unistd/sh/pipe.s               |  2 +-
- 63 files changed, 548 insertions(+), 242 deletions(-)
- create mode 100644 arch/sh/src/__set_thread_area.c
- create mode 100644 arch/sh/src/__unmapself.c
- create mode 100644 arch/sh/src/sh_atomic.h
- create mode 100644 src/locale/c_locale.c
- create mode 100644 src/malloc/expand_heap.c
- create mode 100644 src/process/sh/vfork.s
- create mode 100644 src/stdio/ofl.c
- create mode 100644 src/stdio/ofl_add.c
 
 diff --git a/arch/arm/syscall_arch.h b/arch/arm/syscall_arch.h
 index 199ad2a..64461ec 100644
@@ -513,6 +527,30 @@ index 199ad2a..64461ec 100644
 +#define VDSO_USEFUL
 +#define VDSO_CGT_SYM "__vdso_clock_gettime"
 +#define VDSO_CGT_VER "LINUX_2.6"
+diff --git a/arch/mips/pthread_arch.h b/arch/mips/pthread_arch.h
+index f8e35ae..904a248 100644
+--- a/arch/mips/pthread_arch.h
++++ b/arch/mips/pthread_arch.h
+@@ -13,4 +13,6 @@ static inline struct pthread *__pthread_self()
+ #define TLS_ABOVE_TP
+ #define TP_ADJ(p) ((char *)(p) + sizeof(struct pthread) + 0x7000)
+ 
++#define DTP_OFFSET 0x8000
++
+ #define CANCEL_REG_IP (3-(union {int __i; char __b;}){1}.__b)
+diff --git a/arch/powerpc/pthread_arch.h b/arch/powerpc/pthread_arch.h
+index 4115ec8..1cbfc22 100644
+--- a/arch/powerpc/pthread_arch.h
++++ b/arch/powerpc/pthread_arch.h
+@@ -12,6 +12,8 @@ static inline struct pthread *__pthread_self()
+ #define TLS_ABOVE_TP
+ #define TP_ADJ(p) ((char *)(p) + sizeof(struct pthread) + 0x7000)
+ 
++#define DTP_OFFSET 0x8000
++
+ // offset of the PC register in mcontext_t, divided by the system wordsize
+ // the kernel calls the ip "nip", it's the first saved value after the 32
+ // GPRs.
 diff --git a/arch/sh/src/__set_thread_area.c b/arch/sh/src/__set_thread_area.c
 new file mode 100644
 index 0000000..1d3e022
@@ -854,6 +892,21 @@ index 9b8385e..f5e4d9b 100644
  #define MB_CUR_MAX (CURRENT_UTF8 ? 4 : 1)
 +
 +#endif
+diff --git a/src/internal/pthread_impl.h b/src/internal/pthread_impl.h
+index e29f9c8..3890bb5 100644
+--- a/src/internal/pthread_impl.h
++++ b/src/internal/pthread_impl.h
+@@ -94,6 +94,10 @@ struct __timer {
+ #define CANARY canary
+ #endif
+ 
++#ifndef DTP_OFFSET
++#define DTP_OFFSET 0
++#endif
++
+ #define SIGTIMER 32
+ #define SIGCANCEL 33
+ #define SIGSYNCCALL 34
 diff --git a/src/internal/sh/syscall.s b/src/internal/sh/syscall.s
 index d00712a..331918a 100644
 --- a/src/internal/sh/syscall.s
@@ -892,10 +945,62 @@ index e1325fe..0dd7fb5 100644
  #define feof(f) ((f)->flags & F_EOF)
  #define ferror(f) ((f)->flags & F_ERR)
 diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
-index 42b056d..7e56693 100644
+index 42b056d..d2a7249 100644
 --- a/src/ldso/dynlink.c
 +++ b/src/ldso/dynlink.c
-@@ -536,7 +536,8 @@ static void *map_library(int fd, struct dso *dso)
+@@ -337,7 +337,7 @@ static void do_relocs(struct dso *dso, size_t *rel, size_t rel_size, size_t stri
+ 			*reloc_addr = def.dso->tls_id;
+ 			break;
+ 		case REL_DTPOFF:
+-			*reloc_addr = tls_val + addend;
++			*reloc_addr = tls_val + addend - DTP_OFFSET;
+ 			break;
+ #ifdef TLS_ABOVE_TP
+ 		case REL_TPOFF:
+@@ -423,6 +423,28 @@ static void reclaim_gaps(struct dso *dso)
+ 	}
+ }
+ 
++static void *mmap_fixed(void *p, size_t n, int prot, int flags, int fd, off_t off)
++{
++	char *q = mmap(p, n, prot, flags, fd, off);
++	if (q != MAP_FAILED || errno != EINVAL) return q;
++	/* Fallbacks for MAP_FIXED failure on NOMMU kernels. */
++	if (flags & MAP_ANONYMOUS) {
++		memset(p, 0, n);
++		return p;
++	}
++	ssize_t r;
++	if (lseek(fd, off, SEEK_SET) < 0) return MAP_FAILED;
++	for (q=p; n; q+=r, off+=r, n-=r) {
++		r = read(fd, q, n);
++		if (r < 0 && errno != EINTR) return MAP_FAILED;
++		if (!r) {
++			memset(q, 0, n);
++			break;
++		}
++	}
++	return p;
++}
++
+ static void *map_library(int fd, struct dso *dso)
+ {
+ 	Ehdr buf[(896+sizeof(Ehdr))/sizeof(Ehdr)];
+@@ -524,19 +546,20 @@ static void *map_library(int fd, struct dso *dso)
+ 		prot = (((ph->p_flags&PF_R) ? PROT_READ : 0) |
+ 			((ph->p_flags&PF_W) ? PROT_WRITE: 0) |
+ 			((ph->p_flags&PF_X) ? PROT_EXEC : 0));
+-		if (mmap(base+this_min, this_max-this_min, prot, MAP_PRIVATE|MAP_FIXED, fd, off_start) == MAP_FAILED)
++		if (mmap_fixed(base+this_min, this_max-this_min, prot, MAP_PRIVATE|MAP_FIXED, fd, off_start) == MAP_FAILED)
+ 			goto error;
+ 		if (ph->p_memsz > ph->p_filesz) {
+ 			size_t brk = (size_t)base+ph->p_vaddr+ph->p_filesz;
+ 			size_t pgbrk = brk+PAGE_SIZE-1 & -PAGE_SIZE;
+ 			memset((void *)brk, 0, pgbrk-brk & PAGE_SIZE-1);
+-			if (pgbrk-(size_t)base < this_max && mmap((void *)pgbrk, (size_t)base+this_max-pgbrk, prot, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED)
++			if (pgbrk-(size_t)base < this_max && mmap_fixed((void *)pgbrk, (size_t)base+this_max-pgbrk, prot, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED)
+ 				goto error;
+ 		}
  	}
  	for (i=0; ((size_t *)(base+dyn))[i]; i+=2)
  		if (((size_t *)(base+dyn))[i]==DT_TEXTREL) {
@@ -905,7 +1010,7 @@ index 42b056d..7e56693 100644
  				goto error;
  			break;
  		}
-@@ -927,7 +928,8 @@ static void reloc_all(struct dso *p)
+@@ -927,7 +950,8 @@ static void reloc_all(struct dso *p)
  		do_relocs(p, (void *)(p->base+dyn[DT_RELA]), dyn[DT_RELASZ], 3);
  
  		if (head != &ldso && p->relro_start != p->relro_end &&
@@ -915,7 +1020,25 @@ index 42b056d..7e56693 100644
  			error("Error relocating %s: RELRO protection failed: %m",
  				p->name);
  			if (runtime) longjmp(*rtld_fail, 1);
-@@ -1192,6 +1194,17 @@ _Noreturn void __dls3(size_t *sp)
+@@ -1078,7 +1102,7 @@ void *__tls_get_new(size_t *v)
+ 	__block_all_sigs(&set);
+ 	if (v[0]<=(size_t)self->dtv[0]) {
+ 		__restore_sigs(&set);
+-		return (char *)self->dtv[v[0]]+v[1];
++		return (char *)self->dtv[v[0]]+v[1]+DTP_OFFSET;
+ 	}
+ 
+ 	/* This is safe without any locks held because, if the caller
+@@ -1111,7 +1135,7 @@ void *__tls_get_new(size_t *v)
+ 		if (p->tls_id == v[0]) break;
+ 	}
+ 	__restore_sigs(&set);
+-	return mem + v[1];
++	return mem + v[1] + DTP_OFFSET;
+ }
+ 
+ static void update_tls_size()
+@@ -1192,6 +1216,17 @@ _Noreturn void __dls3(size_t *sp)
  	char **argv_orig = argv;
  	char **envp = argv+argc+1;
  
@@ -933,7 +1056,7 @@ index 42b056d..7e56693 100644
  	/* Setup early thread pointer in builtin_tls for ldso/libc itself to
  	 * use during dynamic linking. If possible it will also serve as the
  	 * thread pointer at runtime. */
-@@ -1200,25 +1213,11 @@ _Noreturn void __dls3(size_t *sp)
+@@ -1200,25 +1235,11 @@ _Noreturn void __dls3(size_t *sp)
  		a_crash();
  	}
  
@@ -1117,6 +1240,36 @@ index b70a0c1..0fc5ecb 100644
  
  	return old == global ? LC_GLOBAL_LOCALE : old;
  }
+diff --git a/src/malloc/calloc.c b/src/malloc/calloc.c
+index c3dfb47..436c0b0 100644
+--- a/src/malloc/calloc.c
++++ b/src/malloc/calloc.c
+@@ -1,22 +1,13 @@
+ #include <stdlib.h>
+ #include <errno.h>
+ 
++void *__malloc0(size_t);
++
+ void *calloc(size_t m, size_t n)
+ {
+-	void *p;
+-	size_t *z;
+ 	if (n && m > (size_t)-1/n) {
+ 		errno = ENOMEM;
+ 		return 0;
+ 	}
+-	n *= m;
+-	p = malloc(n);
+-	if (!p) return 0;
+-	/* Only do this for non-mmapped chunks */
+-	if (((size_t *)p)[-1] & 7) {
+-		/* Only write words that are not already zero */
+-		m = (n + sizeof *z - 1)/sizeof *z;
+-		for (z=p; m; m--, z++) if (*z) *z=0;
+-	}
+-	return p;
++	return __malloc0(n * m);
+ }
 diff --git a/src/malloc/expand_heap.c b/src/malloc/expand_heap.c
 new file mode 100644
 index 0000000..d8c0be7
@@ -1196,10 +1349,10 @@ index 0000000..d8c0be7
 +	return area;
 +}
 diff --git a/src/malloc/lite_malloc.c b/src/malloc/lite_malloc.c
-index 7643fc2..008549d 100644
+index 7643fc2..09ac575 100644
 --- a/src/malloc/lite_malloc.c
 +++ b/src/malloc/lite_malloc.c
-@@ -4,43 +4,46 @@
+@@ -4,43 +4,47 @@
  #include <errno.h>
  #include "libc.h"
  
@@ -1269,8 +1422,9 @@ index 7643fc2..008549d 100644
  }
  
  weak_alias(__simple_malloc, malloc);
++weak_alias(__simple_malloc, __malloc0);
 diff --git a/src/malloc/malloc.c b/src/malloc/malloc.c
-index d4de2dc..290fda1 100644
+index d4de2dc..eb68d55 100644
 --- a/src/malloc/malloc.c
 +++ b/src/malloc/malloc.c
 @@ -13,7 +13,6 @@
@@ -1394,6 +1548,24 @@ index d4de2dc..290fda1 100644
  }
  
  static int adjust_size(size_t *n)
+@@ -378,6 +356,17 @@ void *malloc(size_t n)
+ 	return CHUNK_TO_MEM(c);
+ }
+ 
++void *__malloc0(size_t n)
++{
++	void *p = malloc(n);
++	if (p && !IS_MMAPPED(MEM_TO_CHUNK(p))) {
++		size_t *z;
++		n = (n + sizeof *z - 1)/sizeof *z;
++		for (z=p; n; n--, z++) if (*z) *z=0;
++	}
++	return p;
++}
++
+ void *realloc(void *p, size_t n)
+ {
+ 	struct chunk *self, *next;
 diff --git a/src/multibyte/btowc.c b/src/multibyte/btowc.c
 index 9d2c3b1..8acd0a2 100644
 --- a/src/multibyte/btowc.c
@@ -2106,6 +2278,92 @@ index ac5c2c2..223aad4 100644
  
  	for (p=fmt; *p; p++) {
  
+diff --git a/src/string/strverscmp.c b/src/string/strverscmp.c
+index 6f37cc6..4daf276 100644
+--- a/src/string/strverscmp.c
++++ b/src/string/strverscmp.c
+@@ -2,40 +2,33 @@
+ #include <ctype.h>
+ #include <string.h>
+ 
+-int strverscmp(const char *l, const char *r)
++int strverscmp(const char *l0, const char *r0)
+ {
+-	int haszero=1;
+-	while (*l==*r) {
+-		if (!*l) return 0;
++	const unsigned char *l = (const void *)l0;
++	const unsigned char *r = (const void *)r0;
++	size_t i, dp, j;
++	int z = 1;
+ 
+-		if (*l=='0') {
+-			if (haszero==1) {
+-				haszero=0;
+-			}
+-		} else if (isdigit(*l)) {
+-			if (haszero==1) {
+-				haszero=2;
+-			}
+-		} else {
+-			haszero=1;
+-		}
+-		l++; r++;
++	/* Find maximal matching prefix and track its maximal digit
++	 * suffix and whether those digits are all zeros. */
++	for (dp=i=0; l[i]==r[i]; i++) {
++		int c = l[i];
++		if (!c) return 0;
++		if (!isdigit(c)) dp=i+1, z=1;
++		else if (c!='0') z=0;
+ 	}
+-	if (haszero==1 && (*l=='0' || *r=='0')) {
+-		haszero=0;
+-	}
+-	if ((isdigit(*l) && isdigit(*r) ) && haszero) {
+-		size_t lenl=0, lenr=0;
+-		while (isdigit(l[lenl]) ) lenl++;
+-		while (isdigit(r[lenr]) ) lenr++;
+-		if (lenl==lenr) {
+-			return (*l -  *r);
+-		} else if (lenl>lenr) {
+-			return 1;
+-		} else {
+-			return -1;
+-		}
+-	} else {
+-		return (*l -  *r);
++
++	if (l[dp]!='0' && r[dp]!='0') {
++		/* If we're not looking at a digit sequence that began
++		 * with a zero, longest digit string is greater. */
++		for (j=i; isdigit(l[j]); j++)
++			if (!isdigit(r[j])) return 1;
++		if (isdigit(r[j])) return -1;
++	} else if (z && dp<i && (isdigit(l[i]) || isdigit(r[i]))) {
++		/* Otherwise, if common prefix of digit sequence is
++		 * all zeros, digits order less than non-digits. */
++		return (unsigned char)(l[i]-'0') - (unsigned char)(r[i]-'0');
+ 	}
++
++	return l[i] - r[i];
+ }
+diff --git a/src/thread/__tls_get_addr.c b/src/thread/__tls_get_addr.c
+index 3633396..84a413d 100644
+--- a/src/thread/__tls_get_addr.c
++++ b/src/thread/__tls_get_addr.c
+@@ -8,9 +8,9 @@ void *__tls_get_addr(size_t *v)
+ 	__attribute__((__visibility__("hidden")))
+ 	void *__tls_get_new(size_t *);
+ 	if (v[0]<=(size_t)self->dtv[0])
+-		return (char *)self->dtv[v[0]]+v[1];
++		return (char *)self->dtv[v[0]]+v[1]+DTP_OFFSET;
+ 	return __tls_get_new(v);
+ #else
+-	return (char *)self->dtv[1]+v[1];
++	return (char *)self->dtv[1]+v[1]+DTP_OFFSET;
+ #endif
+ }
 diff --git a/src/thread/__unmapself.c b/src/thread/__unmapself.c
 index e69de29..1d3bee1 100644
 --- a/src/thread/__unmapself.c
@@ -2263,6 +2521,3 @@ index d865ae3..46c4908 100644
  
  	! work around hardware bug
  	or     r0, r0
--- 
-2.1.4
-