summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Olbrich <m.olbrich@pengutronix.de>2015-11-16 19:23:18 +0100
committerMichael Olbrich <m.olbrich@pengutronix.de>2016-06-22 07:53:33 +0200
commit8f1e74bc8a0ee2d06d944a1c94d5884abd09b7b2 (patch)
tree3579907a2095fca3e0766e037f982cfd5a967999
parent65c27afba3d7287d85818d6a08b6169ebbbdd37b (diff)
downloadOSELAS.Toolchain-8f1e74bc8a0ee2d06d944a1c94d5884abd09b7b2.tar.gz
glibc-2.23 patches
Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
-rw-r--r--patches/glibc-2.23/0001-CVE-2016-3075-Stack-overflow-in-_nss_dns_getnetbynam.patch34
-rw-r--r--patches/glibc-2.23/0002-CVE-2016-3706-getaddrinfo-stack-overflow-in-hostent-.patch181
-rw-r--r--patches/glibc-2.23/0003-glob-Simplify-the-interface-for-the-GLOB_ALTDIRFUNC-.patch207
-rw-r--r--patches/glibc-2.23/0004-CVE-2016-1234-glob-Do-not-copy-d_name-field-of-struc.patch374
-rw-r--r--patches/glibc-2.23/0005-CVE-2016-4429-sunrpc-Do-not-use-alloca-in-clntudp_ca.patch52
-rw-r--r--patches/glibc-2.23/0100-add-install-lib-all-target.patch34
-rw-r--r--patches/glibc-2.23/0101-don-t-regen-docs-if-perl-is-not-found.patch35
-rw-r--r--patches/glibc-2.23/0200-resolv-dynamic.patch47
-rw-r--r--patches/glibc-2.23/0300-optimized-string-functions-for-NEON-from-Linaro.patch699
-rw-r--r--patches/glibc-2.23/0301-add-libc_hidden_builtin_def-for-all-cortex-functions.patch64
-rw-r--r--patches/glibc-2.23/0400-Hack-around-mips-args-to-host-gcc.patch28
-rw-r--r--patches/glibc-2.23/0500-ARM-fix-PI-futex-breakge-glibc-bug-18463.patch33
-rw-r--r--patches/glibc-2.23/series21
13 files changed, 1809 insertions, 0 deletions
diff --git a/patches/glibc-2.23/0001-CVE-2016-3075-Stack-overflow-in-_nss_dns_getnetbynam.patch b/patches/glibc-2.23/0001-CVE-2016-3075-Stack-overflow-in-_nss_dns_getnetbynam.patch
new file mode 100644
index 0000000..0d5f50b
--- /dev/null
+++ b/patches/glibc-2.23/0001-CVE-2016-3075-Stack-overflow-in-_nss_dns_getnetbynam.patch
@@ -0,0 +1,34 @@
+From: Florian Weimer <fweimer@redhat.com>
+Date: Tue, 29 Mar 2016 12:57:56 +0200
+Subject: [PATCH] CVE-2016-3075: Stack overflow in _nss_dns_getnetbyname_r [BZ
+ #19879]
+
+The defensive copy is not needed because the name may not alias the
+output buffer.
+---
+ resolv/nss_dns/dns-network.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
+index 2eb2f67e66a8..8f301a706b30 100644
+--- a/resolv/nss_dns/dns-network.c
++++ b/resolv/nss_dns/dns-network.c
+@@ -118,17 +118,14 @@ _nss_dns_getnetbyname_r (const char *name, struct netent *result,
+ } net_buffer;
+ querybuf *orig_net_buffer;
+ int anslen;
+- char *qbuf;
+ enum nss_status status;
+
+ if (__res_maybe_init (&_res, 0) == -1)
+ return NSS_STATUS_UNAVAIL;
+
+- qbuf = strdupa (name);
+-
+ net_buffer.buf = orig_net_buffer = (querybuf *) alloca (1024);
+
+- anslen = __libc_res_nsearch (&_res, qbuf, C_IN, T_PTR, net_buffer.buf->buf,
++ anslen = __libc_res_nsearch (&_res, name, C_IN, T_PTR, net_buffer.buf->buf,
+ 1024, &net_buffer.ptr, NULL, NULL, NULL, NULL);
+ if (anslen < 0)
+ {
diff --git a/patches/glibc-2.23/0002-CVE-2016-3706-getaddrinfo-stack-overflow-in-hostent-.patch b/patches/glibc-2.23/0002-CVE-2016-3706-getaddrinfo-stack-overflow-in-hostent-.patch
new file mode 100644
index 0000000..20b227c
--- /dev/null
+++ b/patches/glibc-2.23/0002-CVE-2016-3706-getaddrinfo-stack-overflow-in-hostent-.patch
@@ -0,0 +1,181 @@
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 29 Apr 2016 10:35:34 +0200
+Subject: [PATCH] CVE-2016-3706: getaddrinfo: stack overflow in hostent
+ conversion [BZ #20010]
+
+When converting a struct hostent response to struct gaih_addrtuple, the
+gethosts macro (which is called from gaih_inet) used alloca, without
+malloc fallback for large responses. This commit changes this code to
+use calloc unconditionally.
+
+This commit also consolidated a second hostent-to-gaih_addrtuple
+conversion loop (in gaih_inet) to use the new conversion function.
+---
+ sysdeps/posix/getaddrinfo.c | 130 +++++++++++++++++++++++---------------------
+ 1 file changed, 69 insertions(+), 61 deletions(-)
+
+diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
+index 1ef3f20d987b..fed2d3bf130b 100644
+--- a/sysdeps/posix/getaddrinfo.c
++++ b/sysdeps/posix/getaddrinfo.c
+@@ -168,9 +168,58 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
+ return 0;
+ }
+
++/* Convert struct hostent to a list of struct gaih_addrtuple objects.
++ h_name is not copied, and the struct hostent object must not be
++ deallocated prematurely. *RESULT must be NULL or a pointer to an
++ object allocated using malloc, which is freed. */
++static bool
++convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
++ int family,
++ struct hostent *h,
++ struct gaih_addrtuple **result)
++{
++ free (*result);
++ *result = NULL;
++
++ /* Count the number of addresses in h->h_addr_list. */
++ size_t count = 0;
++ for (char **p = h->h_addr_list; *p != NULL; ++p)
++ ++count;
++
++ /* Report no data if no addresses are available, or if the incoming
++ address size is larger than what we can store. */
++ if (count == 0 || h->h_length > sizeof (((struct gaih_addrtuple) {}).addr))
++ return true;
++
++ struct gaih_addrtuple *array = calloc (count, sizeof (*array));
++ if (array == NULL)
++ return false;
++
++ for (size_t i = 0; i < count; ++i)
++ {
++ if (family == AF_INET && req->ai_family == AF_INET6)
++ {
++ /* Perform address mapping. */
++ array[i].family = AF_INET6;
++ memcpy(array[i].addr + 3, h->h_addr_list[i], sizeof (uint32_t));
++ array[i].addr[2] = htonl (0xffff);
++ }
++ else
++ {
++ array[i].family = family;
++ memcpy (array[i].addr, h->h_addr_list[i], h->h_length);
++ }
++ array[i].next = array + i + 1;
++ }
++ array[0].name = h->h_name;
++ array[count - 1].next = NULL;
++
++ *result = array;
++ return true;
++}
++
+ #define gethosts(_family, _type) \
+ { \
+- int i; \
+ int herrno; \
+ struct hostent th; \
+ struct hostent *h; \
+@@ -219,36 +268,23 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
+ } \
+ else if (h != NULL) \
+ { \
+- for (i = 0; h->h_addr_list[i]; i++) \
++ /* Make sure that addrmem can be freed. */ \
++ if (!malloc_addrmem) \
++ addrmem = NULL; \
++ if (!convert_hostent_to_gaih_addrtuple (req, _family,h, &addrmem)) \
+ { \
+- if (*pat == NULL) \
+- { \
+- *pat = __alloca (sizeof (struct gaih_addrtuple)); \
+- (*pat)->scopeid = 0; \
+- } \
+- uint32_t *addr = (*pat)->addr; \
+- (*pat)->next = NULL; \
+- (*pat)->name = i == 0 ? strdupa (h->h_name) : NULL; \
+- if (_family == AF_INET && req->ai_family == AF_INET6) \
+- { \
+- (*pat)->family = AF_INET6; \
+- addr[3] = *(uint32_t *) h->h_addr_list[i]; \
+- addr[2] = htonl (0xffff); \
+- addr[1] = 0; \
+- addr[0] = 0; \
+- } \
+- else \
+- { \
+- (*pat)->family = _family; \
+- memcpy (addr, h->h_addr_list[i], sizeof(_type)); \
+- } \
+- pat = &((*pat)->next); \
++ _res.options |= old_res_options & RES_USE_INET6; \
++ result = -EAI_SYSTEM; \
++ goto free_and_return; \
+ } \
++ *pat = addrmem; \
++ /* The conversion uses malloc unconditionally. */ \
++ malloc_addrmem = true; \
+ \
+ if (localcanon != NULL && canon == NULL) \
+ canon = strdupa (localcanon); \
+ \
+- if (_family == AF_INET6 && i > 0) \
++ if (_family == AF_INET6 && *pat != NULL) \
+ got_ipv6 = true; \
+ } \
+ }
+@@ -612,44 +648,16 @@ gaih_inet (const char *name, const struct gaih_service *service,
+ {
+ if (h != NULL)
+ {
+- int i;
+- /* We found data, count the number of addresses. */
+- for (i = 0; h->h_addr_list[i]; ++i)
+- ;
+- if (i > 0 && *pat != NULL)
+- --i;
+-
+- if (__libc_use_alloca (alloca_used
+- + i * sizeof (struct gaih_addrtuple)))
+- addrmem = alloca_account (i * sizeof (struct gaih_addrtuple),
+- alloca_used);
+- else
+- {
+- addrmem = malloc (i
+- * sizeof (struct gaih_addrtuple));
+- if (addrmem == NULL)
+- {
+- result = -EAI_MEMORY;
+- goto free_and_return;
+- }
+- malloc_addrmem = true;
+- }
+-
+- /* Now convert it into the list. */
+- struct gaih_addrtuple *addrfree = addrmem;
+- for (i = 0; h->h_addr_list[i]; ++i)
++ /* We found data, convert it. */
++ if (!convert_hostent_to_gaih_addrtuple
++ (req, AF_INET, h, &addrmem))
+ {
+- if (*pat == NULL)
+- {
+- *pat = addrfree++;
+- (*pat)->scopeid = 0;
+- }
+- (*pat)->next = NULL;
+- (*pat)->family = AF_INET;
+- memcpy ((*pat)->addr, h->h_addr_list[i],
+- h->h_length);
+- pat = &((*pat)->next);
++ result = -EAI_MEMORY;
++ goto free_and_return;
+ }
++ *pat = addrmem;
++ /* The conversion uses malloc unconditionally. */
++ malloc_addrmem = true;
+ }
+ }
+ else
diff --git a/patches/glibc-2.23/0003-glob-Simplify-the-interface-for-the-GLOB_ALTDIRFUNC-.patch b/patches/glibc-2.23/0003-glob-Simplify-the-interface-for-the-GLOB_ALTDIRFUNC-.patch
new file mode 100644
index 0000000..7787ccf
--- /dev/null
+++ b/patches/glibc-2.23/0003-glob-Simplify-the-interface-for-the-GLOB_ALTDIRFUNC-.patch
@@ -0,0 +1,207 @@
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 29 Apr 2016 09:33:07 +0200
+Subject: [PATCH] glob: Simplify the interface for the GLOB_ALTDIRFUNC callback
+ gl_readdir
+
+Previously, application code had to set up the d_namlen member if
+the target supported it, involving conditional compilation. After
+this change, glob will use the length of the string in d_name instead
+of d_namlen to determine the file name length. All glibc targets
+provide the d_type and d_ino members, and setting them as needed for
+gl_readdir is straightforward.
+
+Changing the behavior with regards to d_ino is left to a future
+cleanup.
+---
+ manual/examples/mkdirent.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ manual/pattern.texi | 39 ++++++++++++++++++++++++++++++++++++++-
+ posix/bug-glob2.c | 2 +-
+ posix/glob.c | 24 +++---------------------
+ 4 files changed, 84 insertions(+), 23 deletions(-)
+ create mode 100644 manual/examples/mkdirent.c
+
+diff --git a/manual/examples/mkdirent.c b/manual/examples/mkdirent.c
+new file mode 100644
+index 000000000000..f8400f46d756
+--- /dev/null
++++ b/manual/examples/mkdirent.c
+@@ -0,0 +1,42 @@
++/* Example for creating a struct dirent object for use with glob.
++ Copyright (C) 2016 Free Software Foundation, Inc.
++
++ This program is free software; you can redistribute it and/or
++ modify it under the terms of the GNU General Public License
++ as published by the Free Software Foundation; either version 2
++ of the License, or (at your option) any later version.
++
++ This program is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ GNU General Public License for more details.
++
++ You should have received a copy of the GNU General Public License
++ along with this program; if not, if not, see <http://www.gnu.org/licenses/>.
++*/
++
++#include <dirent.h>
++#include <errno.h>
++#include <stddef.h>
++#include <stdlib.h>
++#include <string.h>
++
++struct dirent *
++mkdirent (const char *name)
++{
++ size_t dirent_size = offsetof (struct dirent, d_name) + 1;
++ size_t name_length = strlen (name);
++ size_t total_size = dirent_size + name_length;
++ if (total_size < dirent_size)
++ {
++ errno = ENOMEM;
++ return NULL;
++ }
++ struct dirent *result = malloc (total_size);
++ if (result == NULL)
++ return NULL;
++ result->d_type = DT_UNKNOWN;
++ result->d_ino = 1; /* Do not skip this entry. */
++ memcpy (result->d_name, name, name_length + 1);
++ return result;
++}
+diff --git a/manual/pattern.texi b/manual/pattern.texi
+index d1b9275cf9c7..565e7eb6d4b4 100644
+--- a/manual/pattern.texi
++++ b/manual/pattern.texi
+@@ -237,7 +237,44 @@ function used to read the contents of a directory. It is used if the
+ @code{GLOB_ALTDIRFUNC} bit is set in the flag parameter. The type of
+ this field is @w{@code{struct dirent *(*) (void *)}}.
+
+-This is a GNU extension.
++An implementation of @code{gl_readdir} needs to initialize the following
++members of the @code{struct dirent} object:
++
++@table @code
++@item d_type
++This member should be set to the file type of the entry if it is known.
++Otherwise, the value @code{DT_UNKNOWN} can be used. The @code{glob}
++function may use the specified file type to avoid callbacks in cases
++where the file type indicates that the data is not required.
++
++@item d_ino
++This member needs to be non-zero, otherwise @code{glob} may skip the
++current entry and call the @code{gl_readdir} callback function again to
++retrieve another entry.
++
++@item d_name
++This member must be set to the name of the entry. It must be
++null-terminated.
++@end table
++
++The example below shows how to allocate a @code{struct dirent} object
++containing a given name.
++
++@smallexample
++@include mkdirent.c.texi
++@end smallexample
++
++The @code{glob} function reads the @code{struct dirent} members listed
++above and makes a copy of the file name in the @code{d_name} member
++immediately after the @code{gl_readdir} callback function returns.
++Future invocations of any of the callback functions may dealloacte or
++reuse the buffer. It is the responsibility of the caller of the
++@code{glob} function to allocate and deallocate the buffer, around the
++call to @code{glob} or using the callback functions. For example, an
++application could allocate the buffer in the @code{gl_readdir} callback
++function, and deallocate it in the @code{gl_closedir} callback function.
++
++The @code{gl_readdir} member is a GNU extension.
+
+ @item gl_opendir
+ The address of an alternative implementation of the @code{opendir}
+diff --git a/posix/bug-glob2.c b/posix/bug-glob2.c
+index ddf5ec913bcf..0fdc5d0a53c3 100644
+--- a/posix/bug-glob2.c
++++ b/posix/bug-glob2.c
+@@ -193,7 +193,7 @@ my_readdir (void *gdir)
+ return NULL;
+ }
+
+- dir->d.d_ino = dir->idx;
++ dir->d.d_ino = 1; /* glob should not skip this entry. */
+
+ #ifdef _DIRENT_HAVE_D_TYPE
+ dir->d.d_type = filesystem[dir->idx].type;
+diff --git a/posix/glob.c b/posix/glob.c
+index 0c04c3ccfdea..9ae76ac222d2 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -57,10 +57,8 @@
+
+ #if defined HAVE_DIRENT_H || defined __GNU_LIBRARY__
+ # include <dirent.h>
+-# define NAMLEN(dirent) strlen((dirent)->d_name)
+ #else
+ # define dirent direct
+-# define NAMLEN(dirent) (dirent)->d_namlen
+ # ifdef HAVE_SYS_NDIR_H
+ # include <sys/ndir.h>
+ # endif
+@@ -76,12 +74,6 @@
+ #endif
+
+
+-/* In GNU systems, <dirent.h> defines this macro for us. */
+-#ifdef _D_NAMLEN
+-# undef NAMLEN
+-# define NAMLEN(d) _D_NAMLEN(d)
+-#endif
+-
+ /* When used in the GNU libc the symbol _DIRENT_HAVE_D_TYPE is available
+ if the `d_type' member for `struct dirent' is available.
+ HAVE_STRUCT_DIRENT_D_TYPE plays the same role in GNULIB. */
+@@ -105,12 +97,6 @@
+
+ /* If the system has the `struct dirent64' type we use it internally. */
+ #if defined _LIBC && !defined COMPILE_GLOB64
+-# if defined HAVE_DIRENT_H || defined __GNU_LIBRARY__
+-# define CONVERT_D_NAMLEN(d64, d32)
+-# else
+-# define CONVERT_D_NAMLEN(d64, d32) \
+- (d64)->d_namlen = (d32)->d_namlen;
+-# endif
+
+ # if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
+ # define CONVERT_D_INO(d64, d32)
+@@ -127,8 +113,7 @@
+ # endif
+
+ # define CONVERT_DIRENT_DIRENT64(d64, d32) \
+- memcpy ((d64)->d_name, (d32)->d_name, NAMLEN (d32) + 1); \
+- CONVERT_D_NAMLEN (d64, d32) \
++ strcpy ((d64)->d_name, (d32)->d_name); \
+ CONVERT_D_INO (d64, d32) \
+ CONVERT_D_TYPE (d64, d32)
+ #endif
+@@ -1554,7 +1539,6 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
+ while (1)
+ {
+ const char *name;
+- size_t len;
+ #if defined _LIBC && !defined COMPILE_GLOB64
+ struct dirent64 *d;
+ union
+@@ -1622,12 +1606,10 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
+ names = newnames;
+ cur = 0;
+ }
+- len = NAMLEN (d);
+- names->name[cur] = (char *) malloc (len + 1);
++ names->name[cur] = strdup (d->d_name);
+ if (names->name[cur] == NULL)
+ goto memory_error;
+- *((char *) mempcpy (names->name[cur++], name, len))
+- = '\0';
++ ++cur;
+ ++nfound;
+ }
+ }
diff --git a/patches/glibc-2.23/0004-CVE-2016-1234-glob-Do-not-copy-d_name-field-of-struc.patch b/patches/glibc-2.23/0004-CVE-2016-1234-glob-Do-not-copy-d_name-field-of-struc.patch
new file mode 100644
index 0000000..6668c7d
--- /dev/null
+++ b/patches/glibc-2.23/0004-CVE-2016-1234-glob-Do-not-copy-d_name-field-of-struc.patch
@@ -0,0 +1,374 @@
+From: Florian Weimer <fweimer@redhat.com>
+Date: Wed, 4 May 2016 12:09:35 +0200
+Subject: [PATCH] CVE-2016-1234: glob: Do not copy d_name field of struct
+ dirent [BZ #19779]
+
+Instead, we store the data we need from the return value of
+readdir in an object of the new type struct readdir_result.
+This type is independent of the layout of struct dirent.
+---
+ posix/bug-glob2.c | 14 ++-
+ posix/glob.c | 223 +++++++++++++++++++---------------
+ sysdeps/unix/sysv/linux/i386/glob64.c | 22 ++++
+ 3 files changed, 159 insertions(+), 100 deletions(-)
+
+diff --git a/posix/bug-glob2.c b/posix/bug-glob2.c
+index 0fdc5d0a53c3..5873e08550e8 100644
+--- a/posix/bug-glob2.c
++++ b/posix/bug-glob2.c
+@@ -40,6 +40,17 @@
+ # define PRINTF(fmt, args...)
+ #endif
+
++#define LONG_NAME \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+
+ static struct
+ {
+@@ -58,6 +69,7 @@ static struct
+ { ".", 3, DT_DIR, 0755 },
+ { "..", 3, DT_DIR, 0755 },
+ { "a", 3, DT_REG, 0644 },
++ { LONG_NAME, 3, DT_REG, 0644 },
+ { "unreadable", 2, DT_DIR, 0111 },
+ { ".", 3, DT_DIR, 0111 },
+ { "..", 3, DT_DIR, 0755 },
+@@ -75,7 +87,7 @@ typedef struct
+ int level;
+ int idx;
+ struct dirent d;
+- char room_for_dirent[NAME_MAX];
++ char room_for_dirent[sizeof (LONG_NAME)];
+ } my_DIR;
+
+
+diff --git a/posix/glob.c b/posix/glob.c
+index 9ae76ac222d2..ea4b0b61eb17 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -24,7 +24,9 @@
+ #include <errno.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#include <stdbool.h>
+ #include <stddef.h>
++#include <stdint.h>
+
+ /* Outcomment the following line for production quality code. */
+ /* #define NDEBUG 1 */
+@@ -73,69 +75,8 @@
+ # endif /* HAVE_VMSDIR_H */
+ #endif
+
+-
+-/* When used in the GNU libc the symbol _DIRENT_HAVE_D_TYPE is available
+- if the `d_type' member for `struct dirent' is available.
+- HAVE_STRUCT_DIRENT_D_TYPE plays the same role in GNULIB. */
+-#if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
+-/* True if the directory entry D must be of type T. */
+-# define DIRENT_MUST_BE(d, t) ((d)->d_type == (t))
+-
+-/* True if the directory entry D might be a symbolic link. */
+-# define DIRENT_MIGHT_BE_SYMLINK(d) \
+- ((d)->d_type == DT_UNKNOWN || (d)->d_type == DT_LNK)
+-
+-/* True if the directory entry D might be a directory. */
+-# define DIRENT_MIGHT_BE_DIR(d) \
+- ((d)->d_type == DT_DIR || DIRENT_MIGHT_BE_SYMLINK (d))
+-
+-#else /* !HAVE_D_TYPE */
+-# define DIRENT_MUST_BE(d, t) false
+-# define DIRENT_MIGHT_BE_SYMLINK(d) true
+-# define DIRENT_MIGHT_BE_DIR(d) true
+-#endif /* HAVE_D_TYPE */
+-
+-/* If the system has the `struct dirent64' type we use it internally. */
+-#if defined _LIBC && !defined COMPILE_GLOB64
+-
+-# if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
+-# define CONVERT_D_INO(d64, d32)
+-# else
+-# define CONVERT_D_INO(d64, d32) \
+- (d64)->d_ino = (d32)->d_ino;
+-# endif
+-
+-# ifdef _DIRENT_HAVE_D_TYPE
+-# define CONVERT_D_TYPE(d64, d32) \
+- (d64)->d_type = (d32)->d_type;
+-# else
+-# define CONVERT_D_TYPE(d64, d32)
+-# endif
+-
+-# define CONVERT_DIRENT_DIRENT64(d64, d32) \
+- strcpy ((d64)->d_name, (d32)->d_name); \
+- CONVERT_D_INO (d64, d32) \
+- CONVERT_D_TYPE (d64, d32)
+-#endif
+-
+-
+-#if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
+-/* Posix does not require that the d_ino field be present, and some
+- systems do not provide it. */
+-# define REAL_DIR_ENTRY(dp) 1
+-#else
+-# define REAL_DIR_ENTRY(dp) (dp->d_ino != 0)
+-#endif /* POSIX */
+-
+ #include <stdlib.h>
+ #include <string.h>
+-
+-/* NAME_MAX is usually defined in <dirent.h> or <limits.h>. */
+-#include <limits.h>
+-#ifndef NAME_MAX
+-# define NAME_MAX (sizeof (((struct dirent *) 0)->d_name))
+-#endif
+-
+ #include <alloca.h>
+
+ #ifdef _LIBC
+@@ -180,8 +121,111 @@
+
+ static const char *next_brace_sub (const char *begin, int flags) __THROWNL;
+
++/* A representation of a directory entry which does not depend on the
++ layout of struct dirent, or the size of ino_t. */
++struct readdir_result
++{
++ const char *name;
++# if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
++ uint8_t type;
++# endif
++ bool skip_entry;
++};
++
++# if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
++/* Initializer based on the d_type member of struct dirent. */
++# define D_TYPE_TO_RESULT(source) (source)->d_type,
++
++/* True if the directory entry D might be a symbolic link. */
++static bool
++readdir_result_might_be_symlink (struct readdir_result d)
++{
++ return d.type == DT_UNKNOWN || d.type == DT_LNK;
++}
++
++/* True if the directory entry D might be a directory. */
++static bool
++readdir_result_might_be_dir (struct readdir_result d)
++{
++ return d.type == DT_DIR || readdir_result_might_be_symlink (d);
++}
++# else /* defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE */
++# define D_TYPE_TO_RESULT(source)
++
++/* If we do not have type information, symbolic links and directories
++ are always a possibility. */
++
++static bool
++readdir_result_might_be_symlink (struct readdir_result d)
++{
++ return true;
++}
++
++static bool
++readdir_result_might_be_dir (struct readdir_result d)
++{
++ return true;
++}
++
++# endif /* defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE */
++
++# if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
++/* Initializer for skip_entry. POSIX does not require that the d_ino
++ field be present, and some systems do not provide it. */
++# define D_INO_TO_RESULT(source) false,
++# else
++# define D_INO_TO_RESULT(source) (source)->d_ino == 0,
++# endif
++
++/* Construct an initializer for a struct readdir_result object from a
++ struct dirent *. No copy of the name is made. */
++#define READDIR_RESULT_INITIALIZER(source) \
++ { \
++ source->d_name, \
++ D_TYPE_TO_RESULT (source) \
++ D_INO_TO_RESULT (source) \
++ }
++
+ #endif /* !defined _LIBC || !defined GLOB_ONLY_P */
+
++/* Call gl_readdir on STREAM. This macro can be overridden to reduce
++ type safety if an old interface version needs to be supported. */
++#ifndef GL_READDIR
++# define GL_READDIR(pglob, stream) ((pglob)->gl_readdir (stream))
++#endif
++
++/* Extract name and type from directory entry. No copy of the name is
++ made. If SOURCE is NULL, result name is NULL. Keep in sync with
++ convert_dirent64 below. */
++static struct readdir_result
++convert_dirent (const struct dirent *source)
++{
++ if (source == NULL)
++ {
++ struct readdir_result result = { NULL, };
++ return result;
++ }
++ struct readdir_result result = READDIR_RESULT_INITIALIZER (source);
++ return result;
++}
++
++#ifndef COMPILE_GLOB64
++/* Like convert_dirent, but works on struct dirent64 instead. Keep in
++ sync with convert_dirent above. */
++static struct readdir_result
++convert_dirent64 (const struct dirent64 *source)
++{
++ if (source == NULL)
++ {
++ struct readdir_result result = { NULL, };
++ return result;
++ }
++ struct readdir_result result = READDIR_RESULT_INITIALIZER (source);
++ return result;
++}
++#endif
++
++
+ #ifndef attribute_hidden
+ # define attribute_hidden
+ #endif
+@@ -1538,55 +1582,36 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
+
+ while (1)
+ {
+- const char *name;
+-#if defined _LIBC && !defined COMPILE_GLOB64
+- struct dirent64 *d;
+- union
+- {
+- struct dirent64 d64;
+- char room [offsetof (struct dirent64, d_name[0])
+- + NAME_MAX + 1];
+- }
+- d64buf;
+-
+- if (__glibc_unlikely (flags & GLOB_ALTDIRFUNC))
+- {
+- struct dirent *d32 = (*pglob->gl_readdir) (stream);
+- if (d32 != NULL)
+- {
+- CONVERT_DIRENT_DIRENT64 (&d64buf.d64, d32);
+- d = &d64buf.d64;
+- }
+- else
+- d = NULL;
+- }
+- else
+- d = __readdir64 (stream);
++ struct readdir_result d;
++ {
++ if (__builtin_expect (flags & GLOB_ALTDIRFUNC, 0))
++ d = convert_dirent (GL_READDIR (pglob, stream));
++ else
++ {
++#ifdef COMPILE_GLOB64
++ d = convert_dirent (__readdir (stream));
+ #else
+- struct dirent *d = (__builtin_expect (flags & GLOB_ALTDIRFUNC, 0)
+- ? ((struct dirent *)
+- (*pglob->gl_readdir) (stream))
+- : __readdir (stream));
++ d = convert_dirent64 (__readdir64 (stream));
+ #endif
+- if (d == NULL)
++ }
++ }
++ if (d.name == NULL)
+ break;
+- if (! REAL_DIR_ENTRY (d))
++ if (d.skip_entry)
+ continue;
+
+ /* If we shall match only directories use the information
+ provided by the dirent call if possible. */
+- if ((flags & GLOB_ONLYDIR) && !DIRENT_MIGHT_BE_DIR (d))
++ if ((flags & GLOB_ONLYDIR) && !readdir_result_might_be_dir (d))
+ continue;
+
+- name = d->d_name;
+-
+- if (fnmatch (pattern, name, fnm_flags) == 0)
++ if (fnmatch (pattern, d.name, fnm_flags) == 0)
+ {
+ /* If the file we found is a symlink we have to
+ make sure the target file exists. */
+- if (!DIRENT_MIGHT_BE_SYMLINK (d)
+- || link_exists_p (dfd, directory, dirlen, name, pglob,
+- flags))
++ if (!readdir_result_might_be_symlink (d)
++ || link_exists_p (dfd, directory, dirlen, d.name,
++ pglob, flags))
+ {
+ if (cur == names->count)
+ {
+@@ -1606,7 +1631,7 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
+ names = newnames;
+ cur = 0;
+ }
+- names->name[cur] = strdup (d->d_name);
++ names->name[cur] = strdup (d.name);
+ if (names->name[cur] == NULL)
+ goto memory_error;
+ ++cur;
+diff --git a/sysdeps/unix/sysv/linux/i386/glob64.c b/sysdeps/unix/sysv/linux/i386/glob64.c
+index b4fcd1a73c77..802c957d6c26 100644
+--- a/sysdeps/unix/sysv/linux/i386/glob64.c
++++ b/sysdeps/unix/sysv/linux/i386/glob64.c
+@@ -1,3 +1,21 @@
++/* Two glob variants with 64-bit support, for dirent64 and __olddirent64.
++ Copyright (C) 1998-2016 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <http://www.gnu.org/licenses/>. */
++
+ #include <dirent.h>
+ #include <glob.h>
+ #include <sys/stat.h>
+@@ -38,11 +56,15 @@ int __old_glob64 (const char *__pattern, int __flags,
+
+ #undef dirent
+ #define dirent __old_dirent64
++#undef GL_READDIR
++# define GL_READDIR(pglob, stream) \
++ ((struct __old_dirent64 *) (pglob)->gl_readdir (stream))
+ #undef __readdir
+ #define __readdir(dirp) __old_readdir64 (dirp)
+ #undef glob
+ #define glob(pattern, flags, errfunc, pglob) \
+ __old_glob64 (pattern, flags, errfunc, pglob)
++#define convert_dirent __old_convert_dirent
+ #define glob_in_dir __old_glob_in_dir
+ #define GLOB_ATTRIBUTE attribute_compat_text_section
+
diff --git a/patches/glibc-2.23/0005-CVE-2016-4429-sunrpc-Do-not-use-alloca-in-clntudp_ca.patch b/patches/glibc-2.23/0005-CVE-2016-4429-sunrpc-Do-not-use-alloca-in-clntudp_ca.patch
new file mode 100644
index 0000000..ebb3cd4
--- /dev/null
+++ b/patches/glibc-2.23/0005-CVE-2016-4429-sunrpc-Do-not-use-alloca-in-clntudp_ca.patch
@@ -0,0 +1,52 @@
+From: Florian Weimer <fweimer@redhat.com>
+Date: Mon, 23 May 2016 20:18:34 +0200
+Subject: [PATCH] CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call [BZ
+ #20112]
+
+The call is technically in a loop, and under certain circumstances
+(which are quite difficult to reproduce in a test case), alloca
+can be invoked repeatedly during a single call to clntudp_call.
+As a result, the available stack space can be exhausted (even
+though individual alloca sizes are bounded implicitly by what
+can fit into a UDP packet, as a side effect of the earlier
+successful send operation).
+
+(cherry picked from commit bc779a1a5b3035133024b21e2f339fe4219fb11c)
+---
+ sunrpc/clnt_udp.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/sunrpc/clnt_udp.c b/sunrpc/clnt_udp.c
+index a6cf5f1ca733..4d9acb1e6a6b 100644
+--- a/sunrpc/clnt_udp.c
++++ b/sunrpc/clnt_udp.c
+@@ -388,9 +388,15 @@ send_again:
+ struct sock_extended_err *e;
+ struct sockaddr_in err_addr;
+ struct iovec iov;
+- char *cbuf = (char *) alloca (outlen + 256);
++ char *cbuf = malloc (outlen + 256);
+ int ret;
+
++ if (cbuf == NULL)
++ {
++ cu->cu_error.re_errno = errno;
++ return (cu->cu_error.re_status = RPC_CANTRECV);
++ }
++
+ iov.iov_base = cbuf + 256;
+ iov.iov_len = outlen;
+ msg.msg_name = (void *) &err_addr;
+@@ -415,10 +421,12 @@ send_again:
+ cmsg = CMSG_NXTHDR (&msg, cmsg))
+ if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVERR)
+ {
++ free (cbuf);
+ e = (struct sock_extended_err *) CMSG_DATA(cmsg);
+ cu->cu_error.re_errno = e->ee_errno;
+ return (cu->cu_error.re_status = RPC_CANTRECV);
+ }
++ free (cbuf);
+ }
+ #endif
+ do
diff --git a/patches/glibc-2.23/0100-add-install-lib-all-target.patch b/patches/glibc-2.23/0100-add-install-lib-all-target.patch
new file mode 100644
index 0000000..99fdf06
--- /dev/null
+++ b/patches/glibc-2.23/0100-add-install-lib-all-target.patch
@@ -0,0 +1,34 @@
+From: Michael Olbrich <m.olbrich@pengutronix.de>
+Date: Tue, 1 Nov 2011 19:22:27 +0100
+Subject: [PATCH] add install-lib-all target
+
+From http://svn.exactcode.de/t2/trunk/package/base/glibc32/make-install-lib-all.patch
+
+Rule to install all needed libraries, not just the ones installed by install-lib,
+yet not install programs.
+Needed because we can't use the main install target, as we can't build programs before
+we have the final gcc installed; linking fails because libeh.a is not present,
+and glibc insists on linking programs with that library.
+
+Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
+---
+ Makerules | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/Makerules b/Makerules
+index 53eabfaba82a..9d960628f2c8 100644
+--- a/Makerules
++++ b/Makerules
+@@ -917,6 +917,12 @@ installed-libcs := $(foreach o,$(filter-out .os,$(object-suffixes-for-libc)),\
+ $(inst_libdir)/$(patsubst %,$(libtype$o),\
+ $(libprefix)$(libc-name)))
+
++install-lib-all: $(inst_slibdir)/libc.so$(libc.so-version) \
++ $(inst_slibdir)/libc-$(version).so \
++ $(inst_libdir)/libc.so \
++ $(inst_libdir)/libc.a \
++ install-lib
++
+ .PHONY: check-install-supported
+ check-install-supported:
+
diff --git a/patches/glibc-2.23/0101-don-t-regen-docs-if-perl-is-not-found.patch b/patches/glibc-2.23/0101-don-t-regen-docs-if-perl-is-not-found.patch
new file mode 100644
index 0000000..378770a
--- /dev/null
+++ b/patches/glibc-2.23/0101-don-t-regen-docs-if-perl-is-not-found.patch
@@ -0,0 +1,35 @@
+From: Michael Olbrich <m.olbrich@pengutronix.de>
+Date: Wed, 2 Nov 2011 00:14:37 +0100
+Subject: [PATCH] don't regen docs if perl is not found
+
+If we're using a cvs snapshot which updates the source files, and
+perl isn't installed yet, then we can't regen the docs. Not a big
+deal, so just whine a little and continue on our merry way.
+
+This patch was taken from gentoo.
+http://bugs.gentoo.org/60132
+
+Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
+---
+ manual/Makefile | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/manual/Makefile b/manual/Makefile
+index f2f694fa28a3..688d9e20fc41 100644
+--- a/manual/Makefile
++++ b/manual/Makefile
+@@ -104,9 +104,14 @@ $(objpfx)dir-add.texi: xtract-typefun.awk $(texis-path)
+ $(objpfx)libm-err.texi: $(objpfx)stamp-libm-err
+ $(objpfx)stamp-libm-err: libm-err-tab.pl $(wildcard $(foreach dir,$(sysdirs),\
+ $(dir)/libm-test-ulps))
++ifneq ($(PERL),no)
+ pwd=`pwd`; \
+ $(PERL) $< $$pwd/.. > $(objpfx)libm-err-tmp
+ $(move-if-change) $(objpfx)libm-err-tmp $(objpfx)libm-err.texi
++else
++ echo "Unable to rebuild math docs, no perl installed"
++ touch libm-err.texi
++endif
+ touch $@
+
+ # Package version and bug reporting URL.
diff --git a/patches/glibc-2.23/0200-resolv-dynamic.patch b/patches/glibc-2.23/0200-resolv-dynamic.patch
new file mode 100644
index 0000000..e47dfd7
--- /dev/null
+++ b/patches/glibc-2.23/0200-resolv-dynamic.patch
@@ -0,0 +1,47 @@
+From: unknown author <unknown.author@example.com>
+Date: Tue, 1 Nov 2011 18:58:26 +0100
+Subject: [PATCH] resolv dynamic
+
+ripped from SuSE
+
+if /etc/resolv.conf is updated, then make sure applications
+already running get the updated information.
+
+http://bugs.gentoo.org/177416
+---
+ resolv/res_libc.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/resolv/res_libc.c b/resolv/res_libc.c
+index a8394e0e7bc7..d25f54f0fc9f 100644
+--- a/resolv/res_libc.c
++++ b/resolv/res_libc.c
+@@ -22,6 +22,7 @@
+ #include <arpa/nameser.h>
+ #include <resolv.h>
+ #include <libc-lock.h>
++#include <sys/stat.h>
+
+
+ /* The following bit is copied from res_data.c (where it is #ifdef'ed
+@@ -95,6 +96,20 @@ int
+ __res_maybe_init (res_state resp, int preinit)
+ {
+ if (resp->options & RES_INIT) {
++ static time_t last_mtime, last_check;
++ time_t now;
++ struct stat statbuf;
++
++ time (&now);
++ if (now != last_check) {
++ last_check = now;
++ if (stat (_PATH_RESCONF, &statbuf) == 0 && last_mtime != statbuf.st_mtime) {
++ last_mtime = statbuf.st_mtime;
++ atomicinclock (lock);
++ atomicinc (__res_initstamp);
++ atomicincunlock (lock);
++ }
++ }
+ if (__res_initstamp != resp->_u._ext.initstamp) {
+ if (resp->nscount > 0)
+ __res_iclose (resp, true);
diff --git a/patches/glibc-2.23/0300-optimized-string-functions-for-NEON-from-Linaro.patch b/patches/glibc-2.23/0300-optimized-string-functions-for-NEON-from-Linaro.patch
new file mode 100644
index 0000000..f823c45
--- /dev/null
+++ b/patches/glibc-2.23/0300-optimized-string-functions-for-NEON-from-Linaro.patch
@@ -0,0 +1,699 @@
+From: Michael Olbrich <m.olbrich@pengutronix.de>
+Date: Thu, 15 Sep 2011 16:50:56 +0200
+Subject: [PATCH] optimized string functions for NEON from Linaro
+
+Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
+---
+ cortex-strings/sysdeps/arm/armv7/memchr.S | 155 ++++++++++++++++++++++++++++++
+ cortex-strings/sysdeps/arm/armv7/memcpy.S | 152 +++++++++++++++++++++++++++++
+ cortex-strings/sysdeps/arm/armv7/memset.S | 118 +++++++++++++++++++++++
+ cortex-strings/sysdeps/arm/armv7/strchr.S | 76 +++++++++++++++
+ cortex-strings/sysdeps/arm/armv7/strlen.S | 150 +++++++++++++++++++++++++++++
+ 5 files changed, 651 insertions(+)
+ create mode 100644 cortex-strings/sysdeps/arm/armv7/memchr.S
+ create mode 100644 cortex-strings/sysdeps/arm/armv7/memcpy.S
+ create mode 100644 cortex-strings/sysdeps/arm/armv7/memset.S
+ create mode 100644 cortex-strings/sysdeps/arm/armv7/strchr.S
+ create mode 100644 cortex-strings/sysdeps/arm/armv7/strlen.S
+
+diff --git a/cortex-strings/sysdeps/arm/armv7/memchr.S b/cortex-strings/sysdeps/arm/armv7/memchr.S
+new file mode 100644
+index 000000000000..92a2d9f0967d
+--- /dev/null
++++ b/cortex-strings/sysdeps/arm/armv7/memchr.S
+@@ -0,0 +1,155 @@
++/* Copyright (c) 2010-2011, Linaro Limited
++ All rights reserved.
++
++ Redistribution and use in source and binary forms, with or without
++ modification, are permitted provided that the following conditions
++ are met:
++
++ * Redistributions of source code must retain the above copyright
++ notice, this list of conditions and the following disclaimer.
++
++ * Redistributions in binary form must reproduce the above copyright
++ notice, this list of conditions and the following disclaimer in the
++ documentation and/or other materials provided with the distribution.
++
++ * Neither the name of Linaro Limited nor the names of its
++ contributors may be used to endorse or promote products derived
++ from this software without specific prior written permission.
++
++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++/*
++ Written by Dave Gilbert <david.gilbert@linaro.org>
++
++ This memchr routine is optimised on a Cortex-A9 and should work on
++ all ARMv7 processors. It has a fast past for short sizes, and has
++ an optimised path for large data sets; the worst case is finding the
++ match early in a large data set.
++
++ */
++
++@ 2011-02-07 david.gilbert@linaro.org
++@ Extracted from local git a5b438d861
++@ 2011-07-14 david.gilbert@linaro.org
++@ Import endianness fix from local git ea786f1b
++@ 2011-12-07 david.gilbert@linaro.org
++@ Removed unneeded cbz from align loop
++
++ .syntax unified
++ .arch armv7-a
++
++@ this lets us check a flag in a 00/ff byte easily in either endianness
++#ifdef __ARMEB__
++#define CHARTSTMASK(c) 1<<(31-(c*8))
++#else
++#define CHARTSTMASK(c) 1<<(c*8)
++#endif
++ .text
++ .thumb
++
++@ ---------------------------------------------------------------------------
++ .thumb_func
++ .align 2
++ .p2align 4,,15
++ .global memchr
++ .type memchr,%function
++memchr:
++ @ r0 = start of memory to scan
++ @ r1 = character to look for
++ @ r2 = length
++ @ returns r0 = pointer to character or NULL if not found
++ and r1,r1,#0xff @ Don't think we can trust the caller to actually pass a char
++
++ cmp r2,#16 @ If it's short don't bother with anything clever
++ blt 20f
++
++ tst r0, #7 @ If it's already aligned skip the next bit
++ beq 10f
++
++ @ Work up to an aligned point
++5:
++ ldrb r3, [r0],#1
++ subs r2, r2, #1
++ cmp r3, r1
++ beq 50f @ If it matches exit found
++ tst r0, #7
++ bne 5b @ If not aligned yet then do next byte
++
++10:
++ @ At this point, we are aligned, we know we have at least 8 bytes to work with
++ push {r4,r5,r6,r7}
++ orr r1, r1, r1, lsl #8 @ expand the match word across to all bytes
++ orr r1, r1, r1, lsl #16
++ bic r4, r2, #7 @ Number of double words to work with
++ mvns r7, #0 @ all F's
++ movs r3, #0
++
++15:
++ ldmia r0!,{r5,r6}
++ subs r4, r4, #8
++ eor r5,r5, r1 @ Get it so that r5,r6 have 00's where the bytes match the target
++ eor r6,r6, r1
++ uadd8 r5, r5, r7 @ Parallel add 0xff - sets the GE bits for anything that wasn't 0
++ sel r5, r3, r7 @ bytes are 00 for none-00 bytes, or ff for 00 bytes - NOTE INVERSION
++ uadd8 r6, r6, r7 @ Parallel add 0xff - sets the GE bits for anything that wasn't 0
++ sel r6, r5, r7 @ chained....bytes are 00 for none-00 bytes, or ff for 00 bytes - NOTE INVERSION
++ cbnz r6, 60f
++ bne 15b @ (Flags from the subs above) If not run out of bytes then go around again
++
++ pop {r4,r5,r6,r7}
++ and r1,r1,#0xff @ Get r1 back to a single character from the expansion above
++ and r2,r2,#7 @ Leave the count remaining as the number after the double words have been done
++
++20:
++ cbz r2, 40f @ 0 length or hit the end already then not found
++
++21: @ Post aligned section, or just a short call
++ ldrb r3,[r0],#1
++ subs r2,r2,#1
++ eor r3,r3,r1 @ r3 = 0 if match - doesn't break flags from sub
++ cbz r3, 50f
++ bne 21b @ on r2 flags
++
++40:
++ movs r0,#0 @ not found
++ bx lr
++
++50:
++ subs r0,r0,#1 @ found
++ bx lr
++
++60: @ We're here because the fast path found a hit - now we have to track down exactly which word it was
++ @ r0 points to the start of the double word after the one that was tested
++ @ r5 has the 00/ff pattern for the first word, r6 has the chained value
++ cmp r5, #0
++ itte eq
++ moveq r5, r6 @ the end is in the 2nd word
++ subeq r0,r0,#3 @ Points to 2nd byte of 2nd word
++ subne r0,r0,#7 @ or 2nd byte of 1st word
++
++ @ r0 currently points to the 3rd byte of the word containing the hit
++ tst r5, # CHARTSTMASK(0) @ 1st character
++ bne 61f
++ adds r0,r0,#1
++ tst r5, # CHARTSTMASK(1) @ 2nd character
++ ittt eq
++ addeq r0,r0,#1
++ tsteq r5, # (3<<15) @ 2nd & 3rd character
++ @ If not the 3rd must be the last one
++ addeq r0,r0,#1
++
++61:
++ pop {r4,r5,r6,r7}
++ subs r0,r0,#1
++ bx lr
+diff --git a/cortex-strings/sysdeps/arm/armv7/memcpy.S b/cortex-strings/sysdeps/arm/armv7/memcpy.S
+new file mode 100644
+index 000000000000..3be24cad2c8d
+--- /dev/null
++++ b/cortex-strings/sysdeps/arm/armv7/memcpy.S
+@@ -0,0 +1,152 @@
++/* Copyright (c) 2010-2011, Linaro Limited
++ All rights reserved.
++
++ Redistribution and use in source and binary forms, with or without
++ modification, are permitted provided that the following conditions
++ are met:
++
++ * Redistributions of source code must retain the above copyright
++ notice, this list of conditions and the following disclaimer.
++
++ * Redistributions in binary form must reproduce the above copyright
++ notice, this list of conditions and the following disclaimer in the
++ documentation and/or other materials provided with the distribution.
++
++ * Neither the name of Linaro Limited nor the names of its
++ contributors may be used to endorse or promote products derived
++ from this software without specific prior written permission.
++
++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++
++ Written by Dave Gilbert <david.gilbert@linaro.org>
++
++ This memcpy routine is optimised on a Cortex-A9 and should work on
++ all ARMv7 processors with NEON. */
++
++@ 2011-09-01 david.gilbert@linaro.org
++@ Extracted from local git 2f11b436
++
++ .syntax unified
++ .arch armv7-a
++
++@ this lets us check a flag in a 00/ff byte easily in either endianness
++#ifdef __ARMEB__
++#define CHARTSTMASK(c) 1<<(31-(c*8))
++#else
++#define CHARTSTMASK(c) 1<<(c*8)
++#endif
++ .text
++ .thumb
++
++@ ---------------------------------------------------------------------------
++ .thumb_func
++ .align 2
++ .p2align 4,,15
++ .global memcpy
++ .type memcpy,%function
++memcpy:
++ @ r0 = dest
++ @ r1 = source
++ @ r2 = count
++ @ returns dest in r0
++ @ Overlaps of source/dest not allowed according to spec
++ @ Note this routine relies on v7 misaligned loads/stores
++ pld [r1]
++ mov r12, r0 @ stash original r0
++ cmp r2,#32
++ blt 10f @ take the small copy case separately
++
++ @ test for either source or destination being misaligned
++ @ (We only rely on word align)
++ tst r0,#3
++ it eq
++ tsteq r1,#3
++ bne 30f @ misaligned case
++
++4:
++ @ at this point we are word (or better) aligned and have at least
++ @ 32 bytes to play with
++
++ @ If it's a huge copy, try Neon
++ cmp r2, #128*1024
++ bge 35f @ Sharing general non-aligned case here, aligned could be faster
++
++ push {r3,r4,r5,r6,r7,r8,r10,r11}
++5:
++ ldmia r1!,{r3,r4,r5,r6,r7,r8,r10,r11}
++ sub r2,r2,#32
++ pld [r1,#96]
++ cmp r2,#32
++ stmia r0!,{r3,r4,r5,r6,r7,r8,r10,r11}
++ bge 5b
++
++ pop {r3,r4,r5,r6,r7,r8,r10,r11}
++ @ We are now down to less than 32 bytes
++ cbz r2,15f @ quick exit for the case where we copied a multiple of 32
++
++10: @ small copies (not necessarily aligned - note might be slightly more than 32bytes)
++ cmp r2,#4
++ blt 12f
++11:
++ sub r2,r2,#4
++ cmp r2,#4
++ ldr r3, [r1],#4
++ str r3, [r0],#4
++ bge 11b
++12:
++ tst r2,#2
++ itt ne
++ ldrhne r3, [r1],#2
++ strhne r3, [r0],#2
++
++ tst r2,#1
++ itt ne
++ ldrbne r3, [r1],#1
++ strbne r3, [r0],#1
++
++15: @ exit
++ mov r0,r12 @ restore r0
++ bx lr
++
++ .align 2
++ .p2align 4,,15
++30: @ non-aligned - at least 32 bytes to play with
++ @ Test for co-misalignment
++ eor r3, r0, r1
++ tst r3,#3
++ beq 50f
++
++ @ Use Neon for misaligned
++35:
++ vld1.8 {d0,d1,d2,d3}, [r1]!
++ sub r2,r2,#32
++ cmp r2,#32
++ pld [r1,#96]
++ vst1.8 {d0,d1,d2,d3}, [r0]!
++ bge 35b
++ b 10b @ TODO: Probably a bad idea to switch to ARM at this point
++
++ .align 2
++ .p2align 4,,15
++50: @ Co-misaligned
++ @ At this point we've got at least 32 bytes
++51:
++ ldrb r3,[r1],#1
++ sub r2,r2,#1
++ strb r3,[r0],#1
++ tst r0,#7
++ bne 51b
++
++ cmp r2,#32
++ blt 10b
++ b 4b
+diff --git a/cortex-strings/sysdeps/arm/armv7/memset.S b/cortex-strings/sysdeps/arm/armv7/memset.S
+new file mode 100644
+index 000000000000..921cb7535cc8
+--- /dev/null
++++ b/cortex-strings/sysdeps/arm/armv7/memset.S
+@@ -0,0 +1,118 @@
++/* Copyright (c) 2010-2011, Linaro Limited
++ All rights reserved.
++
++ Redistribution and use in source and binary forms, with or without
++ modification, are permitted provided that the following conditions
++ are met:
++
++ * Redistributions of source code must retain the above copyright
++ notice, this list of conditions and the following disclaimer.
++
++ * Redistributions in binary form must reproduce the above copyright
++ notice, this list of conditions and the following disclaimer in the
++ documentation and/or other materials provided with the distribution.
++
++ * Neither the name of Linaro Limited nor the names of its
++ contributors may be used to endorse or promote products derived
++ from this software without specific prior written permission.
++
++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++
++ Written by Dave Gilbert <david.gilbert@linaro.org>
++
++ This memset routine is optimised on a Cortex-A9 and should work on
++ all ARMv7 processors. */
++
++ .syntax unified
++ .arch armv7-a
++
++@ 2011-08-30 david.gilbert@linaro.org
++@ Extracted from local git 2f11b436
++
++@ this lets us check a flag in a 00/ff byte easily in either endianness
++#ifdef __ARMEB__
++#define CHARTSTMASK(c) 1<<(31-(c*8))
++#else
++#define CHARTSTMASK(c) 1<<(c*8)
++#endif
++ .text
++ .thumb
++
++@ ---------------------------------------------------------------------------
++ .thumb_func
++ .align 2
++ .p2align 4,,15
++ .global memset
++ .type memset,%function
++memset:
++ @ r0 = address
++ @ r1 = character
++ @ r2 = count
++ @ returns original address in r0
++
++ mov r3, r0 @ Leave r0 alone
++ cbz r2, 10f @ Exit if 0 length
++
++ tst r0, #7
++ beq 2f @ Already aligned
++
++ @ Ok, so we're misaligned here
++1:
++ strb r1, [r3], #1
++ subs r2,r2,#1
++ tst r3, #7
++ cbz r2, 10f @ Exit if we hit the end
++ bne 1b @ go round again if still misaligned
++
++2:
++ @ OK, so we're aligned
++ push {r4,r5,r6,r7}
++ bics r4, r2, #15 @ if less than 16 bytes then need to finish it off
++ beq 5f
++
++3:
++ @ POSIX says that ch is cast to an unsigned char. A uxtb is one
++ @ byte and takes two cycles, where an AND is four bytes but one
++ @ cycle.
++ and r1, #0xFF
++ orr r1, r1, r1, lsl#8 @ Same character into all bytes
++ orr r1, r1, r1, lsl#16
++ mov r5,r1
++ mov r6,r1
++ mov r7,r1
++
++4:
++ subs r4,r4,#16
++ stmia r3!,{r1,r5,r6,r7}
++ bne 4b
++ and r2,r2,#15
++
++ @ At this point we're still aligned and we have upto align-1 bytes left to right
++ @ we can avoid some of the byte-at-a time now by testing for some big chunks
++ tst r2,#8
++ itt ne
++ subne r2,r2,#8
++ stmiane r3!,{r1,r5}
++
++5:
++ pop {r4,r5,r6,r7}
++ cbz r2, 10f
++
++ @ Got to do any last < alignment bytes
++6:
++ subs r2,r2,#1
++ strb r1,[r3],#1
++ bne 6b
++
++10:
++ bx lr @ goodbye
+diff --git a/cortex-strings/sysdeps/arm/armv7/strchr.S b/cortex-strings/sysdeps/arm/armv7/strchr.S
+new file mode 100644
+index 000000000000..8875dbfce6da
+--- /dev/null
++++ b/cortex-strings/sysdeps/arm/armv7/strchr.S
+@@ -0,0 +1,76 @@
++/* Copyright (c) 2010-2011, Linaro Limited
++ All rights reserved.
++
++ Redistribution and use in source and binary forms, with or without
++ modification, are permitted provided that the following conditions
++ are met:
++
++ * Redistributions of source code must retain the above copyright
++ notice, this list of conditions and the following disclaimer.
++
++ * Redistributions in binary form must reproduce the above copyright
++ notice, this list of conditions and the following disclaimer in the
++ documentation and/or other materials provided with the distribution.
++
++ * Neither the name of Linaro Limited nor the names of its
++ contributors may be used to endorse or promote products derived
++ from this software without specific prior written permission.
++
++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++
++ Written by Dave Gilbert <david.gilbert@linaro.org>
++
++ A very simple strchr routine, from benchmarks on A9 it's a bit faster than
++ the current version in eglibc (2.12.1-0ubuntu14 package)
++ I don't think doing a word at a time version is worth it since a lot
++ of strchr cases are very short anyway */
++
++@ 2011-02-07 david.gilbert@linaro.org
++@ Extracted from local git a5b438d861
++
++ .syntax unified
++ .arch armv7-a
++
++ .text
++ .thumb
++
++@ ---------------------------------------------------------------------------
++
++ .thumb_func
++ .align 2
++ .p2align 4,,15
++ .global strchr
++ .type strchr,%function
++strchr:
++ @ r0 = start of string
++ @ r1 = character to match
++ @ returns NULL for no match, or a pointer to the match
++ and r1,r1, #255
++
++1:
++ ldrb r2,[r0],#1
++ cmp r2,r1
++ cbz r2,10f
++ bne 1b
++
++ @ We're here if it matched
++5:
++ subs r0,r0,#1
++ bx lr
++
++10:
++ @ We're here if we ran off the end
++ cmp r1, #0 @ Corner case - you're allowed to search for the nil and get a pointer to it
++ beq 5b @ A bit messy, if it's common we should branch at the start to a special loop
++ mov r0,#0
++ bx lr
+diff --git a/cortex-strings/sysdeps/arm/armv7/strlen.S b/cortex-strings/sysdeps/arm/armv7/strlen.S
+new file mode 100644
+index 000000000000..8efa2356fdd1
+--- /dev/null
++++ b/cortex-strings/sysdeps/arm/armv7/strlen.S
+@@ -0,0 +1,150 @@
++/* Copyright (c) 2010-2011,2013 Linaro Limited
++ All rights reserved.
++
++ Redistribution and use in source and binary forms, with or without
++ modification, are permitted provided that the following conditions
++ are met:
++
++ * Redistributions of source code must retain the above copyright
++ notice, this list of conditions and the following disclaimer.
++
++ * Redistributions in binary form must reproduce the above copyright
++ notice, this list of conditions and the following disclaimer in the
++ documentation and/or other materials provided with the distribution.
++
++ * Neither the name of Linaro Limited nor the names of its
++ contributors may be used to endorse or promote products derived
++ from this software without specific prior written permission.
++
++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++/*
++ Assumes:
++ ARMv6T2, AArch32
++
++ */
++
++ .macro def_fn f p2align=0
++ .text
++ .p2align \p2align
++ .global \f
++ .type \f, %function
++\f:
++ .endm
++
++#ifdef __ARMEB__
++#define S2LO lsl
++#define S2HI lsr
++#else
++#define S2LO lsr
++#define S2HI lsl
++#endif
++
++ /* This code requires Thumb. */
++ .thumb
++ .syntax unified
++
++/* Parameters and result. */
++#define srcin r0
++#define result r0
++
++/* Internal variables. */
++#define src r1
++#define data1a r2
++#define data1b r3
++#define const_m1 r12
++#define const_0 r4
++#define tmp1 r4 /* Overlaps const_0 */
++#define tmp2 r5
++
++def_fn strlen p2align=6
++ pld [srcin, #0]
++ strd r4, r5, [sp, #-8]!
++ bic src, srcin, #7
++ mvn const_m1, #0
++ ands tmp1, srcin, #7 /* (8 - bytes) to alignment. */
++ pld [src, #32]
++ bne.w .Lmisaligned8
++ mov const_0, #0
++ mov result, #-8
++.Lloop_aligned:
++ /* Bytes 0-7. */
++ ldrd data1a, data1b, [src]
++ pld [src, #64]
++ add result, result, #8
++.Lstart_realigned:
++ uadd8 data1a, data1a, const_m1 /* Saturating GE<0:3> set. */
++ sel data1a, const_0, const_m1 /* Select based on GE<0:3>. */
++ uadd8 data1b, data1b, const_m1
++ sel data1b, data1a, const_m1 /* Only used if d1a == 0. */
++ cbnz data1b, .Lnull_found
++
++ /* Bytes 8-15. */
++ ldrd data1a, data1b, [src, #8]
++ uadd8 data1a, data1a, const_m1 /* Saturating GE<0:3> set. */
++ add result, result, #8
++ sel data1a, const_0, const_m1 /* Select based on GE<0:3>. */
++ uadd8 data1b, data1b, const_m1
++ sel data1b, data1a, const_m1 /* Only used if d1a == 0. */
++ cbnz data1b, .Lnull_found
++
++ /* Bytes 16-23. */
++ ldrd data1a, data1b, [src, #16]
++ uadd8 data1a, data1a, const_m1 /* Saturating GE<0:3> set. */
++ add result, result, #8
++ sel data1a, const_0, const_m1 /* Select based on GE<0:3>. */
++ uadd8 data1b, data1b, const_m1
++ sel data1b, data1a, const_m1 /* Only used if d1a == 0. */
++ cbnz data1b, .Lnull_found
++
++ /* Bytes 24-31. */
++ ldrd data1a, data1b, [src, #24]
++ add src, src, #32
++ uadd8 data1a, data1a, const_m1 /* Saturating GE<0:3> set. */
++ add result, result, #8
++ sel data1a, const_0, const_m1 /* Select based on GE<0:3>. */
++ uadd8 data1b, data1b, const_m1
++ sel data1b, data1a, const_m1 /* Only used if d1a == 0. */
++ cmp data1b, #0
++ beq .Lloop_aligned
++
++.Lnull_found:
++ cmp data1a, #0
++ itt eq
++ addeq result, result, #4
++ moveq data1a, data1b
++#ifndef __ARMEB__
++ rev data1a, data1a
++#endif
++ clz data1a, data1a
++ ldrd r4, r5, [sp], #8
++ add result, result, data1a, lsr #3 /* Bits -> Bytes. */
++ bx lr
++
++.Lmisaligned8:
++ ldrd data1a, data1b, [src]
++ and tmp2, tmp1, #3
++ rsb result, tmp1, #0
++ lsl tmp2, tmp2, #3 /* Bytes -> bits. */
++ tst tmp1, #4
++ pld [src, #64]
++ S2HI tmp2, const_m1, tmp2
++ orn data1a, data1a, tmp2
++ itt ne
++ ornne data1b, data1b, tmp2
++ movne data1a, const_m1
++ mov const_0, #0
++ b .Lstart_realigned
++ .size strlen, . - strlen
++
diff --git a/patches/glibc-2.23/0301-add-libc_hidden_builtin_def-for-all-cortex-functions.patch b/patches/glibc-2.23/0301-add-libc_hidden_builtin_def-for-all-cortex-functions.patch
new file mode 100644
index 0000000..2ffcdbb
--- /dev/null
+++ b/patches/glibc-2.23/0301-add-libc_hidden_builtin_def-for-all-cortex-functions.patch
@@ -0,0 +1,64 @@
+From: Michael Olbrich <m.olbrich@pengutronix.de>
+Date: Thu, 15 Sep 2011 23:30:25 +0200
+Subject: [PATCH] add libc_hidden_builtin_def for all cortex functions
+
+Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
+---
+ cortex-strings/sysdeps/arm/armv7/memchr.S | 3 +++
+ cortex-strings/sysdeps/arm/armv7/memcpy.S | 2 ++
+ cortex-strings/sysdeps/arm/armv7/memset.S | 2 ++
+ cortex-strings/sysdeps/arm/armv7/strchr.S | 3 +++
+ cortex-strings/sysdeps/arm/armv7/strlen.S | 1 +
+ 5 files changed, 11 insertions(+)
+
+diff --git a/cortex-strings/sysdeps/arm/armv7/memchr.S b/cortex-strings/sysdeps/arm/armv7/memchr.S
+index 92a2d9f0967d..6e4195325c82 100644
+--- a/cortex-strings/sysdeps/arm/armv7/memchr.S
++++ b/cortex-strings/sysdeps/arm/armv7/memchr.S
+@@ -153,3 +153,6 @@ memchr:
+ pop {r4,r5,r6,r7}
+ subs r0,r0,#1
+ bx lr
++
++strong_alias (memchr, __memchr)
++libc_hidden_builtin_def (memchr)
+diff --git a/cortex-strings/sysdeps/arm/armv7/memcpy.S b/cortex-strings/sysdeps/arm/armv7/memcpy.S
+index 3be24cad2c8d..c2742073a329 100644
+--- a/cortex-strings/sysdeps/arm/armv7/memcpy.S
++++ b/cortex-strings/sysdeps/arm/armv7/memcpy.S
+@@ -150,3 +150,5 @@ memcpy:
+ cmp r2,#32
+ blt 10b
+ b 4b
++
++libc_hidden_builtin_def (memcpy)
+diff --git a/cortex-strings/sysdeps/arm/armv7/memset.S b/cortex-strings/sysdeps/arm/armv7/memset.S
+index 921cb7535cc8..d4c12a4d1243 100644
+--- a/cortex-strings/sysdeps/arm/armv7/memset.S
++++ b/cortex-strings/sysdeps/arm/armv7/memset.S
+@@ -116,3 +116,5 @@ memset:
+
+ 10:
+ bx lr @ goodbye
++
++libc_hidden_builtin_def (memset)
+diff --git a/cortex-strings/sysdeps/arm/armv7/strchr.S b/cortex-strings/sysdeps/arm/armv7/strchr.S
+index 8875dbfce6da..05c832f1faf4 100644
+--- a/cortex-strings/sysdeps/arm/armv7/strchr.S
++++ b/cortex-strings/sysdeps/arm/armv7/strchr.S
+@@ -74,3 +74,6 @@ strchr:
+ beq 5b @ A bit messy, if it's common we should branch at the start to a special loop
+ mov r0,#0
+ bx lr
++
++weak_alias (strchr, index)
++libc_hidden_builtin_def (strchr)
+diff --git a/cortex-strings/sysdeps/arm/armv7/strlen.S b/cortex-strings/sysdeps/arm/armv7/strlen.S
+index 8efa2356fdd1..1445d8e8118e 100644
+--- a/cortex-strings/sysdeps/arm/armv7/strlen.S
++++ b/cortex-strings/sysdeps/arm/armv7/strlen.S
+@@ -148,3 +148,4 @@ def_fn strlen p2align=6
+ b .Lstart_realigned
+ .size strlen, . - strlen
+
++libc_hidden_builtin_def (strlen)
diff --git a/patches/glibc-2.23/0400-Hack-around-mips-args-to-host-gcc.patch b/patches/glibc-2.23/0400-Hack-around-mips-args-to-host-gcc.patch
new file mode 100644
index 0000000..5cc5c41
--- /dev/null
+++ b/patches/glibc-2.23/0400-Hack-around-mips-args-to-host-gcc.patch
@@ -0,0 +1,28 @@
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 3 Dec 2014 15:05:52 +0100
+Subject: [PATCH] Hack around mips args to host-gcc
+
+originally From: "Steven J dot Hill" <sjhill at realitydiluted dot com>
+for Crosstool
+
+In OSELAS.Toolchain we pass -DBOOTSTRAP_GCC in CC. This patch fixes the
+header extraction from the glibc, by not passing mips specific flags to
+the HOST compiler.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+---
+ sysdeps/mips/mips32/Makefile | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sysdeps/mips/mips32/Makefile b/sysdeps/mips/mips32/Makefile
+index dec0b024c3a8..dde2ca6bce1d 100644
+--- a/sysdeps/mips/mips32/Makefile
++++ b/sysdeps/mips/mips32/Makefile
+@@ -1,3 +1,7 @@
++ifeq ($(filter -DBOOTSTRAP_GCC,$(CC)),)
+ ifeq ($(filter -mabi=32,$(CC)),)
+ CC += -mabi=32
+ endif
++else
++CC += -D_MIPS_SZPTR=32
++endif
diff --git a/patches/glibc-2.23/0500-ARM-fix-PI-futex-breakge-glibc-bug-18463.patch b/patches/glibc-2.23/0500-ARM-fix-PI-futex-breakge-glibc-bug-18463.patch
new file mode 100644
index 0000000..447cdfa
--- /dev/null
+++ b/patches/glibc-2.23/0500-ARM-fix-PI-futex-breakge-glibc-bug-18463.patch
@@ -0,0 +1,33 @@
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Sat, 13 Jun 2015 19:25:07 +0200
+Subject: [PATCH] ARM: fix PI futex breakge - glibc bug 18463
+
+This patch fixes glibc bug 18463:
+
+ https://sourceware.org/bugzilla/show_bug.cgi?id=18463
+
+The problem is caused by:
+
+ 47c5adebd2c8 Correct robust mutex / PI futex kernel assumptions (bug 9894).
+
+An alternative approach to this bug is to switch to the new condvar
+implementation from Torvald Riegel
+(https://sourceware.org/ml/libc-alpha/2015-02/msg00578.html). Until glibc
+upstream does so, this patch has probably to be ported to new glibc releases.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+---
+ sysdeps/unix/sysv/linux/arm/kernel-features.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sysdeps/unix/sysv/linux/arm/kernel-features.h b/sysdeps/unix/sysv/linux/arm/kernel-features.h
+index 6f1606c83305..aeaceedcfc9d 100644
+--- a/sysdeps/unix/sysv/linux/arm/kernel-features.h
++++ b/sysdeps/unix/sysv/linux/arm/kernel-features.h
+@@ -39,6 +39,5 @@
+ configuration. */
+ #if __LINUX_KERNEL_VERSION < 0x030E03
+ # undef __ASSUME_FUTEX_LOCK_PI
+-# undef __ASSUME_REQUEUE_PI
+ # undef __ASSUME_SET_ROBUST_LIST
+ #endif
diff --git a/patches/glibc-2.23/series b/patches/glibc-2.23/series
new file mode 100644
index 0000000..f41d245
--- /dev/null
+++ b/patches/glibc-2.23/series
@@ -0,0 +1,21 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+#tag:upstream --start-number 1
+0001-CVE-2016-3075-Stack-overflow-in-_nss_dns_getnetbynam.patch
+0002-CVE-2016-3706-getaddrinfo-stack-overflow-in-hostent-.patch
+0003-glob-Simplify-the-interface-for-the-GLOB_ALTDIRFUNC-.patch
+0004-CVE-2016-1234-glob-Do-not-copy-d_name-field-of-struc.patch
+0005-CVE-2016-4429-sunrpc-Do-not-use-alloca-in-clntudp_ca.patch
+#tag:build-system --start-number 100
+0100-add-install-lib-all-target.patch
+0101-don-t-regen-docs-if-perl-is-not-found.patch
+#tag:gentoo --start-number 200
+0200-resolv-dynamic.patch
+#tag:linaro --start-number 300
+0300-optimized-string-functions-for-NEON-from-Linaro.patch
+0301-add-libc_hidden_builtin_def-for-all-cortex-functions.patch
+#tag:hacks --start-number 400
+0400-Hack-around-mips-args-to-host-gcc.patch
+#tag:open-glibc-bugs --start-number 500
+0500-ARM-fix-PI-futex-breakge-glibc-bug-18463.patch
+# 0864aa35a84bed6790ecc904cfd6bb4c - git-ptx-patches magic