]> git.ipfire.org Git - people/arne_f/ipfire-3.x.git/blame - kernel/patches/grsecurity-2.2.2-2.6.39-201105231910.patch
projects / people / arne_f / ipfire-3.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Move all packages to root.
[people/arne_f/ipfire-3.x.git] / kernel / patches / grsecurity-2.2.2-2.6.39-201105231910.patch
CommitLineData
66a7e928
MT		 1diff -urNp linux-2.6.39/arch/alpha/include/asm/dma-mapping.h linux-2.6.39/arch/alpha/include/asm/dma-mapping.h
2--- linux-2.6.39/arch/alpha/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3+++ linux-2.6.39/arch/alpha/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 4@@ -3,9 +3,9 @@
5
6 #include <linux/dma-attrs.h>
7
8-extern struct dma_map_ops *dma_ops;
9+extern const struct dma_map_ops *dma_ops;
10
11-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
12+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
13 {
14 return dma_ops;
15 }
66a7e928
MT		 16diff -urNp linux-2.6.39/arch/alpha/include/asm/elf.h linux-2.6.39/arch/alpha/include/asm/elf.h
17--- linux-2.6.39/arch/alpha/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
18+++ linux-2.6.39/arch/alpha/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 19@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
58c5fc13
MT		 20
21 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
22
23+#ifdef CONFIG_PAX_ASLR
24+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
25+
26+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
27+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
28+#endif
29+
30 /* $0 is set by ld.so to a pointer to a function which might be
31 registered using atexit. This provides a mean for the dynamic
32 linker to call DT_FINI functions for shared libraries that have
66a7e928
MT		 33diff -urNp linux-2.6.39/arch/alpha/include/asm/pgtable.h linux-2.6.39/arch/alpha/include/asm/pgtable.h
34--- linux-2.6.39/arch/alpha/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
35+++ linux-2.6.39/arch/alpha/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 36@@ -101,6 +101,17 @@ struct vm_area_struct;
37 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
38 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
39 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
40+
41+#ifdef CONFIG_PAX_PAGEEXEC
42+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
43+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
44+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
45+#else
46+# define PAGE_SHARED_NOEXEC PAGE_SHARED
47+# define PAGE_COPY_NOEXEC PAGE_COPY
48+# define PAGE_READONLY_NOEXEC PAGE_READONLY
49+#endif
50+
51 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
52
53 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
66a7e928
MT		 54diff -urNp linux-2.6.39/arch/alpha/kernel/core_apecs.c linux-2.6.39/arch/alpha/kernel/core_apecs.c
55--- linux-2.6.39/arch/alpha/kernel/core_apecs.c 2011-05-19 00:06:34.000000000 -0400
56+++ linux-2.6.39/arch/alpha/kernel/core_apecs.c 2011-05-22 19:36:30.000000000 -0400
57@@ -305,7 +305,7 @@ apecs_write_config(struct pci_bus *bus,
58 return PCIBIOS_SUCCESSFUL;
59 }
60
61-struct pci_ops apecs_pci_ops =
62+const struct pci_ops apecs_pci_ops =
63 {
64 .read = apecs_read_config,
65 .write = apecs_write_config,
66diff -urNp linux-2.6.39/arch/alpha/kernel/core_cia.c linux-2.6.39/arch/alpha/kernel/core_cia.c
67--- linux-2.6.39/arch/alpha/kernel/core_cia.c 2011-05-19 00:06:34.000000000 -0400
68+++ linux-2.6.39/arch/alpha/kernel/core_cia.c 2011-05-22 19:36:30.000000000 -0400
69@@ -239,7 +239,7 @@ cia_write_config(struct pci_bus *bus, un
70 return PCIBIOS_SUCCESSFUL;
71 }
72
73-struct pci_ops cia_pci_ops =
74+const struct pci_ops cia_pci_ops =
75 {
76 .read = cia_read_config,
77 .write = cia_write_config,
78diff -urNp linux-2.6.39/arch/alpha/kernel/core_irongate.c linux-2.6.39/arch/alpha/kernel/core_irongate.c
79--- linux-2.6.39/arch/alpha/kernel/core_irongate.c 2011-05-19 00:06:34.000000000 -0400
80+++ linux-2.6.39/arch/alpha/kernel/core_irongate.c 2011-05-22 19:36:30.000000000 -0400
81@@ -155,7 +155,7 @@ irongate_write_config(struct pci_bus *bu
82 return PCIBIOS_SUCCESSFUL;
83 }
84
85-struct pci_ops irongate_pci_ops =
86+const struct pci_ops irongate_pci_ops =
87 {
88 .read = irongate_read_config,
89 .write = irongate_write_config,
90diff -urNp linux-2.6.39/arch/alpha/kernel/core_lca.c linux-2.6.39/arch/alpha/kernel/core_lca.c
91--- linux-2.6.39/arch/alpha/kernel/core_lca.c 2011-05-19 00:06:34.000000000 -0400
92+++ linux-2.6.39/arch/alpha/kernel/core_lca.c 2011-05-22 19:36:30.000000000 -0400
93@@ -231,7 +231,7 @@ lca_write_config(struct pci_bus *bus, un
94 return PCIBIOS_SUCCESSFUL;
95 }
96
97-struct pci_ops lca_pci_ops =
98+const struct pci_ops lca_pci_ops =
99 {
100 .read = lca_read_config,
101 .write = lca_write_config,
102diff -urNp linux-2.6.39/arch/alpha/kernel/core_marvel.c linux-2.6.39/arch/alpha/kernel/core_marvel.c
103--- linux-2.6.39/arch/alpha/kernel/core_marvel.c 2011-05-19 00:06:34.000000000 -0400
104+++ linux-2.6.39/arch/alpha/kernel/core_marvel.c 2011-05-22 19:36:30.000000000 -0400
105@@ -588,7 +588,7 @@ marvel_write_config(struct pci_bus *bus,
106 return PCIBIOS_SUCCESSFUL;
107 }
108
109-struct pci_ops marvel_pci_ops =
110+const struct pci_ops marvel_pci_ops =
111 {
112 .read = marvel_read_config,
113 .write = marvel_write_config,
114diff -urNp linux-2.6.39/arch/alpha/kernel/core_mcpcia.c linux-2.6.39/arch/alpha/kernel/core_mcpcia.c
115--- linux-2.6.39/arch/alpha/kernel/core_mcpcia.c 2011-05-19 00:06:34.000000000 -0400
116+++ linux-2.6.39/arch/alpha/kernel/core_mcpcia.c 2011-05-22 19:36:30.000000000 -0400
117@@ -235,7 +235,7 @@ mcpcia_write_config(struct pci_bus *bus,
118 return PCIBIOS_SUCCESSFUL;
119 }
120
121-struct pci_ops mcpcia_pci_ops =
122+const struct pci_ops mcpcia_pci_ops =
123 {
124 .read = mcpcia_read_config,
125 .write = mcpcia_write_config,
126diff -urNp linux-2.6.39/arch/alpha/kernel/core_polaris.c linux-2.6.39/arch/alpha/kernel/core_polaris.c
127--- linux-2.6.39/arch/alpha/kernel/core_polaris.c 2011-05-19 00:06:34.000000000 -0400
128+++ linux-2.6.39/arch/alpha/kernel/core_polaris.c 2011-05-22 19:36:30.000000000 -0400
129@@ -136,7 +136,7 @@ polaris_write_config(struct pci_bus *bus
130 return PCIBIOS_SUCCESSFUL;
131 }
132
133-struct pci_ops polaris_pci_ops =
134+const struct pci_ops polaris_pci_ops =
135 {
136 .read = polaris_read_config,
137 .write = polaris_write_config,
138diff -urNp linux-2.6.39/arch/alpha/kernel/core_t2.c linux-2.6.39/arch/alpha/kernel/core_t2.c
139--- linux-2.6.39/arch/alpha/kernel/core_t2.c 2011-05-19 00:06:34.000000000 -0400
140+++ linux-2.6.39/arch/alpha/kernel/core_t2.c 2011-05-22 19:36:30.000000000 -0400
141@@ -314,7 +314,7 @@ t2_write_config(struct pci_bus *bus, uns
142 return PCIBIOS_SUCCESSFUL;
143 }
144
145-struct pci_ops t2_pci_ops =
146+const struct pci_ops t2_pci_ops =
147 {
148 .read = t2_read_config,
149 .write = t2_write_config,
150diff -urNp linux-2.6.39/arch/alpha/kernel/core_titan.c linux-2.6.39/arch/alpha/kernel/core_titan.c
151--- linux-2.6.39/arch/alpha/kernel/core_titan.c 2011-05-19 00:06:34.000000000 -0400
152+++ linux-2.6.39/arch/alpha/kernel/core_titan.c 2011-05-22 19:36:30.000000000 -0400
153@@ -191,7 +191,7 @@ titan_write_config(struct pci_bus *bus,
154 return PCIBIOS_SUCCESSFUL;
155 }
156
157-struct pci_ops titan_pci_ops =
158+const struct pci_ops titan_pci_ops =
159 {
160 .read = titan_read_config,
161 .write = titan_write_config,
162diff -urNp linux-2.6.39/arch/alpha/kernel/core_tsunami.c linux-2.6.39/arch/alpha/kernel/core_tsunami.c
163--- linux-2.6.39/arch/alpha/kernel/core_tsunami.c 2011-05-19 00:06:34.000000000 -0400
164+++ linux-2.6.39/arch/alpha/kernel/core_tsunami.c 2011-05-22 19:36:30.000000000 -0400
165@@ -166,7 +166,7 @@ tsunami_write_config(struct pci_bus *bus
166 return PCIBIOS_SUCCESSFUL;
167 }
168
169-struct pci_ops tsunami_pci_ops =
170+const struct pci_ops tsunami_pci_ops =
171 {
172 .read = tsunami_read_config,
173 .write = tsunami_write_config,
174diff -urNp linux-2.6.39/arch/alpha/kernel/core_wildfire.c linux-2.6.39/arch/alpha/kernel/core_wildfire.c
175--- linux-2.6.39/arch/alpha/kernel/core_wildfire.c 2011-05-19 00:06:34.000000000 -0400
176+++ linux-2.6.39/arch/alpha/kernel/core_wildfire.c 2011-05-22 19:36:30.000000000 -0400
177@@ -431,7 +431,7 @@ wildfire_write_config(struct pci_bus *bu
178 return PCIBIOS_SUCCESSFUL;
179 }
180
181-struct pci_ops wildfire_pci_ops =
182+const struct pci_ops wildfire_pci_ops =
183 {
184 .read = wildfire_read_config,
185 .write = wildfire_write_config,
186diff -urNp linux-2.6.39/arch/alpha/kernel/module.c linux-2.6.39/arch/alpha/kernel/module.c
187--- linux-2.6.39/arch/alpha/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
188+++ linux-2.6.39/arch/alpha/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 189@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
190
191 /* The small sections were sorted to the end of the segment.
192 The following should definitely cover them. */
193- gp = (u64)me->module_core + me->core_size - 0x8000;
194+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
195 got = sechdrs[me->arch.gotsecindex].sh_addr;
196
197 for (i = 0; i < n; i++) {
66a7e928
MT		 198diff -urNp linux-2.6.39/arch/alpha/kernel/osf_sys.c linux-2.6.39/arch/alpha/kernel/osf_sys.c
199--- linux-2.6.39/arch/alpha/kernel/osf_sys.c 2011-05-19 00:06:34.000000000 -0400
200+++ linux-2.6.39/arch/alpha/kernel/osf_sys.c 2011-05-22 19:36:30.000000000 -0400
201@@ -1142,7 +1142,7 @@ arch_get_unmapped_area_1(unsigned long a
57199397
MT		 202 /* At this point: (!vma || addr < vma->vm_end). */
203 if (limit - len < addr)
204 return -ENOMEM;
205- if (!vma || addr + len <= vma->vm_start)
206+ if (check_heap_stack_gap(vma, addr, len))
207 return addr;
208 addr = vma->vm_end;
209 vma = vma->vm_next;
66a7e928 210@@ -1178,6 +1178,10 @@ arch_get_unmapped_area(struct file *filp
58c5fc13
MT		 211 merely specific addresses, but regions of memory -- perhaps
212 this feature should be incorporated into all ports? */
213
214+#ifdef CONFIG_PAX_RANDMMAP
215+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
216+#endif
217+
218 if (addr) {
219 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
220 if (addr != (unsigned long) -ENOMEM)
66a7e928 221@@ -1185,8 +1189,8 @@ arch_get_unmapped_area(struct file *filp
58c5fc13
MT		 222 }
223
224 /* Next, try allocating at TASK_UNMAPPED_BASE. */
225- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
226- len, limit);
227+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
228+
229 if (addr != (unsigned long) -ENOMEM)
230 return addr;
231
66a7e928
MT		 232diff -urNp linux-2.6.39/arch/alpha/kernel/pci_iommu.c linux-2.6.39/arch/alpha/kernel/pci_iommu.c
233--- linux-2.6.39/arch/alpha/kernel/pci_iommu.c 2011-05-19 00:06:34.000000000 -0400
234+++ linux-2.6.39/arch/alpha/kernel/pci_iommu.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 235@@ -950,7 +950,7 @@ static int alpha_pci_set_mask(struct dev
236 return 0;
237 }
238
239-struct dma_map_ops alpha_pci_ops = {
240+const struct dma_map_ops alpha_pci_ops = {
241 .alloc_coherent = alpha_pci_alloc_coherent,
242 .free_coherent = alpha_pci_free_coherent,
243 .map_page = alpha_pci_map_page,
244@@ -962,5 +962,5 @@ struct dma_map_ops alpha_pci_ops = {
245 .set_dma_mask = alpha_pci_set_mask,
246 };
247
248-struct dma_map_ops *dma_ops = &alpha_pci_ops;
249+const struct dma_map_ops *dma_ops = &alpha_pci_ops;
250 EXPORT_SYMBOL(dma_ops);
66a7e928
MT		 251diff -urNp linux-2.6.39/arch/alpha/kernel/pci-noop.c linux-2.6.39/arch/alpha/kernel/pci-noop.c
252--- linux-2.6.39/arch/alpha/kernel/pci-noop.c 2011-05-19 00:06:34.000000000 -0400
253+++ linux-2.6.39/arch/alpha/kernel/pci-noop.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 254@@ -173,7 +173,7 @@ static int alpha_noop_set_mask(struct de
255 return 0;
256 }
257
258-struct dma_map_ops alpha_noop_ops = {
259+const struct dma_map_ops alpha_noop_ops = {
260 .alloc_coherent = alpha_noop_alloc_coherent,
261 .free_coherent = alpha_noop_free_coherent,
262 .map_page = alpha_noop_map_page,
263@@ -183,7 +183,7 @@ struct dma_map_ops alpha_noop_ops = {
264 .set_dma_mask = alpha_noop_set_mask,
265 };
266
267-struct dma_map_ops *dma_ops = &alpha_noop_ops;
268+const struct dma_map_ops *dma_ops = &alpha_noop_ops;
269 EXPORT_SYMBOL(dma_ops);
270
271 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
66a7e928
MT		 272diff -urNp linux-2.6.39/arch/alpha/kernel/proto.h linux-2.6.39/arch/alpha/kernel/proto.h
273--- linux-2.6.39/arch/alpha/kernel/proto.h 2011-05-19 00:06:34.000000000 -0400
274+++ linux-2.6.39/arch/alpha/kernel/proto.h 2011-05-22 19:36:30.000000000 -0400
275@@ -17,14 +17,14 @@ struct pci_dev;
276 struct pci_controller;
277
278 /* core_apecs.c */
279-extern struct pci_ops apecs_pci_ops;
280+extern const struct pci_ops apecs_pci_ops;
281 extern void apecs_init_arch(void);
282 extern void apecs_pci_clr_err(void);
283 extern void apecs_machine_check(unsigned long vector, unsigned long la_ptr);
284 extern void apecs_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
285
286 /* core_cia.c */
287-extern struct pci_ops cia_pci_ops;
288+extern const struct pci_ops cia_pci_ops;
289 extern void cia_init_pci(void);
290 extern void cia_init_arch(void);
291 extern void pyxis_init_arch(void);
292@@ -33,19 +33,19 @@ extern void cia_machine_check(unsigned l
293 extern void cia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
294
295 /* core_irongate.c */
296-extern struct pci_ops irongate_pci_ops;
297+extern const struct pci_ops irongate_pci_ops;
298 extern int irongate_pci_clr_err(void);
299 extern void irongate_init_arch(void);
300 #define irongate_pci_tbi ((void *)0)
301
302 /* core_lca.c */
303-extern struct pci_ops lca_pci_ops;
304+extern const struct pci_ops lca_pci_ops;
305 extern void lca_init_arch(void);
306 extern void lca_machine_check(unsigned long vector, unsigned long la_ptr);
307 extern void lca_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
308
309 /* core_marvel.c */
310-extern struct pci_ops marvel_pci_ops;
311+extern const struct pci_ops marvel_pci_ops;
312 extern void marvel_init_arch(void);
313 extern void marvel_kill_arch(int);
314 extern void marvel_machine_check(unsigned long, unsigned long);
315@@ -60,14 +60,14 @@ struct io7 *marvel_next_io7(struct io7 *
316 void io7_clear_errors(struct io7 *io7);
317
318 /* core_mcpcia.c */
319-extern struct pci_ops mcpcia_pci_ops;
320+extern const struct pci_ops mcpcia_pci_ops;
321 extern void mcpcia_init_arch(void);
322 extern void mcpcia_init_hoses(void);
323 extern void mcpcia_machine_check(unsigned long vector, unsigned long la_ptr);
324 extern void mcpcia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
325
326 /* core_polaris.c */
327-extern struct pci_ops polaris_pci_ops;
328+extern const struct pci_ops polaris_pci_ops;
329 extern int polaris_read_config_dword(struct pci_dev *, int, u32 *);
330 extern int polaris_write_config_dword(struct pci_dev *, int, u32);
331 extern void polaris_init_arch(void);
332@@ -75,14 +75,14 @@ extern void polaris_machine_check(unsign
333 #define polaris_pci_tbi ((void *)0)
334
335 /* core_t2.c */
336-extern struct pci_ops t2_pci_ops;
337+extern const struct pci_ops t2_pci_ops;
338 extern void t2_init_arch(void);
339 extern void t2_kill_arch(int);
340 extern void t2_machine_check(unsigned long vector, unsigned long la_ptr);
341 extern void t2_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
342
343 /* core_titan.c */
344-extern struct pci_ops titan_pci_ops;
345+extern const struct pci_ops titan_pci_ops;
346 extern void titan_init_arch(void);
347 extern void titan_kill_arch(int);
348 extern void titan_machine_check(unsigned long, unsigned long);
349@@ -90,14 +90,14 @@ extern void titan_pci_tbi(struct pci_con
350 extern struct _alpha_agp_info *titan_agp_info(void);
351
352 /* core_tsunami.c */
353-extern struct pci_ops tsunami_pci_ops;
354+extern const struct pci_ops tsunami_pci_ops;
355 extern void tsunami_init_arch(void);
356 extern void tsunami_kill_arch(int);
357 extern void tsunami_machine_check(unsigned long vector, unsigned long la_ptr);
358 extern void tsunami_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
359
360 /* core_wildfire.c */
361-extern struct pci_ops wildfire_pci_ops;
362+extern const struct pci_ops wildfire_pci_ops;
363 extern void wildfire_init_arch(void);
364 extern void wildfire_kill_arch(int);
365 extern void wildfire_machine_check(unsigned long vector, unsigned long la_ptr);
366diff -urNp linux-2.6.39/arch/alpha/mm/fault.c linux-2.6.39/arch/alpha/mm/fault.c
367--- linux-2.6.39/arch/alpha/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
368+++ linux-2.6.39/arch/alpha/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 369@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
370 __reload_thread(pcb);
371 }
372
373+#ifdef CONFIG_PAX_PAGEEXEC
374+/*
375+ * PaX: decide what to do with offenders (regs->pc = fault address)
376+ *
377+ * returns 1 when task should be killed
378+ * 2 when patched PLT trampoline was detected
379+ * 3 when unpatched PLT trampoline was detected
380+ */
381+static int pax_handle_fetch_fault(struct pt_regs *regs)
382+{
383+
384+#ifdef CONFIG_PAX_EMUPLT
385+ int err;
386+
387+ do { /* PaX: patched PLT emulation #1 */
388+ unsigned int ldah, ldq, jmp;
389+
390+ err = get_user(ldah, (unsigned int *)regs->pc);
391+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
392+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
393+
394+ if (err)
395+ break;
396+
397+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
398+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
399+ jmp == 0x6BFB0000U)
400+ {
401+ unsigned long r27, addr;
402+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
403+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
404+
405+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
406+ err = get_user(r27, (unsigned long *)addr);
407+ if (err)
408+ break;
409+
410+ regs->r27 = r27;
411+ regs->pc = r27;
412+ return 2;
413+ }
414+ } while (0);
415+
416+ do { /* PaX: patched PLT emulation #2 */
417+ unsigned int ldah, lda, br;
418+
419+ err = get_user(ldah, (unsigned int *)regs->pc);
420+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
421+ err |= get_user(br, (unsigned int *)(regs->pc+8));
422+
423+ if (err)
424+ break;
425+
426+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
427+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
428+ (br & 0xFFE00000U) == 0xC3E00000U)
429+ {
430+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
431+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
432+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
433+
434+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
435+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
436+ return 2;
437+ }
438+ } while (0);
439+
440+ do { /* PaX: unpatched PLT emulation */
441+ unsigned int br;
442+
443+ err = get_user(br, (unsigned int *)regs->pc);
444+
445+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
446+ unsigned int br2, ldq, nop, jmp;
447+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
448+
449+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
450+ err = get_user(br2, (unsigned int *)addr);
451+ err |= get_user(ldq, (unsigned int *)(addr+4));
452+ err |= get_user(nop, (unsigned int *)(addr+8));
453+ err |= get_user(jmp, (unsigned int *)(addr+12));
454+ err |= get_user(resolver, (unsigned long *)(addr+16));
455+
456+ if (err)
457+ break;
458+
459+ if (br2 == 0xC3600000U &&
460+ ldq == 0xA77B000CU &&
461+ nop == 0x47FF041FU &&
462+ jmp == 0x6B7B0000U)
463+ {
464+ regs->r28 = regs->pc+4;
465+ regs->r27 = addr+16;
466+ regs->pc = resolver;
467+ return 3;
468+ }
469+ }
470+ } while (0);
471+#endif
472+
473+ return 1;
474+}
475+
476+void pax_report_insns(void *pc, void *sp)
477+{
478+ unsigned long i;
479+
480+ printk(KERN_ERR "PAX: bytes at PC: ");
481+ for (i = 0; i < 5; i++) {
482+ unsigned int c;
483+ if (get_user(c, (unsigned int *)pc+i))
484+ printk(KERN_CONT "???????? ");
485+ else
486+ printk(KERN_CONT "%08x ", c);
487+ }
488+ printk("\n");
489+}
490+#endif
491
492 /*
493 * This routine handles page faults. It determines the address,
494@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
495 good_area:
496 si_code = SEGV_ACCERR;
497 if (cause < 0) {
498- if (!(vma->vm_flags & VM_EXEC))
499+ if (!(vma->vm_flags & VM_EXEC)) {
500+
501+#ifdef CONFIG_PAX_PAGEEXEC
502+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
503+ goto bad_area;
504+
505+ up_read(&mm->mmap_sem);
506+ switch (pax_handle_fetch_fault(regs)) {
507+
508+#ifdef CONFIG_PAX_EMUPLT
509+ case 2:
510+ case 3:
511+ return;
512+#endif
513+
514+ }
515+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
516+ do_group_exit(SIGKILL);
517+#else
518 goto bad_area;
519+#endif
520+
521+ }
522 } else if (!cause) {
523 /* Allow reads even for write-only mappings */
524 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
66a7e928
MT		 525diff -urNp linux-2.6.39/arch/arm/common/it8152.c linux-2.6.39/arch/arm/common/it8152.c
526--- linux-2.6.39/arch/arm/common/it8152.c 2011-05-19 00:06:34.000000000 -0400
527+++ linux-2.6.39/arch/arm/common/it8152.c 2011-05-22 19:36:30.000000000 -0400
528@@ -221,7 +221,7 @@ static int it8152_pci_write_config(struc
529 return PCIBIOS_SUCCESSFUL;
530 }
531
532-static struct pci_ops it8152_ops = {
533+static const struct pci_ops it8152_ops = {
534 .read = it8152_pci_read_config,
535 .write = it8152_pci_write_config,
536 };
537diff -urNp linux-2.6.39/arch/arm/common/via82c505.c linux-2.6.39/arch/arm/common/via82c505.c
538--- linux-2.6.39/arch/arm/common/via82c505.c 2011-05-19 00:06:34.000000000 -0400
539+++ linux-2.6.39/arch/arm/common/via82c505.c 2011-05-22 19:36:30.000000000 -0400
540@@ -52,7 +52,7 @@ via82c505_write_config(struct pci_bus *b
541 return PCIBIOS_SUCCESSFUL;
542 }
543
544-static struct pci_ops via82c505_ops = {
545+static const struct pci_ops via82c505_ops = {
546 .read = via82c505_read_config,
547 .write = via82c505_write_config,
548 };
549diff -urNp linux-2.6.39/arch/arm/include/asm/cacheflush.h linux-2.6.39/arch/arm/include/asm/cacheflush.h
550--- linux-2.6.39/arch/arm/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
551+++ linux-2.6.39/arch/arm/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
552@@ -115,7 +115,7 @@ struct cpu_cache_fns {
553 */
554 #ifdef MULTI_CACHE
555
556-extern struct cpu_cache_fns cpu_cache;
557+extern const struct cpu_cache_fns cpu_cache;
558
559 #define __cpuc_flush_icache_all cpu_cache.flush_icache_all
560 #define __cpuc_flush_kern_all cpu_cache.flush_kern_all
561diff -urNp linux-2.6.39/arch/arm/include/asm/elf.h linux-2.6.39/arch/arm/include/asm/elf.h
562--- linux-2.6.39/arch/arm/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
563+++ linux-2.6.39/arch/arm/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
16454cff 564@@ -115,7 +115,14 @@ int dump_task_regs(struct task_struct *t
58c5fc13
MT		 565 the loader. We need to make sure that it is out of the way of the program
566 that it will "exec", and that there is sufficient room for the brk. */
567
568-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
569+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
570+
571+#ifdef CONFIG_PAX_ASLR
572+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
573+
574+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
575+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
576+#endif
577
578 /* When the program starts, a1 contains a pointer to a function to be
579 registered with atexit, as per the SVR4 ABI. A value of 0 means we
16454cff 580@@ -125,10 +132,6 @@ int dump_task_regs(struct task_struct *t
bc901d79
MT		 581 extern void elf_set_personality(const struct elf32_hdr *);
582 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
583
584-struct mm_struct;
585-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
586-#define arch_randomize_brk arch_randomize_brk
587-
588 extern int vectors_user_mapping(void);
589 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
590 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
66a7e928
MT		 591diff -urNp linux-2.6.39/arch/arm/include/asm/kmap_types.h linux-2.6.39/arch/arm/include/asm/kmap_types.h
592--- linux-2.6.39/arch/arm/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
593+++ linux-2.6.39/arch/arm/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
57199397 594@@ -21,6 +21,7 @@ enum km_type {
df50ba0c 595 KM_L1_CACHE,
58c5fc13 596 KM_L2_CACHE,
57199397 597 KM_KDB,
58c5fc13
MT		 598+ KM_CLEARPAGE,
599 KM_TYPE_NR
600 };
601
66a7e928
MT		 602diff -urNp linux-2.6.39/arch/arm/include/asm/outercache.h linux-2.6.39/arch/arm/include/asm/outercache.h
603--- linux-2.6.39/arch/arm/include/asm/outercache.h 2011-05-19 00:06:34.000000000 -0400
604+++ linux-2.6.39/arch/arm/include/asm/outercache.h 2011-05-22 19:36:30.000000000 -0400
605@@ -38,7 +38,7 @@ struct outer_cache_fns {
606
607 #ifdef CONFIG_OUTER_CACHE
608
609-extern struct outer_cache_fns outer_cache;
610+extern const struct outer_cache_fns outer_cache;
611
612 static inline void outer_inv_range(phys_addr_t start, phys_addr_t end)
613 {
614diff -urNp linux-2.6.39/arch/arm/include/asm/page.h linux-2.6.39/arch/arm/include/asm/page.h
615--- linux-2.6.39/arch/arm/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
616+++ linux-2.6.39/arch/arm/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
617@@ -126,7 +126,7 @@ struct cpu_user_fns {
618 };
619
620 #ifdef MULTI_USER
621-extern struct cpu_user_fns cpu_user;
622+extern const struct cpu_user_fns cpu_user;
623
624 #define __cpu_clear_user_highpage cpu_user.cpu_clear_user_highpage
625 #define __cpu_copy_user_highpage cpu_user.cpu_copy_user_highpage
626diff -urNp linux-2.6.39/arch/arm/include/asm/uaccess.h linux-2.6.39/arch/arm/include/asm/uaccess.h
627--- linux-2.6.39/arch/arm/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
628+++ linux-2.6.39/arch/arm/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 629@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
58c5fc13
MT		 630
631 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
632 {
633+ if ((long)n < 0)
634+ return n;
635+
636 if (access_ok(VERIFY_READ, from, n))
637 n = __copy_from_user(to, from, n);
638 else /* security hole - plug it */
ae4e228f 639@@ -412,6 +415,9 @@ static inline unsigned long __must_check
58c5fc13
MT		 640
641 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
642 {
643+ if ((long)n < 0)
644+ return n;
645+
646 if (access_ok(VERIFY_WRITE, to, n))
647 n = __copy_to_user(to, from, n);
648 return n;
66a7e928
MT		 649diff -urNp linux-2.6.39/arch/arm/kernel/kgdb.c linux-2.6.39/arch/arm/kernel/kgdb.c
650--- linux-2.6.39/arch/arm/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
651+++ linux-2.6.39/arch/arm/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
6892158b 652@@ -246,7 +246,7 @@ void kgdb_arch_exit(void)
ae4e228f
MT		 653 * and we handle the normal undef case within the do_undefinstr
654 * handler.
655 */
656-struct kgdb_arch arch_kgdb_ops = {
657+const struct kgdb_arch arch_kgdb_ops = {
658 #ifndef __ARMEB__
659 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
660 #else /* ! __ARMEB__ */
66a7e928
MT		 661diff -urNp linux-2.6.39/arch/arm/kernel/process.c linux-2.6.39/arch/arm/kernel/process.c
662--- linux-2.6.39/arch/arm/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
663+++ linux-2.6.39/arch/arm/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 664@@ -28,7 +28,6 @@
665 #include <linux/tick.h>
666 #include <linux/utsname.h>
667 #include <linux/uaccess.h>
668-#include <linux/random.h>
669 #include <linux/hw_breakpoint.h>
670
671 #include <asm/cacheflush.h>
66a7e928 672@@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
bc901d79
MT		 673 return 0;
674 }
675
676-unsigned long arch_randomize_brk(struct mm_struct *mm)
677-{
678- unsigned long range_end = mm->brk + 0x02000000;
679- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
680-}
681-
16454cff 682 #ifdef CONFIG_MMU
bc901d79
MT		 683 /*
684 * The vectors page is always readable from user space for the
66a7e928
MT		 685diff -urNp linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c
686--- linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c 2011-05-19 00:06:34.000000000 -0400
687+++ linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c 2011-05-22 19:36:30.000000000 -0400
688@@ -162,7 +162,7 @@ static int cns3xxx_pci_setup(int nr, str
689 return 1;
690 }
691
692-static struct pci_ops cns3xxx_pcie_ops = {
693+static const struct pci_ops cns3xxx_pcie_ops = {
694 .read = cns3xxx_pci_read_config,
695 .write = cns3xxx_pci_write_config,
696 };
697diff -urNp linux-2.6.39/arch/arm/mach-dove/pcie.c linux-2.6.39/arch/arm/mach-dove/pcie.c
698--- linux-2.6.39/arch/arm/mach-dove/pcie.c 2011-05-19 00:06:34.000000000 -0400
699+++ linux-2.6.39/arch/arm/mach-dove/pcie.c 2011-05-22 19:36:30.000000000 -0400
700@@ -155,7 +155,7 @@ static int pcie_wr_conf(struct pci_bus *
701 return ret;
702 }
703
704-static struct pci_ops pcie_ops = {
705+static const struct pci_ops pcie_ops = {
706 .read = pcie_rd_conf,
707 .write = pcie_wr_conf,
708 };
709diff -urNp linux-2.6.39/arch/arm/mach-footbridge/dc21285.c linux-2.6.39/arch/arm/mach-footbridge/dc21285.c
710--- linux-2.6.39/arch/arm/mach-footbridge/dc21285.c 2011-05-19 00:06:34.000000000 -0400
711+++ linux-2.6.39/arch/arm/mach-footbridge/dc21285.c 2011-05-22 19:36:30.000000000 -0400
712@@ -129,7 +129,7 @@ dc21285_write_config(struct pci_bus *bus
713 return PCIBIOS_SUCCESSFUL;
714 }
715
716-static struct pci_ops dc21285_ops = {
717+static const struct pci_ops dc21285_ops = {
718 .read = dc21285_read_config,
719 .write = dc21285_write_config,
720 };
721diff -urNp linux-2.6.39/arch/arm/mach-integrator/pci_v3.c linux-2.6.39/arch/arm/mach-integrator/pci_v3.c
722--- linux-2.6.39/arch/arm/mach-integrator/pci_v3.c 2011-05-19 00:06:34.000000000 -0400
723+++ linux-2.6.39/arch/arm/mach-integrator/pci_v3.c 2011-05-22 19:36:30.000000000 -0400
724@@ -340,7 +340,7 @@ static int v3_write_config(struct pci_bu
725 return PCIBIOS_SUCCESSFUL;
726 }
727
728-static struct pci_ops pci_v3_ops = {
729+static const struct pci_ops pci_v3_ops = {
730 .read = v3_read_config,
731 .write = v3_write_config,
732 };
733diff -urNp linux-2.6.39/arch/arm/mach-iop13xx/pci.c linux-2.6.39/arch/arm/mach-iop13xx/pci.c
734--- linux-2.6.39/arch/arm/mach-iop13xx/pci.c 2011-05-19 00:06:34.000000000 -0400
735+++ linux-2.6.39/arch/arm/mach-iop13xx/pci.c 2011-05-22 19:36:30.000000000 -0400
736@@ -324,7 +324,7 @@ iop13xx_atux_write_config(struct pci_bus
737 return PCIBIOS_SUCCESSFUL;
738 }
739
740-static struct pci_ops iop13xx_atux_ops = {
741+static const struct pci_ops iop13xx_atux_ops = {
742 .read = iop13xx_atux_read_config,
743 .write = iop13xx_atux_write_config,
744 };
745@@ -471,7 +471,7 @@ iop13xx_atue_write_config(struct pci_bus
746 return PCIBIOS_SUCCESSFUL;
747 }
748
749-static struct pci_ops iop13xx_atue_ops = {
750+static const struct pci_ops iop13xx_atue_ops = {
751 .read = iop13xx_atue_read_config,
752 .write = iop13xx_atue_write_config,
753 };
754diff -urNp linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c
755--- linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c 2011-05-19 00:06:34.000000000 -0400
756+++ linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c 2011-05-22 19:36:30.000000000 -0400
757@@ -137,7 +137,7 @@ static int enp2611_pci_write_config(stru
758 return PCIBIOS_DEVICE_NOT_FOUND;
759 }
760
761-static struct pci_ops enp2611_pci_ops = {
762+static const struct pci_ops enp2611_pci_ops = {
763 .read = enp2611_pci_read_config,
764 .write = enp2611_pci_write_config
765 };
766diff -urNp linux-2.6.39/arch/arm/mach-ixp2000/pci.c linux-2.6.39/arch/arm/mach-ixp2000/pci.c
767--- linux-2.6.39/arch/arm/mach-ixp2000/pci.c 2011-05-19 00:06:34.000000000 -0400
768+++ linux-2.6.39/arch/arm/mach-ixp2000/pci.c 2011-05-22 19:36:30.000000000 -0400
769@@ -125,7 +125,7 @@ int ixp2000_pci_write_config(struct pci_
770 }
771
772
773-static struct pci_ops ixp2000_pci_ops = {
774+static const struct pci_ops ixp2000_pci_ops = {
775 .read = ixp2000_pci_read_config,
776 .write = ixp2000_pci_write_config
777 };
778diff -urNp linux-2.6.39/arch/arm/mach-ixp23xx/pci.c linux-2.6.39/arch/arm/mach-ixp23xx/pci.c
779--- linux-2.6.39/arch/arm/mach-ixp23xx/pci.c 2011-05-19 00:06:34.000000000 -0400
780+++ linux-2.6.39/arch/arm/mach-ixp23xx/pci.c 2011-05-22 19:36:30.000000000 -0400
781@@ -136,7 +136,7 @@ static int ixp23xx_pci_write_config(stru
782 return PCIBIOS_SUCCESSFUL;
783 }
784
785-struct pci_ops ixp23xx_pci_ops = {
786+const struct pci_ops ixp23xx_pci_ops = {
787 .read = ixp23xx_pci_read_config,
788 .write = ixp23xx_pci_write_config,
789 };
790diff -urNp linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c
791--- linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c 2011-05-19 00:06:34.000000000 -0400
792+++ linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c 2011-05-22 19:36:30.000000000 -0400
793@@ -283,7 +283,7 @@ static int ixp4xx_pci_write_config(struc
794 return PCIBIOS_SUCCESSFUL;
795 }
796
797-struct pci_ops ixp4xx_ops = {
798+const struct pci_ops ixp4xx_ops = {
799 .read = ixp4xx_pci_read_config,
800 .write = ixp4xx_pci_write_config,
801 };
802diff -urNp linux-2.6.39/arch/arm/mach-kirkwood/pcie.c linux-2.6.39/arch/arm/mach-kirkwood/pcie.c
803--- linux-2.6.39/arch/arm/mach-kirkwood/pcie.c 2011-05-19 00:06:34.000000000 -0400
804+++ linux-2.6.39/arch/arm/mach-kirkwood/pcie.c 2011-05-22 19:36:30.000000000 -0400
805@@ -111,7 +111,7 @@ static int pcie_wr_conf(struct pci_bus *
806 return ret;
807 }
808
809-static struct pci_ops pcie_ops = {
810+static const struct pci_ops pcie_ops = {
811 .read = pcie_rd_conf,
812 .write = pcie_wr_conf,
813 };
814diff -urNp linux-2.6.39/arch/arm/mach-ks8695/pci.c linux-2.6.39/arch/arm/mach-ks8695/pci.c
815--- linux-2.6.39/arch/arm/mach-ks8695/pci.c 2011-05-19 00:06:34.000000000 -0400
816+++ linux-2.6.39/arch/arm/mach-ks8695/pci.c 2011-05-22 19:36:30.000000000 -0400
817@@ -136,7 +136,7 @@ static void ks8695_local_writeconfig(int
818 __raw_writel(value, KS8695_PCI_VA + KS8695_PBCD);
819 }
820
821-static struct pci_ops ks8695_pci_ops = {
822+static const struct pci_ops ks8695_pci_ops = {
823 .read = ks8695_pci_readconfig,
824 .write = ks8695_pci_writeconfig,
825 };
826diff -urNp linux-2.6.39/arch/arm/mach-mmp/clock.c linux-2.6.39/arch/arm/mach-mmp/clock.c
827--- linux-2.6.39/arch/arm/mach-mmp/clock.c 2011-05-19 00:06:34.000000000 -0400
828+++ linux-2.6.39/arch/arm/mach-mmp/clock.c 2011-05-22 19:36:30.000000000 -0400
829@@ -29,7 +29,7 @@ static void apbc_clk_disable(struct clk
830 __raw_writel(0, clk->clk_rst);
831 }
832
833-struct clkops apbc_clk_ops = {
834+const struct clkops apbc_clk_ops = {
835 .enable = apbc_clk_enable,
836 .disable = apbc_clk_disable,
837 };
838@@ -44,7 +44,7 @@ static void apmu_clk_disable(struct clk
839 __raw_writel(0, clk->clk_rst);
840 }
841
842-struct clkops apmu_clk_ops = {
843+const struct clkops apmu_clk_ops = {
844 .enable = apmu_clk_enable,
845 .disable = apmu_clk_disable,
846 };
847diff -urNp linux-2.6.39/arch/arm/mach-msm/iommu.c linux-2.6.39/arch/arm/mach-msm/iommu.c
848--- linux-2.6.39/arch/arm/mach-msm/iommu.c 2011-05-19 00:06:34.000000000 -0400
849+++ linux-2.6.39/arch/arm/mach-msm/iommu.c 2011-05-22 19:36:30.000000000 -0400
850@@ -669,7 +669,7 @@ fail:
851 return 0;
852 }
853
854-static struct iommu_ops msm_iommu_ops = {
855+static const struct iommu_ops msm_iommu_ops = {
856 .domain_init = msm_iommu_domain_init,
857 .domain_destroy = msm_iommu_domain_destroy,
858 .attach_dev = msm_iommu_attach_dev,
859diff -urNp linux-2.6.39/arch/arm/mach-msm/last_radio_log.c linux-2.6.39/arch/arm/mach-msm/last_radio_log.c
860--- linux-2.6.39/arch/arm/mach-msm/last_radio_log.c 2011-05-19 00:06:34.000000000 -0400
861+++ linux-2.6.39/arch/arm/mach-msm/last_radio_log.c 2011-05-22 19:36:30.000000000 -0400
862@@ -48,6 +48,7 @@ static ssize_t last_radio_log_read(struc
57199397
MT		 863 }
864
66a7e928
MT		 865 static struct file_operations last_radio_log_fops = {
866+ /* cannot be const, see msm_init_last_radio_log */
bc901d79
MT		 867 .read = last_radio_log_read,
868 .llseek = default_llseek,
16454cff 869 };
66a7e928
MT		 870diff -urNp linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c
871--- linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c 2011-05-19 00:06:34.000000000 -0400
872+++ linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c 2011-05-22 19:36:30.000000000 -0400
873@@ -222,7 +222,7 @@ static int pcie_wr_conf(struct pci_bus *
874 return ret;
875 }
876
877-static struct pci_ops pcie_ops = {
878+static const struct pci_ops pcie_ops = {
879 .read = pcie_rd_conf,
880 .write = pcie_wr_conf,
881 };
882diff -urNp linux-2.6.39/arch/arm/mach-orion5x/pci.c linux-2.6.39/arch/arm/mach-orion5x/pci.c
883--- linux-2.6.39/arch/arm/mach-orion5x/pci.c 2011-05-19 00:06:34.000000000 -0400
884+++ linux-2.6.39/arch/arm/mach-orion5x/pci.c 2011-05-22 19:36:30.000000000 -0400
885@@ -130,7 +130,7 @@ static int pcie_wr_conf(struct pci_bus *
886 return ret;
887 }
888
889-static struct pci_ops pcie_ops = {
890+static const struct pci_ops pcie_ops = {
891 .read = pcie_rd_conf,
892 .write = pcie_wr_conf,
893 };
894@@ -368,7 +368,7 @@ static int orion5x_pci_wr_conf(struct pc
895 PCI_FUNC(devfn), where, size, val);
896 }
897
898-static struct pci_ops pci_ops = {
899+static const struct pci_ops pci_ops = {
900 .read = orion5x_pci_rd_conf,
901 .write = orion5x_pci_wr_conf,
902 };
903diff -urNp linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c
904--- linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-19 00:06:34.000000000 -0400
905+++ linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-22 19:36:30.000000000 -0400
906@@ -117,7 +117,7 @@ static int nanoengine_write_config(struc
907 return PCIBIOS_SUCCESSFUL;
908 }
909
910-static struct pci_ops pci_nano_ops = {
911+static const struct pci_ops pci_nano_ops = {
912 .read = nanoengine_read_config,
913 .write = nanoengine_write_config,
914 };
915diff -urNp linux-2.6.39/arch/arm/mach-tegra/pcie.c linux-2.6.39/arch/arm/mach-tegra/pcie.c
916--- linux-2.6.39/arch/arm/mach-tegra/pcie.c 2011-05-19 00:06:34.000000000 -0400
917+++ linux-2.6.39/arch/arm/mach-tegra/pcie.c 2011-05-22 19:36:30.000000000 -0400
918@@ -336,7 +336,7 @@ static int tegra_pcie_write_conf(struct
919 return PCIBIOS_SUCCESSFUL;
920 }
921
922-static struct pci_ops tegra_pcie_ops = {
923+static const struct pci_ops tegra_pcie_ops = {
924 .read = tegra_pcie_read_conf,
925 .write = tegra_pcie_write_conf,
926 };
927diff -urNp linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c
928--- linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c 2011-05-19 00:06:34.000000000 -0400
929+++ linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c 2011-05-22 19:41:32.000000000 -0400
317566c1
MT		 930@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
931 return sprintf(buf, "0x%X\n", mbox_value);
932 }
933
934-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
935+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
936
937 static int mbox_show(struct seq_file *s, void *data)
938 {
66a7e928
MT		 939diff -urNp linux-2.6.39/arch/arm/mach-versatile/pci.c linux-2.6.39/arch/arm/mach-versatile/pci.c
940--- linux-2.6.39/arch/arm/mach-versatile/pci.c 2011-05-19 00:06:34.000000000 -0400
941+++ linux-2.6.39/arch/arm/mach-versatile/pci.c 2011-05-22 19:36:30.000000000 -0400
942@@ -165,7 +165,7 @@ static int versatile_write_config(struct
943 return PCIBIOS_SUCCESSFUL;
944 }
945
946-static struct pci_ops pci_versatile_ops = {
947+static const struct pci_ops pci_versatile_ops = {
948 .read = versatile_read_config,
949 .write = versatile_write_config,
950 };
951diff -urNp linux-2.6.39/arch/arm/mm/fault.c linux-2.6.39/arch/arm/mm/fault.c
952--- linux-2.6.39/arch/arm/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
953+++ linux-2.6.39/arch/arm/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
954@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
ae4e228f
MT		 955 }
956 #endif
957
958+#ifdef CONFIG_PAX_PAGEEXEC
959+ if (fsr & FSR_LNX_PF) {
960+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
961+ do_group_exit(SIGKILL);
962+ }
963+#endif
964+
965 tsk->thread.address = addr;
966 tsk->thread.error_code = fsr;
967 tsk->thread.trap_no = 14;
66a7e928 968@@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
ae4e228f
MT		 969 }
970 #endif /* CONFIG_MMU */
971
972+#ifdef CONFIG_PAX_PAGEEXEC
973+void pax_report_insns(void *pc, void *sp)
974+{
975+ long i;
976+
977+ printk(KERN_ERR "PAX: bytes at PC: ");
978+ for (i = 0; i < 20; i++) {
979+ unsigned char c;
980+ if (get_user(c, (__force unsigned char __user *)pc+i))
981+ printk(KERN_CONT "?? ");
982+ else
983+ printk(KERN_CONT "%02x ", c);
984+ }
985+ printk("\n");
986+
987+ printk(KERN_ERR "PAX: bytes at SP-4: ");
988+ for (i = -1; i < 20; i++) {
989+ unsigned long c;
990+ if (get_user(c, (__force unsigned long __user *)sp+i))
991+ printk(KERN_CONT "???????? ");
992+ else
993+ printk(KERN_CONT "%08lx ", c);
994+ }
995+ printk("\n");
996+}
997+#endif
998+
999 /*
1000 * First Level Translation Fault Handler
1001 *
66a7e928
MT		 1002diff -urNp linux-2.6.39/arch/arm/mm/mmap.c linux-2.6.39/arch/arm/mm/mmap.c
1003--- linux-2.6.39/arch/arm/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
1004+++ linux-2.6.39/arch/arm/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
1005@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
58c5fc13
MT		 1006 if (len > TASK_SIZE)
1007 return -ENOMEM;
1008
1009+#ifdef CONFIG_PAX_RANDMMAP
1010+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1011+#endif
1012+
1013 if (addr) {
1014 if (do_align)
1015 addr = COLOUR_ALIGN(addr, pgoff);
66a7e928 1016@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
57199397
MT		 1017 addr = PAGE_ALIGN(addr);
1018
1019 vma = find_vma(mm, addr);
1020- if (TASK_SIZE - len >= addr &&
1021- (!vma || addr + len <= vma->vm_start))
1022+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
58c5fc13
MT		 1023 return addr;
1024 }
1025 if (len > mm->cached_hole_size) {
1026- start_addr = addr = mm->free_area_cache;
1027+ start_addr = addr = mm->free_area_cache;
1028 } else {
1029- start_addr = addr = TASK_UNMAPPED_BASE;
1030- mm->cached_hole_size = 0;
1031+ start_addr = addr = mm->mmap_base;
1032+ mm->cached_hole_size = 0;
1033 }
6892158b 1034 /* 8 bits of randomness in 20 address space bits */
66a7e928
MT		 1035 if ((current->flags & PF_RANDOMIZE) &&
1036@@ -100,14 +103,14 @@ full_search:
58c5fc13
MT		 1037 * Start a new search - just in case we missed
1038 * some holes.
1039 */
1040- if (start_addr != TASK_UNMAPPED_BASE) {
1041- start_addr = addr = TASK_UNMAPPED_BASE;
1042+ if (start_addr != mm->mmap_base) {
1043+ start_addr = addr = mm->mmap_base;
1044 mm->cached_hole_size = 0;
1045 goto full_search;
1046 }
57199397
MT		 1047 return -ENOMEM;
1048 }
1049- if (!vma || addr + len <= vma->vm_start) {
1050+ if (check_heap_stack_gap(vma, addr, len)) {
1051 /*
1052 * Remember the place where we stopped the search:
1053 */
66a7e928
MT		 1054diff -urNp linux-2.6.39/arch/arm/plat-iop/pci.c linux-2.6.39/arch/arm/plat-iop/pci.c
1055--- linux-2.6.39/arch/arm/plat-iop/pci.c 2011-05-19 00:06:34.000000000 -0400
1056+++ linux-2.6.39/arch/arm/plat-iop/pci.c 2011-05-22 19:36:30.000000000 -0400
1057@@ -161,7 +161,7 @@ iop3xx_write_config(struct pci_bus *bus,
1058 return PCIBIOS_SUCCESSFUL;
1059 }
1060
1061-static struct pci_ops iop3xx_ops = {
1062+static const struct pci_ops iop3xx_ops = {
1063 .read = iop3xx_read_config,
1064 .write = iop3xx_write_config,
1065 };
1066diff -urNp linux-2.6.39/arch/avr32/include/asm/elf.h linux-2.6.39/arch/avr32/include/asm/elf.h
1067--- linux-2.6.39/arch/avr32/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1068+++ linux-2.6.39/arch/avr32/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 1069@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
58c5fc13
MT		 1070 the loader. We need to make sure that it is out of the way of the program
1071 that it will "exec", and that there is sufficient room for the brk. */
1072
1073-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1074+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1075
1076+#ifdef CONFIG_PAX_ASLR
1077+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1078+
1079+#define PAX_DELTA_MMAP_LEN 15
1080+#define PAX_DELTA_STACK_LEN 15
1081+#endif
1082
1083 /* This yields a mask that user programs can use to figure out what
1084 instruction set this CPU supports. This could be done in user space,
66a7e928
MT		 1085diff -urNp linux-2.6.39/arch/avr32/include/asm/kmap_types.h linux-2.6.39/arch/avr32/include/asm/kmap_types.h
1086--- linux-2.6.39/arch/avr32/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1087+++ linux-2.6.39/arch/avr32/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1088@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1089 D(11) KM_IRQ1,
1090 D(12) KM_SOFTIRQ0,
1091 D(13) KM_SOFTIRQ1,
1092-D(14) KM_TYPE_NR
1093+D(14) KM_CLEARPAGE,
1094+D(15) KM_TYPE_NR
1095 };
1096
1097 #undef D
66a7e928
MT		 1098diff -urNp linux-2.6.39/arch/avr32/mm/fault.c linux-2.6.39/arch/avr32/mm/fault.c
1099--- linux-2.6.39/arch/avr32/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1100+++ linux-2.6.39/arch/avr32/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1101@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
1102
1103 int exception_trace = 1;
1104
1105+#ifdef CONFIG_PAX_PAGEEXEC
1106+void pax_report_insns(void *pc, void *sp)
1107+{
1108+ unsigned long i;
1109+
1110+ printk(KERN_ERR "PAX: bytes at PC: ");
1111+ for (i = 0; i < 20; i++) {
1112+ unsigned char c;
1113+ if (get_user(c, (unsigned char *)pc+i))
1114+ printk(KERN_CONT "???????? ");
1115+ else
1116+ printk(KERN_CONT "%02x ", c);
1117+ }
1118+ printk("\n");
1119+}
1120+#endif
1121+
1122 /*
1123 * This routine handles page faults. It determines the address and the
1124 * problem, and then passes it off to one of the appropriate routines.
6892158b 1125@@ -156,6 +173,16 @@ bad_area:
58c5fc13
MT		 1126 up_read(&mm->mmap_sem);
1127
1128 if (user_mode(regs)) {
1129+
1130+#ifdef CONFIG_PAX_PAGEEXEC
1131+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1132+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1133+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1134+ do_group_exit(SIGKILL);
1135+ }
1136+ }
1137+#endif
1138+
1139 if (exception_trace && printk_ratelimit())
1140 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1141 "sp %08lx ecr %lu\n",
66a7e928
MT		 1142diff -urNp linux-2.6.39/arch/blackfin/kernel/kgdb.c linux-2.6.39/arch/blackfin/kernel/kgdb.c
1143--- linux-2.6.39/arch/blackfin/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1144+++ linux-2.6.39/arch/blackfin/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
16454cff 1145@@ -420,7 +420,7 @@ int kgdb_arch_handle_exception(int vecto
ae4e228f 1146 return -1; /* this means that we do not want to exit from the handler */
58c5fc13
MT		 1147 }
1148
ae4e228f
MT		 1149-struct kgdb_arch arch_kgdb_ops = {
1150+const struct kgdb_arch arch_kgdb_ops = {
1151 .gdb_bpt_instr = {0xa1},
66a7e928
MT		 1152 .flags = KGDB_HW_BREAKPOINT,
1153 .set_hw_breakpoint = bfin_set_hw_break,
1154diff -urNp linux-2.6.39/arch/blackfin/mm/maccess.c linux-2.6.39/arch/blackfin/mm/maccess.c
1155--- linux-2.6.39/arch/blackfin/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
1156+++ linux-2.6.39/arch/blackfin/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 1157@@ -16,7 +16,7 @@ static int validate_memory_access_addres
1158 return bfin_mem_access_type(addr, size);
58c5fc13
MT		 1159 }
1160
ae4e228f
MT		 1161-long probe_kernel_read(void *dst, void *src, size_t size)
1162+long probe_kernel_read(void *dst, const void *src, size_t size)
58c5fc13 1163 {
ae4e228f
MT		 1164 unsigned long lsrc = (unsigned long)src;
1165 int mem_type;
1166@@ -55,7 +55,7 @@ long probe_kernel_read(void *dst, void *
1167 return -EFAULT;
58c5fc13
MT		 1168 }
1169
ae4e228f
MT		 1170-long probe_kernel_write(void *dst, void *src, size_t size)
1171+long probe_kernel_write(void *dst, const void *src, size_t size)
58c5fc13 1172 {
ae4e228f
MT		 1173 unsigned long ldst = (unsigned long)dst;
1174 int mem_type;
66a7e928
MT		 1175diff -urNp linux-2.6.39/arch/frv/include/asm/kmap_types.h linux-2.6.39/arch/frv/include/asm/kmap_types.h
1176--- linux-2.6.39/arch/frv/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1177+++ linux-2.6.39/arch/frv/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1178@@ -23,6 +23,7 @@ enum km_type {
1179 KM_IRQ1,
1180 KM_SOFTIRQ0,
1181 KM_SOFTIRQ1,
1182+ KM_CLEARPAGE,
1183 KM_TYPE_NR
1184 };
1185
66a7e928
MT		 1186diff -urNp linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h
1187--- linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h 2011-05-19 00:06:34.000000000 -0400
1188+++ linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h 2011-05-22 19:36:30.000000000 -0400
1189@@ -34,7 +34,7 @@ void pcibios_resource_survey(void);
1190
1191 extern int __nongpreldata pcibios_last_bus;
1192 extern struct pci_bus *__nongpreldata pci_root_bus;
1193-extern struct pci_ops *__nongpreldata pci_root_ops;
1194+extern const struct pci_ops *__nongpreldata pci_root_ops;
1195
1196 /* pci-irq.c */
1197 extern unsigned int pcibios_irq_mask;
1198diff -urNp linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c
1199--- linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-19 00:06:34.000000000 -0400
1200+++ linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-22 19:36:30.000000000 -0400
1201@@ -27,7 +27,7 @@ unsigned int __nongpreldata pci_probe =
1202
1203 int __nongpreldata pcibios_last_bus = -1;
1204 struct pci_bus *__nongpreldata pci_root_bus;
1205-struct pci_ops *__nongpreldata pci_root_ops;
1206+const struct pci_ops *__nongpreldata pci_root_ops;
1207
1208 /*
1209 * The accessible PCI window does not cover the entire CPU address space, but
1210@@ -169,7 +169,7 @@ static int pci_frv_write_config(struct p
1211 return PCIBIOS_SUCCESSFUL;
1212 }
1213
1214-static struct pci_ops pci_direct_frv = {
1215+static const struct pci_ops pci_direct_frv = {
1216 pci_frv_read_config,
1217 pci_frv_write_config,
1218 };
1219@@ -356,7 +356,7 @@ void __init pcibios_fixup_bus(struct pci
1220
1221 int __init pcibios_init(void)
1222 {
1223- struct pci_ops *dir = NULL;
1224+ const struct pci_ops *dir = NULL;
1225
1226 if (!mb93090_mb00_detected)
1227 return -ENXIO;
1228diff -urNp linux-2.6.39/arch/frv/mm/elf-fdpic.c linux-2.6.39/arch/frv/mm/elf-fdpic.c
1229--- linux-2.6.39/arch/frv/mm/elf-fdpic.c 2011-05-19 00:06:34.000000000 -0400
1230+++ linux-2.6.39/arch/frv/mm/elf-fdpic.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 1231@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
1232 if (addr) {
1233 addr = PAGE_ALIGN(addr);
1234 vma = find_vma(current->mm, addr);
1235- if (TASK_SIZE - len >= addr &&
1236- (!vma || addr + len <= vma->vm_start))
1237+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1238 goto success;
1239 }
1240
1241@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
1242 for (; vma; vma = vma->vm_next) {
1243 if (addr > limit)
1244 break;
1245- if (addr + len <= vma->vm_start)
1246+ if (check_heap_stack_gap(vma, addr, len))
1247 goto success;
1248 addr = vma->vm_end;
1249 }
1250@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
1251 for (; vma; vma = vma->vm_next) {
1252 if (addr > limit)
1253 break;
1254- if (addr + len <= vma->vm_start)
1255+ if (check_heap_stack_gap(vma, addr, len))
1256 goto success;
1257 addr = vma->vm_end;
1258 }
66a7e928
MT		 1259diff -urNp linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c
1260--- linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c 2011-05-19 00:06:34.000000000 -0400
1261+++ linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 1262@@ -17,7 +17,7 @@
1263 #include <linux/swiotlb.h>
1264 #include <asm/machvec.h>
58c5fc13 1265
ae4e228f
MT		 1266-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1267+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
58c5fc13 1268
ae4e228f
MT		 1269 /* swiotlb declarations & definitions: */
1270 extern int swiotlb_late_init_with_default_size (size_t size);
1271@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
1272 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
58c5fc13
MT		 1273 }
1274
ae4e228f
MT		 1275-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1276+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1277 {
1278 if (use_swiotlb(dev))
1279 return &swiotlb_dma_ops;
66a7e928
MT		 1280diff -urNp linux-2.6.39/arch/ia64/hp/common/sba_iommu.c linux-2.6.39/arch/ia64/hp/common/sba_iommu.c
1281--- linux-2.6.39/arch/ia64/hp/common/sba_iommu.c 2011-05-19 00:06:34.000000000 -0400
1282+++ linux-2.6.39/arch/ia64/hp/common/sba_iommu.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 1283@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
1284 },
1285 };
58c5fc13 1286
ae4e228f
MT		 1287-extern struct dma_map_ops swiotlb_dma_ops;
1288+extern const struct dma_map_ops swiotlb_dma_ops;
58c5fc13 1289
ae4e228f
MT		 1290 static int __init
1291 sba_init(void)
1292@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
58c5fc13 1293
ae4e228f 1294 __setup("sbapagesize=",sba_page_override);
58c5fc13 1295
ae4e228f
MT		 1296-struct dma_map_ops sba_dma_ops = {
1297+const struct dma_map_ops sba_dma_ops = {
1298 .alloc_coherent = sba_alloc_coherent,
1299 .free_coherent = sba_free_coherent,
1300 .map_page = sba_map_page,
66a7e928
MT		 1301diff -urNp linux-2.6.39/arch/ia64/include/asm/dma-mapping.h linux-2.6.39/arch/ia64/include/asm/dma-mapping.h
1302--- linux-2.6.39/arch/ia64/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1303+++ linux-2.6.39/arch/ia64/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1304@@ -14,7 +14,7 @@
58c5fc13 1305
66a7e928 1306 #define DMA_ERROR_CODE 0
ae4e228f
MT		 1307
1308-extern struct dma_map_ops *dma_ops;
1309+extern const struct dma_map_ops *dma_ops;
1310 extern struct ia64_machine_vector ia64_mv;
1311 extern void set_iommu_machvec(void);
58c5fc13 1312
66a7e928 1313@@ -26,7 +26,7 @@ extern void machvec_dma_sync_sg(struct d
ae4e228f
MT		 1314 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1315 dma_addr_t *daddr, gfp_t gfp)
1316 {
1317- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1318+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1319 void *caddr;
1320
1321 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
66a7e928 1322@@ -37,7 +37,7 @@ static inline void *dma_alloc_coherent(s
ae4e228f
MT		 1323 static inline void dma_free_coherent(struct device *dev, size_t size,
1324 void *caddr, dma_addr_t daddr)
1325 {
1326- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1327+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1328 debug_dma_free_coherent(dev, size, caddr, daddr);
1329 ops->free_coherent(dev, size, caddr, daddr);
1330 }
66a7e928 1331@@ -51,13 +51,13 @@ static inline void dma_free_coherent(str
ae4e228f
MT		 1332
1333 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
1334 {
1335- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1336+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1337 return ops->mapping_error(dev, daddr);
1338 }
1339
1340 static inline int dma_supported(struct device *dev, u64 mask)
1341 {
1342- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1343+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1344 return ops->dma_supported(dev, mask);
1345 }
1346
66a7e928
MT		 1347diff -urNp linux-2.6.39/arch/ia64/include/asm/elf.h linux-2.6.39/arch/ia64/include/asm/elf.h
1348--- linux-2.6.39/arch/ia64/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1349+++ linux-2.6.39/arch/ia64/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 1350@@ -42,6 +42,13 @@
58c5fc13
MT		 1351 */
1352 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1353
1354+#ifdef CONFIG_PAX_ASLR
1355+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1356+
1357+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1358+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1359+#endif
1360+
1361 #define PT_IA_64_UNWIND 0x70000001
1362
1363 /* IA-64 relocations: */
66a7e928
MT		 1364diff -urNp linux-2.6.39/arch/ia64/include/asm/machvec.h linux-2.6.39/arch/ia64/include/asm/machvec.h
1365--- linux-2.6.39/arch/ia64/include/asm/machvec.h 2011-05-19 00:06:34.000000000 -0400
1366+++ linux-2.6.39/arch/ia64/include/asm/machvec.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 1367@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1368 /* DMA-mapping interface: */
1369 typedef void ia64_mv_dma_init (void);
1370 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1371-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1372+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1373
1374 /*
1375 * WARNING: The legacy I/O space is _architected_. Platforms are
1376@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1377 # endif /* CONFIG_IA64_GENERIC */
1378
1379 extern void swiotlb_dma_init(void);
1380-extern struct dma_map_ops *dma_get_ops(struct device *);
1381+extern const struct dma_map_ops *dma_get_ops(struct device *);
1382
1383 /*
1384 * Define default versions so we can extend machvec for new platforms without having
66a7e928
MT		 1385diff -urNp linux-2.6.39/arch/ia64/include/asm/pgtable.h linux-2.6.39/arch/ia64/include/asm/pgtable.h
1386--- linux-2.6.39/arch/ia64/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
1387+++ linux-2.6.39/arch/ia64/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 1388@@ -12,7 +12,7 @@
1389 * David Mosberger-Tang <davidm@hpl.hp.com>
1390 */
1391
1392-
1393+#include <linux/const.h>
1394 #include <asm/mman.h>
1395 #include <asm/page.h>
1396 #include <asm/processor.h>
58c5fc13
MT		 1397@@ -143,6 +143,17 @@
1398 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1399 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1400 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1401+
1402+#ifdef CONFIG_PAX_PAGEEXEC
1403+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1404+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1405+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1406+#else
1407+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1408+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1409+# define PAGE_COPY_NOEXEC PAGE_COPY
1410+#endif
1411+
1412 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1413 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1414 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
66a7e928
MT		 1415diff -urNp linux-2.6.39/arch/ia64/include/asm/spinlock.h linux-2.6.39/arch/ia64/include/asm/spinlock.h
1416--- linux-2.6.39/arch/ia64/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
1417+++ linux-2.6.39/arch/ia64/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
317566c1
MT		 1418@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1419 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1420
1421 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1422- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1423+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1424 }
1425
1426 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
66a7e928
MT		 1427diff -urNp linux-2.6.39/arch/ia64/include/asm/uaccess.h linux-2.6.39/arch/ia64/include/asm/uaccess.h
1428--- linux-2.6.39/arch/ia64/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
1429+++ linux-2.6.39/arch/ia64/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1430@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1431 const void *__cu_from = (from); \
1432 long __cu_len = (n); \
1433 \
1434- if (__access_ok(__cu_to, __cu_len, get_fs())) \
ae4e228f 1435+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
58c5fc13
MT		 1436 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1437 __cu_len; \
1438 })
1439@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1440 long __cu_len = (n); \
1441 \
1442 __chk_user_ptr(__cu_from); \
1443- if (__access_ok(__cu_from, __cu_len, get_fs())) \
ae4e228f 1444+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
58c5fc13
MT		 1445 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1446 __cu_len; \
1447 })
66a7e928
MT		 1448diff -urNp linux-2.6.39/arch/ia64/kernel/dma-mapping.c linux-2.6.39/arch/ia64/kernel/dma-mapping.c
1449--- linux-2.6.39/arch/ia64/kernel/dma-mapping.c 2011-05-19 00:06:34.000000000 -0400
1450+++ linux-2.6.39/arch/ia64/kernel/dma-mapping.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 1451@@ -3,7 +3,7 @@
1452 /* Set this to 1 if there is a HW IOMMU in the system */
1453 int iommu_detected __read_mostly;
1454
1455-struct dma_map_ops *dma_ops;
1456+const struct dma_map_ops *dma_ops;
1457 EXPORT_SYMBOL(dma_ops);
1458
1459 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1460@@ -16,7 +16,7 @@ static int __init dma_init(void)
1461 }
1462 fs_initcall(dma_init);
1463
1464-struct dma_map_ops *dma_get_ops(struct device *dev)
1465+const struct dma_map_ops *dma_get_ops(struct device *dev)
1466 {
1467 return dma_ops;
1468 }
66a7e928
MT		 1469diff -urNp linux-2.6.39/arch/ia64/kernel/module.c linux-2.6.39/arch/ia64/kernel/module.c
1470--- linux-2.6.39/arch/ia64/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
1471+++ linux-2.6.39/arch/ia64/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1472@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1473 void
1474 module_free (struct module *mod, void *module_region)
1475 {
1476- if (mod && mod->arch.init_unw_table &&
1477- module_region == mod->module_init) {
1478+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1479 unw_remove_unwind_table(mod->arch.init_unw_table);
1480 mod->arch.init_unw_table = NULL;
1481 }
1482@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1483 }
1484
1485 static inline int
1486+in_init_rx (const struct module *mod, uint64_t addr)
1487+{
1488+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1489+}
1490+
1491+static inline int
1492+in_init_rw (const struct module *mod, uint64_t addr)
1493+{
1494+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1495+}
1496+
1497+static inline int
1498 in_init (const struct module *mod, uint64_t addr)
1499 {
1500- return addr - (uint64_t) mod->module_init < mod->init_size;
1501+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1502+}
1503+
1504+static inline int
1505+in_core_rx (const struct module *mod, uint64_t addr)
1506+{
1507+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1508+}
1509+
1510+static inline int
1511+in_core_rw (const struct module *mod, uint64_t addr)
1512+{
1513+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1514 }
1515
1516 static inline int
1517 in_core (const struct module *mod, uint64_t addr)
1518 {
1519- return addr - (uint64_t) mod->module_core < mod->core_size;
1520+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1521 }
1522
1523 static inline int
1524@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1525 break;
1526
1527 case RV_BDREL:
1528- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1529+ if (in_init_rx(mod, val))
1530+ val -= (uint64_t) mod->module_init_rx;
1531+ else if (in_init_rw(mod, val))
1532+ val -= (uint64_t) mod->module_init_rw;
1533+ else if (in_core_rx(mod, val))
1534+ val -= (uint64_t) mod->module_core_rx;
1535+ else if (in_core_rw(mod, val))
1536+ val -= (uint64_t) mod->module_core_rw;
1537 break;
1538
1539 case RV_LTV:
1540@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1541 * addresses have been selected...
1542 */
1543 uint64_t gp;
1544- if (mod->core_size > MAX_LTOFF)
1545+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1546 /*
1547 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1548 * at the end of the module.
1549 */
1550- gp = mod->core_size - MAX_LTOFF / 2;
1551+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1552 else
1553- gp = mod->core_size / 2;
1554- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1555+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1556+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1557 mod->arch.gp = gp;
1558 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1559 }
66a7e928
MT		 1560diff -urNp linux-2.6.39/arch/ia64/kernel/pci-dma.c linux-2.6.39/arch/ia64/kernel/pci-dma.c
1561--- linux-2.6.39/arch/ia64/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
1562+++ linux-2.6.39/arch/ia64/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 1563@@ -43,7 +43,7 @@ struct device fallback_dev = {
1564 .dma_mask = &fallback_dev.coherent_dma_mask,
1565 };
1566
1567-extern struct dma_map_ops intel_dma_ops;
1568+extern const struct dma_map_ops intel_dma_ops;
1569
1570 static int __init pci_iommu_init(void)
1571 {
66a7e928
MT		 1572diff -urNp linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c
1573--- linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
1574+++ linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 1575@@ -22,7 +22,7 @@ static void *ia64_swiotlb_alloc_coherent
ae4e228f
MT		 1576 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1577 }
1578
1579-struct dma_map_ops swiotlb_dma_ops = {
1580+const struct dma_map_ops swiotlb_dma_ops = {
1581 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1582 .free_coherent = swiotlb_free_coherent,
1583 .map_page = swiotlb_map_page,
66a7e928
MT		 1584diff -urNp linux-2.6.39/arch/ia64/kernel/sys_ia64.c linux-2.6.39/arch/ia64/kernel/sys_ia64.c
1585--- linux-2.6.39/arch/ia64/kernel/sys_ia64.c 2011-05-19 00:06:34.000000000 -0400
1586+++ linux-2.6.39/arch/ia64/kernel/sys_ia64.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1587@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1588 if (REGION_NUMBER(addr) == RGN_HPAGE)
1589 addr = 0;
1590 #endif
1591+
1592+#ifdef CONFIG_PAX_RANDMMAP
1593+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1594+ addr = mm->free_area_cache;
1595+ else
1596+#endif
1597+
1598 if (!addr)
1599 addr = mm->free_area_cache;
1600
57199397 1601@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
58c5fc13
MT		 1602 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1603 /* At this point: (!vma || addr < vma->vm_end). */
1604 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1605- if (start_addr != TASK_UNMAPPED_BASE) {
1606+ if (start_addr != mm->mmap_base) {
1607 /* Start a new search --- just in case we missed some holes. */
1608- addr = TASK_UNMAPPED_BASE;
1609+ addr = mm->mmap_base;
1610 goto full_search;
1611 }
1612 return -ENOMEM;
57199397
MT		 1613 }
1614- if (!vma || addr + len <= vma->vm_start) {
1615+ if (check_heap_stack_gap(vma, addr, len)) {
1616 /* Remember the address where we stopped this search: */
1617 mm->free_area_cache = addr + len;
1618 return addr;
66a7e928
MT		 1619diff -urNp linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S
1620--- linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
1621+++ linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
6892158b
MT		 1622@@ -199,7 +199,7 @@ SECTIONS {
1623 /* Per-cpu data: */
1624 . = ALIGN(PERCPU_PAGE_SIZE);
66a7e928 1625 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
6892158b
MT		 1626- __phys_per_cpu_start = __per_cpu_load;
1627+ __phys_per_cpu_start = per_cpu_load;
1628 /*
1629 * ensure percpu data fits
1630 * into percpu page size
66a7e928
MT		 1631diff -urNp linux-2.6.39/arch/ia64/mm/fault.c linux-2.6.39/arch/ia64/mm/fault.c
1632--- linux-2.6.39/arch/ia64/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1633+++ linux-2.6.39/arch/ia64/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1634@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1635 return pte_present(pte);
1636 }
1637
1638+#ifdef CONFIG_PAX_PAGEEXEC
1639+void pax_report_insns(void *pc, void *sp)
1640+{
1641+ unsigned long i;
1642+
1643+ printk(KERN_ERR "PAX: bytes at PC: ");
1644+ for (i = 0; i < 8; i++) {
1645+ unsigned int c;
1646+ if (get_user(c, (unsigned int *)pc+i))
1647+ printk(KERN_CONT "???????? ");
1648+ else
1649+ printk(KERN_CONT "%08x ", c);
1650+ }
1651+ printk("\n");
1652+}
1653+#endif
1654+
1655 void __kprobes
1656 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1657 {
1658@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1659 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1660 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1661
1662- if ((vma->vm_flags & mask) != mask)
1663+ if ((vma->vm_flags & mask) != mask) {
1664+
1665+#ifdef CONFIG_PAX_PAGEEXEC
1666+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1667+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1668+ goto bad_area;
1669+
1670+ up_read(&mm->mmap_sem);
1671+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1672+ do_group_exit(SIGKILL);
1673+ }
1674+#endif
1675+
1676 goto bad_area;
1677
1678+ }
1679+
58c5fc13
MT		 1680 /*
1681 * If for any reason at all we couldn't handle the fault, make
57199397 1682 * sure we exit gracefully rather than endlessly redo the
66a7e928
MT		 1683diff -urNp linux-2.6.39/arch/ia64/mm/hugetlbpage.c linux-2.6.39/arch/ia64/mm/hugetlbpage.c
1684--- linux-2.6.39/arch/ia64/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
1685+++ linux-2.6.39/arch/ia64/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 1686@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1687 /* At this point: (!vmm || addr < vmm->vm_end). */
1688 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1689 return -ENOMEM;
1690- if (!vmm || (addr + len) <= vmm->vm_start)
1691+ if (check_heap_stack_gap(vmm, addr, len))
1692 return addr;
1693 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1694 }
66a7e928
MT		 1695diff -urNp linux-2.6.39/arch/ia64/mm/init.c linux-2.6.39/arch/ia64/mm/init.c
1696--- linux-2.6.39/arch/ia64/mm/init.c 2011-05-19 00:06:34.000000000 -0400
1697+++ linux-2.6.39/arch/ia64/mm/init.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1698@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1699 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1700 vma->vm_end = vma->vm_start + PAGE_SIZE;
1701 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1702+
1703+#ifdef CONFIG_PAX_PAGEEXEC
1704+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1705+ vma->vm_flags &= ~VM_EXEC;
1706+
1707+#ifdef CONFIG_PAX_MPROTECT
1708+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1709+ vma->vm_flags &= ~VM_MAYEXEC;
1710+#endif
1711+
1712+ }
1713+#endif
1714+
1715 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1716 down_write(&current->mm->mmap_sem);
1717 if (insert_vm_struct(current->mm, vma)) {
66a7e928
MT		 1718diff -urNp linux-2.6.39/arch/ia64/pci/pci.c linux-2.6.39/arch/ia64/pci/pci.c
1719--- linux-2.6.39/arch/ia64/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
1720+++ linux-2.6.39/arch/ia64/pci/pci.c 2011-05-22 19:36:30.000000000 -0400
1721@@ -109,7 +109,7 @@ static int pci_write(struct pci_bus *bus
1722 devfn, where, size, value);
1723 }
1724
1725-struct pci_ops pci_root_ops = {
1726+const struct pci_ops pci_root_ops = {
1727 .read = pci_read,
1728 .write = pci_write,
1729 };
1730diff -urNp linux-2.6.39/arch/ia64/sn/pci/pci_dma.c linux-2.6.39/arch/ia64/sn/pci/pci_dma.c
1731--- linux-2.6.39/arch/ia64/sn/pci/pci_dma.c 2011-05-19 00:06:34.000000000 -0400
1732+++ linux-2.6.39/arch/ia64/sn/pci/pci_dma.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 1733@@ -465,7 +465,7 @@ int sn_pci_legacy_write(struct pci_bus *
ae4e228f 1734 return ret;
58c5fc13
MT		 1735 }
1736
ae4e228f
MT		 1737-static struct dma_map_ops sn_dma_ops = {
1738+static const struct dma_map_ops sn_dma_ops = {
1739 .alloc_coherent = sn_dma_alloc_coherent,
1740 .free_coherent = sn_dma_free_coherent,
1741 .map_page = sn_dma_map_page,
66a7e928
MT		 1742diff -urNp linux-2.6.39/arch/m32r/lib/usercopy.c linux-2.6.39/arch/m32r/lib/usercopy.c
1743--- linux-2.6.39/arch/m32r/lib/usercopy.c 2011-05-19 00:06:34.000000000 -0400
1744+++ linux-2.6.39/arch/m32r/lib/usercopy.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 1745@@ -14,6 +14,9 @@
1746 unsigned long
1747 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1748 {
1749+ if ((long)n < 0)
1750+ return n;
1751+
1752 prefetch(from);
1753 if (access_ok(VERIFY_WRITE, to, n))
1754 __copy_user(to,from,n);
1755@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1756 unsigned long
1757 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1758 {
1759+ if ((long)n < 0)
1760+ return n;
1761+
1762 prefetchw(to);
1763 if (access_ok(VERIFY_READ, from, n))
1764 __copy_user_zeroing(to,from,n);
66a7e928
MT		 1765diff -urNp linux-2.6.39/arch/microblaze/include/asm/device.h linux-2.6.39/arch/microblaze/include/asm/device.h
1766--- linux-2.6.39/arch/microblaze/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1767+++ linux-2.6.39/arch/microblaze/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
57199397 1768@@ -13,7 +13,7 @@ struct device_node;
df50ba0c 1769
57199397 1770 struct dev_archdata {
df50ba0c
MT		 1771 /* DMA operations on that device */
1772- struct dma_map_ops *dma_ops;
1773+ const struct dma_map_ops *dma_ops;
1774 void *dma_data;
1775 };
1776
66a7e928
MT		 1777diff -urNp linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h
1778--- linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1779+++ linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 1780@@ -43,14 +43,14 @@ static inline unsigned long device_to_ma
1781 return 0xfffffffful;
1782 }
1783
1784-extern struct dma_map_ops *dma_ops;
1785+extern const struct dma_map_ops *dma_ops;
1786
1787 /*
1788 * Available generic sets of operations
1789 */
1790-extern struct dma_map_ops dma_direct_ops;
1791+extern const struct dma_map_ops dma_direct_ops;
1792
1793-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1794+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
1795 {
1796 /* We don't handle the NULL dev case for ISA for now. We could
1797 * do it via an out of line call but it is not needed for now. The
1798@@ -63,14 +63,14 @@ static inline struct dma_map_ops *get_dm
1799 return dev->archdata.dma_ops;
1800 }
1801
1802-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
1803+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
1804 {
1805 dev->archdata.dma_ops = ops;
1806 }
1807
1808 static inline int dma_supported(struct device *dev, u64 mask)
1809 {
1810- struct dma_map_ops *ops = get_dma_ops(dev);
1811+ const struct dma_map_ops *ops = get_dma_ops(dev);
1812
1813 if (unlikely(!ops))
1814 return 0;
6892158b 1815@@ -81,7 +81,7 @@ static inline int dma_supported(struct d
df50ba0c
MT		 1816
1817 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
1818 {
1819- struct dma_map_ops *ops = get_dma_ops(dev);
1820+ const struct dma_map_ops *ops = get_dma_ops(dev);
1821
1822 if (unlikely(ops == NULL))
1823 return -EIO;
6892158b 1824@@ -97,7 +97,7 @@ static inline int dma_set_mask(struct de
df50ba0c
MT		 1825
1826 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1827 {
1828- struct dma_map_ops *ops = get_dma_ops(dev);
1829+ const struct dma_map_ops *ops = get_dma_ops(dev);
1830 if (ops->mapping_error)
1831 return ops->mapping_error(dev, dma_addr);
1832
6892158b 1833@@ -110,7 +110,7 @@ static inline int dma_mapping_error(stru
df50ba0c
MT		 1834 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1835 dma_addr_t *dma_handle, gfp_t flag)
1836 {
1837- struct dma_map_ops *ops = get_dma_ops(dev);
1838+ const struct dma_map_ops *ops = get_dma_ops(dev);
1839 void *memory;
1840
1841 BUG_ON(!ops);
6892158b 1842@@ -124,7 +124,7 @@ static inline void *dma_alloc_coherent(s
df50ba0c
MT		 1843 static inline void dma_free_coherent(struct device *dev, size_t size,
1844 void *cpu_addr, dma_addr_t dma_handle)
1845 {
1846- struct dma_map_ops *ops = get_dma_ops(dev);
1847+ const struct dma_map_ops *ops = get_dma_ops(dev);
1848
1849 BUG_ON(!ops);
1850 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
66a7e928
MT		 1851diff -urNp linux-2.6.39/arch/microblaze/include/asm/pci.h linux-2.6.39/arch/microblaze/include/asm/pci.h
1852--- linux-2.6.39/arch/microblaze/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
1853+++ linux-2.6.39/arch/microblaze/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 1854@@ -54,8 +54,8 @@ static inline void pcibios_penalize_isa_
1855 }
1856
1857 #ifdef CONFIG_PCI
1858-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
1859-extern struct dma_map_ops *get_pci_dma_ops(void);
1860+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
1861+extern const struct dma_map_ops *get_pci_dma_ops(void);
1862 #else /* CONFIG_PCI */
1863 #define set_pci_dma_ops(d)
1864 #define get_pci_dma_ops() NULL
66a7e928
MT		 1865diff -urNp linux-2.6.39/arch/microblaze/kernel/dma.c linux-2.6.39/arch/microblaze/kernel/dma.c
1866--- linux-2.6.39/arch/microblaze/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
1867+++ linux-2.6.39/arch/microblaze/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
1868@@ -134,7 +134,7 @@ static inline void dma_direct_unmap_page
df50ba0c
MT		 1869 __dma_sync_page(dma_address, 0 , size, direction);
1870 }
1871
1872-struct dma_map_ops dma_direct_ops = {
1873+const struct dma_map_ops dma_direct_ops = {
1874 .alloc_coherent = dma_direct_alloc_coherent,
1875 .free_coherent = dma_direct_free_coherent,
1876 .map_sg = dma_direct_map_sg,
66a7e928
MT		 1877diff -urNp linux-2.6.39/arch/microblaze/kernel/kgdb.c linux-2.6.39/arch/microblaze/kernel/kgdb.c
1878--- linux-2.6.39/arch/microblaze/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1879+++ linux-2.6.39/arch/microblaze/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1880@@ -141,7 +141,7 @@ void kgdb_arch_exit(void)
6892158b
MT		 1881 /*
1882 * Global data
1883 */
1884-struct kgdb_arch arch_kgdb_ops = {
1885+const struct kgdb_arch arch_kgdb_ops = {
bc901d79
MT		 1886 #ifdef __MICROBLAZEEL__
1887 .gdb_bpt_instr = {0x18, 0x00, 0x0c, 0xba}, /* brki r16, 0x18 */
1888 #else
66a7e928
MT		 1889diff -urNp linux-2.6.39/arch/microblaze/pci/indirect_pci.c linux-2.6.39/arch/microblaze/pci/indirect_pci.c
1890--- linux-2.6.39/arch/microblaze/pci/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
1891+++ linux-2.6.39/arch/microblaze/pci/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
1892@@ -140,7 +140,7 @@ indirect_write_config(struct pci_bus *bu
1893 return PCIBIOS_SUCCESSFUL;
1894 }
1895
1896-static struct pci_ops indirect_pci_ops = {
1897+static const struct pci_ops indirect_pci_ops = {
1898 .read = indirect_read_config,
1899 .write = indirect_write_config,
6892158b 1900 };
66a7e928
MT		 1901diff -urNp linux-2.6.39/arch/microblaze/pci/pci-common.c linux-2.6.39/arch/microblaze/pci/pci-common.c
1902--- linux-2.6.39/arch/microblaze/pci/pci-common.c 2011-05-19 00:06:34.000000000 -0400
1903+++ linux-2.6.39/arch/microblaze/pci/pci-common.c 2011-05-22 19:36:30.000000000 -0400
1904@@ -48,14 +48,14 @@ resource_size_t isa_mem_base;
df50ba0c
MT		 1905 /* Default PCI flags is 0 on ppc32, modified at boot on ppc64 */
1906 unsigned int pci_flags;
1907
1908-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1909+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1910
1911-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
1912+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
1913 {
1914 pci_dma_ops = dma_ops;
1915 }
1916
1917-struct dma_map_ops *get_pci_dma_ops(void)
1918+const struct dma_map_ops *get_pci_dma_ops(void)
1919 {
1920 return pci_dma_ops;
1921 }
66a7e928
MT		 1922@@ -1583,7 +1583,7 @@ null_write_config(struct pci_bus *bus, u
1923 return PCIBIOS_DEVICE_NOT_FOUND;
1924 }
1925
1926-static struct pci_ops null_pci_ops = {
1927+static const struct pci_ops null_pci_ops = {
1928 .read = null_read_config,
1929 .write = null_write_config,
1930 };
1931diff -urNp linux-2.6.39/arch/mips/alchemy/common/pci.c linux-2.6.39/arch/mips/alchemy/common/pci.c
1932--- linux-2.6.39/arch/mips/alchemy/common/pci.c 2011-05-19 00:06:34.000000000 -0400
1933+++ linux-2.6.39/arch/mips/alchemy/common/pci.c 2011-05-22 19:36:30.000000000 -0400
1934@@ -51,7 +51,7 @@ static struct resource pci_mem_resource
1935 .flags = IORESOURCE_MEM
1936 };
1937
1938-extern struct pci_ops au1x_pci_ops;
1939+extern const struct pci_ops au1x_pci_ops;
1940
1941 static struct pci_controller au1x_controller = {
1942 .pci_ops = &au1x_pci_ops,
1943diff -urNp linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c
1944--- linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c 2011-05-19 00:06:34.000000000 -0400
1945+++ linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 1946@@ -202,7 +202,7 @@ static phys_addr_t octeon_unity_dma_to_p
1947 }
1948
1949 struct octeon_dma_map_ops {
1950- struct dma_map_ops dma_map_ops;
1951+ const struct dma_map_ops dma_map_ops;
1952 dma_addr_t (*phys_to_dma)(struct device *dev, phys_addr_t paddr);
1953 phys_addr_t (*dma_to_phys)(struct device *dev, dma_addr_t daddr);
1954 };
1955@@ -324,7 +324,7 @@ static struct octeon_dma_map_ops _octeon
1956 },
1957 };
1958
1959-struct dma_map_ops *octeon_pci_dma_map_ops;
1960+const struct dma_map_ops *octeon_pci_dma_map_ops;
1961
1962 void __init octeon_pci_dma_init(void)
1963 {
66a7e928
MT		 1964diff -urNp linux-2.6.39/arch/mips/cobalt/pci.c linux-2.6.39/arch/mips/cobalt/pci.c
1965--- linux-2.6.39/arch/mips/cobalt/pci.c 2011-05-19 00:06:34.000000000 -0400
1966+++ linux-2.6.39/arch/mips/cobalt/pci.c 2011-05-22 19:36:30.000000000 -0400
1967@@ -14,7 +14,7 @@
1968
1969 #include <asm/gt64120.h>
1970
1971-extern struct pci_ops gt64xxx_pci0_ops;
1972+extern const struct pci_ops gt64xxx_pci0_ops;
1973
1974 static struct resource cobalt_mem_resource = {
1975 .start = GT_DEF_PCI0_MEM0_BASE,
1976diff -urNp linux-2.6.39/arch/mips/include/asm/device.h linux-2.6.39/arch/mips/include/asm/device.h
1977--- linux-2.6.39/arch/mips/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1978+++ linux-2.6.39/arch/mips/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 1979@@ -10,7 +10,7 @@ struct dma_map_ops;
1980
1981 struct dev_archdata {
1982 /* DMA operations on that device */
1983- struct dma_map_ops *dma_ops;
1984+ const struct dma_map_ops *dma_ops;
1985 };
1986
1987 struct pdev_archdata {
66a7e928
MT		 1988diff -urNp linux-2.6.39/arch/mips/include/asm/dma-mapping.h linux-2.6.39/arch/mips/include/asm/dma-mapping.h
1989--- linux-2.6.39/arch/mips/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1990+++ linux-2.6.39/arch/mips/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1991@@ -9,9 +9,9 @@
bc901d79 1992 #include <dma-coherence.h>
66a7e928 1993 #endif
bc901d79
MT		 1994
1995-extern struct dma_map_ops *mips_dma_map_ops;
1996+extern const struct dma_map_ops *mips_dma_map_ops;
1997
1998-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1999+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2000 {
2001 if (dev && dev->archdata.dma_ops)
2002 return dev->archdata.dma_ops;
66a7e928 2003@@ -33,13 +33,13 @@ static inline void dma_mark_clean(void *
bc901d79
MT		 2004
2005 static inline int dma_supported(struct device *dev, u64 mask)
2006 {
2007- struct dma_map_ops *ops = get_dma_ops(dev);
2008+ const struct dma_map_ops *ops = get_dma_ops(dev);
2009 return ops->dma_supported(dev, mask);
2010 }
2011
2012 static inline int dma_mapping_error(struct device *dev, u64 mask)
2013 {
2014- struct dma_map_ops *ops = get_dma_ops(dev);
2015+ const struct dma_map_ops *ops = get_dma_ops(dev);
2016 return ops->mapping_error(dev, mask);
2017 }
2018
66a7e928 2019@@ -61,7 +61,7 @@ static inline void *dma_alloc_coherent(s
bc901d79
MT		 2020 dma_addr_t *dma_handle, gfp_t gfp)
2021 {
2022 void *ret;
2023- struct dma_map_ops *ops = get_dma_ops(dev);
2024+ const struct dma_map_ops *ops = get_dma_ops(dev);
2025
2026 ret = ops->alloc_coherent(dev, size, dma_handle, gfp);
2027
66a7e928 2028@@ -73,7 +73,7 @@ static inline void *dma_alloc_coherent(s
bc901d79
MT		 2029 static inline void dma_free_coherent(struct device *dev, size_t size,
2030 void *vaddr, dma_addr_t dma_handle)
2031 {
2032- struct dma_map_ops *ops = get_dma_ops(dev);
2033+ const struct dma_map_ops *ops = get_dma_ops(dev);
2034
2035 ops->free_coherent(dev, size, vaddr, dma_handle);
2036
66a7e928
MT		 2037diff -urNp linux-2.6.39/arch/mips/include/asm/elf.h linux-2.6.39/arch/mips/include/asm/elf.h
2038--- linux-2.6.39/arch/mips/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2039+++ linux-2.6.39/arch/mips/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 2040@@ -372,13 +372,16 @@ extern const char *__elf_platform;
58c5fc13
MT		 2041 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2042 #endif
2043
2044+#ifdef CONFIG_PAX_ASLR
66a7e928 2045+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
58c5fc13 2046+
66a7e928
MT		 2047+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2048+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
58c5fc13
MT		 2049+#endif
2050+
df50ba0c
MT		 2051 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2052 struct linux_binprm;
2053 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
bc901d79
MT		 2054 int uses_interp);
2055
2056-struct mm_struct;
2057-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2058-#define arch_randomize_brk arch_randomize_brk
2059-
2060 #endif /* _ASM_ELF_H */
66a7e928
MT		 2061diff -urNp linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
2062--- linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-19 00:06:34.000000000 -0400
2063+++ linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 2064@@ -66,7 +66,7 @@ dma_addr_t phys_to_dma(struct device *de
2065 phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr);
2066
2067 struct dma_map_ops;
2068-extern struct dma_map_ops *octeon_pci_dma_map_ops;
2069+extern const struct dma_map_ops *octeon_pci_dma_map_ops;
2070 extern char *octeon_swiotlb;
2071
2072 #endif /* __ASM_MACH_CAVIUM_OCTEON_DMA_COHERENCE_H */
66a7e928
MT		 2073diff -urNp linux-2.6.39/arch/mips/include/asm/page.h linux-2.6.39/arch/mips/include/asm/page.h
2074--- linux-2.6.39/arch/mips/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
2075+++ linux-2.6.39/arch/mips/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 2076@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
58c5fc13
MT		 2077 #ifdef CONFIG_CPU_MIPS32
2078 typedef struct { unsigned long pte_low, pte_high; } pte_t;
2079 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
2080- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
2081+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
2082 #else
2083 typedef struct { unsigned long long pte; } pte_t;
2084 #define pte_val(x) ((x).pte)
66a7e928
MT		 2085diff -urNp linux-2.6.39/arch/mips/include/asm/pci/bridge.h linux-2.6.39/arch/mips/include/asm/pci/bridge.h
2086--- linux-2.6.39/arch/mips/include/asm/pci/bridge.h 2011-05-19 00:06:34.000000000 -0400
2087+++ linux-2.6.39/arch/mips/include/asm/pci/bridge.h 2011-05-22 19:36:30.000000000 -0400
2088@@ -849,6 +849,6 @@ struct bridge_controller {
2089 extern void register_bridge_irq(unsigned int irq);
2090 extern int request_bridge_irq(struct bridge_controller *bc);
2091
2092-extern struct pci_ops bridge_pci_ops;
2093+extern const struct pci_ops bridge_pci_ops;
2094
2095 #endif /* _ASM_PCI_BRIDGE_H */
2096diff -urNp linux-2.6.39/arch/mips/include/asm/system.h linux-2.6.39/arch/mips/include/asm/system.h
2097--- linux-2.6.39/arch/mips/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
2098+++ linux-2.6.39/arch/mips/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
71d190be 2099@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
58c5fc13
MT		 2100 */
2101 #define __ARCH_WANT_UNLOCKED_CTXSW
2102
2103-extern unsigned long arch_align_stack(unsigned long sp);
71d190be 2104+#define arch_align_stack(x) ((x) & ~0xfUL)
58c5fc13
MT		 2105
2106 #endif /* _ASM_SYSTEM_H */
66a7e928
MT		 2107diff -urNp linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c
2108--- linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c 2011-05-19 00:06:34.000000000 -0400
2109+++ linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 2110@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2111 #undef ELF_ET_DYN_BASE
2112 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2113
2114+#ifdef CONFIG_PAX_ASLR
66a7e928 2115+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
58c5fc13 2116+
66a7e928
MT		 2117+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2118+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
58c5fc13
MT		 2119+#endif
2120+
2121 #include <asm/processor.h>
2122 #include <linux/module.h>
2123 #include <linux/elfcore.h>
66a7e928
MT		 2124diff -urNp linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c
2125--- linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c 2011-05-19 00:06:34.000000000 -0400
2126+++ linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 2127@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2128 #undef ELF_ET_DYN_BASE
2129 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2130
2131+#ifdef CONFIG_PAX_ASLR
66a7e928 2132+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
58c5fc13 2133+
66a7e928
MT		 2134+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2135+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
58c5fc13
MT		 2136+#endif
2137+
2138 #include <asm/processor.h>
2139
2140 /*
66a7e928
MT		 2141diff -urNp linux-2.6.39/arch/mips/kernel/kgdb.c linux-2.6.39/arch/mips/kernel/kgdb.c
2142--- linux-2.6.39/arch/mips/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
2143+++ linux-2.6.39/arch/mips/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
16454cff 2144@@ -351,7 +351,7 @@ int kgdb_arch_handle_exception(int vecto
ae4e228f
MT		 2145 return -1;
2146 }
2147
16454cff
MT		 2148-struct kgdb_arch arch_kgdb_ops;
2149+struct kgdb_arch arch_kgdb_ops; /* cannot be const, see kgdb_arch_init */
ae4e228f
MT		 2150
2151 /*
16454cff 2152 * We use kgdb_early_setup so that functions we need to call now don't
66a7e928
MT		 2153diff -urNp linux-2.6.39/arch/mips/kernel/process.c linux-2.6.39/arch/mips/kernel/process.c
2154--- linux-2.6.39/arch/mips/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
2155+++ linux-2.6.39/arch/mips/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 2156@@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
58c5fc13
MT		 2157 out:
2158 return pc;
2159 }
2160-
2161-/*
2162- * Don't forget that the stack pointer must be aligned on a 8 bytes
2163- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
2164- */
2165-unsigned long arch_align_stack(unsigned long sp)
2166-{
2167- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2168- sp -= get_random_int() & ~PAGE_MASK;
2169-
2170- return sp & ALMASK;
2171-}
66a7e928
MT		 2172diff -urNp linux-2.6.39/arch/mips/kernel/syscall.c linux-2.6.39/arch/mips/kernel/syscall.c
2173--- linux-2.6.39/arch/mips/kernel/syscall.c 2011-05-19 00:06:34.000000000 -0400
2174+++ linux-2.6.39/arch/mips/kernel/syscall.c 2011-05-22 19:36:30.000000000 -0400
6892158b 2175@@ -108,14 +108,18 @@ unsigned long arch_get_unmapped_area(str
58c5fc13
MT		 2176 do_color_align = 0;
2177 if (filp || (flags & MAP_SHARED))
2178 do_color_align = 1;
2179+
2180+#ifdef CONFIG_PAX_RANDMMAP
2181+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
2182+#endif
2183+
2184 if (addr) {
2185 if (do_color_align)
2186 addr = COLOUR_ALIGN(addr, pgoff);
57199397
MT		 2187 else
2188 addr = PAGE_ALIGN(addr);
2189 vmm = find_vma(current->mm, addr);
2190- if (task_size - len >= addr &&
2191- (!vmm || addr + len <= vmm->vm_start))
2192+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
58c5fc13
MT		 2193 return addr;
2194 }
6892158b
MT		 2195 addr = current->mm->mmap_base;
2196@@ -128,7 +132,7 @@ unsigned long arch_get_unmapped_area(str
57199397
MT		 2197 /* At this point: (!vmm || addr < vmm->vm_end). */
2198 if (task_size - len < addr)
2199 return -ENOMEM;
2200- if (!vmm || addr + len <= vmm->vm_start)
2201+ if (check_heap_stack_gap(vmm, addr, len))
2202 return addr;
2203 addr = vmm->vm_end;
2204 if (do_color_align)
66a7e928
MT		 2205@@ -154,33 +158,6 @@ void arch_pick_mmap_layout(struct mm_str
2206 mm->unmap_area = arch_unmap_area;
bc901d79
MT		 2207 }
2208
66a7e928
MT		 2209-static inline unsigned long brk_rnd(void)
2210-{
2211- unsigned long rnd = get_random_int();
2212-
2213- rnd = rnd << PAGE_SHIFT;
2214- /* 8MB for 32bit, 256MB for 64bit */
2215- if (TASK_IS_32BIT_ADDR)
2216- rnd = rnd & 0x7ffffful;
2217- else
2218- rnd = rnd & 0xffffffful;
2219-
2220- return rnd;
2221-}
2222-
bc901d79
MT		 2223-unsigned long arch_randomize_brk(struct mm_struct *mm)
2224-{
2225- unsigned long base = mm->brk;
2226- unsigned long ret;
2227-
2228- ret = PAGE_ALIGN(base + brk_rnd());
2229-
2230- if (ret < mm->brk)
2231- return mm->brk;
2232-
2233- return ret;
2234-}
2235-
2236 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
2237 unsigned long, prot, unsigned long, flags, unsigned long,
2238 fd, off_t, offset)
66a7e928
MT		 2239diff -urNp linux-2.6.39/arch/mips/mm/dma-default.c linux-2.6.39/arch/mips/mm/dma-default.c
2240--- linux-2.6.39/arch/mips/mm/dma-default.c 2011-05-19 00:06:34.000000000 -0400
2241+++ linux-2.6.39/arch/mips/mm/dma-default.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 2242@@ -300,7 +300,7 @@ void dma_cache_sync(struct device *dev,
2243
2244 EXPORT_SYMBOL(dma_cache_sync);
2245
2246-static struct dma_map_ops mips_default_dma_map_ops = {
2247+static const struct dma_map_ops mips_default_dma_map_ops = {
2248 .alloc_coherent = mips_dma_alloc_coherent,
2249 .free_coherent = mips_dma_free_coherent,
2250 .map_page = mips_dma_map_page,
2251@@ -315,7 +315,7 @@ static struct dma_map_ops mips_default_d
2252 .dma_supported = mips_dma_supported
2253 };
2254
2255-struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2256+const struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2257 EXPORT_SYMBOL(mips_dma_map_ops);
2258
2259 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
66a7e928
MT		 2260diff -urNp linux-2.6.39/arch/mips/mm/fault.c linux-2.6.39/arch/mips/mm/fault.c
2261--- linux-2.6.39/arch/mips/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
2262+++ linux-2.6.39/arch/mips/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 2263@@ -28,6 +28,23 @@
58c5fc13 2264 #include <asm/highmem.h> /* For VMALLOC_END */
6892158b 2265 #include <linux/kdebug.h>
58c5fc13
MT		 2266
2267+#ifdef CONFIG_PAX_PAGEEXEC
6892158b 2268+void pax_report_insns(void *pc, void *sp)
58c5fc13
MT		 2269+{
2270+ unsigned long i;
2271+
2272+ printk(KERN_ERR "PAX: bytes at PC: ");
2273+ for (i = 0; i < 5; i++) {
2274+ unsigned int c;
2275+ if (get_user(c, (unsigned int *)pc+i))
2276+ printk(KERN_CONT "???????? ");
2277+ else
2278+ printk(KERN_CONT "%08x ", c);
2279+ }
2280+ printk("\n");
2281+}
2282+#endif
2283+
2284 /*
2285 * This routine handles page faults. It determines the address,
2286 * and the problem, and then passes it off to one of the appropriate
66a7e928
MT		 2287diff -urNp linux-2.6.39/arch/mips/mti-malta/malta-pci.c linux-2.6.39/arch/mips/mti-malta/malta-pci.c
2288--- linux-2.6.39/arch/mips/mti-malta/malta-pci.c 2011-05-19 00:06:34.000000000 -0400
2289+++ linux-2.6.39/arch/mips/mti-malta/malta-pci.c 2011-05-22 19:36:30.000000000 -0400
2290@@ -64,9 +64,9 @@ static struct resource msc_io_resource =
2291 .flags = IORESOURCE_IO,
2292 };
2293
2294-extern struct pci_ops bonito64_pci_ops;
2295-extern struct pci_ops gt64xxx_pci0_ops;
2296-extern struct pci_ops msc_pci_ops;
2297+extern const struct pci_ops bonito64_pci_ops;
2298+extern const struct pci_ops gt64xxx_pci0_ops;
2299+extern const struct pci_ops msc_pci_ops;
2300
2301 static struct pci_controller bonito64_controller = {
2302 .pci_ops = &bonito64_pci_ops,
2303diff -urNp linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c
2304--- linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2305+++ linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2306@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2307 .flags = IORESOURCE_MEM
2308 };
2309
2310-extern struct pci_ops pnx8550_pci_ops;
2311+extern const struct pci_ops pnx8550_pci_ops;
2312
2313 static struct pci_controller pnx8550_controller = {
2314 .pci_ops = &pnx8550_pci_ops,
2315diff -urNp linux-2.6.39/arch/mips/pci/ops-au1000.c linux-2.6.39/arch/mips/pci/ops-au1000.c
2316--- linux-2.6.39/arch/mips/pci/ops-au1000.c 2011-05-19 00:06:34.000000000 -0400
2317+++ linux-2.6.39/arch/mips/pci/ops-au1000.c 2011-05-22 19:36:30.000000000 -0400
2318@@ -302,7 +302,7 @@ static int config_write(struct pci_bus *
2319 }
2320 }
2321
2322-struct pci_ops au1x_pci_ops = {
2323+const struct pci_ops au1x_pci_ops = {
2324 config_read,
2325 config_write
2326 };
2327diff -urNp linux-2.6.39/arch/mips/pci/ops-bcm63xx.c linux-2.6.39/arch/mips/pci/ops-bcm63xx.c
2328--- linux-2.6.39/arch/mips/pci/ops-bcm63xx.c 2011-05-19 00:06:34.000000000 -0400
2329+++ linux-2.6.39/arch/mips/pci/ops-bcm63xx.c 2011-05-22 19:36:30.000000000 -0400
2330@@ -173,7 +173,7 @@ static int bcm63xx_pci_write(struct pci_
2331 where, size, val);
2332 }
2333
2334-struct pci_ops bcm63xx_pci_ops = {
2335+const struct pci_ops bcm63xx_pci_ops = {
2336 .read = bcm63xx_pci_read,
2337 .write = bcm63xx_pci_write
2338 };
2339@@ -402,7 +402,7 @@ static int bcm63xx_cb_write(struct pci_b
2340 return PCIBIOS_DEVICE_NOT_FOUND;
2341 }
2342
2343-struct pci_ops bcm63xx_cb_ops = {
2344+const struct pci_ops bcm63xx_cb_ops = {
2345 .read = bcm63xx_cb_read,
2346 .write = bcm63xx_cb_write,
2347 };
2348diff -urNp linux-2.6.39/arch/mips/pci/ops-bonito64.c linux-2.6.39/arch/mips/pci/ops-bonito64.c
2349--- linux-2.6.39/arch/mips/pci/ops-bonito64.c 2011-05-19 00:06:34.000000000 -0400
2350+++ linux-2.6.39/arch/mips/pci/ops-bonito64.c 2011-05-22 19:36:30.000000000 -0400
2351@@ -155,7 +155,7 @@ static int bonito64_pcibios_write(struct
2352 return PCIBIOS_SUCCESSFUL;
2353 }
2354
2355-struct pci_ops bonito64_pci_ops = {
2356+const struct pci_ops bonito64_pci_ops = {
2357 .read = bonito64_pcibios_read,
2358 .write = bonito64_pcibios_write
2359 };
2360diff -urNp linux-2.6.39/arch/mips/pci/ops-bridge.c linux-2.6.39/arch/mips/pci/ops-bridge.c
2361--- linux-2.6.39/arch/mips/pci/ops-bridge.c 2011-05-19 00:06:34.000000000 -0400
2362+++ linux-2.6.39/arch/mips/pci/ops-bridge.c 2011-05-22 19:36:30.000000000 -0400
2363@@ -316,7 +316,7 @@ static int pci_write_config(struct pci_b
2364 return pci_conf0_write_config(bus, devfn, where, size, value);
2365 }
2366
2367-struct pci_ops bridge_pci_ops = {
2368+const struct pci_ops bridge_pci_ops = {
2369 .read = pci_read_config,
2370 .write = pci_write_config,
2371 };
2372diff -urNp linux-2.6.39/arch/mips/pci/ops-emma2rh.c linux-2.6.39/arch/mips/pci/ops-emma2rh.c
2373--- linux-2.6.39/arch/mips/pci/ops-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2374+++ linux-2.6.39/arch/mips/pci/ops-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2375@@ -176,7 +176,7 @@ static int pci_config_write(struct pci_b
2376 return PCIBIOS_SUCCESSFUL;
2377 }
2378
2379-struct pci_ops emma2rh_pci_ops = {
2380+const struct pci_ops emma2rh_pci_ops = {
2381 .read = pci_config_read,
2382 .write = pci_config_write,
2383 };
2384diff -urNp linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c
2385--- linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-19 00:06:34.000000000 -0400
2386+++ linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-22 19:36:30.000000000 -0400
2387@@ -146,7 +146,7 @@ static int gt64xxx_pci0_pcibios_write(st
2388 return PCIBIOS_SUCCESSFUL;
2389 }
2390
2391-struct pci_ops gt64xxx_pci0_ops = {
2392+const struct pci_ops gt64xxx_pci0_ops = {
2393 .read = gt64xxx_pci0_pcibios_read,
2394 .write = gt64xxx_pci0_pcibios_write
2395 };
2396diff -urNp linux-2.6.39/arch/mips/pci/ops-loongson2.c linux-2.6.39/arch/mips/pci/ops-loongson2.c
2397--- linux-2.6.39/arch/mips/pci/ops-loongson2.c 2011-05-19 00:06:34.000000000 -0400
2398+++ linux-2.6.39/arch/mips/pci/ops-loongson2.c 2011-05-22 19:36:30.000000000 -0400
2399@@ -174,7 +174,7 @@ static int loongson_pcibios_write(struct
2400 return PCIBIOS_SUCCESSFUL;
2401 }
2402
2403-struct pci_ops loongson_pci_ops = {
2404+const struct pci_ops loongson_pci_ops = {
2405 .read = loongson_pcibios_read,
2406 .write = loongson_pcibios_write
2407 };
2408diff -urNp linux-2.6.39/arch/mips/pci/ops-mace.c linux-2.6.39/arch/mips/pci/ops-mace.c
2409--- linux-2.6.39/arch/mips/pci/ops-mace.c 2011-05-19 00:06:34.000000000 -0400
2410+++ linux-2.6.39/arch/mips/pci/ops-mace.c 2011-05-22 19:36:30.000000000 -0400
2411@@ -96,7 +96,7 @@ mace_pci_write_config(struct pci_bus *bu
2412 return PCIBIOS_SUCCESSFUL;
2413 }
2414
2415-struct pci_ops mace_pci_ops = {
2416+const struct pci_ops mace_pci_ops = {
2417 .read = mace_pci_read_config,
2418 .write = mace_pci_write_config,
2419 };
2420diff -urNp linux-2.6.39/arch/mips/pci/ops-msc.c linux-2.6.39/arch/mips/pci/ops-msc.c
2421--- linux-2.6.39/arch/mips/pci/ops-msc.c 2011-05-19 00:06:34.000000000 -0400
2422+++ linux-2.6.39/arch/mips/pci/ops-msc.c 2011-05-22 19:36:30.000000000 -0400
2423@@ -142,7 +142,7 @@ static int msc_pcibios_write(struct pci_
2424 return PCIBIOS_SUCCESSFUL;
2425 }
2426
2427-struct pci_ops msc_pci_ops = {
2428+const struct pci_ops msc_pci_ops = {
2429 .read = msc_pcibios_read,
2430 .write = msc_pcibios_write
2431 };
2432diff -urNp linux-2.6.39/arch/mips/pci/ops-nile4.c linux-2.6.39/arch/mips/pci/ops-nile4.c
2433--- linux-2.6.39/arch/mips/pci/ops-nile4.c 2011-05-19 00:06:34.000000000 -0400
2434+++ linux-2.6.39/arch/mips/pci/ops-nile4.c 2011-05-22 19:36:30.000000000 -0400
2435@@ -141,7 +141,7 @@ static int nile4_pcibios_write(struct pc
2436 return PCIBIOS_SUCCESSFUL;
2437 }
2438
2439-struct pci_ops nile4_pci_ops = {
2440+const struct pci_ops nile4_pci_ops = {
2441 .read = nile4_pcibios_read,
2442 .write = nile4_pcibios_write,
2443 };
2444diff -urNp linux-2.6.39/arch/mips/pci/ops-pmcmsp.c linux-2.6.39/arch/mips/pci/ops-pmcmsp.c
2445--- linux-2.6.39/arch/mips/pci/ops-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
2446+++ linux-2.6.39/arch/mips/pci/ops-pmcmsp.c 2011-05-22 19:36:30.000000000 -0400
2447@@ -904,7 +904,7 @@ msp_pcibios_write_config(struct pci_bus
2448 * write - function for Linux to generate PCI Configuration writes.
2449 *
2450 ****************************************************************************/
2451-struct pci_ops msp_pci_ops = {
2452+const struct pci_ops msp_pci_ops = {
2453 .read = msp_pcibios_read_config,
2454 .write = msp_pcibios_write_config
2455 };
2456diff -urNp linux-2.6.39/arch/mips/pci/ops-pnx8550.c linux-2.6.39/arch/mips/pci/ops-pnx8550.c
2457--- linux-2.6.39/arch/mips/pci/ops-pnx8550.c 2011-05-19 00:06:34.000000000 -0400
2458+++ linux-2.6.39/arch/mips/pci/ops-pnx8550.c 2011-05-22 19:36:30.000000000 -0400
2459@@ -276,7 +276,7 @@ static int config_write(struct pci_bus *
2460 }
2461 }
2462
2463-struct pci_ops pnx8550_pci_ops = {
2464+const struct pci_ops pnx8550_pci_ops = {
2465 config_read,
2466 config_write
2467 };
2468diff -urNp linux-2.6.39/arch/mips/pci/ops-rc32434.c linux-2.6.39/arch/mips/pci/ops-rc32434.c
2469--- linux-2.6.39/arch/mips/pci/ops-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2470+++ linux-2.6.39/arch/mips/pci/ops-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2471@@ -201,7 +201,7 @@ static int pci_config_write(struct pci_b
2472 }
2473 }
2474
2475-struct pci_ops rc32434_pci_ops = {
2476+const struct pci_ops rc32434_pci_ops = {
2477 .read = pci_config_read,
2478 .write = pci_config_write,
2479 };
2480diff -urNp linux-2.6.39/arch/mips/pci/ops-sni.c linux-2.6.39/arch/mips/pci/ops-sni.c
2481--- linux-2.6.39/arch/mips/pci/ops-sni.c 2011-05-19 00:06:34.000000000 -0400
2482+++ linux-2.6.39/arch/mips/pci/ops-sni.c 2011-05-22 19:36:30.000000000 -0400
2483@@ -83,7 +83,7 @@ static int pcimt_write(struct pci_bus *b
2484 return 0;
2485 }
2486
2487-struct pci_ops sni_pcimt_ops = {
2488+const struct pci_ops sni_pcimt_ops = {
2489 .read = pcimt_read,
2490 .write = pcimt_write,
2491 };
2492@@ -158,7 +158,7 @@ static int pcit_write(struct pci_bus *bu
2493 }
2494
2495
2496-struct pci_ops sni_pcit_ops = {
2497+const struct pci_ops sni_pcit_ops = {
2498 .read = pcit_read,
2499 .write = pcit_write,
2500 };
2501diff -urNp linux-2.6.39/arch/mips/pci/ops-titan.c linux-2.6.39/arch/mips/pci/ops-titan.c
2502--- linux-2.6.39/arch/mips/pci/ops-titan.c 2011-05-19 00:06:34.000000000 -0400
2503+++ linux-2.6.39/arch/mips/pci/ops-titan.c 2011-05-22 19:36:30.000000000 -0400
2504@@ -105,7 +105,7 @@ static int titan_write_config(struct pci
2505 /*
2506 * Titan PCI structure
2507 */
2508-struct pci_ops titan_pci_ops = {
2509+const struct pci_ops titan_pci_ops = {
2510 titan_read_config,
2511 titan_write_config,
2512 };
2513diff -urNp linux-2.6.39/arch/mips/pci/ops-titan-ht.c linux-2.6.39/arch/mips/pci/ops-titan-ht.c
2514--- linux-2.6.39/arch/mips/pci/ops-titan-ht.c 2011-05-19 00:06:34.000000000 -0400
2515+++ linux-2.6.39/arch/mips/pci/ops-titan-ht.c 2011-05-22 19:36:30.000000000 -0400
2516@@ -118,7 +118,7 @@ static int titan_ht_config_write(struct
2517 return PCIBIOS_SUCCESSFUL;
2518 }
2519
2520-struct pci_ops titan_ht_pci_ops = {
2521+const struct pci_ops titan_ht_pci_ops = {
2522 .read = titan_ht_config_read,
2523 .write = titan_ht_config_write,
2524 };
2525diff -urNp linux-2.6.39/arch/mips/pci/ops-tx3927.c linux-2.6.39/arch/mips/pci/ops-tx3927.c
2526--- linux-2.6.39/arch/mips/pci/ops-tx3927.c 2011-05-19 00:06:34.000000000 -0400
2527+++ linux-2.6.39/arch/mips/pci/ops-tx3927.c 2011-05-22 19:36:30.000000000 -0400
2528@@ -121,7 +121,7 @@ static int tx3927_pci_write_config(struc
2529 return check_abort();
2530 }
2531
2532-static struct pci_ops tx3927_pci_ops = {
2533+static const struct pci_ops tx3927_pci_ops = {
2534 .read = tx3927_pci_read_config,
2535 .write = tx3927_pci_write_config,
2536 };
2537diff -urNp linux-2.6.39/arch/mips/pci/ops-vr41xx.c linux-2.6.39/arch/mips/pci/ops-vr41xx.c
2538--- linux-2.6.39/arch/mips/pci/ops-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2539+++ linux-2.6.39/arch/mips/pci/ops-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2540@@ -120,7 +120,7 @@ static int pci_config_write(struct pci_b
2541 return PCIBIOS_SUCCESSFUL;
2542 }
2543
2544-struct pci_ops vr41xx_pci_ops = {
2545+const struct pci_ops vr41xx_pci_ops = {
2546 .read = pci_config_read,
2547 .write = pci_config_write,
2548 };
2549diff -urNp linux-2.6.39/arch/mips/pci/pci-bcm1480.c linux-2.6.39/arch/mips/pci/pci-bcm1480.c
2550--- linux-2.6.39/arch/mips/pci/pci-bcm1480.c 2011-05-19 00:06:34.000000000 -0400
2551+++ linux-2.6.39/arch/mips/pci/pci-bcm1480.c 2011-05-22 19:36:30.000000000 -0400
2552@@ -171,7 +171,7 @@ static int bcm1480_pcibios_write(struct
2553 return PCIBIOS_SUCCESSFUL;
2554 }
2555
2556-struct pci_ops bcm1480_pci_ops = {
2557+const struct pci_ops bcm1480_pci_ops = {
2558 bcm1480_pcibios_read,
2559 bcm1480_pcibios_write,
2560 };
2561diff -urNp linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c
2562--- linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c 2011-05-19 00:06:34.000000000 -0400
2563+++ linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c 2011-05-22 19:36:30.000000000 -0400
2564@@ -166,7 +166,7 @@ static int bcm1480ht_pcibios_get_busno(v
2565 return 0;
2566 }
2567
2568-struct pci_ops bcm1480ht_pci_ops = {
2569+const struct pci_ops bcm1480ht_pci_ops = {
2570 .read = bcm1480ht_pcibios_read,
2571 .write = bcm1480ht_pcibios_write,
2572 };
2573diff -urNp linux-2.6.39/arch/mips/pci/pci-bcm63xx.h linux-2.6.39/arch/mips/pci/pci-bcm63xx.h
2574--- linux-2.6.39/arch/mips/pci/pci-bcm63xx.h 2011-05-19 00:06:34.000000000 -0400
2575+++ linux-2.6.39/arch/mips/pci/pci-bcm63xx.h 2011-05-22 19:36:30.000000000 -0400
2576@@ -16,8 +16,8 @@
2577 /*
2578 * defined in ops-bcm63xx.c
2579 */
2580-extern struct pci_ops bcm63xx_pci_ops;
2581-extern struct pci_ops bcm63xx_cb_ops;
2582+extern const struct pci_ops bcm63xx_pci_ops;
2583+extern const struct pci_ops bcm63xx_cb_ops;
2584
2585 /*
2586 * defined in pci-bcm63xx.c
2587diff -urNp linux-2.6.39/arch/mips/pci/pci-emma2rh.c linux-2.6.39/arch/mips/pci/pci-emma2rh.c
2588--- linux-2.6.39/arch/mips/pci/pci-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2589+++ linux-2.6.39/arch/mips/pci/pci-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2590@@ -43,7 +43,7 @@ static struct resource pci_mem_resource
2591 .flags = IORESOURCE_MEM,
2592 };
2593
2594-extern struct pci_ops emma2rh_pci_ops;
2595+extern const struct pci_ops emma2rh_pci_ops;
2596
2597 static struct pci_controller emma2rh_pci_controller = {
2598 .pci_ops = &emma2rh_pci_ops,
2599diff -urNp linux-2.6.39/arch/mips/pci/pcie-octeon.c linux-2.6.39/arch/mips/pci/pcie-octeon.c
2600--- linux-2.6.39/arch/mips/pci/pcie-octeon.c 2011-05-19 00:06:34.000000000 -0400
2601+++ linux-2.6.39/arch/mips/pci/pcie-octeon.c 2011-05-22 19:36:30.000000000 -0400
2602@@ -1237,7 +1237,7 @@ static int octeon_pcie1_write_config(str
2603 return octeon_pcie_write_config(1, bus, devfn, reg, size, val);
2604 }
2605
2606-static struct pci_ops octeon_pcie0_ops = {
2607+static const struct pci_ops octeon_pcie0_ops = {
2608 octeon_pcie0_read_config,
2609 octeon_pcie0_write_config,
2610 };
2611@@ -1258,7 +1258,7 @@ static struct pci_controller octeon_pcie
2612 .io_resource = &octeon_pcie0_io_resource,
2613 };
2614
2615-static struct pci_ops octeon_pcie1_ops = {
2616+static const struct pci_ops octeon_pcie1_ops = {
2617 octeon_pcie1_read_config,
2618 octeon_pcie1_write_config,
2619 };
2620diff -urNp linux-2.6.39/arch/mips/pci/pci-ip27.c linux-2.6.39/arch/mips/pci/pci-ip27.c
2621--- linux-2.6.39/arch/mips/pci/pci-ip27.c 2011-05-19 00:06:34.000000000 -0400
2622+++ linux-2.6.39/arch/mips/pci/pci-ip27.c 2011-05-22 19:36:30.000000000 -0400
2623@@ -39,7 +39,7 @@ static struct bridge_controller bridges[
2624 struct bridge_controller *irq_to_bridge[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2625 int irq_to_slot[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2626
2627-extern struct pci_ops bridge_pci_ops;
2628+extern const struct pci_ops bridge_pci_ops;
2629
2630 int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
2631 {
2632diff -urNp linux-2.6.39/arch/mips/pci/pci-ip32.c linux-2.6.39/arch/mips/pci/pci-ip32.c
2633--- linux-2.6.39/arch/mips/pci/pci-ip32.c 2011-05-19 00:06:34.000000000 -0400
2634+++ linux-2.6.39/arch/mips/pci/pci-ip32.c 2011-05-22 19:36:30.000000000 -0400
2635@@ -82,7 +82,7 @@ static irqreturn_t macepci_error(int irq
2636 }
2637
2638
2639-extern struct pci_ops mace_pci_ops;
2640+extern const struct pci_ops mace_pci_ops;
2641 #ifdef CONFIG_64BIT
2642 static struct resource mace_pci_mem_resource = {
2643 .name = "SGI O2 PCI MEM",
2644diff -urNp linux-2.6.39/arch/mips/pci/pci-lasat.c linux-2.6.39/arch/mips/pci/pci-lasat.c
2645--- linux-2.6.39/arch/mips/pci/pci-lasat.c 2011-05-19 00:06:34.000000000 -0400
2646+++ linux-2.6.39/arch/mips/pci/pci-lasat.c 2011-05-22 19:36:30.000000000 -0400
2647@@ -14,8 +14,8 @@
2648
2649 #include <irq.h>
2650
2651-extern struct pci_ops nile4_pci_ops;
2652-extern struct pci_ops gt64xxx_pci0_ops;
2653+extern const struct pci_ops nile4_pci_ops;
2654+extern const struct pci_ops gt64xxx_pci0_ops;
2655 static struct resource lasat_pci_mem_resource = {
2656 .name = "LASAT PCI MEM",
2657 .start = 0x18000000,
2658diff -urNp linux-2.6.39/arch/mips/pci/pci-octeon.c linux-2.6.39/arch/mips/pci/pci-octeon.c
2659--- linux-2.6.39/arch/mips/pci/pci-octeon.c 2011-05-19 00:06:34.000000000 -0400
2660+++ linux-2.6.39/arch/mips/pci/pci-octeon.c 2011-05-22 19:36:30.000000000 -0400
2661@@ -334,7 +334,7 @@ static int octeon_write_config(struct pc
2662 }
2663
2664
2665-static struct pci_ops octeon_pci_ops = {
2666+static const struct pci_ops octeon_pci_ops = {
2667 octeon_read_config,
2668 octeon_write_config,
2669 };
2670diff -urNp linux-2.6.39/arch/mips/pci/pci-rc32434.c linux-2.6.39/arch/mips/pci/pci-rc32434.c
2671--- linux-2.6.39/arch/mips/pci/pci-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2672+++ linux-2.6.39/arch/mips/pci/pci-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2673@@ -75,7 +75,7 @@ static struct resource rc32434_res_pci_i
2674 .flags = IORESOURCE_IO,
2675 };
2676
2677-extern struct pci_ops rc32434_pci_ops;
2678+extern const struct pci_ops rc32434_pci_ops;
2679
2680 #define PCI_MEM1_START PCI_ADDR_START
2681 #define PCI_MEM1_END (PCI_ADDR_START + CPUTOPCI_MEM_WIN - 1)
2682diff -urNp linux-2.6.39/arch/mips/pci/pci-sb1250.c linux-2.6.39/arch/mips/pci/pci-sb1250.c
2683--- linux-2.6.39/arch/mips/pci/pci-sb1250.c 2011-05-19 00:06:34.000000000 -0400
2684+++ linux-2.6.39/arch/mips/pci/pci-sb1250.c 2011-05-22 19:36:30.000000000 -0400
2685@@ -181,7 +181,7 @@ static int sb1250_pcibios_write(struct p
2686 return PCIBIOS_SUCCESSFUL;
2687 }
2688
2689-struct pci_ops sb1250_pci_ops = {
2690+const struct pci_ops sb1250_pci_ops = {
2691 .read = sb1250_pcibios_read,
2692 .write = sb1250_pcibios_write,
2693 };
2694diff -urNp linux-2.6.39/arch/mips/pci/pci-vr41xx.c linux-2.6.39/arch/mips/pci/pci-vr41xx.c
2695--- linux-2.6.39/arch/mips/pci/pci-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2696+++ linux-2.6.39/arch/mips/pci/pci-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2697@@ -36,7 +36,7 @@
2698
2699 #include "pci-vr41xx.h"
2700
2701-extern struct pci_ops vr41xx_pci_ops;
2702+extern const struct pci_ops vr41xx_pci_ops;
2703
2704 static void __iomem *pciu_base;
2705
2706diff -urNp linux-2.6.39/arch/mips/pci/pci-yosemite.c linux-2.6.39/arch/mips/pci/pci-yosemite.c
2707--- linux-2.6.39/arch/mips/pci/pci-yosemite.c 2011-05-19 00:06:34.000000000 -0400
2708+++ linux-2.6.39/arch/mips/pci/pci-yosemite.c 2011-05-22 19:36:30.000000000 -0400
2709@@ -11,7 +11,7 @@
2710 #include <linux/pci.h>
2711 #include <asm/titan_dep.h>
2712
2713-extern struct pci_ops titan_pci_ops;
2714+extern const struct pci_ops titan_pci_ops;
2715
2716 static struct resource py_mem_resource = {
2717 .start = 0xe0000000UL,
2718diff -urNp linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c
2719--- linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-19 00:06:34.000000000 -0400
2720+++ linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-22 19:36:30.000000000 -0400
2721@@ -366,7 +366,7 @@ resource_size_t pcibios_align_resource(v
2722 return start;
2723 }
2724
2725-struct pci_ops titan_pci_ops = {
2726+const struct pci_ops titan_pci_ops = {
2727 titan_ht_config_read_byte,
2728 titan_ht_config_read_word,
2729 titan_ht_config_read_dword,
2730diff -urNp linux-2.6.39/arch/mips/pnx8550/common/pci.c linux-2.6.39/arch/mips/pnx8550/common/pci.c
2731--- linux-2.6.39/arch/mips/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2732+++ linux-2.6.39/arch/mips/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2733@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2734 .flags = IORESOURCE_MEM
2735 };
2736
2737-extern struct pci_ops pnx8550_pci_ops;
2738+extern const struct pci_ops pnx8550_pci_ops;
2739
2740 static struct pci_controller pnx8550_controller = {
2741 .pci_ops = &pnx8550_pci_ops,
2742diff -urNp linux-2.6.39/arch/mips/sni/pcimt.c linux-2.6.39/arch/mips/sni/pcimt.c
2743--- linux-2.6.39/arch/mips/sni/pcimt.c 2011-05-19 00:06:34.000000000 -0400
2744+++ linux-2.6.39/arch/mips/sni/pcimt.c 2011-05-22 19:36:30.000000000 -0400
2745@@ -183,7 +183,7 @@ static void __init sni_pcimt_resource_in
2746 request_resource(&sni_mem_resource, pcimt_mem_resources + i);
2747 }
2748
2749-extern struct pci_ops sni_pcimt_ops;
2750+extern const struct pci_ops sni_pcimt_ops;
2751
2752 static struct pci_controller sni_controller = {
2753 .pci_ops = &sni_pcimt_ops,
2754diff -urNp linux-2.6.39/arch/mips/sni/pcit.c linux-2.6.39/arch/mips/sni/pcit.c
2755--- linux-2.6.39/arch/mips/sni/pcit.c 2011-05-19 00:06:34.000000000 -0400
2756+++ linux-2.6.39/arch/mips/sni/pcit.c 2011-05-22 19:36:30.000000000 -0400
2757@@ -145,7 +145,7 @@ static void __init sni_pcit_resource_ini
2758 }
2759
2760
2761-extern struct pci_ops sni_pcit_ops;
2762+extern const struct pci_ops sni_pcit_ops;
2763
2764 static struct pci_controller sni_pcit_controller = {
2765 .pci_ops = &sni_pcit_ops,
2766diff -urNp linux-2.6.39/arch/mips/wrppmc/pci.c linux-2.6.39/arch/mips/wrppmc/pci.c
2767--- linux-2.6.39/arch/mips/wrppmc/pci.c 2011-05-19 00:06:34.000000000 -0400
2768+++ linux-2.6.39/arch/mips/wrppmc/pci.c 2011-05-22 19:36:30.000000000 -0400
2769@@ -14,7 +14,7 @@
2770
2771 #include <asm/gt64120.h>
2772
2773-extern struct pci_ops gt64xxx_pci0_ops;
2774+extern const struct pci_ops gt64xxx_pci0_ops;
2775
2776 static struct resource pci0_io_resource = {
2777 .name = "pci_0 io",
2778diff -urNp linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h
2779--- linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-19 00:06:34.000000000 -0400
2780+++ linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-22 19:36:30.000000000 -0400
2781@@ -39,7 +39,7 @@ extern void pcibios_resource_survey(void
2782
2783 extern int pcibios_last_bus;
2784 extern struct pci_bus *pci_root_bus;
2785-extern struct pci_ops *pci_root_ops;
2786+extern const struct pci_ops *pci_root_ops;
2787
2788 extern struct irq_routing_table *pcibios_get_irq_routing_table(void);
2789 extern int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq);
2790diff -urNp linux-2.6.39/arch/mn10300/unit-asb2305/pci.c linux-2.6.39/arch/mn10300/unit-asb2305/pci.c
2791--- linux-2.6.39/arch/mn10300/unit-asb2305/pci.c 2011-05-19 00:06:34.000000000 -0400
2792+++ linux-2.6.39/arch/mn10300/unit-asb2305/pci.c 2011-05-22 19:36:30.000000000 -0400
2793@@ -24,7 +24,7 @@ unsigned int pci_probe = 1;
2794
2795 int pcibios_last_bus = -1;
2796 struct pci_bus *pci_root_bus;
2797-struct pci_ops *pci_root_ops;
2798+const struct pci_ops *pci_root_ops;
2799
2800 /*
2801 * The accessible PCI window does not cover the entire CPU address space, but
2802@@ -274,7 +274,7 @@ static int pci_ampci_write_config(struct
2803 }
2804 }
2805
2806-static struct pci_ops pci_direct_ampci = {
2807+static const struct pci_ops pci_direct_ampci = {
2808 pci_ampci_read_config,
2809 pci_ampci_write_config,
2810 };
2811@@ -289,7 +289,7 @@ static struct pci_ops pci_direct_ampci =
2812 * This should be close to trivial, but it isn't, because there are buggy
2813 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
2814 */
2815-static int __init pci_sanity_check(struct pci_ops *o)
2816+static int __init pci_sanity_check(const struct pci_ops *o)
2817 {
2818 struct pci_bus bus; /* Fake bus and device */
2819 u32 x;
2820diff -urNp linux-2.6.39/arch/parisc/include/asm/elf.h linux-2.6.39/arch/parisc/include/asm/elf.h
2821--- linux-2.6.39/arch/parisc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2822+++ linux-2.6.39/arch/parisc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 2823@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
58c5fc13
MT		 2824
2825 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
2826
2827+#ifdef CONFIG_PAX_ASLR
2828+#define PAX_ELF_ET_DYN_BASE 0x10000UL
2829+
2830+#define PAX_DELTA_MMAP_LEN 16
2831+#define PAX_DELTA_STACK_LEN 16
2832+#endif
2833+
2834 /* This yields a mask that user programs can use to figure out what
2835 instruction set this CPU supports. This could be done in user space,
2836 but it's not easy, and we've already done it here. */
66a7e928
MT		 2837diff -urNp linux-2.6.39/arch/parisc/include/asm/pgtable.h linux-2.6.39/arch/parisc/include/asm/pgtable.h
2838--- linux-2.6.39/arch/parisc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
2839+++ linux-2.6.39/arch/parisc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
2840@@ -207,6 +207,17 @@ struct vm_area_struct;
58c5fc13
MT		 2841 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
2842 #define PAGE_COPY PAGE_EXECREAD
2843 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
2844+
2845+#ifdef CONFIG_PAX_PAGEEXEC
2846+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
2847+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2848+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2849+#else
2850+# define PAGE_SHARED_NOEXEC PAGE_SHARED
2851+# define PAGE_COPY_NOEXEC PAGE_COPY
2852+# define PAGE_READONLY_NOEXEC PAGE_READONLY
2853+#endif
2854+
2855 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
2856 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
2857 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
66a7e928
MT		 2858diff -urNp linux-2.6.39/arch/parisc/kernel/module.c linux-2.6.39/arch/parisc/kernel/module.c
2859--- linux-2.6.39/arch/parisc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
2860+++ linux-2.6.39/arch/parisc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 2861@@ -96,16 +96,38 @@
58c5fc13
MT		 2862
2863 /* three functions to determine where in the module core
2864 * or init pieces the location is */
2865+static inline int in_init_rx(struct module *me, void *loc)
2866+{
2867+ return (loc >= me->module_init_rx &&
2868+ loc < (me->module_init_rx + me->init_size_rx));
2869+}
2870+
2871+static inline int in_init_rw(struct module *me, void *loc)
2872+{
2873+ return (loc >= me->module_init_rw &&
2874+ loc < (me->module_init_rw + me->init_size_rw));
2875+}
2876+
2877 static inline int in_init(struct module *me, void *loc)
2878 {
2879- return (loc >= me->module_init &&
2880- loc <= (me->module_init + me->init_size));
2881+ return in_init_rx(me, loc) || in_init_rw(me, loc);
2882+}
2883+
2884+static inline int in_core_rx(struct module *me, void *loc)
2885+{
2886+ return (loc >= me->module_core_rx &&
2887+ loc < (me->module_core_rx + me->core_size_rx));
2888+}
2889+
2890+static inline int in_core_rw(struct module *me, void *loc)
2891+{
2892+ return (loc >= me->module_core_rw &&
2893+ loc < (me->module_core_rw + me->core_size_rw));
2894 }
2895
2896 static inline int in_core(struct module *me, void *loc)
2897 {
2898- return (loc >= me->module_core &&
2899- loc <= (me->module_core + me->core_size));
2900+ return in_core_rx(me, loc) || in_core_rw(me, loc);
2901 }
2902
2903 static inline int in_local(struct module *me, void *loc)
df50ba0c 2904@@ -365,13 +387,13 @@ int module_frob_arch_sections(CONST Elf_
58c5fc13
MT		 2905 }
2906
2907 /* align things a bit */
2908- me->core_size = ALIGN(me->core_size, 16);
2909- me->arch.got_offset = me->core_size;
2910- me->core_size += gots * sizeof(struct got_entry);
2911-
2912- me->core_size = ALIGN(me->core_size, 16);
2913- me->arch.fdesc_offset = me->core_size;
2914- me->core_size += fdescs * sizeof(Elf_Fdesc);
2915+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
2916+ me->arch.got_offset = me->core_size_rw;
2917+ me->core_size_rw += gots * sizeof(struct got_entry);
2918+
2919+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
2920+ me->arch.fdesc_offset = me->core_size_rw;
2921+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
2922
2923 me->arch.got_max = gots;
2924 me->arch.fdesc_max = fdescs;
df50ba0c 2925@@ -389,7 +411,7 @@ static Elf64_Word get_got(struct module
58c5fc13
MT		 2926
2927 BUG_ON(value == 0);
2928
2929- got = me->module_core + me->arch.got_offset;
2930+ got = me->module_core_rw + me->arch.got_offset;
2931 for (i = 0; got[i].addr; i++)
2932 if (got[i].addr == value)
2933 goto out;
df50ba0c 2934@@ -407,7 +429,7 @@ static Elf64_Word get_got(struct module
58c5fc13
MT		 2935 #ifdef CONFIG_64BIT
2936 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
2937 {
2938- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
2939+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
2940
2941 if (!value) {
2942 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
df50ba0c 2943@@ -425,7 +447,7 @@ static Elf_Addr get_fdesc(struct module
58c5fc13
MT		 2944
2945 /* Create new one */
2946 fdesc->addr = value;
2947- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
2948+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
2949 return (Elf_Addr)fdesc;
2950 }
2951 #endif /* CONFIG_64BIT */
df50ba0c 2952@@ -849,7 +871,7 @@ register_unwind_table(struct module *me,
58c5fc13
MT		 2953
2954 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
2955 end = table + sechdrs[me->arch.unwind_section].sh_size;
2956- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
2957+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
2958
2959 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
2960 me->arch.unwind_section, table, end, gp);
66a7e928
MT		 2961diff -urNp linux-2.6.39/arch/parisc/kernel/sys_parisc.c linux-2.6.39/arch/parisc/kernel/sys_parisc.c
2962--- linux-2.6.39/arch/parisc/kernel/sys_parisc.c 2011-05-19 00:06:34.000000000 -0400
2963+++ linux-2.6.39/arch/parisc/kernel/sys_parisc.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 2964@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
2965 /* At this point: (!vma || addr < vma->vm_end). */
2966 if (TASK_SIZE - len < addr)
2967 return -ENOMEM;
2968- if (!vma || addr + len <= vma->vm_start)
2969+ if (check_heap_stack_gap(vma, addr, len))
2970 return addr;
2971 addr = vma->vm_end;
2972 }
2973@@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
2974 /* At this point: (!vma || addr < vma->vm_end). */
2975 if (TASK_SIZE - len < addr)
2976 return -ENOMEM;
2977- if (!vma || addr + len <= vma->vm_start)
2978+ if (check_heap_stack_gap(vma, addr, len))
2979 return addr;
2980 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
2981 if (addr < vma->vm_end) /* handle wraparound */
58c5fc13
MT		 2982@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
2983 if (flags & MAP_FIXED)
2984 return addr;
2985 if (!addr)
2986- addr = TASK_UNMAPPED_BASE;
2987+ addr = current->mm->mmap_base;
2988
2989 if (filp) {
2990 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
66a7e928
MT		 2991diff -urNp linux-2.6.39/arch/parisc/kernel/traps.c linux-2.6.39/arch/parisc/kernel/traps.c
2992--- linux-2.6.39/arch/parisc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
2993+++ linux-2.6.39/arch/parisc/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 2994@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
2995
2996 down_read(&current->mm->mmap_sem);
2997 vma = find_vma(current->mm,regs->iaoq[0]);
2998- if (vma && (regs->iaoq[0] >= vma->vm_start)
2999- && (vma->vm_flags & VM_EXEC)) {
3000-
3001+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
3002 fault_address = regs->iaoq[0];
3003 fault_space = regs->iasq[0];
3004
66a7e928
MT		 3005diff -urNp linux-2.6.39/arch/parisc/mm/fault.c linux-2.6.39/arch/parisc/mm/fault.c
3006--- linux-2.6.39/arch/parisc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
3007+++ linux-2.6.39/arch/parisc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 3008@@ -15,6 +15,7 @@
3009 #include <linux/sched.h>
3010 #include <linux/interrupt.h>
3011 #include <linux/module.h>
3012+#include <linux/unistd.h>
3013
3014 #include <asm/uaccess.h>
3015 #include <asm/traps.h>
3016@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
3017 static unsigned long
3018 parisc_acctyp(unsigned long code, unsigned int inst)
3019 {
3020- if (code == 6 || code == 16)
3021+ if (code == 6 || code == 7 || code == 16)
3022 return VM_EXEC;
3023
3024 switch (inst & 0xf0000000) {
3025@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
3026 }
3027 #endif
3028
3029+#ifdef CONFIG_PAX_PAGEEXEC
3030+/*
3031+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
3032+ *
3033+ * returns 1 when task should be killed
3034+ * 2 when rt_sigreturn trampoline was detected
3035+ * 3 when unpatched PLT trampoline was detected
3036+ */
3037+static int pax_handle_fetch_fault(struct pt_regs *regs)
3038+{
3039+
3040+#ifdef CONFIG_PAX_EMUPLT
3041+ int err;
3042+
3043+ do { /* PaX: unpatched PLT emulation */
3044+ unsigned int bl, depwi;
3045+
3046+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
3047+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
3048+
3049+ if (err)
3050+ break;
3051+
3052+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
3053+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
3054+
3055+ err = get_user(ldw, (unsigned int *)addr);
3056+ err |= get_user(bv, (unsigned int *)(addr+4));
3057+ err |= get_user(ldw2, (unsigned int *)(addr+8));
3058+
3059+ if (err)
3060+ break;
3061+
3062+ if (ldw == 0x0E801096U &&
3063+ bv == 0xEAC0C000U &&
3064+ ldw2 == 0x0E881095U)
3065+ {
3066+ unsigned int resolver, map;
3067+
3068+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
3069+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
3070+ if (err)
3071+ break;
3072+
3073+ regs->gr[20] = instruction_pointer(regs)+8;
3074+ regs->gr[21] = map;
3075+ regs->gr[22] = resolver;
3076+ regs->iaoq[0] = resolver | 3UL;
3077+ regs->iaoq[1] = regs->iaoq[0] + 4;
3078+ return 3;
3079+ }
3080+ }
3081+ } while (0);
3082+#endif
3083+
3084+#ifdef CONFIG_PAX_EMUTRAMP
3085+
3086+#ifndef CONFIG_PAX_EMUSIGRT
3087+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
3088+ return 1;
3089+#endif
3090+
3091+ do { /* PaX: rt_sigreturn emulation */
3092+ unsigned int ldi1, ldi2, bel, nop;
3093+
3094+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
3095+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
3096+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
3097+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
3098+
3099+ if (err)
3100+ break;
3101+
3102+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
3103+ ldi2 == 0x3414015AU &&
3104+ bel == 0xE4008200U &&
3105+ nop == 0x08000240U)
3106+ {
3107+ regs->gr[25] = (ldi1 & 2) >> 1;
3108+ regs->gr[20] = __NR_rt_sigreturn;
3109+ regs->gr[31] = regs->iaoq[1] + 16;
3110+ regs->sr[0] = regs->iasq[1];
3111+ regs->iaoq[0] = 0x100UL;
3112+ regs->iaoq[1] = regs->iaoq[0] + 4;
3113+ regs->iasq[0] = regs->sr[2];
3114+ regs->iasq[1] = regs->sr[2];
3115+ return 2;
3116+ }
3117+ } while (0);
3118+#endif
3119+
3120+ return 1;
3121+}
3122+
3123+void pax_report_insns(void *pc, void *sp)
3124+{
3125+ unsigned long i;
3126+
3127+ printk(KERN_ERR "PAX: bytes at PC: ");
3128+ for (i = 0; i < 5; i++) {
3129+ unsigned int c;
3130+ if (get_user(c, (unsigned int *)pc+i))
3131+ printk(KERN_CONT "???????? ");
3132+ else
3133+ printk(KERN_CONT "%08x ", c);
3134+ }
3135+ printk("\n");
3136+}
3137+#endif
3138+
3139 int fixup_exception(struct pt_regs *regs)
3140 {
3141 const struct exception_table_entry *fix;
3142@@ -192,8 +303,33 @@ good_area:
3143
3144 acc_type = parisc_acctyp(code,regs->iir);
3145
3146- if ((vma->vm_flags & acc_type) != acc_type)
3147+ if ((vma->vm_flags & acc_type) != acc_type) {
3148+
3149+#ifdef CONFIG_PAX_PAGEEXEC
3150+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
3151+ (address & ~3UL) == instruction_pointer(regs))
3152+ {
3153+ up_read(&mm->mmap_sem);
3154+ switch (pax_handle_fetch_fault(regs)) {
3155+
3156+#ifdef CONFIG_PAX_EMUPLT
3157+ case 3:
3158+ return;
3159+#endif
3160+
3161+#ifdef CONFIG_PAX_EMUTRAMP
3162+ case 2:
3163+ return;
3164+#endif
3165+
3166+ }
3167+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
3168+ do_group_exit(SIGKILL);
3169+ }
3170+#endif
3171+
3172 goto bad_area;
3173+ }
3174
3175 /*
3176 * If for any reason at all we couldn't handle the fault, make
66a7e928
MT		 3177diff -urNp linux-2.6.39/arch/powerpc/include/asm/device.h linux-2.6.39/arch/powerpc/include/asm/device.h
3178--- linux-2.6.39/arch/powerpc/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
3179+++ linux-2.6.39/arch/powerpc/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 3180@@ -17,7 +17,7 @@ struct device_node;
3181 */
57199397 3182 struct dev_archdata {
ae4e228f
MT		 3183 /* DMA operations on that device */
3184- struct dma_map_ops *dma_ops;
3185+ const struct dma_map_ops *dma_ops;
3186
3187 /*
3188 * When an iommu is in use, dma_data is used as a ptr to the base of the
66a7e928
MT		 3189diff -urNp linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h
3190--- linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3191+++ linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
3192@@ -67,12 +67,13 @@ static inline unsigned long device_to_ma
57199397 3193 /*
df50ba0c
MT		 3194 * Available generic sets of operations
3195 */
57199397 3196+/* cannot be const */
ae4e228f 3197 #ifdef CONFIG_PPC64
bc901d79
MT		 3198-extern struct dma_map_ops dma_iommu_ops;
3199+extern const struct dma_map_ops dma_iommu_ops;
ae4e228f
MT		 3200 #endif
3201-extern struct dma_map_ops dma_direct_ops;
3202+extern const struct dma_map_ops dma_direct_ops;
3203
3204-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3205+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
58c5fc13 3206 {
ae4e228f
MT		 3207 /* We don't handle the NULL dev case for ISA for now. We could
3208 * do it via an out of line call but it is not needed for now. The
66a7e928 3209@@ -85,7 +86,7 @@ static inline struct dma_map_ops *get_dm
ae4e228f 3210 return dev->archdata.dma_ops;
58c5fc13
MT		 3211 }
3212
ae4e228f
MT		 3213-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
3214+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
58c5fc13 3215 {
ae4e228f 3216 dev->archdata.dma_ops = ops;
58c5fc13 3217 }
66a7e928 3218@@ -119,7 +120,7 @@ static inline void set_dma_offset(struct
58c5fc13 3219
ae4e228f 3220 static inline int dma_supported(struct device *dev, u64 mask)
58c5fc13 3221 {
ae4e228f
MT		 3222- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3223+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
58c5fc13 3224
ae4e228f
MT		 3225 if (unlikely(dma_ops == NULL))
3226 return 0;
66a7e928 3227@@ -133,7 +134,7 @@ extern int dma_set_mask(struct device *d
ae4e228f
MT		 3228 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3229 dma_addr_t *dma_handle, gfp_t flag)
3230 {
3231- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3232+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3233 void *cpu_addr;
3234
3235 BUG_ON(!dma_ops);
66a7e928 3236@@ -148,7 +149,7 @@ static inline void *dma_alloc_coherent(s
ae4e228f
MT		 3237 static inline void dma_free_coherent(struct device *dev, size_t size,
3238 void *cpu_addr, dma_addr_t dma_handle)
58c5fc13 3239 {
ae4e228f
MT		 3240- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3241+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3242
3243 BUG_ON(!dma_ops);
3244
66a7e928 3245@@ -159,7 +160,7 @@ static inline void dma_free_coherent(str
ae4e228f
MT		 3246
3247 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
3248 {
3249- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3250+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3251
3252 if (dma_ops->mapping_error)
3253 return dma_ops->mapping_error(dev, dma_addr);
66a7e928
MT		 3254diff -urNp linux-2.6.39/arch/powerpc/include/asm/elf.h linux-2.6.39/arch/powerpc/include/asm/elf.h
3255--- linux-2.6.39/arch/powerpc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
3256+++ linux-2.6.39/arch/powerpc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 3257@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
58c5fc13
MT		 3258 the loader. We need to make sure that it is out of the way of the program
3259 that it will "exec", and that there is sufficient room for the brk. */
3260
3261-extern unsigned long randomize_et_dyn(unsigned long base);
3262-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
3263+#define ELF_ET_DYN_BASE (0x20000000)
3264+
3265+#ifdef CONFIG_PAX_ASLR
3266+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
3267+
3268+#ifdef __powerpc64__
bc901d79
MT		 3269+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
3270+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
58c5fc13
MT		 3271+#else
3272+#define PAX_DELTA_MMAP_LEN 15
3273+#define PAX_DELTA_STACK_LEN 15
3274+#endif
3275+#endif
3276
3277 /*
3278 * Our registers are always unsigned longs, whether we're a 32 bit
ae4e228f 3279@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
58c5fc13
MT		 3280 (0x7ff >> (PAGE_SHIFT - 12)) : \
3281 (0x3ffff >> (PAGE_SHIFT - 12)))
3282
3283-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
3284-#define arch_randomize_brk arch_randomize_brk
3285-
3286 #endif /* __KERNEL__ */
3287
3288 /*
66a7e928
MT		 3289diff -urNp linux-2.6.39/arch/powerpc/include/asm/iommu.h linux-2.6.39/arch/powerpc/include/asm/iommu.h
3290--- linux-2.6.39/arch/powerpc/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
3291+++ linux-2.6.39/arch/powerpc/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 3292@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
3293 extern void iommu_init_early_dart(void);
3294 extern void iommu_init_early_pasemi(void);
3295
3296+/* dma-iommu.c */
3297+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
3298+
3299 #ifdef CONFIG_PCI
3300 extern void pci_iommu_init(void);
3301 extern void pci_direct_iommu_init(void);
66a7e928
MT		 3302diff -urNp linux-2.6.39/arch/powerpc/include/asm/kmap_types.h linux-2.6.39/arch/powerpc/include/asm/kmap_types.h
3303--- linux-2.6.39/arch/powerpc/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
3304+++ linux-2.6.39/arch/powerpc/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
57199397 3305@@ -27,6 +27,7 @@ enum km_type {
58c5fc13
MT		 3306 KM_PPC_SYNC_PAGE,
3307 KM_PPC_SYNC_ICACHE,
57199397 3308 KM_KDB,
58c5fc13
MT		 3309+ KM_CLEARPAGE,
3310 KM_TYPE_NR
3311 };
3312
66a7e928
MT		 3313diff -urNp linux-2.6.39/arch/powerpc/include/asm/page_64.h linux-2.6.39/arch/powerpc/include/asm/page_64.h
3314--- linux-2.6.39/arch/powerpc/include/asm/page_64.h 2011-05-19 00:06:34.000000000 -0400
3315+++ linux-2.6.39/arch/powerpc/include/asm/page_64.h 2011-05-22 19:36:30.000000000 -0400
57199397 3316@@ -172,15 +172,18 @@ do { \
66a7e928 3317 * stack by default, so in the absence of a PT_GNU_STACK program header
efbe55a5
MT		 3318 * we turn execute permission off.
3319 */
3320-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3321- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3322+#define VM_STACK_DEFAULT_FLAGS32 \
3323+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3324+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3325
3326 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3327 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3328
3329+#ifndef CONFIG_PAX_PAGEEXEC
3330 #define VM_STACK_DEFAULT_FLAGS \
bc901d79 3331 (is_32bit_task() ? \
efbe55a5
MT		 3332 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
3333+#endif
3334
3335 #include <asm-generic/getorder.h>
3336
66a7e928
MT		 3337diff -urNp linux-2.6.39/arch/powerpc/include/asm/page.h linux-2.6.39/arch/powerpc/include/asm/page.h
3338--- linux-2.6.39/arch/powerpc/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
3339+++ linux-2.6.39/arch/powerpc/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 3340@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
3341 * and needs to be executable. This means the whole heap ends
3342 * up being executable.
3343 */
3344-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3345- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3346+#define VM_DATA_DEFAULT_FLAGS32 \
3347+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3348+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3349
3350 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3351 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3352@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
3353 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
3354 #endif
3355
3356+#define ktla_ktva(addr) (addr)
3357+#define ktva_ktla(addr) (addr)
3358+
3359 #ifndef __ASSEMBLY__
3360
3361 #undef STRICT_MM_TYPECHECKS
66a7e928
MT		 3362diff -urNp linux-2.6.39/arch/powerpc/include/asm/pci.h linux-2.6.39/arch/powerpc/include/asm/pci.h
3363--- linux-2.6.39/arch/powerpc/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
3364+++ linux-2.6.39/arch/powerpc/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 3365@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
3366 }
3367
3368 #ifdef CONFIG_PCI
3369-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
3370-extern struct dma_map_ops *get_pci_dma_ops(void);
3371+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
3372+extern const struct dma_map_ops *get_pci_dma_ops(void);
3373 #else /* CONFIG_PCI */
3374 #define set_pci_dma_ops(d)
3375 #define get_pci_dma_ops() NULL
66a7e928
MT		 3376diff -urNp linux-2.6.39/arch/powerpc/include/asm/pgtable.h linux-2.6.39/arch/powerpc/include/asm/pgtable.h
3377--- linux-2.6.39/arch/powerpc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
3378+++ linux-2.6.39/arch/powerpc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
317566c1
MT		 3379@@ -2,6 +2,7 @@
3380 #define _ASM_POWERPC_PGTABLE_H
3381 #ifdef __KERNEL__
3382
3383+#include <linux/const.h>
3384 #ifndef __ASSEMBLY__
3385 #include <asm/processor.h> /* For TASK_SIZE */
3386 #include <asm/mmu.h>
66a7e928
MT		 3387diff -urNp linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h
3388--- linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h 2011-05-19 00:06:34.000000000 -0400
3389+++ linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 3390@@ -21,6 +21,7 @@
3391 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
3392 #define _PAGE_USER 0x004 /* usermode access allowed */
3393 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
ae4e228f 3394+#define _PAGE_EXEC _PAGE_GUARDED
58c5fc13
MT		 3395 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
3396 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
3397 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
66a7e928
MT		 3398diff -urNp linux-2.6.39/arch/powerpc/include/asm/reg.h linux-2.6.39/arch/powerpc/include/asm/reg.h
3399--- linux-2.6.39/arch/powerpc/include/asm/reg.h 2011-05-19 00:06:34.000000000 -0400
3400+++ linux-2.6.39/arch/powerpc/include/asm/reg.h 2011-05-22 19:36:30.000000000 -0400
3401@@ -201,6 +201,7 @@
58c5fc13
MT		 3402 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
3403 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
3404 #define DSISR_NOHPTE 0x40000000 /* no translation found */
3405+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
3406 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
3407 #define DSISR_ISSTORE 0x02000000 /* access was a store */
3408 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
66a7e928
MT		 3409diff -urNp linux-2.6.39/arch/powerpc/include/asm/swiotlb.h linux-2.6.39/arch/powerpc/include/asm/swiotlb.h
3410--- linux-2.6.39/arch/powerpc/include/asm/swiotlb.h 2011-05-19 00:06:34.000000000 -0400
3411+++ linux-2.6.39/arch/powerpc/include/asm/swiotlb.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 3412@@ -13,7 +13,7 @@
3413
3414 #include <linux/swiotlb.h>
3415
3416-extern struct dma_map_ops swiotlb_dma_ops;
3417+extern const struct dma_map_ops swiotlb_dma_ops;
3418
3419 static inline void dma_mark_clean(void *addr, size_t size) {}
3420
66a7e928
MT		 3421diff -urNp linux-2.6.39/arch/powerpc/include/asm/system.h linux-2.6.39/arch/powerpc/include/asm/system.h
3422--- linux-2.6.39/arch/powerpc/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
3423+++ linux-2.6.39/arch/powerpc/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 3424@@ -533,7 +533,7 @@ __cmpxchg_local(volatile void *ptr, unsi
3425 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
3426 #endif
3427
3428-extern unsigned long arch_align_stack(unsigned long sp);
3429+#define arch_align_stack(x) ((x) & ~0xfUL)
3430
3431 /* Used in very early kernel initialization. */
3432 extern unsigned long reloc_offset(void);
66a7e928
MT		 3433diff -urNp linux-2.6.39/arch/powerpc/include/asm/uaccess.h linux-2.6.39/arch/powerpc/include/asm/uaccess.h
3434--- linux-2.6.39/arch/powerpc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
3435+++ linux-2.6.39/arch/powerpc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
efbe55a5
MT		 3436@@ -13,6 +13,8 @@
3437 #define VERIFY_READ 0
3438 #define VERIFY_WRITE 1
3439
3440+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3441+
3442 /*
3443 * The fs value determines whether argument validity checking should be
3444 * performed or not. If get_fs() == USER_DS, checking is performed, with
3445@@ -327,52 +329,6 @@ do { \
58c5fc13
MT		 3446 extern unsigned long __copy_tofrom_user(void __user *to,
3447 const void __user *from, unsigned long size);
3448
3449-#ifndef __powerpc64__
3450-
3451-static inline unsigned long copy_from_user(void *to,
3452- const void __user *from, unsigned long n)
3453-{
3454- unsigned long over;
3455-
3456- if (access_ok(VERIFY_READ, from, n))
3457- return __copy_tofrom_user((__force void __user *)to, from, n);
3458- if ((unsigned long)from < TASK_SIZE) {
3459- over = (unsigned long)from + n - TASK_SIZE;
3460- return __copy_tofrom_user((__force void __user *)to, from,
3461- n - over) + over;
3462- }
3463- return n;
3464-}
3465-
3466-static inline unsigned long copy_to_user(void __user *to,
3467- const void *from, unsigned long n)
3468-{
3469- unsigned long over;
3470-
3471- if (access_ok(VERIFY_WRITE, to, n))
3472- return __copy_tofrom_user(to, (__force void __user *)from, n);
3473- if ((unsigned long)to < TASK_SIZE) {
3474- over = (unsigned long)to + n - TASK_SIZE;
3475- return __copy_tofrom_user(to, (__force void __user *)from,
3476- n - over) + over;
3477- }
3478- return n;
3479-}
3480-
3481-#else /* __powerpc64__ */
3482-
3483-#define __copy_in_user(to, from, size) \
3484- __copy_tofrom_user((to), (from), (size))
3485-
3486-extern unsigned long copy_from_user(void *to, const void __user *from,
3487- unsigned long n);
3488-extern unsigned long copy_to_user(void __user *to, const void *from,
3489- unsigned long n);
3490-extern unsigned long copy_in_user(void __user *to, const void __user *from,
3491- unsigned long n);
3492-
3493-#endif /* __powerpc64__ */
3494-
3495 static inline unsigned long __copy_from_user_inatomic(void *to,
3496 const void __user *from, unsigned long n)
3497 {
efbe55a5 3498@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
58c5fc13
MT		 3499 if (ret == 0)
3500 return 0;
3501 }
ae4e228f 3502+
58c5fc13
MT		 3503+ if (!__builtin_constant_p(n))
3504+ check_object_size(to, n, false);
3505+
3506 return __copy_tofrom_user((__force void __user *)to, from, n);
3507 }
3508
efbe55a5 3509@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
58c5fc13
MT		 3510 if (ret == 0)
3511 return 0;
3512 }
ae4e228f 3513+
58c5fc13
MT		 3514+ if (!__builtin_constant_p(n))
3515+ check_object_size(from, n, true);
3516+
3517 return __copy_tofrom_user(to, (__force const void __user *)from, n);
3518 }
3519
efbe55a5 3520@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
58c5fc13
MT		 3521 return __copy_to_user_inatomic(to, from, size);
3522 }
3523
3524+#ifndef __powerpc64__
3525+
3526+static inline unsigned long __must_check copy_from_user(void *to,
3527+ const void __user *from, unsigned long n)
3528+{
3529+ unsigned long over;
3530+
ae4e228f 3531+ if ((long)n < 0)
58c5fc13
MT		 3532+ return n;
3533+
3534+ if (access_ok(VERIFY_READ, from, n)) {
3535+ if (!__builtin_constant_p(n))
3536+ check_object_size(to, n, false);
58c5fc13
MT		 3537+ return __copy_tofrom_user((__force void __user *)to, from, n);
3538+ }
3539+ if ((unsigned long)from < TASK_SIZE) {
3540+ over = (unsigned long)from + n - TASK_SIZE;
3541+ if (!__builtin_constant_p(n - over))
3542+ check_object_size(to, n - over, false);
3543+ return __copy_tofrom_user((__force void __user *)to, from,
3544+ n - over) + over;
3545+ }
3546+ return n;
3547+}
3548+
3549+static inline unsigned long __must_check copy_to_user(void __user *to,
3550+ const void *from, unsigned long n)
3551+{
3552+ unsigned long over;
3553+
ae4e228f 3554+ if ((long)n < 0)
58c5fc13
MT		 3555+ return n;
3556+
3557+ if (access_ok(VERIFY_WRITE, to, n)) {
3558+ if (!__builtin_constant_p(n))
3559+ check_object_size(from, n, true);
3560+ return __copy_tofrom_user(to, (__force void __user *)from, n);
3561+ }
3562+ if ((unsigned long)to < TASK_SIZE) {
3563+ over = (unsigned long)to + n - TASK_SIZE;
3564+ if (!__builtin_constant_p(n))
3565+ check_object_size(from, n - over, true);
3566+ return __copy_tofrom_user(to, (__force void __user *)from,
3567+ n - over) + over;
3568+ }
3569+ return n;
3570+}
3571+
3572+#else /* __powerpc64__ */
3573+
3574+#define __copy_in_user(to, from, size) \
3575+ __copy_tofrom_user((to), (from), (size))
3576+
ae4e228f 3577+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
58c5fc13 3578+{
ae4e228f 3579+ if ((long)n < 0 || n > INT_MAX)
58c5fc13
MT		 3580+ return n;
3581+
3582+ if (!__builtin_constant_p(n))
3583+ check_object_size(to, n, false);
3584+
3585+ if (likely(access_ok(VERIFY_READ, from, n)))
3586+ n = __copy_from_user(to, from, n);
3587+ else
3588+ memset(to, 0, n);
58c5fc13
MT		 3589+ return n;
3590+}
3591+
ae4e228f 3592+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
58c5fc13 3593+{
ae4e228f 3594+ if ((long)n < 0 || n > INT_MAX)
58c5fc13
MT		 3595+ return n;
3596+
3597+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
3598+ if (!__builtin_constant_p(n))
3599+ check_object_size(from, n, true);
3600+ n = __copy_to_user(to, from, n);
3601+ }
58c5fc13
MT		 3602+ return n;
3603+}
3604+
3605+extern unsigned long copy_in_user(void __user *to, const void __user *from,
3606+ unsigned long n);
3607+
3608+#endif /* __powerpc64__ */
3609+
3610 extern unsigned long __clear_user(void __user *addr, unsigned long size);
3611
3612 static inline unsigned long clear_user(void __user *addr, unsigned long size)
66a7e928
MT		 3613diff -urNp linux-2.6.39/arch/powerpc/kernel/dma.c linux-2.6.39/arch/powerpc/kernel/dma.c
3614--- linux-2.6.39/arch/powerpc/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
3615+++ linux-2.6.39/arch/powerpc/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 3616@@ -136,7 +136,7 @@ static inline void dma_direct_sync_singl
57199397
MT		 3617 }
3618 #endif
3619
3620-struct dma_map_ops dma_direct_ops = {
3621+const struct dma_map_ops dma_direct_ops = {
3622 .alloc_coherent = dma_direct_alloc_coherent,
3623 .free_coherent = dma_direct_free_coherent,
3624 .map_sg = dma_direct_map_sg,
bc901d79
MT		 3625@@ -157,7 +157,7 @@ EXPORT_SYMBOL(dma_direct_ops);
3626
3627 int dma_set_mask(struct device *dev, u64 dma_mask)
3628 {
3629- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3630+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3631
3632 if (ppc_md.dma_set_mask)
3633 return ppc_md.dma_set_mask(dev, dma_mask);
66a7e928
MT		 3634diff -urNp linux-2.6.39/arch/powerpc/kernel/dma-iommu.c linux-2.6.39/arch/powerpc/kernel/dma-iommu.c
3635--- linux-2.6.39/arch/powerpc/kernel/dma-iommu.c 2011-05-19 00:06:34.000000000 -0400
3636+++ linux-2.6.39/arch/powerpc/kernel/dma-iommu.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 3637@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
3638 }
3639
3640 /* We support DMA to/from any memory page via the iommu */
3641-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
3642+int dma_iommu_dma_supported(struct device *dev, u64 mask)
3643 {
3644 struct iommu_table *tbl = get_iommu_table_base(dev);
3645
16454cff 3646@@ -90,7 +90,7 @@ static int dma_iommu_dma_supported(struc
6892158b
MT		 3647 return 1;
3648 }
3649
16454cff
MT		 3650-struct dma_map_ops dma_iommu_ops = {
3651+struct dma_map_ops dma_iommu_ops = { /* cannot be const, see arch/powerpc/platforms/cell/iommu.c */
6892158b
MT		 3652 .alloc_coherent = dma_iommu_alloc_coherent,
3653 .free_coherent = dma_iommu_free_coherent,
16454cff 3654 .map_sg = dma_iommu_map_sg,
66a7e928
MT		 3655diff -urNp linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c
3656--- linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
3657+++ linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 3658@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
ae4e228f
MT		 3659 * map_page, and unmap_page on highmem, use normal dma_ops
3660 * for everything else.
3661 */
3662-struct dma_map_ops swiotlb_dma_ops = {
3663+const struct dma_map_ops swiotlb_dma_ops = {
3664 .alloc_coherent = dma_direct_alloc_coherent,
3665 .free_coherent = dma_direct_free_coherent,
3666 .map_sg = swiotlb_map_sg_attrs,
66a7e928
MT		 3667diff -urNp linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S
3668--- linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S 2011-05-19 00:06:34.000000000 -0400
3669+++ linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S 2011-05-22 19:36:30.000000000 -0400
6892158b 3670@@ -495,6 +495,7 @@ storage_fault_common:
ae4e228f
MT		 3671 std r14,_DAR(r1)
3672 std r15,_DSISR(r1)
3673 addi r3,r1,STACK_FRAME_OVERHEAD
3674+ bl .save_nvgprs
3675 mr r4,r14
3676 mr r5,r15
3677 ld r14,PACA_EXGEN+EX_R14(r13)
6892158b 3678@@ -504,8 +505,7 @@ storage_fault_common:
ae4e228f
MT		 3679 cmpdi r3,0
3680 bne- 1f
3681 b .ret_from_except_lite
3682-1: bl .save_nvgprs
3683- mr r5,r3
3684+1: mr r5,r3
3685 addi r3,r1,STACK_FRAME_OVERHEAD
3686 ld r4,_DAR(r1)
3687 bl .bad_page_fault
66a7e928
MT		 3688diff -urNp linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S
3689--- linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S 2011-05-19 00:06:34.000000000 -0400
3690+++ linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S 2011-05-22 19:36:30.000000000 -0400
16454cff 3691@@ -848,10 +848,10 @@ handle_page_fault:
ae4e228f
MT		 3692 11: ld r4,_DAR(r1)
3693 ld r5,_DSISR(r1)
3694 addi r3,r1,STACK_FRAME_OVERHEAD
3695+ bl .save_nvgprs
3696 bl .do_page_fault
3697 cmpdi r3,0
3698 beq+ 13f
3699- bl .save_nvgprs
3700 mr r5,r3
3701 addi r3,r1,STACK_FRAME_OVERHEAD
3702 lwz r4,_DAR(r1)
66a7e928
MT		 3703diff -urNp linux-2.6.39/arch/powerpc/kernel/ibmebus.c linux-2.6.39/arch/powerpc/kernel/ibmebus.c
3704--- linux-2.6.39/arch/powerpc/kernel/ibmebus.c 2011-05-19 00:06:34.000000000 -0400
3705+++ linux-2.6.39/arch/powerpc/kernel/ibmebus.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 3706@@ -128,7 +128,7 @@ static int ibmebus_dma_supported(struct
ae4e228f
MT		 3707 return 1;
3708 }
3709
3710-static struct dma_map_ops ibmebus_dma_ops = {
3711+static const struct dma_map_ops ibmebus_dma_ops = {
3712 .alloc_coherent = ibmebus_alloc_coherent,
3713 .free_coherent = ibmebus_free_coherent,
3714 .map_sg = ibmebus_map_sg,
66a7e928
MT		 3715diff -urNp linux-2.6.39/arch/powerpc/kernel/kgdb.c linux-2.6.39/arch/powerpc/kernel/kgdb.c
3716--- linux-2.6.39/arch/powerpc/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
3717+++ linux-2.6.39/arch/powerpc/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 3718@@ -422,7 +422,7 @@ int kgdb_arch_handle_exception(int vecto
ae4e228f
MT		 3719 /*
3720 * Global data
3721 */
3722-struct kgdb_arch arch_kgdb_ops = {
3723+const struct kgdb_arch arch_kgdb_ops = {
3724 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
3725 };
3726
66a7e928
MT		 3727diff -urNp linux-2.6.39/arch/powerpc/kernel/module_32.c linux-2.6.39/arch/powerpc/kernel/module_32.c
3728--- linux-2.6.39/arch/powerpc/kernel/module_32.c 2011-05-19 00:06:34.000000000 -0400
3729+++ linux-2.6.39/arch/powerpc/kernel/module_32.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 3730@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
3731 me->arch.core_plt_section = i;
3732 }
3733 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
3734- printk("Module doesn't contain .plt or .init.plt sections.\n");
3735+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
3736 return -ENOEXEC;
3737 }
3738
3739@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
3740
3741 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
3742 /* Init, or core PLT? */
3743- if (location >= mod->module_core
3744- && location < mod->module_core + mod->core_size)
3745+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
3746+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
3747 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
3748- else
3749+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
3750+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
3751 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
3752+ else {
3753+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
3754+ return ~0UL;
3755+ }
3756
3757 /* Find this entry, or if that fails, the next avail. entry */
3758 while (entry->jump[0]) {
66a7e928
MT		 3759diff -urNp linux-2.6.39/arch/powerpc/kernel/module.c linux-2.6.39/arch/powerpc/kernel/module.c
3760--- linux-2.6.39/arch/powerpc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
3761+++ linux-2.6.39/arch/powerpc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 3762@@ -31,11 +31,24 @@
3763
3764 LIST_HEAD(module_bug_list);
3765
3766+#ifdef CONFIG_PAX_KERNEXEC
3767 void *module_alloc(unsigned long size)
3768 {
3769 if (size == 0)
3770 return NULL;
3771
3772+ return vmalloc(size);
3773+}
3774+
3775+void *module_alloc_exec(unsigned long size)
3776+#else
3777+void *module_alloc(unsigned long size)
3778+#endif
3779+
3780+{
3781+ if (size == 0)
3782+ return NULL;
3783+
3784 return vmalloc_exec(size);
3785 }
3786
3787@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
3788 vfree(module_region);
3789 }
3790
3791+#ifdef CONFIG_PAX_KERNEXEC
3792+void module_free_exec(struct module *mod, void *module_region)
3793+{
3794+ module_free(mod, module_region);
3795+}
3796+#endif
3797+
3798 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
3799 const Elf_Shdr *sechdrs,
3800 const char *name)
66a7e928
MT		 3801diff -urNp linux-2.6.39/arch/powerpc/kernel/pci-common.c linux-2.6.39/arch/powerpc/kernel/pci-common.c
3802--- linux-2.6.39/arch/powerpc/kernel/pci-common.c 2011-05-19 00:06:34.000000000 -0400
3803+++ linux-2.6.39/arch/powerpc/kernel/pci-common.c 2011-05-22 19:36:30.000000000 -0400
3804@@ -53,14 +53,14 @@ resource_size_t isa_mem_base;
ae4e228f
MT		 3805 unsigned int ppc_pci_flags = 0;
3806
3807
3808-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3809+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3810
3811-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
3812+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
3813 {
3814 pci_dma_ops = dma_ops;
3815 }
3816
3817-struct dma_map_ops *get_pci_dma_ops(void)
3818+const struct dma_map_ops *get_pci_dma_ops(void)
3819 {
3820 return pci_dma_ops;
3821 }
66a7e928
MT		 3822@@ -1639,7 +1639,7 @@ null_write_config(struct pci_bus *bus, u
3823 return PCIBIOS_DEVICE_NOT_FOUND;
3824 }
3825
3826-static struct pci_ops null_pci_ops =
3827+static const struct pci_ops null_pci_ops =
3828 {
3829 .read = null_read_config,
3830 .write = null_write_config,
3831diff -urNp linux-2.6.39/arch/powerpc/kernel/process.c linux-2.6.39/arch/powerpc/kernel/process.c
3832--- linux-2.6.39/arch/powerpc/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
3833+++ linux-2.6.39/arch/powerpc/kernel/process.c 2011-05-22 19:41:32.000000000 -0400
16454cff 3834@@ -655,8 +655,8 @@ void show_regs(struct pt_regs * regs)
bc901d79
MT		 3835 * Lookup NIP late so we have the best change of getting the
3836 * above info out without failing
3837 */
3838- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
3839- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
3840+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
3841+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
3842 #endif
3843 show_stack(current, (unsigned long *) regs->gpr[1]);
3844 if (!user_mode(regs))
16454cff 3845@@ -1146,10 +1146,10 @@ void show_stack(struct task_struct *tsk,
bc901d79
MT		 3846 newsp = stack[0];
3847 ip = stack[STACK_FRAME_LR_SAVE];
3848 if (!firstframe || ip != lr) {
3849- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
3850+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
3851 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
3852 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
3853- printk(" (%pS)",
3854+ printk(" (%pA)",
3855 (void *)current->ret_stack[curr_frame].ret);
3856 curr_frame--;
3857 }
16454cff 3858@@ -1169,7 +1169,7 @@ void show_stack(struct task_struct *tsk,
bc901d79
MT		 3859 struct pt_regs *regs = (struct pt_regs *)
3860 (sp + STACK_FRAME_OVERHEAD);
3861 lr = regs->link;
3862- printk("--- Exception: %lx at %pS\n LR = %pS\n",
3863+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
3864 regs->trap, (void *)regs->nip, (void *)lr);
3865 firstframe = 1;
3866 }
16454cff 3867@@ -1244,58 +1244,3 @@ void thread_info_cache_init(void)
58c5fc13 3868 }
6892158b 3869
bc901d79
MT		 3870 #endif /* THREAD_SHIFT < PAGE_SHIFT */
3871-
3872-unsigned long arch_align_stack(unsigned long sp)
3873-{
3874- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3875- sp -= get_random_int() & ~PAGE_MASK;
3876- return sp & ~0xf;
3877-}
3878-
58c5fc13
MT		 3879-static inline unsigned long brk_rnd(void)
3880-{
3881- unsigned long rnd = 0;
3882-
3883- /* 8MB for 32bit, 1GB for 64bit */
3884- if (is_32bit_task())
3885- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
3886- else
3887- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
3888-
3889- return rnd << PAGE_SHIFT;
3890-}
3891-
3892-unsigned long arch_randomize_brk(struct mm_struct *mm)
3893-{
ae4e228f
MT		 3894- unsigned long base = mm->brk;
3895- unsigned long ret;
3896-
3897-#ifdef CONFIG_PPC_STD_MMU_64
3898- /*
3899- * If we are using 1TB segments and we are allowed to randomise
3900- * the heap, we can put it above 1TB so it is backed by a 1TB
3901- * segment. Otherwise the heap will be in the bottom 1TB
3902- * which always uses 256MB segments and this may result in a
3903- * performance penalty.
3904- */
3905- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
3906- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
3907-#endif
3908-
3909- ret = PAGE_ALIGN(base + brk_rnd());
58c5fc13
MT		 3910-
3911- if (ret < mm->brk)
3912- return mm->brk;
3913-
3914- return ret;
3915-}
3916-
3917-unsigned long randomize_et_dyn(unsigned long base)
3918-{
3919- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3920-
3921- if (ret < base)
3922- return base;
3923-
3924- return ret;
3925-}
66a7e928
MT		 3926diff -urNp linux-2.6.39/arch/powerpc/kernel/rtas_pci.c linux-2.6.39/arch/powerpc/kernel/rtas_pci.c
3927--- linux-2.6.39/arch/powerpc/kernel/rtas_pci.c 2011-05-19 00:06:34.000000000 -0400
3928+++ linux-2.6.39/arch/powerpc/kernel/rtas_pci.c 2011-05-22 19:36:30.000000000 -0400
3929@@ -149,7 +149,7 @@ static int rtas_pci_write_config(struct
3930 return PCIBIOS_DEVICE_NOT_FOUND;
3931 }
3932
3933-static struct pci_ops rtas_pci_ops = {
3934+static const struct pci_ops rtas_pci_ops = {
3935 .read = rtas_pci_read_config,
3936 .write = rtas_pci_write_config,
3937 };
3938diff -urNp linux-2.6.39/arch/powerpc/kernel/signal_32.c linux-2.6.39/arch/powerpc/kernel/signal_32.c
3939--- linux-2.6.39/arch/powerpc/kernel/signal_32.c 2011-05-19 00:06:34.000000000 -0400
3940+++ linux-2.6.39/arch/powerpc/kernel/signal_32.c 2011-05-22 19:36:30.000000000 -0400
6892158b 3941@@ -858,7 +858,7 @@ int handle_rt_signal32(unsigned long sig
58c5fc13
MT		 3942 /* Save user registers on the stack */
3943 frame = &rt_sf->uc.uc_mcontext;
3944 addr = frame;
3945- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
3946+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
3947 if (save_user_regs(regs, frame, 0, 1))
3948 goto badframe;
3949 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
66a7e928
MT		 3950diff -urNp linux-2.6.39/arch/powerpc/kernel/signal_64.c linux-2.6.39/arch/powerpc/kernel/signal_64.c
3951--- linux-2.6.39/arch/powerpc/kernel/signal_64.c 2011-05-19 00:06:34.000000000 -0400
3952+++ linux-2.6.39/arch/powerpc/kernel/signal_64.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 3953@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
3954 current->thread.fpscr.val = 0;
3955
3956 /* Set up to return from userspace. */
3957- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
3958+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
3959 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
3960 } else {
3961 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
66a7e928
MT		 3962diff -urNp linux-2.6.39/arch/powerpc/kernel/vdso.c linux-2.6.39/arch/powerpc/kernel/vdso.c
3963--- linux-2.6.39/arch/powerpc/kernel/vdso.c 2011-05-19 00:06:34.000000000 -0400
3964+++ linux-2.6.39/arch/powerpc/kernel/vdso.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 3965@@ -36,6 +36,7 @@
58c5fc13
MT		 3966 #include <asm/firmware.h>
3967 #include <asm/vdso.h>
3968 #include <asm/vdso_datapage.h>
3969+#include <asm/mman.h>
3970
3971 #include "setup.h"
3972
ae4e228f 3973@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
58c5fc13
MT		 3974 vdso_base = VDSO32_MBASE;
3975 #endif
3976
3977- current->mm->context.vdso_base = 0;
3978+ current->mm->context.vdso_base = ~0UL;
3979
3980 /* vDSO has a problem and was disabled, just don't "enable" it for the
3981 * process
ae4e228f 3982@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
58c5fc13 3983 vdso_base = get_unmapped_area(NULL, vdso_base,
ae4e228f
MT		 3984 (vdso_pages << PAGE_SHIFT) +
3985 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
3986- 0, 0);
3987+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
58c5fc13
MT		 3988 if (IS_ERR_VALUE(vdso_base)) {
3989 rc = vdso_base;
3990 goto fail_mmapsem;
66a7e928
MT		 3991diff -urNp linux-2.6.39/arch/powerpc/kernel/vio.c linux-2.6.39/arch/powerpc/kernel/vio.c
3992--- linux-2.6.39/arch/powerpc/kernel/vio.c 2011-05-19 00:06:34.000000000 -0400
3993+++ linux-2.6.39/arch/powerpc/kernel/vio.c 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 3994@@ -605,11 +605,12 @@ static int vio_dma_iommu_dma_supported(s
3995 return dma_iommu_ops.dma_supported(dev, mask);
ae4e228f
MT		 3996 }
3997
3998-struct dma_map_ops vio_dma_mapping_ops = {
16454cff 3999+const struct dma_map_ops vio_dma_mapping_ops = {
ae4e228f
MT		 4000 .alloc_coherent = vio_dma_iommu_alloc_coherent,
4001 .free_coherent = vio_dma_iommu_free_coherent,
4002 .map_sg = vio_dma_iommu_map_sg,
4003 .unmap_sg = vio_dma_iommu_unmap_sg,
4004+ .dma_supported = dma_iommu_dma_supported,
4005 .map_page = vio_dma_iommu_map_page,
4006 .unmap_page = vio_dma_iommu_unmap_page,
16454cff 4007 .dma_supported = vio_dma_iommu_dma_supported,
66a7e928
MT		 4008diff -urNp linux-2.6.39/arch/powerpc/lib/usercopy_64.c linux-2.6.39/arch/powerpc/lib/usercopy_64.c
4009--- linux-2.6.39/arch/powerpc/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
4010+++ linux-2.6.39/arch/powerpc/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 4011@@ -9,22 +9,6 @@
4012 #include <linux/module.h>
4013 #include <asm/uaccess.h>
4014
4015-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4016-{
4017- if (likely(access_ok(VERIFY_READ, from, n)))
4018- n = __copy_from_user(to, from, n);
4019- else
4020- memset(to, 0, n);
4021- return n;
4022-}
4023-
4024-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4025-{
4026- if (likely(access_ok(VERIFY_WRITE, to, n)))
4027- n = __copy_to_user(to, from, n);
4028- return n;
4029-}
4030-
4031 unsigned long copy_in_user(void __user *to, const void __user *from,
4032 unsigned long n)
4033 {
4034@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
4035 return n;
4036 }
4037
4038-EXPORT_SYMBOL(copy_from_user);
4039-EXPORT_SYMBOL(copy_to_user);
4040 EXPORT_SYMBOL(copy_in_user);
4041
66a7e928
MT		 4042diff -urNp linux-2.6.39/arch/powerpc/mm/fault.c linux-2.6.39/arch/powerpc/mm/fault.c
4043--- linux-2.6.39/arch/powerpc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
4044+++ linux-2.6.39/arch/powerpc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 4045@@ -31,6 +31,10 @@
58c5fc13 4046 #include <linux/kdebug.h>
ae4e228f 4047 #include <linux/perf_event.h>
bc901d79 4048 #include <linux/magic.h>
58c5fc13
MT		 4049+#include <linux/slab.h>
4050+#include <linux/pagemap.h>
4051+#include <linux/compiler.h>
4052+#include <linux/unistd.h>
4053
4054 #include <asm/firmware.h>
4055 #include <asm/page.h>
bc901d79 4056@@ -42,6 +46,7 @@
58c5fc13
MT		 4057 #include <asm/tlbflush.h>
4058 #include <asm/siginfo.h>
ae4e228f 4059 #include <mm/mmu_decl.h>
58c5fc13
MT		 4060+#include <asm/ptrace.h>
4061
58c5fc13 4062 #ifdef CONFIG_KPROBES
ae4e228f 4063 static inline int notify_page_fault(struct pt_regs *regs)
bc901d79 4064@@ -65,6 +70,33 @@ static inline int notify_page_fault(stru
58c5fc13
MT		 4065 }
4066 #endif
4067
4068+#ifdef CONFIG_PAX_PAGEEXEC
4069+/*
4070+ * PaX: decide what to do with offenders (regs->nip = fault address)
4071+ *
4072+ * returns 1 when task should be killed
4073+ */
4074+static int pax_handle_fetch_fault(struct pt_regs *regs)
4075+{
4076+ return 1;
4077+}
4078+
4079+void pax_report_insns(void *pc, void *sp)
4080+{
4081+ unsigned long i;
4082+
4083+ printk(KERN_ERR "PAX: bytes at PC: ");
4084+ for (i = 0; i < 5; i++) {
4085+ unsigned int c;
ae4e228f 4086+ if (get_user(c, (unsigned int __user *)pc+i))
58c5fc13
MT		 4087+ printk(KERN_CONT "???????? ");
4088+ else
4089+ printk(KERN_CONT "%08x ", c);
4090+ }
4091+ printk("\n");
4092+}
4093+#endif
4094+
4095 /*
4096 * Check whether the instruction at regs->nip is a store using
4097 * an update addressing form which will update r1.
bc901d79 4098@@ -135,7 +167,7 @@ int __kprobes do_page_fault(struct pt_re
58c5fc13
MT		 4099 * indicate errors in DSISR but can validly be set in SRR1.
4100 */
4101 if (trap == 0x400)
4102- error_code &= 0x48200000;
4103+ error_code &= 0x58200000;
4104 else
4105 is_write = error_code & DSISR_ISSTORE;
4106 #else
bc901d79 4107@@ -258,7 +290,7 @@ good_area:
58c5fc13
MT		 4108 * "undefined". Of those that can be set, this is the only
4109 * one which seems bad.
4110 */
4111- if (error_code & 0x10000000)
4112+ if (error_code & DSISR_GUARDED)
4113 /* Guarded storage error. */
4114 goto bad_area;
4115 #endif /* CONFIG_8xx */
bc901d79 4116@@ -273,7 +305,7 @@ good_area:
58c5fc13
MT		 4117 * processors use the same I/D cache coherency mechanism
4118 * as embedded.
4119 */
4120- if (error_code & DSISR_PROTFAULT)
4121+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
4122 goto bad_area;
4123 #endif /* CONFIG_PPC_STD_MMU */
4124
bc901d79 4125@@ -342,6 +374,23 @@ bad_area:
58c5fc13
MT		 4126 bad_area_nosemaphore:
4127 /* User mode accesses cause a SIGSEGV */
4128 if (user_mode(regs)) {
4129+
4130+#ifdef CONFIG_PAX_PAGEEXEC
4131+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4132+#ifdef CONFIG_PPC_STD_MMU
4133+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
4134+#else
4135+ if (is_exec && regs->nip == address) {
4136+#endif
4137+ switch (pax_handle_fetch_fault(regs)) {
4138+ }
4139+
4140+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
4141+ do_group_exit(SIGKILL);
4142+ }
4143+ }
4144+#endif
4145+
4146 _exception(SIGSEGV, regs, code, address);
4147 return 0;
4148 }
66a7e928
MT		 4149diff -urNp linux-2.6.39/arch/powerpc/mm/mmap_64.c linux-2.6.39/arch/powerpc/mm/mmap_64.c
4150--- linux-2.6.39/arch/powerpc/mm/mmap_64.c 2011-05-19 00:06:34.000000000 -0400
4151+++ linux-2.6.39/arch/powerpc/mm/mmap_64.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 4152@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
4153 */
4154 if (mmap_is_legacy()) {
4155 mm->mmap_base = TASK_UNMAPPED_BASE;
4156+
4157+#ifdef CONFIG_PAX_RANDMMAP
4158+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4159+ mm->mmap_base += mm->delta_mmap;
4160+#endif
4161+
4162 mm->get_unmapped_area = arch_get_unmapped_area;
4163 mm->unmap_area = arch_unmap_area;
4164 } else {
4165 mm->mmap_base = mmap_base();
4166+
4167+#ifdef CONFIG_PAX_RANDMMAP
4168+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4169+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4170+#endif
4171+
4172 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4173 mm->unmap_area = arch_unmap_area_topdown;
4174 }
66a7e928
MT		 4175diff -urNp linux-2.6.39/arch/powerpc/mm/slice.c linux-2.6.39/arch/powerpc/mm/slice.c
4176--- linux-2.6.39/arch/powerpc/mm/slice.c 2011-05-19 00:06:34.000000000 -0400
4177+++ linux-2.6.39/arch/powerpc/mm/slice.c 2011-05-22 19:36:30.000000000 -0400
6892158b 4178@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
57199397
MT		 4179 if ((mm->task_size - len) < addr)
4180 return 0;
4181 vma = find_vma(mm, addr);
4182- return (!vma || (addr + len) <= vma->vm_start);
4183+ return check_heap_stack_gap(vma, addr, len);
4184 }
4185
6892158b
MT		 4186 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
4187@@ -256,7 +256,7 @@ full_search:
57199397
MT		 4188 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
4189 continue;
4190 }
4191- if (!vma || addr + len <= vma->vm_start) {
4192+ if (check_heap_stack_gap(vma, addr, len)) {
4193 /*
4194 * Remember the place where we stopped the search:
4195 */
16454cff
MT		 4196@@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
4197 }
4198 }
4199
4200- addr = mm->mmap_base;
4201- while (addr > len) {
4202+ if (mm->mmap_base < len)
4203+ addr = -ENOMEM;
4204+ else
4205+ addr = mm->mmap_base - len;
4206+
4207+ while (!IS_ERR_VALUE(addr)) {
4208 /* Go down by chunk size */
4209- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
4210+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
4211
4212 /* Check for hit with different page size */
4213 mask = slice_range_to_mask(addr, len);
4214@@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
57199397
MT		 4215 * return with success:
4216 */
4217 vma = find_vma(mm, addr);
4218- if (!vma || (addr + len) <= vma->vm_start) {
4219+ if (check_heap_stack_gap(vma, addr, len)) {
4220 /* remember the address as a hint for next time */
4221 if (use_cache)
4222 mm->free_area_cache = addr;
16454cff
MT		 4223@@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
4224 mm->cached_hole_size = vma->vm_start - addr;
4225
4226 /* try just below the current vma->vm_start */
4227- addr = vma->vm_start;
4228+ addr = skip_heap_stack_gap(vma, len);
4229 }
4230
4231 /*
4232@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
58c5fc13
MT		 4233 if (fixed && addr > (mm->task_size - len))
4234 return -EINVAL;
4235
4236+#ifdef CONFIG_PAX_RANDMMAP
4237+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
4238+ addr = 0;
4239+#endif
4240+
4241 /* If hint, make sure it matches our alignment restrictions */
4242 if (!fixed && addr) {
4243 addr = _ALIGN_UP(addr, 1ul << pshift);
66a7e928
MT		 4244diff -urNp linux-2.6.39/arch/powerpc/platforms/52xx/efika.c linux-2.6.39/arch/powerpc/platforms/52xx/efika.c
4245--- linux-2.6.39/arch/powerpc/platforms/52xx/efika.c 2011-05-19 00:06:34.000000000 -0400
4246+++ linux-2.6.39/arch/powerpc/platforms/52xx/efika.c 2011-05-22 19:36:30.000000000 -0400
4247@@ -60,7 +60,7 @@ static int rtas_write_config(struct pci_
4248 return rval ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
4249 }
4250
4251-static struct pci_ops rtas_pci_ops = {
4252+static const struct pci_ops rtas_pci_ops = {
4253 .read = rtas_read_config,
4254 .write = rtas_write_config,
4255 };
4256diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c
4257--- linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-19 00:06:34.000000000 -0400
4258+++ linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-22 19:36:30.000000000 -0400
4259@@ -234,7 +234,7 @@ static int celleb_fake_pci_write_config(
4260 return PCIBIOS_SUCCESSFUL;
4261 }
4262
4263-static struct pci_ops celleb_fake_pci_ops = {
4264+static const struct pci_ops celleb_fake_pci_ops = {
4265 .read = celleb_fake_pci_read_config,
4266 .write = celleb_fake_pci_write_config,
4267 };
4268diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c
4269--- linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-19 00:06:34.000000000 -0400
4270+++ linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-22 19:36:30.000000000 -0400
4271@@ -245,7 +245,7 @@ static int celleb_epci_write_config(stru
4272 return celleb_epci_check_abort(hose, addr);
4273 }
4274
4275-struct pci_ops celleb_epci_ops = {
4276+const struct pci_ops celleb_epci_ops = {
4277 .read = celleb_epci_read_config,
4278 .write = celleb_epci_write_config,
4279 };
4280diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c
4281--- linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-19 00:06:34.000000000 -0400
4282+++ linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-22 19:36:30.000000000 -0400
4283@@ -399,7 +399,7 @@ static int scc_pciex_write_config(struct
4284 return PCIBIOS_SUCCESSFUL;
4285 }
4286
4287-static struct pci_ops scc_pciex_pci_ops = {
4288+static const struct pci_ops scc_pciex_pci_ops = {
4289 scc_pciex_read_config,
4290 scc_pciex_write_config,
4291 };
4292diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/iommu.c linux-2.6.39/arch/powerpc/platforms/cell/iommu.c
4293--- linux-2.6.39/arch/powerpc/platforms/cell/iommu.c 2011-05-19 00:06:34.000000000 -0400
4294+++ linux-2.6.39/arch/powerpc/platforms/cell/iommu.c 2011-05-22 19:36:30.000000000 -0400
57199397 4295@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
ae4e228f
MT		 4296
4297 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
4298
4299-struct dma_map_ops dma_iommu_fixed_ops = {
4300+const struct dma_map_ops dma_iommu_fixed_ops = {
4301 .alloc_coherent = dma_fixed_alloc_coherent,
4302 .free_coherent = dma_fixed_free_coherent,
4303 .map_sg = dma_fixed_map_sg,
66a7e928
MT		 4304diff -urNp linux-2.6.39/arch/powerpc/platforms/chrp/pci.c linux-2.6.39/arch/powerpc/platforms/chrp/pci.c
4305--- linux-2.6.39/arch/powerpc/platforms/chrp/pci.c 2011-05-19 00:06:34.000000000 -0400
4306+++ linux-2.6.39/arch/powerpc/platforms/chrp/pci.c 2011-05-22 19:36:30.000000000 -0400
4307@@ -84,7 +84,7 @@ int gg2_write_config(struct pci_bus *bus
4308 return PCIBIOS_SUCCESSFUL;
4309 }
4310
4311-static struct pci_ops gg2_pci_ops =
4312+static const struct pci_ops gg2_pci_ops =
4313 {
4314 .read = gg2_read_config,
4315 .write = gg2_write_config,
4316@@ -122,7 +122,7 @@ int rtas_write_config(struct pci_bus *bu
4317 return rval? PCIBIOS_DEVICE_NOT_FOUND: PCIBIOS_SUCCESSFUL;
4318 }
4319
4320-static struct pci_ops rtas_pci_ops =
4321+static const struct pci_ops rtas_pci_ops =
4322 {
4323 .read = rtas_read_config,
4324 .write = rtas_write_config,
4325diff -urNp linux-2.6.39/arch/powerpc/platforms/iseries/pci.c linux-2.6.39/arch/powerpc/platforms/iseries/pci.c
4326--- linux-2.6.39/arch/powerpc/platforms/iseries/pci.c 2011-05-19 00:06:34.000000000 -0400
4327+++ linux-2.6.39/arch/powerpc/platforms/iseries/pci.c 2011-05-22 19:36:30.000000000 -0400
4328@@ -533,7 +533,7 @@ static int iSeries_pci_write_config(stru
4329 return 0;
4330 }
4331
4332-static struct pci_ops iSeries_pci_ops = {
4333+static const struct pci_ops iSeries_pci_ops = {
4334 .read = iSeries_pci_read_config,
4335 .write = iSeries_pci_write_config
4336 };
4337diff -urNp linux-2.6.39/arch/powerpc/platforms/maple/pci.c linux-2.6.39/arch/powerpc/platforms/maple/pci.c
4338--- linux-2.6.39/arch/powerpc/platforms/maple/pci.c 2011-05-19 00:06:34.000000000 -0400
4339+++ linux-2.6.39/arch/powerpc/platforms/maple/pci.c 2011-05-22 19:36:30.000000000 -0400
4340@@ -180,7 +180,7 @@ static int u3_agp_write_config(struct pc
4341 return PCIBIOS_SUCCESSFUL;
4342 }
4343
4344-static struct pci_ops u3_agp_pci_ops =
4345+static const struct pci_ops u3_agp_pci_ops =
4346 {
4347 .read = u3_agp_read_config,
4348 .write = u3_agp_write_config,
4349@@ -276,7 +276,7 @@ static int u3_ht_write_config(struct pci
4350 return PCIBIOS_SUCCESSFUL;
4351 }
4352
4353-static struct pci_ops u3_ht_pci_ops =
4354+static const struct pci_ops u3_ht_pci_ops =
4355 {
4356 .read = u3_ht_read_config,
4357 .write = u3_ht_write_config,
4358@@ -381,7 +381,7 @@ static int u4_pcie_write_config(struct p
4359 return PCIBIOS_SUCCESSFUL;
4360 }
4361
4362-static struct pci_ops u4_pcie_pci_ops =
4363+static const struct pci_ops u4_pcie_pci_ops =
4364 {
4365 .read = u4_pcie_read_config,
4366 .write = u4_pcie_write_config,
4367diff -urNp linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c
4368--- linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c 2011-05-19 00:06:34.000000000 -0400
4369+++ linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c 2011-05-22 19:36:30.000000000 -0400
4370@@ -176,7 +176,7 @@ static int pa_pxp_write_config(struct pc
4371 return PCIBIOS_SUCCESSFUL;
4372 }
4373
4374-static struct pci_ops pa_pxp_ops = {
4375+static const struct pci_ops pa_pxp_ops = {
4376 .read = pa_pxp_read_config,
4377 .write = pa_pxp_write_config,
4378 };
4379diff -urNp linux-2.6.39/arch/powerpc/platforms/powermac/pci.c linux-2.6.39/arch/powerpc/platforms/powermac/pci.c
4380--- linux-2.6.39/arch/powerpc/platforms/powermac/pci.c 2011-05-19 00:06:34.000000000 -0400
4381+++ linux-2.6.39/arch/powerpc/platforms/powermac/pci.c 2011-05-22 19:36:30.000000000 -0400
4382@@ -218,7 +218,7 @@ static int macrisc_write_config(struct p
4383 return PCIBIOS_SUCCESSFUL;
4384 }
4385
4386-static struct pci_ops macrisc_pci_ops =
4387+static const struct pci_ops macrisc_pci_ops =
4388 {
4389 .read = macrisc_read_config,
4390 .write = macrisc_write_config,
4391@@ -273,7 +273,7 @@ chaos_write_config(struct pci_bus *bus,
4392 return macrisc_write_config(bus, devfn, offset, len, val);
4393 }
4394
4395-static struct pci_ops chaos_pci_ops =
4396+static const struct pci_ops chaos_pci_ops =
4397 {
4398 .read = chaos_read_config,
4399 .write = chaos_write_config,
4400diff -urNp linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c
4401--- linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c 2011-05-19 00:06:34.000000000 -0400
4402+++ linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 4403@@ -695,7 +695,7 @@ static int ps3_dma_supported(struct devi
ae4e228f
MT		 4404 return mask >= DMA_BIT_MASK(32);
4405 }
4406
4407-static struct dma_map_ops ps3_sb_dma_ops = {
4408+static const struct dma_map_ops ps3_sb_dma_ops = {
4409 .alloc_coherent = ps3_alloc_coherent,
4410 .free_coherent = ps3_free_coherent,
4411 .map_sg = ps3_sb_map_sg,
df50ba0c 4412@@ -705,7 +705,7 @@ static struct dma_map_ops ps3_sb_dma_ops
ae4e228f 4413 .unmap_page = ps3_unmap_page,
58c5fc13
MT		 4414 };
4415
ae4e228f
MT		 4416-static struct dma_map_ops ps3_ioc0_dma_ops = {
4417+static const struct dma_map_ops ps3_ioc0_dma_ops = {
4418 .alloc_coherent = ps3_alloc_coherent,
4419 .free_coherent = ps3_free_coherent,
4420 .map_sg = ps3_ioc0_map_sg,
66a7e928
MT		 4421diff -urNp linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c
4422--- linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c 2011-05-19 00:06:34.000000000 -0400
4423+++ linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c 2011-05-22 19:36:30.000000000 -0400
4424@@ -573,7 +573,7 @@ static int mpc83xx_pcie_write_config(str
4425 return PCIBIOS_SUCCESSFUL;
4426 }
4427
4428-static struct pci_ops mpc83xx_pcie_ops = {
4429+static const struct pci_ops mpc83xx_pcie_ops = {
4430 .read = mpc83xx_pcie_read_config,
4431 .write = mpc83xx_pcie_write_config,
4432 };
4433diff -urNp linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c
4434--- linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
4435+++ linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
4436@@ -148,7 +148,7 @@ indirect_write_config(struct pci_bus *bu
4437 return PCIBIOS_SUCCESSFUL;
4438 }
4439
4440-static struct pci_ops indirect_pci_ops =
4441+static const struct pci_ops indirect_pci_ops =
4442 {
4443 .read = indirect_read_config,
4444 .write = indirect_write_config,
4445diff -urNp linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c
4446--- linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-19 00:06:34.000000000 -0400
4447+++ linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-22 19:36:30.000000000 -0400
4448@@ -1514,7 +1514,7 @@ static int ppc4xx_pciex_write_config(str
4449 return PCIBIOS_SUCCESSFUL;
58c5fc13
MT		 4450 }
4451
66a7e928
MT		 4452-static struct pci_ops ppc4xx_pciex_pci_ops =
4453+static const struct pci_ops ppc4xx_pciex_pci_ops =
4454 {
4455 .read = ppc4xx_pciex_read_config,
4456 .write = ppc4xx_pciex_write_config,
4457diff -urNp linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c
4458--- linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c 2011-05-19 00:06:34.000000000 -0400
4459+++ linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c 2011-05-22 19:36:30.000000000 -0400
4460@@ -190,7 +190,7 @@ void tsi108_clear_pci_cfg_error(void)
4461 tsi108_clear_pci_error(tsi108_pci_cfg_phys);
4462 }
4463
4464-static struct pci_ops tsi108_direct_pci_ops = {
4465+static const struct pci_ops tsi108_direct_pci_ops = {
4466 .read = tsi108_direct_read_config,
4467 .write = tsi108_direct_write_config,
58c5fc13 4468 };
66a7e928
MT		 4469diff -urNp linux-2.6.39/arch/s390/include/asm/elf.h linux-2.6.39/arch/s390/include/asm/elf.h
4470--- linux-2.6.39/arch/s390/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
4471+++ linux-2.6.39/arch/s390/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 4472@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
4473 the loader. We need to make sure that it is out of the way of the program
ae4e228f 4474 that it will "exec", and that there is sufficient room for the brk. */
58c5fc13 4475
16454cff
MT		 4476-extern unsigned long randomize_et_dyn(unsigned long base);
4477-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
4478+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
4479+
ae4e228f
MT		 4480+#ifdef CONFIG_PAX_ASLR
4481+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
58c5fc13 4482+
ae4e228f
MT		 4483+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4484+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4485+#endif
16454cff 4486
ae4e228f
MT		 4487 /* This yields a mask that user programs can use to figure out what
4488 instruction set this CPU supports. */
16454cff
MT		 4489@@ -222,7 +228,4 @@ struct linux_binprm;
4490 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
4491 int arch_setup_additional_pages(struct linux_binprm *, int);
4492
4493-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
4494-#define arch_randomize_brk arch_randomize_brk
4495-
4496 #endif
66a7e928
MT		 4497diff -urNp linux-2.6.39/arch/s390/include/asm/system.h linux-2.6.39/arch/s390/include/asm/system.h
4498--- linux-2.6.39/arch/s390/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4499+++ linux-2.6.39/arch/s390/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4500@@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
16454cff
MT		 4501 extern void (*_machine_halt)(void);
4502 extern void (*_machine_power_off)(void);
58c5fc13 4503
16454cff
MT		 4504-extern unsigned long arch_align_stack(unsigned long sp);
4505+#define arch_align_stack(x) ((x) & ~0xfUL)
4506
4507 static inline int tprot(unsigned long addr)
4508 {
66a7e928
MT		 4509diff -urNp linux-2.6.39/arch/s390/include/asm/uaccess.h linux-2.6.39/arch/s390/include/asm/uaccess.h
4510--- linux-2.6.39/arch/s390/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
4511+++ linux-2.6.39/arch/s390/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 4512@@ -234,6 +234,10 @@ static inline unsigned long __must_check
58c5fc13
MT		 4513 copy_to_user(void __user *to, const void *from, unsigned long n)
4514 {
4515 might_fault();
4516+
4517+ if ((long)n < 0)
4518+ return n;
4519+
4520 if (access_ok(VERIFY_WRITE, to, n))
4521 n = __copy_to_user(to, from, n);
4522 return n;
ae4e228f 4523@@ -259,6 +263,9 @@ copy_to_user(void __user *to, const void
58c5fc13
MT		 4524 static inline unsigned long __must_check
4525 __copy_from_user(void *to, const void __user *from, unsigned long n)
4526 {
4527+ if ((long)n < 0)
4528+ return n;
4529+
4530 if (__builtin_constant_p(n) && (n <= 256))
4531 return uaccess.copy_from_user_small(n, from, to);
4532 else
df50ba0c
MT		 4533@@ -293,6 +300,10 @@ copy_from_user(void *to, const void __us
4534 unsigned int sz = __compiletime_object_size(to);
4535
58c5fc13
MT		 4536 might_fault();
4537+
4538+ if ((long)n < 0)
4539+ return n;
4540+
df50ba0c
MT		 4541 if (unlikely(sz != -1 && sz < n)) {
4542 copy_from_user_overflow();
4543 return n;
66a7e928
MT		 4544diff -urNp linux-2.6.39/arch/s390/Kconfig linux-2.6.39/arch/s390/Kconfig
4545--- linux-2.6.39/arch/s390/Kconfig 2011-05-19 00:06:34.000000000 -0400
4546+++ linux-2.6.39/arch/s390/Kconfig 2011-05-22 19:36:30.000000000 -0400
4547@@ -234,11 +234,9 @@ config S390_EXEC_PROTECT
16454cff 4548 prompt "Data execute protection"
57199397
MT		 4549 help
4550 This option allows to enable a buffer overflow protection for user
4551- space programs and it also selects the addressing mode option above.
4552- The kernel parameter noexec=on will enable this feature and also
4553- switch the addressing modes, default is disabled. Enabling this (via
bc901d79
MT		 4554- kernel parameter) on machines earlier than IBM System z9 this will
4555- reduce system performance.
57199397 4556+ space programs.
bc901d79 4557+ Enabling this (via kernel parameter) on machines earlier than IBM
16454cff 4558+ System z9 this will reduce system performance.
57199397
MT		 4559
4560 comment "Code generation options"
4561
66a7e928
MT		 4562diff -urNp linux-2.6.39/arch/s390/kernel/module.c linux-2.6.39/arch/s390/kernel/module.c
4563--- linux-2.6.39/arch/s390/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
4564+++ linux-2.6.39/arch/s390/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
57199397 4565@@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
58c5fc13
MT		 4566
4567 /* Increase core size by size of got & plt and set start
4568 offsets for got and plt. */
4569- me->core_size = ALIGN(me->core_size, 4);
4570- me->arch.got_offset = me->core_size;
4571- me->core_size += me->arch.got_size;
4572- me->arch.plt_offset = me->core_size;
4573- me->core_size += me->arch.plt_size;
4574+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
4575+ me->arch.got_offset = me->core_size_rw;
4576+ me->core_size_rw += me->arch.got_size;
4577+ me->arch.plt_offset = me->core_size_rx;
4578+ me->core_size_rx += me->arch.plt_size;
4579 return 0;
4580 }
4581
57199397 4582@@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
58c5fc13
MT		 4583 if (info->got_initialized == 0) {
4584 Elf_Addr *gotent;
4585
4586- gotent = me->module_core + me->arch.got_offset +
4587+ gotent = me->module_core_rw + me->arch.got_offset +
4588 info->got_offset;
4589 *gotent = val;
4590 info->got_initialized = 1;
57199397 4591@@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
58c5fc13
MT		 4592 else if (r_type == R_390_GOTENT ||
4593 r_type == R_390_GOTPLTENT)
4594 *(unsigned int *) loc =
4595- (val + (Elf_Addr) me->module_core - loc) >> 1;
4596+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
4597 else if (r_type == R_390_GOT64 ||
4598 r_type == R_390_GOTPLT64)
4599 *(unsigned long *) loc = val;
57199397 4600@@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
58c5fc13
MT		 4601 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
4602 if (info->plt_initialized == 0) {
4603 unsigned int *ip;
4604- ip = me->module_core + me->arch.plt_offset +
4605+ ip = me->module_core_rx + me->arch.plt_offset +
4606 info->plt_offset;
4607 #ifndef CONFIG_64BIT
4608 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
57199397 4609@@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
58c5fc13
MT		 4610 val - loc + 0xffffUL < 0x1ffffeUL) ||
4611 (r_type == R_390_PLT32DBL &&
4612 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
4613- val = (Elf_Addr) me->module_core +
4614+ val = (Elf_Addr) me->module_core_rx +
4615 me->arch.plt_offset +
4616 info->plt_offset;
4617 val += rela->r_addend - loc;
57199397 4618@@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
58c5fc13
MT		 4619 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
4620 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
4621 val = val + rela->r_addend -
4622- ((Elf_Addr) me->module_core + me->arch.got_offset);
4623+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
4624 if (r_type == R_390_GOTOFF16)
4625 *(unsigned short *) loc = val;
4626 else if (r_type == R_390_GOTOFF32)
57199397 4627@@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
58c5fc13
MT		 4628 break;
4629 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
4630 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
4631- val = (Elf_Addr) me->module_core + me->arch.got_offset +
4632+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
4633 rela->r_addend - loc;
4634 if (r_type == R_390_GOTPC)
4635 *(unsigned int *) loc = val;
66a7e928
MT		 4636diff -urNp linux-2.6.39/arch/s390/kernel/process.c linux-2.6.39/arch/s390/kernel/process.c
4637--- linux-2.6.39/arch/s390/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4638+++ linux-2.6.39/arch/s390/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 4639@@ -334,39 +334,3 @@ unsigned long get_wchan(struct task_stru
4640 }
4641 return 0;
4642 }
4643-
4644-unsigned long arch_align_stack(unsigned long sp)
4645-{
4646- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4647- sp -= get_random_int() & ~PAGE_MASK;
4648- return sp & ~0xf;
4649-}
4650-
4651-static inline unsigned long brk_rnd(void)
4652-{
4653- /* 8MB for 32bit, 1GB for 64bit */
4654- if (is_32bit_task())
4655- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
4656- else
4657- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
4658-}
4659-
4660-unsigned long arch_randomize_brk(struct mm_struct *mm)
4661-{
4662- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
4663-
4664- if (ret < mm->brk)
4665- return mm->brk;
4666- return ret;
4667-}
4668-
4669-unsigned long randomize_et_dyn(unsigned long base)
4670-{
4671- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4672-
4673- if (!(current->flags & PF_RANDOMIZE))
4674- return base;
4675- if (ret < base)
4676- return base;
4677- return ret;
4678-}
66a7e928
MT		 4679diff -urNp linux-2.6.39/arch/s390/kernel/setup.c linux-2.6.39/arch/s390/kernel/setup.c
4680--- linux-2.6.39/arch/s390/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
4681+++ linux-2.6.39/arch/s390/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
4682@@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
ae4e228f
MT		 4683 }
4684 early_param("mem", early_parse_mem);
58c5fc13 4685
ae4e228f
MT		 4686-unsigned int user_mode = HOME_SPACE_MODE;
4687+unsigned int user_mode = SECONDARY_SPACE_MODE;
4688 EXPORT_SYMBOL_GPL(user_mode);
4689
4690 static int set_amode_and_uaccess(unsigned long user_amode,
66a7e928 4691@@ -300,17 +300,6 @@ static int set_amode_and_uaccess(unsigne
ae4e228f
MT		 4692 }
4693 }
4694
4695-/*
4696- * Switch kernel/user addressing modes?
4697- */
4698-static int __init early_parse_switch_amode(char *p)
4699-{
4700- if (user_mode != SECONDARY_SPACE_MODE)
4701- user_mode = PRIMARY_SPACE_MODE;
4702- return 0;
4703-}
4704-early_param("switch_amode", early_parse_switch_amode);
4705-
4706 static int __init early_parse_user_mode(char *p)
4707 {
4708 if (p && strcmp(p, "primary") == 0)
66a7e928 4709@@ -327,20 +316,6 @@ static int __init early_parse_user_mode(
ae4e228f
MT		 4710 }
4711 early_param("user_mode", early_parse_user_mode);
4712
4713-#ifdef CONFIG_S390_EXEC_PROTECT
4714-/*
4715- * Enable execute protection?
4716- */
4717-static int __init early_parse_noexec(char *p)
4718-{
4719- if (!strncmp(p, "off", 3))
4720- return 0;
4721- user_mode = SECONDARY_SPACE_MODE;
4722- return 0;
4723-}
4724-early_param("noexec", early_parse_noexec);
4725-#endif /* CONFIG_S390_EXEC_PROTECT */
4726-
4727 static void setup_addressing_mode(void)
4728 {
4729 if (user_mode == SECONDARY_SPACE_MODE) {
66a7e928
MT		 4730diff -urNp linux-2.6.39/arch/s390/mm/maccess.c linux-2.6.39/arch/s390/mm/maccess.c
4731--- linux-2.6.39/arch/s390/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
4732+++ linux-2.6.39/arch/s390/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 4733@@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void
4734 return rc ? rc : count;
4735 }
4736
4737-long probe_kernel_write(void *dst, void *src, size_t size)
4738+long probe_kernel_write(void *dst, const void *src, size_t size)
4739 {
4740 long copied = 0;
4741
66a7e928
MT		 4742diff -urNp linux-2.6.39/arch/s390/mm/mmap.c linux-2.6.39/arch/s390/mm/mmap.c
4743--- linux-2.6.39/arch/s390/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4744+++ linux-2.6.39/arch/s390/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
16454cff 4745@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
ae4e228f
MT		 4746 */
4747 if (mmap_is_legacy()) {
4748 mm->mmap_base = TASK_UNMAPPED_BASE;
4749+
4750+#ifdef CONFIG_PAX_RANDMMAP
4751+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4752+ mm->mmap_base += mm->delta_mmap;
4753+#endif
4754+
4755 mm->get_unmapped_area = arch_get_unmapped_area;
4756 mm->unmap_area = arch_unmap_area;
4757 } else {
4758 mm->mmap_base = mmap_base();
4759+
4760+#ifdef CONFIG_PAX_RANDMMAP
4761+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4762+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4763+#endif
4764+
4765 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4766 mm->unmap_area = arch_unmap_area_topdown;
4767 }
16454cff 4768@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
ae4e228f
MT		 4769 */
4770 if (mmap_is_legacy()) {
4771 mm->mmap_base = TASK_UNMAPPED_BASE;
4772+
4773+#ifdef CONFIG_PAX_RANDMMAP
4774+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4775+ mm->mmap_base += mm->delta_mmap;
4776+#endif
4777+
4778 mm->get_unmapped_area = s390_get_unmapped_area;
4779 mm->unmap_area = arch_unmap_area;
4780 } else {
4781 mm->mmap_base = mmap_base();
4782+
4783+#ifdef CONFIG_PAX_RANDMMAP
4784+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4785+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4786+#endif
4787+
4788 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
4789 mm->unmap_area = arch_unmap_area_topdown;
4790 }
66a7e928
MT		 4791diff -urNp linux-2.6.39/arch/score/include/asm/system.h linux-2.6.39/arch/score/include/asm/system.h
4792--- linux-2.6.39/arch/score/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4793+++ linux-2.6.39/arch/score/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 4794@@ -17,7 +17,7 @@ do { \
4795 #define finish_arch_switch(prev) do {} while (0)
4796
4797 typedef void (*vi_handler_t)(void);
4798-extern unsigned long arch_align_stack(unsigned long sp);
4799+#define arch_align_stack(x) (x)
4800
4801 #define mb() barrier()
4802 #define rmb() barrier()
66a7e928
MT		 4803diff -urNp linux-2.6.39/arch/score/kernel/process.c linux-2.6.39/arch/score/kernel/process.c
4804--- linux-2.6.39/arch/score/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4805+++ linux-2.6.39/arch/score/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 4806@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
4807
4808 return task_pt_regs(task)->cp0_epc;
4809 }
4810-
4811-unsigned long arch_align_stack(unsigned long sp)
4812-{
4813- return sp;
4814-}
66a7e928
MT		 4815diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c
4816--- linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-19 00:06:34.000000000 -0400
4817+++ linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-22 19:36:30.000000000 -0400
4818@@ -76,7 +76,7 @@ static int gapspci_write(struct pci_bus
4819 return PCIBIOS_SUCCESSFUL;
4820 }
4821
4822-struct pci_ops gapspci_pci_ops = {
4823+const struct pci_ops gapspci_pci_ops = {
4824 .read = gapspci_read,
4825 .write = gapspci_write,
4826 };
4827diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c
4828--- linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c 2011-05-19 00:06:34.000000000 -0400
4829+++ linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c 2011-05-22 19:36:30.000000000 -0400
4830@@ -96,7 +96,7 @@ static int sh4_pci_write(struct pci_bus
4831 return PCIBIOS_SUCCESSFUL;
4832 }
4833
4834-struct pci_ops sh4_pci_ops = {
4835+const struct pci_ops sh4_pci_ops = {
4836 .read = sh4_pci_read,
4837 .write = sh4_pci_write,
4838 };
4839diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c
4840--- linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c 2011-05-19 00:06:34.000000000 -0400
4841+++ linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c 2011-05-22 19:36:30.000000000 -0400
4842@@ -62,7 +62,7 @@ static int sh5pci_write(struct pci_bus *
4843 return PCIBIOS_SUCCESSFUL;
4844 }
4845
4846-struct pci_ops sh5_pci_ops = {
4847+const struct pci_ops sh5_pci_ops = {
4848 .read = sh5pci_read,
4849 .write = sh5pci_write,
4850 };
4851diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c
4852--- linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4853+++ linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4854@@ -165,7 +165,7 @@ out:
4855 return ret;
4856 }
4857
4858-struct pci_ops sh7786_pci_ops = {
4859+const struct pci_ops sh7786_pci_ops = {
4860 .read = sh7786_pcie_read,
4861 .write = sh7786_pcie_write,
4862 };
4863diff -urNp linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c
4864--- linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4865+++ linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4866@@ -109,7 +109,7 @@ static struct resource sh7786_pci2_resou
4867 },
4868 };
4869
4870-extern struct pci_ops sh7786_pci_ops;
4871+extern const struct pci_ops sh7786_pci_ops;
4872
4873 #define DEFINE_CONTROLLER(start, idx) \
4874 { \
4875diff -urNp linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h
4876--- linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h 2011-05-19 00:06:34.000000000 -0400
4877+++ linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h 2011-05-22 19:36:30.000000000 -0400
4878@@ -161,7 +161,7 @@
4879 #define SH4_PCIPDR 0x220 /* Port IO Data Register */
4880
4881 /* arch/sh/kernel/drivers/pci/ops-sh4.c */
4882-extern struct pci_ops sh4_pci_ops;
4883+extern const struct pci_ops sh4_pci_ops;
4884 int pci_fixup_pcic(struct pci_channel *chan);
4885
4886 struct sh4_pci_address_space {
4887diff -urNp linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h
4888--- linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h 2011-05-19 00:06:34.000000000 -0400
4889+++ linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h 2011-05-22 19:36:30.000000000 -0400
4890@@ -105,6 +105,6 @@ extern unsigned long pcicr_virt;
4891 #define PCISH5_MEM_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4892 #define PCISH5_IO_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4893
4894-extern struct pci_ops sh5_pci_ops;
4895+extern const struct pci_ops sh5_pci_ops;
4896
4897 #endif /* __PCI_SH5_H */
4898diff -urNp linux-2.6.39/arch/sh/include/asm/dma-mapping.h linux-2.6.39/arch/sh/include/asm/dma-mapping.h
4899--- linux-2.6.39/arch/sh/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
4900+++ linux-2.6.39/arch/sh/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 4901@@ -1,10 +1,10 @@
4902 #ifndef __ASM_SH_DMA_MAPPING_H
4903 #define __ASM_SH_DMA_MAPPING_H
4904
4905-extern struct dma_map_ops *dma_ops;
4906+extern const struct dma_map_ops *dma_ops;
4907 extern void no_iommu_init(void);
4908
4909-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
4910+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
4911 {
4912 return dma_ops;
4913 }
4914@@ -14,7 +14,7 @@ static inline struct dma_map_ops *get_dm
4915
4916 static inline int dma_supported(struct device *dev, u64 mask)
4917 {
4918- struct dma_map_ops *ops = get_dma_ops(dev);
4919+ const struct dma_map_ops *ops = get_dma_ops(dev);
4920
4921 if (ops->dma_supported)
4922 return ops->dma_supported(dev, mask);
4923@@ -24,7 +24,7 @@ static inline int dma_supported(struct d
4924
4925 static inline int dma_set_mask(struct device *dev, u64 mask)
4926 {
4927- struct dma_map_ops *ops = get_dma_ops(dev);
4928+ const struct dma_map_ops *ops = get_dma_ops(dev);
4929
4930 if (!dev->dma_mask || !dma_supported(dev, mask))
4931 return -EIO;
6892158b 4932@@ -44,7 +44,7 @@ void dma_cache_sync(struct device *dev,
ae4e228f
MT		 4933
4934 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
4935 {
4936- struct dma_map_ops *ops = get_dma_ops(dev);
4937+ const struct dma_map_ops *ops = get_dma_ops(dev);
4938
4939 if (ops->mapping_error)
4940 return ops->mapping_error(dev, dma_addr);
6892158b 4941@@ -55,7 +55,7 @@ static inline int dma_mapping_error(stru
ae4e228f
MT		 4942 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
4943 dma_addr_t *dma_handle, gfp_t gfp)
4944 {
4945- struct dma_map_ops *ops = get_dma_ops(dev);
4946+ const struct dma_map_ops *ops = get_dma_ops(dev);
4947 void *memory;
4948
4949 if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
6892158b 4950@@ -72,7 +72,7 @@ static inline void *dma_alloc_coherent(s
ae4e228f
MT		 4951 static inline void dma_free_coherent(struct device *dev, size_t size,
4952 void *vaddr, dma_addr_t dma_handle)
4953 {
4954- struct dma_map_ops *ops = get_dma_ops(dev);
4955+ const struct dma_map_ops *ops = get_dma_ops(dev);
4956
df50ba0c
MT		 4957 if (dma_release_from_coherent(dev, get_order(size), vaddr))
4958 return;
66a7e928
MT		 4959diff -urNp linux-2.6.39/arch/sh/kernel/dma-nommu.c linux-2.6.39/arch/sh/kernel/dma-nommu.c
4960--- linux-2.6.39/arch/sh/kernel/dma-nommu.c 2011-05-19 00:06:34.000000000 -0400
4961+++ linux-2.6.39/arch/sh/kernel/dma-nommu.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 4962@@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device
4963 }
4964 #endif
4965
4966-struct dma_map_ops nommu_dma_ops = {
4967+const struct dma_map_ops nommu_dma_ops = {
4968 .alloc_coherent = dma_generic_alloc_coherent,
4969 .free_coherent = dma_generic_free_coherent,
4970 .map_page = nommu_map_page,
66a7e928
MT		 4971diff -urNp linux-2.6.39/arch/sh/kernel/kgdb.c linux-2.6.39/arch/sh/kernel/kgdb.c
4972--- linux-2.6.39/arch/sh/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
4973+++ linux-2.6.39/arch/sh/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
57199397 4974@@ -319,7 +319,7 @@ void kgdb_arch_exit(void)
df50ba0c 4975 unregister_die_notifier(&kgdb_notifier);
ae4e228f
MT		 4976 }
4977
4978-struct kgdb_arch arch_kgdb_ops = {
4979+const struct kgdb_arch arch_kgdb_ops = {
4980 /* Breakpoint instruction: trapa #0x3c */
4981 #ifdef CONFIG_CPU_LITTLE_ENDIAN
4982 .gdb_bpt_instr = { 0x3c, 0xc3 },
66a7e928
MT		 4983diff -urNp linux-2.6.39/arch/sh/mm/consistent.c linux-2.6.39/arch/sh/mm/consistent.c
4984--- linux-2.6.39/arch/sh/mm/consistent.c 2011-05-19 00:06:34.000000000 -0400
4985+++ linux-2.6.39/arch/sh/mm/consistent.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 4986@@ -22,7 +22,7 @@
ae4e228f
MT		 4987
4988 #define PREALLOC_DMA_DEBUG_ENTRIES 4096
4989
4990-struct dma_map_ops *dma_ops;
4991+const struct dma_map_ops *dma_ops;
4992 EXPORT_SYMBOL(dma_ops);
4993
4994 static int __init dma_init(void)
66a7e928
MT		 4995diff -urNp linux-2.6.39/arch/sh/mm/mmap.c linux-2.6.39/arch/sh/mm/mmap.c
4996--- linux-2.6.39/arch/sh/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4997+++ linux-2.6.39/arch/sh/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 4998@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
4999 addr = PAGE_ALIGN(addr);
5000
5001 vma = find_vma(mm, addr);
5002- if (TASK_SIZE - len >= addr &&
5003- (!vma || addr + len <= vma->vm_start))
5004+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5005 return addr;
5006 }
efbe55a5 5007
57199397
MT		 5008@@ -106,7 +105,7 @@ full_search:
5009 }
5010 return -ENOMEM;
5011 }
5012- if (likely(!vma || addr + len <= vma->vm_start)) {
5013+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5014 /*
5015 * Remember the place where we stopped the search:
5016 */
5017@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
5018 addr = PAGE_ALIGN(addr);
5019
5020 vma = find_vma(mm, addr);
5021- if (TASK_SIZE - len >= addr &&
5022- (!vma || addr + len <= vma->vm_start))
5023+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5024 return addr;
5025 }
5026
5027@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
5028 /* make sure it can fit in the remaining address space */
5029 if (likely(addr > len)) {
5030 vma = find_vma(mm, addr-len);
5031- if (!vma || addr <= vma->vm_start) {
5032+ if (check_heap_stack_gap(vma, addr - len, len)) {
5033 /* remember the address as a hint for next time */
5034 return (mm->free_area_cache = addr-len);
5035 }
16454cff
MT		 5036@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
5037 if (unlikely(mm->mmap_base < len))
5038 goto bottomup;
5039
5040- addr = mm->mmap_base-len;
5041- if (do_colour_align)
5042- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5043+ addr = mm->mmap_base - len;
5044
5045 do {
5046+ if (do_colour_align)
5047+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5048 /*
5049 * Lookup failure means no vma is above this address,
5050 * else if new region fits below vma->vm_start,
57199397
MT		 5051 * return with success:
5052 */
5053 vma = find_vma(mm, addr);
5054- if (likely(!vma || addr+len <= vma->vm_start)) {
5055+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5056 /* remember the address as a hint for next time */
5057 return (mm->free_area_cache = addr);
5058 }
16454cff
MT		 5059@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
5060 mm->cached_hole_size = vma->vm_start - addr;
5061
5062 /* try just below the current vma->vm_start */
5063- addr = vma->vm_start-len;
5064- if (do_colour_align)
5065- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5066- } while (likely(len < vma->vm_start));
5067+ addr = skip_heap_stack_gap(vma, len);
5068+ } while (!IS_ERR_VALUE(addr));
5069
5070 bottomup:
5071 /*
66a7e928
MT		 5072diff -urNp linux-2.6.39/arch/sparc/include/asm/atomic_64.h linux-2.6.39/arch/sparc/include/asm/atomic_64.h
5073--- linux-2.6.39/arch/sparc/include/asm/atomic_64.h 2011-05-19 00:06:34.000000000 -0400
5074+++ linux-2.6.39/arch/sparc/include/asm/atomic_64.h 2011-05-22 19:36:30.000000000 -0400
57199397 5075@@ -14,18 +14,40 @@
58c5fc13
MT		 5076 #define ATOMIC64_INIT(i) { (i) }
5077
57199397 5078 #define atomic_read(v) (*(volatile int *)&(v)->counter)
ae4e228f
MT		 5079+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5080+{
5081+ return v->counter;
5082+}
57199397 5083 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
ae4e228f
MT		 5084+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
5085+{
5086+ return v->counter;
5087+}
58c5fc13
MT		 5088
5089 #define atomic_set(v, i) (((v)->counter) = i)
ae4e228f
MT		 5090+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5091+{
5092+ v->counter = i;
5093+}
58c5fc13 5094 #define atomic64_set(v, i) (((v)->counter) = i)
ae4e228f
MT		 5095+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
5096+{
5097+ v->counter = i;
5098+}
58c5fc13
MT		 5099
5100 extern void atomic_add(int, atomic_t *);
5101+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
57199397
MT		 5102 extern void atomic64_add(long, atomic64_t *);
5103+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
58c5fc13
MT		 5104 extern void atomic_sub(int, atomic_t *);
5105+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
57199397
MT		 5106 extern void atomic64_sub(long, atomic64_t *);
5107+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
58c5fc13
MT		 5108
5109 extern int atomic_add_ret(int, atomic_t *);
57199397
MT		 5110+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
5111 extern long atomic64_add_ret(long, atomic64_t *);
5112+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
ae4e228f 5113 extern int atomic_sub_ret(int, atomic_t *);
57199397 5114 extern long atomic64_sub_ret(long, atomic64_t *);
ae4e228f 5115
6892158b 5116@@ -33,12 +55,24 @@ extern long atomic64_sub_ret(long, atomi
57199397 5117 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
ae4e228f
MT		 5118
5119 #define atomic_inc_return(v) atomic_add_ret(1, v)
57199397
MT		 5120+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5121+{
5122+ return atomic_add_ret_unchecked(1, v);
5123+}
ae4e228f 5124 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
57199397
MT		 5125+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
5126+{
5127+ return atomic64_add_ret_unchecked(1, v);
5128+}
ae4e228f
MT		 5129
5130 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
5131 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
6892158b
MT		 5132
5133 #define atomic_add_return(i, v) atomic_add_ret(i, v)
5134+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5135+{
5136+ return atomic_add_ret_unchecked(i, v);
5137+}
5138 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
5139
5140 /*
8308f9c9
MT		 5141@@ -50,6 +84,7 @@ extern long atomic64_sub_ret(long, atomi
5142 * other cases.
5143 */
5144 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5145+#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
5146 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
5147
5148 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
5149@@ -59,30 +94,59 @@ extern long atomic64_sub_ret(long, atomi
58c5fc13
MT		 5150 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
5151
5152 #define atomic_inc(v) atomic_add(1, v)
ae4e228f
MT		 5153+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5154+{
5155+ atomic_add_unchecked(1, v);
5156+}
58c5fc13 5157 #define atomic64_inc(v) atomic64_add(1, v)
ae4e228f
MT		 5158+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
5159+{
5160+ atomic64_add_unchecked(1, v);
5161+}
58c5fc13
MT		 5162
5163 #define atomic_dec(v) atomic_sub(1, v)
df50ba0c
MT		 5164+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
5165+{
5166+ atomic_sub_unchecked(1, v);
5167+}
ae4e228f 5168 #define atomic64_dec(v) atomic64_sub(1, v)
df50ba0c
MT		 5169+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
5170+{
5171+ atomic64_sub_unchecked(1, v);
5172+}
5173
5174 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
5175 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
8308f9c9
MT		 5176
5177 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5178+#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5179 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
5180+#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
58c5fc13
MT		 5181
5182 static inline int atomic_add_unless(atomic_t *v, int a, int u)
5183 {
5184- int c, old;
5185+ int c, old, new;
5186 c = atomic_read(v);
5187 for (;;) {
5188- if (unlikely(c == (u)))
5189+ if (unlikely(c == u))
5190 break;
5191- old = atomic_cmpxchg((v), c, c + (a));
5192+
5193+ asm volatile("addcc %2, %0, %0\n"
5194+
5195+#ifdef CONFIG_PAX_REFCOUNT
5196+ "tvs %%icc, 6\n"
5197+#endif
5198+
5199+ : "=r" (new)
5200+ : "0" (c), "ir" (a)
5201+ : "cc");
5202+
5203+ old = atomic_cmpxchg(v, c, new);
5204 if (likely(old == c))
5205 break;
5206 c = old;
5207 }
5208- return c != (u);
5209+ return c != u;
5210 }
5211
5212 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
8308f9c9 5213@@ -93,17 +157,28 @@ static inline int atomic_add_unless(atom
58c5fc13 5214
57199397 5215 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
58c5fc13
MT		 5216 {
5217- long c, old;
5218+ long c, old, new;
5219 c = atomic64_read(v);
5220 for (;;) {
5221- if (unlikely(c == (u)))
5222+ if (unlikely(c == u))
5223 break;
5224- old = atomic64_cmpxchg((v), c, c + (a));
5225+
5226+ asm volatile("addcc %2, %0, %0\n"
5227+
5228+#ifdef CONFIG_PAX_REFCOUNT
5229+ "tvs %%xcc, 6\n"
5230+#endif
5231+
5232+ : "=r" (new)
5233+ : "0" (c), "ir" (a)
5234+ : "cc");
5235+
5236+ old = atomic64_cmpxchg(v, c, new);
5237 if (likely(old == c))
5238 break;
5239 c = old;
5240 }
5241- return c != (u);
5242+ return c != u;
5243 }
5244
5245 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
66a7e928
MT		 5246diff -urNp linux-2.6.39/arch/sparc/include/asm/cache.h linux-2.6.39/arch/sparc/include/asm/cache.h
5247--- linux-2.6.39/arch/sparc/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
5248+++ linux-2.6.39/arch/sparc/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
5249@@ -10,7 +10,7 @@
5250 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
5251
5252 #define L1_CACHE_SHIFT 5
5253-#define L1_CACHE_BYTES 32
5254+#define L1_CACHE_BYTES 32U
5255
5256 #ifdef CONFIG_SPARC32
5257 #define SMP_CACHE_BYTES_SHIFT 5
5258diff -urNp linux-2.6.39/arch/sparc/include/asm/dma-mapping.h linux-2.6.39/arch/sparc/include/asm/dma-mapping.h
5259--- linux-2.6.39/arch/sparc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
5260+++ linux-2.6.39/arch/sparc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
6892158b
MT		 5261@@ -12,10 +12,10 @@ extern int dma_supported(struct device *
5262 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
ae4e228f 5263 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
ae4e228f
MT		 5264
5265-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
df50ba0c 5266+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
ae4e228f
MT		 5267 extern struct bus_type pci_bus_type;
5268
5269-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5270+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5271 {
5272 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
5273 if (dev->bus == &pci_bus_type)
6892158b 5274@@ -29,7 +29,7 @@ static inline struct dma_map_ops *get_dm
ae4e228f
MT		 5275 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5276 dma_addr_t *dma_handle, gfp_t flag)
5277 {
5278- struct dma_map_ops *ops = get_dma_ops(dev);
5279+ const struct dma_map_ops *ops = get_dma_ops(dev);
5280 void *cpu_addr;
5281
5282 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
6892158b 5283@@ -40,7 +40,7 @@ static inline void *dma_alloc_coherent(s
ae4e228f
MT		 5284 static inline void dma_free_coherent(struct device *dev, size_t size,
5285 void *cpu_addr, dma_addr_t dma_handle)
5286 {
5287- struct dma_map_ops *ops = get_dma_ops(dev);
5288+ const struct dma_map_ops *ops = get_dma_ops(dev);
5289
5290 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
5291 ops->free_coherent(dev, size, cpu_addr, dma_handle);
66a7e928
MT		 5292diff -urNp linux-2.6.39/arch/sparc/include/asm/elf_32.h linux-2.6.39/arch/sparc/include/asm/elf_32.h
5293--- linux-2.6.39/arch/sparc/include/asm/elf_32.h 2011-05-19 00:06:34.000000000 -0400
5294+++ linux-2.6.39/arch/sparc/include/asm/elf_32.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 5295@@ -114,6 +114,13 @@ typedef struct {
58c5fc13
MT		 5296
5297 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
5298
5299+#ifdef CONFIG_PAX_ASLR
5300+#define PAX_ELF_ET_DYN_BASE 0x10000UL
5301+
5302+#define PAX_DELTA_MMAP_LEN 16
5303+#define PAX_DELTA_STACK_LEN 16
5304+#endif
5305+
5306 /* This yields a mask that user programs can use to figure out what
5307 instruction set this cpu supports. This can NOT be done in userspace
5308 on Sparc. */
66a7e928
MT		 5309diff -urNp linux-2.6.39/arch/sparc/include/asm/elf_64.h linux-2.6.39/arch/sparc/include/asm/elf_64.h
5310--- linux-2.6.39/arch/sparc/include/asm/elf_64.h 2011-05-19 00:06:34.000000000 -0400
5311+++ linux-2.6.39/arch/sparc/include/asm/elf_64.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 5312@@ -162,6 +162,12 @@ typedef struct {
58c5fc13
MT		 5313 #define ELF_ET_DYN_BASE 0x0000010000000000UL
5314 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
5315
5316+#ifdef CONFIG_PAX_ASLR
5317+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
5318+
ae4e228f
MT		 5319+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
5320+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
58c5fc13
MT		 5321+#endif
5322
5323 /* This yields a mask that user programs can use to figure out what
5324 instruction set this cpu supports. */
66a7e928
MT		 5325diff -urNp linux-2.6.39/arch/sparc/include/asm/pgtable_32.h linux-2.6.39/arch/sparc/include/asm/pgtable_32.h
5326--- linux-2.6.39/arch/sparc/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
5327+++ linux-2.6.39/arch/sparc/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 5328@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
5329 BTFIXUPDEF_INT(page_none)
5330 BTFIXUPDEF_INT(page_copy)
5331 BTFIXUPDEF_INT(page_readonly)
5332+
5333+#ifdef CONFIG_PAX_PAGEEXEC
5334+BTFIXUPDEF_INT(page_shared_noexec)
5335+BTFIXUPDEF_INT(page_copy_noexec)
5336+BTFIXUPDEF_INT(page_readonly_noexec)
5337+#endif
5338+
5339 BTFIXUPDEF_INT(page_kernel)
5340
5341 #define PMD_SHIFT SUN4C_PMD_SHIFT
5342@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
5343 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
5344 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
5345
5346+#ifdef CONFIG_PAX_PAGEEXEC
5347+extern pgprot_t PAGE_SHARED_NOEXEC;
5348+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
5349+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
5350+#else
5351+# define PAGE_SHARED_NOEXEC PAGE_SHARED
5352+# define PAGE_COPY_NOEXEC PAGE_COPY
5353+# define PAGE_READONLY_NOEXEC PAGE_READONLY
5354+#endif
5355+
5356 extern unsigned long page_kernel;
5357
5358 #ifdef MODULE
66a7e928
MT		 5359diff -urNp linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h
5360--- linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h 2011-05-19 00:06:34.000000000 -0400
5361+++ linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 5362@@ -115,6 +115,13 @@
5363 SRMMU_EXEC | SRMMU_REF)
5364 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
5365 SRMMU_EXEC | SRMMU_REF)
5366+
5367+#ifdef CONFIG_PAX_PAGEEXEC
5368+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
5369+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5370+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5371+#endif
5372+
5373 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
5374 SRMMU_DIRTY | SRMMU_REF)
5375
66a7e928
MT		 5376diff -urNp linux-2.6.39/arch/sparc/include/asm/spinlock_64.h linux-2.6.39/arch/sparc/include/asm/spinlock_64.h
5377--- linux-2.6.39/arch/sparc/include/asm/spinlock_64.h 2011-05-19 00:06:34.000000000 -0400
5378+++ linux-2.6.39/arch/sparc/include/asm/spinlock_64.h 2011-05-22 19:36:30.000000000 -0400
8308f9c9
MT		 5379@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
5380
5381 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
5382
5383-static void inline arch_read_lock(arch_rwlock_t *lock)
5384+static inline void arch_read_lock(arch_rwlock_t *lock)
5385 {
5386 unsigned long tmp1, tmp2;
5387
58c5fc13
MT		 5388 __asm__ __volatile__ (
5389 "1: ldsw [%2], %0\n"
5390 " brlz,pn %0, 2f\n"
5391-"4: add %0, 1, %1\n"
5392+"4: addcc %0, 1, %1\n"
5393+
5394+#ifdef CONFIG_PAX_REFCOUNT
5395+" tvs %%icc, 6\n"
5396+#endif
5397+
5398 " cas [%2], %0, %1\n"
5399 " cmp %0, %1\n"
5400 " bne,pn %%icc, 1b\n"
8308f9c9 5401@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
58c5fc13
MT		 5402 " .previous"
5403 : "=&r" (tmp1), "=&r" (tmp2)
5404 : "r" (lock)
5405- : "memory");
5406+ : "memory", "cc");
5407 }
5408
8308f9c9
MT		 5409-static int inline arch_read_trylock(arch_rwlock_t *lock)
5410+static inline int arch_read_trylock(arch_rwlock_t *lock)
5411 {
5412 int tmp1, tmp2;
5413
ae4e228f 5414@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
58c5fc13
MT		 5415 "1: ldsw [%2], %0\n"
5416 " brlz,a,pn %0, 2f\n"
5417 " mov 0, %0\n"
5418-" add %0, 1, %1\n"
5419+" addcc %0, 1, %1\n"
5420+
5421+#ifdef CONFIG_PAX_REFCOUNT
5422+" tvs %%icc, 6\n"
5423+#endif
5424+
5425 " cas [%2], %0, %1\n"
5426 " cmp %0, %1\n"
5427 " bne,pn %%icc, 1b\n"
8308f9c9
MT		 5428@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
5429 return tmp1;
5430 }
5431
5432-static void inline arch_read_unlock(arch_rwlock_t *lock)
5433+static inline void arch_read_unlock(arch_rwlock_t *lock)
5434 {
5435 unsigned long tmp1, tmp2;
58c5fc13
MT		 5436
5437 __asm__ __volatile__(
5438 "1: lduw [%2], %0\n"
5439-" sub %0, 1, %1\n"
5440+" subcc %0, 1, %1\n"
5441+
5442+#ifdef CONFIG_PAX_REFCOUNT
ae4e228f 5443+" tvs %%icc, 6\n"
58c5fc13
MT		 5444+#endif
5445+
5446 " cas [%2], %0, %1\n"
5447 " cmp %0, %1\n"
5448 " bne,pn %%xcc, 1b\n"
8308f9c9
MT		 5449@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
5450 : "memory");
5451 }
5452
5453-static void inline arch_write_lock(arch_rwlock_t *lock)
5454+static inline void arch_write_lock(arch_rwlock_t *lock)
5455 {
5456 unsigned long mask, tmp1, tmp2;
5457
5458@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
5459 : "memory");
5460 }
5461
5462-static void inline arch_write_unlock(arch_rwlock_t *lock)
5463+static inline void arch_write_unlock(arch_rwlock_t *lock)
5464 {
5465 __asm__ __volatile__(
5466 " stw %%g0, [%0]"
5467@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
5468 : "memory");
5469 }
5470
5471-static int inline arch_write_trylock(arch_rwlock_t *lock)
5472+static inline int arch_write_trylock(arch_rwlock_t *lock)
5473 {
5474 unsigned long mask, tmp1, tmp2, result;
5475
66a7e928
MT		 5476diff -urNp linux-2.6.39/arch/sparc/include/asm/uaccess_32.h linux-2.6.39/arch/sparc/include/asm/uaccess_32.h
5477--- linux-2.6.39/arch/sparc/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
5478+++ linux-2.6.39/arch/sparc/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
6892158b 5479@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
58c5fc13
MT		 5480
5481 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
5482 {
5483- if (n && __access_ok((unsigned long) to, n))
5484+ if ((long)n < 0)
5485+ return n;
5486+
5487+ if (n && __access_ok((unsigned long) to, n)) {
5488+ if (!__builtin_constant_p(n))
5489+ check_object_size(from, n, true);
5490 return __copy_user(to, (__force void __user *) from, n);
5491- else
5492+ } else
5493 return n;
5494 }
5495
5496 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
5497 {
5498+ if ((long)n < 0)
5499+ return n;
5500+
5501+ if (!__builtin_constant_p(n))
5502+ check_object_size(from, n, true);
5503+
5504 return __copy_user(to, (__force void __user *) from, n);
5505 }
5506
6892158b 5507 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
58c5fc13 5508 {
6892158b 5509- if (n && __access_ok((unsigned long) from, n))
58c5fc13
MT		 5510+ if ((long)n < 0)
5511+ return n;
5512+
5513+ if (n && __access_ok((unsigned long) from, n)) {
5514+ if (!__builtin_constant_p(n))
5515+ check_object_size(to, n, false);
5516 return __copy_user((__force void __user *) to, from, n);
5517- else
5518+ } else
5519 return n;
5520 }
5521
5522 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
5523 {
5524+ if ((long)n < 0)
5525+ return n;
58c5fc13
MT		 5526+
5527 return __copy_user((__force void __user *) to, from, n);
5528 }
5529
66a7e928
MT		 5530diff -urNp linux-2.6.39/arch/sparc/include/asm/uaccess_64.h linux-2.6.39/arch/sparc/include/asm/uaccess_64.h
5531--- linux-2.6.39/arch/sparc/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
5532+++ linux-2.6.39/arch/sparc/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 5533@@ -10,6 +10,7 @@
5534 #include <linux/compiler.h>
5535 #include <linux/string.h>
5536 #include <linux/thread_info.h>
5537+#include <linux/kernel.h>
5538 #include <asm/asi.h>
5539 #include <asm/system.h>
5540 #include <asm/spitfire.h>
6892158b
MT		 5541@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
5542 static inline unsigned long __must_check
5543 copy_from_user(void *to, const void __user *from, unsigned long size)
5544 {
5545- unsigned long ret = ___copy_from_user(to, from, size);
5546+ unsigned long ret;
ae4e228f
MT		 5547
5548+ if ((long)size < 0 || size > INT_MAX)
58c5fc13
MT		 5549+ return size;
5550+
5551+ if (!__builtin_constant_p(size))
5552+ check_object_size(to, size, false);
5553+
6892158b
MT		 5554+ ret = ___copy_from_user(to, from, size);
5555 if (unlikely(ret))
5556 ret = copy_from_user_fixup(to, from, size);
5557
5558@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
58c5fc13
MT		 5559 static inline unsigned long __must_check
5560 copy_to_user(void __user *to, const void *from, unsigned long size)
5561 {
5562- unsigned long ret = ___copy_to_user(to, from, size);
5563+ unsigned long ret;
5564+
ae4e228f 5565+ if ((long)size < 0 || size > INT_MAX)
58c5fc13
MT		 5566+ return size;
5567+
5568+ if (!__builtin_constant_p(size))
5569+ check_object_size(from, size, true);
58c5fc13 5570
ae4e228f 5571+ ret = ___copy_to_user(to, from, size);
58c5fc13
MT		 5572 if (unlikely(ret))
5573 ret = copy_to_user_fixup(to, from, size);
ae4e228f 5574 return ret;
66a7e928
MT		 5575diff -urNp linux-2.6.39/arch/sparc/include/asm/uaccess.h linux-2.6.39/arch/sparc/include/asm/uaccess.h
5576--- linux-2.6.39/arch/sparc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
5577+++ linux-2.6.39/arch/sparc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 5578@@ -1,5 +1,13 @@
5579 #ifndef ___ASM_SPARC_UACCESS_H
5580 #define ___ASM_SPARC_UACCESS_H
5581+
5582+#ifdef __KERNEL__
5583+#ifndef __ASSEMBLY__
5584+#include <linux/types.h>
5585+extern void check_object_size(const void *ptr, unsigned long n, bool to);
5586+#endif
5587+#endif
5588+
5589 #if defined(__sparc__) && defined(__arch64__)
5590 #include <asm/uaccess_64.h>
5591 #else
66a7e928
MT		 5592diff -urNp linux-2.6.39/arch/sparc/kernel/iommu.c linux-2.6.39/arch/sparc/kernel/iommu.c
5593--- linux-2.6.39/arch/sparc/kernel/iommu.c 2011-05-19 00:06:34.000000000 -0400
5594+++ linux-2.6.39/arch/sparc/kernel/iommu.c 2011-05-22 19:36:30.000000000 -0400
71d190be 5595@@ -824,7 +824,7 @@ static void dma_4u_sync_sg_for_cpu(struc
ae4e228f
MT		 5596 spin_unlock_irqrestore(&iommu->lock, flags);
5597 }
5598
5599-static struct dma_map_ops sun4u_dma_ops = {
5600+static const struct dma_map_ops sun4u_dma_ops = {
5601 .alloc_coherent = dma_4u_alloc_coherent,
5602 .free_coherent = dma_4u_free_coherent,
5603 .map_page = dma_4u_map_page,
71d190be 5604@@ -835,7 +835,7 @@ static struct dma_map_ops sun4u_dma_ops
ae4e228f
MT		 5605 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
5606 };
5607
5608-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5609+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5610 EXPORT_SYMBOL(dma_ops);
5611
5612 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
66a7e928
MT		 5613diff -urNp linux-2.6.39/arch/sparc/kernel/ioport.c linux-2.6.39/arch/sparc/kernel/ioport.c
5614--- linux-2.6.39/arch/sparc/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
5615+++ linux-2.6.39/arch/sparc/kernel/ioport.c 2011-05-22 19:36:30.000000000 -0400
5616@@ -402,7 +402,7 @@ static void sbus_sync_sg_for_device(stru
ae4e228f
MT		 5617 BUG();
5618 }
5619
5620-struct dma_map_ops sbus_dma_ops = {
5621+const struct dma_map_ops sbus_dma_ops = {
5622 .alloc_coherent = sbus_alloc_coherent,
5623 .free_coherent = sbus_free_coherent,
5624 .map_page = sbus_map_page,
66a7e928 5625@@ -653,7 +653,7 @@ static void pci32_sync_sg_for_device(str
ae4e228f
MT		 5626 }
5627 }
5628
5629-struct dma_map_ops pci32_dma_ops = {
5630+const struct dma_map_ops pci32_dma_ops = {
5631 .alloc_coherent = pci32_alloc_coherent,
5632 .free_coherent = pci32_free_coherent,
5633 .map_page = pci32_map_page,
66a7e928
MT		 5634diff -urNp linux-2.6.39/arch/sparc/kernel/kgdb_32.c linux-2.6.39/arch/sparc/kernel/kgdb_32.c
5635--- linux-2.6.39/arch/sparc/kernel/kgdb_32.c 2011-05-19 00:06:34.000000000 -0400
5636+++ linux-2.6.39/arch/sparc/kernel/kgdb_32.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 5637@@ -164,7 +164,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5638 regs->npc = regs->pc + 4;
ae4e228f
MT		 5639 }
5640
5641-struct kgdb_arch arch_kgdb_ops = {
5642+const struct kgdb_arch arch_kgdb_ops = {
5643 /* Breakpoint instruction: ta 0x7d */
5644 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
5645 };
66a7e928
MT		 5646diff -urNp linux-2.6.39/arch/sparc/kernel/kgdb_64.c linux-2.6.39/arch/sparc/kernel/kgdb_64.c
5647--- linux-2.6.39/arch/sparc/kernel/kgdb_64.c 2011-05-19 00:06:34.000000000 -0400
5648+++ linux-2.6.39/arch/sparc/kernel/kgdb_64.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 5649@@ -187,7 +187,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5650 regs->tnpc = regs->tpc + 4;
ae4e228f
MT		 5651 }
5652
5653-struct kgdb_arch arch_kgdb_ops = {
5654+const struct kgdb_arch arch_kgdb_ops = {
5655 /* Breakpoint instruction: ta 0x72 */
5656 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
5657 };
66a7e928
MT		 5658diff -urNp linux-2.6.39/arch/sparc/kernel/Makefile linux-2.6.39/arch/sparc/kernel/Makefile
5659--- linux-2.6.39/arch/sparc/kernel/Makefile 2011-05-19 00:06:34.000000000 -0400
5660+++ linux-2.6.39/arch/sparc/kernel/Makefile 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 5661@@ -3,7 +3,7 @@
5662 #
5663
5664 asflags-y := -ansi
5665-ccflags-y := -Werror
5666+#ccflags-y := -Werror
5667
5668 extra-y := head_$(BITS).o
5669 extra-y += init_task.o
66a7e928
MT		 5670diff -urNp linux-2.6.39/arch/sparc/kernel/pcic.c linux-2.6.39/arch/sparc/kernel/pcic.c
5671--- linux-2.6.39/arch/sparc/kernel/pcic.c 2011-05-19 00:06:34.000000000 -0400
5672+++ linux-2.6.39/arch/sparc/kernel/pcic.c 2011-05-22 19:36:30.000000000 -0400
5673@@ -268,7 +268,7 @@ static int pcic_write_config(struct pci_
5674 return -EINVAL;
5675 }
5676
5677-static struct pci_ops pcic_ops = {
5678+static const struct pci_ops pcic_ops = {
5679 .read = pcic_read_config,
5680 .write = pcic_write_config,
5681 };
5682diff -urNp linux-2.6.39/arch/sparc/kernel/pci_common.c linux-2.6.39/arch/sparc/kernel/pci_common.c
5683--- linux-2.6.39/arch/sparc/kernel/pci_common.c 2011-05-19 00:06:34.000000000 -0400
5684+++ linux-2.6.39/arch/sparc/kernel/pci_common.c 2011-05-22 19:36:30.000000000 -0400
5685@@ -249,7 +249,7 @@ static int sun4u_write_pci_cfg(struct pc
5686 return PCIBIOS_SUCCESSFUL;
5687 }
5688
5689-struct pci_ops sun4u_pci_ops = {
5690+const struct pci_ops sun4u_pci_ops = {
5691 .read = sun4u_read_pci_cfg,
5692 .write = sun4u_write_pci_cfg,
5693 };
5694@@ -310,7 +310,7 @@ static int sun4v_write_pci_cfg(struct pc
5695 return PCIBIOS_SUCCESSFUL;
5696 }
5697
5698-struct pci_ops sun4v_pci_ops = {
5699+const struct pci_ops sun4v_pci_ops = {
5700 .read = sun4v_read_pci_cfg,
5701 .write = sun4v_write_pci_cfg,
5702 };
5703diff -urNp linux-2.6.39/arch/sparc/kernel/pci_impl.h linux-2.6.39/arch/sparc/kernel/pci_impl.h
5704--- linux-2.6.39/arch/sparc/kernel/pci_impl.h 2011-05-19 00:06:34.000000000 -0400
5705+++ linux-2.6.39/arch/sparc/kernel/pci_impl.h 2011-05-22 19:36:30.000000000 -0400
5706@@ -175,8 +175,8 @@ extern void pci_config_write8(u8 *addr,
5707 extern void pci_config_write16(u16 *addr, u16 val);
5708 extern void pci_config_write32(u32 *addr, u32 val);
5709
5710-extern struct pci_ops sun4u_pci_ops;
5711-extern struct pci_ops sun4v_pci_ops;
5712+extern const struct pci_ops sun4u_pci_ops;
5713+extern const struct pci_ops sun4v_pci_ops;
5714
5715 extern volatile int pci_poke_in_progress;
5716 extern volatile int pci_poke_cpu;
5717diff -urNp linux-2.6.39/arch/sparc/kernel/pci_sun4v.c linux-2.6.39/arch/sparc/kernel/pci_sun4v.c
5718--- linux-2.6.39/arch/sparc/kernel/pci_sun4v.c 2011-05-19 00:06:34.000000000 -0400
5719+++ linux-2.6.39/arch/sparc/kernel/pci_sun4v.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 5720@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
5721 spin_unlock_irqrestore(&iommu->lock, flags);
5722 }
5723
5724-static struct dma_map_ops sun4v_dma_ops = {
5725+static const struct dma_map_ops sun4v_dma_ops = {
5726 .alloc_coherent = dma_4v_alloc_coherent,
5727 .free_coherent = dma_4v_free_coherent,
5728 .map_page = dma_4v_map_page,
66a7e928
MT		 5729diff -urNp linux-2.6.39/arch/sparc/kernel/process_32.c linux-2.6.39/arch/sparc/kernel/process_32.c
5730--- linux-2.6.39/arch/sparc/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
5731+++ linux-2.6.39/arch/sparc/kernel/process_32.c 2011-05-22 19:41:32.000000000 -0400
bc901d79
MT		 5732@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
5733 rw->ins[4], rw->ins[5],
5734 rw->ins[6],
5735 rw->ins[7]);
5736- printk("%pS\n", (void *) rw->ins[7]);
5737+ printk("%pA\n", (void *) rw->ins[7]);
5738 rw = (struct reg_window32 *) rw->ins[6];
5739 }
5740 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
5741@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
5742
5743 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
5744 r->psr, r->pc, r->npc, r->y, print_tainted());
5745- printk("PC: <%pS>\n", (void *) r->pc);
5746+ printk("PC: <%pA>\n", (void *) r->pc);
5747 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5748 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
5749 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
5750 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5751 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
5752 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
5753- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
5754+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
5755
5756 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5757 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
5758@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
5759 rw = (struct reg_window32 *) fp;
5760 pc = rw->ins[7];
5761 printk("[%08lx : ", pc);
5762- printk("%pS ] ", (void *) pc);
5763+ printk("%pA ] ", (void *) pc);
5764 fp = rw->ins[6];
5765 } while (++count < 16);
5766 printk("\n");
66a7e928
MT		 5767diff -urNp linux-2.6.39/arch/sparc/kernel/process_64.c linux-2.6.39/arch/sparc/kernel/process_64.c
5768--- linux-2.6.39/arch/sparc/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
5769+++ linux-2.6.39/arch/sparc/kernel/process_64.c 2011-05-22 19:41:32.000000000 -0400
bc901d79
MT		 5770@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
5771 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
5772 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
5773 if (regs->tstate & TSTATE_PRIV)
5774- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
5775+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
5776 }
5777
5778 void show_regs(struct pt_regs *regs)
5779 {
5780 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
5781 regs->tpc, regs->tnpc, regs->y, print_tainted());
5782- printk("TPC: <%pS>\n", (void *) regs->tpc);
5783+ printk("TPC: <%pA>\n", (void *) regs->tpc);
5784 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
5785 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
5786 regs->u_regs[3]);
5787@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
5788 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
5789 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
5790 regs->u_regs[15]);
5791- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
5792+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
5793 show_regwindow(regs);
5794 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
5795 }
5796@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
5797 ((tp && tp->task) ? tp->task->pid : -1));
5798
5799 if (gp->tstate & TSTATE_PRIV) {
5800- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
5801+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
5802 (void *) gp->tpc,
5803 (void *) gp->o7,
5804 (void *) gp->i7,
66a7e928
MT		 5805diff -urNp linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c
5806--- linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c 2011-05-19 00:06:34.000000000 -0400
5807+++ linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 5808@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
58c5fc13
MT		 5809 if (ARCH_SUN4C && len > 0x20000000)
5810 return -ENOMEM;
5811 if (!addr)
5812- addr = TASK_UNMAPPED_BASE;
5813+ addr = current->mm->mmap_base;
5814
5815 if (flags & MAP_SHARED)
5816 addr = COLOUR_ALIGN(addr);
bc901d79 5817@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
57199397
MT		 5818 }
5819 if (TASK_SIZE - PAGE_SIZE - len < addr)
5820 return -ENOMEM;
5821- if (!vmm || addr + len <= vmm->vm_start)
5822+ if (check_heap_stack_gap(vmm, addr, len))
5823 return addr;
5824 addr = vmm->vm_end;
5825 if (flags & MAP_SHARED)
66a7e928
MT		 5826diff -urNp linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c
5827--- linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c 2011-05-19 00:06:34.000000000 -0400
5828+++ linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 5829@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
58c5fc13
MT		 5830 /* We do not accept a shared mapping if it would violate
5831 * cache aliasing constraints.
5832 */
5833- if ((flags & MAP_SHARED) &&
5834+ if ((filp || (flags & MAP_SHARED)) &&
5835 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5836 return -EINVAL;
5837 return addr;
df50ba0c 5838@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
58c5fc13
MT		 5839 if (filp || (flags & MAP_SHARED))
5840 do_color_align = 1;
5841
5842+#ifdef CONFIG_PAX_RANDMMAP
5843+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
5844+#endif
5845+
5846 if (addr) {
5847 if (do_color_align)
5848 addr = COLOUR_ALIGN(addr, pgoff);
57199397
MT		 5849@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
5850 addr = PAGE_ALIGN(addr);
5851
5852 vma = find_vma(mm, addr);
5853- if (task_size - len >= addr &&
5854- (!vma || addr + len <= vma->vm_start))
5855+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5856 return addr;
58c5fc13
MT		 5857 }
5858
5859 if (len > mm->cached_hole_size) {
5860- start_addr = addr = mm->free_area_cache;
5861+ start_addr = addr = mm->free_area_cache;
5862 } else {
5863- start_addr = addr = TASK_UNMAPPED_BASE;
5864+ start_addr = addr = mm->mmap_base;
5865 mm->cached_hole_size = 0;
5866 }
5867
57199397 5868@@ -174,14 +177,14 @@ full_search:
58c5fc13
MT		 5869 vma = find_vma(mm, VA_EXCLUDE_END);
5870 }
5871 if (unlikely(task_size < addr)) {
5872- if (start_addr != TASK_UNMAPPED_BASE) {
5873- start_addr = addr = TASK_UNMAPPED_BASE;
5874+ if (start_addr != mm->mmap_base) {
5875+ start_addr = addr = mm->mmap_base;
5876 mm->cached_hole_size = 0;
5877 goto full_search;
5878 }
57199397
MT		 5879 return -ENOMEM;
5880 }
5881- if (likely(!vma || addr + len <= vma->vm_start)) {
5882+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5883 /*
5884 * Remember the place where we stopped the search:
5885 */
5886@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
58c5fc13
MT		 5887 /* We do not accept a shared mapping if it would violate
5888 * cache aliasing constraints.
5889 */
5890- if ((flags & MAP_SHARED) &&
5891+ if ((filp || (flags & MAP_SHARED)) &&
5892 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5893 return -EINVAL;
5894 return addr;
57199397
MT		 5895@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
5896 addr = PAGE_ALIGN(addr);
5897
5898 vma = find_vma(mm, addr);
5899- if (task_size - len >= addr &&
5900- (!vma || addr + len <= vma->vm_start))
5901+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5902 return addr;
5903 }
5904
5905@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
5906 /* make sure it can fit in the remaining address space */
5907 if (likely(addr > len)) {
5908 vma = find_vma(mm, addr-len);
5909- if (!vma || addr <= vma->vm_start) {
5910+ if (check_heap_stack_gap(vma, addr - len, len)) {
5911 /* remember the address as a hint for next time */
5912 return (mm->free_area_cache = addr-len);
5913 }
16454cff
MT		 5914@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
5915 if (unlikely(mm->mmap_base < len))
5916 goto bottomup;
5917
5918- addr = mm->mmap_base-len;
5919- if (do_color_align)
5920- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5921+ addr = mm->mmap_base - len;
5922
5923 do {
5924+ if (do_color_align)
5925+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5926 /*
5927 * Lookup failure means no vma is above this address,
5928 * else if new region fits below vma->vm_start,
57199397
MT		 5929 * return with success:
5930 */
5931 vma = find_vma(mm, addr);
5932- if (likely(!vma || addr+len <= vma->vm_start)) {
5933+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5934 /* remember the address as a hint for next time */
5935 return (mm->free_area_cache = addr);
5936 }
16454cff
MT		 5937@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
5938 mm->cached_hole_size = vma->vm_start - addr;
5939
5940 /* try just below the current vma->vm_start */
5941- addr = vma->vm_start-len;
5942- if (do_color_align)
5943- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5944- } while (likely(len < vma->vm_start));
5945+ addr = skip_heap_stack_gap(vma, len);
5946+ } while (!IS_ERR_VALUE(addr));
5947
5948 bottomup:
5949 /*
66a7e928 5950@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
ae4e228f 5951 gap == RLIM_INFINITY ||
58c5fc13
MT		 5952 sysctl_legacy_va_layout) {
5953 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
5954+
5955+#ifdef CONFIG_PAX_RANDMMAP
5956+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5957+ mm->mmap_base += mm->delta_mmap;
5958+#endif
5959+
5960 mm->get_unmapped_area = arch_get_unmapped_area;
5961 mm->unmap_area = arch_unmap_area;
5962 } else {
66a7e928 5963@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
58c5fc13
MT		 5964 gap = (task_size / 6 * 5);
5965
5966 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
5967+
5968+#ifdef CONFIG_PAX_RANDMMAP
5969+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5970+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
5971+#endif
5972+
5973 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
5974 mm->unmap_area = arch_unmap_area_topdown;
5975 }
66a7e928
MT		 5976diff -urNp linux-2.6.39/arch/sparc/kernel/traps_32.c linux-2.6.39/arch/sparc/kernel/traps_32.c
5977--- linux-2.6.39/arch/sparc/kernel/traps_32.c 2011-05-19 00:06:34.000000000 -0400
5978+++ linux-2.6.39/arch/sparc/kernel/traps_32.c 2011-05-22 19:41:32.000000000 -0400
bc901d79
MT		 5979@@ -76,7 +76,7 @@ void die_if_kernel(char *str, struct pt_
5980 count++ < 30 &&
5981 (((unsigned long) rw) >= PAGE_OFFSET) &&
5982 !(((unsigned long) rw) & 0x7)) {
5983- printk("Caller[%08lx]: %pS\n", rw->ins[7],
5984+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
5985 (void *) rw->ins[7]);
5986 rw = (struct reg_window32 *)rw->ins[6];
5987 }
66a7e928
MT		 5988diff -urNp linux-2.6.39/arch/sparc/kernel/traps_64.c linux-2.6.39/arch/sparc/kernel/traps_64.c
5989--- linux-2.6.39/arch/sparc/kernel/traps_64.c 2011-05-19 00:06:34.000000000 -0400
5990+++ linux-2.6.39/arch/sparc/kernel/traps_64.c 2011-05-22 19:41:32.000000000 -0400
bc901d79
MT		 5991@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
5992 i + 1,
5993 p->trapstack[i].tstate, p->trapstack[i].tpc,
5994 p->trapstack[i].tnpc, p->trapstack[i].tt);
5995- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
5996+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
5997 }
5998 }
5999
57199397 6000@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
58c5fc13
MT		 6001
6002 lvl -= 0x100;
6003 if (regs->tstate & TSTATE_PRIV) {
6004+
6005+#ifdef CONFIG_PAX_REFCOUNT
6006+ if (lvl == 6)
6007+ pax_report_refcount_overflow(regs);
6008+#endif
6009+
6010 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
6011 die_if_kernel(buffer, regs);
6012 }
57199397 6013@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
58c5fc13
MT		 6014 void bad_trap_tl1(struct pt_regs *regs, long lvl)
6015 {
6016 char buffer[32];
6017-
6018+
6019 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
6020 0, lvl, SIGTRAP) == NOTIFY_STOP)
6021 return;
6022
6023+#ifdef CONFIG_PAX_REFCOUNT
6024+ if (lvl == 6)
6025+ pax_report_refcount_overflow(regs);
6026+#endif
6027+
6028 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
6029
6030 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
bc901d79
MT		 6031@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
6032 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
6033 printk("%s" "ERROR(%d): ",
6034 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
6035- printk("TPC<%pS>\n", (void *) regs->tpc);
6036+ printk("TPC<%pA>\n", (void *) regs->tpc);
6037 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
6038 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
6039 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
6040@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
6041 smp_processor_id(),
6042 (type & 0x1) ? 'I' : 'D',
6043 regs->tpc);
6044- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
6045+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
6046 panic("Irrecoverable Cheetah+ parity error.");
6047 }
6048
6049@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
6050 smp_processor_id(),
6051 (type & 0x1) ? 'I' : 'D',
6052 regs->tpc);
6053- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
6054+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
6055 }
6056
6057 struct sun4v_error_entry {
6058@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
6059
6060 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
6061 regs->tpc, tl);
6062- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
6063+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
6064 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6065- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
6066+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
6067 (void *) regs->u_regs[UREG_I7]);
6068 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
6069 "pte[%lx] error[%lx]\n",
6070@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
6071
6072 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
6073 regs->tpc, tl);
6074- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
6075+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
6076 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6077- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
6078+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
6079 (void *) regs->u_regs[UREG_I7]);
6080 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
6081 "pte[%lx] error[%lx]\n",
71d190be 6082@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
bc901d79
MT		 6083 fp = (unsigned long)sf->fp + STACK_BIAS;
6084 }
6085
6086- printk(" [%016lx] %pS\n", pc, (void *) pc);
6087+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6088 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
6089 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
6090 int index = tsk->curr_ret_stack;
6091 if (tsk->ret_stack && index >= graph) {
6092 pc = tsk->ret_stack[index - graph].ret;
6093- printk(" [%016lx] %pS\n", pc, (void *) pc);
6094+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6095 graph++;
6096 }
6097 }
71d190be 6098@@ -2254,7 +2265,7 @@ void die_if_kernel(char *str, struct pt_
bc901d79
MT		 6099 while (rw &&
6100 count++ < 30 &&
6101 kstack_valid(tp, (unsigned long) rw)) {
6102- printk("Caller[%016lx]: %pS\n", rw->ins[7],
6103+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
6104 (void *) rw->ins[7]);
6105
6106 rw = kernel_stack_up(rw);
66a7e928
MT		 6107diff -urNp linux-2.6.39/arch/sparc/kernel/unaligned_64.c linux-2.6.39/arch/sparc/kernel/unaligned_64.c
6108--- linux-2.6.39/arch/sparc/kernel/unaligned_64.c 2011-05-19 00:06:34.000000000 -0400
6109+++ linux-2.6.39/arch/sparc/kernel/unaligned_64.c 2011-05-22 19:41:32.000000000 -0400
bc901d79
MT		 6110@@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs
6111 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
6112
6113 if (__ratelimit(&ratelimit)) {
6114- printk("Kernel unaligned access at TPC[%lx] %pS\n",
6115+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
6116 regs->tpc, (void *) regs->tpc);
6117 }
6118 }
66a7e928
MT		 6119diff -urNp linux-2.6.39/arch/sparc/lib/atomic_64.S linux-2.6.39/arch/sparc/lib/atomic_64.S
6120--- linux-2.6.39/arch/sparc/lib/atomic_64.S 2011-05-19 00:06:34.000000000 -0400
6121+++ linux-2.6.39/arch/sparc/lib/atomic_64.S 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 6122@@ -18,7 +18,12 @@
6123 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
6124 BACKOFF_SETUP(%o2)
6125 1: lduw [%o1], %g1
6126- add %g1, %o0, %g7
6127+ addcc %g1, %o0, %g7
6128+
6129+#ifdef CONFIG_PAX_REFCOUNT
6130+ tvs %icc, 6
6131+#endif
6132+
6133 cas [%o1], %g1, %g7
6134 cmp %g1, %g7
6892158b 6135 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
58c5fc13
MT		 6136@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
6137 2: BACKOFF_SPIN(%o2, %o3, 1b)
6138 .size atomic_add, .-atomic_add
6139
6140+ .globl atomic_add_unchecked
6141+ .type atomic_add_unchecked,#function
6142+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6143+ BACKOFF_SETUP(%o2)
6144+1: lduw [%o1], %g1
6145+ add %g1, %o0, %g7
6146+ cas [%o1], %g1, %g7
6147+ cmp %g1, %g7
6148+ bne,pn %icc, 2f
6149+ nop
6150+ retl
6151+ nop
6152+2: BACKOFF_SPIN(%o2, %o3, 1b)
6153+ .size atomic_add_unchecked, .-atomic_add_unchecked
6154+
6155 .globl atomic_sub
6156 .type atomic_sub,#function
6157 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6158 BACKOFF_SETUP(%o2)
6159 1: lduw [%o1], %g1
6160- sub %g1, %o0, %g7
6161+ subcc %g1, %o0, %g7
6162+
6163+#ifdef CONFIG_PAX_REFCOUNT
6164+ tvs %icc, 6
6165+#endif
6166+
6167 cas [%o1], %g1, %g7
6168 cmp %g1, %g7
6892158b 6169 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
58c5fc13
MT		 6170@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
6171 2: BACKOFF_SPIN(%o2, %o3, 1b)
6172 .size atomic_sub, .-atomic_sub
6173
6174+ .globl atomic_sub_unchecked
6175+ .type atomic_sub_unchecked,#function
6176+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6177+ BACKOFF_SETUP(%o2)
6178+1: lduw [%o1], %g1
6179+ sub %g1, %o0, %g7
6180+ cas [%o1], %g1, %g7
6181+ cmp %g1, %g7
6182+ bne,pn %icc, 2f
6183+ nop
6184+ retl
6185+ nop
6186+2: BACKOFF_SPIN(%o2, %o3, 1b)
6187+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
6188+
6189 .globl atomic_add_ret
6190 .type atomic_add_ret,#function
6191 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6192 BACKOFF_SETUP(%o2)
6193 1: lduw [%o1], %g1
6194- add %g1, %o0, %g7
6195+ addcc %g1, %o0, %g7
6196+
6197+#ifdef CONFIG_PAX_REFCOUNT
6198+ tvs %icc, 6
6199+#endif
6200+
6201 cas [%o1], %g1, %g7
6202 cmp %g1, %g7
6892158b
MT		 6203 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6204@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
57199397
MT		 6205 2: BACKOFF_SPIN(%o2, %o3, 1b)
6206 .size atomic_add_ret, .-atomic_add_ret
6207
6208+ .globl atomic_add_ret_unchecked
6209+ .type atomic_add_ret_unchecked,#function
6210+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6211+ BACKOFF_SETUP(%o2)
6212+1: lduw [%o1], %g1
6213+ addcc %g1, %o0, %g7
6214+ cas [%o1], %g1, %g7
6215+ cmp %g1, %g7
6216+ bne,pn %icc, 2f
6217+ add %g7, %o0, %g7
6218+ sra %g7, 0, %o0
6219+ retl
6220+ nop
6221+2: BACKOFF_SPIN(%o2, %o3, 1b)
6222+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
6223+
6224 .globl atomic_sub_ret
6225 .type atomic_sub_ret,#function
58c5fc13
MT		 6226 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6227 BACKOFF_SETUP(%o2)
6228 1: lduw [%o1], %g1
6229- sub %g1, %o0, %g7
6230+ subcc %g1, %o0, %g7
6231+
6232+#ifdef CONFIG_PAX_REFCOUNT
6233+ tvs %icc, 6
6234+#endif
6235+
6236 cas [%o1], %g1, %g7
6237 cmp %g1, %g7
6892158b
MT		 6238 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6239@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
58c5fc13
MT		 6240 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
6241 BACKOFF_SETUP(%o2)
6242 1: ldx [%o1], %g1
6243- add %g1, %o0, %g7
6244+ addcc %g1, %o0, %g7
6245+
6246+#ifdef CONFIG_PAX_REFCOUNT
6247+ tvs %xcc, 6
6248+#endif
6249+
6250 casx [%o1], %g1, %g7
6251 cmp %g1, %g7
6892158b
MT		 6252 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6253@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
ae4e228f
MT		 6254 2: BACKOFF_SPIN(%o2, %o3, 1b)
6255 .size atomic64_add, .-atomic64_add
6256
6257+ .globl atomic64_add_unchecked
6258+ .type atomic64_add_unchecked,#function
6259+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6260+ BACKOFF_SETUP(%o2)
6261+1: ldx [%o1], %g1
6262+ addcc %g1, %o0, %g7
6263+ casx [%o1], %g1, %g7
6264+ cmp %g1, %g7
6265+ bne,pn %xcc, 2f
6266+ nop
6267+ retl
6268+ nop
6269+2: BACKOFF_SPIN(%o2, %o3, 1b)
6270+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
6271+
6272 .globl atomic64_sub
6273 .type atomic64_sub,#function
58c5fc13
MT		 6274 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6275 BACKOFF_SETUP(%o2)
6276 1: ldx [%o1], %g1
6277- sub %g1, %o0, %g7
6278+ subcc %g1, %o0, %g7
6279+
6280+#ifdef CONFIG_PAX_REFCOUNT
6281+ tvs %xcc, 6
6282+#endif
6283+
6284 casx [%o1], %g1, %g7
6285 cmp %g1, %g7
6892158b
MT		 6286 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6287@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
df50ba0c
MT		 6288 2: BACKOFF_SPIN(%o2, %o3, 1b)
6289 .size atomic64_sub, .-atomic64_sub
6290
6291+ .globl atomic64_sub_unchecked
6292+ .type atomic64_sub_unchecked,#function
6293+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6294+ BACKOFF_SETUP(%o2)
6295+1: ldx [%o1], %g1
6296+ subcc %g1, %o0, %g7
6297+ casx [%o1], %g1, %g7
6298+ cmp %g1, %g7
6299+ bne,pn %xcc, 2f
6300+ nop
6301+ retl
6302+ nop
6303+2: BACKOFF_SPIN(%o2, %o3, 1b)
6304+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
6305+
6306 .globl atomic64_add_ret
6307 .type atomic64_add_ret,#function
58c5fc13
MT		 6308 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6309 BACKOFF_SETUP(%o2)
6310 1: ldx [%o1], %g1
6311- add %g1, %o0, %g7
6312+ addcc %g1, %o0, %g7
6313+
6314+#ifdef CONFIG_PAX_REFCOUNT
6315+ tvs %xcc, 6
6316+#endif
6317+
6318 casx [%o1], %g1, %g7
6319 cmp %g1, %g7
6892158b
MT		 6320 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6321@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
ae4e228f
MT		 6322 2: BACKOFF_SPIN(%o2, %o3, 1b)
6323 .size atomic64_add_ret, .-atomic64_add_ret
6324
6325+ .globl atomic64_add_ret_unchecked
6326+ .type atomic64_add_ret_unchecked,#function
6327+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6328+ BACKOFF_SETUP(%o2)
6329+1: ldx [%o1], %g1
6330+ addcc %g1, %o0, %g7
6331+ casx [%o1], %g1, %g7
6332+ cmp %g1, %g7
6333+ bne,pn %xcc, 2f
6334+ add %g7, %o0, %g7
6335+ mov %g7, %o0
6336+ retl
6337+ nop
6338+2: BACKOFF_SPIN(%o2, %o3, 1b)
6339+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
6340+
6341 .globl atomic64_sub_ret
6342 .type atomic64_sub_ret,#function
58c5fc13
MT		 6343 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6344 BACKOFF_SETUP(%o2)
6345 1: ldx [%o1], %g1
6346- sub %g1, %o0, %g7
6347+ subcc %g1, %o0, %g7
6348+
6349+#ifdef CONFIG_PAX_REFCOUNT
6350+ tvs %xcc, 6
6351+#endif
6352+
6353 casx [%o1], %g1, %g7
6354 cmp %g1, %g7
6892158b 6355 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
66a7e928
MT		 6356diff -urNp linux-2.6.39/arch/sparc/lib/ksyms.c linux-2.6.39/arch/sparc/lib/ksyms.c
6357--- linux-2.6.39/arch/sparc/lib/ksyms.c 2011-05-19 00:06:34.000000000 -0400
6358+++ linux-2.6.39/arch/sparc/lib/ksyms.c 2011-05-22 19:36:30.000000000 -0400
57199397 6359@@ -142,12 +142,17 @@ EXPORT_SYMBOL(__downgrade_write);
58c5fc13
MT		 6360
6361 /* Atomic counter implementation. */
6362 EXPORT_SYMBOL(atomic_add);
6363+EXPORT_SYMBOL(atomic_add_unchecked);
6364 EXPORT_SYMBOL(atomic_add_ret);
6365 EXPORT_SYMBOL(atomic_sub);
6366+EXPORT_SYMBOL(atomic_sub_unchecked);
6367 EXPORT_SYMBOL(atomic_sub_ret);
6368 EXPORT_SYMBOL(atomic64_add);
57199397 6369+EXPORT_SYMBOL(atomic64_add_unchecked);
58c5fc13 6370 EXPORT_SYMBOL(atomic64_add_ret);
57199397 6371+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
df50ba0c
MT		 6372 EXPORT_SYMBOL(atomic64_sub);
6373+EXPORT_SYMBOL(atomic64_sub_unchecked);
6374 EXPORT_SYMBOL(atomic64_sub_ret);
6375
6376 /* Atomic bit operations. */
66a7e928
MT		 6377diff -urNp linux-2.6.39/arch/sparc/lib/Makefile linux-2.6.39/arch/sparc/lib/Makefile
6378--- linux-2.6.39/arch/sparc/lib/Makefile 2011-05-19 00:06:34.000000000 -0400
6379+++ linux-2.6.39/arch/sparc/lib/Makefile 2011-05-22 19:36:30.000000000 -0400
6380@@ -2,7 +2,7 @@
6381 #
6382
6383 asflags-y := -ansi -DST_DIV0=0x02
6384-ccflags-y := -Werror
6385+#ccflags-y := -Werror
6386
6387 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
6388 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
6389diff -urNp linux-2.6.39/arch/sparc/Makefile linux-2.6.39/arch/sparc/Makefile
6390--- linux-2.6.39/arch/sparc/Makefile 2011-05-19 00:06:34.000000000 -0400
6391+++ linux-2.6.39/arch/sparc/Makefile 2011-05-22 19:41:32.000000000 -0400
57199397
MT		 6392@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
6393 # Export what is needed by arch/sparc/boot/Makefile
6394 export VMLINUX_INIT VMLINUX_MAIN
6395 VMLINUX_INIT := $(head-y) $(init-y)
6396-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
6397+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
6398 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
6399 VMLINUX_MAIN += $(drivers-y) $(net-y)
efbe55a5 6400
66a7e928
MT		 6401diff -urNp linux-2.6.39/arch/sparc/mm/fault_32.c linux-2.6.39/arch/sparc/mm/fault_32.c
6402--- linux-2.6.39/arch/sparc/mm/fault_32.c 2011-05-19 00:06:34.000000000 -0400
6403+++ linux-2.6.39/arch/sparc/mm/fault_32.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 6404@@ -22,6 +22,9 @@
58c5fc13
MT		 6405 #include <linux/interrupt.h>
6406 #include <linux/module.h>
6407 #include <linux/kdebug.h>
6408+#include <linux/slab.h>
6409+#include <linux/pagemap.h>
6410+#include <linux/compiler.h>
6411
6412 #include <asm/system.h>
6413 #include <asm/page.h>
df50ba0c 6414@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
58c5fc13
MT		 6415 return safe_compute_effective_address(regs, insn);
6416 }
6417
6418+#ifdef CONFIG_PAX_PAGEEXEC
6419+#ifdef CONFIG_PAX_DLRESOLVE
ae4e228f 6420+static void pax_emuplt_close(struct vm_area_struct *vma)
58c5fc13
MT		 6421+{
6422+ vma->vm_mm->call_dl_resolve = 0UL;
6423+}
6424+
6425+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6426+{
6427+ unsigned int *kaddr;
6428+
6429+ vmf->page = alloc_page(GFP_HIGHUSER);
6430+ if (!vmf->page)
6431+ return VM_FAULT_OOM;
6432+
6433+ kaddr = kmap(vmf->page);
6434+ memset(kaddr, 0, PAGE_SIZE);
6435+ kaddr[0] = 0x9DE3BFA8U; /* save */
6436+ flush_dcache_page(vmf->page);
6437+ kunmap(vmf->page);
6438+ return VM_FAULT_MAJOR;
6439+}
6440+
6441+static const struct vm_operations_struct pax_vm_ops = {
6442+ .close = pax_emuplt_close,
6443+ .fault = pax_emuplt_fault
6444+};
6445+
6446+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6447+{
6448+ int ret;
6449+
df50ba0c 6450+ INIT_LIST_HEAD(&vma->anon_vma_chain);
58c5fc13
MT		 6451+ vma->vm_mm = current->mm;
6452+ vma->vm_start = addr;
6453+ vma->vm_end = addr + PAGE_SIZE;
6454+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6455+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6456+ vma->vm_ops = &pax_vm_ops;
6457+
6458+ ret = insert_vm_struct(current->mm, vma);
6459+ if (ret)
6460+ return ret;
6461+
6462+ ++current->mm->total_vm;
6463+ return 0;
6464+}
6465+#endif
6466+
6467+/*
6468+ * PaX: decide what to do with offenders (regs->pc = fault address)
6469+ *
6470+ * returns 1 when task should be killed
6471+ * 2 when patched PLT trampoline was detected
6472+ * 3 when unpatched PLT trampoline was detected
6473+ */
6474+static int pax_handle_fetch_fault(struct pt_regs *regs)
6475+{
6476+
6477+#ifdef CONFIG_PAX_EMUPLT
6478+ int err;
6479+
6480+ do { /* PaX: patched PLT emulation #1 */
6481+ unsigned int sethi1, sethi2, jmpl;
6482+
6483+ err = get_user(sethi1, (unsigned int *)regs->pc);
6484+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
6485+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
6486+
6487+ if (err)
6488+ break;
6489+
6490+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6491+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6492+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6493+ {
6494+ unsigned int addr;
6495+
6496+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6497+ addr = regs->u_regs[UREG_G1];
6498+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6499+ regs->pc = addr;
6500+ regs->npc = addr+4;
6501+ return 2;
6502+ }
6503+ } while (0);
6504+
6505+ { /* PaX: patched PLT emulation #2 */
6506+ unsigned int ba;
6507+
6508+ err = get_user(ba, (unsigned int *)regs->pc);
6509+
6510+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6511+ unsigned int addr;
6512+
6513+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6514+ regs->pc = addr;
6515+ regs->npc = addr+4;
6516+ return 2;
6517+ }
6518+ }
6519+
6520+ do { /* PaX: patched PLT emulation #3 */
6521+ unsigned int sethi, jmpl, nop;
6522+
6523+ err = get_user(sethi, (unsigned int *)regs->pc);
6524+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
6525+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6526+
6527+ if (err)
6528+ break;
6529+
6530+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6531+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6532+ nop == 0x01000000U)
6533+ {
6534+ unsigned int addr;
6535+
6536+ addr = (sethi & 0x003FFFFFU) << 10;
6537+ regs->u_regs[UREG_G1] = addr;
6538+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6539+ regs->pc = addr;
6540+ regs->npc = addr+4;
6541+ return 2;
6542+ }
6543+ } while (0);
6544+
6545+ do { /* PaX: unpatched PLT emulation step 1 */
6546+ unsigned int sethi, ba, nop;
6547+
6548+ err = get_user(sethi, (unsigned int *)regs->pc);
6549+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
6550+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6551+
6552+ if (err)
6553+ break;
6554+
6555+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6556+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6557+ nop == 0x01000000U)
6558+ {
6559+ unsigned int addr, save, call;
6560+
6561+ if ((ba & 0xFFC00000U) == 0x30800000U)
6562+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6563+ else
6564+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6565+
6566+ err = get_user(save, (unsigned int *)addr);
6567+ err |= get_user(call, (unsigned int *)(addr+4));
6568+ err |= get_user(nop, (unsigned int *)(addr+8));
6569+ if (err)
6570+ break;
6571+
6572+#ifdef CONFIG_PAX_DLRESOLVE
6573+ if (save == 0x9DE3BFA8U &&
6574+ (call & 0xC0000000U) == 0x40000000U &&
6575+ nop == 0x01000000U)
6576+ {
6577+ struct vm_area_struct *vma;
6578+ unsigned long call_dl_resolve;
6579+
6580+ down_read(&current->mm->mmap_sem);
6581+ call_dl_resolve = current->mm->call_dl_resolve;
6582+ up_read(&current->mm->mmap_sem);
6583+ if (likely(call_dl_resolve))
6584+ goto emulate;
6585+
6586+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
6587+
6588+ down_write(&current->mm->mmap_sem);
6589+ if (current->mm->call_dl_resolve) {
6590+ call_dl_resolve = current->mm->call_dl_resolve;
6591+ up_write(&current->mm->mmap_sem);
6592+ if (vma)
6593+ kmem_cache_free(vm_area_cachep, vma);
6594+ goto emulate;
6595+ }
6596+
6597+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6598+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
6599+ up_write(&current->mm->mmap_sem);
6600+ if (vma)
6601+ kmem_cache_free(vm_area_cachep, vma);
6602+ return 1;
6603+ }
6604+
6605+ if (pax_insert_vma(vma, call_dl_resolve)) {
6606+ up_write(&current->mm->mmap_sem);
6607+ kmem_cache_free(vm_area_cachep, vma);
6608+ return 1;
6609+ }
6610+
6611+ current->mm->call_dl_resolve = call_dl_resolve;
6612+ up_write(&current->mm->mmap_sem);
6613+
6614+emulate:
6615+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6616+ regs->pc = call_dl_resolve;
6617+ regs->npc = addr+4;
6618+ return 3;
6619+ }
6620+#endif
6621+
6622+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
6623+ if ((save & 0xFFC00000U) == 0x05000000U &&
6624+ (call & 0xFFFFE000U) == 0x85C0A000U &&
6625+ nop == 0x01000000U)
6626+ {
6627+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6628+ regs->u_regs[UREG_G2] = addr + 4;
6629+ addr = (save & 0x003FFFFFU) << 10;
6630+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6631+ regs->pc = addr;
6632+ regs->npc = addr+4;
6633+ return 3;
6634+ }
6635+ }
6636+ } while (0);
6637+
6638+ do { /* PaX: unpatched PLT emulation step 2 */
6639+ unsigned int save, call, nop;
6640+
6641+ err = get_user(save, (unsigned int *)(regs->pc-4));
6642+ err |= get_user(call, (unsigned int *)regs->pc);
6643+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
6644+ if (err)
6645+ break;
6646+
6647+ if (save == 0x9DE3BFA8U &&
6648+ (call & 0xC0000000U) == 0x40000000U &&
6649+ nop == 0x01000000U)
6650+ {
6651+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
6652+
6653+ regs->u_regs[UREG_RETPC] = regs->pc;
6654+ regs->pc = dl_resolve;
6655+ regs->npc = dl_resolve+4;
6656+ return 3;
6657+ }
6658+ } while (0);
6659+#endif
6660+
6661+ return 1;
6662+}
6663+
6664+void pax_report_insns(void *pc, void *sp)
6665+{
6666+ unsigned long i;
6667+
6668+ printk(KERN_ERR "PAX: bytes at PC: ");
ae4e228f 6669+ for (i = 0; i < 8; i++) {
58c5fc13
MT		 6670+ unsigned int c;
6671+ if (get_user(c, (unsigned int *)pc+i))
6672+ printk(KERN_CONT "???????? ");
6673+ else
6674+ printk(KERN_CONT "%08x ", c);
6675+ }
6676+ printk("\n");
6677+}
6678+#endif
6679+
df50ba0c
MT		 6680 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
6681 int text_fault)
58c5fc13 6682 {
71d190be 6683@@ -281,6 +546,24 @@ good_area:
58c5fc13
MT		 6684 if(!(vma->vm_flags & VM_WRITE))
6685 goto bad_area;
6686 } else {
6687+
6688+#ifdef CONFIG_PAX_PAGEEXEC
6689+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
6690+ up_read(&mm->mmap_sem);
6691+ switch (pax_handle_fetch_fault(regs)) {
6692+
6693+#ifdef CONFIG_PAX_EMUPLT
6694+ case 2:
6695+ case 3:
6696+ return;
6697+#endif
6698+
6699+ }
6700+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
6701+ do_group_exit(SIGKILL);
6702+ }
6703+#endif
6704+
6705 /* Allow reads even for write-only mappings */
6706 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
6707 goto bad_area;
66a7e928
MT		 6708diff -urNp linux-2.6.39/arch/sparc/mm/fault_64.c linux-2.6.39/arch/sparc/mm/fault_64.c
6709--- linux-2.6.39/arch/sparc/mm/fault_64.c 2011-05-19 00:06:34.000000000 -0400
6710+++ linux-2.6.39/arch/sparc/mm/fault_64.c 2011-05-22 19:41:32.000000000 -0400
ae4e228f 6711@@ -21,6 +21,9 @@
58c5fc13
MT		 6712 #include <linux/kprobes.h>
6713 #include <linux/kdebug.h>
6714 #include <linux/percpu.h>
6715+#include <linux/slab.h>
6716+#include <linux/pagemap.h>
6717+#include <linux/compiler.h>
6718
6719 #include <asm/page.h>
6720 #include <asm/pgtable.h>
bc901d79
MT		 6721@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
6722 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
6723 regs->tpc);
6724 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
6725- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
6726+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
6727 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
6728 dump_stack();
6729 unhandled_fault(regs->tpc, current, regs);
df50ba0c 6730@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
58c5fc13
MT		 6731 show_regs(regs);
6732 }
6733
6734+#ifdef CONFIG_PAX_PAGEEXEC
6735+#ifdef CONFIG_PAX_DLRESOLVE
6736+static void pax_emuplt_close(struct vm_area_struct *vma)
6737+{
6738+ vma->vm_mm->call_dl_resolve = 0UL;
6739+}
6740+
6741+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6742+{
6743+ unsigned int *kaddr;
6744+
6745+ vmf->page = alloc_page(GFP_HIGHUSER);
6746+ if (!vmf->page)
6747+ return VM_FAULT_OOM;
6748+
6749+ kaddr = kmap(vmf->page);
6750+ memset(kaddr, 0, PAGE_SIZE);
6751+ kaddr[0] = 0x9DE3BFA8U; /* save */
6752+ flush_dcache_page(vmf->page);
6753+ kunmap(vmf->page);
6754+ return VM_FAULT_MAJOR;
6755+}
6756+
6757+static const struct vm_operations_struct pax_vm_ops = {
6758+ .close = pax_emuplt_close,
6759+ .fault = pax_emuplt_fault
6760+};
6761+
6762+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6763+{
6764+ int ret;
6765+
df50ba0c 6766+ INIT_LIST_HEAD(&vma->anon_vma_chain);
58c5fc13
MT		 6767+ vma->vm_mm = current->mm;
6768+ vma->vm_start = addr;
6769+ vma->vm_end = addr + PAGE_SIZE;
6770+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6771+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6772+ vma->vm_ops = &pax_vm_ops;
6773+
6774+ ret = insert_vm_struct(current->mm, vma);
6775+ if (ret)
6776+ return ret;
6777+
6778+ ++current->mm->total_vm;
6779+ return 0;
6780+}
6781+#endif
6782+
6783+/*
6784+ * PaX: decide what to do with offenders (regs->tpc = fault address)
6785+ *
6786+ * returns 1 when task should be killed
6787+ * 2 when patched PLT trampoline was detected
6788+ * 3 when unpatched PLT trampoline was detected
6789+ */
6790+static int pax_handle_fetch_fault(struct pt_regs *regs)
6791+{
6792+
6793+#ifdef CONFIG_PAX_EMUPLT
6794+ int err;
6795+
6796+ do { /* PaX: patched PLT emulation #1 */
6797+ unsigned int sethi1, sethi2, jmpl;
6798+
6799+ err = get_user(sethi1, (unsigned int *)regs->tpc);
6800+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
6801+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
6802+
6803+ if (err)
6804+ break;
6805+
6806+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6807+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6808+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6809+ {
6810+ unsigned long addr;
6811+
6812+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6813+ addr = regs->u_regs[UREG_G1];
6814+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6815+
6816+ if (test_thread_flag(TIF_32BIT))
6817+ addr &= 0xFFFFFFFFUL;
6818+
6819+ regs->tpc = addr;
6820+ regs->tnpc = addr+4;
6821+ return 2;
6822+ }
6823+ } while (0);
6824+
6825+ { /* PaX: patched PLT emulation #2 */
6826+ unsigned int ba;
6827+
6828+ err = get_user(ba, (unsigned int *)regs->tpc);
6829+
6830+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6831+ unsigned long addr;
6832+
6833+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6834+
6835+ if (test_thread_flag(TIF_32BIT))
6836+ addr &= 0xFFFFFFFFUL;
6837+
6838+ regs->tpc = addr;
6839+ regs->tnpc = addr+4;
6840+ return 2;
6841+ }
6842+ }
6843+
6844+ do { /* PaX: patched PLT emulation #3 */
6845+ unsigned int sethi, jmpl, nop;
6846+
6847+ err = get_user(sethi, (unsigned int *)regs->tpc);
6848+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
6849+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
6850+
6851+ if (err)
6852+ break;
6853+
6854+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6855+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6856+ nop == 0x01000000U)
6857+ {
6858+ unsigned long addr;
6859+
6860+ addr = (sethi & 0x003FFFFFU) << 10;
6861+ regs->u_regs[UREG_G1] = addr;
6862+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6863+
6864+ if (test_thread_flag(TIF_32BIT))
6865+ addr &= 0xFFFFFFFFUL;
6866+
6867+ regs->tpc = addr;
6868+ regs->tnpc = addr+4;
6869+ return 2;
6870+ }
6871+ } while (0);
6872+
6873+ do { /* PaX: patched PLT emulation #4 */
ae4e228f 6874+ unsigned int sethi, mov1, call, mov2;
58c5fc13 6875+
ae4e228f
MT		 6876+ err = get_user(sethi, (unsigned int *)regs->tpc);
6877+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
6878+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
6879+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
58c5fc13
MT		 6880+
6881+ if (err)
6882+ break;
6883+
ae4e228f
MT		 6884+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6885+ mov1 == 0x8210000FU &&
58c5fc13
MT		 6886+ (call & 0xC0000000U) == 0x40000000U &&
6887+ mov2 == 0x9E100001U)
6888+ {
6889+ unsigned long addr;
6890+
6891+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
6892+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
6893+
6894+ if (test_thread_flag(TIF_32BIT))
6895+ addr &= 0xFFFFFFFFUL;
6896+
6897+ regs->tpc = addr;
6898+ regs->tnpc = addr+4;
6899+ return 2;
6900+ }
6901+ } while (0);
6902+
6903+ do { /* PaX: patched PLT emulation #5 */
ae4e228f 6904+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
58c5fc13 6905+
ae4e228f
MT		 6906+ err = get_user(sethi, (unsigned int *)regs->tpc);
6907+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
6908+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
6909+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
6910+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
6911+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
6912+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
6913+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
58c5fc13
MT		 6914+
6915+ if (err)
6916+ break;
6917+
ae4e228f
MT		 6918+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6919+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
58c5fc13
MT		 6920+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
6921+ (or1 & 0xFFFFE000U) == 0x82106000U &&
6922+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
ae4e228f 6923+ sllx == 0x83287020U &&
58c5fc13
MT		 6924+ jmpl == 0x81C04005U &&
6925+ nop == 0x01000000U)
6926+ {
6927+ unsigned long addr;
6928+
6929+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
6930+ regs->u_regs[UREG_G1] <<= 32;
6931+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
6932+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
6933+ regs->tpc = addr;
6934+ regs->tnpc = addr+4;
6935+ return 2;
6936+ }
6937+ } while (0);
6938+
6939+ do { /* PaX: patched PLT emulation #6 */
ae4e228f 6940+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
58c5fc13 6941+
ae4e228f
MT		 6942+ err = get_user(sethi, (unsigned int *)regs->tpc);
6943+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
6944+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
6945+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
6946+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
6947+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
6948+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
58c5fc13
MT		 6949+
6950+ if (err)
6951+ break;
6952+
ae4e228f
MT		 6953+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6954+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
58c5fc13 6955+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
ae4e228f 6956+ sllx == 0x83287020U &&
58c5fc13
MT		 6957+ (or & 0xFFFFE000U) == 0x8A116000U &&
6958+ jmpl == 0x81C04005U &&
6959+ nop == 0x01000000U)
6960+ {
6961+ unsigned long addr;
6962+
6963+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
6964+ regs->u_regs[UREG_G1] <<= 32;
6965+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
6966+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
6967+ regs->tpc = addr;
6968+ regs->tnpc = addr+4;
6969+ return 2;
6970+ }
6971+ } while (0);
6972+
6973+ do { /* PaX: unpatched PLT emulation step 1 */
6974+ unsigned int sethi, ba, nop;
6975+
6976+ err = get_user(sethi, (unsigned int *)regs->tpc);
6977+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
6978+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
6979+
6980+ if (err)
6981+ break;
6982+
6983+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6984+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6985+ nop == 0x01000000U)
6986+ {
6987+ unsigned long addr;
6988+ unsigned int save, call;
ae4e228f 6989+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
58c5fc13
MT		 6990+
6991+ if ((ba & 0xFFC00000U) == 0x30800000U)
6992+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6993+ else
6994+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
6995+
6996+ if (test_thread_flag(TIF_32BIT))
6997+ addr &= 0xFFFFFFFFUL;
6998+
6999+ err = get_user(save, (unsigned int *)addr);
7000+ err |= get_user(call, (unsigned int *)(addr+4));
7001+ err |= get_user(nop, (unsigned int *)(addr+8));
7002+ if (err)
7003+ break;
7004+
7005+#ifdef CONFIG_PAX_DLRESOLVE
7006+ if (save == 0x9DE3BFA8U &&
7007+ (call & 0xC0000000U) == 0x40000000U &&
7008+ nop == 0x01000000U)
7009+ {
7010+ struct vm_area_struct *vma;
7011+ unsigned long call_dl_resolve;
7012+
7013+ down_read(&current->mm->mmap_sem);
7014+ call_dl_resolve = current->mm->call_dl_resolve;
7015+ up_read(&current->mm->mmap_sem);
7016+ if (likely(call_dl_resolve))
7017+ goto emulate;
7018+
7019+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
7020+
7021+ down_write(&current->mm->mmap_sem);
7022+ if (current->mm->call_dl_resolve) {
7023+ call_dl_resolve = current->mm->call_dl_resolve;
7024+ up_write(&current->mm->mmap_sem);
7025+ if (vma)
7026+ kmem_cache_free(vm_area_cachep, vma);
7027+ goto emulate;
7028+ }
7029+
7030+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7031+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7032+ up_write(&current->mm->mmap_sem);
7033+ if (vma)
7034+ kmem_cache_free(vm_area_cachep, vma);
7035+ return 1;
7036+ }
7037+
7038+ if (pax_insert_vma(vma, call_dl_resolve)) {
7039+ up_write(&current->mm->mmap_sem);
7040+ kmem_cache_free(vm_area_cachep, vma);
7041+ return 1;
7042+ }
7043+
7044+ current->mm->call_dl_resolve = call_dl_resolve;
7045+ up_write(&current->mm->mmap_sem);
7046+
7047+emulate:
7048+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7049+ regs->tpc = call_dl_resolve;
7050+ regs->tnpc = addr+4;
7051+ return 3;
7052+ }
7053+#endif
7054+
7055+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
7056+ if ((save & 0xFFC00000U) == 0x05000000U &&
7057+ (call & 0xFFFFE000U) == 0x85C0A000U &&
7058+ nop == 0x01000000U)
7059+ {
7060+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7061+ regs->u_regs[UREG_G2] = addr + 4;
7062+ addr = (save & 0x003FFFFFU) << 10;
7063+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7064+
7065+ if (test_thread_flag(TIF_32BIT))
7066+ addr &= 0xFFFFFFFFUL;
7067+
7068+ regs->tpc = addr;
7069+ regs->tnpc = addr+4;
7070+ return 3;
7071+ }
ae4e228f
MT		 7072+
7073+ /* PaX: 64-bit PLT stub */
7074+ err = get_user(sethi1, (unsigned int *)addr);
7075+ err |= get_user(sethi2, (unsigned int *)(addr+4));
7076+ err |= get_user(or1, (unsigned int *)(addr+8));
7077+ err |= get_user(or2, (unsigned int *)(addr+12));
7078+ err |= get_user(sllx, (unsigned int *)(addr+16));
7079+ err |= get_user(add, (unsigned int *)(addr+20));
7080+ err |= get_user(jmpl, (unsigned int *)(addr+24));
7081+ err |= get_user(nop, (unsigned int *)(addr+28));
7082+ if (err)
7083+ break;
7084+
7085+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
7086+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7087+ (or1 & 0xFFFFE000U) == 0x88112000U &&
7088+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
7089+ sllx == 0x89293020U &&
7090+ add == 0x8A010005U &&
7091+ jmpl == 0x89C14000U &&
7092+ nop == 0x01000000U)
7093+ {
7094+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7095+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7096+ regs->u_regs[UREG_G4] <<= 32;
7097+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7098+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
7099+ regs->u_regs[UREG_G4] = addr + 24;
7100+ addr = regs->u_regs[UREG_G5];
7101+ regs->tpc = addr;
7102+ regs->tnpc = addr+4;
7103+ return 3;
7104+ }
58c5fc13
MT		 7105+ }
7106+ } while (0);
7107+
7108+#ifdef CONFIG_PAX_DLRESOLVE
7109+ do { /* PaX: unpatched PLT emulation step 2 */
7110+ unsigned int save, call, nop;
7111+
7112+ err = get_user(save, (unsigned int *)(regs->tpc-4));
7113+ err |= get_user(call, (unsigned int *)regs->tpc);
7114+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
7115+ if (err)
7116+ break;
7117+
7118+ if (save == 0x9DE3BFA8U &&
7119+ (call & 0xC0000000U) == 0x40000000U &&
7120+ nop == 0x01000000U)
7121+ {
7122+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7123+
7124+ if (test_thread_flag(TIF_32BIT))
7125+ dl_resolve &= 0xFFFFFFFFUL;
7126+
7127+ regs->u_regs[UREG_RETPC] = regs->tpc;
7128+ regs->tpc = dl_resolve;
7129+ regs->tnpc = dl_resolve+4;
7130+ return 3;
7131+ }
7132+ } while (0);
7133+#endif
7134+
7135+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
7136+ unsigned int sethi, ba, nop;
7137+
7138+ err = get_user(sethi, (unsigned int *)regs->tpc);
7139+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7140+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7141+
7142+ if (err)
7143+ break;
7144+
7145+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7146+ (ba & 0xFFF00000U) == 0x30600000U &&
7147+ nop == 0x01000000U)
7148+ {
7149+ unsigned long addr;
7150+
7151+ addr = (sethi & 0x003FFFFFU) << 10;
7152+ regs->u_regs[UREG_G1] = addr;
7153+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7154+
7155+ if (test_thread_flag(TIF_32BIT))
7156+ addr &= 0xFFFFFFFFUL;
7157+
7158+ regs->tpc = addr;
7159+ regs->tnpc = addr+4;
7160+ return 2;
7161+ }
7162+ } while (0);
7163+
7164+#endif
7165+
7166+ return 1;
7167+}
7168+
7169+void pax_report_insns(void *pc, void *sp)
7170+{
7171+ unsigned long i;
7172+
7173+ printk(KERN_ERR "PAX: bytes at PC: ");
ae4e228f 7174+ for (i = 0; i < 8; i++) {
58c5fc13
MT		 7175+ unsigned int c;
7176+ if (get_user(c, (unsigned int *)pc+i))
7177+ printk(KERN_CONT "???????? ");
7178+ else
7179+ printk(KERN_CONT "%08x ", c);
7180+ }
7181+ printk("\n");
7182+}
7183+#endif
7184+
7185 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7186 {
7187 struct mm_struct *mm = current->mm;
df50ba0c 7188@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
58c5fc13
MT		 7189 if (!vma)
7190 goto bad_area;
7191
7192+#ifdef CONFIG_PAX_PAGEEXEC
7193+ /* PaX: detect ITLB misses on non-exec pages */
7194+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7195+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7196+ {
7197+ if (address != regs->tpc)
7198+ goto good_area;
7199+
7200+ up_read(&mm->mmap_sem);
7201+ switch (pax_handle_fetch_fault(regs)) {
7202+
7203+#ifdef CONFIG_PAX_EMUPLT
7204+ case 2:
7205+ case 3:
7206+ return;
7207+#endif
7208+
7209+ }
7210+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
7211+ do_group_exit(SIGKILL);
7212+ }
7213+#endif
7214+
7215 /* Pure DTLB misses do not tell us whether the fault causing
7216 * load/store/atomic was a write or not, it only says that there
7217 * was no match. So in such a case we (carefully) read the
66a7e928
MT		 7218diff -urNp linux-2.6.39/arch/sparc/mm/hugetlbpage.c linux-2.6.39/arch/sparc/mm/hugetlbpage.c
7219--- linux-2.6.39/arch/sparc/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
7220+++ linux-2.6.39/arch/sparc/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 7221@@ -68,7 +68,7 @@ full_search:
7222 }
7223 return -ENOMEM;
7224 }
7225- if (likely(!vma || addr + len <= vma->vm_start)) {
7226+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7227 /*
7228 * Remember the place where we stopped the search:
7229 */
7230@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
7231 /* make sure it can fit in the remaining address space */
7232 if (likely(addr > len)) {
7233 vma = find_vma(mm, addr-len);
7234- if (!vma || addr <= vma->vm_start) {
7235+ if (check_heap_stack_gap(vma, addr - len, len)) {
7236 /* remember the address as a hint for next time */
7237 return (mm->free_area_cache = addr-len);
7238 }
16454cff
MT		 7239@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
7240 if (unlikely(mm->mmap_base < len))
7241 goto bottomup;
7242
7243- addr = (mm->mmap_base-len) & HPAGE_MASK;
7244+ addr = mm->mmap_base - len;
7245
7246 do {
7247+ addr &= HPAGE_MASK;
7248 /*
7249 * Lookup failure means no vma is above this address,
7250 * else if new region fits below vma->vm_start,
57199397
MT		 7251 * return with success:
7252 */
7253 vma = find_vma(mm, addr);
7254- if (likely(!vma || addr+len <= vma->vm_start)) {
7255+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7256 /* remember the address as a hint for next time */
7257 return (mm->free_area_cache = addr);
7258 }
16454cff
MT		 7259@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
7260 mm->cached_hole_size = vma->vm_start - addr;
7261
7262 /* try just below the current vma->vm_start */
7263- addr = (vma->vm_start-len) & HPAGE_MASK;
7264- } while (likely(len < vma->vm_start));
7265+ addr = skip_heap_stack_gap(vma, len);
7266+ } while (!IS_ERR_VALUE(addr));
7267
7268 bottomup:
7269 /*
7270@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
57199397
MT		 7271 if (addr) {
7272 addr = ALIGN(addr, HPAGE_SIZE);
7273 vma = find_vma(mm, addr);
7274- if (task_size - len >= addr &&
7275- (!vma || addr + len <= vma->vm_start))
7276+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
7277 return addr;
7278 }
7279 if (mm->get_unmapped_area == arch_get_unmapped_area)
66a7e928
MT		 7280diff -urNp linux-2.6.39/arch/sparc/mm/init_32.c linux-2.6.39/arch/sparc/mm/init_32.c
7281--- linux-2.6.39/arch/sparc/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
7282+++ linux-2.6.39/arch/sparc/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 7283@@ -318,6 +318,9 @@ extern void device_scan(void);
58c5fc13
MT		 7284 pgprot_t PAGE_SHARED __read_mostly;
7285 EXPORT_SYMBOL(PAGE_SHARED);
7286
7287+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
7288+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
7289+
7290 void __init paging_init(void)
7291 {
7292 switch(sparc_cpu_model) {
df50ba0c 7293@@ -346,17 +349,17 @@ void __init paging_init(void)
58c5fc13
MT		 7294
7295 /* Initialize the protection map with non-constant, MMU dependent values. */
7296 protection_map[0] = PAGE_NONE;
7297- protection_map[1] = PAGE_READONLY;
7298- protection_map[2] = PAGE_COPY;
7299- protection_map[3] = PAGE_COPY;
7300+ protection_map[1] = PAGE_READONLY_NOEXEC;
7301+ protection_map[2] = PAGE_COPY_NOEXEC;
7302+ protection_map[3] = PAGE_COPY_NOEXEC;
7303 protection_map[4] = PAGE_READONLY;
7304 protection_map[5] = PAGE_READONLY;
7305 protection_map[6] = PAGE_COPY;
7306 protection_map[7] = PAGE_COPY;
7307 protection_map[8] = PAGE_NONE;
7308- protection_map[9] = PAGE_READONLY;
7309- protection_map[10] = PAGE_SHARED;
7310- protection_map[11] = PAGE_SHARED;
7311+ protection_map[9] = PAGE_READONLY_NOEXEC;
7312+ protection_map[10] = PAGE_SHARED_NOEXEC;
7313+ protection_map[11] = PAGE_SHARED_NOEXEC;
7314 protection_map[12] = PAGE_READONLY;
7315 protection_map[13] = PAGE_READONLY;
7316 protection_map[14] = PAGE_SHARED;
66a7e928
MT		 7317diff -urNp linux-2.6.39/arch/sparc/mm/Makefile linux-2.6.39/arch/sparc/mm/Makefile
7318--- linux-2.6.39/arch/sparc/mm/Makefile 2011-05-19 00:06:34.000000000 -0400
7319+++ linux-2.6.39/arch/sparc/mm/Makefile 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 7320@@ -2,7 +2,7 @@
7321 #
7322
7323 asflags-y := -ansi
7324-ccflags-y := -Werror
7325+#ccflags-y := -Werror
7326
7327 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
7328 obj-y += fault_$(BITS).o
66a7e928
MT		 7329diff -urNp linux-2.6.39/arch/sparc/mm/srmmu.c linux-2.6.39/arch/sparc/mm/srmmu.c
7330--- linux-2.6.39/arch/sparc/mm/srmmu.c 2011-05-19 00:06:34.000000000 -0400
7331+++ linux-2.6.39/arch/sparc/mm/srmmu.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 7332@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
58c5fc13
MT		 7333 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
7334 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
7335 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
7336+
7337+#ifdef CONFIG_PAX_PAGEEXEC
7338+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
7339+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
7340+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
7341+#endif
7342+
7343 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
7344 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
7345
66a7e928
MT		 7346diff -urNp linux-2.6.39/arch/tile/kernel/pci.c linux-2.6.39/arch/tile/kernel/pci.c
7347--- linux-2.6.39/arch/tile/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7348+++ linux-2.6.39/arch/tile/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7349@@ -60,7 +60,7 @@ int __write_once tile_plx_gen1;
7350 static struct pci_controller controllers[TILE_NUM_PCIE];
7351 static int num_controllers;
7352
7353-static struct pci_ops tile_cfg_ops;
7354+static const struct pci_ops tile_cfg_ops;
7355
7356
7357 /*
7358@@ -564,7 +564,7 @@ static int __devinit tile_cfg_write(stru
7359 }
7360
7361
7362-static struct pci_ops tile_cfg_ops = {
7363+static const struct pci_ops tile_cfg_ops = {
7364 .read = tile_cfg_read,
7365 .write = tile_cfg_write,
7366 };
7367diff -urNp linux-2.6.39/arch/um/include/asm/kmap_types.h linux-2.6.39/arch/um/include/asm/kmap_types.h
7368--- linux-2.6.39/arch/um/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
7369+++ linux-2.6.39/arch/um/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 7370@@ -23,6 +23,7 @@ enum km_type {
7371 KM_IRQ1,
7372 KM_SOFTIRQ0,
7373 KM_SOFTIRQ1,
7374+ KM_CLEARPAGE,
7375 KM_TYPE_NR
7376 };
7377
66a7e928
MT		 7378diff -urNp linux-2.6.39/arch/um/include/asm/page.h linux-2.6.39/arch/um/include/asm/page.h
7379--- linux-2.6.39/arch/um/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
7380+++ linux-2.6.39/arch/um/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 7381@@ -14,6 +14,9 @@
7382 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
7383 #define PAGE_MASK (~(PAGE_SIZE-1))
7384
7385+#define ktla_ktva(addr) (addr)
7386+#define ktva_ktla(addr) (addr)
7387+
7388 #ifndef __ASSEMBLY__
7389
7390 struct page;
66a7e928
MT		 7391diff -urNp linux-2.6.39/arch/um/kernel/process.c linux-2.6.39/arch/um/kernel/process.c
7392--- linux-2.6.39/arch/um/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
7393+++ linux-2.6.39/arch/um/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 7394@@ -404,22 +404,6 @@ int singlestepping(void * t)
7395 return 2;
7396 }
7397
7398-/*
7399- * Only x86 and x86_64 have an arch_align_stack().
7400- * All other arches have "#define arch_align_stack(x) (x)"
7401- * in their asm/system.h
7402- * As this is included in UML from asm-um/system-generic.h,
7403- * we can use it to behave as the subarch does.
7404- */
7405-#ifndef arch_align_stack
7406-unsigned long arch_align_stack(unsigned long sp)
7407-{
7408- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
7409- sp -= get_random_int() % 8192;
7410- return sp & ~0xf;
7411-}
7412-#endif
7413-
7414 unsigned long get_wchan(struct task_struct *p)
7415 {
7416 unsigned long stack_page, sp, ip;
66a7e928
MT		 7417diff -urNp linux-2.6.39/arch/um/sys-i386/syscalls.c linux-2.6.39/arch/um/sys-i386/syscalls.c
7418--- linux-2.6.39/arch/um/sys-i386/syscalls.c 2011-05-19 00:06:34.000000000 -0400
7419+++ linux-2.6.39/arch/um/sys-i386/syscalls.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 7420@@ -11,6 +11,21 @@
7421 #include "asm/uaccess.h"
7422 #include "asm/unistd.h"
7423
7424+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
7425+{
7426+ unsigned long pax_task_size = TASK_SIZE;
7427+
7428+#ifdef CONFIG_PAX_SEGMEXEC
7429+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
7430+ pax_task_size = SEGMEXEC_TASK_SIZE;
7431+#endif
7432+
7433+ if (len > pax_task_size || addr > pax_task_size - len)
7434+ return -EINVAL;
7435+
7436+ return 0;
7437+}
7438+
7439 /*
df50ba0c
MT		 7440 * The prototype on i386 is:
7441 *
66a7e928
MT		 7442diff -urNp linux-2.6.39/arch/unicore32/kernel/pci.c linux-2.6.39/arch/unicore32/kernel/pci.c
7443--- linux-2.6.39/arch/unicore32/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7444+++ linux-2.6.39/arch/unicore32/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7445@@ -66,7 +66,7 @@ puv3_write_config(struct pci_bus *bus, u
7446 return PCIBIOS_SUCCESSFUL;
7447 }
7448
7449-struct pci_ops pci_puv3_ops = {
7450+const struct pci_ops pci_puv3_ops = {
7451 .read = puv3_read_config,
7452 .write = puv3_write_config,
7453 };
7454diff -urNp linux-2.6.39/arch/x86/boot/bitops.h linux-2.6.39/arch/x86/boot/bitops.h
7455--- linux-2.6.39/arch/x86/boot/bitops.h 2011-05-19 00:06:34.000000000 -0400
7456+++ linux-2.6.39/arch/x86/boot/bitops.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 7457@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
7458 u8 v;
7459 const u32 *p = (const u32 *)addr;
7460
7461- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7462+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7463 return v;
7464 }
7465
7466@@ -37,7 +37,7 @@ static inline int variable_test_bit(int
7467
7468 static inline void set_bit(int nr, void *addr)
7469 {
7470- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7471+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7472 }
7473
7474 #endif /* BOOT_BITOPS_H */
66a7e928
MT		 7475diff -urNp linux-2.6.39/arch/x86/boot/boot.h linux-2.6.39/arch/x86/boot/boot.h
7476--- linux-2.6.39/arch/x86/boot/boot.h 2011-05-19 00:06:34.000000000 -0400
7477+++ linux-2.6.39/arch/x86/boot/boot.h 2011-05-22 19:36:30.000000000 -0400
6892158b 7478@@ -85,7 +85,7 @@ static inline void io_delay(void)
58c5fc13
MT		 7479 static inline u16 ds(void)
7480 {
7481 u16 seg;
7482- asm("movw %%ds,%0" : "=rm" (seg));
7483+ asm volatile("movw %%ds,%0" : "=rm" (seg));
7484 return seg;
7485 }
7486
6892158b 7487@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
58c5fc13
MT		 7488 static inline int memcmp(const void *s1, const void *s2, size_t len)
7489 {
7490 u8 diff;
7491- asm("repe; cmpsb; setnz %0"
7492+ asm volatile("repe; cmpsb; setnz %0"
7493 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
7494 return diff;
7495 }
66a7e928
MT		 7496diff -urNp linux-2.6.39/arch/x86/boot/compressed/head_32.S linux-2.6.39/arch/x86/boot/compressed/head_32.S
7497--- linux-2.6.39/arch/x86/boot/compressed/head_32.S 2011-05-19 00:06:34.000000000 -0400
7498+++ linux-2.6.39/arch/x86/boot/compressed/head_32.S 2011-05-22 19:36:30.000000000 -0400
ae4e228f 7499@@ -76,7 +76,7 @@ ENTRY(startup_32)
58c5fc13
MT		 7500 notl %eax
7501 andl %eax, %ebx
7502 #else
7503- movl $LOAD_PHYSICAL_ADDR, %ebx
7504+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7505 #endif
7506
7507 /* Target address to relocate to for decompression */
6892158b 7508@@ -162,7 +162,7 @@ relocated:
58c5fc13
MT		 7509 * and where it was actually loaded.
7510 */
7511 movl %ebp, %ebx
7512- subl $LOAD_PHYSICAL_ADDR, %ebx
7513+ subl $____LOAD_PHYSICAL_ADDR, %ebx
7514 jz 2f /* Nothing to be done if loaded at compiled addr. */
7515 /*
7516 * Process relocations.
6892158b 7517@@ -170,8 +170,7 @@ relocated:
58c5fc13
MT		 7518
7519 1: subl $4, %edi
7520 movl (%edi), %ecx
7521- testl %ecx, %ecx
7522- jz 2f
7523+ jecxz 2f
7524 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
7525 jmp 1b
7526 2:
66a7e928
MT		 7527diff -urNp linux-2.6.39/arch/x86/boot/compressed/head_64.S linux-2.6.39/arch/x86/boot/compressed/head_64.S
7528--- linux-2.6.39/arch/x86/boot/compressed/head_64.S 2011-05-19 00:06:34.000000000 -0400
7529+++ linux-2.6.39/arch/x86/boot/compressed/head_64.S 2011-05-22 19:36:30.000000000 -0400
ae4e228f 7530@@ -91,7 +91,7 @@ ENTRY(startup_32)
58c5fc13
MT		 7531 notl %eax
7532 andl %eax, %ebx
7533 #else
7534- movl $LOAD_PHYSICAL_ADDR, %ebx
7535+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7536 #endif
7537
7538 /* Target address to relocate to for decompression */
7539@@ -233,7 +233,7 @@ ENTRY(startup_64)
7540 notq %rax
7541 andq %rax, %rbp
7542 #else
7543- movq $LOAD_PHYSICAL_ADDR, %rbp
7544+ movq $____LOAD_PHYSICAL_ADDR, %rbp
7545 #endif
7546
7547 /* Target address to relocate to for decompression */
66a7e928
MT		 7548diff -urNp linux-2.6.39/arch/x86/boot/compressed/misc.c linux-2.6.39/arch/x86/boot/compressed/misc.c
7549--- linux-2.6.39/arch/x86/boot/compressed/misc.c 2011-05-19 00:06:34.000000000 -0400
7550+++ linux-2.6.39/arch/x86/boot/compressed/misc.c 2011-05-22 19:36:30.000000000 -0400
16454cff 7551@@ -310,7 +310,7 @@ static void parse_elf(void *output)
58c5fc13
MT		 7552 case PT_LOAD:
7553 #ifdef CONFIG_RELOCATABLE
7554 dest = output;
7555- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
7556+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
7557 #else
7558 dest = (void *)(phdr->p_paddr);
7559 #endif
16454cff 7560@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
58c5fc13
MT		 7561 error("Destination address too large");
7562 #endif
7563 #ifndef CONFIG_RELOCATABLE
7564- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
7565+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
7566 error("Wrong destination address");
7567 #endif
7568
66a7e928
MT		 7569diff -urNp linux-2.6.39/arch/x86/boot/compressed/relocs.c linux-2.6.39/arch/x86/boot/compressed/relocs.c
7570--- linux-2.6.39/arch/x86/boot/compressed/relocs.c 2011-05-19 00:06:34.000000000 -0400
7571+++ linux-2.6.39/arch/x86/boot/compressed/relocs.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 7572@@ -13,8 +13,11 @@
58c5fc13 7573
ae4e228f
MT		 7574 static void die(char *fmt, ...);
7575
7576+#include "../../../../include/generated/autoconf.h"
58c5fc13
MT		 7577+
7578 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
7579 static Elf32_Ehdr ehdr;
7580+static Elf32_Phdr *phdr;
7581 static unsigned long reloc_count, reloc_idx;
7582 static unsigned long *relocs;
7583
ae4e228f 7584@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
58c5fc13
MT		 7585 }
7586 }
7587
7588+static void read_phdrs(FILE *fp)
7589+{
7590+ unsigned int i;
7591+
7592+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
7593+ if (!phdr) {
7594+ die("Unable to allocate %d program headers\n",
7595+ ehdr.e_phnum);
7596+ }
7597+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
7598+ die("Seek to %d failed: %s\n",
7599+ ehdr.e_phoff, strerror(errno));
7600+ }
7601+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
7602+ die("Cannot read ELF program headers: %s\n",
7603+ strerror(errno));
7604+ }
7605+ for(i = 0; i < ehdr.e_phnum; i++) {
7606+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
7607+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
7608+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
7609+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
7610+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
7611+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
7612+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
7613+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
7614+ }
7615+
7616+}
7617+
7618 static void read_shdrs(FILE *fp)
7619 {
7620- int i;
7621+ unsigned int i;
7622 Elf32_Shdr shdr;
7623
7624 secs = calloc(ehdr.e_shnum, sizeof(struct section));
ae4e228f 7625@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
58c5fc13
MT		 7626
7627 static void read_strtabs(FILE *fp)
7628 {
7629- int i;
7630+ unsigned int i;
7631 for (i = 0; i < ehdr.e_shnum; i++) {
7632 struct section *sec = &secs[i];
7633 if (sec->shdr.sh_type != SHT_STRTAB) {
ae4e228f 7634@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
58c5fc13
MT		 7635
7636 static void read_symtabs(FILE *fp)
7637 {
7638- int i,j;
7639+ unsigned int i,j;
7640 for (i = 0; i < ehdr.e_shnum; i++) {
7641 struct section *sec = &secs[i];
7642 if (sec->shdr.sh_type != SHT_SYMTAB) {
ae4e228f 7643@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
58c5fc13
MT		 7644
7645 static void read_relocs(FILE *fp)
7646 {
7647- int i,j;
7648+ unsigned int i,j;
7649+ uint32_t base;
7650+
7651 for (i = 0; i < ehdr.e_shnum; i++) {
7652 struct section *sec = &secs[i];
7653 if (sec->shdr.sh_type != SHT_REL) {
ae4e228f 7654@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
58c5fc13
MT		 7655 die("Cannot read symbol table: %s\n",
7656 strerror(errno));
7657 }
7658+ base = 0;
7659+ for (j = 0; j < ehdr.e_phnum; j++) {
7660+ if (phdr[j].p_type != PT_LOAD )
7661+ continue;
7662+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
7663+ continue;
7664+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
7665+ break;
7666+ }
7667 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
7668 Elf32_Rel *rel = &sec->reltab[j];
7669- rel->r_offset = elf32_to_cpu(rel->r_offset);
7670+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
7671 rel->r_info = elf32_to_cpu(rel->r_info);
7672 }
7673 }
ae4e228f 7674@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
58c5fc13
MT		 7675
7676 static void print_absolute_symbols(void)
7677 {
7678- int i;
7679+ unsigned int i;
7680 printf("Absolute symbols\n");
7681 printf(" Num: Value Size Type Bind Visibility Name\n");
7682 for (i = 0; i < ehdr.e_shnum; i++) {
7683 struct section *sec = &secs[i];
7684 char *sym_strtab;
7685 Elf32_Sym *sh_symtab;
7686- int j;
7687+ unsigned int j;
7688
7689 if (sec->shdr.sh_type != SHT_SYMTAB) {
7690 continue;
ae4e228f 7691@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
58c5fc13
MT		 7692
7693 static void print_absolute_relocs(void)
7694 {
7695- int i, printed = 0;
7696+ unsigned int i, printed = 0;
7697
7698 for (i = 0; i < ehdr.e_shnum; i++) {
7699 struct section *sec = &secs[i];
7700 struct section *sec_applies, *sec_symtab;
7701 char *sym_strtab;
7702 Elf32_Sym *sh_symtab;
7703- int j;
7704+ unsigned int j;
7705 if (sec->shdr.sh_type != SHT_REL) {
7706 continue;
7707 }
ae4e228f 7708@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
58c5fc13
MT		 7709
7710 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
7711 {
7712- int i;
7713+ unsigned int i;
7714 /* Walk through the relocations */
7715 for (i = 0; i < ehdr.e_shnum; i++) {
7716 char *sym_strtab;
7717 Elf32_Sym *sh_symtab;
7718 struct section *sec_applies, *sec_symtab;
7719- int j;
7720+ unsigned int j;
7721 struct section *sec = &secs[i];
7722
7723 if (sec->shdr.sh_type != SHT_REL) {
ae4e228f
MT		 7724@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
7725 !is_rel_reloc(sym_name(sym_strtab, sym))) {
58c5fc13
MT		 7726 continue;
7727 }
7728+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
57199397 7729+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
58c5fc13
MT		 7730+ continue;
7731+
7732+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
7733+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
57199397 7734+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
ae4e228f 7735+ continue;
58c5fc13
MT		 7736+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
7737+ continue;
7738+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
7739+ continue;
7740+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
7741+ continue;
7742+#endif
ae4e228f
MT		 7743+
7744 switch (r_type) {
7745 case R_386_NONE:
7746 case R_386_PC32:
7747@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
58c5fc13
MT		 7748
7749 static void emit_relocs(int as_text)
7750 {
7751- int i;
7752+ unsigned int i;
7753 /* Count how many relocations I have and allocate space for them. */
7754 reloc_count = 0;
7755 walk_relocs(count_reloc);
ae4e228f 7756@@ -665,6 +725,7 @@ int main(int argc, char **argv)
58c5fc13
MT		 7757 fname, strerror(errno));
7758 }
7759 read_ehdr(fp);
7760+ read_phdrs(fp);
7761 read_shdrs(fp);
7762 read_strtabs(fp);
7763 read_symtabs(fp);
66a7e928
MT		 7764diff -urNp linux-2.6.39/arch/x86/boot/cpucheck.c linux-2.6.39/arch/x86/boot/cpucheck.c
7765--- linux-2.6.39/arch/x86/boot/cpucheck.c 2011-05-19 00:06:34.000000000 -0400
7766+++ linux-2.6.39/arch/x86/boot/cpucheck.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 7767@@ -74,7 +74,7 @@ static int has_fpu(void)
7768 u16 fcw = -1, fsw = -1;
7769 u32 cr0;
7770
7771- asm("movl %%cr0,%0" : "=r" (cr0));
7772+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
7773 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
7774 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
7775 asm volatile("movl %0,%%cr0" : : "r" (cr0));
7776@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
7777 {
7778 u32 f0, f1;
7779
7780- asm("pushfl ; "
7781+ asm volatile("pushfl ; "
7782 "pushfl ; "
7783 "popl %0 ; "
7784 "movl %0,%1 ; "
7785@@ -115,7 +115,7 @@ static void get_flags(void)
7786 set_bit(X86_FEATURE_FPU, cpu.flags);
7787
7788 if (has_eflag(X86_EFLAGS_ID)) {
7789- asm("cpuid"
7790+ asm volatile("cpuid"
7791 : "=a" (max_intel_level),
7792 "=b" (cpu_vendor[0]),
7793 "=d" (cpu_vendor[1]),
7794@@ -124,7 +124,7 @@ static void get_flags(void)
7795
7796 if (max_intel_level >= 0x00000001 &&
7797 max_intel_level <= 0x0000ffff) {
7798- asm("cpuid"
7799+ asm volatile("cpuid"
7800 : "=a" (tfms),
7801 "=c" (cpu.flags[4]),
7802 "=d" (cpu.flags[0])
7803@@ -136,7 +136,7 @@ static void get_flags(void)
7804 cpu.model += ((tfms >> 16) & 0xf) << 4;
7805 }
7806
7807- asm("cpuid"
7808+ asm volatile("cpuid"
7809 : "=a" (max_amd_level)
7810 : "a" (0x80000000)
7811 : "ebx", "ecx", "edx");
7812@@ -144,7 +144,7 @@ static void get_flags(void)
7813 if (max_amd_level >= 0x80000001 &&
7814 max_amd_level <= 0x8000ffff) {
7815 u32 eax = 0x80000001;
7816- asm("cpuid"
7817+ asm volatile("cpuid"
7818 : "+a" (eax),
7819 "=c" (cpu.flags[6]),
7820 "=d" (cpu.flags[1])
7821@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7822 u32 ecx = MSR_K7_HWCR;
7823 u32 eax, edx;
7824
7825- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7826+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7827 eax &= ~(1 << 15);
7828- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7829+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7830
7831 get_flags(); /* Make sure it really did something */
7832 err = check_flags();
7833@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7834 u32 ecx = MSR_VIA_FCR;
7835 u32 eax, edx;
7836
7837- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7838+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7839 eax |= (1<<1)|(1<<7);
7840- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7841+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7842
7843 set_bit(X86_FEATURE_CX8, cpu.flags);
7844 err = check_flags();
7845@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
7846 u32 eax, edx;
7847 u32 level = 1;
7848
7849- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7850- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
7851- asm("cpuid"
7852+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7853+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
7854+ asm volatile("cpuid"
7855 : "+a" (level), "=d" (cpu.flags[0])
7856 : : "ecx", "ebx");
7857- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7858+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7859
7860 err = check_flags();
7861 }
66a7e928
MT		 7862diff -urNp linux-2.6.39/arch/x86/boot/header.S linux-2.6.39/arch/x86/boot/header.S
7863--- linux-2.6.39/arch/x86/boot/header.S 2011-05-19 00:06:34.000000000 -0400
7864+++ linux-2.6.39/arch/x86/boot/header.S 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 7865@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
7866 # single linked list of
7867 # struct setup_data
7868
7869-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
7870+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
7871
7872 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
7873 #define VO_INIT_SIZE (VO__end - VO__text)
66a7e928
MT		 7874diff -urNp linux-2.6.39/arch/x86/boot/memory.c linux-2.6.39/arch/x86/boot/memory.c
7875--- linux-2.6.39/arch/x86/boot/memory.c 2011-05-19 00:06:34.000000000 -0400
7876+++ linux-2.6.39/arch/x86/boot/memory.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 7877@@ -19,7 +19,7 @@
7878
7879 static int detect_memory_e820(void)
7880 {
7881- int count = 0;
7882+ unsigned int count = 0;
7883 struct biosregs ireg, oreg;
7884 struct e820entry *desc = boot_params.e820_map;
7885 static struct e820entry buf; /* static so it is zeroed */
66a7e928
MT		 7886diff -urNp linux-2.6.39/arch/x86/boot/video.c linux-2.6.39/arch/x86/boot/video.c
7887--- linux-2.6.39/arch/x86/boot/video.c 2011-05-19 00:06:34.000000000 -0400
7888+++ linux-2.6.39/arch/x86/boot/video.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 7889@@ -96,7 +96,7 @@ static void store_mode_params(void)
7890 static unsigned int get_entry(void)
7891 {
7892 char entry_buf[4];
7893- int i, len = 0;
7894+ unsigned int i, len = 0;
7895 int key;
7896 unsigned int v;
7897
66a7e928
MT		 7898diff -urNp linux-2.6.39/arch/x86/boot/video-vesa.c linux-2.6.39/arch/x86/boot/video-vesa.c
7899--- linux-2.6.39/arch/x86/boot/video-vesa.c 2011-05-19 00:06:34.000000000 -0400
7900+++ linux-2.6.39/arch/x86/boot/video-vesa.c 2011-05-22 19:36:30.000000000 -0400
57199397 7901@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
58c5fc13 7902
57199397
MT		 7903 boot_params.screen_info.vesapm_seg = oreg.es;
7904 boot_params.screen_info.vesapm_off = oreg.di;
7905+ boot_params.screen_info.vesapm_size = oreg.cx;
7906 }
efbe55a5 7907
57199397 7908 /*
66a7e928
MT		 7909diff -urNp linux-2.6.39/arch/x86/ia32/ia32_aout.c linux-2.6.39/arch/x86/ia32/ia32_aout.c
7910--- linux-2.6.39/arch/x86/ia32/ia32_aout.c 2011-05-19 00:06:34.000000000 -0400
7911+++ linux-2.6.39/arch/x86/ia32/ia32_aout.c 2011-05-22 19:41:32.000000000 -0400
6892158b
MT		 7912@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
7913 unsigned long dump_start, dump_size;
7914 struct user32 dump;
7915
7916+ memset(&dump, 0, sizeof(dump));
7917+
7918 fs = get_fs();
7919 set_fs(KERNEL_DS);
7920 has_dumped = 1;
66a7e928
MT		 7921diff -urNp linux-2.6.39/arch/x86/ia32/ia32entry.S linux-2.6.39/arch/x86/ia32/ia32entry.S
7922--- linux-2.6.39/arch/x86/ia32/ia32entry.S 2011-05-19 00:06:34.000000000 -0400
7923+++ linux-2.6.39/arch/x86/ia32/ia32entry.S 2011-05-23 17:16:01.000000000 -0400
df50ba0c
MT		 7924@@ -13,6 +13,7 @@
7925 #include <asm/thread_info.h>
7926 #include <asm/segment.h>
7927 #include <asm/irqflags.h>
7928+#include <asm/pgtable.h>
7929 #include <linux/linkage.h>
7930
7931 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
66a7e928 7932@@ -95,6 +96,32 @@ ENTRY(native_irq_enable_sysexit)
317566c1
MT		 7933 ENDPROC(native_irq_enable_sysexit)
7934 #endif
7935
7936+ .macro pax_enter_kernel_user
df50ba0c
MT		 7937+#ifdef CONFIG_PAX_MEMORY_UDEREF
7938+ call pax_enter_kernel_user
7939+#endif
317566c1
MT		 7940+ .endm
7941+
7942+ .macro pax_exit_kernel_user
7943+#ifdef CONFIG_PAX_MEMORY_UDEREF
7944+ call pax_exit_kernel_user
7945+#endif
71d190be 7946+#ifdef CONFIG_PAX_RANDKSTACK
66a7e928 7947+ pushq %rax
71d190be 7948+ call pax_randomize_kstack
66a7e928 7949+ popq %rax
71d190be 7950+#endif
8308f9c9 7951+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8308f9c9 7952+ call pax_erase_kstack
66a7e928
MT		 7953+#endif
7954+ .endm
7955+
7956+ .macro pax_erase_kstack
7957+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
7958+ call pax_erase_kstack
8308f9c9 7959+#endif
317566c1 7960+ .endm
df50ba0c 7961+
317566c1
MT		 7962 /*
7963 * 32bit SYSENTER instruction entry.
7964 *
66a7e928 7965@@ -121,7 +148,7 @@ ENTRY(ia32_sysenter_target)
71d190be 7966 CFI_REGISTER rsp,rbp
317566c1
MT		 7967 SWAPGS_UNSAFE_STACK
7968 movq PER_CPU_VAR(kernel_stack), %rsp
71d190be 7969- addq $(KERNEL_STACK_OFFSET),%rsp
317566c1 7970+ pax_enter_kernel_user
df50ba0c
MT		 7971 /*
7972 * No need to follow this irqs on/off section: the syscall
7973 * disabled irqs, here we enable it straight after entry:
66a7e928
MT		 7974@@ -134,7 +161,8 @@ ENTRY(ia32_sysenter_target)
7975 CFI_REL_OFFSET rsp,0
7976 pushfq_cfi
71d190be
MT		 7977 /*CFI_REL_OFFSET rflags,0*/
7978- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
7979+ GET_THREAD_INFO(%r10)
7980+ movl TI_sysenter_return(%r10), %r10d
7981 CFI_REGISTER rip,r10
66a7e928
MT		 7982 pushq_cfi $__USER32_CS
7983 /*CFI_REL_OFFSET cs,0*/
7984@@ -146,6 +174,12 @@ ENTRY(ia32_sysenter_target)
df50ba0c
MT		 7985 SAVE_ARGS 0,0,1
7986 /* no need to do an access_ok check here because rbp has been
7987 32bit zero extended */
7988+
7989+#ifdef CONFIG_PAX_MEMORY_UDEREF
7990+ mov $PAX_USER_SHADOW_BASE,%r10
7991+ add %r10,%rbp
7992+#endif
7993+
7994 1: movl (%rbp),%ebp
7995 .section __ex_table,"a"
7996 .quad 1b,ia32_badarg
66a7e928 7997@@ -168,6 +202,7 @@ sysenter_dispatch:
df50ba0c
MT		 7998 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
7999 jnz sysexit_audit
8000 sysexit_from_sys_call:
317566c1 8001+ pax_exit_kernel_user
df50ba0c
MT		 8002 andl $~TS_COMPAT,TI_status(%r10)
8003 /* clear IF, that popfq doesn't enable interrupts early */
8004 andl $~0x200,EFLAGS-R11(%rsp)
66a7e928
MT		 8005@@ -194,6 +229,9 @@ sysexit_from_sys_call:
8006 movl %eax,%esi /* 2nd arg: syscall number */
8007 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
8008 call audit_syscall_entry
8009+
8010+ pax_erase_kstack
8011+
8012 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
8013 cmpq $(IA32_NR_syscalls-1),%rax
8014 ja ia32_badsys
8015@@ -246,6 +284,9 @@ sysenter_tracesys:
8016 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
8017 movq %rsp,%rdi /* &pt_regs -> arg1 */
8018 call syscall_trace_enter
8019+
8020+ pax_erase_kstack
8021+
8022 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8023 RESTORE_REST
8024 cmpq $(IA32_NR_syscalls-1),%rax
8025@@ -277,19 +318,24 @@ ENDPROC(ia32_sysenter_target)
71d190be
MT		 8026 ENTRY(ia32_cstar_target)
8027 CFI_STARTPROC32 simple
8028 CFI_SIGNAL_FRAME
8029- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
8030+ CFI_DEF_CFA rsp,0
8031 CFI_REGISTER rip,rcx
8032 /*CFI_REGISTER rflags,r11*/
8033 SWAPGS_UNSAFE_STACK
df50ba0c
MT		 8034 movl %esp,%r8d
8035 CFI_REGISTER rsp,r8
8036 movq PER_CPU_VAR(kernel_stack),%rsp
8037+
8038+#ifdef CONFIG_PAX_MEMORY_UDEREF
317566c1 8039+ pax_enter_kernel_user
df50ba0c
MT		 8040+#endif
8041+
8042 /*
8043 * No need to follow this irqs on/off section: the syscall
8044 * disabled irqs and here we enable it straight after entry:
71d190be
MT		 8045 */
8046 ENABLE_INTERRUPTS(CLBR_NONE)
8047- SAVE_ARGS 8,1,1
8048+ SAVE_ARGS 8*6,1,1
8049 movl %eax,%eax /* zero extension */
8050 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
8051 movq %rcx,RIP-ARGOFFSET(%rsp)
66a7e928 8052@@ -305,6 +351,12 @@ ENTRY(ia32_cstar_target)
df50ba0c
MT		 8053 /* no need to do an access_ok check here because r8 has been
8054 32bit zero extended */
8055 /* hardware stack frame is complete now */
8056+
8057+#ifdef CONFIG_PAX_MEMORY_UDEREF
8058+ mov $PAX_USER_SHADOW_BASE,%r10
8059+ add %r10,%r8
8060+#endif
8061+
8062 1: movl (%r8),%r9d
8063 .section __ex_table,"a"
8064 .quad 1b,ia32_badarg
66a7e928 8065@@ -327,6 +379,7 @@ cstar_dispatch:
df50ba0c
MT		 8066 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8067 jnz sysretl_audit
8068 sysretl_from_sys_call:
317566c1 8069+ pax_exit_kernel_user
df50ba0c
MT		 8070 andl $~TS_COMPAT,TI_status(%r10)
8071 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
8072 movl RIP-ARGOFFSET(%rsp),%ecx
66a7e928
MT		 8073@@ -364,6 +417,9 @@ cstar_tracesys:
8074 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8075 movq %rsp,%rdi /* &pt_regs -> arg1 */
8076 call syscall_trace_enter
8077+
8078+ pax_erase_kstack
8079+
8080 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
8081 RESTORE_REST
8082 xchgl %ebp,%r9d
8083@@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
df50ba0c
MT		 8084 CFI_REL_OFFSET rip,RIP-RIP
8085 PARAVIRT_ADJUST_EXCEPTION_FRAME
8086 SWAPGS
317566c1 8087+ pax_enter_kernel_user
df50ba0c
MT		 8088 /*
8089 * No need to follow this irqs on/off section: the syscall
8090 * disabled irqs and here we enable it straight after entry:
66a7e928
MT		 8091@@ -441,6 +498,9 @@ ia32_tracesys:
8092 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8093 movq %rsp,%rdi /* &pt_regs -> arg1 */
8094 call syscall_trace_enter
8095+
8096+ pax_erase_kstack
8097+
8098 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8099 RESTORE_REST
8100 cmpq $(IA32_NR_syscalls-1),%rax
8101diff -urNp linux-2.6.39/arch/x86/ia32/ia32_signal.c linux-2.6.39/arch/x86/ia32/ia32_signal.c
8102--- linux-2.6.39/arch/x86/ia32/ia32_signal.c 2011-05-19 00:06:34.000000000 -0400
8103+++ linux-2.6.39/arch/x86/ia32/ia32_signal.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 8104@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
8105 sp -= frame_size;
8106 /* Align the stack pointer according to the i386 ABI,
8107 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
8108- sp = ((sp + 4) & -16ul) - 4;
8109+ sp = ((sp - 12) & -16ul) - 4;
8110 return (void __user *) sp;
8111 }
8112
bc901d79
MT		 8113@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
8114 * These are actually not used anymore, but left because some
8115 * gdb versions depend on them as a marker.
8116 */
8117- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8118+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8119 } put_user_catch(err);
8120
8121 if (err)
57199397
MT		 8122@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
8123 0xb8,
8124 __NR_ia32_rt_sigreturn,
8125 0x80cd,
8126- 0,
8127+ 0
8128 };
8129
8130 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
bc901d79 8131@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
6892158b
MT		 8132
8133 if (ka->sa.sa_flags & SA_RESTORER)
8134 restorer = ka->sa.sa_restorer;
8135+ else if (current->mm->context.vdso)
8136+ /* Return stub is in 32bit vsyscall page */
8137+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
8138 else
8139- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
8140- rt_sigreturn);
8141+ restorer = &frame->retcode;
8142 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
8143
8144 /*
bc901d79
MT		 8145 * Not actually used anymore, but left because some gdb
8146 * versions need it.
8147 */
8148- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8149+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8150 } put_user_catch(err);
8151
8152 if (err)
66a7e928
MT		 8153diff -urNp linux-2.6.39/arch/x86/include/asm/alternative.h linux-2.6.39/arch/x86/include/asm/alternative.h
8154--- linux-2.6.39/arch/x86/include/asm/alternative.h 2011-05-19 00:06:34.000000000 -0400
8155+++ linux-2.6.39/arch/x86/include/asm/alternative.h 2011-05-22 19:36:30.000000000 -0400
16454cff 8156@@ -94,7 +94,7 @@ static inline int alternatives_text_rese
6892158b 8157 ".section .discard,\"aw\",@progbits\n" \
ae4e228f 8158 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
58c5fc13
MT		 8159 ".previous\n" \
8160- ".section .altinstr_replacement, \"ax\"\n" \
8161+ ".section .altinstr_replacement, \"a\"\n" \
8162 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
8163 ".previous"
8164
66a7e928
MT		 8165diff -urNp linux-2.6.39/arch/x86/include/asm/apm.h linux-2.6.39/arch/x86/include/asm/apm.h
8166--- linux-2.6.39/arch/x86/include/asm/apm.h 2011-05-19 00:06:34.000000000 -0400
8167+++ linux-2.6.39/arch/x86/include/asm/apm.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 8168@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
8169 __asm__ __volatile__(APM_DO_ZERO_SEGS
8170 "pushl %%edi\n\t"
8171 "pushl %%ebp\n\t"
8172- "lcall *%%cs:apm_bios_entry\n\t"
8173+ "lcall *%%ss:apm_bios_entry\n\t"
8174 "setc %%al\n\t"
8175 "popl %%ebp\n\t"
8176 "popl %%edi\n\t"
8177@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
8178 __asm__ __volatile__(APM_DO_ZERO_SEGS
8179 "pushl %%edi\n\t"
8180 "pushl %%ebp\n\t"
8181- "lcall *%%cs:apm_bios_entry\n\t"
8182+ "lcall *%%ss:apm_bios_entry\n\t"
8183 "setc %%bl\n\t"
8184 "popl %%ebp\n\t"
8185 "popl %%edi\n\t"
66a7e928
MT		 8186diff -urNp linux-2.6.39/arch/x86/include/asm/atomic64_32.h linux-2.6.39/arch/x86/include/asm/atomic64_32.h
8187--- linux-2.6.39/arch/x86/include/asm/atomic64_32.h 2011-05-19 00:06:34.000000000 -0400
8188+++ linux-2.6.39/arch/x86/include/asm/atomic64_32.h 2011-05-22 19:36:30.000000000 -0400
df50ba0c 8189@@ -12,6 +12,14 @@ typedef struct {
ae4e228f
MT		 8190 u64 __aligned(8) counter;
8191 } atomic64_t;
8192
8193+#ifdef CONFIG_PAX_REFCOUNT
8194+typedef struct {
8195+ u64 __aligned(8) counter;
8196+} atomic64_unchecked_t;
8197+#else
8198+typedef atomic64_t atomic64_unchecked_t;
8199+#endif
8200+
8201 #define ATOMIC64_INIT(val) { (val) }
8202
57199397 8203 #ifdef CONFIG_X86_CMPXCHG64
66a7e928
MT		 8204@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
8205 }
8206
8207 /**
8208+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
8209+ * @p: pointer to type atomic64_unchecked_t
8210+ * @o: expected value
8211+ * @n: new value
8212+ *
8213+ * Atomically sets @v to @n if it was equal to @o and returns
8214+ * the old value.
8215+ */
8216+
8217+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
8218+{
8219+ return cmpxchg64(&v->counter, o, n);
8220+}
8221+
8222+/**
8223 * atomic64_xchg - xchg atomic64 variable
8224 * @v: pointer to type atomic64_t
8225 * @n: value to assign
8226@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
8308f9c9
MT		 8227 }
8228
8229 /**
8230+ * atomic64_set_unchecked - set atomic64 variable
8231+ * @v: pointer to type atomic64_unchecked_t
8232+ * @n: value to assign
8233+ *
8234+ * Atomically sets the value of @v to @n.
8235+ */
8236+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
8237+{
8238+ unsigned high = (unsigned)(i >> 32);
8239+ unsigned low = (unsigned)i;
8240+ asm volatile(ATOMIC64_ALTERNATIVE(set)
8241+ : "+b" (low), "+c" (high)
8242+ : "S" (v)
8243+ : "eax", "edx", "memory"
8244+ );
8245+}
8246+
8247+/**
8248 * atomic64_read - read atomic64 variable
8249 * @v: pointer to type atomic64_t
8250 *
66a7e928 8251@@ -93,6 +134,22 @@ static inline long long atomic64_read(at
8308f9c9
MT		 8252 }
8253
8254 /**
8255+ * atomic64_read_unchecked - read atomic64 variable
8256+ * @v: pointer to type atomic64_unchecked_t
8257+ *
8258+ * Atomically reads the value of @v and returns it.
8259+ */
8260+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
8261+{
8262+ long long r;
8263+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
8264+ : "=A" (r), "+c" (v)
8265+ : : "memory"
8266+ );
8267+ return r;
8268+ }
8269+
8270+/**
8271 * atomic64_add_return - add and return
8272 * @i: integer value to add
8273 * @v: pointer to type atomic64_t
66a7e928
MT		 8274@@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
8275 return i;
8276 }
8277
8278+/**
8279+ * atomic64_add_return_unchecked - add and return
8280+ * @i: integer value to add
8281+ * @v: pointer to type atomic64_unchecked_t
8282+ *
8283+ * Atomically adds @i to @v and returns @i + *@v
8284+ */
8285+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
8286+{
8287+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
8288+ : "+A" (i), "+c" (v)
8289+ : : "memory"
8290+ );
8291+ return i;
8292+}
8293+
8294 /*
8295 * Other variants with different arithmetic operators:
8296 */
8297@@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
8308f9c9
MT		 8298 return a;
8299 }
8300
8301+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8302+{
8303+ long long a;
8304+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
8305+ : "=A" (a)
8306+ : "S" (v)
8307+ : "memory", "ecx"
8308+ );
8309+ return a;
8310+}
8311+
8312 static inline long long atomic64_dec_return(atomic64_t *v)
8313 {
8314 long long a;
66a7e928 8315@@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
8308f9c9
MT		 8316 }
8317
8318 /**
8319+ * atomic64_add_unchecked - add integer to atomic64 variable
8320+ * @i: integer value to add
8321+ * @v: pointer to type atomic64_unchecked_t
8322+ *
8323+ * Atomically adds @i to @v.
8324+ */
8325+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
8326+{
8327+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
8328+ : "+A" (i), "+c" (v)
8329+ : : "memory"
8330+ );
8331+ return i;
8332+}
8333+
8334+/**
8335 * atomic64_sub - subtract the atomic64 variable
8336 * @i: integer value to subtract
8337 * @v: pointer to type atomic64_t
66a7e928
MT		 8338diff -urNp linux-2.6.39/arch/x86/include/asm/atomic64_64.h linux-2.6.39/arch/x86/include/asm/atomic64_64.h
8339--- linux-2.6.39/arch/x86/include/asm/atomic64_64.h 2011-05-19 00:06:34.000000000 -0400
8340+++ linux-2.6.39/arch/x86/include/asm/atomic64_64.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 8341@@ -18,7 +18,19 @@
8342 */
8343 static inline long atomic64_read(const atomic64_t *v)
8344 {
8345- return (*(volatile long *)&(v)->counter);
8346+ return (*(volatile const long *)&(v)->counter);
8347+}
8348+
8349+/**
ae4e228f
MT		 8350+ * atomic64_read_unchecked - read atomic64 variable
8351+ * @v: pointer of type atomic64_unchecked_t
8352+ *
8353+ * Atomically reads the value of @v.
8354+ * Doesn't imply a read memory barrier.
8355+ */
8356+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8357+{
bc901d79
MT		 8358+ return (*(volatile const long *)&(v)->counter);
8359 }
8360
8361 /**
df50ba0c 8362@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
ae4e228f
MT		 8363 }
8364
8365 /**
8366+ * atomic64_set_unchecked - set atomic64 variable
8367+ * @v: pointer to type atomic64_unchecked_t
8368+ * @i: required value
8369+ *
8370+ * Atomically sets the value of @v to @i.
8371+ */
8372+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8373+{
8374+ v->counter = i;
8375+}
8376+
8377+/**
8378 * atomic64_add - add integer to atomic64 variable
8379 * @i: integer value to add
8380 * @v: pointer to type atomic64_t
df50ba0c 8381@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
58c5fc13
MT		 8382 */
8383 static inline void atomic64_add(long i, atomic64_t *v)
8384 {
58c5fc13
MT		 8385+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
8386+
8387+#ifdef CONFIG_PAX_REFCOUNT
8388+ "jno 0f\n"
8389+ LOCK_PREFIX "subq %1,%0\n"
8390+ "int $4\n0:\n"
8391+ _ASM_EXTABLE(0b, 0b)
8392+#endif
8393+
ae4e228f
MT		 8394+ : "=m" (v->counter)
8395+ : "er" (i), "m" (v->counter));
8396+}
8397+
8398+/**
8399+ * atomic64_add_unchecked - add integer to atomic64 variable
8400+ * @i: integer value to add
8401+ * @v: pointer to type atomic64_unchecked_t
8402+ *
8403+ * Atomically adds @i to @v.
8404+ */
8405+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8406+{
8407 asm volatile(LOCK_PREFIX "addq %1,%0"
58c5fc13
MT		 8408 : "=m" (v->counter)
8409 : "er" (i), "m" (v->counter));
6892158b 8410@@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
58c5fc13
MT		 8411 */
8412 static inline void atomic64_sub(long i, atomic64_t *v)
8413 {
8414- asm volatile(LOCK_PREFIX "subq %1,%0"
8415+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8416+
8417+#ifdef CONFIG_PAX_REFCOUNT
8418+ "jno 0f\n"
8419+ LOCK_PREFIX "addq %1,%0\n"
8420+ "int $4\n0:\n"
8421+ _ASM_EXTABLE(0b, 0b)
8422+#endif
8423+
6892158b
MT		 8424+ : "=m" (v->counter)
8425+ : "er" (i), "m" (v->counter));
8426+}
8427+
8428+/**
8429+ * atomic64_sub_unchecked - subtract the atomic64 variable
8430+ * @i: integer value to subtract
8431+ * @v: pointer to type atomic64_unchecked_t
8432+ *
8433+ * Atomically subtracts @i from @v.
8434+ */
8435+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
8436+{
8437+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
58c5fc13
MT		 8438 : "=m" (v->counter)
8439 : "er" (i), "m" (v->counter));
8440 }
6892158b 8441@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
58c5fc13
MT		 8442 {
8443 unsigned char c;
8444
8445- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8446+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
8447+
8448+#ifdef CONFIG_PAX_REFCOUNT
8449+ "jno 0f\n"
8450+ LOCK_PREFIX "addq %2,%0\n"
8451+ "int $4\n0:\n"
8452+ _ASM_EXTABLE(0b, 0b)
8453+#endif
8454+
8455+ "sete %1\n"
8456 : "=m" (v->counter), "=qm" (c)
8457 : "er" (i), "m" (v->counter) : "memory");
8458 return c;
6892158b 8459@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
58c5fc13
MT		 8460 */
8461 static inline void atomic64_inc(atomic64_t *v)
8462 {
58c5fc13
MT		 8463+ asm volatile(LOCK_PREFIX "incq %0\n"
8464+
8465+#ifdef CONFIG_PAX_REFCOUNT
8466+ "jno 0f\n"
58c5fc13 8467+ LOCK_PREFIX "decq %0\n"
6892158b
MT		 8468+ "int $4\n0:\n"
8469+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 8470+#endif
8471+
ae4e228f
MT		 8472+ : "=m" (v->counter)
8473+ : "m" (v->counter));
8474+}
8475+
8476+/**
8477+ * atomic64_inc_unchecked - increment atomic64 variable
8478+ * @v: pointer to type atomic64_unchecked_t
8479+ *
8480+ * Atomically increments @v by 1.
8481+ */
8482+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8483+{
8484 asm volatile(LOCK_PREFIX "incq %0"
58c5fc13
MT		 8485 : "=m" (v->counter)
8486 : "m" (v->counter));
6892158b 8487@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
58c5fc13
MT		 8488 */
8489 static inline void atomic64_dec(atomic64_t *v)
8490 {
8491- asm volatile(LOCK_PREFIX "decq %0"
8492+ asm volatile(LOCK_PREFIX "decq %0\n"
8493+
8494+#ifdef CONFIG_PAX_REFCOUNT
8495+ "jno 0f\n"
58c5fc13 8496+ LOCK_PREFIX "incq %0\n"
6892158b
MT		 8497+ "int $4\n0:\n"
8498+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 8499+#endif
8500+
df50ba0c
MT		 8501+ : "=m" (v->counter)
8502+ : "m" (v->counter));
8503+}
8504+
8505+/**
8506+ * atomic64_dec_unchecked - decrement atomic64 variable
8507+ * @v: pointer to type atomic64_t
8508+ *
8509+ * Atomically decrements @v by 1.
8510+ */
8511+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8512+{
8513+ asm volatile(LOCK_PREFIX "decq %0\n"
58c5fc13
MT		 8514 : "=m" (v->counter)
8515 : "m" (v->counter));
8516 }
6892158b 8517@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
58c5fc13
MT		 8518 {
8519 unsigned char c;
8520
8521- asm volatile(LOCK_PREFIX "decq %0; sete %1"
8522+ asm volatile(LOCK_PREFIX "decq %0\n"
8523+
8524+#ifdef CONFIG_PAX_REFCOUNT
8525+ "jno 0f\n"
58c5fc13 8526+ LOCK_PREFIX "incq %0\n"
6892158b
MT		 8527+ "int $4\n0:\n"
8528+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 8529+#endif
8530+
8531+ "sete %1\n"
8532 : "=m" (v->counter), "=qm" (c)
8533 : "m" (v->counter) : "memory");
8534 return c != 0;
6892158b 8535@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
58c5fc13
MT		 8536 {
8537 unsigned char c;
8538
8539- asm volatile(LOCK_PREFIX "incq %0; sete %1"
8540+ asm volatile(LOCK_PREFIX "incq %0\n"
8541+
8542+#ifdef CONFIG_PAX_REFCOUNT
8543+ "jno 0f\n"
58c5fc13 8544+ LOCK_PREFIX "decq %0\n"
6892158b
MT		 8545+ "int $4\n0:\n"
8546+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 8547+#endif
8548+
8549+ "sete %1\n"
8550 : "=m" (v->counter), "=qm" (c)
8551 : "m" (v->counter) : "memory");
8552 return c != 0;
6892158b 8553@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
58c5fc13
MT		 8554 {
8555 unsigned char c;
8556
8557- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8558+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
8559+
8560+#ifdef CONFIG_PAX_REFCOUNT
8561+ "jno 0f\n"
8562+ LOCK_PREFIX "subq %2,%0\n"
8563+ "int $4\n0:\n"
8564+ _ASM_EXTABLE(0b, 0b)
8565+#endif
8566+
8567+ "sets %1\n"
8568 : "=m" (v->counter), "=qm" (c)
8569 : "er" (i), "m" (v->counter) : "memory");
8570 return c;
6892158b 8571@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
58c5fc13
MT		 8572 static inline long atomic64_add_return(long i, atomic64_t *v)
8573 {
8574 long __i = i;
8575- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8576+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8577+
8578+#ifdef CONFIG_PAX_REFCOUNT
8579+ "jno 0f\n"
8580+ "movq %0, %1\n"
8581+ "int $4\n0:\n"
8582+ _ASM_EXTABLE(0b, 0b)
8583+#endif
8584+
ae4e228f
MT		 8585+ : "+r" (i), "+m" (v->counter)
8586+ : : "memory");
8587+ return i + __i;
8588+}
8589+
8590+/**
8591+ * atomic64_add_return_unchecked - add and return
8592+ * @i: integer value to add
8593+ * @v: pointer to type atomic64_unchecked_t
8594+ *
8595+ * Atomically adds @i to @v and returns @i + @v
8596+ */
8597+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8598+{
8599+ long __i = i;
8600+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
58c5fc13
MT		 8601 : "+r" (i), "+m" (v->counter)
8602 : : "memory");
8603 return i + __i;
6892158b 8604@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
ae4e228f
MT		 8605 }
8606
8607 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
57199397
MT		 8608+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8609+{
8610+ return atomic64_add_return_unchecked(1, v);
8611+}
ae4e228f
MT		 8612 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8613
8614 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
66a7e928
MT		 8615@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
8616 return cmpxchg(&v->counter, old, new);
8617 }
8618
8619+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8620+{
8621+ return cmpxchg(&v->counter, old, new);
8622+}
8623+
8624 static inline long atomic64_xchg(atomic64_t *v, long new)
8625 {
8626 return xchg(&v->counter, new);
8627@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
58c5fc13 8628 */
df50ba0c 8629 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
58c5fc13 8630 {
df50ba0c
MT		 8631- long c, old;
8632+ long c, old, new;
8633 c = atomic64_read(v);
58c5fc13
MT		 8634 for (;;) {
8635- if (unlikely(c == (u)))
8636+ if (unlikely(c == u))
8637 break;
df50ba0c 8638- old = atomic64_cmpxchg((v), c, c + (a));
58c5fc13 8639+
df50ba0c 8640+ asm volatile("add %2,%0\n"
58c5fc13
MT		 8641+
8642+#ifdef CONFIG_PAX_REFCOUNT
8643+ "jno 0f\n"
6892158b 8644+ "sub %2,%0\n"
58c5fc13
MT		 8645+ "int $4\n0:\n"
8646+ _ASM_EXTABLE(0b, 0b)
8647+#endif
8648+
8649+ : "=r" (new)
8650+ : "0" (c), "ir" (a));
8651+
df50ba0c 8652+ old = atomic64_cmpxchg(v, c, new);
58c5fc13
MT		 8653 if (likely(old == c))
8654 break;
8655 c = old;
8656 }
8657- return c != (u);
8658+ return c != u;
8659 }
8660
df50ba0c 8661 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
66a7e928
MT		 8662diff -urNp linux-2.6.39/arch/x86/include/asm/atomic.h linux-2.6.39/arch/x86/include/asm/atomic.h
8663--- linux-2.6.39/arch/x86/include/asm/atomic.h 2011-05-19 00:06:34.000000000 -0400
8664+++ linux-2.6.39/arch/x86/include/asm/atomic.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 8665@@ -22,7 +22,18 @@
8666 */
8667 static inline int atomic_read(const atomic_t *v)
8668 {
8669- return (*(volatile int *)&(v)->counter);
8670+ return (*(volatile const int *)&(v)->counter);
8671+}
8672+
8673+/**
57199397
MT		 8674+ * atomic_read_unchecked - read atomic variable
8675+ * @v: pointer of type atomic_unchecked_t
8676+ *
8677+ * Atomically reads the value of @v.
8678+ */
8679+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
8680+{
bc901d79
MT		 8681+ return (*(volatile const int *)&(v)->counter);
8682 }
8683
8684 /**
57199397
MT		 8685@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
8686 }
8687
8688 /**
8689+ * atomic_set_unchecked - set atomic variable
8690+ * @v: pointer of type atomic_unchecked_t
8691+ * @i: required value
8692+ *
8693+ * Atomically sets the value of @v to @i.
8694+ */
8695+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
8696+{
8697+ v->counter = i;
8698+}
8699+
8700+/**
8701 * atomic_add - add integer to atomic variable
8702 * @i: integer value to add
8703 * @v: pointer of type atomic_t
8704@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
8705 */
8706 static inline void atomic_add(int i, atomic_t *v)
8707 {
8708- asm volatile(LOCK_PREFIX "addl %1,%0"
8709+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
8710+
8711+#ifdef CONFIG_PAX_REFCOUNT
8712+ "jno 0f\n"
8713+ LOCK_PREFIX "subl %1,%0\n"
bc901d79 8714+ "int $4\n0:\n"
57199397
MT		 8715+ _ASM_EXTABLE(0b, 0b)
8716+#endif
8717+
8718+ : "+m" (v->counter)
8719+ : "ir" (i));
8720+}
8721+
8722+/**
8723+ * atomic_add_unchecked - add integer to atomic variable
8724+ * @i: integer value to add
8725+ * @v: pointer of type atomic_unchecked_t
8726+ *
8727+ * Atomically adds @i to @v.
8728+ */
8729+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
8730+{
8731+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
8732 : "+m" (v->counter)
8733 : "ir" (i));
8734 }
8735@@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
8736 */
8737 static inline void atomic_sub(int i, atomic_t *v)
8738 {
8739- asm volatile(LOCK_PREFIX "subl %1,%0"
8740+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
8741+
8742+#ifdef CONFIG_PAX_REFCOUNT
8743+ "jno 0f\n"
8744+ LOCK_PREFIX "addl %1,%0\n"
bc901d79 8745+ "int $4\n0:\n"
57199397
MT		 8746+ _ASM_EXTABLE(0b, 0b)
8747+#endif
8748+
8749+ : "+m" (v->counter)
8750+ : "ir" (i));
8751+}
8752+
8753+/**
8754+ * atomic_sub_unchecked - subtract integer from atomic variable
8755+ * @i: integer value to subtract
8308f9c9 8756+ * @v: pointer of type atomic_unchecked_t
57199397
MT		 8757+ *
8758+ * Atomically subtracts @i from @v.
8759+ */
8760+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
8761+{
8762+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
8763 : "+m" (v->counter)
8764 : "ir" (i));
8765 }
8766@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
8767 {
8768 unsigned char c;
8769
8770- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
8771+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
8772+
8773+#ifdef CONFIG_PAX_REFCOUNT
8774+ "jno 0f\n"
8775+ LOCK_PREFIX "addl %2,%0\n"
bc901d79 8776+ "int $4\n0:\n"
57199397
MT		 8777+ _ASM_EXTABLE(0b, 0b)
8778+#endif
8779+
8780+ "sete %1\n"
8781 : "+m" (v->counter), "=qm" (c)
8782 : "ir" (i) : "memory");
8783 return c;
8784@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
8785 */
8786 static inline void atomic_inc(atomic_t *v)
8787 {
8788- asm volatile(LOCK_PREFIX "incl %0"
8789+ asm volatile(LOCK_PREFIX "incl %0\n"
8790+
8791+#ifdef CONFIG_PAX_REFCOUNT
8792+ "jno 0f\n"
8793+ LOCK_PREFIX "decl %0\n"
bc901d79 8794+ "int $4\n0:\n"
57199397
MT		 8795+ _ASM_EXTABLE(0b, 0b)
8796+#endif
8797+
8798+ : "+m" (v->counter));
8799+}
8800+
8801+/**
8802+ * atomic_inc_unchecked - increment atomic variable
8803+ * @v: pointer of type atomic_unchecked_t
8804+ *
8805+ * Atomically increments @v by 1.
8806+ */
8807+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
8808+{
8809+ asm volatile(LOCK_PREFIX "incl %0\n"
8810 : "+m" (v->counter));
8811 }
8812
8813@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
8814 */
8815 static inline void atomic_dec(atomic_t *v)
8816 {
8817- asm volatile(LOCK_PREFIX "decl %0"
8818+ asm volatile(LOCK_PREFIX "decl %0\n"
8819+
8820+#ifdef CONFIG_PAX_REFCOUNT
8821+ "jno 0f\n"
8822+ LOCK_PREFIX "incl %0\n"
bc901d79 8823+ "int $4\n0:\n"
57199397
MT		 8824+ _ASM_EXTABLE(0b, 0b)
8825+#endif
8826+
8827+ : "+m" (v->counter));
8828+}
8829+
8830+/**
8831+ * atomic_dec_unchecked - decrement atomic variable
8308f9c9 8832+ * @v: pointer of type atomic_unchecked_t
57199397
MT		 8833+ *
8834+ * Atomically decrements @v by 1.
8835+ */
8836+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
8837+{
8838+ asm volatile(LOCK_PREFIX "decl %0\n"
8839 : "+m" (v->counter));
8840 }
8841
8842@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
8843 {
8844 unsigned char c;
8845
8846- asm volatile(LOCK_PREFIX "decl %0; sete %1"
8847+ asm volatile(LOCK_PREFIX "decl %0\n"
8848+
8849+#ifdef CONFIG_PAX_REFCOUNT
8850+ "jno 0f\n"
8851+ LOCK_PREFIX "incl %0\n"
bc901d79 8852+ "int $4\n0:\n"
57199397
MT		 8853+ _ASM_EXTABLE(0b, 0b)
8854+#endif
8855+
8856+ "sete %1\n"
8857 : "+m" (v->counter), "=qm" (c)
8858 : : "memory");
8859 return c != 0;
8308f9c9 8860@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
57199397
MT		 8861 {
8862 unsigned char c;
8863
8864- asm volatile(LOCK_PREFIX "incl %0; sete %1"
8865+ asm volatile(LOCK_PREFIX "incl %0\n"
8866+
8867+#ifdef CONFIG_PAX_REFCOUNT
8868+ "jno 0f\n"
8869+ LOCK_PREFIX "decl %0\n"
bc901d79 8870+ "int $4\n0:\n"
57199397
MT		 8871+ _ASM_EXTABLE(0b, 0b)
8872+#endif
8873+
8308f9c9
MT		 8874+ "sete %1\n"
8875+ : "+m" (v->counter), "=qm" (c)
8876+ : : "memory");
8877+ return c != 0;
8878+}
8879+
8880+/**
8881+ * atomic_inc_and_test_unchecked - increment and test
8882+ * @v: pointer of type atomic_unchecked_t
8883+ *
8884+ * Atomically increments @v by 1
8885+ * and returns true if the result is zero, or false for all
8886+ * other cases.
8887+ */
8888+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
8889+{
8890+ unsigned char c;
8891+
8892+ asm volatile(LOCK_PREFIX "incl %0\n"
57199397
MT		 8893+ "sete %1\n"
8894 : "+m" (v->counter), "=qm" (c)
8895 : : "memory");
8896 return c != 0;
8308f9c9 8897@@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
57199397
MT		 8898 {
8899 unsigned char c;
8900
8901- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
8902+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
8903+
8904+#ifdef CONFIG_PAX_REFCOUNT
8905+ "jno 0f\n"
8906+ LOCK_PREFIX "subl %2,%0\n"
bc901d79 8907+ "int $4\n0:\n"
57199397
MT		 8908+ _ASM_EXTABLE(0b, 0b)
8909+#endif
8910+
8911+ "sets %1\n"
8912 : "+m" (v->counter), "=qm" (c)
8913 : "ir" (i) : "memory");
8914 return c;
8308f9c9 8915@@ -180,6 +342,46 @@ static inline int atomic_add_return(int
57199397
MT		 8916 #endif
8917 /* Modern 486+ processor */
8918 __i = i;
8919+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
8920+
8921+#ifdef CONFIG_PAX_REFCOUNT
8922+ "jno 0f\n"
8923+ "movl %0, %1\n"
bc901d79 8924+ "int $4\n0:\n"
57199397
MT		 8925+ _ASM_EXTABLE(0b, 0b)
8926+#endif
8927+
8928+ : "+r" (i), "+m" (v->counter)
8929+ : : "memory");
8930+ return i + __i;
8931+
8932+#ifdef CONFIG_M386
8933+no_xadd: /* Legacy 386 processor */
8934+ local_irq_save(flags);
8935+ __i = atomic_read(v);
8936+ atomic_set(v, i + __i);
8937+ local_irq_restore(flags);
8938+ return i + __i;
8939+#endif
8940+}
8941+
8942+/**
8943+ * atomic_add_return_unchecked - add integer and return
8944+ * @v: pointer of type atomic_unchecked_t
8945+ * @i: integer value to add
8946+ *
8947+ * Atomically adds @i to @v and returns @i + @v
8948+ */
8949+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
8950+{
8951+ int __i;
8952+#ifdef CONFIG_M386
8953+ unsigned long flags;
8954+ if (unlikely(boot_cpu_data.x86 <= 3))
8955+ goto no_xadd;
8956+#endif
8957+ /* Modern 486+ processor */
8958+ __i = i;
8959 asm volatile(LOCK_PREFIX "xaddl %0, %1"
8960 : "+r" (i), "+m" (v->counter)
8961 : : "memory");
8308f9c9 8962@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
57199397
MT		 8963 }
8964
8965 #define atomic_inc_return(v) (atomic_add_return(1, v))
8966+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
8967+{
8968+ return atomic_add_return_unchecked(1, v);
8969+}
8970 #define atomic_dec_return(v) (atomic_sub_return(1, v))
8971
8972 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
8308f9c9
MT		 8973@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
8974 return cmpxchg(&v->counter, old, new);
8975 }
8976
8977+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
8978+{
8979+ return cmpxchg(&v->counter, old, new);
8980+}
8981+
8982 static inline int atomic_xchg(atomic_t *v, int new)
8983 {
8984 return xchg(&v->counter, new);
8985 }
8986
8987+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
8988+{
8989+ return xchg(&v->counter, new);
8990+}
8991+
8992 /**
8993 * atomic_add_unless - add unless the number is already a given value
8994 * @v: pointer of type atomic_t
8995@@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
57199397
MT		 8996 */
8997 static inline int atomic_add_unless(atomic_t *v, int a, int u)
8998 {
8999- int c, old;
9000+ int c, old, new;
9001 c = atomic_read(v);
9002 for (;;) {
9003- if (unlikely(c == (u)))
9004+ if (unlikely(c == u))
9005 break;
9006- old = atomic_cmpxchg((v), c, c + (a));
9007+
9008+ asm volatile("addl %2,%0\n"
9009+
9010+#ifdef CONFIG_PAX_REFCOUNT
9011+ "jno 0f\n"
6892158b 9012+ "subl %2,%0\n"
bc901d79 9013+ "int $4\n0:\n"
57199397
MT		 9014+ _ASM_EXTABLE(0b, 0b)
9015+#endif
9016+
9017+ : "=r" (new)
9018+ : "0" (c), "ir" (a));
9019+
9020+ old = atomic_cmpxchg(v, c, new);
9021 if (likely(old == c))
9022 break;
9023 c = old;
9024 }
9025- return c != (u);
9026+ return c != u;
9027 }
9028
9029 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
317566c1
MT		 9030
9031+/**
9032+ * atomic_inc_not_zero_hint - increment if not null
9033+ * @v: pointer of type atomic_t
9034+ * @hint: probable value of the atomic before the increment
9035+ *
9036+ * This version of atomic_inc_not_zero() gives a hint of probable
9037+ * value of the atomic. This helps processor to not read the memory
9038+ * before doing the atomic read/modify/write cycle, lowering
9039+ * number of bus transactions on some arches.
9040+ *
9041+ * Returns: 0 if increment was not done, 1 otherwise.
9042+ */
9043+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
9044+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
9045+{
9046+ int val, c = hint, new;
9047+
9048+ /* sanity test, should be removed by compiler if hint is a constant */
9049+ if (!hint)
9050+ return atomic_inc_not_zero(v);
9051+
9052+ do {
9053+ asm volatile("incl %0\n"
9054+
9055+#ifdef CONFIG_PAX_REFCOUNT
9056+ "jno 0f\n"
9057+ "decl %0\n"
9058+ "int $4\n0:\n"
9059+ _ASM_EXTABLE(0b, 0b)
9060+#endif
9061+
9062+ : "=r" (new)
9063+ : "0" (c));
9064+
9065+ val = atomic_cmpxchg(v, c, new);
9066+ if (val == c)
9067+ return 1;
9068+ c = val;
9069+ } while (c);
9070+
9071+ return 0;
9072+}
9073+
9074 /*
9075 * atomic_dec_if_positive - decrement by 1 if old value positive
9076 * @v: pointer of type atomic_t
66a7e928
MT		 9077diff -urNp linux-2.6.39/arch/x86/include/asm/bitops.h linux-2.6.39/arch/x86/include/asm/bitops.h
9078--- linux-2.6.39/arch/x86/include/asm/bitops.h 2011-05-19 00:06:34.000000000 -0400
9079+++ linux-2.6.39/arch/x86/include/asm/bitops.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 9080@@ -38,7 +38,7 @@
9081 * a mask operation on a byte.
9082 */
9083 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
9084-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
9085+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
9086 #define CONST_MASK(nr) (1 << ((nr) & 7))
9087
9088 /**
66a7e928
MT		 9089diff -urNp linux-2.6.39/arch/x86/include/asm/boot.h linux-2.6.39/arch/x86/include/asm/boot.h
9090--- linux-2.6.39/arch/x86/include/asm/boot.h 2011-05-19 00:06:34.000000000 -0400
9091+++ linux-2.6.39/arch/x86/include/asm/boot.h 2011-05-22 19:36:30.000000000 -0400
efbe55a5
MT		 9092@@ -11,10 +11,15 @@
9093 #include <asm/pgtable_types.h>
df50ba0c 9094
efbe55a5
MT		 9095 /* Physical address where kernel should be loaded. */
9096-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9097+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9098 + (CONFIG_PHYSICAL_ALIGN - 1)) \
9099 & ~(CONFIG_PHYSICAL_ALIGN - 1))
df50ba0c 9100
efbe55a5
MT		 9101+#ifndef __ASSEMBLY__
9102+extern unsigned char __LOAD_PHYSICAL_ADDR[];
9103+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
df50ba0c
MT		 9104+#endif
9105+
efbe55a5
MT		 9106 /* Minimum kernel alignment, as a power of two */
9107 #ifdef CONFIG_X86_64
9108 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
66a7e928
MT		 9109diff -urNp linux-2.6.39/arch/x86/include/asm/cacheflush.h linux-2.6.39/arch/x86/include/asm/cacheflush.h
9110--- linux-2.6.39/arch/x86/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
9111+++ linux-2.6.39/arch/x86/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
16454cff 9112@@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
57199397
MT		 9113 unsigned long pg_flags = pg->flags & _PGMT_MASK;
9114
9115 if (pg_flags == _PGMT_DEFAULT)
9116- return -1;
9117+ return ~0UL;
9118 else if (pg_flags == _PGMT_WC)
9119 return _PAGE_CACHE_WC;
9120 else if (pg_flags == _PGMT_UC_MINUS)
66a7e928
MT		 9121diff -urNp linux-2.6.39/arch/x86/include/asm/cache.h linux-2.6.39/arch/x86/include/asm/cache.h
9122--- linux-2.6.39/arch/x86/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
9123+++ linux-2.6.39/arch/x86/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
8308f9c9
MT		 9124@@ -5,12 +5,13 @@
9125
9126 /* L1 cache line size */
9127 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
9128-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9129+#define L1_CACHE_BYTES (_AC(1,U) << L1_CACHE_SHIFT)
efbe55a5 9130
57199397
MT		 9131 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9132+#define __read_only __attribute__((__section__(".data..read_only")))
efbe55a5
MT		 9133
9134 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
8308f9c9
MT		 9135-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
9136+#define INTERNODE_CACHE_BYTES (_AC(1,U) << INTERNODE_CACHE_SHIFT)
9137
9138 #ifdef CONFIG_X86_VSMP
9139 #ifdef CONFIG_SMP
66a7e928
MT		 9140diff -urNp linux-2.6.39/arch/x86/include/asm/checksum_32.h linux-2.6.39/arch/x86/include/asm/checksum_32.h
9141--- linux-2.6.39/arch/x86/include/asm/checksum_32.h 2011-05-19 00:06:34.000000000 -0400
9142+++ linux-2.6.39/arch/x86/include/asm/checksum_32.h 2011-05-22 19:36:30.000000000 -0400
efbe55a5
MT		 9143@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
9144 int len, __wsum sum,
9145 int *src_err_ptr, int *dst_err_ptr);
df50ba0c 9146
efbe55a5
MT		 9147+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
9148+ int len, __wsum sum,
9149+ int *src_err_ptr, int *dst_err_ptr);
df50ba0c 9150+
efbe55a5
MT		 9151+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
9152+ int len, __wsum sum,
9153+ int *src_err_ptr, int *dst_err_ptr);
df50ba0c 9154+
efbe55a5
MT		 9155 /*
9156 * Note: when you get a NULL pointer exception here this means someone
9157 * passed in an incorrect kernel address to one of these functions.
9158@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
9159 int *err_ptr)
df50ba0c 9160 {
efbe55a5
MT		 9161 might_sleep();
9162- return csum_partial_copy_generic((__force void *)src, dst,
9163+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
9164 len, sum, err_ptr, NULL);
58c5fc13
MT		 9165 }
9166
ae4e228f 9167@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
58c5fc13
MT		 9168 {
9169 might_sleep();
9170 if (access_ok(VERIFY_WRITE, dst, len))
9171- return csum_partial_copy_generic(src, (__force void *)dst,
9172+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
9173 len, sum, NULL, err_ptr);
9174
9175 if (len)
66a7e928
MT		 9176diff -urNp linux-2.6.39/arch/x86/include/asm/cpufeature.h linux-2.6.39/arch/x86/include/asm/cpufeature.h
9177--- linux-2.6.39/arch/x86/include/asm/cpufeature.h 2011-05-19 00:06:34.000000000 -0400
9178+++ linux-2.6.39/arch/x86/include/asm/cpufeature.h 2011-05-22 19:36:30.000000000 -0400
9179@@ -351,7 +351,7 @@ static __always_inline __pure bool __sta
6892158b
MT		 9180 ".section .discard,\"aw\",@progbits\n"
9181 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
57199397
MT		 9182 ".previous\n"
9183- ".section .altinstr_replacement,\"ax\"\n"
9184+ ".section .altinstr_replacement,\"a\"\n"
9185 "3: movb $1,%0\n"
9186 "4:\n"
9187 ".previous\n"
66a7e928
MT		 9188diff -urNp linux-2.6.39/arch/x86/include/asm/desc_defs.h linux-2.6.39/arch/x86/include/asm/desc_defs.h
9189--- linux-2.6.39/arch/x86/include/asm/desc_defs.h 2011-05-19 00:06:34.000000000 -0400
9190+++ linux-2.6.39/arch/x86/include/asm/desc_defs.h 2011-05-22 19:36:30.000000000 -0400
317566c1
MT		 9191@@ -31,6 +31,12 @@ struct desc_struct {
9192 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
9193 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
9194 };
9195+ struct {
9196+ u16 offset_low;
9197+ u16 seg;
9198+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
9199+ unsigned offset_high: 16;
16454cff 9200+ } gate;
317566c1
MT		 9201 };
9202 } __attribute__((packed));
9203
66a7e928
MT		 9204diff -urNp linux-2.6.39/arch/x86/include/asm/desc.h linux-2.6.39/arch/x86/include/asm/desc.h
9205--- linux-2.6.39/arch/x86/include/asm/desc.h 2011-05-19 00:06:34.000000000 -0400
9206+++ linux-2.6.39/arch/x86/include/asm/desc.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 9207@@ -4,6 +4,7 @@
9208 #include <asm/desc_defs.h>
9209 #include <asm/ldt.h>
9210 #include <asm/mmu.h>
9211+#include <asm/pgtable.h>
9212 #include <linux/smp.h>
9213
9214 static inline void fill_ldt(struct desc_struct *desc,
9215@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
58c5fc13
MT		 9216 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
9217 desc->type = (info->read_exec_only ^ 1) << 1;
9218 desc->type |= info->contents << 2;
9219+ desc->type |= info->seg_not_present ^ 1;
9220 desc->s = 1;
9221 desc->dpl = 0x3;
9222 desc->p = info->seg_not_present ^ 1;
ae4e228f 9223@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
58c5fc13
MT		 9224 }
9225
9226 extern struct desc_ptr idt_descr;
9227-extern gate_desc idt_table[];
9228-
9229-struct gdt_page {
9230- struct desc_struct gdt[GDT_ENTRIES];
9231-} __attribute__((aligned(PAGE_SIZE)));
9232-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
9233+extern gate_desc idt_table[256];
9234
9235+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
9236 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
9237 {
9238- return per_cpu(gdt_page, cpu).gdt;
9239+ return cpu_gdt_table[cpu];
9240 }
9241
9242 #ifdef CONFIG_X86_64
317566c1
MT		 9243@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
9244 unsigned long base, unsigned dpl, unsigned flags,
9245 unsigned short seg)
9246 {
9247- gate->a = (seg << 16) | (base & 0xffff);
9248- gate->b = (base & 0xffff0000) |
9249- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
16454cff
MT		 9250+ gate->gate.offset_low = base;
9251+ gate->gate.seg = seg;
9252+ gate->gate.reserved = 0;
9253+ gate->gate.type = type;
9254+ gate->gate.s = 0;
9255+ gate->gate.dpl = dpl;
9256+ gate->gate.p = 1;
9257+ gate->gate.offset_high = base >> 16;
317566c1
MT		 9258 }
9259
9260 #endif
71d190be 9261@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
58c5fc13
MT		 9262 static inline void native_write_idt_entry(gate_desc *idt, int entry,
9263 const gate_desc *gate)
9264 {
ae4e228f 9265+ pax_open_kernel();
58c5fc13 9266 memcpy(&idt[entry], gate, sizeof(*gate));
ae4e228f 9267+ pax_close_kernel();
58c5fc13
MT		 9268 }
9269
9270 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
9271 const void *desc)
9272 {
ae4e228f 9273+ pax_open_kernel();
58c5fc13 9274 memcpy(&ldt[entry], desc, 8);
ae4e228f 9275+ pax_close_kernel();
58c5fc13
MT		 9276 }
9277
9278 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
71d190be 9279@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
58c5fc13
MT		 9280 size = sizeof(struct desc_struct);
9281 break;
9282 }
9283+
ae4e228f 9284+ pax_open_kernel();
58c5fc13 9285 memcpy(&gdt[entry], desc, size);
ae4e228f 9286+ pax_close_kernel();
58c5fc13
MT		 9287 }
9288
9289 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
71d190be 9290@@ -211,7 +221,9 @@ static inline void native_set_ldt(const
58c5fc13
MT		 9291
9292 static inline void native_load_tr_desc(void)
9293 {
ae4e228f 9294+ pax_open_kernel();
58c5fc13 9295 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
ae4e228f 9296+ pax_close_kernel();
58c5fc13
MT		 9297 }
9298
9299 static inline void native_load_gdt(const struct desc_ptr *dtr)
71d190be 9300@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
58c5fc13
MT		 9301 unsigned int i;
9302 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
9303
ae4e228f 9304+ pax_open_kernel();
58c5fc13
MT		 9305 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
9306 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
ae4e228f 9307+ pax_close_kernel();
58c5fc13
MT		 9308 }
9309
9310 #define _LDT_empty(info) \
71d190be 9311@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
df50ba0c
MT		 9312 desc->limit = (limit >> 16) & 0xf;
9313 }
9314
9315-static inline void _set_gate(int gate, unsigned type, void *addr,
9316+static inline void _set_gate(int gate, unsigned type, const void *addr,
9317 unsigned dpl, unsigned ist, unsigned seg)
9318 {
9319 gate_desc s;
71d190be 9320@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
df50ba0c
MT		 9321 * Pentium F0 0F bugfix can have resulted in the mapped
9322 * IDT being write-protected.
9323 */
9324-static inline void set_intr_gate(unsigned int n, void *addr)
9325+static inline void set_intr_gate(unsigned int n, const void *addr)
9326 {
9327 BUG_ON((unsigned)n > 0xFF);
9328 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
71d190be 9329@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
df50ba0c
MT		 9330 /*
9331 * This routine sets up an interrupt gate at directory privilege level 3.
9332 */
9333-static inline void set_system_intr_gate(unsigned int n, void *addr)
9334+static inline void set_system_intr_gate(unsigned int n, const void *addr)
9335 {
9336 BUG_ON((unsigned)n > 0xFF);
9337 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
9338 }
9339
9340-static inline void set_system_trap_gate(unsigned int n, void *addr)
9341+static inline void set_system_trap_gate(unsigned int n, const void *addr)
9342 {
9343 BUG_ON((unsigned)n > 0xFF);
9344 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
9345 }
9346
9347-static inline void set_trap_gate(unsigned int n, void *addr)
9348+static inline void set_trap_gate(unsigned int n, const void *addr)
9349 {
9350 BUG_ON((unsigned)n > 0xFF);
9351 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
71d190be 9352@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
df50ba0c
MT		 9353 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
9354 {
9355 BUG_ON((unsigned)n > 0xFF);
9356- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
9357+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
9358 }
9359
9360-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
9361+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
9362 {
9363 BUG_ON((unsigned)n > 0xFF);
9364 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
9365 }
9366
9367-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
9368+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
9369 {
9370 BUG_ON((unsigned)n > 0xFF);
58c5fc13
MT		 9371 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
9372 }
9373
9374+#ifdef CONFIG_X86_32
9375+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
9376+{
9377+ struct desc_struct d;
9378+
9379+ if (likely(limit))
9380+ limit = (limit - 1UL) >> PAGE_SHIFT;
9381+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
9382+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
9383+}
9384+#endif
9385+
9386 #endif /* _ASM_X86_DESC_H */
66a7e928
MT		 9387diff -urNp linux-2.6.39/arch/x86/include/asm/device.h linux-2.6.39/arch/x86/include/asm/device.h
9388--- linux-2.6.39/arch/x86/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
9389+++ linux-2.6.39/arch/x86/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 9390@@ -6,7 +6,7 @@ struct dev_archdata {
9391 void *acpi_handle;
9392 #endif
9393 #ifdef CONFIG_X86_64
9394-struct dma_map_ops *dma_ops;
9395+ const struct dma_map_ops *dma_ops;
9396 #endif
9397 #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
9398 void *iommu; /* hook for IOMMU specific extension */
66a7e928
MT		 9399diff -urNp linux-2.6.39/arch/x86/include/asm/dma-mapping.h linux-2.6.39/arch/x86/include/asm/dma-mapping.h
9400--- linux-2.6.39/arch/x86/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
9401+++ linux-2.6.39/arch/x86/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 9402@@ -26,9 +26,9 @@ extern int iommu_merge;
9403 extern struct device x86_dma_fallback_dev;
9404 extern int panic_on_overflow;
9405
9406-extern struct dma_map_ops *dma_ops;
9407+extern const struct dma_map_ops *dma_ops;
9408
9409-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
9410+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
9411 {
9412 #ifdef CONFIG_X86_32
9413 return dma_ops;
9414@@ -45,7 +45,7 @@ static inline struct dma_map_ops *get_dm
9415 /* Make sure we keep the same behaviour */
9416 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
9417 {
9418- struct dma_map_ops *ops = get_dma_ops(dev);
9419+ const struct dma_map_ops *ops = get_dma_ops(dev);
9420 if (ops->mapping_error)
9421 return ops->mapping_error(dev, dma_addr);
9422
6892158b 9423@@ -115,7 +115,7 @@ static inline void *
ae4e228f
MT		 9424 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
9425 gfp_t gfp)
9426 {
9427- struct dma_map_ops *ops = get_dma_ops(dev);
9428+ const struct dma_map_ops *ops = get_dma_ops(dev);
9429 void *memory;
9430
9431 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
6892158b 9432@@ -142,7 +142,7 @@ dma_alloc_coherent(struct device *dev, s
ae4e228f
MT		 9433 static inline void dma_free_coherent(struct device *dev, size_t size,
9434 void *vaddr, dma_addr_t bus)
9435 {
9436- struct dma_map_ops *ops = get_dma_ops(dev);
9437+ const struct dma_map_ops *ops = get_dma_ops(dev);
9438
9439 WARN_ON(irqs_disabled()); /* for portability */
9440
66a7e928
MT		 9441diff -urNp linux-2.6.39/arch/x86/include/asm/e820.h linux-2.6.39/arch/x86/include/asm/e820.h
9442--- linux-2.6.39/arch/x86/include/asm/e820.h 2011-05-19 00:06:34.000000000 -0400
9443+++ linux-2.6.39/arch/x86/include/asm/e820.h 2011-05-22 19:36:30.000000000 -0400
57199397 9444@@ -69,7 +69,7 @@ struct e820map {
ae4e228f 9445 #define ISA_START_ADDRESS 0xa0000
58c5fc13 9446 #define ISA_END_ADDRESS 0x100000
58c5fc13
MT		 9447
9448-#define BIOS_BEGIN 0x000a0000
9449+#define BIOS_BEGIN 0x000c0000
9450 #define BIOS_END 0x00100000
9451
bc901d79 9452 #define BIOS_ROM_BASE 0xffe00000
66a7e928
MT		 9453diff -urNp linux-2.6.39/arch/x86/include/asm/elf.h linux-2.6.39/arch/x86/include/asm/elf.h
9454--- linux-2.6.39/arch/x86/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
9455+++ linux-2.6.39/arch/x86/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 9456@@ -237,7 +237,25 @@ extern int force_personality32;
58c5fc13
MT		 9457 the loader. We need to make sure that it is out of the way of the program
9458 that it will "exec", and that there is sufficient room for the brk. */
9459
9460+#ifdef CONFIG_PAX_SEGMEXEC
9461+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
9462+#else
9463 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
9464+#endif
9465+
9466+#ifdef CONFIG_PAX_ASLR
9467+#ifdef CONFIG_X86_32
9468+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
9469+
9470+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9471+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9472+#else
9473+#define PAX_ELF_ET_DYN_BASE 0x400000UL
9474+
df50ba0c
MT		 9475+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9476+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
58c5fc13
MT		 9477+#endif
9478+#endif
9479
9480 /* This yields a mask that user programs can use to figure out what
9481 instruction set this CPU supports. This could be done in user space,
ae4e228f 9482@@ -291,8 +309,7 @@ do { \
58c5fc13
MT		 9483 #define ARCH_DLINFO \
9484 do { \
9485 if (vdso_enabled) \
9486- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
9487- (unsigned long)current->mm->context.vdso); \
9488+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
9489 } while (0)
9490
9491 #define AT_SYSINFO 32
ae4e228f 9492@@ -303,7 +320,7 @@ do { \
58c5fc13
MT		 9493
9494 #endif /* !CONFIG_X86_32 */
9495
9496-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
9497+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
9498
9499 #define VDSO_ENTRY \
9500 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
ae4e228f 9501@@ -317,7 +334,4 @@ extern int arch_setup_additional_pages(s
58c5fc13
MT		 9502 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
9503 #define compat_arch_setup_additional_pages syscall32_setup_pages
9504
9505-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
9506-#define arch_randomize_brk arch_randomize_brk
9507-
9508 #endif /* _ASM_X86_ELF_H */
66a7e928
MT		 9509diff -urNp linux-2.6.39/arch/x86/include/asm/emergency-restart.h linux-2.6.39/arch/x86/include/asm/emergency-restart.h
9510--- linux-2.6.39/arch/x86/include/asm/emergency-restart.h 2011-05-19 00:06:34.000000000 -0400
9511+++ linux-2.6.39/arch/x86/include/asm/emergency-restart.h 2011-05-22 19:36:30.000000000 -0400
9512@@ -15,6 +15,6 @@ enum reboot_type {
9513
9514 extern enum reboot_type reboot_type;
9515
9516-extern void machine_emergency_restart(void);
9517+extern void machine_emergency_restart(void) __noreturn;
9518
9519 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
9520diff -urNp linux-2.6.39/arch/x86/include/asm/futex.h linux-2.6.39/arch/x86/include/asm/futex.h
9521--- linux-2.6.39/arch/x86/include/asm/futex.h 2011-05-19 00:06:34.000000000 -0400
9522+++ linux-2.6.39/arch/x86/include/asm/futex.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 9523@@ -12,16 +12,18 @@
58c5fc13
MT		 9524 #include <asm/system.h>
9525
df50ba0c 9526 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
df50ba0c 9527+ typecheck(u32 *, uaddr); \
58c5fc13
MT		 9528 asm volatile("1:\t" insn "\n" \
9529 "2:\t.section .fixup,\"ax\"\n" \
df50ba0c
MT		 9530 "3:\tmov\t%3, %1\n" \
9531 "\tjmp\t2b\n" \
9532 "\t.previous\n" \
9533 _ASM_EXTABLE(1b, 3b) \
9534- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
c52201e0 9535+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
df50ba0c
MT		 9536 : "i" (-EFAULT), "0" (oparg), "1" (0))
9537
9538 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
9539+ typecheck(u32 *, uaddr); \
9540 asm volatile("1:\tmovl %2, %0\n" \
9541 "\tmovl\t%0, %3\n" \
9542 "\t" insn "\n" \
66a7e928 9543@@ -34,7 +36,7 @@
df50ba0c
MT		 9544 _ASM_EXTABLE(1b, 4b) \
9545 _ASM_EXTABLE(2b, 4b) \
58c5fc13 9546 : "=&a" (oldval), "=&r" (ret), \
df50ba0c 9547- "+m" (*uaddr), "=&r" (tem) \
c52201e0 9548+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
58c5fc13 9549 : "r" (oparg), "i" (-EFAULT), "1" (0))
58c5fc13 9550
66a7e928 9551 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
bc901d79 9552@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
58c5fc13
MT		 9553
9554 switch (op) {
9555 case FUTEX_OP_SET:
bc901d79 9556- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
16454cff 9557+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
58c5fc13
MT		 9558 break;
9559 case FUTEX_OP_ADD:
bc901d79 9560- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
16454cff 9561+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
58c5fc13 9562 uaddr, oparg);
58c5fc13
MT		 9563 break;
9564 case FUTEX_OP_OR:
66a7e928
MT		 9565@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
9566 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
58c5fc13
MT		 9567 return -EFAULT;
9568
66a7e928
MT		 9569- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
9570+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
bc901d79 9571 "2:\t.section .fixup, \"ax\"\n"
66a7e928 9572 "3:\tmov %3, %0\n"
58c5fc13
MT		 9573 "\tjmp 2b\n"
9574 "\t.previous\n"
9575 _ASM_EXTABLE(1b, 3b)
66a7e928
MT		 9576- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
9577+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
9578 : "i" (-EFAULT), "r" (newval), "1" (oldval)
58c5fc13
MT		 9579 : "memory"
9580 );
66a7e928
MT		 9581diff -urNp linux-2.6.39/arch/x86/include/asm/hw_irq.h linux-2.6.39/arch/x86/include/asm/hw_irq.h
9582--- linux-2.6.39/arch/x86/include/asm/hw_irq.h 2011-05-19 00:06:34.000000000 -0400
9583+++ linux-2.6.39/arch/x86/include/asm/hw_irq.h 2011-05-22 19:36:30.000000000 -0400
9584@@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
8308f9c9
MT		 9585 extern void enable_IO_APIC(void);
9586
9587 /* Statistics */
9588-extern atomic_t irq_err_count;
9589-extern atomic_t irq_mis_count;
9590+extern atomic_unchecked_t irq_err_count;
9591+extern atomic_unchecked_t irq_mis_count;
9592
9593 /* EISA */
9594 extern void eisa_set_level_irq(unsigned int irq);
66a7e928
MT		 9595diff -urNp linux-2.6.39/arch/x86/include/asm/i387.h linux-2.6.39/arch/x86/include/asm/i387.h
9596--- linux-2.6.39/arch/x86/include/asm/i387.h 2011-05-19 00:06:34.000000000 -0400
9597+++ linux-2.6.39/arch/x86/include/asm/i387.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 9598@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
df50ba0c
MT		 9599 {
9600 int err;
9601
9602+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9603+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9604+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
9605+#endif
9606+
bc901d79 9607 /* See comment in fxsave() below. */
16454cff
MT		 9608 #ifdef CONFIG_AS_FXSAVEQ
9609 asm volatile("1: fxrstorq %[fx]\n\t"
9610@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
df50ba0c
MT		 9611 {
9612 int err;
9613
9614+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9615+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9616+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9617+#endif
9618+
6892158b
MT		 9619 /*
9620 * Clear the bytes not touched by the fxsave and reserved
9621 * for the SW usage.
16454cff 9622@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
bc901d79 9623 #endif /* CONFIG_X86_64 */
58c5fc13
MT		 9624
9625 /* We need a safe address that is cheap to find and that is already
9626- in L1 during context switch. The best choices are unfortunately
9627- different for UP and SMP */
9628-#ifdef CONFIG_SMP
9629-#define safe_address (__per_cpu_offset[0])
9630-#else
9631-#define safe_address (kstat_cpu(0).cpustat.user)
9632-#endif
9633+ in L1 during context switch. */
9634+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9635
9636 /*
9637 * These must be called with preempt disabled
71d190be
MT		 9638@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
9639 struct thread_info *me = current_thread_info();
9640 preempt_disable();
9641 if (me->status & TS_USEDFPU)
9642- __save_init_fpu(me->task);
9643+ __save_init_fpu(current);
9644 else
9645 clts();
9646 }
66a7e928
MT		 9647diff -urNp linux-2.6.39/arch/x86/include/asm/io.h linux-2.6.39/arch/x86/include/asm/io.h
9648--- linux-2.6.39/arch/x86/include/asm/io.h 2011-05-19 00:06:34.000000000 -0400
9649+++ linux-2.6.39/arch/x86/include/asm/io.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 9650@@ -216,6 +216,17 @@ extern void set_iounmap_nonlazy(void);
58c5fc13
MT		 9651
9652 #include <linux/vmalloc.h>
9653
9654+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
ae4e228f 9655+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
58c5fc13 9656+{
c52201e0 9657+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
58c5fc13
MT		 9658+}
9659+
ae4e228f 9660+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
58c5fc13 9661+{
c52201e0 9662+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
58c5fc13
MT		 9663+}
9664+
df50ba0c
MT		 9665 /*
9666 * Convert a virtual cached pointer to an uncached pointer
9667 */
66a7e928
MT		 9668diff -urNp linux-2.6.39/arch/x86/include/asm/iommu.h linux-2.6.39/arch/x86/include/asm/iommu.h
9669--- linux-2.6.39/arch/x86/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
9670+++ linux-2.6.39/arch/x86/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 9671@@ -1,7 +1,7 @@
9672 #ifndef _ASM_X86_IOMMU_H
9673 #define _ASM_X86_IOMMU_H
9674
9675-extern struct dma_map_ops nommu_dma_ops;
9676+extern const struct dma_map_ops nommu_dma_ops;
9677 extern int force_iommu, no_iommu;
9678 extern int iommu_detected;
9679 extern int iommu_pass_through;
66a7e928
MT		 9680diff -urNp linux-2.6.39/arch/x86/include/asm/irqflags.h linux-2.6.39/arch/x86/include/asm/irqflags.h
9681--- linux-2.6.39/arch/x86/include/asm/irqflags.h 2011-05-19 00:06:34.000000000 -0400
9682+++ linux-2.6.39/arch/x86/include/asm/irqflags.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 9683@@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
ae4e228f
MT		 9684 sti; \
9685 sysexit
9686
df50ba0c
MT		 9687+#define GET_CR0_INTO_RDI mov %cr0, %rdi
9688+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
9689+#define GET_CR3_INTO_RDI mov %cr3, %rdi
9690+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
ae4e228f
MT		 9691+
9692 #else
58c5fc13
MT		 9693 #define INTERRUPT_RETURN iret
9694 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
66a7e928
MT		 9695diff -urNp linux-2.6.39/arch/x86/include/asm/kprobes.h linux-2.6.39/arch/x86/include/asm/kprobes.h
9696--- linux-2.6.39/arch/x86/include/asm/kprobes.h 2011-05-19 00:06:34.000000000 -0400
9697+++ linux-2.6.39/arch/x86/include/asm/kprobes.h 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 9698@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
9699 #define RELATIVEJUMP_SIZE 5
9700 #define RELATIVECALL_OPCODE 0xe8
9701 #define RELATIVE_ADDR_SIZE 4
9702-#define MAX_STACK_SIZE 64
9703-#define MIN_STACK_SIZE(ADDR) \
9704- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
9705- THREAD_SIZE - (unsigned long)(ADDR))) \
9706- ? (MAX_STACK_SIZE) \
9707- : (((unsigned long)current_thread_info()) + \
9708- THREAD_SIZE - (unsigned long)(ADDR)))
9709+#define MAX_STACK_SIZE 64UL
9710+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
9711
9712 #define flush_insn_slot(p) do { } while (0)
9713
66a7e928
MT		 9714diff -urNp linux-2.6.39/arch/x86/include/asm/kvm_host.h linux-2.6.39/arch/x86/include/asm/kvm_host.h
9715--- linux-2.6.39/arch/x86/include/asm/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
9716+++ linux-2.6.39/arch/x86/include/asm/kvm_host.h 2011-05-22 19:36:30.000000000 -0400
9717@@ -419,7 +419,7 @@ struct kvm_arch {
8308f9c9
MT		 9718 unsigned int n_used_mmu_pages;
9719 unsigned int n_requested_mmu_pages;
9720 unsigned int n_max_mmu_pages;
9721- atomic_t invlpg_counter;
9722+ atomic_unchecked_t invlpg_counter;
9723 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
9724 /*
9725 * Hash table of struct kvm_mmu_page.
66a7e928 9726@@ -599,7 +599,7 @@ struct kvm_arch_async_pf {
16454cff 9727 bool direct_map;
58c5fc13
MT		 9728 };
9729
9730-extern struct kvm_x86_ops *kvm_x86_ops;
9731+extern const struct kvm_x86_ops *kvm_x86_ops;
9732
9733 int kvm_mmu_module_init(void);
9734 void kvm_mmu_module_exit(void);
66a7e928
MT		 9735diff -urNp linux-2.6.39/arch/x86/include/asm/local.h linux-2.6.39/arch/x86/include/asm/local.h
9736--- linux-2.6.39/arch/x86/include/asm/local.h 2011-05-19 00:06:34.000000000 -0400
9737+++ linux-2.6.39/arch/x86/include/asm/local.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 9738@@ -18,26 +18,58 @@ typedef struct {
58c5fc13
MT		 9739
9740 static inline void local_inc(local_t *l)
9741 {
9742- asm volatile(_ASM_INC "%0"
9743+ asm volatile(_ASM_INC "%0\n"
9744+
9745+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9746+ "jno 0f\n"
58c5fc13 9747+ _ASM_DEC "%0\n"
bc901d79
MT		 9748+ "int $4\n0:\n"
9749+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9750+#endif
9751+
9752 : "+m" (l->a.counter));
9753 }
9754
9755 static inline void local_dec(local_t *l)
9756 {
9757- asm volatile(_ASM_DEC "%0"
9758+ asm volatile(_ASM_DEC "%0\n"
9759+
9760+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9761+ "jno 0f\n"
58c5fc13 9762+ _ASM_INC "%0\n"
bc901d79
MT		 9763+ "int $4\n0:\n"
9764+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9765+#endif
9766+
9767 : "+m" (l->a.counter));
9768 }
9769
9770 static inline void local_add(long i, local_t *l)
9771 {
9772- asm volatile(_ASM_ADD "%1,%0"
9773+ asm volatile(_ASM_ADD "%1,%0\n"
9774+
9775+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9776+ "jno 0f\n"
58c5fc13 9777+ _ASM_SUB "%1,%0\n"
bc901d79
MT		 9778+ "int $4\n0:\n"
9779+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9780+#endif
9781+
9782 : "+m" (l->a.counter)
9783 : "ir" (i));
9784 }
9785
9786 static inline void local_sub(long i, local_t *l)
9787 {
9788- asm volatile(_ASM_SUB "%1,%0"
9789+ asm volatile(_ASM_SUB "%1,%0\n"
9790+
9791+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9792+ "jno 0f\n"
58c5fc13 9793+ _ASM_ADD "%1,%0\n"
bc901d79
MT		 9794+ "int $4\n0:\n"
9795+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9796+#endif
9797+
9798 : "+m" (l->a.counter)
9799 : "ir" (i));
9800 }
bc901d79 9801@@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
58c5fc13
MT		 9802 {
9803 unsigned char c;
9804
9805- asm volatile(_ASM_SUB "%2,%0; sete %1"
9806+ asm volatile(_ASM_SUB "%2,%0\n"
9807+
9808+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9809+ "jno 0f\n"
58c5fc13 9810+ _ASM_ADD "%2,%0\n"
bc901d79
MT		 9811+ "int $4\n0:\n"
9812+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9813+#endif
9814+
9815+ "sete %1\n"
9816 : "+m" (l->a.counter), "=qm" (c)
9817 : "ir" (i) : "memory");
9818 return c;
bc901d79 9819@@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
58c5fc13
MT		 9820 {
9821 unsigned char c;
9822
9823- asm volatile(_ASM_DEC "%0; sete %1"
9824+ asm volatile(_ASM_DEC "%0\n"
9825+
9826+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9827+ "jno 0f\n"
58c5fc13 9828+ _ASM_INC "%0\n"
bc901d79
MT		 9829+ "int $4\n0:\n"
9830+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9831+#endif
9832+
9833+ "sete %1\n"
9834 : "+m" (l->a.counter), "=qm" (c)
9835 : : "memory");
9836 return c != 0;
bc901d79 9837@@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
58c5fc13
MT		 9838 {
9839 unsigned char c;
9840
9841- asm volatile(_ASM_INC "%0; sete %1"
9842+ asm volatile(_ASM_INC "%0\n"
9843+
9844+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9845+ "jno 0f\n"
58c5fc13 9846+ _ASM_DEC "%0\n"
bc901d79
MT		 9847+ "int $4\n0:\n"
9848+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9849+#endif
9850+
9851+ "sete %1\n"
9852 : "+m" (l->a.counter), "=qm" (c)
9853 : : "memory");
9854 return c != 0;
bc901d79 9855@@ -110,7 +169,16 @@ static inline int local_add_negative(lon
58c5fc13
MT		 9856 {
9857 unsigned char c;
9858
9859- asm volatile(_ASM_ADD "%2,%0; sets %1"
9860+ asm volatile(_ASM_ADD "%2,%0\n"
9861+
9862+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9863+ "jno 0f\n"
58c5fc13 9864+ _ASM_SUB "%2,%0\n"
bc901d79
MT		 9865+ "int $4\n0:\n"
9866+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9867+#endif
9868+
9869+ "sets %1\n"
9870 : "+m" (l->a.counter), "=qm" (c)
9871 : "ir" (i) : "memory");
9872 return c;
bc901d79 9873@@ -133,7 +201,15 @@ static inline long local_add_return(long
58c5fc13
MT		 9874 #endif
9875 /* Modern 486+ processor */
9876 __i = i;
9877- asm volatile(_ASM_XADD "%0, %1;"
9878+ asm volatile(_ASM_XADD "%0, %1\n"
9879+
9880+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 9881+ "jno 0f\n"
58c5fc13 9882+ _ASM_MOV "%0,%1\n"
bc901d79
MT		 9883+ "int $4\n0:\n"
9884+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 9885+#endif
9886+
9887 : "+r" (i), "+m" (l->a.counter)
9888 : : "memory");
9889 return i + __i;
66a7e928
MT		 9890diff -urNp linux-2.6.39/arch/x86/include/asm/mce.h linux-2.6.39/arch/x86/include/asm/mce.h
9891--- linux-2.6.39/arch/x86/include/asm/mce.h 2011-05-19 00:06:34.000000000 -0400
9892+++ linux-2.6.39/arch/x86/include/asm/mce.h 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 9893@@ -198,7 +198,7 @@ int mce_notify_irq(void);
9894 void mce_notify_process(void);
9895
9896 DECLARE_PER_CPU(struct mce, injectm);
9897-extern struct file_operations mce_chrdev_ops;
9898+extern struct file_operations mce_chrdev_ops; /* cannot be const, see arch/x86/kernel/cpu/mcheck/mce. */
9899
9900 /*
9901 * Exception handler
66a7e928
MT		 9902diff -urNp linux-2.6.39/arch/x86/include/asm/microcode.h linux-2.6.39/arch/x86/include/asm/microcode.h
9903--- linux-2.6.39/arch/x86/include/asm/microcode.h 2011-05-19 00:06:34.000000000 -0400
9904+++ linux-2.6.39/arch/x86/include/asm/microcode.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 9905@@ -12,13 +12,13 @@ struct device;
9906 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
9907
9908 struct microcode_ops {
9909- enum ucode_state (*request_microcode_user) (int cpu,
9910+ enum ucode_state (* const request_microcode_user) (int cpu,
9911 const void __user *buf, size_t size);
9912
9913- enum ucode_state (*request_microcode_fw) (int cpu,
9914+ enum ucode_state (* const request_microcode_fw) (int cpu,
9915 struct device *device);
9916
9917- void (*microcode_fini_cpu) (int cpu);
9918+ void (* const microcode_fini_cpu) (int cpu);
9919
9920 /*
9921 * The generic 'microcode_core' part guarantees that
16454cff 9922@@ -38,16 +38,16 @@ struct ucode_cpu_info {
ae4e228f
MT		 9923 extern struct ucode_cpu_info ucode_cpu_info[];
9924
9925 #ifdef CONFIG_MICROCODE_INTEL
9926-extern struct microcode_ops * __init init_intel_microcode(void);
9927+extern const struct microcode_ops * __init init_intel_microcode(void);
9928 #else
9929-static inline struct microcode_ops * __init init_intel_microcode(void)
9930+static inline const struct microcode_ops * __init init_intel_microcode(void)
9931 {
9932 return NULL;
9933 }
9934 #endif /* CONFIG_MICROCODE_INTEL */
9935
9936 #ifdef CONFIG_MICROCODE_AMD
9937-extern struct microcode_ops * __init init_amd_microcode(void);
9938+extern const struct microcode_ops * __init init_amd_microcode(void);
16454cff
MT		 9939
9940 static inline void get_ucode_data(void *to, const u8 *from, size_t n)
9941 {
9942@@ -55,7 +55,7 @@ static inline void get_ucode_data(void *
9943 }
9944
ae4e228f
MT		 9945 #else
9946-static inline struct microcode_ops * __init init_amd_microcode(void)
9947+static inline const struct microcode_ops * __init init_amd_microcode(void)
9948 {
9949 return NULL;
9950 }
66a7e928
MT		 9951diff -urNp linux-2.6.39/arch/x86/include/asm/mman.h linux-2.6.39/arch/x86/include/asm/mman.h
9952--- linux-2.6.39/arch/x86/include/asm/mman.h 2011-05-19 00:06:34.000000000 -0400
9953+++ linux-2.6.39/arch/x86/include/asm/mman.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 9954@@ -5,4 +5,14 @@
9955
9956 #include <asm-generic/mman.h>
58c5fc13
MT		 9957
9958+#ifdef __KERNEL__
9959+#ifndef __ASSEMBLY__
9960+#ifdef CONFIG_X86_32
9961+#define arch_mmap_check i386_mmap_check
9962+int i386_mmap_check(unsigned long addr, unsigned long len,
9963+ unsigned long flags);
9964+#endif
9965+#endif
9966+#endif
9967+
9968 #endif /* _ASM_X86_MMAN_H */
66a7e928
MT		 9969diff -urNp linux-2.6.39/arch/x86/include/asm/mmu_context.h linux-2.6.39/arch/x86/include/asm/mmu_context.h
9970--- linux-2.6.39/arch/x86/include/asm/mmu_context.h 2011-05-19 00:06:34.000000000 -0400
9971+++ linux-2.6.39/arch/x86/include/asm/mmu_context.h 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 9972@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
9973
9974 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
9975 {
9976+
9977+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9978+ unsigned int i;
9979+ pgd_t *pgd;
9980+
9981+ pax_open_kernel();
9982+ pgd = get_cpu_pgd(smp_processor_id());
9983+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
9984+ if (paravirt_enabled())
9985+ set_pgd(pgd+i, native_make_pgd(0));
9986+ else
9987+ pgd[i] = native_make_pgd(0);
9988+ pax_close_kernel();
9989+#endif
9990+
9991 #ifdef CONFIG_SMP
9992 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
9993 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
ea610fa8 9994@@ -34,16 +49,30 @@ static inline void switch_mm(struct mm_s
58c5fc13
MT		 9995 struct task_struct *tsk)
9996 {
9997 unsigned cpu = smp_processor_id();
9998+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
9999+ int tlbstate = TLBSTATE_OK;
10000+#endif
10001
10002 if (likely(prev != next)) {
58c5fc13
MT		 10003 #ifdef CONFIG_SMP
10004+#ifdef CONFIG_X86_32
10005+ tlbstate = percpu_read(cpu_tlbstate.state);
10006+#endif
10007 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10008 percpu_write(cpu_tlbstate.active_mm, next);
10009 #endif
df50ba0c
MT		 10010 cpumask_set_cpu(cpu, mm_cpumask(next));
10011
10012 /* Re-load page tables */
10013+#ifdef CONFIG_PAX_PER_CPU_PGD
10014+ pax_open_kernel();
10015+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10016+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10017+ pax_close_kernel();
10018+ load_cr3(get_cpu_pgd(cpu));
10019+#else
10020 load_cr3(next->pgd);
10021+#endif
ea610fa8 10022
c52201e0
MT		 10023 /* stop flush ipis for the previous mm */
10024 cpumask_clear_cpu(cpu, mm_cpumask(prev));
ea610fa8 10025@@ -53,9 +82,38 @@ static inline void switch_mm(struct mm_s
58c5fc13
MT		 10026 */
10027 if (unlikely(prev->context.ldt != next->context.ldt))
10028 load_LDT_nolock(&next->context);
df50ba0c 10029- }
58c5fc13
MT		 10030+
10031+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
ae4e228f 10032+ if (!(__supported_pte_mask & _PAGE_NX)) {
58c5fc13
MT		 10033+ smp_mb__before_clear_bit();
10034+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
10035+ smp_mb__after_clear_bit();
10036+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10037+ }
10038+#endif
10039+
10040+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10041+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
ae4e228f
MT		 10042+ prev->context.user_cs_limit != next->context.user_cs_limit))
10043+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
df50ba0c 10044 #ifdef CONFIG_SMP
ae4e228f 10045+ else if (unlikely(tlbstate != TLBSTATE_OK))
58c5fc13
MT		 10046+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10047+#endif
ae4e228f 10048+#endif
58c5fc13 10049+
df50ba0c 10050+ }
58c5fc13 10051 else {
df50ba0c
MT		 10052+
10053+#ifdef CONFIG_PAX_PER_CPU_PGD
10054+ pax_open_kernel();
10055+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10056+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10057+ pax_close_kernel();
10058+ load_cr3(get_cpu_pgd(cpu));
10059+#endif
10060+
10061+#ifdef CONFIG_SMP
10062 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10063 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
10064
ea610fa8 10065@@ -64,11 +122,28 @@ static inline void switch_mm(struct mm_s
df50ba0c
MT		 10066 * tlb flush IPI delivery. We must reload CR3
10067 * to make sure to use no freed page tables.
58c5fc13 10068 */
df50ba0c
MT		 10069+
10070+#ifndef CONFIG_PAX_PER_CPU_PGD
58c5fc13 10071 load_cr3(next->pgd);
df50ba0c
MT		 10072+#endif
10073+
58c5fc13
MT		 10074 load_LDT_nolock(&next->context);
10075+
10076+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
ae4e228f 10077+ if (!(__supported_pte_mask & _PAGE_NX))
58c5fc13
MT		 10078+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10079+#endif
10080+
10081+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10082+#ifdef CONFIG_PAX_PAGEEXEC
ae4e228f 10083+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
58c5fc13
MT		 10084+#endif
10085+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10086+#endif
10087+
10088 }
df50ba0c 10089- }
58c5fc13 10090 #endif
df50ba0c
MT		 10091+ }
10092 }
10093
10094 #define activate_mm(prev, next) \
66a7e928
MT		 10095diff -urNp linux-2.6.39/arch/x86/include/asm/mmu.h linux-2.6.39/arch/x86/include/asm/mmu.h
10096--- linux-2.6.39/arch/x86/include/asm/mmu.h 2011-05-19 00:06:34.000000000 -0400
10097+++ linux-2.6.39/arch/x86/include/asm/mmu.h 2011-05-22 19:36:30.000000000 -0400
10098@@ -9,10 +9,22 @@
57199397
MT		 10099 * we put the segment information here.
10100 */
10101 typedef struct {
10102- void *ldt;
10103+ struct desc_struct *ldt;
10104 int size;
10105 struct mutex lock;
10106- void *vdso;
10107+ unsigned long vdso;
10108+
10109+#ifdef CONFIG_X86_32
10110+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10111+ unsigned long user_cs_base;
10112+ unsigned long user_cs_limit;
10113+
10114+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10115+ cpumask_t cpu_user_cs_mask;
10116+#endif
10117+
10118+#endif
10119+#endif
57199397 10120
66a7e928
MT		 10121 #ifdef CONFIG_X86_64
10122 /* True if mm supports a task running in 32 bit compatibility mode. */
10123diff -urNp linux-2.6.39/arch/x86/include/asm/module.h linux-2.6.39/arch/x86/include/asm/module.h
10124--- linux-2.6.39/arch/x86/include/asm/module.h 2011-05-19 00:06:34.000000000 -0400
10125+++ linux-2.6.39/arch/x86/include/asm/module.h 2011-05-22 19:41:32.000000000 -0400
71d190be
MT		 10126@@ -5,6 +5,7 @@
10127
10128 #ifdef CONFIG_X86_64
10129 /* X86_64 does not define MODULE_PROC_FAMILY */
10130+#define MODULE_PROC_FAMILY ""
10131 #elif defined CONFIG_M386
10132 #define MODULE_PROC_FAMILY "386 "
10133 #elif defined CONFIG_M486
10134@@ -59,8 +60,30 @@
df50ba0c
MT		 10135 #error unknown processor family
10136 #endif
10137
71d190be
MT		 10138-#ifdef CONFIG_X86_32
10139-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
df50ba0c
MT		 10140+#ifdef CONFIG_PAX_MEMORY_UDEREF
10141+#define MODULE_PAX_UDEREF "UDEREF "
10142+#else
10143+#define MODULE_PAX_UDEREF ""
10144+#endif
10145+
71d190be
MT		 10146+#ifdef CONFIG_PAX_KERNEXEC
10147+#define MODULE_PAX_KERNEXEC "KERNEXEC "
df50ba0c 10148+#else
71d190be 10149+#define MODULE_PAX_KERNEXEC ""
58c5fc13
MT		 10150 #endif
10151
71d190be
MT		 10152+#ifdef CONFIG_PAX_REFCOUNT
10153+#define MODULE_PAX_REFCOUNT "REFCOUNT "
10154+#else
10155+#define MODULE_PAX_REFCOUNT ""
10156+#endif
10157+
10158+#ifdef CONFIG_GRKERNSEC
10159+#define MODULE_GRSEC "GRSECURITY "
10160+#else
10161+#define MODULE_GRSEC ""
10162+#endif
10163+
10164+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
10165+
58c5fc13 10166 #endif /* _ASM_X86_MODULE_H */
66a7e928
MT		 10167diff -urNp linux-2.6.39/arch/x86/include/asm/page_64_types.h linux-2.6.39/arch/x86/include/asm/page_64_types.h
10168--- linux-2.6.39/arch/x86/include/asm/page_64_types.h 2011-05-19 00:06:34.000000000 -0400
10169+++ linux-2.6.39/arch/x86/include/asm/page_64_types.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 10170@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
10171
10172 /* duplicated to the one in bootmem.h */
10173 extern unsigned long max_pfn;
10174-extern unsigned long phys_base;
10175+extern const unsigned long phys_base;
10176
10177 extern unsigned long __phys_addr(unsigned long);
10178 #define __phys_reloc_hide(x) (x)
66a7e928
MT		 10179diff -urNp linux-2.6.39/arch/x86/include/asm/paravirt.h linux-2.6.39/arch/x86/include/asm/paravirt.h
10180--- linux-2.6.39/arch/x86/include/asm/paravirt.h 2011-05-19 00:06:34.000000000 -0400
10181+++ linux-2.6.39/arch/x86/include/asm/paravirt.h 2011-05-22 19:36:30.000000000 -0400
16454cff 10182@@ -739,6 +739,21 @@ static inline void __set_fixmap(unsigned
ae4e228f
MT		 10183 pv_mmu_ops.set_fixmap(idx, phys, flags);
10184 }
10185
10186+#ifdef CONFIG_PAX_KERNEXEC
10187+static inline unsigned long pax_open_kernel(void)
10188+{
efbe55a5 10189+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
ae4e228f
MT		 10190+}
10191+
10192+static inline unsigned long pax_close_kernel(void)
10193+{
efbe55a5 10194+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
ae4e228f
MT		 10195+}
10196+#else
10197+static inline unsigned long pax_open_kernel(void) { return 0; }
10198+static inline unsigned long pax_close_kernel(void) { return 0; }
10199+#endif
10200+
10201 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
10202
10203 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
16454cff 10204@@ -955,7 +970,7 @@ extern void default_banner(void);
58c5fc13
MT		 10205
10206 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
10207 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
10208-#define PARA_INDIRECT(addr) *%cs:addr
10209+#define PARA_INDIRECT(addr) *%ss:addr
10210 #endif
10211
10212 #define INTERRUPT_RETURN \
16454cff 10213@@ -1032,6 +1047,21 @@ extern void default_banner(void);
df50ba0c 10214 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
ae4e228f
MT		 10215 CLBR_NONE, \
10216 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
58c5fc13 10217+
df50ba0c 10218+#define GET_CR0_INTO_RDI \
ae4e228f 10219+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
df50ba0c 10220+ mov %rax,%rdi
ae4e228f 10221+
df50ba0c
MT		 10222+#define SET_RDI_INTO_CR0 \
10223+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
ae4e228f 10224+
df50ba0c
MT		 10225+#define GET_CR3_INTO_RDI \
10226+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
10227+ mov %rax,%rdi
10228+
10229+#define SET_RDI_INTO_CR3 \
10230+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
ae4e228f
MT		 10231+
10232 #endif /* CONFIG_X86_32 */
10233
10234 #endif /* __ASSEMBLY__ */
66a7e928
MT		 10235diff -urNp linux-2.6.39/arch/x86/include/asm/paravirt_types.h linux-2.6.39/arch/x86/include/asm/paravirt_types.h
10236--- linux-2.6.39/arch/x86/include/asm/paravirt_types.h 2011-05-19 00:06:34.000000000 -0400
10237+++ linux-2.6.39/arch/x86/include/asm/paravirt_types.h 2011-05-22 19:36:30.000000000 -0400
16454cff 10238@@ -317,6 +317,12 @@ struct pv_mmu_ops {
ae4e228f
MT		 10239 an mfn. We can tell which is which from the index. */
10240 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
10241 phys_addr_t phys, pgprot_t flags);
10242+
10243+#ifdef CONFIG_PAX_KERNEXEC
10244+ unsigned long (*pax_open_kernel)(void);
10245+ unsigned long (*pax_close_kernel)(void);
10246+#endif
10247+
10248 };
10249
10250 struct arch_spinlock;
66a7e928
MT		 10251diff -urNp linux-2.6.39/arch/x86/include/asm/pci_x86.h linux-2.6.39/arch/x86/include/asm/pci_x86.h
10252--- linux-2.6.39/arch/x86/include/asm/pci_x86.h 2011-05-19 00:06:34.000000000 -0400
10253+++ linux-2.6.39/arch/x86/include/asm/pci_x86.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 10254@@ -93,16 +93,16 @@ extern int (*pcibios_enable_irq)(struct
ae4e228f
MT		 10255 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
10256
10257 struct pci_raw_ops {
10258- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10259+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10260 int reg, int len, u32 *val);
10261- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10262+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10263 int reg, int len, u32 val);
10264 };
10265
10266-extern struct pci_raw_ops *raw_pci_ops;
10267-extern struct pci_raw_ops *raw_pci_ext_ops;
10268+extern const struct pci_raw_ops *raw_pci_ops;
10269+extern const struct pci_raw_ops *raw_pci_ext_ops;
10270
10271-extern struct pci_raw_ops pci_direct_conf1;
10272+extern const struct pci_raw_ops pci_direct_conf1;
10273 extern bool port_cf9_safe;
10274
10275 /* arch_initcall level */
66a7e928
MT		 10276diff -urNp linux-2.6.39/arch/x86/include/asm/pgalloc.h linux-2.6.39/arch/x86/include/asm/pgalloc.h
10277--- linux-2.6.39/arch/x86/include/asm/pgalloc.h 2011-05-19 00:06:34.000000000 -0400
10278+++ linux-2.6.39/arch/x86/include/asm/pgalloc.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 10279@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
58c5fc13
MT		 10280 pmd_t *pmd, pte_t *pte)
10281 {
10282 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10283+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
10284+}
10285+
10286+static inline void pmd_populate_user(struct mm_struct *mm,
10287+ pmd_t *pmd, pte_t *pte)
10288+{
10289+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10290 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
10291 }
10292
66a7e928
MT		 10293diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable-2level.h linux-2.6.39/arch/x86/include/asm/pgtable-2level.h
10294--- linux-2.6.39/arch/x86/include/asm/pgtable-2level.h 2011-05-19 00:06:34.000000000 -0400
10295+++ linux-2.6.39/arch/x86/include/asm/pgtable-2level.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 10296@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
58c5fc13
MT		 10297
10298 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10299 {
ae4e228f 10300+ pax_open_kernel();
58c5fc13 10301 *pmdp = pmd;
ae4e228f 10302+ pax_close_kernel();
58c5fc13
MT		 10303 }
10304
10305 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
66a7e928
MT		 10306diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_32.h linux-2.6.39/arch/x86/include/asm/pgtable_32.h
10307--- linux-2.6.39/arch/x86/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
10308+++ linux-2.6.39/arch/x86/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
6892158b 10309@@ -25,9 +25,6 @@
57199397
MT		 10310 struct mm_struct;
10311 struct vm_area_struct;
10312
10313-extern pgd_t swapper_pg_dir[1024];
bc901d79 10314-extern pgd_t initial_page_table[1024];
57199397
MT		 10315-
10316 static inline void pgtable_cache_init(void) { }
10317 static inline void check_pgt_cache(void) { }
10318 void paging_init(void);
6892158b 10319@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
57199397
MT		 10320 # include <asm/pgtable-2level.h>
10321 #endif
10322
10323+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
bc901d79 10324+extern pgd_t initial_page_table[PTRS_PER_PGD];
57199397
MT		 10325+#ifdef CONFIG_X86_PAE
10326+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
10327+#endif
10328+
10329 #if defined(CONFIG_HIGHPTE)
bc901d79
MT		 10330 #define pte_offset_map(dir, address) \
10331 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
10332@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
57199397
MT		 10333 /* Clear a kernel PTE and flush it from the TLB */
10334 #define kpte_clear_flush(ptep, vaddr) \
10335 do { \
10336+ pax_open_kernel(); \
10337 pte_clear(&init_mm, (vaddr), (ptep)); \
10338+ pax_close_kernel(); \
10339 __flush_tlb_one((vaddr)); \
10340 } while (0)
10341
bc901d79 10342@@ -74,6 +79,9 @@ do { \
57199397
MT		 10343
10344 #endif /* !__ASSEMBLY__ */
10345
10346+#define HAVE_ARCH_UNMAPPED_AREA
10347+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
10348+
10349 /*
10350 * kern_addr_valid() is (1) for FLATMEM and (0) for
10351 * SPARSEMEM and DISCONTIGMEM
66a7e928
MT		 10352diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h
10353--- linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h 2011-05-19 00:06:34.000000000 -0400
10354+++ linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 10355@@ -8,7 +8,7 @@
10356 */
10357 #ifdef CONFIG_X86_PAE
10358 # include <asm/pgtable-3level_types.h>
10359-# define PMD_SIZE (1UL << PMD_SHIFT)
10360+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
10361 # define PMD_MASK (~(PMD_SIZE - 1))
10362 #else
10363 # include <asm/pgtable-2level_types.h>
10364@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
10365 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
10366 #endif
10367
10368+#ifdef CONFIG_PAX_KERNEXEC
10369+#ifndef __ASSEMBLY__
10370+extern unsigned char MODULES_EXEC_VADDR[];
10371+extern unsigned char MODULES_EXEC_END[];
10372+#endif
10373+#include <asm/boot.h>
10374+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
10375+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
10376+#else
10377+#define ktla_ktva(addr) (addr)
10378+#define ktva_ktla(addr) (addr)
10379+#endif
10380+
10381 #define MODULES_VADDR VMALLOC_START
10382 #define MODULES_END VMALLOC_END
10383 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
66a7e928
MT		 10384diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable-3level.h linux-2.6.39/arch/x86/include/asm/pgtable-3level.h
10385--- linux-2.6.39/arch/x86/include/asm/pgtable-3level.h 2011-05-19 00:06:34.000000000 -0400
10386+++ linux-2.6.39/arch/x86/include/asm/pgtable-3level.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 10387@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
58c5fc13
MT		 10388
10389 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10390 {
ae4e228f 10391+ pax_open_kernel();
58c5fc13 10392 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
ae4e228f 10393+ pax_close_kernel();
58c5fc13
MT		 10394 }
10395
10396 static inline void native_set_pud(pud_t *pudp, pud_t pud)
10397 {
ae4e228f 10398+ pax_open_kernel();
58c5fc13 10399 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
ae4e228f 10400+ pax_close_kernel();
58c5fc13
MT		 10401 }
10402
10403 /*
66a7e928
MT		 10404diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_64.h linux-2.6.39/arch/x86/include/asm/pgtable_64.h
10405--- linux-2.6.39/arch/x86/include/asm/pgtable_64.h 2011-05-19 00:06:34.000000000 -0400
10406+++ linux-2.6.39/arch/x86/include/asm/pgtable_64.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 10407@@ -16,10 +16,13 @@
10408
10409 extern pud_t level3_kernel_pgt[512];
10410 extern pud_t level3_ident_pgt[512];
10411+extern pud_t level3_vmalloc_pgt[512];
10412+extern pud_t level3_vmemmap_pgt[512];
10413+extern pud_t level2_vmemmap_pgt[512];
10414 extern pmd_t level2_kernel_pgt[512];
10415 extern pmd_t level2_fixmap_pgt[512];
10416-extern pmd_t level2_ident_pgt[512];
10417-extern pgd_t init_level4_pgt[];
10418+extern pmd_t level2_ident_pgt[512*2];
10419+extern pgd_t init_level4_pgt[512];
10420
10421 #define swapper_pg_dir init_level4_pgt
10422
16454cff 10423@@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
57199397
MT		 10424
10425 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10426 {
10427+ pax_open_kernel();
10428 *pmdp = pmd;
10429+ pax_close_kernel();
10430 }
10431
10432 static inline void native_pmd_clear(pmd_t *pmd)
16454cff 10433@@ -107,7 +112,9 @@ static inline void native_pud_clear(pud_
57199397
MT		 10434
10435 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
10436 {
10437+ pax_open_kernel();
10438 *pgdp = pgd;
10439+ pax_close_kernel();
10440 }
10441
10442 static inline void native_pgd_clear(pgd_t *pgd)
66a7e928
MT		 10443diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h
10444--- linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h 2011-05-19 00:06:34.000000000 -0400
10445+++ linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 10446@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
10447 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
10448 #define MODULES_END _AC(0xffffffffff000000, UL)
10449 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
10450+#define MODULES_EXEC_VADDR MODULES_VADDR
10451+#define MODULES_EXEC_END MODULES_END
10452+
10453+#define ktla_ktva(addr) (addr)
10454+#define ktva_ktla(addr) (addr)
10455
10456 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
66a7e928
MT		 10457diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable.h linux-2.6.39/arch/x86/include/asm/pgtable.h
10458--- linux-2.6.39/arch/x86/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
10459+++ linux-2.6.39/arch/x86/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
16454cff 10460@@ -81,12 +81,51 @@ extern struct mm_struct *pgd_page_get_mm
ae4e228f
MT		 10461
10462 #define arch_end_context_switch(prev) do {} while(0)
10463
10464+#define pax_open_kernel() native_pax_open_kernel()
10465+#define pax_close_kernel() native_pax_close_kernel()
10466 #endif /* CONFIG_PARAVIRT */
10467
10468+#define __HAVE_ARCH_PAX_OPEN_KERNEL
10469+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
58c5fc13
MT		 10470+
10471+#ifdef CONFIG_PAX_KERNEXEC
ae4e228f
MT		 10472+static inline unsigned long native_pax_open_kernel(void)
10473+{
58c5fc13
MT		 10474+ unsigned long cr0;
10475+
ae4e228f
MT		 10476+ preempt_disable();
10477+ barrier();
10478+ cr0 = read_cr0() ^ X86_CR0_WP;
10479+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
10480+ write_cr0(cr0);
10481+ return cr0 ^ X86_CR0_WP;
10482+}
58c5fc13 10483+
ae4e228f
MT		 10484+static inline unsigned long native_pax_close_kernel(void)
10485+{
10486+ unsigned long cr0;
58c5fc13 10487+
ae4e228f
MT		 10488+ cr0 = read_cr0() ^ X86_CR0_WP;
10489+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
10490+ write_cr0(cr0);
10491+ barrier();
10492+ preempt_enable_no_resched();
10493+ return cr0 ^ X86_CR0_WP;
10494+}
10495+#else
10496+static inline unsigned long native_pax_open_kernel(void) { return 0; }
10497+static inline unsigned long native_pax_close_kernel(void) { return 0; }
58c5fc13
MT		 10498+#endif
10499+
ae4e228f 10500 /*
58c5fc13
MT		 10501 * The following only work if pte_present() is true.
10502 * Undefined behaviour if not..
10503 */
10504+static inline int pte_user(pte_t pte)
10505+{
10506+ return pte_val(pte) & _PAGE_USER;
10507+}
10508+
10509 static inline int pte_dirty(pte_t pte)
10510 {
10511 return pte_flags(pte) & _PAGE_DIRTY;
16454cff 10512@@ -196,9 +235,29 @@ static inline pte_t pte_wrprotect(pte_t
58c5fc13
MT		 10513 return pte_clear_flags(pte, _PAGE_RW);
10514 }
10515
10516+static inline pte_t pte_mkread(pte_t pte)
10517+{
10518+ return __pte(pte_val(pte) | _PAGE_USER);
10519+}
10520+
10521 static inline pte_t pte_mkexec(pte_t pte)
10522 {
10523- return pte_clear_flags(pte, _PAGE_NX);
10524+#ifdef CONFIG_X86_PAE
10525+ if (__supported_pte_mask & _PAGE_NX)
10526+ return pte_clear_flags(pte, _PAGE_NX);
10527+ else
10528+#endif
10529+ return pte_set_flags(pte, _PAGE_USER);
10530+}
10531+
10532+static inline pte_t pte_exprotect(pte_t pte)
10533+{
10534+#ifdef CONFIG_X86_PAE
10535+ if (__supported_pte_mask & _PAGE_NX)
10536+ return pte_set_flags(pte, _PAGE_NX);
10537+ else
10538+#endif
10539+ return pte_clear_flags(pte, _PAGE_USER);
10540 }
10541
10542 static inline pte_t pte_mkdirty(pte_t pte)
16454cff 10543@@ -390,6 +449,15 @@ pte_t *populate_extra_pte(unsigned long
df50ba0c
MT		 10544 #endif
10545
10546 #ifndef __ASSEMBLY__
10547+
10548+#ifdef CONFIG_PAX_PER_CPU_PGD
10549+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10550+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10551+{
10552+ return cpu_pgd[cpu];
10553+}
10554+#endif
10555+
10556 #include <linux/mm_types.h>
10557
10558 static inline int pte_none(pte_t pte)
16454cff 10559@@ -560,7 +628,7 @@ static inline pud_t *pud_offset(pgd_t *p
58c5fc13
MT		 10560
10561 static inline int pgd_bad(pgd_t pgd)
10562 {
10563- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10564+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10565 }
10566
10567 static inline int pgd_none(pgd_t pgd)
16454cff 10568@@ -583,7 +651,12 @@ static inline int pgd_none(pgd_t pgd)
df50ba0c
MT		 10569 * pgd_offset() returns a (pgd_t *)
10570 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10571 */
10572-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10573+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10574+
10575+#ifdef CONFIG_PAX_PER_CPU_PGD
10576+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10577+#endif
10578+
10579 /*
10580 * a shortcut which implies the use of the kernel's pgd, instead
10581 * of a process's
16454cff 10582@@ -594,6 +667,20 @@ static inline int pgd_none(pgd_t pgd)
df50ba0c
MT		 10583 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10584 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10585
10586+#ifdef CONFIG_X86_32
10587+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10588+#else
10589+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10590+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10591+
10592+#ifdef CONFIG_PAX_MEMORY_UDEREF
10593+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10594+#else
10595+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10596+#endif
10597+
10598+#endif
10599+
10600 #ifndef __ASSEMBLY__
10601
10602 extern int direct_gbpages;
16454cff 10603@@ -758,11 +845,23 @@ static inline void pmdp_set_wrprotect(st
ae4e228f
MT		 10604 * dst and src can be on the same page, but the range must not overlap,
10605 * and must not cross a page boundary.
58c5fc13 10606 */
ae4e228f
MT		 10607-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10608+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
58c5fc13
MT		 10609 {
10610- memcpy(dst, src, count * sizeof(pgd_t));
ae4e228f
MT		 10611+ pax_open_kernel();
10612+ while (count--)
10613+ *dst++ = *src++;
10614+ pax_close_kernel();
58c5fc13
MT		 10615 }
10616
df50ba0c
MT		 10617+#ifdef CONFIG_PAX_PER_CPU_PGD
10618+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10619+#endif
10620+
10621+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10622+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10623+#else
10624+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10625+#endif
58c5fc13 10626
df50ba0c
MT		 10627 #include <asm-generic/pgtable.h>
10628 #endif /* __ASSEMBLY__ */
66a7e928
MT		 10629diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_types.h linux-2.6.39/arch/x86/include/asm/pgtable_types.h
10630--- linux-2.6.39/arch/x86/include/asm/pgtable_types.h 2011-05-19 00:06:34.000000000 -0400
10631+++ linux-2.6.39/arch/x86/include/asm/pgtable_types.h 2011-05-22 19:36:30.000000000 -0400
16454cff 10632@@ -16,13 +16,12 @@
58c5fc13
MT		 10633 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10634 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10635 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10636-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10637+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10638 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10639 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10640 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10641-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10642-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
16454cff 10643-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
58c5fc13 10644+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
16454cff 10645+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
58c5fc13
MT		 10646 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10647
10648 /* If _PAGE_BIT_PRESENT is clear, we use these: */
16454cff 10649@@ -40,7 +39,6 @@
58c5fc13
MT		 10650 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10651 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10652 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10653-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10654 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10655 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10656 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
16454cff 10657@@ -57,8 +55,10 @@
58c5fc13
MT		 10658
10659 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10660 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10661-#else
10662+#elif defined(CONFIG_KMEMCHECK)
10663 #define _PAGE_NX (_AT(pteval_t, 0))
10664+#else
10665+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10666 #endif
10667
10668 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
16454cff 10669@@ -96,6 +96,9 @@
58c5fc13
MT		 10670 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10671 _PAGE_ACCESSED)
10672
10673+#define PAGE_READONLY_NOEXEC PAGE_READONLY
10674+#define PAGE_SHARED_NOEXEC PAGE_SHARED
10675+
10676 #define __PAGE_KERNEL_EXEC \
10677 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10678 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
16454cff 10679@@ -106,8 +109,8 @@
58c5fc13
MT		 10680 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10681 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10682 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10683-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10684-#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
10685+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
10686+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
10687 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
10688 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
10689 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
16454cff 10690@@ -166,8 +169,8 @@
58c5fc13
MT		 10691 * bits are combined, this will alow user to access the high address mapped
10692 * VDSO in the presence of CONFIG_COMPAT_VDSO
10693 */
10694-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
10695-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
10696+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10697+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10698 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
10699 #endif
10700
16454cff 10701@@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
57199397
MT		 10702 {
10703 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
10704 }
10705+#endif
10706
10707+#if PAGETABLE_LEVELS == 3
10708+#include <asm-generic/pgtable-nopud.h>
10709+#endif
10710+
10711+#if PAGETABLE_LEVELS == 2
10712+#include <asm-generic/pgtable-nopmd.h>
10713+#endif
10714+
10715+#ifndef __ASSEMBLY__
10716 #if PAGETABLE_LEVELS > 3
10717 typedef struct { pudval_t pud; } pud_t;
10718
16454cff 10719@@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
57199397
MT		 10720 return pud.pud;
10721 }
10722 #else
10723-#include <asm-generic/pgtable-nopud.h>
10724-
10725 static inline pudval_t native_pud_val(pud_t pud)
10726 {
10727 return native_pgd_val(pud.pgd);
16454cff 10728@@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
57199397
MT		 10729 return pmd.pmd;
10730 }
10731 #else
10732-#include <asm-generic/pgtable-nopmd.h>
10733-
10734 static inline pmdval_t native_pmd_val(pmd_t pmd)
10735 {
10736 return native_pgd_val(pmd.pud.pgd);
16454cff 10737@@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
58c5fc13
MT		 10738
10739 extern pteval_t __supported_pte_mask;
ae4e228f
MT		 10740 extern void set_nx(void);
10741-extern int nx_enabled;
58c5fc13
MT		 10742
10743 #define pgprot_writecombine pgprot_writecombine
10744 extern pgprot_t pgprot_writecombine(pgprot_t prot);
66a7e928
MT		 10745diff -urNp linux-2.6.39/arch/x86/include/asm/processor.h linux-2.6.39/arch/x86/include/asm/processor.h
10746--- linux-2.6.39/arch/x86/include/asm/processor.h 2011-05-19 00:06:34.000000000 -0400
10747+++ linux-2.6.39/arch/x86/include/asm/processor.h 2011-05-22 19:36:30.000000000 -0400
10748@@ -266,7 +266,7 @@ struct tss_struct {
58c5fc13
MT		 10749
10750 } ____cacheline_aligned;
10751
10752-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10753+extern struct tss_struct init_tss[NR_CPUS];
10754
10755 /*
10756 * Save the original ist values for checking stack pointers during debugging
66a7e928 10757@@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
58c5fc13
MT		 10758 */
10759 #define TASK_SIZE PAGE_OFFSET
10760 #define TASK_SIZE_MAX TASK_SIZE
10761+
10762+#ifdef CONFIG_PAX_SEGMEXEC
10763+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
58c5fc13
MT		 10764+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10765+#else
10766 #define STACK_TOP TASK_SIZE
10767-#define STACK_TOP_MAX STACK_TOP
10768+#endif
ae4e228f 10769+
58c5fc13
MT		 10770+#define STACK_TOP_MAX TASK_SIZE
10771
10772 #define INIT_THREAD { \
66a7e928
MT		 10773- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10774+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10775 .vm86_info = NULL, \
10776 .sysenter_cs = __KERNEL_CS, \
10777 .io_bitmap_ptr = NULL, \
10778@@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
58c5fc13
MT		 10779 */
10780 #define INIT_TSS { \
10781 .x86_tss = { \
10782- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10783+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10784 .ss0 = __KERNEL_DS, \
10785 .ss1 = __KERNEL_CS, \
10786 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
66a7e928 10787@@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
58c5fc13
MT		 10788 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10789
10790 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10791-#define KSTK_TOP(info) \
10792-({ \
10793- unsigned long *__ptr = (unsigned long *)(info); \
10794- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10795-})
71d190be 10796+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
58c5fc13
MT		 10797
10798 /*
10799 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
66a7e928 10800@@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
58c5fc13
MT		 10801 #define task_pt_regs(task) \
10802 ({ \
10803 struct pt_regs *__regs__; \
10804- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10805+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10806 __regs__ - 1; \
10807 })
10808
66a7e928 10809@@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
df50ba0c
MT		 10810 /*
10811 * User space process size. 47bits minus one guard page.
10812 */
10813-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10814+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10815
10816 /* This decides where the kernel will search for a free chunk of vm
58c5fc13
MT		 10817 * space during mmap's.
10818 */
10819 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10820- 0xc0000000 : 0xFFFFe000)
10821+ 0xc0000000 : 0xFFFFf000)
10822
10823 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10824 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
66a7e928
MT		 10825@@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
10826 #define STACK_TOP_MAX TASK_SIZE_MAX
10827
10828 #define INIT_THREAD { \
10829- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10830+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10831 }
10832
10833 #define INIT_TSS { \
10834- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10835+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10836 }
10837
10838 /*
10839@@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
58c5fc13
MT		 10840 */
10841 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
10842
10843+#ifdef CONFIG_PAX_SEGMEXEC
10844+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
10845+#endif
10846+
10847 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
10848
10849 /* Get/set a process' ability to use the timestamp counter instruction */
66a7e928
MT		 10850diff -urNp linux-2.6.39/arch/x86/include/asm/ptrace.h linux-2.6.39/arch/x86/include/asm/ptrace.h
10851--- linux-2.6.39/arch/x86/include/asm/ptrace.h 2011-05-19 00:06:34.000000000 -0400
10852+++ linux-2.6.39/arch/x86/include/asm/ptrace.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f 10853@@ -152,28 +152,29 @@ static inline unsigned long regs_return_
58c5fc13
MT		 10854 }
10855
10856 /*
10857- * user_mode_vm(regs) determines whether a register set came from user mode.
10858+ * user_mode(regs) determines whether a register set came from user mode.
10859 * This is true if V8086 mode was enabled OR if the register set was from
10860 * protected mode with RPL-3 CS value. This tricky test checks that with
10861 * one comparison. Many places in the kernel can bypass this full check
10862- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
10863+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
10864+ * be used.
10865 */
10866-static inline int user_mode(struct pt_regs *regs)
10867+static inline int user_mode_novm(struct pt_regs *regs)
10868 {
10869 #ifdef CONFIG_X86_32
10870 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
10871 #else
10872- return !!(regs->cs & 3);
10873+ return !!(regs->cs & SEGMENT_RPL_MASK);
10874 #endif
10875 }
10876
10877-static inline int user_mode_vm(struct pt_regs *regs)
10878+static inline int user_mode(struct pt_regs *regs)
10879 {
10880 #ifdef CONFIG_X86_32
10881 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
10882 USER_RPL;
10883 #else
10884- return user_mode(regs);
10885+ return user_mode_novm(regs);
10886 #endif
10887 }
10888
66a7e928
MT		 10889diff -urNp linux-2.6.39/arch/x86/include/asm/reboot.h linux-2.6.39/arch/x86/include/asm/reboot.h
10890--- linux-2.6.39/arch/x86/include/asm/reboot.h 2011-05-19 00:06:34.000000000 -0400
10891+++ linux-2.6.39/arch/x86/include/asm/reboot.h 2011-05-22 19:36:30.000000000 -0400
10892@@ -6,19 +6,19 @@
10893 struct pt_regs;
10894
10895 struct machine_ops {
10896- void (*restart)(char *cmd);
10897- void (*halt)(void);
10898- void (*power_off)(void);
10899+ void (* __noreturn restart)(char *cmd);
10900+ void (* __noreturn halt)(void);
10901+ void (* __noreturn power_off)(void);
10902 void (*shutdown)(void);
10903 void (*crash_shutdown)(struct pt_regs *);
10904- void (*emergency_restart)(void);
10905+ void (* __noreturn emergency_restart)(void);
10906 };
10907
10908 extern struct machine_ops machine_ops;
58c5fc13
MT		 10909
10910 void native_machine_crash_shutdown(struct pt_regs *regs);
10911 void native_machine_shutdown(void);
66a7e928
MT		 10912-void machine_real_restart(unsigned int type);
10913+void machine_real_restart(unsigned int type) __noreturn;
10914 /* These must match dispatch_table in reboot_32.S */
10915 #define MRR_BIOS 0
10916 #define MRR_APM 1
10917diff -urNp linux-2.6.39/arch/x86/include/asm/rwsem.h linux-2.6.39/arch/x86/include/asm/rwsem.h
10918--- linux-2.6.39/arch/x86/include/asm/rwsem.h 2011-05-19 00:06:34.000000000 -0400
10919+++ linux-2.6.39/arch/x86/include/asm/rwsem.h 2011-05-22 19:36:30.000000000 -0400
10920@@ -64,6 +64,14 @@ static inline void __down_read(struct rw
58c5fc13
MT		 10921 {
10922 asm volatile("# beginning down_read\n\t"
df50ba0c 10923 LOCK_PREFIX _ASM_INC "(%1)\n\t"
58c5fc13
MT		 10924+
10925+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 10926+ "jno 0f\n"
df50ba0c 10927+ LOCK_PREFIX _ASM_DEC "(%1)\n"
bc901d79
MT		 10928+ "int $4\n0:\n"
10929+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 10930+#endif
10931+
6892158b 10932 /* adds 0x00000001 */
bc901d79 10933 " jns 1f\n"
58c5fc13 10934 " call call_rwsem_down_read_failed\n"
66a7e928 10935@@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
bc901d79 10936 "1:\n\t"
df50ba0c
MT		 10937 " mov %1,%2\n\t"
10938 " add %3,%2\n\t"
58c5fc13
MT		 10939+
10940+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 10941+ "jno 0f\n"
df50ba0c 10942+ "sub %3,%2\n"
bc901d79
MT		 10943+ "int $4\n0:\n"
10944+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 10945+#endif
10946+
bc901d79 10947 " jle 2f\n\t"
df50ba0c 10948 LOCK_PREFIX " cmpxchg %2,%0\n\t"
bc901d79 10949 " jnz 1b\n\t"
66a7e928
MT		 10950@@ -104,6 +120,14 @@ static inline void __down_write_nested(s
10951 long tmp;
58c5fc13 10952 asm volatile("# beginning down_write\n\t"
df50ba0c 10953 LOCK_PREFIX " xadd %1,(%2)\n\t"
58c5fc13
MT		 10954+
10955+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 10956+ "jno 0f\n"
df50ba0c 10957+ "mov %1,(%2)\n"
bc901d79
MT		 10958+ "int $4\n0:\n"
10959+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 10960+#endif
10961+
6892158b 10962 /* adds 0xffff0001, returns the old value */
df50ba0c 10963 " test %1,%1\n\t"
58c5fc13 10964 /* was the count 0 before? */
66a7e928
MT		 10965@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
10966 long tmp;
58c5fc13 10967 asm volatile("# beginning __up_read\n\t"
df50ba0c 10968 LOCK_PREFIX " xadd %1,(%2)\n\t"
58c5fc13
MT		 10969+
10970+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 10971+ "jno 0f\n"
df50ba0c 10972+ "mov %1,(%2)\n"
bc901d79
MT		 10973+ "int $4\n0:\n"
10974+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 10975+#endif
10976+
10977 /* subtracts 1, returns the old value */
bc901d79 10978 " jns 1f\n\t"
6892158b 10979 " call call_rwsem_wake\n" /* expects old value in %edx */
66a7e928
MT		 10980@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
10981 long tmp;
58c5fc13 10982 asm volatile("# beginning __up_write\n\t"
df50ba0c 10983 LOCK_PREFIX " xadd %1,(%2)\n\t"
58c5fc13
MT		 10984+
10985+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 10986+ "jno 0f\n"
df50ba0c 10987+ "mov %1,(%2)\n"
bc901d79
MT		 10988+ "int $4\n0:\n"
10989+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 10990+#endif
10991+
6892158b 10992 /* subtracts 0xffff0001, returns the old value */
bc901d79 10993 " jns 1f\n\t"
6892158b 10994 " call call_rwsem_wake\n" /* expects old value in %edx */
66a7e928 10995@@ -176,6 +216,14 @@ static inline void __downgrade_write(str
58c5fc13
MT		 10996 {
10997 asm volatile("# beginning __downgrade_write\n\t"
df50ba0c 10998 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
58c5fc13
MT		 10999+
11000+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11001+ "jno 0f\n"
df50ba0c 11002+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
bc901d79
MT		 11003+ "int $4\n0:\n"
11004+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11005+#endif
11006+
df50ba0c
MT		 11007 /*
11008 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
11009 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
66a7e928
MT		 11010@@ -194,7 +242,15 @@ static inline void __downgrade_write(str
11011 */
11012 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
58c5fc13 11013 {
df50ba0c
MT		 11014- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
11015+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
58c5fc13
MT		 11016+
11017+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11018+ "jno 0f\n"
df50ba0c 11019+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
bc901d79
MT		 11020+ "int $4\n0:\n"
11021+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11022+#endif
11023+
11024 : "+m" (sem->count)
df50ba0c 11025 : "er" (delta));
58c5fc13 11026 }
66a7e928 11027@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
58c5fc13 11028 {
66a7e928 11029 long tmp = delta;
58c5fc13
MT		 11030
11031- asm volatile(LOCK_PREFIX "xadd %0,%1"
11032+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
11033+
11034+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11035+ "jno 0f\n"
df50ba0c 11036+ "mov %0,%1\n"
bc901d79
MT		 11037+ "int $4\n0:\n"
11038+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11039+#endif
11040+
11041 : "+r" (tmp), "+m" (sem->count)
11042 : : "memory");
11043
66a7e928
MT		 11044diff -urNp linux-2.6.39/arch/x86/include/asm/segment.h linux-2.6.39/arch/x86/include/asm/segment.h
11045--- linux-2.6.39/arch/x86/include/asm/segment.h 2011-05-19 00:06:34.000000000 -0400
11046+++ linux-2.6.39/arch/x86/include/asm/segment.h 2011-05-22 19:36:30.000000000 -0400
11047@@ -64,8 +64,8 @@
ae4e228f
MT		 11048 * 26 - ESPFIX small SS
11049 * 27 - per-cpu [ offset to per-cpu data area ]
11050 * 28 - stack_canary-20 [ for stack protector ]
11051- * 29 - unused
11052- * 30 - unused
11053+ * 29 - PCI BIOS CS
11054+ * 30 - PCI BIOS DS
11055 * 31 - TSS for double fault handler
11056 */
11057 #define GDT_ENTRY_TLS_MIN 6
66a7e928 11058@@ -79,6 +79,8 @@
ae4e228f 11059
bc901d79 11060 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
ae4e228f
MT		 11061
11062+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
11063+
bc901d79 11064 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
58c5fc13 11065
bc901d79 11066 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
66a7e928 11067@@ -104,6 +106,12 @@
58c5fc13
MT		 11068 #define __KERNEL_STACK_CANARY 0
11069 #endif
11070
bc901d79 11071+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
58c5fc13
MT		 11072+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
11073+
bc901d79 11074+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
58c5fc13
MT		 11075+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
11076+
11077 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
11078
11079 /*
66a7e928 11080@@ -141,7 +149,7 @@
58c5fc13
MT		 11081 */
11082
11083 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
11084-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
11085+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
11086
11087
11088 #else
66a7e928 11089@@ -165,6 +173,8 @@
ae4e228f
MT		 11090 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
11091 #define __USER32_DS __USER_DS
11092
11093+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
11094+
11095 #define GDT_ENTRY_TSS 8 /* needs two entries */
11096 #define GDT_ENTRY_LDT 10 /* needs two entries */
11097 #define GDT_ENTRY_TLS_MIN 12
66a7e928 11098@@ -185,6 +195,7 @@
ae4e228f
MT		 11099 #endif
11100
bc901d79
MT		 11101 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
11102+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
11103 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
11104 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
11105 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
66a7e928
MT		 11106diff -urNp linux-2.6.39/arch/x86/include/asm/smp.h linux-2.6.39/arch/x86/include/asm/smp.h
11107--- linux-2.6.39/arch/x86/include/asm/smp.h 2011-05-19 00:06:34.000000000 -0400
11108+++ linux-2.6.39/arch/x86/include/asm/smp.h 2011-05-22 19:36:30.000000000 -0400
11109@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
11110 /* cpus sharing the last level cache: */
11111 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
6892158b
MT		 11112 DECLARE_PER_CPU(u16, cpu_llc_id);
11113-DECLARE_PER_CPU(int, cpu_number);
11114+DECLARE_PER_CPU(unsigned int, cpu_number);
11115
11116 static inline struct cpumask *cpu_sibling_mask(int cpu)
11117 {
66a7e928 11118@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
71d190be
MT		 11119 extern int safe_smp_processor_id(void);
11120
11121 #elif defined(CONFIG_X86_64_SMP)
11122-#define raw_smp_processor_id() (percpu_read(cpu_number))
11123-
11124-#define stack_smp_processor_id() \
11125-({ \
11126- struct thread_info *ti; \
11127- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
11128- ti->cpu; \
11129-})
11130+#define raw_smp_processor_id() (percpu_read(cpu_number))
11131+#define stack_smp_processor_id() raw_smp_processor_id()
11132 #define safe_smp_processor_id() smp_processor_id()
11133
11134 #endif
66a7e928
MT		 11135diff -urNp linux-2.6.39/arch/x86/include/asm/spinlock.h linux-2.6.39/arch/x86/include/asm/spinlock.h
11136--- linux-2.6.39/arch/x86/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
11137+++ linux-2.6.39/arch/x86/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
bc901d79 11138@@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
ae4e228f 11139 static inline void arch_read_lock(arch_rwlock_t *rw)
58c5fc13
MT		 11140 {
11141 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
58c5fc13
MT		 11142+
11143+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11144+ "jno 0f\n"
58c5fc13 11145+ LOCK_PREFIX " addl $1,(%0)\n"
bc901d79
MT		 11146+ "int $4\n0:\n"
11147+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11148+#endif
11149+
bc901d79
MT		 11150 "jns 1f\n"
11151 "call __read_lock_failed\n\t"
11152 "1:\n"
11153@@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
ae4e228f 11154 static inline void arch_write_lock(arch_rwlock_t *rw)
58c5fc13
MT		 11155 {
11156 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
58c5fc13
MT		 11157+
11158+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11159+ "jno 0f\n"
58c5fc13 11160+ LOCK_PREFIX " addl %1,(%0)\n"
bc901d79
MT		 11161+ "int $4\n0:\n"
11162+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11163+#endif
11164+
bc901d79
MT		 11165 "jz 1f\n"
11166 "call __write_lock_failed\n\t"
11167 "1:\n"
11168@@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
58c5fc13 11169
ae4e228f 11170 static inline void arch_read_unlock(arch_rwlock_t *rw)
58c5fc13
MT		 11171 {
11172- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
11173+ asm volatile(LOCK_PREFIX "incl %0\n"
11174+
11175+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11176+ "jno 0f\n"
58c5fc13 11177+ LOCK_PREFIX "decl %0\n"
bc901d79
MT		 11178+ "int $4\n0:\n"
11179+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11180+#endif
11181+
11182+ :"+m" (rw->lock) : : "memory");
11183 }
11184
ae4e228f 11185 static inline void arch_write_unlock(arch_rwlock_t *rw)
58c5fc13
MT		 11186 {
11187- asm volatile(LOCK_PREFIX "addl %1, %0"
11188+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
11189+
11190+#ifdef CONFIG_PAX_REFCOUNT
58c5fc13 11191+ "jno 0f\n"
bc901d79 11192+ LOCK_PREFIX "subl %1, %0\n"
58c5fc13 11193+ "int $4\n0:\n"
bc901d79 11194+ _ASM_EXTABLE(0b, 0b)
58c5fc13
MT		 11195+#endif
11196+
11197 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
11198 }
11199
66a7e928
MT		 11200diff -urNp linux-2.6.39/arch/x86/include/asm/stackprotector.h linux-2.6.39/arch/x86/include/asm/stackprotector.h
11201--- linux-2.6.39/arch/x86/include/asm/stackprotector.h 2011-05-19 00:06:34.000000000 -0400
11202+++ linux-2.6.39/arch/x86/include/asm/stackprotector.h 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 11203@@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
11204
11205 static inline void load_stack_canary_segment(void)
11206 {
11207-#ifdef CONFIG_X86_32
11208+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
11209 asm volatile ("mov %0, %%gs" : : "r" (0));
11210 #endif
11211 }
66a7e928
MT		 11212diff -urNp linux-2.6.39/arch/x86/include/asm/stacktrace.h linux-2.6.39/arch/x86/include/asm/stacktrace.h
11213--- linux-2.6.39/arch/x86/include/asm/stacktrace.h 2011-05-19 00:06:34.000000000 -0400
11214+++ linux-2.6.39/arch/x86/include/asm/stacktrace.h 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 11215@@ -11,28 +11,20 @@
11216
11217 extern int kstack_depth_to_print;
11218
11219-struct thread_info;
11220+struct task_struct;
11221 struct stacktrace_ops;
11222
11223-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
11224- unsigned long *stack,
11225- unsigned long bp,
11226- const struct stacktrace_ops *ops,
11227- void *data,
11228- unsigned long *end,
11229- int *graph);
11230-
11231-extern unsigned long
11232-print_context_stack(struct thread_info *tinfo,
11233- unsigned long *stack, unsigned long bp,
11234- const struct stacktrace_ops *ops, void *data,
11235- unsigned long *end, int *graph);
11236-
11237-extern unsigned long
11238-print_context_stack_bp(struct thread_info *tinfo,
11239- unsigned long *stack, unsigned long bp,
11240- const struct stacktrace_ops *ops, void *data,
11241- unsigned long *end, int *graph);
11242+typedef unsigned long walk_stack_t(struct task_struct *task,
11243+ void *stack_start,
11244+ unsigned long *stack,
11245+ unsigned long bp,
11246+ const struct stacktrace_ops *ops,
11247+ void *data,
11248+ unsigned long *end,
11249+ int *graph);
11250+
11251+extern walk_stack_t print_context_stack;
11252+extern walk_stack_t print_context_stack_bp;
11253
11254 /* Generic stack tracer with callbacks */
11255
11256@@ -43,7 +35,7 @@ struct stacktrace_ops {
11257 void (*address)(void *data, unsigned long address, int reliable);
11258 /* On negative return stop dumping */
11259 int (*stack)(void *data, char *name);
11260- walk_stack_t walk_stack;
11261+ walk_stack_t *walk_stack;
11262 };
11263
11264 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
66a7e928
MT		 11265diff -urNp linux-2.6.39/arch/x86/include/asm/system.h linux-2.6.39/arch/x86/include/asm/system.h
11266--- linux-2.6.39/arch/x86/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
11267+++ linux-2.6.39/arch/x86/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
11268@@ -129,7 +129,7 @@ do { \
71d190be
MT		 11269 "call __switch_to\n\t" \
11270 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
11271 __switch_canary \
11272- "movq %P[thread_info](%%rsi),%%r8\n\t" \
11273+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
11274 "movq %%rax,%%rdi\n\t" \
11275 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
11276 "jnz ret_from_fork\n\t" \
66a7e928 11277@@ -140,7 +140,7 @@ do { \
71d190be
MT		 11278 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
11279 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
11280 [_tif_fork] "i" (_TIF_FORK), \
11281- [thread_info] "i" (offsetof(struct task_struct, stack)), \
11282+ [thread_info] "m" (current_tinfo), \
11283 [current_task] "m" (current_task) \
11284 __switch_canary_iparam \
11285 : "memory", "cc" __EXTRA_CLOBBER)
66a7e928 11286@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
58c5fc13
MT		 11287 {
11288 unsigned long __limit;
11289 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
11290- return __limit + 1;
11291+ return __limit;
11292 }
11293
11294 static inline void native_clts(void)
66a7e928 11295@@ -340,12 +340,12 @@ void enable_hlt(void);
58c5fc13
MT		 11296
11297 void cpu_idle_wait(void);
11298
11299-extern unsigned long arch_align_stack(unsigned long sp);
11300+#define arch_align_stack(x) ((x) & ~0xfUL)
11301 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
11302
11303 void default_idle(void);
66a7e928
MT		 11304
11305-void stop_this_cpu(void *dummy);
11306+void stop_this_cpu(void *dummy) __noreturn;
11307
11308 /*
11309 * Force strict CPU ordering.
11310diff -urNp linux-2.6.39/arch/x86/include/asm/thread_info.h linux-2.6.39/arch/x86/include/asm/thread_info.h
11311--- linux-2.6.39/arch/x86/include/asm/thread_info.h 2011-05-19 00:06:34.000000000 -0400
11312+++ linux-2.6.39/arch/x86/include/asm/thread_info.h 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 11313@@ -10,6 +10,7 @@
11314 #include <linux/compiler.h>
11315 #include <asm/page.h>
11316 #include <asm/types.h>
11317+#include <asm/percpu.h>
11318
11319 /*
11320 * low level task data that entry.S needs immediate access to
11321@@ -24,7 +25,6 @@ struct exec_domain;
11322 #include <asm/atomic.h>
11323
11324 struct thread_info {
11325- struct task_struct *task; /* main task structure */
11326 struct exec_domain *exec_domain; /* execution domain */
11327 __u32 flags; /* low level flags */
11328 __u32 status; /* thread synchronous flags */
66a7e928 11329@@ -34,18 +34,12 @@ struct thread_info {
71d190be
MT		 11330 mm_segment_t addr_limit;
11331 struct restart_block restart_block;
11332 void __user *sysenter_return;
11333-#ifdef CONFIG_X86_32
11334- unsigned long previous_esp; /* ESP of the previous stack in
11335- case of nested (IRQ) stacks
11336- */
11337- __u8 supervisor_stack[0];
11338-#endif
66a7e928 11339+ unsigned long lowest_stack;
71d190be
MT		 11340 int uaccess_err;
11341 };
11342
11343-#define INIT_THREAD_INFO(tsk) \
11344+#define INIT_THREAD_INFO \
11345 { \
11346- .task = &tsk, \
11347 .exec_domain = &default_exec_domain, \
11348 .flags = 0, \
11349 .cpu = 0, \
66a7e928 11350@@ -56,7 +50,7 @@ struct thread_info {
71d190be
MT		 11351 }, \
11352 }
11353
11354-#define init_thread_info (init_thread_union.thread_info)
66a7e928 11355+#define init_thread_info (init_thread_union.stack)
71d190be
MT		 11356 #define init_stack (init_thread_union.stack)
11357
11358 #else /* !__ASSEMBLY__ */
66a7e928
MT		 11359@@ -170,6 +164,23 @@ struct thread_info {
11360 ret; \
11361 })
71d190be
MT		 11362
11363+#ifdef __ASSEMBLY__
11364+/* how to get the thread information struct from ASM */
11365+#define GET_THREAD_INFO(reg) \
11366+ mov PER_CPU_VAR(current_tinfo), reg
11367+
11368+/* use this one if reg already contains %esp */
11369+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
11370+#else
11371+/* how to get the thread information struct from C */
11372+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
11373+
11374+static __always_inline struct thread_info *current_thread_info(void)
11375+{
11376+ return percpu_read_stable(current_tinfo);
11377+}
11378+#endif
11379+
11380 #ifdef CONFIG_X86_32
11381
11382 #define STACK_WARN (THREAD_SIZE/8)
66a7e928 11383@@ -180,35 +191,13 @@ struct thread_info {
71d190be
MT		 11384 */
11385 #ifndef __ASSEMBLY__
11386
11387-
11388 /* how to get the current stack pointer from C */
11389 register unsigned long current_stack_pointer asm("esp") __used;
11390
11391-/* how to get the thread information struct from C */
11392-static inline struct thread_info *current_thread_info(void)
11393-{
11394- return (struct thread_info *)
11395- (current_stack_pointer & ~(THREAD_SIZE - 1));
11396-}
11397-
11398-#else /* !__ASSEMBLY__ */
11399-
11400-/* how to get the thread information struct from ASM */
11401-#define GET_THREAD_INFO(reg) \
11402- movl $-THREAD_SIZE, reg; \
11403- andl %esp, reg
11404-
11405-/* use this one if reg already contains %esp */
11406-#define GET_THREAD_INFO_WITH_ESP(reg) \
11407- andl $-THREAD_SIZE, reg
11408-
11409 #endif
11410
11411 #else /* X86_32 */
11412
11413-#include <asm/percpu.h>
11414-#define KERNEL_STACK_OFFSET (5*8)
11415-
11416 /*
11417 * macros/functions for gaining access to the thread information structure
11418 * preempt_count needs to be 1 initially, until the scheduler is functional.
66a7e928 11419@@ -216,21 +205,8 @@ static inline struct thread_info *curren
71d190be
MT		 11420 #ifndef __ASSEMBLY__
11421 DECLARE_PER_CPU(unsigned long, kernel_stack);
11422
11423-static inline struct thread_info *current_thread_info(void)
11424-{
11425- struct thread_info *ti;
11426- ti = (void *)(percpu_read_stable(kernel_stack) +
11427- KERNEL_STACK_OFFSET - THREAD_SIZE);
11428- return ti;
11429-}
11430-
11431-#else /* !__ASSEMBLY__ */
11432-
11433-/* how to get the thread information struct from ASM */
11434-#define GET_THREAD_INFO(reg) \
11435- movq PER_CPU_VAR(kernel_stack),reg ; \
11436- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
11437-
66a7e928
MT		 11438+/* how to get the current stack pointer from C */
11439+register unsigned long current_stack_pointer asm("rsp") __used;
71d190be
MT		 11440 #endif
11441
11442 #endif /* !X86_32 */
66a7e928 11443@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
71d190be
MT		 11444 extern void free_thread_info(struct thread_info *ti);
11445 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
11446 #define arch_task_cache_init arch_task_cache_init
11447+
11448+#define __HAVE_THREAD_FUNCTIONS
11449+#define task_thread_info(task) (&(task)->tinfo)
11450+#define task_stack_page(task) ((task)->stack)
11451+#define setup_thread_stack(p, org) do {} while (0)
11452+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
11453+
11454+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
66a7e928 11455+extern struct task_struct *alloc_task_struct_node(int node);
71d190be
MT		 11456+extern void free_task_struct(struct task_struct *);
11457+
11458 #endif
11459 #endif /* _ASM_X86_THREAD_INFO_H */
66a7e928
MT		 11460diff -urNp linux-2.6.39/arch/x86/include/asm/uaccess_32.h linux-2.6.39/arch/x86/include/asm/uaccess_32.h
11461--- linux-2.6.39/arch/x86/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
11462+++ linux-2.6.39/arch/x86/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
11463@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
58c5fc13
MT		 11464 static __always_inline unsigned long __must_check
11465 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
11466 {
66a7e928
MT		 11467+ pax_track_stack();
11468+
58c5fc13
MT		 11469+ if ((long)n < 0)
11470+ return n;
11471+
11472 if (__builtin_constant_p(n)) {
11473 unsigned long ret;
11474
66a7e928 11475@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
58c5fc13
MT		 11476 return ret;
11477 }
11478 }
11479+ if (!__builtin_constant_p(n))
11480+ check_object_size(from, n, true);
11481 return __copy_to_user_ll(to, from, n);
11482 }
11483
66a7e928
MT		 11484@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
11485 __copy_to_user(void __user *to, const void *from, unsigned long n)
11486 {
11487 might_fault();
11488+
11489 return __copy_to_user_inatomic(to, from, n);
11490 }
11491
58c5fc13
MT		 11492 static __always_inline unsigned long
11493 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
11494 {
11495+ if ((long)n < 0)
11496+ return n;
11497+
11498 /* Avoid zeroing the tail if the copy fails..
11499 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
11500 * but as the zeroing behaviour is only significant when n is not
66a7e928 11501@@ -138,6 +149,12 @@ static __always_inline unsigned long
58c5fc13
MT		 11502 __copy_from_user(void *to, const void __user *from, unsigned long n)
11503 {
11504 might_fault();
11505+
66a7e928
MT		 11506+ pax_track_stack();
11507+
58c5fc13
MT		 11508+ if ((long)n < 0)
11509+ return n;
11510+
11511 if (__builtin_constant_p(n)) {
11512 unsigned long ret;
11513
66a7e928 11514@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
58c5fc13
MT		 11515 return ret;
11516 }
11517 }
11518+ if (!__builtin_constant_p(n))
11519+ check_object_size(to, n, false);
11520 return __copy_from_user_ll(to, from, n);
11521 }
11522
66a7e928 11523@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
58c5fc13
MT		 11524 const void __user *from, unsigned long n)
11525 {
11526 might_fault();
11527+
11528+ if ((long)n < 0)
11529+ return n;
11530+
11531 if (__builtin_constant_p(n)) {
11532 unsigned long ret;
11533
66a7e928 11534@@ -182,15 +205,19 @@ static __always_inline unsigned long
58c5fc13
MT		 11535 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11536 unsigned long n)
11537 {
11538- return __copy_from_user_ll_nocache_nozero(to, from, n);
ae4e228f 11539-}
58c5fc13
MT		 11540+ if ((long)n < 0)
11541+ return n;
ae4e228f
MT		 11542
11543-unsigned long __must_check copy_to_user(void __user *to,
11544- const void *from, unsigned long n);
11545-unsigned long __must_check _copy_from_user(void *to,
11546- const void __user *from,
11547- unsigned long n);
58c5fc13
MT		 11548+ return __copy_from_user_ll_nocache_nozero(to, from, n);
11549+}
ae4e228f
MT		 11550
11551+extern void copy_to_user_overflow(void)
11552+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11553+ __compiletime_error("copy_to_user() buffer size is not provably correct")
11554+#else
11555+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
11556+#endif
11557+;
11558
11559 extern void copy_from_user_overflow(void)
11560 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
66a7e928 11561@@ -200,17 +227,61 @@ extern void copy_from_user_overflow(void
ae4e228f
MT		 11562 #endif
11563 ;
11564
11565-static inline unsigned long __must_check copy_from_user(void *to,
11566- const void __user *from,
11567- unsigned long n)
58c5fc13
MT		 11568+/**
11569+ * copy_to_user: - Copy a block of data into user space.
11570+ * @to: Destination address, in user space.
11571+ * @from: Source address, in kernel space.
11572+ * @n: Number of bytes to copy.
11573+ *
11574+ * Context: User context only. This function may sleep.
11575+ *
11576+ * Copy data from kernel space to user space.
11577+ *
11578+ * Returns number of bytes that could not be copied.
11579+ * On success, this will be zero.
11580+ */
ae4e228f 11581+static inline unsigned long __must_check
58c5fc13
MT		 11582+copy_to_user(void __user *to, const void *from, unsigned long n)
11583+{
ae4e228f
MT		 11584+ int sz = __compiletime_object_size(from);
11585+
11586+ if (unlikely(sz != -1 && sz < n))
11587+ copy_to_user_overflow();
11588+ else if (access_ok(VERIFY_WRITE, to, n))
58c5fc13
MT		 11589+ n = __copy_to_user(to, from, n);
11590+ return n;
11591+}
11592+
11593+/**
11594+ * copy_from_user: - Copy a block of data from user space.
11595+ * @to: Destination address, in kernel space.
11596+ * @from: Source address, in user space.
11597+ * @n: Number of bytes to copy.
11598+ *
11599+ * Context: User context only. This function may sleep.
11600+ *
11601+ * Copy data from user space to kernel space.
11602+ *
11603+ * Returns number of bytes that could not be copied.
11604+ * On success, this will be zero.
11605+ *
11606+ * If some data could not be copied, this function will pad the copied
11607+ * data to the requested size using zero bytes.
11608+ */
ae4e228f 11609+static inline unsigned long __must_check
58c5fc13 11610+copy_from_user(void *to, const void __user *from, unsigned long n)
ae4e228f
MT		 11611 {
11612 int sz = __compiletime_object_size(to);
11613
11614- if (likely(sz == -1 || sz >= n))
11615- n = _copy_from_user(to, from, n);
11616- else
11617+ if (unlikely(sz != -1 && sz < n))
11618 copy_from_user_overflow();
11619-
11620+ else if (access_ok(VERIFY_READ, from, n))
58c5fc13
MT		 11621+ n = __copy_from_user(to, from, n);
11622+ else if ((long)n > 0) {
11623+ if (!__builtin_constant_p(n))
11624+ check_object_size(to, n, false);
11625+ memset(to, 0, n);
11626+ }
ae4e228f 11627 return n;
58c5fc13
MT		 11628 }
11629
66a7e928
MT		 11630diff -urNp linux-2.6.39/arch/x86/include/asm/uaccess_64.h linux-2.6.39/arch/x86/include/asm/uaccess_64.h
11631--- linux-2.6.39/arch/x86/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
11632+++ linux-2.6.39/arch/x86/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
6892158b 11633@@ -11,6 +11,9 @@
df50ba0c
MT		 11634 #include <asm/alternative.h>
11635 #include <asm/cpufeature.h>
58c5fc13 11636 #include <asm/page.h>
df50ba0c
MT		 11637+#include <asm/pgtable.h>
11638+
58c5fc13 11639+#define set_fs(x) (current_thread_info()->addr_limit = (x))
df50ba0c 11640
58c5fc13
MT		 11641 /*
11642 * Copy To/From Userspace
6892158b 11643@@ -37,26 +40,26 @@ copy_user_generic(void *to, const void *
df50ba0c
MT		 11644 return ret;
11645 }
11646
58c5fc13 11647-__must_check unsigned long
ae4e228f 11648-_copy_to_user(void __user *to, const void *from, unsigned len);
58c5fc13 11649-__must_check unsigned long
ae4e228f
MT		 11650-_copy_from_user(void *to, const void __user *from, unsigned len);
11651+static __always_inline __must_check unsigned long
11652+__copy_to_user(void __user *to, const void *from, unsigned len);
11653+static __always_inline __must_check unsigned long
11654+__copy_from_user(void *to, const void __user *from, unsigned len);
11655 __must_check unsigned long
58c5fc13
MT		 11656 copy_in_user(void __user *to, const void __user *from, unsigned len);
11657
ae4e228f
MT		 11658 static inline unsigned long __must_check copy_from_user(void *to,
11659 const void __user *from,
11660- unsigned long n)
11661+ unsigned n)
11662 {
11663- int sz = __compiletime_object_size(to);
11664-
11665 might_fault();
11666- if (likely(sz == -1 || sz >= n))
11667- n = _copy_from_user(to, from, n);
11668-#ifdef CONFIG_DEBUG_VM
11669- else
11670- WARN(1, "Buffer overflow detected!\n");
11671-#endif
11672+
11673+ if (access_ok(VERIFY_READ, from, n))
11674+ n = __copy_from_user(to, from, n);
11675+ else if ((int)n > 0) {
11676+ if (!__builtin_constant_p(n))
11677+ check_object_size(to, n, false);
11678+ memset(to, 0, n);
11679+ }
11680 return n;
11681 }
11682
66a7e928 11683@@ -65,110 +68,198 @@ int copy_to_user(void __user *dst, const
ae4e228f
MT		 11684 {
11685 might_fault();
11686
11687- return _copy_to_user(dst, src, size);
11688+ if (access_ok(VERIFY_WRITE, dst, size))
11689+ size = __copy_to_user(dst, src, size);
11690+ return size;
11691 }
11692
58c5fc13
MT		 11693 static __always_inline __must_check
11694-int __copy_from_user(void *dst, const void __user *src, unsigned size)
11695+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
11696 {
11697- int ret = 0;
ae4e228f 11698+ int sz = __compiletime_object_size(dst);
58c5fc13
MT		 11699+ unsigned ret = 0;
11700
11701 might_fault();
11702- if (!__builtin_constant_p(size))
bc901d79 11703- return copy_user_generic(dst, (__force void *)src, size);
58c5fc13 11704+
66a7e928
MT		 11705+ pax_track_stack();
11706+
58c5fc13
MT		 11707+ if ((int)size < 0)
11708+ return size;
11709+
bc901d79
MT		 11710+#ifdef CONFIG_PAX_MEMORY_UDEREF
11711+ if (!__access_ok(VERIFY_READ, src, size))
11712+ return size;
11713+#endif
11714+
ae4e228f
MT		 11715+ if (unlikely(sz != -1 && sz < size)) {
11716+#ifdef CONFIG_DEBUG_VM
11717+ WARN(1, "Buffer overflow detected!\n");
11718+#endif
11719+ return size;
11720+ }
11721+
58c5fc13
MT		 11722+ if (!__builtin_constant_p(size)) {
11723+ check_object_size(dst, size, false);
8308f9c9
MT		 11724+
11725+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 11726+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11727+ src += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11728+#endif
11729+
bc901d79 11730+ return copy_user_generic(dst, (__force const void *)src, size);
58c5fc13
MT		 11731+ }
11732 switch (size) {
bc901d79
MT		 11733- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
11734+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
58c5fc13 11735 ret, "b", "b", "=q", 1);
bc901d79
MT		 11736 return ret;
11737- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
11738+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
11739 ret, "w", "w", "=r", 2);
11740 return ret;
11741- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
11742+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
11743 ret, "l", "k", "=r", 4);
11744 return ret;
11745- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
11746+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11747 ret, "q", "", "=r", 8);
11748 return ret;
11749 case 10:
11750- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11751+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11752 ret, "q", "", "=r", 10);
11753 if (unlikely(ret))
11754 return ret;
11755 __get_user_asm(*(u16 *)(8 + (char *)dst),
11756- (u16 __user *)(8 + (char __user *)src),
11757+ (const u16 __user *)(8 + (const char __user *)src),
11758 ret, "w", "w", "=r", 2);
11759 return ret;
11760 case 16:
11761- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11762+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11763 ret, "q", "", "=r", 16);
11764 if (unlikely(ret))
11765 return ret;
11766 __get_user_asm(*(u64 *)(8 + (char *)dst),
11767- (u64 __user *)(8 + (char __user *)src),
11768+ (const u64 __user *)(8 + (const char __user *)src),
df50ba0c
MT		 11769 ret, "q", "", "=r", 8);
11770 return ret;
11771 default:
bc901d79 11772- return copy_user_generic(dst, (__force void *)src, size);
8308f9c9
MT		 11773+
11774+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 11775+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11776+ src += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11777+#endif
11778+
bc901d79 11779+ return copy_user_generic(dst, (__force const void *)src, size);
df50ba0c 11780 }
58c5fc13
MT		 11781 }
11782
11783 static __always_inline __must_check
11784-int __copy_to_user(void __user *dst, const void *src, unsigned size)
11785+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
11786 {
11787- int ret = 0;
ae4e228f 11788+ int sz = __compiletime_object_size(src);
58c5fc13
MT		 11789+ unsigned ret = 0;
11790
11791 might_fault();
11792- if (!__builtin_constant_p(size))
11793+
66a7e928
MT		 11794+ pax_track_stack();
11795+
58c5fc13
MT		 11796+ if ((int)size < 0)
11797+ return size;
11798+
bc901d79
MT		 11799+#ifdef CONFIG_PAX_MEMORY_UDEREF
11800+ if (!__access_ok(VERIFY_WRITE, dst, size))
11801+ return size;
11802+#endif
11803+
ae4e228f
MT		 11804+ if (unlikely(sz != -1 && sz < size)) {
11805+#ifdef CONFIG_DEBUG_VM
11806+ WARN(1, "Buffer overflow detected!\n");
11807+#endif
11808+ return size;
11809+ }
11810+
58c5fc13
MT		 11811+ if (!__builtin_constant_p(size)) {
11812+ check_object_size(src, size, true);
8308f9c9
MT		 11813+
11814+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 11815+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11816+ dst += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11817+#endif
11818+
58c5fc13
MT		 11819 return copy_user_generic((__force void *)dst, src, size);
11820+ }
11821 switch (size) {
bc901d79
MT		 11822- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11823+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
58c5fc13 11824 ret, "b", "b", "iq", 1);
bc901d79
MT		 11825 return ret;
11826- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11827+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11828 ret, "w", "w", "ir", 2);
11829 return ret;
11830- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11831+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11832 ret, "l", "k", "ir", 4);
11833 return ret;
11834- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11835+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11836 ret, "q", "", "er", 8);
11837 return ret;
11838 case 10:
11839- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11840+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11841 ret, "q", "", "er", 10);
11842 if (unlikely(ret))
11843 return ret;
11844 asm("":::"memory");
11845- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11846+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11847 ret, "w", "w", "ir", 2);
11848 return ret;
11849 case 16:
11850- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11851+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11852 ret, "q", "", "er", 16);
11853 if (unlikely(ret))
11854 return ret;
11855 asm("":::"memory");
11856- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11857+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
df50ba0c
MT		 11858 ret, "q", "", "er", 8);
11859 return ret;
11860 default:
8308f9c9
MT		 11861+
11862+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 11863+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11864+ dst += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11865+#endif
11866+
df50ba0c
MT		 11867 return copy_user_generic((__force void *)dst, src, size);
11868 }
58c5fc13
MT		 11869 }
11870
11871 static __always_inline __must_check
11872-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
ae4e228f 11873+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
58c5fc13
MT		 11874 {
11875- int ret = 0;
58c5fc13
MT		 11876+ unsigned ret = 0;
11877
11878 might_fault();
df50ba0c 11879- if (!__builtin_constant_p(size))
58c5fc13
MT		 11880+
11881+ if ((int)size < 0)
11882+ return size;
11883+
bc901d79
MT		 11884+#ifdef CONFIG_PAX_MEMORY_UDEREF
11885+ if (!__access_ok(VERIFY_READ, src, size))
11886+ return size;
11887+ if (!__access_ok(VERIFY_WRITE, dst, size))
11888+ return size;
11889+#endif
11890+
df50ba0c 11891+ if (!__builtin_constant_p(size)) {
8308f9c9
MT		 11892+
11893+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 11894+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11895+ src += PAX_USER_SHADOW_BASE;
11896+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11897+ dst += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11898+#endif
11899+
58c5fc13 11900 return copy_user_generic((__force void *)dst,
bc901d79
MT		 11901- (__force void *)src, size);
11902+ (__force const void *)src, size);
df50ba0c
MT		 11903+ }
11904 switch (size) {
11905 case 1: {
11906 u8 tmp;
bc901d79
MT		 11907- __get_user_asm(tmp, (u8 __user *)src,
11908+ __get_user_asm(tmp, (const u8 __user *)src,
11909 ret, "b", "b", "=q", 1);
11910 if (likely(!ret))
11911 __put_user_asm(tmp, (u8 __user *)dst,
66a7e928 11912@@ -177,7 +268,7 @@ int __copy_in_user(void __user *dst, con
bc901d79
MT		 11913 }
11914 case 2: {
11915 u16 tmp;
11916- __get_user_asm(tmp, (u16 __user *)src,
11917+ __get_user_asm(tmp, (const u16 __user *)src,
11918 ret, "w", "w", "=r", 2);
11919 if (likely(!ret))
11920 __put_user_asm(tmp, (u16 __user *)dst,
66a7e928 11921@@ -187,7 +278,7 @@ int __copy_in_user(void __user *dst, con
bc901d79
MT		 11922
11923 case 4: {
11924 u32 tmp;
11925- __get_user_asm(tmp, (u32 __user *)src,
11926+ __get_user_asm(tmp, (const u32 __user *)src,
11927 ret, "l", "k", "=r", 4);
11928 if (likely(!ret))
11929 __put_user_asm(tmp, (u32 __user *)dst,
66a7e928 11930@@ -196,7 +287,7 @@ int __copy_in_user(void __user *dst, con
bc901d79
MT		 11931 }
11932 case 8: {
11933 u64 tmp;
11934- __get_user_asm(tmp, (u64 __user *)src,
11935+ __get_user_asm(tmp, (const u64 __user *)src,
11936 ret, "q", "", "=r", 8);
11937 if (likely(!ret))
11938 __put_user_asm(tmp, (u64 __user *)dst,
66a7e928 11939@@ -204,8 +295,16 @@ int __copy_in_user(void __user *dst, con
df50ba0c
MT		 11940 return ret;
11941 }
11942 default:
8308f9c9
MT		 11943+
11944+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 11945+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11946+ src += PAX_USER_SHADOW_BASE;
11947+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11948+ dst += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11949+#endif
11950+
df50ba0c 11951 return copy_user_generic((__force void *)dst,
bc901d79
MT		 11952- (__force void *)src, size);
11953+ (__force const void *)src, size);
df50ba0c 11954 }
bc901d79
MT		 11955 }
11956
66a7e928 11957@@ -222,33 +321,72 @@ __must_check unsigned long __clear_user(
df50ba0c
MT		 11958 static __must_check __always_inline int
11959 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11960 {
66a7e928
MT		 11961+ pax_track_stack();
11962+
bc901d79
MT		 11963+ if ((int)size < 0)
11964+ return size;
11965+
11966+#ifdef CONFIG_PAX_MEMORY_UDEREF
11967+ if (!__access_ok(VERIFY_READ, src, size))
11968+ return size;
bc901d79 11969+
df50ba0c
MT		 11970+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11971+ src += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11972+#endif
11973+
ae4e228f
MT		 11974 return copy_user_generic(dst, (__force const void *)src, size);
11975 }
58c5fc13
MT		 11976
11977-static __must_check __always_inline int
11978+static __must_check __always_inline unsigned long
11979 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11980 {
11981+ if ((int)size < 0)
11982+ return size;
11983+
bc901d79
MT		 11984+#ifdef CONFIG_PAX_MEMORY_UDEREF
11985+ if (!__access_ok(VERIFY_WRITE, dst, size))
11986+ return size;
bc901d79 11987+
df50ba0c
MT		 11988+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11989+ dst += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 11990+#endif
11991+
58c5fc13
MT		 11992 return copy_user_generic((__force void *)dst, src, size);
11993 }
11994
11995-extern long __copy_user_nocache(void *dst, const void __user *src,
11996+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11997 unsigned size, int zerorest);
11998
11999-static inline int
12000-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12001+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12002 {
12003 might_sleep();
12004+
12005+ if ((int)size < 0)
12006+ return size;
bc901d79
MT		 12007+
12008+#ifdef CONFIG_PAX_MEMORY_UDEREF
12009+ if (!__access_ok(VERIFY_READ, src, size))
12010+ return size;
12011+#endif
58c5fc13
MT		 12012+
12013 return __copy_user_nocache(dst, src, size, 1);
12014 }
12015
12016-static inline int
12017-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12018+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12019 unsigned size)
12020 {
12021+ if ((int)size < 0)
12022+ return size;
bc901d79
MT		 12023+
12024+#ifdef CONFIG_PAX_MEMORY_UDEREF
12025+ if (!__access_ok(VERIFY_READ, src, size))
12026+ return size;
12027+#endif
58c5fc13
MT		 12028+
12029 return __copy_user_nocache(dst, src, size, 0);
12030 }
12031
12032-unsigned long
12033+extern unsigned long
12034 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
12035
12036 #endif /* _ASM_X86_UACCESS_64_H */
66a7e928
MT		 12037diff -urNp linux-2.6.39/arch/x86/include/asm/uaccess.h linux-2.6.39/arch/x86/include/asm/uaccess.h
12038--- linux-2.6.39/arch/x86/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
12039+++ linux-2.6.39/arch/x86/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 12040@@ -8,12 +8,15 @@
12041 #include <linux/thread_info.h>
12042 #include <linux/prefetch.h>
12043 #include <linux/string.h>
12044+#include <linux/sched.h>
12045 #include <asm/asm.h>
12046 #include <asm/page.h>
12047
12048 #define VERIFY_READ 0
12049 #define VERIFY_WRITE 1
12050
12051+extern void check_object_size(const void *ptr, unsigned long n, bool to);
12052+
12053 /*
12054 * The fs value determines whether argument validity checking should be
12055 * performed or not. If get_fs() == USER_DS, checking is performed, with
12056@@ -29,7 +32,12 @@
12057
12058 #define get_ds() (KERNEL_DS)
12059 #define get_fs() (current_thread_info()->addr_limit)
bc901d79
MT		 12060+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12061+void __set_fs(mm_segment_t x);
57199397
MT		 12062+void set_fs(mm_segment_t x);
12063+#else
12064 #define set_fs(x) (current_thread_info()->addr_limit = (x))
12065+#endif
12066
12067 #define segment_eq(a, b) ((a).seg == (b).seg)
12068
12069@@ -77,7 +85,33 @@
12070 * checks that the pointer is in the user space range - after calling
12071 * this function, memory access functions may still return -EFAULT.
12072 */
12073-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12074+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12075+#define access_ok(type, addr, size) \
12076+({ \
12077+ long __size = size; \
12078+ unsigned long __addr = (unsigned long)addr; \
12079+ unsigned long __addr_ao = __addr & PAGE_MASK; \
12080+ unsigned long __end_ao = __addr + __size - 1; \
12081+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
12082+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
12083+ while(__addr_ao <= __end_ao) { \
12084+ char __c_ao; \
12085+ __addr_ao += PAGE_SIZE; \
12086+ if (__size > PAGE_SIZE) \
12087+ cond_resched(); \
12088+ if (__get_user(__c_ao, (char __user *)__addr)) \
12089+ break; \
12090+ if (type != VERIFY_WRITE) { \
12091+ __addr = __addr_ao; \
12092+ continue; \
12093+ } \
12094+ if (__put_user(__c_ao, (char __user *)__addr)) \
12095+ break; \
12096+ __addr = __addr_ao; \
12097+ } \
12098+ } \
12099+ __ret_ao; \
12100+})
12101
12102 /*
12103 * The exception table consists of pairs of addresses: the first is the
bc901d79 12104@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
57199397
MT		 12105 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
12106 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
12107
12108-
bc901d79 12109+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
16454cff 12110+#define __copyuser_seg "gs;"
bc901d79
MT		 12111+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
12112+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
57199397 12113+#else
bc901d79
MT		 12114+#define __copyuser_seg
12115+#define __COPYUSER_SET_ES
12116+#define __COPYUSER_RESTORE_ES
57199397
MT		 12117+#endif
12118
12119 #ifdef CONFIG_X86_32
12120 #define __put_user_asm_u64(x, addr, err, errret) \
12121- asm volatile("1: movl %%eax,0(%2)\n" \
12122- "2: movl %%edx,4(%2)\n" \
16454cff
MT		 12123+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
12124+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
57199397 12125 "3:\n" \
57199397
MT		 12126 ".section .fixup,\"ax\"\n" \
12127 "4: movl %3,%0\n" \
bc901d79
MT		 12128@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
12129 : "A" (x), "r" (addr), "i" (errret), "0" (err))
57199397
MT		 12130
12131 #define __put_user_asm_ex_u64(x, addr) \
12132- asm volatile("1: movl %%eax,0(%1)\n" \
12133- "2: movl %%edx,4(%1)\n" \
16454cff
MT		 12134+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
12135+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
57199397 12136 "3:\n" \
57199397
MT		 12137 _ASM_EXTABLE(1b, 2b - 1b) \
12138 _ASM_EXTABLE(2b, 3b - 2b) \
bc901d79 12139@@ -374,7 +416,7 @@ do { \
57199397
MT		 12140 } while (0)
12141
12142 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12143- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
16454cff 12144+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
57199397 12145 "2:\n" \
57199397
MT		 12146 ".section .fixup,\"ax\"\n" \
12147 "3: mov %3,%0\n" \
bc901d79 12148@@ -382,7 +424,7 @@ do { \
57199397
MT		 12149 " jmp 2b\n" \
12150 ".previous\n" \
12151 _ASM_EXTABLE(1b, 3b) \
12152- : "=r" (err), ltype(x) \
57199397 12153+ : "=r" (err), ltype (x) \
bc901d79 12154 : "m" (__m(addr)), "i" (errret), "0" (err))
57199397
MT		 12155
12156 #define __get_user_size_ex(x, ptr, size) \
bc901d79 12157@@ -407,7 +449,7 @@ do { \
57199397
MT		 12158 } while (0)
12159
12160 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
12161- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
16454cff 12162+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
57199397 12163 "2:\n" \
57199397 12164 _ASM_EXTABLE(1b, 2b - 1b) \
bc901d79
MT		 12165 : ltype(x) : "m" (__m(addr)))
12166@@ -424,13 +466,24 @@ do { \
57199397
MT		 12167 int __gu_err; \
12168 unsigned long __gu_val; \
12169 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
12170- (x) = (__force __typeof__(*(ptr)))__gu_val; \
12171+ (x) = (__typeof__(*(ptr)))__gu_val; \
12172 __gu_err; \
12173 })
12174
12175 /* FIXME: this hack is definitely wrong -AK */
12176 struct __large_struct { unsigned long buf[100]; };
12177-#define __m(x) (*(struct __large_struct __user *)(x))
12178+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12179+#define ____m(x) \
12180+({ \
12181+ unsigned long ____x = (unsigned long)(x); \
12182+ if (____x < PAX_USER_SHADOW_BASE) \
12183+ ____x += PAX_USER_SHADOW_BASE; \
12184+ (void __user *)____x; \
12185+})
12186+#else
12187+#define ____m(x) (x)
12188+#endif
12189+#define __m(x) (*(struct __large_struct __user *)____m(x))
12190
12191 /*
12192 * Tell gcc we read from memory instead of writing: this is because
bc901d79 12193@@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
57199397
MT		 12194 * aliasing issues.
12195 */
12196 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12197- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
16454cff 12198+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
57199397 12199 "2:\n" \
57199397
MT		 12200 ".section .fixup,\"ax\"\n" \
12201 "3: mov %3,%0\n" \
bc901d79 12202@@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
57199397
MT		 12203 ".previous\n" \
12204 _ASM_EXTABLE(1b, 3b) \
12205 : "=r"(err) \
12206- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
bc901d79 12207+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
57199397
MT		 12208
12209 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
12210- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
16454cff 12211+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
57199397 12212 "2:\n" \
57199397 12213 _ASM_EXTABLE(1b, 2b - 1b) \
bc901d79
MT		 12214 : : ltype(x), "m" (__m(addr)))
12215@@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
12216 * On error, the variable @x is set to zero.
12217 */
57199397 12218
bc901d79
MT		 12219+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12220+#define __get_user(x, ptr) get_user((x), (ptr))
12221+#else
12222 #define __get_user(x, ptr) \
12223 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
12224+#endif
12225
12226 /**
12227 * __put_user: - Write a simple value into user space, with less checking.
12228@@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
12229 * Returns zero on success, or -EFAULT on error.
12230 */
12231
12232+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12233+#define __put_user(x, ptr) put_user((x), (ptr))
12234+#else
12235 #define __put_user(x, ptr) \
12236 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
12237+#endif
12238
12239 #define __get_user_unaligned __get_user
12240 #define __put_user_unaligned __put_user
12241@@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
57199397
MT		 12242 #define get_user_ex(x, ptr) do { \
12243 unsigned long __gue_val; \
12244 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
12245- (x) = (__force __typeof__(*(ptr)))__gue_val; \
12246+ (x) = (__typeof__(*(ptr)))__gue_val; \
12247 } while (0)
12248
12249 #ifdef CONFIG_X86_WP_WORKS_OK
bc901d79 12250@@ -567,6 +628,7 @@ extern struct movsl_mask {
57199397
MT		 12251
12252 #define ARCH_HAS_NOCACHE_UACCESS 1
12253
12254+#define ARCH_HAS_SORT_EXTABLE
12255 #ifdef CONFIG_X86_32
12256 # include "uaccess_32.h"
12257 #else
66a7e928
MT		 12258diff -urNp linux-2.6.39/arch/x86/include/asm/vgtod.h linux-2.6.39/arch/x86/include/asm/vgtod.h
12259--- linux-2.6.39/arch/x86/include/asm/vgtod.h 2011-05-19 00:06:34.000000000 -0400
12260+++ linux-2.6.39/arch/x86/include/asm/vgtod.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 12261@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
12262 int sysctl_enabled;
12263 struct timezone sys_tz;
12264 struct { /* extract of a clocksource struct */
12265+ char name[8];
12266 cycle_t (*vread)(void);
12267 cycle_t cycle_last;
12268 cycle_t mask;
66a7e928
MT		 12269diff -urNp linux-2.6.39/arch/x86/include/asm/vsyscall.h linux-2.6.39/arch/x86/include/asm/vsyscall.h
12270--- linux-2.6.39/arch/x86/include/asm/vsyscall.h 2011-05-19 00:06:34.000000000 -0400
12271+++ linux-2.6.39/arch/x86/include/asm/vsyscall.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 12272@@ -15,9 +15,10 @@ enum vsyscall_num {
12273
12274 #ifdef __KERNEL__
12275 #include <linux/seqlock.h>
12276+#include <linux/getcpu.h>
12277+#include <linux/time.h>
12278
12279 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
12280-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
12281
12282 /* Definitions for CONFIG_GENERIC_TIME definitions */
12283 #define __section_vsyscall_gtod_data __attribute__ \
12284@@ -31,7 +32,6 @@ enum vsyscall_num {
12285 #define VGETCPU_LSL 2
12286
12287 extern int __vgetcpu_mode;
12288-extern volatile unsigned long __jiffies;
12289
12290 /* kernel space (writeable) */
12291 extern int vgetcpu_mode;
12292@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
12293
12294 extern void map_vsyscall(void);
12295
12296+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
12297+extern time_t vtime(time_t *t);
12298+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
12299 #endif /* __KERNEL__ */
12300
12301 #endif /* _ASM_X86_VSYSCALL_H */
66a7e928
MT		 12302diff -urNp linux-2.6.39/arch/x86/include/asm/xen/pci.h linux-2.6.39/arch/x86/include/asm/xen/pci.h
12303--- linux-2.6.39/arch/x86/include/asm/xen/pci.h 2011-05-19 00:06:34.000000000 -0400
12304+++ linux-2.6.39/arch/x86/include/asm/xen/pci.h 2011-05-22 19:36:30.000000000 -0400
12305@@ -33,7 +33,7 @@ struct xen_pci_frontend_ops {
12306 void (*disable_msix)(struct pci_dev *dev);
12307 };
12308
12309-extern struct xen_pci_frontend_ops *xen_pci_frontend;
12310+extern const struct xen_pci_frontend_ops *xen_pci_frontend;
12311
12312 static inline int xen_pci_frontend_enable_msi(struct pci_dev *dev,
12313 int vectors[])
12314diff -urNp linux-2.6.39/arch/x86/include/asm/xsave.h linux-2.6.39/arch/x86/include/asm/xsave.h
12315--- linux-2.6.39/arch/x86/include/asm/xsave.h 2011-05-19 00:06:34.000000000 -0400
12316+++ linux-2.6.39/arch/x86/include/asm/xsave.h 2011-05-22 19:36:30.000000000 -0400
6892158b 12317@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
df50ba0c
MT		 12318 {
12319 int err;
6892158b 12320
df50ba0c
MT		 12321+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12322+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
12323+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
12324+#endif
12325+
6892158b
MT		 12326 /*
12327 * Clear the xsave header first, so that reserved fields are
12328 * initialized to zero.
12329@@ -100,6 +105,11 @@ static inline int xrestore_user(struct x
df50ba0c
MT		 12330 u32 lmask = mask;
12331 u32 hmask = mask >> 32;
12332
12333+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12334+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
12335+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
12336+#endif
12337+
12338 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
12339 "2:\n"
12340 ".section .fixup,\"ax\"\n"
66a7e928
MT		 12341diff -urNp linux-2.6.39/arch/x86/Kconfig linux-2.6.39/arch/x86/Kconfig
12342--- linux-2.6.39/arch/x86/Kconfig 2011-05-19 00:06:34.000000000 -0400
12343+++ linux-2.6.39/arch/x86/Kconfig 2011-05-22 19:41:32.000000000 -0400
12344@@ -224,7 +224,7 @@ config X86_HT
bc901d79
MT		 12345
12346 config X86_32_LAZY_GS
12347 def_bool y
12348- depends on X86_32 && !CC_STACKPROTECTOR
12349+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12350
12351 config ARCH_HWEIGHT_CFLAGS
12352 string
66a7e928 12353@@ -1022,7 +1022,7 @@ choice
57199397
MT		 12354
12355 config NOHIGHMEM
12356 bool "off"
12357- depends on !X86_NUMAQ
12358+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12359 ---help---
12360 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12361 However, the address space of 32-bit x86 processors is only 4
66a7e928 12362@@ -1059,7 +1059,7 @@ config NOHIGHMEM
57199397
MT		 12363
12364 config HIGHMEM4G
12365 bool "4GB"
12366- depends on !X86_NUMAQ
12367+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12368 ---help---
12369 Select this if you have a 32-bit processor and between 1 and 4
12370 gigabytes of physical RAM.
66a7e928 12371@@ -1113,7 +1113,7 @@ config PAGE_OFFSET
57199397
MT		 12372 hex
12373 default 0xB0000000 if VMSPLIT_3G_OPT
12374 default 0x80000000 if VMSPLIT_2G
12375- default 0x78000000 if VMSPLIT_2G_OPT
12376+ default 0x70000000 if VMSPLIT_2G_OPT
12377 default 0x40000000 if VMSPLIT_1G
12378 default 0xC0000000
12379 depends on X86_32
66a7e928 12380@@ -1457,7 +1457,7 @@ config ARCH_USES_PG_UNCACHED
57199397
MT		 12381
12382 config EFI
12383 bool "EFI runtime service support"
12384- depends on ACPI
12385+ depends on ACPI && !PAX_KERNEXEC
12386 ---help---
12387 This enables the kernel to use EFI runtime services that are
12388 available (such as the EFI variable services).
66a7e928 12389@@ -1487,6 +1487,7 @@ config SECCOMP
bc901d79
MT		 12390
12391 config CC_STACKPROTECTOR
12392 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
12393+ depends on X86_64 || !PAX_MEMORY_UDEREF
12394 ---help---
12395 This option turns on the -fstack-protector GCC feature. This
12396 feature puts, at the beginning of functions, a canary value on
66a7e928 12397@@ -1544,6 +1545,7 @@ config KEXEC_JUMP
57199397 12398 config PHYSICAL_START
16454cff 12399 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
57199397
MT		 12400 default "0x1000000"
12401+ range 0x400000 0x40000000
12402 ---help---
12403 This gives the physical address where the kernel is loaded.
12404
66a7e928 12405@@ -1607,6 +1609,7 @@ config X86_NEED_RELOCS
57199397
MT		 12406 config PHYSICAL_ALIGN
12407 hex "Alignment value to which kernel should be aligned" if X86_32
12408 default "0x1000000"
12409+ range 0x400000 0x1000000 if PAX_KERNEXEC
12410 range 0x2000 0x1000000
12411 ---help---
12412 This value puts the alignment restrictions on physical address
66a7e928 12413@@ -1638,9 +1641,10 @@ config HOTPLUG_CPU
57199397
MT		 12414 Say N if you want to disable CPU hotplug.
12415
12416 config COMPAT_VDSO
12417- def_bool y
12418+ def_bool n
12419 prompt "Compat VDSO support"
12420 depends on X86_32 || IA32_EMULATION
12421+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
12422 ---help---
12423 Map the 32-bit VDSO to the predictable old-style address too.
12424
66a7e928
MT		 12425diff -urNp linux-2.6.39/arch/x86/Kconfig.cpu linux-2.6.39/arch/x86/Kconfig.cpu
12426--- linux-2.6.39/arch/x86/Kconfig.cpu 2011-05-19 00:06:34.000000000 -0400
12427+++ linux-2.6.39/arch/x86/Kconfig.cpu 2011-05-22 19:36:30.000000000 -0400
12428@@ -334,7 +334,7 @@ config X86_PPRO_FENCE
57199397
MT		 12429
12430 config X86_F00F_BUG
12431 def_bool y
12432- depends on M586MMX || M586TSC || M586 || M486 || M386
12433+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
12434
12435 config X86_INVD_BUG
12436 def_bool y
66a7e928 12437@@ -358,7 +358,7 @@ config X86_POPAD_OK
57199397
MT		 12438
12439 config X86_ALIGNMENT_16
12440 def_bool y
12441- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12442+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12443
12444 config X86_INTEL_USERCOPY
12445 def_bool y
66a7e928 12446@@ -404,7 +404,7 @@ config X86_CMPXCHG64
57199397
MT		 12447 # generates cmov.
12448 config X86_CMOV
12449 def_bool y
12450- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12451+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12452
12453 config X86_MINIMUM_CPU_FAMILY
12454 int
66a7e928
MT		 12455diff -urNp linux-2.6.39/arch/x86/Kconfig.debug linux-2.6.39/arch/x86/Kconfig.debug
12456--- linux-2.6.39/arch/x86/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
12457+++ linux-2.6.39/arch/x86/Kconfig.debug 2011-05-22 19:36:30.000000000 -0400
bc901d79 12458@@ -101,7 +101,7 @@ config X86_PTDUMP
57199397
MT		 12459 config DEBUG_RODATA
12460 bool "Write protect kernel read-only data structures"
12461 default y
12462- depends on DEBUG_KERNEL
12463+ depends on DEBUG_KERNEL && BROKEN
12464 ---help---
12465 Mark the kernel read-only data as write-protected in the pagetables,
12466 in order to catch accidental (and incorrect) writes to such const
16454cff
MT		 12467@@ -119,7 +119,7 @@ config DEBUG_RODATA_TEST
12468
12469 config DEBUG_SET_MODULE_RONX
12470 bool "Set loadable kernel module data as NX and text as RO"
12471- depends on MODULES
12472+ depends on MODULES && BROKEN
12473 ---help---
12474 This option helps catch unintended modifications to loadable
12475 kernel module's text and read-only data. It also prevents execution
66a7e928
MT		 12476diff -urNp linux-2.6.39/arch/x86/kernel/acpi/sleep.c linux-2.6.39/arch/x86/kernel/acpi/sleep.c
12477--- linux-2.6.39/arch/x86/kernel/acpi/sleep.c 2011-05-19 00:06:34.000000000 -0400
12478+++ linux-2.6.39/arch/x86/kernel/acpi/sleep.c 2011-05-22 19:36:30.000000000 -0400
12479@@ -88,8 +88,12 @@ int acpi_suspend_lowlevel(void)
12480 header->trampoline_segment = trampoline_address() >> 4;
58c5fc13 12481 #ifdef CONFIG_SMP
16454cff 12482 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
58c5fc13 12483+
ae4e228f 12484+ pax_open_kernel();
58c5fc13
MT		 12485 early_gdt_descr.address =
12486 (unsigned long)get_cpu_gdt_table(smp_processor_id());
ae4e228f 12487+ pax_close_kernel();
58c5fc13
MT		 12488+
12489 initial_gs = per_cpu_offset(smp_processor_id());
12490 #endif
12491 initial_code = (unsigned long)wakeup_long64;
66a7e928
MT		 12492diff -urNp linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S
12493--- linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S 2011-05-19 00:06:34.000000000 -0400
12494+++ linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 12495@@ -30,13 +30,11 @@ wakeup_pmode_return:
12496 # and restore the stack ... but you need gdt for this to work
12497 movl saved_context_esp, %esp
12498
12499- movl %cs:saved_magic, %eax
12500- cmpl $0x12345678, %eax
12501+ cmpl $0x12345678, saved_magic
12502 jne bogus_magic
12503
12504 # jump to place where we left off
12505- movl saved_eip, %eax
12506- jmp *%eax
12507+ jmp *(saved_eip)
12508
12509 bogus_magic:
12510 jmp bogus_magic
66a7e928
MT		 12511diff -urNp linux-2.6.39/arch/x86/kernel/alternative.c linux-2.6.39/arch/x86/kernel/alternative.c
12512--- linux-2.6.39/arch/x86/kernel/alternative.c 2011-05-19 00:06:34.000000000 -0400
12513+++ linux-2.6.39/arch/x86/kernel/alternative.c 2011-05-22 19:36:30.000000000 -0400
6892158b 12514@@ -248,7 +248,7 @@ static void alternatives_smp_lock(const
57199397
MT		 12515 if (!*poff || ptr < text || ptr >= text_end)
12516 continue;
12517 /* turn DS segment override prefix into lock prefix */
12518- if (*ptr == 0x3e)
12519+ if (*ktla_ktva(ptr) == 0x3e)
12520 text_poke(ptr, ((unsigned char []){0xf0}), 1);
12521 };
12522 mutex_unlock(&text_mutex);
6892158b 12523@@ -269,7 +269,7 @@ static void alternatives_smp_unlock(cons
57199397
MT		 12524 if (!*poff || ptr < text || ptr >= text_end)
12525 continue;
12526 /* turn lock prefix into DS segment override prefix */
12527- if (*ptr == 0xf0)
12528+ if (*ktla_ktva(ptr) == 0xf0)
12529 text_poke(ptr, ((unsigned char []){0x3E}), 1);
12530 };
12531 mutex_unlock(&text_mutex);
16454cff 12532@@ -438,7 +438,7 @@ void __init_or_module apply_paravirt(str
58c5fc13
MT		 12533
12534 BUG_ON(p->len > MAX_PATCH_LEN);
12535 /* prep the buffer with the original instructions */
12536- memcpy(insnbuf, p->instr, p->len);
12537+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12538 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12539 (unsigned long)p->instr, p->len);
12540
16454cff 12541@@ -506,7 +506,7 @@ void __init alternative_instructions(voi
df50ba0c
MT		 12542 if (smp_alt_once)
12543 free_init_pages("SMP alternatives",
12544 (unsigned long)__smp_locks,
12545- (unsigned long)__smp_locks_end);
12546+ PAGE_ALIGN((unsigned long)__smp_locks_end));
12547
12548 restart_nmi();
12549 }
16454cff 12550@@ -523,13 +523,17 @@ void __init alternative_instructions(voi
58c5fc13
MT		 12551 * instructions. And on the local CPU you need to be protected again NMI or MCE
12552 * handlers seeing an inconsistent instruction while you patch.
12553 */
bc901d79
MT		 12554-void *__init_or_module text_poke_early(void *addr, const void *opcode,
12555+void *__kprobes text_poke_early(void *addr, const void *opcode,
ae4e228f 12556 size_t len)
58c5fc13
MT		 12557 {
12558 unsigned long flags;
58c5fc13
MT		 12559 local_irq_save(flags);
12560- memcpy(addr, opcode, len);
12561+
ae4e228f 12562+ pax_open_kernel();
58c5fc13 12563+ memcpy(ktla_ktva(addr), opcode, len);
57199397 12564 sync_core();
ae4e228f 12565+ pax_close_kernel();
58c5fc13 12566+
ae4e228f 12567 local_irq_restore(flags);
58c5fc13 12568 /* Could also do a CLFLUSH here to speed up CPU recovery; but
57199397 12569 that causes hangs on some VIA CPUs. */
16454cff 12570@@ -551,36 +555,22 @@ void *__init_or_module text_poke_early(v
58c5fc13
MT		 12571 */
12572 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12573 {
12574- unsigned long flags;
12575- char *vaddr;
12576+ unsigned char *vaddr = ktla_ktva(addr);
12577 struct page *pages[2];
12578- int i;
12579+ size_t i;
58c5fc13 12580
ae4e228f 12581 if (!core_kernel_text((unsigned long)addr)) {
58c5fc13
MT		 12582- pages[0] = vmalloc_to_page(addr);
12583- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
58c5fc13
MT		 12584+ pages[0] = vmalloc_to_page(vaddr);
12585+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12586 } else {
12587- pages[0] = virt_to_page(addr);
12588+ pages[0] = virt_to_page(vaddr);
12589 WARN_ON(!PageReserved(pages[0]));
12590- pages[1] = virt_to_page(addr + PAGE_SIZE);
12591+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12592 }
12593 BUG_ON(!pages[0]);
12594- local_irq_save(flags);
12595- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12596- if (pages[1])
12597- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12598- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12599- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12600- clear_fixmap(FIX_TEXT_POKE0);
12601- if (pages[1])
12602- clear_fixmap(FIX_TEXT_POKE1);
12603- local_flush_tlb();
12604- sync_core();
12605- /* Could also do a CLFLUSH here to speed up CPU recovery; but
12606- that causes hangs on some VIA CPUs. */
12607+ text_poke_early(addr, opcode, len);
12608 for (i = 0; i < len; i++)
12609- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12610- local_irq_restore(flags);
bc901d79 12611+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
58c5fc13
MT		 12612 return addr;
12613 }
df50ba0c 12614
ea610fa8 12615@@ -682,9 +672,9 @@ void __kprobes text_poke_smp_batch(struc
bc901d79
MT		 12616 #if defined(CONFIG_DYNAMIC_FTRACE) || defined(HAVE_JUMP_LABEL)
12617
12618 #ifdef CONFIG_X86_64
12619-unsigned char ideal_nop5[5] = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12620+unsigned char ideal_nop5[5] __read_only = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12621 #else
12622-unsigned char ideal_nop5[5] = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12623+unsigned char ideal_nop5[5] __read_only = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12624 #endif
12625
12626 void __init arch_init_ideal_nop5(void)
66a7e928
MT		 12627diff -urNp linux-2.6.39/arch/x86/kernel/amd_iommu.c linux-2.6.39/arch/x86/kernel/amd_iommu.c
12628--- linux-2.6.39/arch/x86/kernel/amd_iommu.c 2011-05-19 00:06:34.000000000 -0400
12629+++ linux-2.6.39/arch/x86/kernel/amd_iommu.c 2011-05-22 19:36:30.000000000 -0400
12630@@ -48,7 +48,7 @@ static DEFINE_SPINLOCK(iommu_pd_list_loc
12631 */
12632 static struct protection_domain *pt_domain;
12633
12634-static struct iommu_ops amd_iommu_ops;
12635+static const struct iommu_ops amd_iommu_ops;
12636
12637 /*
12638 * general struct to manage commands send to an IOMMU
6892158b 12639@@ -2286,7 +2286,7 @@ static void prealloc_protection_domains(
ae4e228f
MT		 12640 }
12641 }
12642
12643-static struct dma_map_ops amd_iommu_dma_ops = {
12644+static const struct dma_map_ops amd_iommu_dma_ops = {
12645 .alloc_coherent = alloc_coherent,
12646 .free_coherent = free_coherent,
12647 .map_page = map_page,
66a7e928
MT		 12648@@ -2582,7 +2582,7 @@ static int amd_iommu_domain_has_cap(stru
12649 return 0;
12650 }
12651
12652-static struct iommu_ops amd_iommu_ops = {
12653+static const struct iommu_ops amd_iommu_ops = {
12654 .domain_init = amd_iommu_domain_init,
12655 .domain_destroy = amd_iommu_domain_destroy,
12656 .attach_dev = amd_iommu_attach_device,
12657diff -urNp linux-2.6.39/arch/x86/kernel/apic/apic.c linux-2.6.39/arch/x86/kernel/apic/apic.c
12658--- linux-2.6.39/arch/x86/kernel/apic/apic.c 2011-05-19 00:06:34.000000000 -0400
12659+++ linux-2.6.39/arch/x86/kernel/apic/apic.c 2011-05-22 19:36:30.000000000 -0400
12660@@ -1821,7 +1821,7 @@ void smp_error_interrupt(struct pt_regs
8308f9c9
MT		 12661 apic_write(APIC_ESR, 0);
12662 v1 = apic_read(APIC_ESR);
12663 ack_APIC_irq();
12664- atomic_inc(&irq_err_count);
12665+ atomic_inc_unchecked(&irq_err_count);
12666
12667 /*
12668 * Here is what the APIC error bits mean:
66a7e928
MT		 12669@@ -2204,6 +2204,8 @@ static int __cpuinit apic_cluster_num(vo
12670 u16 *bios_cpu_apicid;
12671 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
12672
12673+ pax_track_stack();
12674+
12675 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12676 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12677
12678diff -urNp linux-2.6.39/arch/x86/kernel/apic/io_apic.c linux-2.6.39/arch/x86/kernel/apic/io_apic.c
12679--- linux-2.6.39/arch/x86/kernel/apic/io_apic.c 2011-05-19 00:06:34.000000000 -0400
12680+++ linux-2.6.39/arch/x86/kernel/apic/io_apic.c 2011-05-22 19:36:30.000000000 -0400
12681@@ -623,7 +623,7 @@ struct IO_APIC_route_entry **alloc_ioapi
ae4e228f 12682 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
bc901d79 12683 GFP_KERNEL);
ae4e228f
MT		 12684 if (!ioapic_entries)
12685- return 0;
12686+ return NULL;
58c5fc13 12687
ae4e228f
MT		 12688 for (apic = 0; apic < nr_ioapics; apic++) {
12689 ioapic_entries[apic] =
66a7e928 12690@@ -640,7 +640,7 @@ nomem:
ae4e228f
MT		 12691 kfree(ioapic_entries[apic]);
12692 kfree(ioapic_entries);
58c5fc13 12693
ae4e228f
MT		 12694- return 0;
12695+ return NULL;
12696 }
58c5fc13 12697
ae4e228f 12698 /*
66a7e928 12699@@ -1040,7 +1040,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
ae4e228f
MT		 12700 }
12701 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12702
12703-void lock_vector_lock(void)
12704+void lock_vector_lock(void) __acquires(vector_lock)
12705 {
12706 /* Used to the online set of cpus does not change
12707 * during assign_irq_vector.
66a7e928 12708@@ -1048,7 +1048,7 @@ void lock_vector_lock(void)
df50ba0c 12709 raw_spin_lock(&vector_lock);
ae4e228f
MT		 12710 }
12711
12712-void unlock_vector_lock(void)
12713+void unlock_vector_lock(void) __releases(vector_lock)
12714 {
df50ba0c 12715 raw_spin_unlock(&vector_lock);
ae4e228f 12716 }
66a7e928 12717@@ -2379,7 +2379,7 @@ static void ack_apic_edge(struct irq_dat
8308f9c9
MT		 12718 ack_APIC_irq();
12719 }
12720
12721-atomic_t irq_mis_count;
12722+atomic_unchecked_t irq_mis_count;
12723
12724 /*
12725 * IO-APIC versions below 0x20 don't support EOI register.
66a7e928 12726@@ -2487,7 +2487,7 @@ static void ack_apic_level(struct irq_da
8308f9c9
MT		 12727 * at the cpu.
12728 */
12729 if (!(v & (1 << (i & 0x1f)))) {
12730- atomic_inc(&irq_mis_count);
12731+ atomic_inc_unchecked(&irq_mis_count);
12732
12733 eoi_ioapic_irq(irq, cfg);
12734 }
66a7e928
MT		 12735diff -urNp linux-2.6.39/arch/x86/kernel/apm_32.c linux-2.6.39/arch/x86/kernel/apm_32.c
12736--- linux-2.6.39/arch/x86/kernel/apm_32.c 2011-05-19 00:06:34.000000000 -0400
12737+++ linux-2.6.39/arch/x86/kernel/apm_32.c 2011-05-22 19:36:30.000000000 -0400
12738@@ -412,7 +412,7 @@ static DEFINE_MUTEX(apm_mutex);
ae4e228f
MT		 12739 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12740 * even though they are called in protected mode.
12741 */
12742-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12743+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12744 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12745
12746 static const char driver_version[] = "1.16ac"; /* no spaces */
66a7e928 12747@@ -590,7 +590,10 @@ static long __apm_bios_call(void *_call)
58c5fc13
MT		 12748 BUG_ON(cpu != 0);
12749 gdt = get_cpu_gdt_table(cpu);
12750 save_desc_40 = gdt[0x40 / 8];
12751+
ae4e228f 12752+ pax_open_kernel();
58c5fc13 12753 gdt[0x40 / 8] = bad_bios_desc;
ae4e228f 12754+ pax_close_kernel();
58c5fc13 12755
58c5fc13
MT		 12756 apm_irq_save(flags);
12757 APM_DO_SAVE_SEGS;
66a7e928 12758@@ -599,7 +602,11 @@ static long __apm_bios_call(void *_call)
58c5fc13
MT		 12759 &call->esi);
12760 APM_DO_RESTORE_SEGS;
12761 apm_irq_restore(flags);
12762+
ae4e228f 12763+ pax_open_kernel();
58c5fc13 12764 gdt[0x40 / 8] = save_desc_40;
ae4e228f 12765+ pax_close_kernel();
58c5fc13
MT		 12766+
12767 put_cpu();
12768
12769 return call->eax & 0xff;
66a7e928 12770@@ -666,7 +673,10 @@ static long __apm_bios_call_simple(void
58c5fc13
MT		 12771 BUG_ON(cpu != 0);
12772 gdt = get_cpu_gdt_table(cpu);
12773 save_desc_40 = gdt[0x40 / 8];
12774+
ae4e228f 12775+ pax_open_kernel();
58c5fc13 12776 gdt[0x40 / 8] = bad_bios_desc;
ae4e228f 12777+ pax_close_kernel();
58c5fc13 12778
58c5fc13
MT		 12779 apm_irq_save(flags);
12780 APM_DO_SAVE_SEGS;
66a7e928 12781@@ -674,7 +684,11 @@ static long __apm_bios_call_simple(void
58c5fc13
MT		 12782 &call->eax);
12783 APM_DO_RESTORE_SEGS;
12784 apm_irq_restore(flags);
12785+
ae4e228f 12786+ pax_open_kernel();
58c5fc13 12787 gdt[0x40 / 8] = save_desc_40;
ae4e228f 12788+ pax_close_kernel();
58c5fc13
MT		 12789+
12790 put_cpu();
12791 return error;
12792 }
66a7e928 12793@@ -2351,12 +2365,15 @@ static int __init apm_init(void)
58c5fc13
MT		 12794 * code to that CPU.
12795 */
12796 gdt = get_cpu_gdt_table(0);
12797+
ae4e228f
MT		 12798+ pax_open_kernel();
12799 set_desc_base(&gdt[APM_CS >> 3],
12800 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12801 set_desc_base(&gdt[APM_CS_16 >> 3],
12802 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12803 set_desc_base(&gdt[APM_DS >> 3],
12804 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12805+ pax_close_kernel();
58c5fc13 12806
58c5fc13
MT		 12807 proc_create("apm", 0, NULL, &apm_file_ops);
12808
66a7e928
MT		 12809diff -urNp linux-2.6.39/arch/x86/kernel/asm-offsets_64.c linux-2.6.39/arch/x86/kernel/asm-offsets_64.c
12810--- linux-2.6.39/arch/x86/kernel/asm-offsets_64.c 2011-05-19 00:06:34.000000000 -0400
12811+++ linux-2.6.39/arch/x86/kernel/asm-offsets_64.c 2011-05-22 19:36:30.000000000 -0400
12812@@ -69,6 +69,7 @@ int main(void)
12813 BLANK();
12814 #undef ENTRY
12815
12816+ DEFINE(TSS_size, sizeof(struct tss_struct));
12817 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
71d190be
MT		 12818 BLANK();
12819
66a7e928
MT		 12820diff -urNp linux-2.6.39/arch/x86/kernel/asm-offsets.c linux-2.6.39/arch/x86/kernel/asm-offsets.c
12821--- linux-2.6.39/arch/x86/kernel/asm-offsets.c 2011-05-19 00:06:34.000000000 -0400
12822+++ linux-2.6.39/arch/x86/kernel/asm-offsets.c 2011-05-22 19:36:30.000000000 -0400
12823@@ -33,6 +33,8 @@ void common(void) {
71d190be 12824 OFFSET(TI_status, thread_info, status);
66a7e928
MT		 12825 OFFSET(TI_addr_limit, thread_info, addr_limit);
12826 OFFSET(TI_preempt_count, thread_info, preempt_count);
12827+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12828+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
58c5fc13 12829
66a7e928
MT		 12830 BLANK();
12831 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
12832@@ -53,8 +55,24 @@ void common(void) {
ae4e228f 12833 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
66a7e928 12834 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
ae4e228f
MT		 12835 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12836+
12837+#ifdef CONFIG_PAX_KERNEXEC
ae4e228f
MT		 12838+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12839+#endif
df50ba0c
MT		 12840+
12841+#ifdef CONFIG_PAX_MEMORY_UDEREF
12842+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
12843+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
12844+ OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
ae4e228f
MT		 12845 #endif
12846
66a7e928
MT		 12847+#endif
12848+
12849+ BLANK();
12850+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12851+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
8308f9c9 12852+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
66a7e928 12853+
8308f9c9
MT		 12854 #ifdef CONFIG_XEN
12855 BLANK();
12856 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
66a7e928
MT		 12857diff -urNp linux-2.6.39/arch/x86/kernel/cpu/amd.c linux-2.6.39/arch/x86/kernel/cpu/amd.c
12858--- linux-2.6.39/arch/x86/kernel/cpu/amd.c 2011-05-19 00:06:34.000000000 -0400
12859+++ linux-2.6.39/arch/x86/kernel/cpu/amd.c 2011-05-22 19:36:30.000000000 -0400
12860@@ -641,7 +641,7 @@ static unsigned int __cpuinit amd_size_c
71d190be
MT		 12861 unsigned int size)
12862 {
12863 /* AMD errata T13 (order #21922) */
12864- if ((c->x86 == 6)) {
12865+ if (c->x86 == 6) {
12866 /* Duron Rev A0 */
12867 if (c->x86_model == 3 && c->x86_mask == 0)
12868 size = 64;
66a7e928
MT		 12869diff -urNp linux-2.6.39/arch/x86/kernel/cpu/common.c linux-2.6.39/arch/x86/kernel/cpu/common.c
12870--- linux-2.6.39/arch/x86/kernel/cpu/common.c 2011-05-19 00:06:34.000000000 -0400
12871+++ linux-2.6.39/arch/x86/kernel/cpu/common.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 12872@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
58c5fc13
MT		 12873
12874 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
12875
12876-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
12877-#ifdef CONFIG_X86_64
12878- /*
12879- * We need valid kernel segments for data and code in long mode too
12880- * IRET will check the segment types kkeil 2000/10/28
12881- * Also sysret mandates a special GDT layout
12882- *
12883- * TLS descriptors are currently at a different place compared to i386.
12884- * Hopefully nobody expects them at a fixed place (Wine?)
12885- */
ae4e228f
MT		 12886- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
12887- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
12888- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
12889- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
12890- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
12891- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
58c5fc13 12892-#else
ae4e228f
MT		 12893- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
12894- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12895- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
12896- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
58c5fc13
MT		 12897- /*
12898- * Segments used for calling PnP BIOS have byte granularity.
12899- * They code segments and data segments have fixed 64k limits,
12900- * the transfer segment sizes are set at run time.
12901- */
12902- /* 32-bit code */
ae4e228f 12903- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
58c5fc13 12904- /* 16-bit code */
ae4e228f 12905- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
58c5fc13 12906- /* 16-bit data */
ae4e228f 12907- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
58c5fc13 12908- /* 16-bit data */
ae4e228f 12909- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
58c5fc13 12910- /* 16-bit data */
ae4e228f 12911- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
58c5fc13
MT		 12912- /*
12913- * The APM segments have byte granularity and their bases
12914- * are set at run time. All have 64k limits.
12915- */
12916- /* 32-bit code */
ae4e228f 12917- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
58c5fc13 12918- /* 16-bit code */
ae4e228f 12919- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
58c5fc13 12920- /* data */
ae4e228f 12921- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
58c5fc13 12922-
ae4e228f
MT		 12923- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12924- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
58c5fc13
MT		 12925- GDT_STACK_CANARY_INIT
12926-#endif
12927-} };
12928-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
12929-
12930 static int __init x86_xsave_setup(char *s)
12931 {
12932 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
6892158b 12933@@ -352,7 +298,7 @@ void switch_to_new_gdt(int cpu)
58c5fc13
MT		 12934 {
12935 struct desc_ptr gdt_descr;
12936
12937- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
12938+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12939 gdt_descr.size = GDT_SIZE - 1;
12940 load_gdt(&gdt_descr);
12941 /* Reload the per-cpu base */
bc901d79 12942@@ -825,6 +771,10 @@ static void __cpuinit identify_cpu(struc
58c5fc13
MT		 12943 /* Filter out anything that depends on CPUID levels we don't have */
12944 filter_cpuid_features(c, true);
12945
ae4e228f 12946+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
58c5fc13
MT		 12947+ setup_clear_cpu_cap(X86_FEATURE_SEP);
12948+#endif
12949+
12950 /* If the model name is still unset, do table lookup. */
12951 if (!c->x86_model_id[0]) {
12952 const char *p;
71d190be
MT		 12953@@ -1004,6 +954,9 @@ static __init int setup_disablecpuid(cha
12954 }
12955 __setup("clearcpuid=", setup_disablecpuid);
12956
12957+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
12958+EXPORT_PER_CPU_SYMBOL(current_tinfo);
12959+
12960 #ifdef CONFIG_X86_64
12961 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
12962
12963@@ -1019,7 +972,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
12964 EXPORT_PER_CPU_SYMBOL(current_task);
12965
12966 DEFINE_PER_CPU(unsigned long, kernel_stack) =
12967- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
66a7e928 12968+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
71d190be
MT		 12969 EXPORT_PER_CPU_SYMBOL(kernel_stack);
12970
12971 DEFINE_PER_CPU(char *, irq_stack_ptr) =
12972@@ -1084,7 +1037,7 @@ struct pt_regs * __cpuinit idle_regs(str
bc901d79
MT		 12973 {
12974 memset(regs, 0, sizeof(struct pt_regs));
12975 regs->fs = __KERNEL_PERCPU;
12976- regs->gs = __KERNEL_STACK_CANARY;
12977+ savesegment(gs, regs->gs);
12978
12979 return regs;
12980 }
71d190be 12981@@ -1139,7 +1092,7 @@ void __cpuinit cpu_init(void)
58c5fc13
MT		 12982 int i;
12983
12984 cpu = stack_smp_processor_id();
12985- t = &per_cpu(init_tss, cpu);
12986+ t = init_tss + cpu;
ae4e228f 12987 oist = &per_cpu(orig_ist, cpu);
58c5fc13
MT		 12988
12989 #ifdef CONFIG_NUMA
71d190be 12990@@ -1165,7 +1118,7 @@ void __cpuinit cpu_init(void)
df50ba0c
MT		 12991 switch_to_new_gdt(cpu);
12992 loadsegment(fs, 0);
12993
12994- load_idt((const struct desc_ptr *)&idt_descr);
12995+ load_idt(&idt_descr);
12996
12997 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
12998 syscall_init();
71d190be 12999@@ -1174,7 +1127,6 @@ void __cpuinit cpu_init(void)
bc901d79
MT		 13000 wrmsrl(MSR_KERNEL_GS_BASE, 0);
13001 barrier();
13002
13003- x86_configure_nx();
13004 if (cpu != 0)
13005 enable_x2apic();
13006
71d190be 13007@@ -1228,7 +1180,7 @@ void __cpuinit cpu_init(void)
58c5fc13
MT		 13008 {
13009 int cpu = smp_processor_id();
13010 struct task_struct *curr = current;
13011- struct tss_struct *t = &per_cpu(init_tss, cpu);
13012+ struct tss_struct *t = init_tss + cpu;
13013 struct thread_struct *thread = &curr->thread;
13014
13015 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
66a7e928
MT		 13016diff -urNp linux-2.6.39/arch/x86/kernel/cpu/intel.c linux-2.6.39/arch/x86/kernel/cpu/intel.c
13017--- linux-2.6.39/arch/x86/kernel/cpu/intel.c 2011-05-19 00:06:34.000000000 -0400
13018+++ linux-2.6.39/arch/x86/kernel/cpu/intel.c 2011-05-22 19:36:30.000000000 -0400
6892158b 13019@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
58c5fc13
MT		 13020 * Update the IDT descriptor and reload the IDT so that
13021 * it uses the read-only mapped virtual address.
13022 */
13023- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
13024+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
13025 load_idt(&idt_descr);
13026 }
13027 #endif
66a7e928
MT		 13028diff -urNp linux-2.6.39/arch/x86/kernel/cpu/Makefile linux-2.6.39/arch/x86/kernel/cpu/Makefile
13029--- linux-2.6.39/arch/x86/kernel/cpu/Makefile 2011-05-19 00:06:34.000000000 -0400
13030+++ linux-2.6.39/arch/x86/kernel/cpu/Makefile 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 13031@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
13032 CFLAGS_REMOVE_perf_event.o = -pg
13033 endif
13034
13035-# Make sure load_percpu_segment has no stackprotector
13036-nostackp := $(call cc-option, -fno-stack-protector)
13037-CFLAGS_common.o := $(nostackp)
13038-
6892158b 13039 obj-y := intel_cacheinfo.o scattered.o topology.o
57199397
MT		 13040 obj-y += proc.o capflags.o powerflags.o common.o
13041 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
66a7e928
MT		 13042diff -urNp linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c
13043--- linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-19 00:06:34.000000000 -0400
13044+++ linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-22 19:36:30.000000000 -0400
13045@@ -46,6 +46,7 @@
c52201e0
MT		 13046 #include <asm/ipi.h>
13047 #include <asm/mce.h>
13048 #include <asm/msr.h>
13049+#include <asm/local.h>
13050
13051 #include "mce-internal.h"
13052
66a7e928 13053@@ -220,7 +221,7 @@ static void print_mce(struct mce *m)
ae4e228f
MT		 13054 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
13055 m->cs, m->ip);
13056
13057- if (m->cs == __KERNEL_CS)
13058+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
13059 print_symbol("{%s}", m->ip);
13060 pr_cont("\n");
13061 }
66a7e928 13062@@ -244,10 +245,10 @@ static void print_mce(struct mce *m)
8308f9c9
MT		 13063
13064 #define PANIC_TIMEOUT 5 /* 5 seconds */
13065
13066-static atomic_t mce_paniced;
13067+static atomic_unchecked_t mce_paniced;
13068
13069 static int fake_panic;
13070-static atomic_t mce_fake_paniced;
13071+static atomic_unchecked_t mce_fake_paniced;
13072
13073 /* Panic in progress. Enable interrupts and wait for final IPI */
13074 static void wait_for_panic(void)
66a7e928 13075@@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
8308f9c9
MT		 13076 /*
13077 * Make sure only one CPU runs in machine check panic
13078 */
13079- if (atomic_inc_return(&mce_paniced) > 1)
13080+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
13081 wait_for_panic();
13082 barrier();
13083
66a7e928 13084@@ -279,7 +280,7 @@ static void mce_panic(char *msg, struct
8308f9c9
MT		 13085 console_verbose();
13086 } else {
13087 /* Don't log too much for fake panic */
13088- if (atomic_inc_return(&mce_fake_paniced) > 1)
13089+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
13090 return;
13091 }
13092 /* First print corrected ones that are still unlogged */
66a7e928 13093@@ -647,7 +648,7 @@ static int mce_timed_out(u64 *t)
8308f9c9
MT		 13094 * might have been modified by someone else.
13095 */
13096 rmb();
13097- if (atomic_read(&mce_paniced))
13098+ if (atomic_read_unchecked(&mce_paniced))
13099 wait_for_panic();
13100 if (!monarch_timeout)
13101 goto out;
66a7e928 13102@@ -1461,14 +1462,14 @@ void __cpuinit mcheck_cpu_init(struct cp
58c5fc13
MT		 13103 */
13104
13105 static DEFINE_SPINLOCK(mce_state_lock);
13106-static int open_count; /* #times opened */
c52201e0 13107+static local_t open_count; /* #times opened */
58c5fc13
MT		 13108 static int open_exclu; /* already open exclusive? */
13109
13110 static int mce_open(struct inode *inode, struct file *file)
13111 {
13112 spin_lock(&mce_state_lock);
13113
13114- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
c52201e0 13115+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
58c5fc13
MT		 13116 spin_unlock(&mce_state_lock);
13117
13118 return -EBUSY;
66a7e928 13119@@ -1476,7 +1477,7 @@ static int mce_open(struct inode *inode,
58c5fc13
MT		 13120
13121 if (file->f_flags & O_EXCL)
13122 open_exclu = 1;
13123- open_count++;
c52201e0 13124+ local_inc(&open_count);
58c5fc13
MT		 13125
13126 spin_unlock(&mce_state_lock);
13127
66a7e928 13128@@ -1487,7 +1488,7 @@ static int mce_release(struct inode *ino
58c5fc13
MT		 13129 {
13130 spin_lock(&mce_state_lock);
13131
13132- open_count--;
c52201e0 13133+ local_dec(&open_count);
58c5fc13
MT		 13134 open_exclu = 0;
13135
13136 spin_unlock(&mce_state_lock);
66a7e928 13137@@ -2174,7 +2175,7 @@ struct dentry *mce_get_debugfs_dir(void)
8308f9c9
MT		 13138 static void mce_reset(void)
13139 {
13140 cpu_missing = 0;
13141- atomic_set(&mce_fake_paniced, 0);
13142+ atomic_set_unchecked(&mce_fake_paniced, 0);
13143 atomic_set(&mce_executing, 0);
13144 atomic_set(&mce_callin, 0);
13145 atomic_set(&global_nwo, 0);
66a7e928
MT		 13146diff -urNp linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c
13147--- linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c 2011-05-19 00:06:34.000000000 -0400
13148+++ linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c 2011-05-22 19:36:30.000000000 -0400
13149@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
ae4e228f
MT		 13150 u64 size_or_mask, size_and_mask;
13151 static bool mtrr_aps_delayed_init;
13152
df50ba0c 13153-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
ae4e228f
MT		 13154+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
13155
df50ba0c 13156 const struct mtrr_ops *mtrr_if;
ae4e228f 13157
66a7e928
MT		 13158diff -urNp linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h
13159--- linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-19 00:06:34.000000000 -0400
13160+++ linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 13161@@ -12,19 +12,19 @@
13162 extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
13163
13164 struct mtrr_ops {
13165- u32 vendor;
13166- u32 use_intel_if;
13167- void (*set)(unsigned int reg, unsigned long base,
13168+ const u32 vendor;
13169+ const u32 use_intel_if;
13170+ void (* const set)(unsigned int reg, unsigned long base,
13171 unsigned long size, mtrr_type type);
13172- void (*set_all)(void);
13173+ void (* const set_all)(void);
13174
13175- void (*get)(unsigned int reg, unsigned long *base,
13176+ void (* const get)(unsigned int reg, unsigned long *base,
13177 unsigned long *size, mtrr_type *type);
13178- int (*get_free_region)(unsigned long base, unsigned long size,
13179+ int (* const get_free_region)(unsigned long base, unsigned long size,
13180 int replace_reg);
13181- int (*validate_add_page)(unsigned long base, unsigned long size,
13182+ int (* const validate_add_page)(unsigned long base, unsigned long size,
13183 unsigned int type);
13184- int (*have_wrcomb)(void);
13185+ int (* const have_wrcomb)(void);
13186 };
13187
13188 extern int generic_get_free_region(unsigned long base, unsigned long size,
66a7e928
MT		 13189diff -urNp linux-2.6.39/arch/x86/kernel/cpu/perf_event.c linux-2.6.39/arch/x86/kernel/cpu/perf_event.c
13190--- linux-2.6.39/arch/x86/kernel/cpu/perf_event.c 2011-05-19 00:06:34.000000000 -0400
13191+++ linux-2.6.39/arch/x86/kernel/cpu/perf_event.c 2011-05-22 19:36:30.000000000 -0400
13192@@ -774,6 +774,8 @@ static int x86_schedule_events(struct cp
13193 int i, j, w, wmax, num = 0;
13194 struct hw_perf_event *hwc;
13195
13196+ pax_track_stack();
13197+
13198 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
13199
13200 for (i = 0; i < n; i++) {
13201@@ -1878,7 +1880,7 @@ perf_callchain_user(struct perf_callchai
57199397
MT		 13202 break;
13203
bc901d79 13204 perf_callchain_store(entry, frame.return_address);
57199397
MT		 13205- fp = frame.next_frame;
13206+ fp = (__force const void __user *)frame.next_frame;
13207 }
13208 }
13209
66a7e928
MT		 13210diff -urNp linux-2.6.39/arch/x86/kernel/crash.c linux-2.6.39/arch/x86/kernel/crash.c
13211--- linux-2.6.39/arch/x86/kernel/crash.c 2011-05-19 00:06:34.000000000 -0400
13212+++ linux-2.6.39/arch/x86/kernel/crash.c 2011-05-22 19:36:30.000000000 -0400
6892158b 13213@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
58c5fc13
MT		 13214 regs = args->regs;
13215
13216 #ifdef CONFIG_X86_32
13217- if (!user_mode_vm(regs)) {
13218+ if (!user_mode(regs)) {
13219 crash_fixup_ss_esp(&fixed_regs, regs);
13220 regs = &fixed_regs;
13221 }
66a7e928
MT		 13222diff -urNp linux-2.6.39/arch/x86/kernel/doublefault_32.c linux-2.6.39/arch/x86/kernel/doublefault_32.c
13223--- linux-2.6.39/arch/x86/kernel/doublefault_32.c 2011-05-19 00:06:34.000000000 -0400
13224+++ linux-2.6.39/arch/x86/kernel/doublefault_32.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 13225@@ -11,7 +11,7 @@
13226
13227 #define DOUBLEFAULT_STACKSIZE (1024)
13228 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13229-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13230+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13231
13232 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13233
13234@@ -21,7 +21,7 @@ static void doublefault_fn(void)
13235 unsigned long gdt, tss;
13236
13237 store_gdt(&gdt_desc);
13238- gdt = gdt_desc.address;
13239+ gdt = (unsigned long)gdt_desc.address;
13240
13241 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13242
ae4e228f 13243@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
58c5fc13
MT		 13244 /* 0x2 bit is always set */
13245 .flags = X86_EFLAGS_SF | 0x2,
13246 .sp = STACK_START,
13247- .es = __USER_DS,
13248+ .es = __KERNEL_DS,
13249 .cs = __KERNEL_CS,
13250 .ss = __KERNEL_DS,
13251- .ds = __USER_DS,
13252+ .ds = __KERNEL_DS,
13253 .fs = __KERNEL_PERCPU,
13254
13255 .__cr3 = __pa_nodebug(swapper_pg_dir),
66a7e928
MT		 13256diff -urNp linux-2.6.39/arch/x86/kernel/dumpstack_32.c linux-2.6.39/arch/x86/kernel/dumpstack_32.c
13257--- linux-2.6.39/arch/x86/kernel/dumpstack_32.c 2011-05-19 00:06:34.000000000 -0400
13258+++ linux-2.6.39/arch/x86/kernel/dumpstack_32.c 2011-05-22 19:36:30.000000000 -0400
13259@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
13260 bp = stack_frame(task, regs);
71d190be 13261
71d190be
MT		 13262 for (;;) {
13263- struct thread_info *context;
13264+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
71d190be
MT		 13265
13266- context = (struct thread_info *)
13267- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13268- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
66a7e928
MT		 13269+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13270
71d190be
MT		 13271- stack = (unsigned long *)context->previous_esp;
13272- if (!stack)
13273+ if (stack_start == task_stack_page(task))
13274 break;
13275+ stack = *(unsigned long **)stack_start;
13276 if (ops->stack(data, "IRQ") < 0)
13277 break;
13278 touch_nmi_watchdog();
66a7e928 13279@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
58c5fc13
MT		 13280 * When in-kernel, we also print out the stack and code at the
13281 * time of the fault..
13282 */
13283- if (!user_mode_vm(regs)) {
13284+ if (!user_mode(regs)) {
13285 unsigned int code_prologue = code_bytes * 43 / 64;
13286 unsigned int code_len = code_bytes;
13287 unsigned char c;
13288 u8 *ip;
13289+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13290
13291 printk(KERN_EMERG "Stack:\n");
66a7e928 13292 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
58c5fc13
MT		 13293
13294 printk(KERN_EMERG "Code: ");
13295
13296- ip = (u8 *)regs->ip - code_prologue;
13297+ ip = (u8 *)regs->ip - code_prologue + cs_base;
13298 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13299 /* try starting at IP */
13300- ip = (u8 *)regs->ip;
13301+ ip = (u8 *)regs->ip + cs_base;
13302 code_len = code_len - code_prologue + 1;
13303 }
13304 for (i = 0; i < code_len; i++, ip++) {
66a7e928 13305@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
58c5fc13
MT		 13306 printk(" Bad EIP value.");
13307 break;
13308 }
13309- if (ip == (u8 *)regs->ip)
13310+ if (ip == (u8 *)regs->ip + cs_base)
13311 printk("<%02x> ", c);
13312 else
13313 printk("%02x ", c);
66a7e928 13314@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
58c5fc13
MT		 13315 {
13316 unsigned short ud2;
13317
13318+ ip = ktla_ktva(ip);
13319 if (ip < PAGE_OFFSET)
13320 return 0;
13321 if (probe_kernel_address((unsigned short *)ip, ud2))
66a7e928
MT		 13322diff -urNp linux-2.6.39/arch/x86/kernel/dumpstack_64.c linux-2.6.39/arch/x86/kernel/dumpstack_64.c
13323--- linux-2.6.39/arch/x86/kernel/dumpstack_64.c 2011-05-19 00:06:34.000000000 -0400
13324+++ linux-2.6.39/arch/x86/kernel/dumpstack_64.c 2011-05-22 19:36:30.000000000 -0400
13325@@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
71d190be
MT		 13326 unsigned long *irq_stack_end =
13327 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13328 unsigned used = 0;
13329- struct thread_info *tinfo;
13330 int graph = 0;
13331 unsigned long dummy;
71d190be
MT		 13332+ void *stack_start;
13333
13334 if (!task)
13335 task = current;
13336@@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
13337 * current stack address. If the stacks consist of nested
13338 * exceptions
13339 */
13340- tinfo = task_thread_info(task);
13341 for (;;) {
13342 char *id;
13343 unsigned long *estack_end;
13344+
13345 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13346 &used, &id);
13347
13348@@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
13349 if (ops->stack(data, id) < 0)
13350 break;
13351
13352- bp = ops->walk_stack(tinfo, stack, bp, ops,
13353+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13354 data, estack_end, &graph);
13355 ops->stack(data, "<EOE>");
13356 /*
13357@@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
13358 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
13359 if (ops->stack(data, "IRQ") < 0)
13360 break;
13361- bp = ops->walk_stack(tinfo, stack, bp,
13362+ bp = ops->walk_stack(task, irq_stack, stack, bp,
13363 ops, data, irq_stack_end, &graph);
13364 /*
13365 * We link to the next stack (which would be
13366@@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
13367 /*
13368 * This handles the process stack:
13369 */
13370- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13371+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13372+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13373 put_cpu();
13374 }
13375 EXPORT_SYMBOL(dump_trace);
66a7e928
MT		 13376diff -urNp linux-2.6.39/arch/x86/kernel/dumpstack.c linux-2.6.39/arch/x86/kernel/dumpstack.c
13377--- linux-2.6.39/arch/x86/kernel/dumpstack.c 2011-05-19 00:06:34.000000000 -0400
13378+++ linux-2.6.39/arch/x86/kernel/dumpstack.c 2011-05-22 19:41:32.000000000 -0400
bc901d79
MT		 13379@@ -2,6 +2,9 @@
13380 * Copyright (C) 1991, 1992 Linus Torvalds
13381 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13382 */
13383+#ifdef CONFIG_GRKERNSEC_HIDESYM
13384+#define __INCLUDED_BY_HIDESYM 1
13385+#endif
13386 #include <linux/kallsyms.h>
13387 #include <linux/kprobes.h>
13388 #include <linux/uaccess.h>
71d190be
MT		 13389@@ -35,9 +38,8 @@ void printk_address(unsigned long addres
13390 static void
13391 print_ftrace_graph_addr(unsigned long addr, void *data,
13392 const struct stacktrace_ops *ops,
13393- struct thread_info *tinfo, int *graph)
13394+ struct task_struct *task, int *graph)
13395 {
13396- struct task_struct *task = tinfo->task;
13397 unsigned long ret_addr;
13398 int index = task->curr_ret_stack;
13399
13400@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
13401 static inline void
13402 print_ftrace_graph_addr(unsigned long addr, void *data,
13403 const struct stacktrace_ops *ops,
13404- struct thread_info *tinfo, int *graph)
13405+ struct task_struct *task, int *graph)
13406 { }
13407 #endif
13408
13409@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
13410 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13411 */
13412
13413-static inline int valid_stack_ptr(struct thread_info *tinfo,
13414- void *p, unsigned int size, void *end)
13415+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13416 {
13417- void *t = tinfo;
13418 if (end) {
13419 if (p < end && p >= (end-THREAD_SIZE))
13420 return 1;
13421@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
13422 }
13423
13424 unsigned long
13425-print_context_stack(struct thread_info *tinfo,
13426+print_context_stack(struct task_struct *task, void *stack_start,
13427 unsigned long *stack, unsigned long bp,
13428 const struct stacktrace_ops *ops, void *data,
13429 unsigned long *end, int *graph)
13430 {
13431 struct stack_frame *frame = (struct stack_frame *)bp;
13432
13433- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13434+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13435 unsigned long addr;
13436
13437 addr = *stack;
13438@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
13439 } else {
13440 ops->address(data, addr, 0);
13441 }
13442- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13443+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13444 }
13445 stack++;
13446 }
13447@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
13448 EXPORT_SYMBOL_GPL(print_context_stack);
13449
13450 unsigned long
13451-print_context_stack_bp(struct thread_info *tinfo,
13452+print_context_stack_bp(struct task_struct *task, void *stack_start,
13453 unsigned long *stack, unsigned long bp,
13454 const struct stacktrace_ops *ops, void *data,
13455 unsigned long *end, int *graph)
13456@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
13457 struct stack_frame *frame = (struct stack_frame *)bp;
13458 unsigned long *ret_addr = &frame->return_address;
13459
13460- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
13461+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
13462 unsigned long addr = *ret_addr;
13463
13464 if (!__kernel_text_address(addr))
13465@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
13466 ops->address(data, addr, 1);
13467 frame = frame->next_frame;
13468 ret_addr = &frame->return_address;
13469- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13470+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13471 }
13472
13473 return (unsigned long)frame;
66a7e928 13474@@ -202,7 +202,7 @@ void dump_stack(void)
57199397 13475
66a7e928 13476 bp = stack_frame(current, NULL);
57199397
MT		 13477 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13478- current->pid, current->comm, print_tainted(),
13479+ task_pid_nr(current), current->comm, print_tainted(),
13480 init_utsname()->release,
13481 (int)strcspn(init_utsname()->version, " "),
13482 init_utsname()->version);
66a7e928 13483@@ -238,6 +238,8 @@ unsigned __kprobes long oops_begin(void)
71d190be
MT		 13484 }
13485 EXPORT_SYMBOL_GPL(oops_begin);
13486
13487+extern void gr_handle_kernel_exploit(void);
13488+
13489 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13490 {
13491 if (regs && kexec_should_crash(current))
66a7e928 13492@@ -259,7 +261,10 @@ void __kprobes oops_end(unsigned long fl
57199397
MT		 13493 panic("Fatal exception in interrupt");
13494 if (panic_on_oops)
13495 panic("Fatal exception");
13496- do_exit(signr);
71d190be
MT		 13497+
13498+ gr_handle_kernel_exploit();
13499+
57199397
MT		 13500+ do_group_exit(signr);
13501 }
13502
13503 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
66a7e928 13504@@ -286,7 +291,7 @@ int __kprobes __die(const char *str, str
57199397
MT		 13505
13506 show_registers(regs);
13507 #ifdef CONFIG_X86_32
13508- if (user_mode_vm(regs)) {
13509+ if (user_mode(regs)) {
13510 sp = regs->sp;
13511 ss = regs->ss & 0xffff;
13512 } else {
66a7e928 13513@@ -314,7 +319,7 @@ void die(const char *str, struct pt_regs
57199397
MT		 13514 unsigned long flags = oops_begin();
13515 int sig = SIGSEGV;
13516
13517- if (!user_mode_vm(regs))
13518+ if (!user_mode(regs))
13519 report_bug(regs->ip, regs);
13520
13521 if (__die(str, regs, err))
66a7e928
MT		 13522diff -urNp linux-2.6.39/arch/x86/kernel/early_printk.c linux-2.6.39/arch/x86/kernel/early_printk.c
13523--- linux-2.6.39/arch/x86/kernel/early_printk.c 2011-05-19 00:06:34.000000000 -0400
13524+++ linux-2.6.39/arch/x86/kernel/early_printk.c 2011-05-22 19:36:30.000000000 -0400
13525@@ -7,6 +7,7 @@
13526 #include <linux/pci_regs.h>
13527 #include <linux/pci_ids.h>
13528 #include <linux/errno.h>
13529+#include <linux/sched.h>
13530 #include <asm/io.h>
13531 #include <asm/processor.h>
13532 #include <asm/fcntl.h>
13533@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
13534 int n;
13535 va_list ap;
13536
13537+ pax_track_stack();
13538+
13539 va_start(ap, fmt);
13540 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13541 early_console->write(early_console, buf, n);
13542diff -urNp linux-2.6.39/arch/x86/kernel/entry_32.S linux-2.6.39/arch/x86/kernel/entry_32.S
13543--- linux-2.6.39/arch/x86/kernel/entry_32.S 2011-05-19 00:06:34.000000000 -0400
13544+++ linux-2.6.39/arch/x86/kernel/entry_32.S 2011-05-23 17:07:00.000000000 -0400
13545@@ -185,13 +185,146 @@
bc901d79
MT		 13546 /*CFI_REL_OFFSET gs, PT_GS*/
13547 .endm
13548 .macro SET_KERNEL_GS reg
58c5fc13 13549+
bc901d79
MT		 13550+#ifdef CONFIG_CC_STACKPROTECTOR
13551 movl $(__KERNEL_STACK_CANARY), \reg
13552+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13553+ movl $(__USER_DS), \reg
13554+#else
13555+ xorl \reg, \reg
13556+#endif
13557+
13558 movl \reg, %gs
13559 .endm
58c5fc13
MT		 13560
13561 #endif /* CONFIG_X86_32_LAZY_GS */
13562
13563-.macro SAVE_ALL
8308f9c9 13564+.macro pax_enter_kernel
df50ba0c 13565+#ifdef CONFIG_PAX_KERNEXEC
8308f9c9 13566+ call pax_enter_kernel
df50ba0c 13567+#endif
8308f9c9
MT		 13568+.endm
13569+
13570+.macro pax_exit_kernel
13571+#ifdef CONFIG_PAX_KERNEXEC
13572+ call pax_exit_kernel
df50ba0c
MT		 13573+#endif
13574+.endm
13575+
df50ba0c 13576+#ifdef CONFIG_PAX_KERNEXEC
8308f9c9 13577+ENTRY(pax_enter_kernel)
df50ba0c 13578+#ifdef CONFIG_PARAVIRT
66a7e928
MT		 13579+ pushl %eax
13580+ pushl %ecx
df50ba0c
MT		 13581+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13582+ mov %eax, %esi
13583+#else
13584+ mov %cr0, %esi
13585+#endif
13586+ bts $16, %esi
13587+ jnc 1f
13588+ mov %cs, %esi
13589+ cmp $__KERNEL_CS, %esi
13590+ jz 3f
13591+ ljmp $__KERNEL_CS, $3f
13592+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13593+2:
13594+#ifdef CONFIG_PARAVIRT
13595+ mov %esi, %eax
13596+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13597+#else
13598+ mov %esi, %cr0
13599+#endif
13600+3:
13601+#ifdef CONFIG_PARAVIRT
66a7e928
MT		 13602+ popl %ecx
13603+ popl %eax
df50ba0c 13604+#endif
8308f9c9
MT		 13605+ ret
13606+ENDPROC(pax_enter_kernel)
13607+
13608+ENTRY(pax_exit_kernel)
13609+#ifdef CONFIG_PARAVIRT
66a7e928
MT		 13610+ pushl %eax
13611+ pushl %ecx
8308f9c9
MT		 13612+#endif
13613+ mov %cs, %esi
13614+ cmp $__KERNEXEC_KERNEL_CS, %esi
13615+ jnz 2f
13616+#ifdef CONFIG_PARAVIRT
13617+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13618+ mov %eax, %esi
13619+#else
13620+ mov %cr0, %esi
13621+#endif
13622+ btr $16, %esi
13623+ ljmp $__KERNEL_CS, $1f
13624+1:
13625+#ifdef CONFIG_PARAVIRT
13626+ mov %esi, %eax
13627+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13628+#else
13629+ mov %esi, %cr0
13630+#endif
13631+2:
13632+#ifdef CONFIG_PARAVIRT
66a7e928
MT		 13633+ popl %ecx
13634+ popl %eax
8308f9c9
MT		 13635+#endif
13636+ ret
13637+ENDPROC(pax_exit_kernel)
13638+#endif
13639+
13640+.macro pax_erase_kstack
13641+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13642+ call pax_erase_kstack
df50ba0c
MT		 13643+#endif
13644+.endm
13645+
8308f9c9 13646+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
66a7e928
MT		 13647+/*
13648+ * ebp: thread_info
13649+ * ecx, edx: can be clobbered
13650+ */
8308f9c9 13651+ENTRY(pax_erase_kstack)
66a7e928
MT		 13652+ pushl %edi
13653+ pushl %eax
8308f9c9 13654+
66a7e928 13655+ mov TI_lowest_stack(%ebp), %edi
8308f9c9
MT		 13656+ mov $-0xBEEF, %eax
13657+ std
66a7e928
MT		 13658+
13659+1: mov %edi, %ecx
8308f9c9
MT		 13660+ and $THREAD_SIZE_asm - 1, %ecx
13661+ shr $2, %ecx
13662+ repne scasl
13663+ jecxz 2f
66a7e928
MT		 13664+
13665+ cmp $2*16, %ecx
8308f9c9 13666+ jc 2f
66a7e928
MT		 13667+
13668+ mov $2*16, %ecx
8308f9c9
MT		 13669+ repe scasl
13670+ jecxz 2f
13671+ jne 1b
66a7e928
MT		 13672+
13673+2: cld
8308f9c9
MT		 13674+ mov %esp, %ecx
13675+ sub %edi, %ecx
13676+ shr $2, %ecx
13677+ rep stosl
13678+
66a7e928
MT		 13679+ mov TI_task_thread_sp0(%ebp), %edi
13680+ sub $128, %edi
13681+ mov %edi, TI_lowest_stack(%ebp)
13682+
13683+ popl %eax
13684+ popl %edi
8308f9c9
MT		 13685+ ret
13686+ENDPROC(pax_erase_kstack)
13687+#endif
13688+
58c5fc13
MT		 13689+.macro __SAVE_ALL _DS
13690 cld
13691 PUSH_GS
bc901d79 13692 pushl_cfi %fs
66a7e928 13693@@ -214,7 +347,7 @@
bc901d79
MT		 13694 CFI_REL_OFFSET ecx, 0
13695 pushl_cfi %ebx
58c5fc13
MT		 13696 CFI_REL_OFFSET ebx, 0
13697- movl $(__USER_DS), %edx
13698+ movl $\_DS, %edx
13699 movl %edx, %ds
13700 movl %edx, %es
13701 movl $(__KERNEL_PERCPU), %edx
66a7e928 13702@@ -222,6 +355,15 @@
58c5fc13
MT		 13703 SET_KERNEL_GS %edx
13704 .endm
13705
13706+.macro SAVE_ALL
ae4e228f 13707+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
58c5fc13 13708+ __SAVE_ALL __KERNEL_DS
8308f9c9 13709+ pax_enter_kernel
58c5fc13
MT		 13710+#else
13711+ __SAVE_ALL __USER_DS
13712+#endif
13713+.endm
13714+
13715 .macro RESTORE_INT_REGS
bc901d79
MT		 13716 popl_cfi %ebx
13717 CFI_RESTORE ebx
66a7e928 13718@@ -332,7 +474,15 @@ check_userspace:
58c5fc13
MT		 13719 movb PT_CS(%esp), %al
13720 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13721 cmpl $USER_RPL, %eax
13722+
13723+#ifdef CONFIG_PAX_KERNEXEC
13724+ jae resume_userspace
ae4e228f
MT		 13725+
13726+ PAX_EXIT_KERNEL
58c5fc13
MT		 13727+ jmp resume_kernel
13728+#else
13729 jb resume_kernel # not returning to v8086 or userspace
13730+#endif
13731
13732 ENTRY(resume_userspace)
13733 LOCKDEP_SYS_EXIT
66a7e928
MT		 13734@@ -344,7 +494,7 @@ ENTRY(resume_userspace)
13735 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13736 # int/exception return?
13737 jne work_pending
13738- jmp restore_all
13739+ jmp restore_all_pax
13740 END(ret_from_exception)
13741
13742 #ifdef CONFIG_PREEMPT
13743@@ -394,23 +544,34 @@ sysenter_past_esp:
58c5fc13
MT		 13744 /*CFI_REL_OFFSET cs, 0*/
13745 /*
13746 * Push current_thread_info()->sysenter_return to the stack.
13747- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13748- * pushed above; +8 corresponds to copy_thread's esp0 setting.
13749 */
66a7e928 13750- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
71d190be 13751+ pushl_cfi $0
58c5fc13
MT		 13752 CFI_REL_OFFSET eip, 0
13753
bc901d79 13754 pushl_cfi %eax
71d190be
MT		 13755 SAVE_ALL
13756+ GET_THREAD_INFO(%ebp)
13757+ movl TI_sysenter_return(%ebp),%ebp
13758+ movl %ebp,PT_EIP(%esp)
13759 ENABLE_INTERRUPTS(CLBR_NONE)
13760
13761 /*
58c5fc13
MT		 13762 * Load the potential sixth argument from user stack.
13763 * Careful about security.
13764 */
13765+ movl PT_OLDESP(%esp),%ebp
13766+
13767+#ifdef CONFIG_PAX_MEMORY_UDEREF
13768+ mov PT_OLDSS(%esp),%ds
13769+1: movl %ds:(%ebp),%ebp
13770+ push %ss
13771+ pop %ds
13772+#else
13773 cmpl $__PAGE_OFFSET-3,%ebp
13774 jae syscall_fault
13775 1: movl (%ebp),%ebp
13776+#endif
13777+
13778 movl %ebp,PT_EBP(%esp)
13779 .section __ex_table,"a"
13780 .align 4
66a7e928 13781@@ -433,12 +594,23 @@ sysenter_do_call:
58c5fc13
MT		 13782 testl $_TIF_ALLWORK_MASK, %ecx
13783 jne sysexit_audit
13784 sysenter_exit:
13785+
13786+#ifdef CONFIG_PAX_RANDKSTACK
8308f9c9 13787+ pushl_cfi %eax
58c5fc13 13788+ call pax_randomize_kstack
8308f9c9
MT		 13789+ popl_cfi %eax
13790+#endif
13791+
66a7e928 13792+ pax_erase_kstack
58c5fc13
MT		 13793+
13794 /* if something modifies registers it must also disable sysexit */
13795 movl PT_EIP(%esp), %edx
13796 movl PT_OLDESP(%esp), %ecx
13797 xorl %ebp,%ebp
13798 TRACE_IRQS_ON
13799 1: mov PT_FS(%esp), %fs
13800+2: mov PT_DS(%esp), %ds
13801+3: mov PT_ES(%esp), %es
13802 PTGS_TO_GS
13803 ENABLE_INTERRUPTS_SYSEXIT
13804
66a7e928
MT		 13805@@ -455,6 +627,9 @@ sysenter_audit:
13806 movl %eax,%edx /* 2nd arg: syscall number */
13807 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
13808 call audit_syscall_entry
13809+
13810+ pax_erase_kstack
13811+
13812 pushl_cfi %ebx
13813 movl PT_EAX(%esp),%eax /* reload syscall number */
13814 jmp sysenter_do_call
13815@@ -481,11 +656,17 @@ sysexit_audit:
58c5fc13
MT		 13816
13817 CFI_ENDPROC
13818 .pushsection .fixup,"ax"
13819-2: movl $0,PT_FS(%esp)
13820+4: movl $0,PT_FS(%esp)
13821+ jmp 1b
13822+5: movl $0,PT_DS(%esp)
13823+ jmp 1b
13824+6: movl $0,PT_ES(%esp)
13825 jmp 1b
13826 .section __ex_table,"a"
13827 .align 4
13828- .long 1b,2b
13829+ .long 1b,4b
13830+ .long 2b,5b
13831+ .long 3b,6b
13832 .popsection
13833 PTGS_TO_GS_EX
13834 ENDPROC(ia32_sysenter_target)
66a7e928 13835@@ -518,6 +699,14 @@ syscall_exit:
58c5fc13
MT		 13836 testl $_TIF_ALLWORK_MASK, %ecx # current->work
13837 jne syscall_exit_work
13838
66a7e928
MT		 13839+restore_all_pax:
13840+
58c5fc13
MT		 13841+#ifdef CONFIG_PAX_RANDKSTACK
13842+ call pax_randomize_kstack
13843+#endif
8308f9c9 13844+
8308f9c9 13845+ pax_erase_kstack
58c5fc13
MT		 13846+
13847 restore_all:
13848 TRACE_IRQS_IRET
13849 restore_all_notrace:
66a7e928 13850@@ -577,14 +766,21 @@ ldt_ss:
6892158b
MT		 13851 * compensating for the offset by changing to the ESPFIX segment with
13852 * a base address that matches for the difference.
13853 */
13854-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
13855+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
13856 mov %esp, %edx /* load kernel esp */
58c5fc13
MT		 13857 mov PT_OLDESP(%esp), %eax /* load userspace esp */
13858 mov %dx, %ax /* eax: new kernel esp */
13859 sub %eax, %edx /* offset (low word is 0) */
58c5fc13
MT		 13860+#ifdef CONFIG_SMP
13861+ movl PER_CPU_VAR(cpu_number), %ebx
13862+ shll $PAGE_SHIFT_asm, %ebx
13863+ addl $cpu_gdt_table, %ebx
13864+#else
13865+ movl $cpu_gdt_table, %ebx
13866+#endif
13867 shr $16, %edx
6892158b
MT		 13868- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
13869- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
13870+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13871+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
bc901d79
MT		 13872 pushl_cfi $__ESPFIX_SS
13873 pushl_cfi %eax /* new kernel esp */
13874 /* Disable interrupts, but do not irqtrace this section: we
66a7e928
MT		 13875@@ -613,29 +809,23 @@ work_resched:
13876 movl TI_flags(%ebp), %ecx
13877 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13878 # than syscall tracing?
13879- jz restore_all
13880+ jz restore_all_pax
13881 testb $_TIF_NEED_RESCHED, %cl
13882 jnz work_resched
58c5fc13
MT		 13883
13884 work_notifysig: # deal with pending signals and
13885 # notify-resume requests
13886+ movl %esp, %eax
13887 #ifdef CONFIG_VM86
13888 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13889- movl %esp, %eax
13890- jne work_notifysig_v86 # returning to kernel-space or
13891+ jz 1f # returning to kernel-space or
13892 # vm86-space
13893- xorl %edx, %edx
13894- call do_notify_resume
13895- jmp resume_userspace_sig
13896
13897- ALIGN
13898-work_notifysig_v86:
bc901d79 13899 pushl_cfi %ecx # save ti_flags for do_notify_resume
58c5fc13 13900 call save_v86_state # %eax contains pt_regs pointer
bc901d79 13901 popl_cfi %ecx
58c5fc13
MT		 13902 movl %eax, %esp
13903-#else
13904- movl %esp, %eax
13905+1:
13906 #endif
13907 xorl %edx, %edx
13908 call do_notify_resume
66a7e928
MT		 13909@@ -648,6 +838,9 @@ syscall_trace_entry:
13910 movl $-ENOSYS,PT_EAX(%esp)
13911 movl %esp, %eax
13912 call syscall_trace_enter
13913+
13914+ pax_erase_kstack
13915+
13916 /* What it returned is what we'll actually use. */
13917 cmpl $(nr_syscalls), %eax
13918 jnae syscall_call
13919@@ -670,6 +863,10 @@ END(syscall_exit_work)
58c5fc13
MT		 13920
13921 RING0_INT_FRAME # can't unwind into user space anyway
13922 syscall_fault:
13923+#ifdef CONFIG_PAX_MEMORY_UDEREF
13924+ push %ss
13925+ pop %ds
13926+#endif
13927 GET_THREAD_INFO(%ebp)
13928 movl $-EFAULT,PT_EAX(%esp)
13929 jmp resume_userspace
66a7e928 13930@@ -752,6 +949,36 @@ ptregs_clone:
bc901d79
MT		 13931 CFI_ENDPROC
13932 ENDPROC(ptregs_clone)
13933
13934+ ALIGN;
13935+ENTRY(kernel_execve)
13936+ CFI_STARTPROC
13937+ pushl_cfi %ebp
13938+ sub $PT_OLDSS+4,%esp
13939+ pushl_cfi %edi
13940+ pushl_cfi %ecx
13941+ pushl_cfi %eax
13942+ lea 3*4(%esp),%edi
13943+ mov $PT_OLDSS/4+1,%ecx
13944+ xorl %eax,%eax
13945+ rep stosl
13946+ popl_cfi %eax
13947+ popl_cfi %ecx
13948+ popl_cfi %edi
13949+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13950+ pushl_cfi %esp
13951+ call sys_execve
13952+ add $4,%esp
13953+ CFI_ADJUST_CFA_OFFSET -4
13954+ GET_THREAD_INFO(%ebp)
13955+ test %eax,%eax
13956+ jz syscall_exit
13957+ add $PT_OLDSS+4,%esp
13958+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13959+ popl_cfi %ebp
13960+ ret
13961+ CFI_ENDPROC
13962+ENDPROC(kernel_execve)
13963+
13964 .macro FIXUP_ESPFIX_STACK
13965 /*
13966 * Switch back for ESPFIX stack to the normal zerobased stack
66a7e928 13967@@ -761,8 +988,15 @@ ENDPROC(ptregs_clone)
58c5fc13
MT		 13968 * normal stack and adjusts ESP with the matching offset.
13969 */
13970 /* fixup the stack */
6892158b
MT		 13971- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13972- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
58c5fc13
MT		 13973+#ifdef CONFIG_SMP
13974+ movl PER_CPU_VAR(cpu_number), %ebx
13975+ shll $PAGE_SHIFT_asm, %ebx
13976+ addl $cpu_gdt_table, %ebx
13977+#else
13978+ movl $cpu_gdt_table, %ebx
13979+#endif
6892158b
MT		 13980+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
13981+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
58c5fc13 13982 shl $16, %eax
6892158b 13983 addl %esp, %eax /* the adjusted stack pointer */
bc901d79 13984 pushl_cfi $__KERNEL_DS
66a7e928 13985@@ -1213,7 +1447,6 @@ return_to_handler:
ae4e228f 13986 jmp *%ecx
58c5fc13
MT		 13987 #endif
13988
13989-.section .rodata,"a"
13990 #include "syscall_table_32.S"
13991
13992 syscall_table_size=(.-sys_call_table)
66a7e928 13993@@ -1259,9 +1492,12 @@ error_code:
58c5fc13
MT		 13994 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13995 REG_TO_PTGS %ecx
13996 SET_KERNEL_GS %ecx
13997- movl $(__USER_DS), %ecx
13998+ movl $(__KERNEL_DS), %ecx
13999 movl %ecx, %ds
14000 movl %ecx, %es
df50ba0c 14001+
8308f9c9 14002+ pax_enter_kernel
df50ba0c 14003+
58c5fc13 14004 TRACE_IRQS_OFF
df50ba0c
MT		 14005 movl %esp,%eax # pt_regs pointer
14006 call *%edi
66a7e928 14007@@ -1346,6 +1582,9 @@ nmi_stack_correct:
58c5fc13
MT		 14008 xorl %edx,%edx # zero error code
14009 movl %esp,%eax # pt_regs pointer
14010 call do_nmi
14011+
8308f9c9 14012+ pax_exit_kernel
58c5fc13
MT		 14013+
14014 jmp restore_all_notrace
14015 CFI_ENDPROC
14016
66a7e928 14017@@ -1382,6 +1621,9 @@ nmi_espfix_stack:
58c5fc13
MT		 14018 FIXUP_ESPFIX_STACK # %eax == %esp
14019 xorl %edx,%edx # zero error code
14020 call do_nmi
14021+
8308f9c9 14022+ pax_exit_kernel
58c5fc13
MT		 14023+
14024 RESTORE_REGS
14025 lss 12+4(%esp), %esp # back to espfix stack
14026 CFI_ADJUST_CFA_OFFSET -24
66a7e928
MT		 14027diff -urNp linux-2.6.39/arch/x86/kernel/entry_64.S linux-2.6.39/arch/x86/kernel/entry_64.S
14028--- linux-2.6.39/arch/x86/kernel/entry_64.S 2011-05-19 00:06:34.000000000 -0400
14029+++ linux-2.6.39/arch/x86/kernel/entry_64.S 2011-05-23 17:10:49.000000000 -0400
ae4e228f
MT		 14030@@ -53,6 +53,7 @@
14031 #include <asm/paravirt.h>
14032 #include <asm/ftrace.h>
14033 #include <asm/percpu.h>
14034+#include <asm/pgtable.h>
14035
14036 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14037 #include <linux/elf-em.h>
66a7e928 14038@@ -176,6 +177,259 @@ ENTRY(native_usergs_sysret64)
df50ba0c
MT		 14039 ENDPROC(native_usergs_sysret64)
14040 #endif /* CONFIG_PARAVIRT */
14041
14042+ .macro ljmpq sel, off
8308f9c9 14043+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
df50ba0c
MT		 14044+ .byte 0x48; ljmp *1234f(%rip)
14045+ .pushsection .rodata
14046+ .align 16
14047+ 1234: .quad \off; .word \sel
14048+ .popsection
14049+#else
66a7e928
MT		 14050+ pushq $\sel
14051+ pushq $\off
df50ba0c
MT		 14052+ lretq
14053+#endif
14054+ .endm
14055+
317566c1
MT		 14056+ .macro pax_enter_kernel
14057+#ifdef CONFIG_PAX_KERNEXEC
14058+ call pax_enter_kernel
14059+#endif
14060+ .endm
14061+
14062+ .macro pax_exit_kernel
14063+#ifdef CONFIG_PAX_KERNEXEC
14064+ call pax_exit_kernel
14065+#endif
14066+ .endm
df50ba0c
MT		 14067+
14068+#ifdef CONFIG_PAX_KERNEXEC
317566c1 14069+ENTRY(pax_enter_kernel)
66a7e928 14070+ pushq %rdi
df50ba0c
MT		 14071+
14072+#ifdef CONFIG_PARAVIRT
14073+ PV_SAVE_REGS(CLBR_RDI)
14074+#endif
14075+
14076+ GET_CR0_INTO_RDI
14077+ bts $16,%rdi
14078+ jnc 1f
14079+ mov %cs,%edi
14080+ cmp $__KERNEL_CS,%edi
14081+ jz 3f
14082+ ljmpq __KERNEL_CS,3f
14083+1: ljmpq __KERNEXEC_KERNEL_CS,2f
14084+2: SET_RDI_INTO_CR0
14085+3:
14086+
14087+#ifdef CONFIG_PARAVIRT
14088+ PV_RESTORE_REGS(CLBR_RDI)
14089+#endif
14090+
66a7e928 14091+ popq %rdi
df50ba0c
MT		 14092+ retq
14093+ENDPROC(pax_enter_kernel)
14094+
14095+ENTRY(pax_exit_kernel)
66a7e928 14096+ pushq %rdi
df50ba0c
MT		 14097+
14098+#ifdef CONFIG_PARAVIRT
14099+ PV_SAVE_REGS(CLBR_RDI)
14100+#endif
14101+
14102+ mov %cs,%rdi
14103+ cmp $__KERNEXEC_KERNEL_CS,%edi
14104+ jnz 2f
14105+ GET_CR0_INTO_RDI
14106+ btr $16,%rdi
14107+ ljmpq __KERNEL_CS,1f
14108+1: SET_RDI_INTO_CR0
14109+2:
14110+
14111+#ifdef CONFIG_PARAVIRT
14112+ PV_RESTORE_REGS(CLBR_RDI);
14113+#endif
14114+
66a7e928 14115+ popq %rdi
df50ba0c
MT		 14116+ retq
14117+ENDPROC(pax_exit_kernel)
317566c1 14118+#endif
df50ba0c 14119+
317566c1
MT		 14120+ .macro pax_enter_kernel_user
14121+#ifdef CONFIG_PAX_MEMORY_UDEREF
14122+ call pax_enter_kernel_user
14123+#endif
14124+ .endm
df50ba0c 14125+
317566c1 14126+ .macro pax_exit_kernel_user
df50ba0c 14127+#ifdef CONFIG_PAX_MEMORY_UDEREF
317566c1
MT		 14128+ call pax_exit_kernel_user
14129+#endif
71d190be
MT		 14130+#ifdef CONFIG_PAX_RANDKSTACK
14131+ push %rax
14132+ call pax_randomize_kstack
14133+ pop %rax
14134+#endif
8308f9c9 14135+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8308f9c9 14136+ call pax_erase_kstack
8308f9c9 14137+#endif
317566c1
MT		 14138+ .endm
14139+
14140+#ifdef CONFIG_PAX_MEMORY_UDEREF
14141+ENTRY(pax_enter_kernel_user)
66a7e928
MT		 14142+ pushq %rdi
14143+ pushq %rbx
df50ba0c
MT		 14144+
14145+#ifdef CONFIG_PARAVIRT
14146+ PV_SAVE_REGS(CLBR_RDI)
14147+#endif
14148+
14149+ GET_CR3_INTO_RDI
14150+ mov %rdi,%rbx
14151+ add $__START_KERNEL_map,%rbx
14152+ sub phys_base(%rip),%rbx
14153+
14154+#ifdef CONFIG_PARAVIRT
66a7e928 14155+ pushq %rdi
df50ba0c
MT		 14156+ cmpl $0, pv_info+PARAVIRT_enabled
14157+ jz 1f
14158+ i = 0
14159+ .rept USER_PGD_PTRS
14160+ mov i*8(%rbx),%rsi
14161+ mov $0,%sil
14162+ lea i*8(%rbx),%rdi
14163+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14164+ i = i + 1
14165+ .endr
14166+ jmp 2f
14167+1:
14168+#endif
14169+
14170+ i = 0
14171+ .rept USER_PGD_PTRS
14172+ movb $0,i*8(%rbx)
14173+ i = i + 1
14174+ .endr
14175+
14176+#ifdef CONFIG_PARAVIRT
66a7e928 14177+2: popq %rdi
df50ba0c
MT		 14178+#endif
14179+ SET_RDI_INTO_CR3
14180+
14181+#ifdef CONFIG_PAX_KERNEXEC
14182+ GET_CR0_INTO_RDI
14183+ bts $16,%rdi
14184+ SET_RDI_INTO_CR0
14185+#endif
14186+
14187+#ifdef CONFIG_PARAVIRT
14188+ PV_RESTORE_REGS(CLBR_RDI)
14189+#endif
14190+
66a7e928
MT		 14191+ popq %rbx
14192+ popq %rdi
df50ba0c
MT		 14193+ retq
14194+ENDPROC(pax_enter_kernel_user)
14195+
14196+ENTRY(pax_exit_kernel_user)
df50ba0c
MT		 14197+ push %rdi
14198+
14199+#ifdef CONFIG_PARAVIRT
66a7e928 14200+ pushq %rbx
df50ba0c
MT		 14201+ PV_SAVE_REGS(CLBR_RDI)
14202+#endif
14203+
14204+#ifdef CONFIG_PAX_KERNEXEC
14205+ GET_CR0_INTO_RDI
14206+ btr $16,%rdi
14207+ SET_RDI_INTO_CR0
14208+#endif
14209+
14210+ GET_CR3_INTO_RDI
14211+ add $__START_KERNEL_map,%rdi
14212+ sub phys_base(%rip),%rdi
14213+
14214+#ifdef CONFIG_PARAVIRT
14215+ cmpl $0, pv_info+PARAVIRT_enabled
14216+ jz 1f
14217+ mov %rdi,%rbx
14218+ i = 0
14219+ .rept USER_PGD_PTRS
14220+ mov i*8(%rbx),%rsi
14221+ mov $0x67,%sil
14222+ lea i*8(%rbx),%rdi
14223+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14224+ i = i + 1
14225+ .endr
14226+ jmp 2f
14227+1:
14228+#endif
14229+
14230+ i = 0
14231+ .rept USER_PGD_PTRS
14232+ movb $0x67,i*8(%rdi)
14233+ i = i + 1
14234+ .endr
14235+
14236+#ifdef CONFIG_PARAVIRT
14237+2: PV_RESTORE_REGS(CLBR_RDI)
66a7e928 14238+ popq %rbx
df50ba0c
MT		 14239+#endif
14240+
66a7e928 14241+ popq %rdi
df50ba0c
MT		 14242+ retq
14243+ENDPROC(pax_exit_kernel_user)
66a7e928
MT		 14244+#endif
14245+
14246+ .macro pax_erase_kstack
14247+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14248+ call pax_erase_kstack
14249+#endif
14250+ .endm
14251+
14252+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14253+/*
14254+ * r10: thread_info
14255+ * rcx, rdx: can be clobbered
14256+ */
14257+ENTRY(pax_erase_kstack)
14258+ pushq %rdi
14259+ pushq %rax
14260+
14261+ GET_THREAD_INFO(%r10)
14262+ mov TI_lowest_stack(%r10), %rdi
14263+ mov $-0xBEEF, %rax
14264+ std
14265+
14266+1: mov %edi, %ecx
14267+ and $THREAD_SIZE_asm - 1, %ecx
14268+ shr $3, %ecx
14269+ repne scasq
14270+ jecxz 2f
14271+
14272+ cmp $2*8, %ecx
14273+ jc 2f
14274+
14275+ mov $2*8, %ecx
14276+ repe scasq
14277+ jecxz 2f
14278+ jne 1b
14279+
14280+2: cld
14281+ mov %esp, %ecx
14282+ sub %edi, %ecx
14283+ shr $3, %ecx
14284+ rep stosq
14285+
14286+ mov TI_task_thread_sp0(%r10), %rdi
14287+ sub $256, %rdi
14288+ mov %rdi, TI_lowest_stack(%r10)
14289+
14290+ popq %rax
14291+ popq %rdi
14292+ ret
14293+ENDPROC(pax_erase_kstack)
317566c1 14294+#endif
df50ba0c
MT		 14295
14296 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14297 #ifdef CONFIG_TRACE_IRQFLAGS
66a7e928 14298@@ -318,7 +572,7 @@ ENTRY(save_args)
16454cff 14299 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
df50ba0c
MT		 14300 movq_cfi rbp, 8 /* push %rbp */
14301 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14302- testl $3, CS(%rdi)
14303+ testb $3, CS(%rdi)
14304 je 1f
14305 SWAPGS
14306 /*
66a7e928 14307@@ -409,7 +663,7 @@ ENTRY(ret_from_fork)
df50ba0c
MT		 14308
14309 RESTORE_REST
14310
14311- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14312+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14313 je int_ret_from_sys_call
14314
14315 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
66a7e928 14316@@ -455,7 +709,7 @@ END(ret_from_fork)
71d190be
MT		 14317 ENTRY(system_call)
14318 CFI_STARTPROC simple
14319 CFI_SIGNAL_FRAME
14320- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14321+ CFI_DEF_CFA rsp,0
14322 CFI_REGISTER rip,rcx
14323 /*CFI_REGISTER rflags,r11*/
14324 SWAPGS_UNSAFE_STACK
66a7e928 14325@@ -468,12 +722,13 @@ ENTRY(system_call_after_swapgs)
df50ba0c
MT		 14326
14327 movq %rsp,PER_CPU_VAR(old_rsp)
14328 movq PER_CPU_VAR(kernel_stack),%rsp
317566c1 14329+ pax_enter_kernel_user
df50ba0c
MT		 14330 /*
14331 * No need to follow this irqs off/on section - it's straight
14332 * and short:
71d190be
MT		 14333 */
14334 ENABLE_INTERRUPTS(CLBR_NONE)
14335- SAVE_ARGS 8,1
14336+ SAVE_ARGS 8*6,1
14337 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14338 movq %rcx,RIP-ARGOFFSET(%rsp)
14339 CFI_REL_OFFSET rip,RIP-ARGOFFSET
66a7e928 14340@@ -502,6 +757,7 @@ sysret_check:
df50ba0c
MT		 14341 andl %edi,%edx
14342 jnz sysret_careful
14343 CFI_REMEMBER_STATE
317566c1 14344+ pax_exit_kernel_user
df50ba0c
MT		 14345 /*
14346 * sysretq will re-enable interrupts:
14347 */
66a7e928
MT		 14348@@ -560,6 +816,9 @@ auditsys:
14349 movq %rax,%rsi /* 2nd arg: syscall number */
14350 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14351 call audit_syscall_entry
14352+
14353+ pax_erase_kstack
14354+
14355 LOAD_ARGS 0 /* reload call-clobbered registers */
14356 jmp system_call_fastpath
14357
14358@@ -590,6 +849,9 @@ tracesys:
14359 FIXUP_TOP_OF_STACK %rdi
14360 movq %rsp,%rdi
14361 call syscall_trace_enter
14362+
14363+ pax_erase_kstack
14364+
14365 /*
14366 * Reload arg registers from stack in case ptrace changed them.
14367 * We don't reload %rax because syscall_trace_enter() returned
14368@@ -611,7 +873,7 @@ tracesys:
df50ba0c
MT		 14369 GLOBAL(int_ret_from_sys_call)
14370 DISABLE_INTERRUPTS(CLBR_NONE)
14371 TRACE_IRQS_OFF
14372- testl $3,CS-ARGOFFSET(%rsp)
14373+ testb $3,CS-ARGOFFSET(%rsp)
14374 je retint_restore_args
14375 movl $_TIF_ALLWORK_MASK,%edi
14376 /* edi: mask to check */
66a7e928 14377@@ -793,6 +1055,16 @@ END(interrupt)
16454cff 14378 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
ae4e228f
MT		 14379 call save_args
14380 PARTIAL_FRAME 0
df50ba0c
MT		 14381+#ifdef CONFIG_PAX_MEMORY_UDEREF
14382+ testb $3, CS(%rdi)
14383+ jnz 1f
317566c1 14384+ pax_enter_kernel
df50ba0c 14385+ jmp 2f
317566c1 14386+1: pax_enter_kernel_user
df50ba0c
MT		 14387+2:
14388+#else
317566c1 14389+ pax_enter_kernel
df50ba0c 14390+#endif
ae4e228f
MT		 14391 call \func
14392 .endm
14393
66a7e928 14394@@ -825,7 +1097,7 @@ ret_from_intr:
ae4e228f
MT		 14395 CFI_ADJUST_CFA_OFFSET -8
14396 exit_intr:
ae4e228f 14397 GET_THREAD_INFO(%rcx)
df50ba0c
MT		 14398- testl $3,CS-ARGOFFSET(%rsp)
14399+ testb $3,CS-ARGOFFSET(%rsp)
ae4e228f 14400 je retint_kernel
df50ba0c
MT		 14401
14402 /* Interrupt came from user space */
66a7e928 14403@@ -847,12 +1119,14 @@ retint_swapgs: /* return to user-space
df50ba0c
MT		 14404 * The iretq could re-enable interrupts:
14405 */
14406 DISABLE_INTERRUPTS(CLBR_ANY)
317566c1 14407+ pax_exit_kernel_user
df50ba0c
MT		 14408 TRACE_IRQS_IRETQ
14409 SWAPGS
14410 jmp restore_args
14411
14412 retint_restore_args: /* return to kernel space */
14413 DISABLE_INTERRUPTS(CLBR_ANY)
317566c1 14414+ pax_exit_kernel
df50ba0c
MT		 14415 /*
14416 * The iretq could re-enable interrupts:
14417 */
66a7e928 14418@@ -1027,6 +1301,16 @@ ENTRY(\sym)
bc901d79 14419 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
ae4e228f
MT		 14420 call error_entry
14421 DEFAULT_FRAME 0
df50ba0c
MT		 14422+#ifdef CONFIG_PAX_MEMORY_UDEREF
14423+ testb $3, CS(%rsp)
14424+ jnz 1f
317566c1 14425+ pax_enter_kernel
df50ba0c 14426+ jmp 2f
317566c1 14427+1: pax_enter_kernel_user
df50ba0c
MT		 14428+2:
14429+#else
317566c1 14430+ pax_enter_kernel
df50ba0c 14431+#endif
ae4e228f
MT		 14432 movq %rsp,%rdi /* pt_regs pointer */
14433 xorl %esi,%esi /* no error code */
14434 call \do_sym
66a7e928 14435@@ -1044,6 +1328,16 @@ ENTRY(\sym)
bc901d79 14436 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
ae4e228f
MT		 14437 call save_paranoid
14438 TRACE_IRQS_OFF
df50ba0c
MT		 14439+#ifdef CONFIG_PAX_MEMORY_UDEREF
14440+ testb $3, CS(%rsp)
14441+ jnz 1f
317566c1 14442+ pax_enter_kernel
df50ba0c 14443+ jmp 2f
317566c1 14444+1: pax_enter_kernel_user
df50ba0c
MT		 14445+2:
14446+#else
317566c1 14447+ pax_enter_kernel
df50ba0c 14448+#endif
ae4e228f
MT		 14449 movq %rsp,%rdi /* pt_regs pointer */
14450 xorl %esi,%esi /* no error code */
14451 call \do_sym
66a7e928 14452@@ -1052,7 +1346,7 @@ ENTRY(\sym)
6892158b
MT		 14453 END(\sym)
14454 .endm
14455
14456-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14457+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14458 .macro paranoidzeroentry_ist sym do_sym ist
14459 ENTRY(\sym)
14460 INTR_FRAME
66a7e928 14461@@ -1062,8 +1356,24 @@ ENTRY(\sym)
bc901d79 14462 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
ae4e228f 14463 call save_paranoid
58c5fc13 14464 TRACE_IRQS_OFF
df50ba0c
MT		 14465+#ifdef CONFIG_PAX_MEMORY_UDEREF
14466+ testb $3, CS(%rsp)
14467+ jnz 1f
317566c1 14468+ pax_enter_kernel
df50ba0c 14469+ jmp 2f
317566c1 14470+1: pax_enter_kernel_user
df50ba0c
MT		 14471+2:
14472+#else
317566c1 14473+ pax_enter_kernel
df50ba0c 14474+#endif
58c5fc13
MT		 14475 movq %rsp,%rdi /* pt_regs pointer */
14476 xorl %esi,%esi /* no error code */
58c5fc13 14477+#ifdef CONFIG_SMP
ae4e228f
MT		 14478+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14479+ lea init_tss(%r12), %r12
58c5fc13 14480+#else
ae4e228f 14481+ lea init_tss(%rip), %r12
58c5fc13 14482+#endif
6892158b 14483 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
58c5fc13 14484 call \do_sym
6892158b 14485 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
66a7e928 14486@@ -1080,6 +1390,16 @@ ENTRY(\sym)
bc901d79 14487 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
ae4e228f
MT		 14488 call error_entry
14489 DEFAULT_FRAME 0
df50ba0c
MT		 14490+#ifdef CONFIG_PAX_MEMORY_UDEREF
14491+ testb $3, CS(%rsp)
14492+ jnz 1f
317566c1 14493+ pax_enter_kernel
df50ba0c 14494+ jmp 2f
317566c1 14495+1: pax_enter_kernel_user
df50ba0c
MT		 14496+2:
14497+#else
317566c1 14498+ pax_enter_kernel
df50ba0c 14499+#endif
ae4e228f
MT		 14500 movq %rsp,%rdi /* pt_regs pointer */
14501 movq ORIG_RAX(%rsp),%rsi /* get error code */
14502 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
66a7e928 14503@@ -1099,6 +1419,16 @@ ENTRY(\sym)
ae4e228f
MT		 14504 call save_paranoid
14505 DEFAULT_FRAME 0
14506 TRACE_IRQS_OFF
df50ba0c
MT		 14507+#ifdef CONFIG_PAX_MEMORY_UDEREF
14508+ testb $3, CS(%rsp)
14509+ jnz 1f
317566c1 14510+ pax_enter_kernel
df50ba0c 14511+ jmp 2f
317566c1 14512+1: pax_enter_kernel_user
df50ba0c
MT		 14513+2:
14514+#else
317566c1 14515+ pax_enter_kernel
df50ba0c 14516+#endif
ae4e228f
MT		 14517 movq %rsp,%rdi /* pt_regs pointer */
14518 movq ORIG_RAX(%rsp),%rsi /* get error code */
14519 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
66a7e928 14520@@ -1361,14 +1691,27 @@ ENTRY(paranoid_exit)
df50ba0c
MT		 14521 TRACE_IRQS_OFF
14522 testl %ebx,%ebx /* swapgs needed? */
14523 jnz paranoid_restore
14524- testl $3,CS(%rsp)
14525+ testb $3,CS(%rsp)
ae4e228f 14526 jnz paranoid_userspace
df50ba0c 14527+#ifdef CONFIG_PAX_MEMORY_UDEREF
317566c1 14528+ pax_exit_kernel
df50ba0c
MT		 14529+ TRACE_IRQS_IRETQ 0
14530+ SWAPGS_UNSAFE_STACK
14531+ RESTORE_ALL 8
14532+ jmp irq_return
14533+#endif
ae4e228f 14534 paranoid_swapgs:
df50ba0c 14535+#ifdef CONFIG_PAX_MEMORY_UDEREF
317566c1 14536+ pax_exit_kernel_user
df50ba0c 14537+#else
317566c1 14538+ pax_exit_kernel
df50ba0c 14539+#endif
ae4e228f
MT		 14540 TRACE_IRQS_IRETQ 0
14541 SWAPGS_UNSAFE_STACK
14542 RESTORE_ALL 8
14543 jmp irq_return
14544 paranoid_restore:
317566c1 14545+ pax_exit_kernel
ae4e228f
MT		 14546 TRACE_IRQS_IRETQ 0
14547 RESTORE_ALL 8
14548 jmp irq_return
66a7e928 14549@@ -1426,7 +1769,7 @@ ENTRY(error_entry)
df50ba0c
MT		 14550 movq_cfi r14, R14+8
14551 movq_cfi r15, R15+8
14552 xorl %ebx,%ebx
14553- testl $3,CS+8(%rsp)
14554+ testb $3,CS+8(%rsp)
14555 je error_kernelspace
14556 error_swapgs:
14557 SWAPGS
66a7e928 14558@@ -1490,6 +1833,16 @@ ENTRY(nmi)
bc901d79 14559 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
ae4e228f
MT		 14560 call save_paranoid
14561 DEFAULT_FRAME 0
df50ba0c
MT		 14562+#ifdef CONFIG_PAX_MEMORY_UDEREF
14563+ testb $3, CS(%rsp)
14564+ jnz 1f
317566c1 14565+ pax_enter_kernel
df50ba0c 14566+ jmp 2f
317566c1 14567+1: pax_enter_kernel_user
df50ba0c
MT		 14568+2:
14569+#else
317566c1 14570+ pax_enter_kernel
df50ba0c 14571+#endif
ae4e228f
MT		 14572 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14573 movq %rsp,%rdi
14574 movq $-1,%rsi
66a7e928 14575@@ -1500,11 +1853,25 @@ ENTRY(nmi)
df50ba0c
MT		 14576 DISABLE_INTERRUPTS(CLBR_NONE)
14577 testl %ebx,%ebx /* swapgs needed? */
14578 jnz nmi_restore
14579- testl $3,CS(%rsp)
14580+ testb $3,CS(%rsp)
14581 jnz nmi_userspace
317566c1
MT		 14582+#ifdef CONFIG_PAX_MEMORY_UDEREF
14583+ pax_exit_kernel
14584+ SWAPGS_UNSAFE_STACK
14585+ RESTORE_ALL 8
14586+ jmp irq_return
14587+#endif
ae4e228f 14588 nmi_swapgs:
317566c1
MT		 14589+#ifdef CONFIG_PAX_MEMORY_UDEREF
14590+ pax_exit_kernel_user
14591+#else
14592+ pax_exit_kernel
14593+#endif
ae4e228f 14594 SWAPGS_UNSAFE_STACK
317566c1
MT		 14595+ RESTORE_ALL 8
14596+ jmp irq_return
ae4e228f 14597 nmi_restore:
317566c1 14598+ pax_exit_kernel
ae4e228f
MT		 14599 RESTORE_ALL 8
14600 jmp irq_return
14601 nmi_userspace:
66a7e928
MT		 14602diff -urNp linux-2.6.39/arch/x86/kernel/ftrace.c linux-2.6.39/arch/x86/kernel/ftrace.c
14603--- linux-2.6.39/arch/x86/kernel/ftrace.c 2011-05-19 00:06:34.000000000 -0400
14604+++ linux-2.6.39/arch/x86/kernel/ftrace.c 2011-05-22 19:36:30.000000000 -0400
8308f9c9
MT		 14605@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
14606 static void *mod_code_newcode; /* holds the text to write to the IP */
14607
14608 static unsigned nmi_wait_count;
14609-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14610+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14611
14612 int ftrace_arch_read_dyn_info(char *buf, int size)
14613 {
14614@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14615
14616 r = snprintf(buf, size, "%u %u",
14617 nmi_wait_count,
14618- atomic_read(&nmi_update_count));
14619+ atomic_read_unchecked(&nmi_update_count));
14620 return r;
14621 }
14622
14623@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
df50ba0c 14624
ae4e228f
MT		 14625 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14626 smp_rmb();
14627+ pax_open_kernel();
14628 ftrace_mod_code();
8308f9c9 14629- atomic_inc(&nmi_update_count);
ae4e228f 14630+ pax_close_kernel();
8308f9c9 14631+ atomic_inc_unchecked(&nmi_update_count);
ae4e228f
MT		 14632 }
14633 /* Must have previous changes seen before executions */
8308f9c9 14634 smp_mb();
16454cff 14635@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
ae4e228f
MT		 14636 {
14637 unsigned char replaced[MCOUNT_INSN_SIZE];
14638
14639+ ip = ktla_ktva(ip);
14640+
14641 /*
14642 * Note: Due to modules and __init, code can
14643 * disappear and change, we need to protect against faulting
16454cff 14644@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
58c5fc13
MT		 14645 unsigned char old[MCOUNT_INSN_SIZE], *new;
14646 int ret;
14647
14648- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14649+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14650 new = ftrace_call_replace(ip, (unsigned long)func);
ae4e228f
MT		 14651 ret = ftrace_modify_code(ip, old, new);
14652
16454cff 14653@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
ae4e228f
MT		 14654 {
14655 unsigned char code[MCOUNT_INSN_SIZE];
14656
14657+ ip = ktla_ktva(ip);
14658+
14659 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14660 return -EFAULT;
14661
66a7e928
MT		 14662diff -urNp linux-2.6.39/arch/x86/kernel/head32.c linux-2.6.39/arch/x86/kernel/head32.c
14663--- linux-2.6.39/arch/x86/kernel/head32.c 2011-05-19 00:06:34.000000000 -0400
14664+++ linux-2.6.39/arch/x86/kernel/head32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 14665@@ -19,6 +19,7 @@
ae4e228f 14666 #include <asm/io_apic.h>
58c5fc13 14667 #include <asm/bios_ebda.h>
bc901d79 14668 #include <asm/tlbflush.h>
58c5fc13
MT		 14669+#include <asm/boot.h>
14670
ae4e228f 14671 static void __init i386_default_early_setup(void)
58c5fc13 14672 {
66a7e928
MT		 14673@@ -34,7 +35,7 @@ void __init i386_start_kernel(void)
14674 {
14675 memblock_init();
58c5fc13 14676
bc901d79
MT		 14677- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14678+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
58c5fc13
MT		 14679
14680 #ifdef CONFIG_BLK_DEV_INITRD
14681 /* Reserve INITRD */
66a7e928
MT		 14682diff -urNp linux-2.6.39/arch/x86/kernel/head_32.S linux-2.6.39/arch/x86/kernel/head_32.S
14683--- linux-2.6.39/arch/x86/kernel/head_32.S 2011-05-19 00:06:34.000000000 -0400
14684+++ linux-2.6.39/arch/x86/kernel/head_32.S 2011-05-22 19:36:30.000000000 -0400
df50ba0c 14685@@ -25,6 +25,12 @@
58c5fc13
MT		 14686 /* Physical address */
14687 #define pa(X) ((X) - __PAGE_OFFSET)
ae4e228f
MT		 14688
14689+#ifdef CONFIG_PAX_KERNEXEC
14690+#define ta(X) (X)
14691+#else
14692+#define ta(X) ((X) - __PAGE_OFFSET)
14693+#endif
14694+
14695 /*
14696 * References to members of the new_cpu_data structure.
14697 */
df50ba0c 14698@@ -54,11 +60,7 @@
58c5fc13
MT		 14699 * and small than max_low_pfn, otherwise will waste some page table entries
14700 */
14701
14702-#if PTRS_PER_PMD > 1
14703-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14704-#else
14705-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14706-#endif
14707+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14708
bc901d79
MT		 14709 /* Number of possible pages in the lowmem region */
14710 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14711@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
58c5fc13
MT		 14712 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14713
14714 /*
14715+ * Real beginning of normal "text" segment
14716+ */
14717+ENTRY(stext)
14718+ENTRY(_stext)
14719+
14720+/*
14721 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14722 * %esi points to the real-mode code as a 32-bit pointer.
14723 * CS and DS must be 4 GB flat segments, but we don't depend on
bc901d79 14724@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
58c5fc13
MT		 14725 * can.
14726 */
ae4e228f 14727 __HEAD
58c5fc13
MT		 14728+
14729+#ifdef CONFIG_PAX_KERNEXEC
14730+ jmp startup_32
14731+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14732+.fill PAGE_SIZE-5,1,0xcc
14733+#endif
14734+
14735 ENTRY(startup_32)
16454cff
MT		 14736 movl pa(stack_start),%ecx
14737
14738@@ -105,6 +120,57 @@ ENTRY(startup_32)
58c5fc13 14739 2:
16454cff 14740 leal -__PAGE_OFFSET(%ecx),%esp
58c5fc13
MT		 14741
14742+#ifdef CONFIG_SMP
14743+ movl $pa(cpu_gdt_table),%edi
14744+ movl $__per_cpu_load,%eax
14745+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14746+ rorl $16,%eax
14747+ movb %al,__KERNEL_PERCPU + 4(%edi)
14748+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14749+ movl $__per_cpu_end - 1,%eax
ae4e228f 14750+ subl $__per_cpu_start,%eax
58c5fc13
MT		 14751+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14752+#endif
14753+
14754+#ifdef CONFIG_PAX_MEMORY_UDEREF
14755+ movl $NR_CPUS,%ecx
14756+ movl $pa(cpu_gdt_table),%edi
14757+1:
14758+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
bc901d79
MT		 14759+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14760+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
58c5fc13
MT		 14761+ addl $PAGE_SIZE_asm,%edi
14762+ loop 1b
14763+#endif
14764+
14765+#ifdef CONFIG_PAX_KERNEXEC
14766+ movl $pa(boot_gdt),%edi
ae4e228f 14767+ movl $__LOAD_PHYSICAL_ADDR,%eax
58c5fc13
MT		 14768+ movw %ax,__BOOT_CS + 2(%edi)
14769+ rorl $16,%eax
14770+ movb %al,__BOOT_CS + 4(%edi)
14771+ movb %ah,__BOOT_CS + 7(%edi)
14772+ rorl $16,%eax
14773+
ae4e228f
MT		 14774+ ljmp $(__BOOT_CS),$1f
14775+1:
14776+
58c5fc13
MT		 14777+ movl $NR_CPUS,%ecx
14778+ movl $pa(cpu_gdt_table),%edi
ae4e228f 14779+ addl $__PAGE_OFFSET,%eax
58c5fc13
MT		 14780+1:
14781+ movw %ax,__KERNEL_CS + 2(%edi)
ae4e228f 14782+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
58c5fc13
MT		 14783+ rorl $16,%eax
14784+ movb %al,__KERNEL_CS + 4(%edi)
ae4e228f 14785+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
58c5fc13 14786+ movb %ah,__KERNEL_CS + 7(%edi)
ae4e228f 14787+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
58c5fc13
MT		 14788+ rorl $16,%eax
14789+ addl $PAGE_SIZE_asm,%edi
14790+ loop 1b
14791+#endif
14792+
14793 /*
14794 * Clear BSS first so that there are no surprises...
14795 */
16454cff 14796@@ -195,8 +261,11 @@ ENTRY(startup_32)
58c5fc13
MT		 14797 movl %eax, pa(max_pfn_mapped)
14798
14799 /* Do early initialization of the fixmap area */
bc901d79
MT		 14800- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14801- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
58c5fc13 14802+#ifdef CONFIG_COMPAT_VDSO
bc901d79 14803+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
58c5fc13 14804+#else
bc901d79 14805+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
58c5fc13
MT		 14806+#endif
14807 #else /* Not PAE */
14808
14809 page_pde_offset = (__PAGE_OFFSET >> 20);
16454cff 14810@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
58c5fc13
MT		 14811 movl %eax, pa(max_pfn_mapped)
14812
14813 /* Do early initialization of the fixmap area */
bc901d79
MT		 14814- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14815- movl %eax,pa(initial_page_table+0xffc)
58c5fc13 14816+#ifdef CONFIG_COMPAT_VDSO
bc901d79 14817+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
58c5fc13 14818+#else
bc901d79 14819+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
58c5fc13
MT		 14820+#endif
14821 #endif
16454cff
MT		 14822
14823 #ifdef CONFIG_PARAVIRT
14824@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14825 cmpl $num_subarch_entries, %eax
14826 jae bad_subarch
14827
14828- movl pa(subarch_entries)(,%eax,4), %eax
14829- subl $__PAGE_OFFSET, %eax
14830- jmp *%eax
14831+ jmp *pa(subarch_entries)(,%eax,4)
14832
14833 bad_subarch:
14834 WEAK(lguest_entry)
14835@@ -255,10 +325,10 @@ WEAK(xen_entry)
14836 __INITDATA
14837
14838 subarch_entries:
14839- .long default_entry /* normal x86/PC */
14840- .long lguest_entry /* lguest hypervisor */
14841- .long xen_entry /* Xen hypervisor */
14842- .long default_entry /* Moorestown MID */
66a7e928
MT		 14843+ .long ta(default_entry) /* normal x86/PC */
14844+ .long ta(lguest_entry) /* lguest hypervisor */
14845+ .long ta(xen_entry) /* Xen hypervisor */
14846+ .long ta(default_entry) /* Moorestown MID */
16454cff
MT		 14847 num_subarch_entries = (. - subarch_entries) / 4
14848 .previous
14849 #else
14850@@ -312,6 +382,7 @@ default_entry:
58c5fc13
MT		 14851 orl %edx,%eax
14852 movl %eax,%cr4
14853
14854+#ifdef CONFIG_X86_PAE
ae4e228f
MT		 14855 testb $X86_CR4_PAE, %al # check if PAE is enabled
14856 jz 6f
58c5fc13 14857
16454cff 14858@@ -340,6 +411,9 @@ default_entry:
58c5fc13
MT		 14859 /* Make changes effective */
14860 wrmsr
14861
14862+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
58c5fc13 14863+#endif
ae4e228f 14864+
58c5fc13
MT		 14865 6:
14866
14867 /*
16454cff 14868@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
58c5fc13
MT		 14869 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14870 movl %eax,%ss # after changing gdt.
14871
14872- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14873+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14874 movl %eax,%ds
14875 movl %eax,%es
14876
16454cff 14877@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
58c5fc13
MT		 14878 */
14879 cmpb $0,ready
14880 jne 1f
df50ba0c 14881- movl $gdt_page,%eax
58c5fc13 14882+ movl $cpu_gdt_table,%eax
df50ba0c 14883 movl $stack_canary,%ecx
58c5fc13
MT		 14884+#ifdef CONFIG_SMP
14885+ addl $__per_cpu_load,%ecx
14886+#endif
14887 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14888 shrl $16, %ecx
14889 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
bc901d79
MT		 14890 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14891 1:
14892-#endif
14893 movl $(__KERNEL_STACK_CANARY),%eax
14894+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14895+ movl $(__USER_DS),%eax
14896+#else
14897+ xorl %eax,%eax
14898+#endif
14899 movl %eax,%gs
14900
14901 xorl %eax,%eax # Clear LDT
16454cff 14902@@ -558,22 +639,22 @@ early_page_fault:
58c5fc13
MT		 14903 jmp early_fault
14904
14905 early_fault:
14906- cld
14907 #ifdef CONFIG_PRINTK
14908+ cmpl $1,%ss:early_recursion_flag
14909+ je hlt_loop
14910+ incl %ss:early_recursion_flag
14911+ cld
14912 pusha
14913 movl $(__KERNEL_DS),%eax
14914 movl %eax,%ds
14915 movl %eax,%es
14916- cmpl $2,early_recursion_flag
14917- je hlt_loop
14918- incl early_recursion_flag
14919 movl %cr2,%eax
14920 pushl %eax
14921 pushl %edx /* trapno */
14922 pushl $fault_msg
14923 call printk
14924+; call dump_stack
14925 #endif
14926- call dump_stack
14927 hlt_loop:
14928 hlt
14929 jmp hlt_loop
16454cff 14930@@ -581,8 +662,11 @@ hlt_loop:
58c5fc13
MT		 14931 /* This is the default interrupt "handler" :-) */
14932 ALIGN
14933 ignore_int:
14934- cld
14935 #ifdef CONFIG_PRINTK
14936+ cmpl $2,%ss:early_recursion_flag
14937+ je hlt_loop
14938+ incl %ss:early_recursion_flag
14939+ cld
14940 pushl %eax
14941 pushl %ecx
14942 pushl %edx
16454cff 14943@@ -591,9 +675,6 @@ ignore_int:
58c5fc13
MT		 14944 movl $(__KERNEL_DS),%eax
14945 movl %eax,%ds
14946 movl %eax,%es
14947- cmpl $2,early_recursion_flag
14948- je hlt_loop
14949- incl early_recursion_flag
14950 pushl 16(%esp)
14951 pushl 24(%esp)
14952 pushl 32(%esp)
16454cff 14953@@ -622,29 +703,43 @@ ENTRY(initial_code)
58c5fc13
MT		 14954 /*
14955 * BSS section
14956 */
ae4e228f 14957-__PAGE_ALIGNED_BSS
66a7e928 14958- .align PAGE_SIZE
58c5fc13 14959 #ifdef CONFIG_X86_PAE
bc901d79 14960+.section .initial_pg_pmd,"a",@progbits
16454cff 14961 initial_pg_pmd:
58c5fc13
MT		 14962 .fill 1024*KPMDS,4,0
14963 #else
c52201e0 14964+.section .initial_page_table,"a",@progbits
bc901d79 14965 ENTRY(initial_page_table)
58c5fc13
MT		 14966 .fill 1024,4,0
14967 #endif
bc901d79 14968+.section .initial_pg_fixmap,"a",@progbits
16454cff 14969 initial_pg_fixmap:
58c5fc13 14970 .fill 1024,4,0
bc901d79
MT		 14971+.section .empty_zero_page,"a",@progbits
14972 ENTRY(empty_zero_page)
14973 .fill 4096,1,0
14974+.section .swapper_pg_dir,"a",@progbits
14975 ENTRY(swapper_pg_dir)
6892158b
MT		 14976+#ifdef CONFIG_X86_PAE
14977+ .fill 4,8,0
14978+#else
14979 .fill 1024,4,0
6892158b 14980+#endif
58c5fc13 14981+
bc901d79 14982+/*
58c5fc13
MT		 14983+ * The IDT has to be page-aligned to simplify the Pentium
14984+ * F0 0F bug workaround.. We have a special link segment
14985+ * for this.
14986+ */
14987+.section .idt,"a",@progbits
14988+ENTRY(idt_table)
14989+ .fill 256,8,0
bc901d79
MT		 14990
14991 /*
58c5fc13
MT		 14992 * This starts the data section.
14993 */
14994 #ifdef CONFIG_X86_PAE
ae4e228f 14995-__PAGE_ALIGNED_DATA
58c5fc13 14996- /* Page-aligned for the benefit of paravirt? */
66a7e928 14997- .align PAGE_SIZE
bc901d79
MT		 14998+.section .initial_page_table,"a",@progbits
14999 ENTRY(initial_page_table)
15000 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
58c5fc13 15001 # if KPMDS == 3
71d190be 15002@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
df50ba0c
MT		 15003 # error "Kernel PMDs should be 1, 2 or 3"
15004 # endif
66a7e928 15005 .align PAGE_SIZE /* needs to be page-sized too */
df50ba0c
MT		 15006+
15007+#ifdef CONFIG_PAX_PER_CPU_PGD
15008+ENTRY(cpu_pgd)
15009+ .rept NR_CPUS
15010+ .fill 4,8,0
15011+ .endr
15012+#endif
15013+
15014 #endif
58c5fc13
MT		 15015
15016 .data
16454cff 15017 .balign 4
58c5fc13
MT		 15018 ENTRY(stack_start)
15019- .long init_thread_union+THREAD_SIZE
15020+ .long init_thread_union+THREAD_SIZE-8
71d190be
MT		 15021+
15022+ready: .byte 0
58c5fc13
MT		 15023
15024+.section .rodata,"a",@progbits
15025 early_recursion_flag:
15026 .long 0
15027
71d190be
MT		 15028-ready: .byte 0
15029-
15030 int_msg:
15031 .asciz "Unknown interrupt or fault at: %p %p %p\n"
15032
16454cff 15033@@ -707,7 +811,7 @@ fault_msg:
58c5fc13
MT		 15034 .word 0 # 32 bit align gdt_desc.address
15035 boot_gdt_descr:
15036 .word __BOOT_DS+7
15037- .long boot_gdt - __PAGE_OFFSET
15038+ .long pa(boot_gdt)
15039
15040 .word 0 # 32-bit align idt_desc.address
15041 idt_descr:
16454cff 15042@@ -718,7 +822,7 @@ idt_descr:
58c5fc13
MT		 15043 .word 0 # 32 bit align gdt_desc.address
15044 ENTRY(early_gdt_descr)
15045 .word GDT_ENTRIES*8-1
df50ba0c 15046- .long gdt_page /* Overwritten for secondary CPUs */
58c5fc13
MT		 15047+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
15048
15049 /*
15050 * The boot_gdt must mirror the equivalent in setup.S and is
16454cff 15051@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
58c5fc13
MT		 15052 .align L1_CACHE_BYTES
15053 ENTRY(boot_gdt)
15054 .fill GDT_ENTRY_BOOT_CS,8,0
15055- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
15056- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
15057+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
15058+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
15059+
15060+ .align PAGE_SIZE_asm
15061+ENTRY(cpu_gdt_table)
15062+ .rept NR_CPUS
15063+ .quad 0x0000000000000000 /* NULL descriptor */
15064+ .quad 0x0000000000000000 /* 0x0b reserved */
15065+ .quad 0x0000000000000000 /* 0x13 reserved */
15066+ .quad 0x0000000000000000 /* 0x1b reserved */
ae4e228f
MT		 15067+
15068+#ifdef CONFIG_PAX_KERNEXEC
15069+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
15070+#else
58c5fc13 15071+ .quad 0x0000000000000000 /* 0x20 unused */
ae4e228f
MT		 15072+#endif
15073+
58c5fc13
MT		 15074+ .quad 0x0000000000000000 /* 0x28 unused */
15075+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
15076+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
15077+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
15078+ .quad 0x0000000000000000 /* 0x4b reserved */
15079+ .quad 0x0000000000000000 /* 0x53 reserved */
15080+ .quad 0x0000000000000000 /* 0x5b reserved */
15081+
15082+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
15083+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
15084+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
15085+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
15086+
15087+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
15088+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
15089+
15090+ /*
15091+ * Segments used for calling PnP BIOS have byte granularity.
15092+ * The code segments and data segments have fixed 64k limits,
15093+ * the transfer segment sizes are set at run time.
15094+ */
15095+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
15096+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
15097+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
15098+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
15099+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
15100+
15101+ /*
15102+ * The APM segments have byte granularity and their bases
15103+ * are set at run time. All have 64k limits.
15104+ */
15105+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
15106+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
15107+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
15108+
15109+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
15110+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
ae4e228f 15111+ .quad 0x0040910000000018 /* 0xe0 - STACK_CANARY */
58c5fc13
MT		 15112+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
15113+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
15114+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
15115+
15116+ /* Be sure this is zeroed to avoid false validations in Xen */
15117+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
15118+ .endr
66a7e928
MT		 15119diff -urNp linux-2.6.39/arch/x86/kernel/head_64.S linux-2.6.39/arch/x86/kernel/head_64.S
15120--- linux-2.6.39/arch/x86/kernel/head_64.S 2011-05-19 00:06:34.000000000 -0400
15121+++ linux-2.6.39/arch/x86/kernel/head_64.S 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 15122@@ -19,6 +19,7 @@
15123 #include <asm/cache.h>
15124 #include <asm/processor-flags.h>
15125 #include <asm/percpu.h>
15126+#include <asm/cpufeature.h>
15127
15128 #ifdef CONFIG_PARAVIRT
15129 #include <asm/asm-offsets.h>
15130@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
58c5fc13
MT		 15131 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
15132 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
15133 L3_START_KERNEL = pud_index(__START_KERNEL_map)
15134+L4_VMALLOC_START = pgd_index(VMALLOC_START)
15135+L3_VMALLOC_START = pud_index(VMALLOC_START)
15136+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
15137+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
15138
15139 .text
ae4e228f
MT		 15140 __HEAD
15141@@ -85,35 +90,22 @@ startup_64:
58c5fc13
MT		 15142 */
15143 addq %rbp, init_level4_pgt + 0(%rip)
15144 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
15145+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
15146+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
15147 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
15148
15149 addq %rbp, level3_ident_pgt + 0(%rip)
ae4e228f 15150+#ifndef CONFIG_XEN
58c5fc13 15151+ addq %rbp, level3_ident_pgt + 8(%rip)
ae4e228f 15152+#endif
58c5fc13
MT		 15153
15154- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
15155- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
15156+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
15157
15158- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15159+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
15160+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
15161
15162- /* Add an Identity mapping if I am above 1G */
15163- leaq _text(%rip), %rdi
15164- andq $PMD_PAGE_MASK, %rdi
15165-
15166- movq %rdi, %rax
15167- shrq $PUD_SHIFT, %rax
15168- andq $(PTRS_PER_PUD - 1), %rax
15169- jz ident_complete
15170-
15171- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15172- leaq level3_ident_pgt(%rip), %rbx
15173- movq %rdx, 0(%rbx, %rax, 8)
15174-
15175- movq %rdi, %rax
15176- shrq $PMD_SHIFT, %rax
15177- andq $(PTRS_PER_PMD - 1), %rax
15178- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15179- leaq level2_spare_pgt(%rip), %rbx
15180- movq %rdx, 0(%rbx, %rax, 8)
15181-ident_complete:
15182+ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15183+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15184
15185 /*
15186 * Fixup the kernel text+data virtual addresses. Note that
66a7e928 15187@@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
df50ba0c
MT		 15188 * after the boot processor executes this code.
15189 */
15190
15191- /* Enable PAE mode and PGE */
15192- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15193+ /* Enable PAE mode and PSE/PGE */
15194+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15195 movq %rax, %cr4
15196
15197 /* Setup early boot stage 4 level pagetables. */
66a7e928 15198@@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
ae4e228f
MT		 15199 movl $MSR_EFER, %ecx
15200 rdmsr
15201 btsl $_EFER_SCE, %eax /* Enable System Call */
15202- btl $20,%edi /* No Execute supported? */
15203+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
58c5fc13
MT		 15204 jnc 1f
15205 btsl $_EFER_NX, %eax
15206+ leaq init_level4_pgt(%rip), %rdi
15207+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15208+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15209+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
ae4e228f 15210+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
58c5fc13
MT		 15211 1: wrmsr /* Make changes effective */
15212
15213 /* Setup cr0 */
66a7e928 15214@@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
58c5fc13
MT		 15215 bad_address:
15216 jmp bad_address
15217
15218- .section ".init.text","ax"
15219+ __INIT
15220 #ifdef CONFIG_EARLY_PRINTK
15221 .globl early_idt_handlers
15222 early_idt_handlers:
66a7e928 15223@@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
58c5fc13
MT		 15224 #endif /* EARLY_PRINTK */
15225 1: hlt
15226 jmp 1b
15227+ .previous
15228
15229 #ifdef CONFIG_EARLY_PRINTK
15230+ __INITDATA
15231 early_recursion_flag:
15232 .long 0
15233+ .previous
15234
15235+ .section .rodata,"a",@progbits
15236 early_idt_msg:
15237 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15238 early_idt_ripmsg:
15239 .asciz "RIP %s\n"
15240-#endif /* CONFIG_EARLY_PRINTK */
15241 .previous
15242+#endif /* CONFIG_EARLY_PRINTK */
15243
15244+ .section .rodata,"a",@progbits
15245 #define NEXT_PAGE(name) \
15246 .balign PAGE_SIZE; \
15247 ENTRY(name)
66a7e928 15248@@ -338,7 +340,6 @@ ENTRY(name)
bc901d79
MT		 15249 i = i + 1 ; \
15250 .endr
15251
15252- .data
15253 /*
15254 * This default setting generates an ident mapping at address 0x100000
15255 * and a mapping for the kernel that precisely maps virtual address
66a7e928 15256@@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
58c5fc13
MT		 15257 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15258 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15259 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15260+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15261+ .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15262+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15263+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15264 .org init_level4_pgt + L4_START_KERNEL*8, 0
15265 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15266 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15267
df50ba0c
MT		 15268+#ifdef CONFIG_PAX_PER_CPU_PGD
15269+NEXT_PAGE(cpu_pgd)
15270+ .rept NR_CPUS
15271+ .fill 512,8,0
15272+ .endr
15273+#endif
15274+
58c5fc13
MT		 15275 NEXT_PAGE(level3_ident_pgt)
15276 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15277+#ifdef CONFIG_XEN
15278 .fill 511,8,0
15279+#else
15280+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
ae4e228f 15281+ .fill 510,8,0
58c5fc13
MT		 15282+#endif
15283+
15284+NEXT_PAGE(level3_vmalloc_pgt)
15285+ .fill 512,8,0
15286+
15287+NEXT_PAGE(level3_vmemmap_pgt)
15288+ .fill L3_VMEMMAP_START,8,0
15289+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15290
15291 NEXT_PAGE(level3_kernel_pgt)
15292 .fill L3_START_KERNEL,8,0
66a7e928 15293@@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
58c5fc13
MT		 15294 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15295 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15296
15297+NEXT_PAGE(level2_vmemmap_pgt)
15298+ .fill 512,8,0
15299+
15300 NEXT_PAGE(level2_fixmap_pgt)
15301- .fill 506,8,0
15302- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15303- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15304- .fill 5,8,0
15305+ .fill 507,8,0
15306+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15307+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15308+ .fill 4,8,0
15309
15310-NEXT_PAGE(level1_fixmap_pgt)
15311+NEXT_PAGE(level1_vsyscall_pgt)
15312 .fill 512,8,0
15313
15314-NEXT_PAGE(level2_ident_pgt)
15315- /* Since I easily can, map the first 1G.
ae4e228f 15316+ /* Since I easily can, map the first 2G.
58c5fc13
MT		 15317 * Don't set NX because code runs from these pages.
15318 */
15319- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15320+NEXT_PAGE(level2_ident_pgt)
ae4e228f 15321+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
58c5fc13
MT		 15322
15323 NEXT_PAGE(level2_kernel_pgt)
15324 /*
66a7e928 15325@@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
58c5fc13
MT		 15326 * If you want to increase this then increase MODULES_VADDR
15327 * too.)
15328 */
15329- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15330- KERNEL_IMAGE_SIZE/PMD_SIZE)
15331-
15332-NEXT_PAGE(level2_spare_pgt)
15333- .fill 512, 8, 0
15334+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15335
15336 #undef PMDS
15337 #undef NEXT_PAGE
15338
15339- .data
15340+ .align PAGE_SIZE
15341+ENTRY(cpu_gdt_table)
15342+ .rept NR_CPUS
15343+ .quad 0x0000000000000000 /* NULL descriptor */
15344+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15345+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15346+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15347+ .quad 0x00cffb000000ffff /* __USER32_CS */
15348+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15349+ .quad 0x00affb000000ffff /* __USER_CS */
ae4e228f
MT		 15350+
15351+#ifdef CONFIG_PAX_KERNEXEC
15352+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15353+#else
58c5fc13 15354+ .quad 0x0 /* unused */
ae4e228f
MT		 15355+#endif
15356+
58c5fc13
MT		 15357+ .quad 0,0 /* TSS */
15358+ .quad 0,0 /* LDT */
15359+ .quad 0,0,0 /* three TLS descriptors */
15360+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15361+ /* asm/segment.h:GDT_ENTRIES must match this */
15362+
15363+ /* zero the remaining page */
15364+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15365+ .endr
15366+
15367 .align 16
15368 .globl early_gdt_descr
15369 early_gdt_descr:
15370 .word GDT_ENTRIES*8-1
15371 early_gdt_descr_base:
15372- .quad INIT_PER_CPU_VAR(gdt_page)
15373+ .quad cpu_gdt_table
15374
15375 ENTRY(phys_base)
15376 /* This must match the first entry in level2_kernel_pgt */
15377 .quad 0x0000000000000000
15378
15379 #include "../../x86/xen/xen-head.S"
15380-
15381- .section .bss, "aw", @nobits
15382+
15383+ .section .rodata,"a",@progbits
15384 .align L1_CACHE_BYTES
15385 ENTRY(idt_table)
15386- .skip IDT_ENTRIES * 16
15387+ .fill 512,8,0
15388
ae4e228f 15389 __PAGE_ALIGNED_BSS
58c5fc13 15390 .align PAGE_SIZE
66a7e928
MT		 15391diff -urNp linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c
15392--- linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c 2011-05-19 00:06:34.000000000 -0400
15393+++ linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 15394@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15395 EXPORT_SYMBOL(cmpxchg8b_emu);
58c5fc13
MT		 15396 #endif
15397
15398+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15399+
15400 /* Networking helper routines. */
15401 EXPORT_SYMBOL(csum_partial_copy_generic);
15402+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15403+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15404
15405 EXPORT_SYMBOL(__get_user_1);
15406 EXPORT_SYMBOL(__get_user_2);
ae4e228f 15407@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
58c5fc13
MT		 15408
15409 EXPORT_SYMBOL(csum_partial);
15410 EXPORT_SYMBOL(empty_zero_page);
15411+
15412+#ifdef CONFIG_PAX_KERNEXEC
15413+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15414+#endif
66a7e928
MT		 15415diff -urNp linux-2.6.39/arch/x86/kernel/i8259.c linux-2.6.39/arch/x86/kernel/i8259.c
15416--- linux-2.6.39/arch/x86/kernel/i8259.c 2011-05-19 00:06:34.000000000 -0400
15417+++ linux-2.6.39/arch/x86/kernel/i8259.c 2011-05-22 19:36:30.000000000 -0400
8308f9c9
MT		 15418@@ -210,7 +210,7 @@ spurious_8259A_irq:
15419 "spurious 8259A interrupt: IRQ%d.\n", irq);
15420 spurious_irq_mask |= irqmask;
15421 }
15422- atomic_inc(&irq_err_count);
15423+ atomic_inc_unchecked(&irq_err_count);
15424 /*
15425 * Theoretically we do not have to handle this IRQ,
15426 * but in Linux this does not cause problems and is
66a7e928
MT		 15427diff -urNp linux-2.6.39/arch/x86/kernel/init_task.c linux-2.6.39/arch/x86/kernel/init_task.c
15428--- linux-2.6.39/arch/x86/kernel/init_task.c 2011-05-19 00:06:34.000000000 -0400
15429+++ linux-2.6.39/arch/x86/kernel/init_task.c 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 15430@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15431 * way process stacks are handled. This is done by having a special
15432 * "init_task" linker map entry..
15433 */
15434-union thread_union init_thread_union __init_task_data =
15435- { INIT_THREAD_INFO(init_task) };
15436+union thread_union init_thread_union __init_task_data;
15437
15438 /*
15439 * Initial task structure.
15440@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
58c5fc13
MT		 15441 * section. Since TSS's are completely CPU-local, we want them
15442 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15443 */
15444-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15445-
15446+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15447+EXPORT_SYMBOL(init_tss);
66a7e928
MT		 15448diff -urNp linux-2.6.39/arch/x86/kernel/ioport.c linux-2.6.39/arch/x86/kernel/ioport.c
15449--- linux-2.6.39/arch/x86/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
15450+++ linux-2.6.39/arch/x86/kernel/ioport.c 2011-05-22 19:41:32.000000000 -0400
58c5fc13
MT		 15451@@ -6,6 +6,7 @@
15452 #include <linux/sched.h>
15453 #include <linux/kernel.h>
15454 #include <linux/capability.h>
15455+#include <linux/security.h>
15456 #include <linux/errno.h>
15457 #include <linux/types.h>
15458 #include <linux/ioport.h>
66a7e928 15459@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
58c5fc13
MT		 15460
15461 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15462 return -EINVAL;
15463+#ifdef CONFIG_GRKERNSEC_IO
df50ba0c 15464+ if (turn_on && grsec_disable_privio) {
58c5fc13
MT		 15465+ gr_handle_ioperm();
15466+ return -EPERM;
15467+ }
15468+#endif
15469 if (turn_on && !capable(CAP_SYS_RAWIO))
15470 return -EPERM;
15471
66a7e928 15472@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
58c5fc13
MT		 15473 * because the ->io_bitmap_max value must match the bitmap
15474 * contents:
15475 */
15476- tss = &per_cpu(init_tss, get_cpu());
15477+ tss = init_tss + get_cpu();
15478
66a7e928
MT		 15479 if (turn_on)
15480 bitmap_clear(t->io_bitmap_ptr, from, num);
15481@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
58c5fc13
MT		 15482 return -EINVAL;
15483 /* Trying to gain more privileges? */
15484 if (level > old) {
15485+#ifdef CONFIG_GRKERNSEC_IO
df50ba0c
MT		 15486+ if (grsec_disable_privio) {
15487+ gr_handle_iopl();
15488+ return -EPERM;
15489+ }
15490+#endif
58c5fc13
MT		 15491 if (!capable(CAP_SYS_RAWIO))
15492 return -EPERM;
58c5fc13 15493 }
66a7e928
MT		 15494diff -urNp linux-2.6.39/arch/x86/kernel/irq_32.c linux-2.6.39/arch/x86/kernel/irq_32.c
15495--- linux-2.6.39/arch/x86/kernel/irq_32.c 2011-05-19 00:06:34.000000000 -0400
15496+++ linux-2.6.39/arch/x86/kernel/irq_32.c 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 15497@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15498 __asm__ __volatile__("andl %%esp,%0" :
15499 "=r" (sp) : "0" (THREAD_SIZE - 1));
15500
15501- return sp < (sizeof(struct thread_info) + STACK_WARN);
15502+ return sp < STACK_WARN;
15503 }
15504
15505 static void print_stack_overflow(void)
15506@@ -54,8 +54,8 @@ static inline void print_stack_overflow(
15507 * per-CPU IRQ handling contexts (thread information and stack)
15508 */
15509 union irq_ctx {
15510- struct thread_info tinfo;
15511- u32 stack[THREAD_SIZE/sizeof(u32)];
15512+ unsigned long previous_esp;
15513+ u32 stack[THREAD_SIZE/sizeof(u32)];
15514 } __attribute__((aligned(THREAD_SIZE)));
15515
15516 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15517@@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
15518 static inline int
15519 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15520 {
15521- union irq_ctx *curctx, *irqctx;
15522+ union irq_ctx *irqctx;
15523 u32 *isp, arg1, arg2;
15524
15525- curctx = (union irq_ctx *) current_thread_info();
15526 irqctx = __this_cpu_read(hardirq_ctx);
15527
15528 /*
15529@@ -87,21 +86,17 @@ execute_on_irq_stack(int overflow, struc
15530 * handler) we can't do that and just have to keep using the
15531 * current stack (which is the irq stack already after all)
15532 */
15533- if (unlikely(curctx == irqctx))
15534+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
58c5fc13
MT		 15535 return 0;
15536
15537 /* build the stack frame on the IRQ stack */
15538- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
71d190be
MT		 15539- irqctx->tinfo.task = curctx->tinfo.task;
15540- irqctx->tinfo.previous_esp = current_stack_pointer;
58c5fc13 15541+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
71d190be
MT		 15542+ irqctx->previous_esp = current_stack_pointer;
15543+ add_preempt_count(HARDIRQ_OFFSET);
bc901d79 15544
71d190be
MT		 15545- /*
15546- * Copy the softirq bits in preempt_count so that the
15547- * softirq checks work in the hardirq context.
15548- */
15549- irqctx->tinfo.preempt_count =
15550- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15551- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
bc901d79 15552+#ifdef CONFIG_PAX_MEMORY_UDEREF
71d190be 15553+ __set_fs(MAKE_MM_SEG(0));
bc901d79 15554+#endif
71d190be 15555
bc901d79
MT		 15556 if (unlikely(overflow))
15557 call_on_stack(print_stack_overflow, isp);
71d190be 15558@@ -113,6 +108,12 @@ execute_on_irq_stack(int overflow, struc
bc901d79
MT		 15559 : "0" (irq), "1" (desc), "2" (isp),
15560 "D" (desc->handle_irq)
15561 : "memory", "cc", "ecx");
15562+
15563+#ifdef CONFIG_PAX_MEMORY_UDEREF
71d190be 15564+ __set_fs(current_thread_info()->addr_limit);
bc901d79
MT		 15565+#endif
15566+
71d190be 15567+ sub_preempt_count(HARDIRQ_OFFSET);
bc901d79
MT		 15568 return 1;
15569 }
15570
71d190be
MT		 15571@@ -121,29 +122,11 @@ execute_on_irq_stack(int overflow, struc
15572 */
15573 void __cpuinit irq_ctx_init(int cpu)
15574 {
15575- union irq_ctx *irqctx;
15576-
15577 if (per_cpu(hardirq_ctx, cpu))
15578 return;
15579
15580- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15581- THREAD_FLAGS,
15582- THREAD_ORDER));
15583- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15584- irqctx->tinfo.cpu = cpu;
15585- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15586- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15587-
15588- per_cpu(hardirq_ctx, cpu) = irqctx;
15589-
15590- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15591- THREAD_FLAGS,
15592- THREAD_ORDER));
15593- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15594- irqctx->tinfo.cpu = cpu;
15595- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15596-
15597- per_cpu(softirq_ctx, cpu) = irqctx;
15598+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15599+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15600
15601 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15602 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15603@@ -152,7 +135,6 @@ void __cpuinit irq_ctx_init(int cpu)
15604 asmlinkage void do_softirq(void)
15605 {
15606 unsigned long flags;
15607- struct thread_info *curctx;
15608 union irq_ctx *irqctx;
15609 u32 *isp;
15610
15611@@ -162,15 +144,22 @@ asmlinkage void do_softirq(void)
15612 local_irq_save(flags);
15613
15614 if (local_softirq_pending()) {
15615- curctx = current_thread_info();
15616 irqctx = __this_cpu_read(softirq_ctx);
15617- irqctx->tinfo.task = curctx->task;
15618- irqctx->tinfo.previous_esp = current_stack_pointer;
15619+ irqctx->previous_esp = current_stack_pointer;
58c5fc13
MT		 15620
15621 /* build the stack frame on the softirq stack */
15622- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15623+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
bc901d79
MT		 15624+
15625+#ifdef CONFIG_PAX_MEMORY_UDEREF
71d190be 15626+ __set_fs(MAKE_MM_SEG(0));
bc901d79 15627+#endif
58c5fc13
MT		 15628
15629 call_on_stack(__do_softirq, isp);
bc901d79
MT		 15630+
15631+#ifdef CONFIG_PAX_MEMORY_UDEREF
71d190be 15632+ __set_fs(current_thread_info()->addr_limit);
bc901d79
MT		 15633+#endif
15634+
58c5fc13 15635 /*
66a7e928 15636 * Shouldn't happen, we returned above if in_interrupt():
bc901d79 15637 */
66a7e928
MT		 15638diff -urNp linux-2.6.39/arch/x86/kernel/irq.c linux-2.6.39/arch/x86/kernel/irq.c
15639--- linux-2.6.39/arch/x86/kernel/irq.c 2011-05-19 00:06:34.000000000 -0400
15640+++ linux-2.6.39/arch/x86/kernel/irq.c 2011-05-22 19:36:30.000000000 -0400
15641@@ -17,7 +17,7 @@
8308f9c9
MT		 15642 #include <asm/mce.h>
15643 #include <asm/hw_irq.h>
15644
15645-atomic_t irq_err_count;
15646+atomic_unchecked_t irq_err_count;
15647
15648 /* Function pointer for generic interrupt vector handling */
15649 void (*x86_platform_ipi_callback)(void) = NULL;
66a7e928 15650@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
8308f9c9
MT		 15651 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15652 seq_printf(p, " Machine check polls\n");
15653 #endif
15654- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15655+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15656 #if defined(CONFIG_X86_IO_APIC)
15657- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15658+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15659 #endif
15660 return 0;
15661 }
66a7e928 15662@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
8308f9c9
MT		 15663
15664 u64 arch_irq_stat(void)
15665 {
15666- u64 sum = atomic_read(&irq_err_count);
15667+ u64 sum = atomic_read_unchecked(&irq_err_count);
15668
15669 #ifdef CONFIG_X86_IO_APIC
15670- sum += atomic_read(&irq_mis_count);
15671+ sum += atomic_read_unchecked(&irq_mis_count);
15672 #endif
15673 return sum;
15674 }
66a7e928
MT		 15675diff -urNp linux-2.6.39/arch/x86/kernel/kgdb.c linux-2.6.39/arch/x86/kernel/kgdb.c
15676--- linux-2.6.39/arch/x86/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
15677+++ linux-2.6.39/arch/x86/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
16454cff 15678@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
6892158b 15679 #ifdef CONFIG_X86_32
66a7e928 15680 switch (regno) {
6892158b
MT		 15681 case GDB_SS:
15682- if (!user_mode_vm(regs))
15683+ if (!user_mode(regs))
15684 *(unsigned long *)mem = __KERNEL_DS;
15685 break;
15686 case GDB_SP:
15687- if (!user_mode_vm(regs))
15688+ if (!user_mode(regs))
15689 *(unsigned long *)mem = kernel_stack_pointer(regs);
15690 break;
15691 case GDB_GS:
8308f9c9
MT		 15692@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
15693 case 'k':
15694 /* clear the trace bit */
15695 linux_regs->flags &= ~X86_EFLAGS_TF;
15696- atomic_set(&kgdb_cpu_doing_single_step, -1);
15697+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15698
15699 /* set the trace bit if we're stepping */
15700 if (remcomInBuffer[0] == 's') {
15701 linux_regs->flags |= X86_EFLAGS_TF;
15702- atomic_set(&kgdb_cpu_doing_single_step,
15703+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15704 raw_smp_processor_id());
15705 }
15706
66a7e928
MT		 15707@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
15708 return NOTIFY_DONE;
8308f9c9
MT		 15709
15710 case DIE_DEBUG:
15711- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15712+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15713 if (user_mode(regs))
15714 return single_step_cont(regs, args);
15715 break;
66a7e928 15716@@ -710,7 +710,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
57199397 15717 regs->ip = ip;
ae4e228f
MT		 15718 }
15719
15720-struct kgdb_arch arch_kgdb_ops = {
15721+const struct kgdb_arch arch_kgdb_ops = {
15722 /* Breakpoint instruction: */
15723 .gdb_bpt_instr = { 0xcc },
15724 .flags = KGDB_HW_BREAKPOINT,
66a7e928
MT		 15725diff -urNp linux-2.6.39/arch/x86/kernel/kprobes.c linux-2.6.39/arch/x86/kernel/kprobes.c
15726--- linux-2.6.39/arch/x86/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
15727+++ linux-2.6.39/arch/x86/kernel/kprobes.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 15728@@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
df50ba0c
MT		 15729 } __attribute__((packed)) *insn;
15730
bc901d79 15731 insn = (struct __arch_relative_insn *)from;
58c5fc13 15732+
ae4e228f 15733+ pax_open_kernel();
df50ba0c
MT		 15734 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15735 insn->op = op;
ae4e228f 15736+ pax_close_kernel();
58c5fc13
MT		 15737 }
15738
df50ba0c 15739 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
bc901d79
MT		 15740@@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op
15741 kprobe_opcode_t opcode;
15742 kprobe_opcode_t *orig_opcodes = opcodes;
15743
15744- if (search_exception_tables((unsigned long)opcodes))
15745+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15746 return 0; /* Page fault may occur on this address. */
15747
15748 retry:
15749@@ -314,7 +317,9 @@ static int __kprobes __copy_instruction(
df50ba0c
MT		 15750 }
15751 }
15752 insn_get_length(&insn);
ae4e228f 15753+ pax_open_kernel();
df50ba0c 15754 memcpy(dest, insn.kaddr, insn.length);
ae4e228f 15755+ pax_close_kernel();
58c5fc13 15756
df50ba0c
MT		 15757 #ifdef CONFIG_X86_64
15758 if (insn_rip_relative(&insn)) {
bc901d79 15759@@ -338,7 +343,9 @@ static int __kprobes __copy_instruction(
df50ba0c
MT		 15760 (u8 *) dest;
15761 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15762 disp = (u8 *) dest + insn_offset_displacement(&insn);
15763+ pax_open_kernel();
15764 *(s32 *) disp = (s32) newdisp;
15765+ pax_close_kernel();
15766 }
15767 #endif
15768 return insn.length;
bc901d79 15769@@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s
df50ba0c
MT		 15770 */
15771 __copy_instruction(p->ainsn.insn, p->addr, 0);
58c5fc13
MT		 15772
15773- if (can_boost(p->addr))
15774+ if (can_boost(ktla_ktva(p->addr)))
15775 p->ainsn.boostable = 0;
15776 else
15777 p->ainsn.boostable = -1;
15778
15779- p->opcode = *p->addr;
15780+ p->opcode = *(ktla_ktva(p->addr));
15781 }
15782
15783 int __kprobes arch_prepare_kprobe(struct kprobe *p)
bc901d79 15784@@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s
df50ba0c
MT		 15785 * nor set current_kprobe, because it doesn't use single
15786 * stepping.
15787 */
15788- regs->ip = (unsigned long)p->ainsn.insn;
15789+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15790 preempt_enable_no_resched();
15791 return;
15792 }
bc901d79 15793@@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s
58c5fc13
MT		 15794 if (p->opcode == BREAKPOINT_INSTRUCTION)
15795 regs->ip = (unsigned long)p->addr;
15796 else
15797- regs->ip = (unsigned long)p->ainsn.insn;
15798+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15799 }
15800
df50ba0c 15801 /*
bc901d79 15802@@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru
df50ba0c
MT		 15803 setup_singlestep(p, regs, kcb, 0);
15804 return 1;
15805 }
15806- } else if (*addr != BREAKPOINT_INSTRUCTION) {
15807+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
58c5fc13
MT		 15808 /*
15809 * The breakpoint instruction was removed right
15810 * after we hit it. Another cpu has removed
bc901d79 15811@@ -817,7 +824,7 @@ static void __kprobes resume_execution(s
58c5fc13
MT		 15812 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15813 {
15814 unsigned long *tos = stack_addr(regs);
15815- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15816+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15817 unsigned long orig_ip = (unsigned long)p->addr;
15818 kprobe_opcode_t *insn = p->ainsn.insn;
15819
bc901d79 15820@@ -999,7 +1006,7 @@ int __kprobes kprobe_exceptions_notify(s
58c5fc13
MT		 15821 struct die_args *args = data;
15822 int ret = NOTIFY_DONE;
15823
15824- if (args->regs && user_mode_vm(args->regs))
15825+ if (args->regs && user_mode(args->regs))
15826 return ret;
15827
15828 switch (val) {
66a7e928 15829@@ -1381,7 +1388,7 @@ int __kprobes arch_prepare_optimized_kpr
bc901d79
MT		 15830 * Verify if the address gap is in 2GB range, because this uses
15831 * a relative jump.
15832 */
15833- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15834+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15835 if (abs(rel) > 0x7fffffff)
15836 return -ERANGE;
15837
66a7e928 15838@@ -1402,11 +1409,11 @@ int __kprobes arch_prepare_optimized_kpr
bc901d79
MT		 15839 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15840
15841 /* Set probe function call */
15842- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15843+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15844
15845 /* Set returning jmp instruction at the tail of out-of-line buffer */
15846 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15847- (u8 *)op->kp.addr + op->optinsn.size);
15848+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15849
15850 flush_icache_range((unsigned long) buf,
15851 (unsigned long) buf + TMPL_END_IDX +
66a7e928 15852@@ -1428,7 +1435,7 @@ static void __kprobes setup_optimize_kpr
bc901d79
MT		 15853 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15854
15855 /* Backup instructions which will be replaced by jump address */
15856- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15857+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15858 RELATIVE_ADDR_SIZE);
15859
16454cff 15860 insn_buf[0] = RELATIVEJUMP_OPCODE;
66a7e928
MT		 15861diff -urNp linux-2.6.39/arch/x86/kernel/ldt.c linux-2.6.39/arch/x86/kernel/ldt.c
15862--- linux-2.6.39/arch/x86/kernel/ldt.c 2011-05-19 00:06:34.000000000 -0400
15863+++ linux-2.6.39/arch/x86/kernel/ldt.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 15864@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
58c5fc13
MT		 15865 if (reload) {
15866 #ifdef CONFIG_SMP
15867 preempt_disable();
15868- load_LDT(pc);
15869+ load_LDT_nolock(pc);
ae4e228f
MT		 15870 if (!cpumask_equal(mm_cpumask(current->mm),
15871 cpumask_of(smp_processor_id())))
58c5fc13
MT		 15872 smp_call_function(flush_ldt, current->mm, 1);
15873 preempt_enable();
15874 #else
15875- load_LDT(pc);
15876+ load_LDT_nolock(pc);
15877 #endif
15878 }
15879 if (oldsize) {
df50ba0c 15880@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
58c5fc13
MT		 15881 return err;
15882
15883 for (i = 0; i < old->size; i++)
15884- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15885+ write_ldt_entry(new->ldt, i, old->ldt + i);
15886 return 0;
15887 }
15888
df50ba0c 15889@@ -116,6 +116,24 @@ int init_new_context(struct task_struct
58c5fc13
MT		 15890 retval = copy_ldt(&mm->context, &old_mm->context);
15891 mutex_unlock(&old_mm->context.lock);
15892 }
15893+
15894+ if (tsk == current) {
6892158b 15895+ mm->context.vdso = 0;
58c5fc13
MT		 15896+
15897+#ifdef CONFIG_X86_32
15898+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15899+ mm->context.user_cs_base = 0UL;
15900+ mm->context.user_cs_limit = ~0UL;
15901+
15902+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15903+ cpus_clear(mm->context.cpu_user_cs_mask);
15904+#endif
15905+
15906+#endif
15907+#endif
15908+
15909+ }
15910+
15911 return retval;
15912 }
15913
df50ba0c 15914@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
58c5fc13
MT		 15915 }
15916 }
15917
15918+#ifdef CONFIG_PAX_SEGMEXEC
15919+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15920+ error = -EINVAL;
15921+ goto out_unlock;
15922+ }
15923+#endif
15924+
15925 fill_ldt(&ldt, &ldt_info);
15926 if (oldmode)
15927 ldt.avl = 0;
66a7e928
MT		 15928diff -urNp linux-2.6.39/arch/x86/kernel/machine_kexec_32.c linux-2.6.39/arch/x86/kernel/machine_kexec_32.c
15929--- linux-2.6.39/arch/x86/kernel/machine_kexec_32.c 2011-05-19 00:06:34.000000000 -0400
15930+++ linux-2.6.39/arch/x86/kernel/machine_kexec_32.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 15931@@ -27,7 +27,7 @@
58c5fc13 15932 #include <asm/cacheflush.h>
ae4e228f 15933 #include <asm/debugreg.h>
58c5fc13
MT		 15934
15935-static void set_idt(void *newidt, __u16 limit)
15936+static void set_idt(struct desc_struct *newidt, __u16 limit)
15937 {
15938 struct desc_ptr curidt;
15939
ae4e228f 15940@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
58c5fc13
MT		 15941 }
15942
15943
15944-static void set_gdt(void *newgdt, __u16 limit)
15945+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15946 {
15947 struct desc_ptr curgdt;
15948
15949@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15950 }
15951
15952 control_page = page_address(image->control_code_page);
15953- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15954+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15955
15956 relocate_kernel_ptr = control_page;
15957 page_list[PA_CONTROL_PAGE] = __pa(control_page);
66a7e928
MT		 15958diff -urNp linux-2.6.39/arch/x86/kernel/microcode_amd.c linux-2.6.39/arch/x86/kernel/microcode_amd.c
15959--- linux-2.6.39/arch/x86/kernel/microcode_amd.c 2011-05-19 00:06:34.000000000 -0400
15960+++ linux-2.6.39/arch/x86/kernel/microcode_amd.c 2011-05-22 19:36:30.000000000 -0400
15961@@ -339,7 +339,7 @@ static void microcode_fini_cpu_amd(int c
ae4e228f
MT		 15962 uci->mc = NULL;
15963 }
15964
15965-static struct microcode_ops microcode_amd_ops = {
15966+static const struct microcode_ops microcode_amd_ops = {
15967 .request_microcode_user = request_microcode_user,
66a7e928 15968 .request_microcode_fw = request_microcode_amd,
ae4e228f 15969 .collect_cpu_info = collect_cpu_info_amd,
66a7e928 15970@@ -347,7 +347,7 @@ static struct microcode_ops microcode_am
ae4e228f
MT		 15971 .microcode_fini_cpu = microcode_fini_cpu_amd,
15972 };
58c5fc13 15973
ae4e228f
MT		 15974-struct microcode_ops * __init init_amd_microcode(void)
15975+const struct microcode_ops * __init init_amd_microcode(void)
15976 {
15977 return &microcode_amd_ops;
15978 }
66a7e928
MT		 15979diff -urNp linux-2.6.39/arch/x86/kernel/microcode_core.c linux-2.6.39/arch/x86/kernel/microcode_core.c
15980--- linux-2.6.39/arch/x86/kernel/microcode_core.c 2011-05-19 00:06:34.000000000 -0400
15981+++ linux-2.6.39/arch/x86/kernel/microcode_core.c 2011-05-22 19:36:30.000000000 -0400
15982@@ -93,7 +93,7 @@ MODULE_LICENSE("GPL");
ae4e228f
MT		 15983
15984 #define MICROCODE_VERSION "2.00"
15985
15986-static struct microcode_ops *microcode_ops;
15987+static const struct microcode_ops *microcode_ops;
15988
15989 /*
15990 * Synchronization.
66a7e928
MT		 15991diff -urNp linux-2.6.39/arch/x86/kernel/microcode_intel.c linux-2.6.39/arch/x86/kernel/microcode_intel.c
15992--- linux-2.6.39/arch/x86/kernel/microcode_intel.c 2011-05-19 00:06:34.000000000 -0400
15993+++ linux-2.6.39/arch/x86/kernel/microcode_intel.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 15994@@ -440,13 +440,13 @@ static enum ucode_state request_microcod
ae4e228f
MT		 15995
15996 static int get_ucode_user(void *to, const void *from, size_t n)
15997 {
15998- return copy_from_user(to, from, n);
15999+ return copy_from_user(to, (__force const void __user *)from, n);
16000 }
16001
16002 static enum ucode_state
16003 request_microcode_user(int cpu, const void __user *buf, size_t size)
16004 {
16005- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16006+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
16007 }
16008
16009 static void microcode_fini_cpu(int cpu)
bc901d79 16010@@ -457,7 +457,7 @@ static void microcode_fini_cpu(int cpu)
ae4e228f
MT		 16011 uci->mc = NULL;
16012 }
16013
16014-static struct microcode_ops microcode_intel_ops = {
16015+static const struct microcode_ops microcode_intel_ops = {
16016 .request_microcode_user = request_microcode_user,
16017 .request_microcode_fw = request_microcode_fw,
16018 .collect_cpu_info = collect_cpu_info,
bc901d79 16019@@ -465,7 +465,7 @@ static struct microcode_ops microcode_in
ae4e228f
MT		 16020 .microcode_fini_cpu = microcode_fini_cpu,
16021 };
16022
16023-struct microcode_ops * __init init_intel_microcode(void)
16024+const struct microcode_ops * __init init_intel_microcode(void)
16025 {
16026 return &microcode_intel_ops;
16027 }
66a7e928
MT		 16028diff -urNp linux-2.6.39/arch/x86/kernel/module.c linux-2.6.39/arch/x86/kernel/module.c
16029--- linux-2.6.39/arch/x86/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
16030+++ linux-2.6.39/arch/x86/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
16454cff 16031@@ -35,21 +35,66 @@
58c5fc13
MT		 16032 #define DEBUGP(fmt...)
16033 #endif
16034
16035-void *module_alloc(unsigned long size)
16454cff 16036+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
58c5fc13 16037 {
16454cff 16038 if (PAGE_ALIGN(size) > MODULES_LEN)
58c5fc13 16039 return NULL;
16454cff
MT		 16040 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
16041- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
16042+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
16043 -1, __builtin_return_address(0));
16044 }
58c5fc13 16045
58c5fc13
MT		 16046+void *module_alloc(unsigned long size)
16047+{
ae4e228f
MT		 16048+
16049+#ifdef CONFIG_PAX_KERNEXEC
58c5fc13 16050+ return __module_alloc(size, PAGE_KERNEL);
ae4e228f
MT		 16051+#else
16052+ return __module_alloc(size, PAGE_KERNEL_EXEC);
16053+#endif
16054+
16454cff
MT		 16055+}
16056+
ae4e228f 16057 /* Free memory returned from module_alloc */
16454cff
MT		 16058 void module_free(struct module *mod, void *module_region)
16059 {
ae4e228f
MT		 16060 vfree(module_region);
16061 }
16062
16063+#ifdef CONFIG_PAX_KERNEXEC
16064+#ifdef CONFIG_X86_32
58c5fc13
MT		 16065+void *module_alloc_exec(unsigned long size)
16066+{
16067+ struct vm_struct *area;
16068+
16069+ if (size == 0)
16070+ return NULL;
16071+
16072+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
ae4e228f 16073+ return area ? area->addr : NULL;
58c5fc13
MT		 16074+}
16075+EXPORT_SYMBOL(module_alloc_exec);
16076+
16077+void module_free_exec(struct module *mod, void *module_region)
16078+{
ae4e228f 16079+ vunmap(module_region);
58c5fc13
MT		 16080+}
16081+EXPORT_SYMBOL(module_free_exec);
16082+#else
58c5fc13
MT		 16083+void module_free_exec(struct module *mod, void *module_region)
16084+{
16085+ module_free(mod, module_region);
16086+}
16087+EXPORT_SYMBOL(module_free_exec);
16088+
16089+void *module_alloc_exec(unsigned long size)
16090+{
16091+ return __module_alloc(size, PAGE_KERNEL_RX);
16092+}
16093+EXPORT_SYMBOL(module_alloc_exec);
16094+#endif
58c5fc13 16095+#endif
ae4e228f
MT		 16096+
16097 /* We don't need anything special. */
16098 int module_frob_arch_sections(Elf_Ehdr *hdr,
16099 Elf_Shdr *sechdrs,
16454cff 16100@@ -69,14 +114,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
58c5fc13
MT		 16101 unsigned int i;
16102 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
16103 Elf32_Sym *sym;
16104- uint32_t *location;
16105+ uint32_t *plocation, location;
58c5fc13
MT		 16106
16107 DEBUGP("Applying relocate section %u to %u\n", relsec,
16108 sechdrs[relsec].sh_info);
16109 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
16110 /* This is where to make the change */
16111- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
16112- + rel[i].r_offset;
16113+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
16114+ location = (uint32_t)plocation;
16115+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
16116+ plocation = ktla_ktva((void *)plocation);
16117 /* This is the symbol it is referring to. Note that all
16118 undefined symbols have been resolved. */
16119 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
16454cff 16120@@ -85,11 +132,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
58c5fc13
MT		 16121 switch (ELF32_R_TYPE(rel[i].r_info)) {
16122 case R_386_32:
16123 /* We add the value into the location given */
16124- *location += sym->st_value;
ae4e228f 16125+ pax_open_kernel();
58c5fc13 16126+ *plocation += sym->st_value;
ae4e228f 16127+ pax_close_kernel();
58c5fc13
MT		 16128 break;
16129 case R_386_PC32:
16130 /* Add the value, subtract its postition */
16131- *location += sym->st_value - (uint32_t)location;
ae4e228f 16132+ pax_open_kernel();
58c5fc13 16133+ *plocation += sym->st_value - location;
ae4e228f 16134+ pax_close_kernel();
58c5fc13
MT		 16135 break;
16136 default:
16137 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
16454cff 16138@@ -145,21 +196,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
58c5fc13
MT		 16139 case R_X86_64_NONE:
16140 break;
16141 case R_X86_64_64:
ae4e228f 16142+ pax_open_kernel();
58c5fc13 16143 *(u64 *)loc = val;
ae4e228f 16144+ pax_close_kernel();
58c5fc13
MT		 16145 break;
16146 case R_X86_64_32:
ae4e228f 16147+ pax_open_kernel();
58c5fc13 16148 *(u32 *)loc = val;
ae4e228f 16149+ pax_close_kernel();
58c5fc13
MT		 16150 if (val != *(u32 *)loc)
16151 goto overflow;
16152 break;
16153 case R_X86_64_32S:
ae4e228f 16154+ pax_open_kernel();
58c5fc13 16155 *(s32 *)loc = val;
ae4e228f 16156+ pax_close_kernel();
58c5fc13
MT		 16157 if ((s64)val != *(s32 *)loc)
16158 goto overflow;
16159 break;
16160 case R_X86_64_PC32:
16161 val -= (u64)loc;
ae4e228f 16162+ pax_open_kernel();
58c5fc13 16163 *(u32 *)loc = val;
ae4e228f 16164+ pax_close_kernel();
58c5fc13
MT		 16165+
16166 #if 0
16167 if ((s64)val != *(s32 *)loc)
16168 goto overflow;
66a7e928
MT		 16169diff -urNp linux-2.6.39/arch/x86/kernel/paravirt.c linux-2.6.39/arch/x86/kernel/paravirt.c
16170--- linux-2.6.39/arch/x86/kernel/paravirt.c 2011-05-19 00:06:34.000000000 -0400
16171+++ linux-2.6.39/arch/x86/kernel/paravirt.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 16172@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
58c5fc13 16173 * corresponding structure. */
df50ba0c 16174 static void *get_call_destination(u8 type)
58c5fc13
MT		 16175 {
16176- struct paravirt_patch_template tmpl = {
16177+ const struct paravirt_patch_template tmpl = {
16178 .pv_init_ops = pv_init_ops,
16179 .pv_time_ops = pv_time_ops,
16180 .pv_cpu_ops = pv_cpu_ops,
66a7e928
MT		 16181@@ -133,6 +133,9 @@ static void *get_call_destination(u8 typ
16182 .pv_lock_ops = pv_lock_ops,
16183 #endif
16184 };
16185+
16186+ pax_track_stack();
16187+
16188 return *((void **)&tmpl + type);
16189 }
16190
16191@@ -145,14 +148,14 @@ unsigned paravirt_patch_default(u8 type,
58c5fc13 16192 if (opfunc == NULL)
df50ba0c
MT		 16193 /* If there's no function, patch it with a ud2a (BUG) */
16194 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16195- else if (opfunc == _paravirt_nop)
16196+ else if (opfunc == (void *)_paravirt_nop)
16197 /* If the operation is a nop, then nop the callsite */
16198 ret = paravirt_patch_nop();
16199
16200 /* identity functions just return their single argument */
16201- else if (opfunc == _paravirt_ident_32)
16202+ else if (opfunc == (void *)_paravirt_ident_32)
16203 ret = paravirt_patch_ident_32(insnbuf, len);
16204- else if (opfunc == _paravirt_ident_64)
16205+ else if (opfunc == (void *)_paravirt_ident_64)
16206 ret = paravirt_patch_ident_64(insnbuf, len);
16207
16208 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
66a7e928 16209@@ -178,7 +181,7 @@ unsigned paravirt_patch_insns(void *insn
58c5fc13
MT		 16210 if (insn_len > len || start == NULL)
16211 insn_len = len;
16212 else
16213- memcpy(insnbuf, start, insn_len);
16214+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16215
16216 return insn_len;
16217 }
66a7e928 16218@@ -294,22 +297,22 @@ void arch_flush_lazy_mmu_mode(void)
58c5fc13
MT		 16219 preempt_enable();
16220 }
16221
16222-struct pv_info pv_info = {
16223+struct pv_info pv_info __read_only = {
16224 .name = "bare hardware",
16225 .paravirt_enabled = 0,
16226 .kernel_rpl = 0,
16227 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16228 };
16229
16230-struct pv_init_ops pv_init_ops = {
16231+struct pv_init_ops pv_init_ops __read_only = {
16232 .patch = native_patch,
58c5fc13
MT		 16233 };
16234
16235-struct pv_time_ops pv_time_ops = {
16236+struct pv_time_ops pv_time_ops __read_only = {
ae4e228f 16237 .sched_clock = native_sched_clock,
58c5fc13
MT		 16238 };
16239
16240-struct pv_irq_ops pv_irq_ops = {
16241+struct pv_irq_ops pv_irq_ops __read_only = {
58c5fc13
MT		 16242 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16243 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
ae4e228f 16244 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
66a7e928 16245@@ -321,7 +324,7 @@ struct pv_irq_ops pv_irq_ops = {
58c5fc13
MT		 16246 #endif
16247 };
16248
16249-struct pv_cpu_ops pv_cpu_ops = {
16250+struct pv_cpu_ops pv_cpu_ops __read_only = {
16251 .cpuid = native_cpuid,
16252 .get_debugreg = native_get_debugreg,
16253 .set_debugreg = native_set_debugreg,
66a7e928 16254@@ -382,7 +385,7 @@ struct pv_cpu_ops pv_cpu_ops = {
58c5fc13
MT		 16255 .end_context_switch = paravirt_nop,
16256 };
16257
16258-struct pv_apic_ops pv_apic_ops = {
16259+struct pv_apic_ops pv_apic_ops __read_only = {
16260 #ifdef CONFIG_X86_LOCAL_APIC
ae4e228f
MT		 16261 .startup_ipi_hook = paravirt_nop,
16262 #endif
66a7e928 16263@@ -396,7 +399,7 @@ struct pv_apic_ops pv_apic_ops = {
58c5fc13
MT		 16264 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16265 #endif
16266
16267-struct pv_mmu_ops pv_mmu_ops = {
16268+struct pv_mmu_ops pv_mmu_ops __read_only = {
ae4e228f
MT		 16269
16270 .read_cr2 = native_read_cr2,
16271 .write_cr2 = native_write_cr2,
66a7e928 16272@@ -465,6 +468,12 @@ struct pv_mmu_ops pv_mmu_ops = {
ae4e228f
MT		 16273 },
16274
16275 .set_fixmap = native_set_fixmap,
16276+
16277+#ifdef CONFIG_PAX_KERNEXEC
16278+ .pax_open_kernel = native_pax_open_kernel,
16279+ .pax_close_kernel = native_pax_close_kernel,
16280+#endif
16281+
16282 };
16283
16284 EXPORT_SYMBOL_GPL(pv_time_ops);
66a7e928
MT		 16285diff -urNp linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c
16286--- linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c 2011-05-19 00:06:34.000000000 -0400
16287+++ linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 16288@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
16289 arch_spin_lock(lock);
16290 }
16291
16292-struct pv_lock_ops pv_lock_ops = {
16293+struct pv_lock_ops pv_lock_ops __read_only = {
16294 #ifdef CONFIG_SMP
16295 .spin_is_locked = __ticket_spin_is_locked,
16296 .spin_is_contended = __ticket_spin_is_contended,
66a7e928
MT		 16297diff -urNp linux-2.6.39/arch/x86/kernel/pci-calgary_64.c linux-2.6.39/arch/x86/kernel/pci-calgary_64.c
16298--- linux-2.6.39/arch/x86/kernel/pci-calgary_64.c 2011-05-19 00:06:34.000000000 -0400
16299+++ linux-2.6.39/arch/x86/kernel/pci-calgary_64.c 2011-05-22 19:36:30.000000000 -0400
16300@@ -179,13 +179,13 @@ static void calioc2_dump_error_regs(stru
16301 static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl);
16302 static void get_tce_space_from_tar(void);
16303
16304-static struct cal_chipset_ops calgary_chip_ops = {
16305+static const struct cal_chipset_ops calgary_chip_ops = {
16306 .handle_quirks = calgary_handle_quirks,
16307 .tce_cache_blast = calgary_tce_cache_blast,
16308 .dump_error_regs = calgary_dump_error_regs
16309 };
16310
16311-static struct cal_chipset_ops calioc2_chip_ops = {
16312+static const struct cal_chipset_ops calioc2_chip_ops = {
16313 .handle_quirks = calioc2_handle_quirks,
16314 .tce_cache_blast = calioc2_tce_cache_blast,
16315 .dump_error_regs = calioc2_dump_error_regs
bc901d79 16316@@ -476,7 +476,7 @@ static void calgary_free_coherent(struct
ae4e228f
MT		 16317 free_pages((unsigned long)vaddr, get_order(size));
16318 }
16319
16320-static struct dma_map_ops calgary_dma_ops = {
16321+static const struct dma_map_ops calgary_dma_ops = {
16322 .alloc_coherent = calgary_alloc_coherent,
16323 .free_coherent = calgary_free_coherent,
16324 .map_sg = calgary_map_sg,
66a7e928
MT		 16325diff -urNp linux-2.6.39/arch/x86/kernel/pci-dma.c linux-2.6.39/arch/x86/kernel/pci-dma.c
16326--- linux-2.6.39/arch/x86/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
16327+++ linux-2.6.39/arch/x86/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 16328@@ -16,7 +16,7 @@
ae4e228f
MT		 16329
16330 static int forbid_dac __read_mostly;
16331
16332-struct dma_map_ops *dma_ops = &nommu_dma_ops;
16333+const struct dma_map_ops *dma_ops = &nommu_dma_ops;
16334 EXPORT_SYMBOL(dma_ops);
16335
16336 static int iommu_sac_force __read_mostly;
bc901d79 16337@@ -250,7 +250,7 @@ early_param("iommu", iommu_setup);
ae4e228f
MT		 16338
16339 int dma_supported(struct device *dev, u64 mask)
16340 {
16341- struct dma_map_ops *ops = get_dma_ops(dev);
16342+ const struct dma_map_ops *ops = get_dma_ops(dev);
16343
16344 #ifdef CONFIG_PCI
16345 if (mask > 0xffffffff && forbid_dac > 0) {
66a7e928
MT		 16346diff -urNp linux-2.6.39/arch/x86/kernel/pci-gart_64.c linux-2.6.39/arch/x86/kernel/pci-gart_64.c
16347--- linux-2.6.39/arch/x86/kernel/pci-gart_64.c 2011-05-19 00:06:34.000000000 -0400
16348+++ linux-2.6.39/arch/x86/kernel/pci-gart_64.c 2011-05-22 19:36:30.000000000 -0400
16349@@ -695,7 +695,7 @@ static __init int init_amd_gatt(struct a
ae4e228f
MT		 16350 return -1;
16351 }
16352
16353-static struct dma_map_ops gart_dma_ops = {
16354+static const struct dma_map_ops gart_dma_ops = {
16355 .map_sg = gart_map_sg,
16356 .unmap_sg = gart_unmap_sg,
16357 .map_page = gart_map_page,
66a7e928
MT		 16358diff -urNp linux-2.6.39/arch/x86/kernel/pci-iommu_table.c linux-2.6.39/arch/x86/kernel/pci-iommu_table.c
16359--- linux-2.6.39/arch/x86/kernel/pci-iommu_table.c 2011-05-19 00:06:34.000000000 -0400
16360+++ linux-2.6.39/arch/x86/kernel/pci-iommu_table.c 2011-05-22 19:36:30.000000000 -0400
16361@@ -2,7 +2,7 @@
16362 #include <asm/iommu_table.h>
16363 #include <linux/string.h>
16364 #include <linux/kallsyms.h>
16365-
16366+#include <linux/sched.h>
16367
16368 #define DEBUG 1
16369
16370@@ -53,6 +53,8 @@ void __init check_iommu_entries(struct i
16371 char sym_p[KSYM_SYMBOL_LEN];
16372 char sym_q[KSYM_SYMBOL_LEN];
16373
16374+ pax_track_stack();
16375+
16376 /* Simple cyclic dependency checker. */
16377 for (p = start; p < finish; p++) {
16378 q = find_dependents_of(start, finish, p);
16379diff -urNp linux-2.6.39/arch/x86/kernel/pci-nommu.c linux-2.6.39/arch/x86/kernel/pci-nommu.c
16380--- linux-2.6.39/arch/x86/kernel/pci-nommu.c 2011-05-19 00:06:34.000000000 -0400
16381+++ linux-2.6.39/arch/x86/kernel/pci-nommu.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 16382@@ -95,7 +95,7 @@ static void nommu_sync_sg_for_device(str
ae4e228f
MT		 16383 flush_write_buffers();
16384 }
16385
16386-struct dma_map_ops nommu_dma_ops = {
16387+const struct dma_map_ops nommu_dma_ops = {
16388 .alloc_coherent = dma_generic_alloc_coherent,
16389 .free_coherent = nommu_free_coherent,
16390 .map_sg = nommu_map_sg,
66a7e928
MT		 16391diff -urNp linux-2.6.39/arch/x86/kernel/pci-swiotlb.c linux-2.6.39/arch/x86/kernel/pci-swiotlb.c
16392--- linux-2.6.39/arch/x86/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
16393+++ linux-2.6.39/arch/x86/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 16394@@ -26,7 +26,7 @@ static void *x86_swiotlb_alloc_coherent(
ae4e228f
MT		 16395 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16396 }
16397
16398-static struct dma_map_ops swiotlb_dma_ops = {
16399+static const struct dma_map_ops swiotlb_dma_ops = {
16400 .mapping_error = swiotlb_dma_mapping_error,
16401 .alloc_coherent = x86_swiotlb_alloc_coherent,
16402 .free_coherent = swiotlb_free_coherent,
66a7e928
MT		 16403diff -urNp linux-2.6.39/arch/x86/kernel/process_32.c linux-2.6.39/arch/x86/kernel/process_32.c
16404--- linux-2.6.39/arch/x86/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
16405+++ linux-2.6.39/arch/x86/kernel/process_32.c 2011-05-22 19:36:30.000000000 -0400
16454cff 16406@@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
57199397
MT		 16407 unsigned long thread_saved_pc(struct task_struct *tsk)
16408 {
16409 return ((unsigned long *)tsk->thread.sp)[3];
16410+//XXX return tsk->thread.eip;
16411 }
16412
16413 #ifndef CONFIG_SMP
16454cff 16414@@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
57199397
MT		 16415 unsigned long sp;
16416 unsigned short ss, gs;
16417
16418- if (user_mode_vm(regs)) {
16419+ if (user_mode(regs)) {
16420 sp = regs->sp;
16421 ss = regs->ss & 0xffff;
bc901d79
MT		 16422- gs = get_user_gs(regs);
16423 } else {
16424 sp = kernel_stack_pointer(regs);
16425 savesegment(ss, ss);
16426- savesegment(gs, gs);
16427 }
16428+ gs = get_user_gs(regs);
16429
16430 show_regs_common();
16431
66a7e928 16432@@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
57199397
MT		 16433 struct task_struct *tsk;
16434 int err;
16435
16436- childregs = task_pt_regs(p);
16437+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16438 *childregs = *regs;
16439 childregs->ax = 0;
16440 childregs->sp = sp;
66a7e928
MT		 16441
16442 p->thread.sp = (unsigned long) childregs;
16443 p->thread.sp0 = (unsigned long) (childregs+1);
16444+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16445
16446 p->thread.ip = (unsigned long) ret_from_fork;
16447
16448@@ -293,7 +294,7 @@ __switch_to(struct task_struct *prev_p,
57199397
MT		 16449 struct thread_struct *prev = &prev_p->thread,
16450 *next = &next_p->thread;
16451 int cpu = smp_processor_id();
16452- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16453+ struct tss_struct *tss = init_tss + cpu;
16454 bool preload_fpu;
16455
16456 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
66a7e928 16457@@ -328,6 +329,10 @@ __switch_to(struct task_struct *prev_p,
57199397
MT		 16458 */
16459 lazy_save_gs(prev->gs);
16460
16461+#ifdef CONFIG_PAX_MEMORY_UDEREF
bc901d79 16462+ __set_fs(task_thread_info(next_p)->addr_limit);
57199397
MT		 16463+#endif
16464+
16465 /*
16466 * Load the per-thread Thread-Local Storage descriptor.
16467 */
66a7e928 16468@@ -363,6 +368,9 @@ __switch_to(struct task_struct *prev_p,
71d190be
MT		 16469 */
16470 arch_end_context_switch(next_p);
57199397 16471
71d190be
MT		 16472+ percpu_write(current_task, next_p);
16473+ percpu_write(current_tinfo, &next_p->tinfo);
57199397 16474+
71d190be
MT		 16475 if (preload_fpu)
16476 __math_state_restore();
16477
66a7e928 16478@@ -372,8 +380,6 @@ __switch_to(struct task_struct *prev_p,
71d190be
MT		 16479 if (prev->gs | next->gs)
16480 lazy_load_gs(next->gs);
16481
16482- percpu_write(current_task, next_p);
16483-
16484 return prev_p;
16485 }
16486
66a7e928 16487@@ -403,4 +409,3 @@ unsigned long get_wchan(struct task_stru
71d190be
MT		 16488 } while (count++ < 16);
16489 return 0;
16490 }
16491-
66a7e928
MT		 16492diff -urNp linux-2.6.39/arch/x86/kernel/process_64.c linux-2.6.39/arch/x86/kernel/process_64.c
16493--- linux-2.6.39/arch/x86/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
16494+++ linux-2.6.39/arch/x86/kernel/process_64.c 2011-05-22 19:36:30.000000000 -0400
16454cff 16495@@ -87,7 +87,7 @@ static void __exit_idle(void)
57199397
MT		 16496 void exit_idle(void)
16497 {
16498 /* idle loop has pid 0 */
16499- if (current->pid)
16500+ if (task_pid_nr(current))
16501 return;
16502 __exit_idle();
16503 }
71d190be
MT		 16504@@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
16505 struct pt_regs *childregs;
16506 struct task_struct *me = current;
16507
16508- childregs = ((struct pt_regs *)
16509- (THREAD_SIZE + task_stack_page(p))) - 1;
66a7e928 16510+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
71d190be
MT		 16511 *childregs = *regs;
16512
16513 childregs->ax = 0;
66a7e928
MT		 16514@@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
16515 p->thread.sp = (unsigned long) childregs;
16516 p->thread.sp0 = (unsigned long) (childregs+1);
16517 p->thread.usersp = me->thread.usersp;
16518+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16519
16520 set_tsk_thread_flag(p, TIF_FORK);
16521
16522@@ -376,7 +376,7 @@ __switch_to(struct task_struct *prev_p,
57199397
MT		 16523 struct thread_struct *prev = &prev_p->thread;
16524 struct thread_struct *next = &next_p->thread;
16525 int cpu = smp_processor_id();
16526- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16527+ struct tss_struct *tss = init_tss + cpu;
16528 unsigned fsindex, gsindex;
16529 bool preload_fpu;
16530
66a7e928 16531@@ -472,10 +472,9 @@ __switch_to(struct task_struct *prev_p,
71d190be
MT		 16532 prev->usersp = percpu_read(old_rsp);
16533 percpu_write(old_rsp, next->usersp);
16534 percpu_write(current_task, next_p);
16535+ percpu_write(current_tinfo, &next_p->tinfo);
16536
16537- percpu_write(kernel_stack,
16538- (unsigned long)task_stack_page(next_p) +
16539- THREAD_SIZE - KERNEL_STACK_OFFSET);
16540+ percpu_write(kernel_stack, next->sp0);
16541
16542 /*
16543 * Now maybe reload the debug registers and handle I/O bitmaps
66a7e928 16544@@ -537,12 +536,11 @@ unsigned long get_wchan(struct task_stru
57199397
MT		 16545 if (!p || p == current || p->state == TASK_RUNNING)
16546 return 0;
16547 stack = (unsigned long)task_stack_page(p);
16548- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
66a7e928 16549+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
57199397
MT		 16550 return 0;
16551 fp = *(u64 *)(p->thread.sp);
16552 do {
16553- if (fp < (unsigned long)stack ||
16554- fp >= (unsigned long)stack+THREAD_SIZE)
66a7e928 16555+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
57199397
MT		 16556 return 0;
16557 ip = *(u64 *)(fp+8);
16558 if (!in_sched_functions(ip))
66a7e928
MT		 16559diff -urNp linux-2.6.39/arch/x86/kernel/process.c linux-2.6.39/arch/x86/kernel/process.c
16560--- linux-2.6.39/arch/x86/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
16561+++ linux-2.6.39/arch/x86/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 16562@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
16563
16564 void free_thread_info(struct thread_info *ti)
16565 {
16566- free_thread_xstate(ti->task);
16567 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16568 }
16569
16570+static struct kmem_cache *task_struct_cachep;
16571+
16572 void arch_task_cache_init(void)
16573 {
16574- task_xstate_cachep =
16575- kmem_cache_create("task_xstate", xstate_size,
16576+ /* create a slab on which task_structs can be allocated */
16577+ task_struct_cachep =
16578+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16579+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16580+
16581+ task_xstate_cachep =
16582+ kmem_cache_create("task_xstate", xstate_size,
16583 __alignof__(union thread_xstate),
16584- SLAB_PANIC | SLAB_NOTRACK, NULL);
16585+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16586+}
16587+
66a7e928 16588+struct task_struct *alloc_task_struct_node(int node)
71d190be 16589+{
66a7e928 16590+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
71d190be
MT		 16591+}
16592+
16593+void free_task_struct(struct task_struct *task)
16594+{
16595+ free_thread_xstate(task);
16596+ kmem_cache_free(task_struct_cachep, task);
16597 }
16598
16599 /*
16600@@ -70,7 +87,7 @@ void exit_thread(void)
efbe55a5
MT		 16601 unsigned long *bp = t->io_bitmap_ptr;
16602
16603 if (bp) {
16604- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16605+ struct tss_struct *tss = init_tss + get_cpu();
16606
16607 t->io_bitmap_ptr = NULL;
16608 clear_thread_flag(TIF_IO_BITMAP);
71d190be 16609@@ -106,7 +123,7 @@ void show_regs_common(void)
efbe55a5
MT		 16610
16611 printk(KERN_CONT "\n");
ea610fa8 16612 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
efbe55a5
MT		 16613- current->pid, current->comm, print_tainted(),
16614+ task_pid_nr(current), current->comm, print_tainted(),
16615 init_utsname()->release,
16616 (int)strcspn(init_utsname()->version, " "),
c52201e0 16617 init_utsname()->version);
66a7e928 16618@@ -120,6 +137,9 @@ void flush_thread(void)
efbe55a5
MT		 16619 {
16620 struct task_struct *tsk = current;
16621
bc901d79 16622+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
efbe55a5
MT		 16623+ loadsegment(gs, 0);
16624+#endif
16625 flush_ptrace_hw_breakpoint(tsk);
16626 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16627 /*
66a7e928 16628@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
efbe55a5
MT		 16629 regs.di = (unsigned long) arg;
16630
16631 #ifdef CONFIG_X86_32
16632- regs.ds = __USER_DS;
16633- regs.es = __USER_DS;
16634+ regs.ds = __KERNEL_DS;
16635+ regs.es = __KERNEL_DS;
16636 regs.fs = __KERNEL_PERCPU;
bc901d79
MT		 16637- regs.gs = __KERNEL_STACK_CANARY;
16638+ savesegment(gs, regs.gs);
efbe55a5 16639 #else
bc901d79
MT		 16640 regs.ss = __KERNEL_DS;
16641 #endif
66a7e928
MT		 16642@@ -401,7 +421,7 @@ void default_idle(void)
16643 EXPORT_SYMBOL(default_idle);
16644 #endif
16645
16646-void stop_this_cpu(void *dummy)
16647+__noreturn void stop_this_cpu(void *dummy)
16648 {
16649 local_irq_disable();
16650 /*
16651@@ -665,16 +685,34 @@ static int __init idle_setup(char *str)
efbe55a5
MT		 16652 }
16653 early_param("idle", idle_setup);
71d190be 16654
efbe55a5 16655-unsigned long arch_align_stack(unsigned long sp)
71d190be
MT		 16656+#ifdef CONFIG_PAX_RANDKSTACK
16657+asmlinkage void pax_randomize_kstack(void)
16658 {
efbe55a5
MT		 16659- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16660- sp -= get_random_int() % 8192;
16661- return sp & ~0xf;
16662-}
71d190be
MT		 16663+ struct thread_struct *thread = &current->thread;
16664+ unsigned long time;
16665
efbe55a5
MT		 16666-unsigned long arch_randomize_brk(struct mm_struct *mm)
16667-{
16668- unsigned long range_end = mm->brk + 0x02000000;
16669- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16670-}
71d190be
MT		 16671+ if (!randomize_va_space)
16672+ return;
16673+
16674+ rdtscl(time);
16675+
16676+ /* P4 seems to return a 0 LSB, ignore it */
16677+#ifdef CONFIG_MPENTIUM4
66a7e928 16678+ time &= 0x3EUL;
71d190be 16679+ time <<= 2;
66a7e928 16680+#elif defined(CONFIG_X86_64)
71d190be 16681+ time &= 0xFUL;
66a7e928
MT		 16682+ time <<= 4;
16683+#else
16684+ time &= 0x1FUL;
71d190be
MT		 16685+ time <<= 3;
16686+#endif
16687+
16688+ thread->sp0 ^= time;
16689+ load_sp0(init_tss + smp_processor_id(), thread);
16690
16691+#ifdef CONFIG_X86_64
16692+ percpu_write(kernel_stack, thread->sp0);
16693+#endif
16694+}
16695+#endif
66a7e928
MT		 16696diff -urNp linux-2.6.39/arch/x86/kernel/ptrace.c linux-2.6.39/arch/x86/kernel/ptrace.c
16697--- linux-2.6.39/arch/x86/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
16698+++ linux-2.6.39/arch/x86/kernel/ptrace.c 2011-05-22 19:36:30.000000000 -0400
16699@@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
bc901d79 16700 unsigned long addr, unsigned long data)
ae4e228f
MT		 16701 {
16702 int ret;
16703- unsigned long __user *datap = (unsigned long __user *)data;
16704+ unsigned long __user *datap = (__force unsigned long __user *)data;
16705
16706 switch (request) {
16707 /* read the word at location addr in the USER area. */
66a7e928 16708@@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
bc901d79 16709 if ((int) addr < 0)
ae4e228f
MT		 16710 return -EIO;
16711 ret = do_get_thread_area(child, addr,
bc901d79
MT		 16712- (struct user_desc __user *)data);
16713+ (__force struct user_desc __user *) data);
ae4e228f
MT		 16714 break;
16715
16716 case PTRACE_SET_THREAD_AREA:
bc901d79 16717 if ((int) addr < 0)
ae4e228f
MT		 16718 return -EIO;
16719 ret = do_set_thread_area(child, addr,
bc901d79
MT		 16720- (struct user_desc __user *)data, 0);
16721+ (__force struct user_desc __user *) data, 0);
ae4e228f
MT		 16722 break;
16723 #endif
16724
66a7e928 16725@@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
ae4e228f
MT		 16726 memset(info, 0, sizeof(*info));
16727 info->si_signo = SIGTRAP;
16728 info->si_code = si_code;
16729- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16730+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16731 }
16732
16733 void user_single_step_siginfo(struct task_struct *tsk,
66a7e928 16734@@ -1363,7 +1363,7 @@ void send_sigtrap(struct task_struct *ts
16454cff
MT		 16735 * We must return the syscall number to actually look up in the table.
16736 * This can be -1L to skip running any syscall at all.
16737 */
16738-asmregparm long syscall_trace_enter(struct pt_regs *regs)
16739+long syscall_trace_enter(struct pt_regs *regs)
16740 {
16741 long ret = 0;
16742
66a7e928 16743@@ -1408,7 +1408,7 @@ asmregparm long syscall_trace_enter(stru
16454cff
MT		 16744 return ret ?: regs->orig_ax;
16745 }
16746
16747-asmregparm void syscall_trace_leave(struct pt_regs *regs)
16748+void syscall_trace_leave(struct pt_regs *regs)
16749 {
16750 bool step;
16751
66a7e928
MT		 16752diff -urNp linux-2.6.39/arch/x86/kernel/pvclock.c linux-2.6.39/arch/x86/kernel/pvclock.c
16753--- linux-2.6.39/arch/x86/kernel/pvclock.c 2011-05-19 00:06:34.000000000 -0400
16754+++ linux-2.6.39/arch/x86/kernel/pvclock.c 2011-05-22 19:36:30.000000000 -0400
16755@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
16756 return pv_tsc_khz;
16757 }
16758
16759-static atomic64_t last_value = ATOMIC64_INIT(0);
16760+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16761
16762 void pvclock_resume(void)
16763 {
16764- atomic64_set(&last_value, 0);
16765+ atomic64_set_unchecked(&last_value, 0);
16766 }
16767
16768 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16769@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
16770 * updating at the same time, and one of them could be slightly behind,
16771 * making the assumption that last_value always go forward fail to hold.
16772 */
16773- last = atomic64_read(&last_value);
16774+ last = atomic64_read_unchecked(&last_value);
16775 do {
16776 if (ret < last)
16777 return last;
16778- last = atomic64_cmpxchg(&last_value, last, ret);
16779+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16780 } while (unlikely(last != ret));
16781
16782 return ret;
16783diff -urNp linux-2.6.39/arch/x86/kernel/reboot.c linux-2.6.39/arch/x86/kernel/reboot.c
16784--- linux-2.6.39/arch/x86/kernel/reboot.c 2011-05-19 00:06:34.000000000 -0400
16785+++ linux-2.6.39/arch/x86/kernel/reboot.c 2011-05-23 17:07:00.000000000 -0400
16786@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
58c5fc13
MT		 16787 EXPORT_SYMBOL(pm_power_off);
16788
16789 static const struct desc_ptr no_idt = {};
16790-static int reboot_mode;
16791+static unsigned short reboot_mode;
16792 enum reboot_type reboot_type = BOOT_KBD;
16793 int reboot_force;
16794
66a7e928
MT		 16795@@ -307,13 +307,17 @@ core_initcall(reboot_init);
16796 extern const unsigned char machine_real_restart_asm[];
16797 extern const u64 machine_real_restart_gdt[3];
16798
16799-void machine_real_restart(unsigned int type)
16800+__noreturn void machine_real_restart(unsigned int type)
58c5fc13 16801 {
66a7e928
MT		 16802 void *restart_va;
16803 unsigned long restart_pa;
16804- void (*restart_lowmem)(unsigned int);
16805+ void (* __noreturn restart_lowmem)(unsigned int);
16806 u64 *lowmem_gdt;
16807
16808+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16809+ struct desc_struct *gdt;
16810+#endif
16811+
58c5fc13
MT		 16812 local_irq_disable();
16813
66a7e928
MT		 16814 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16815@@ -339,14 +343,14 @@ void machine_real_restart(unsigned int t
58c5fc13
MT		 16816 boot)". This seems like a fairly standard thing that gets set by
16817 REBOOT.COM programs, and the previous reset routine did this
16818 too. */
16819- *((unsigned short *)0x472) = reboot_mode;
16820+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16821
66a7e928
MT		 16822 /* Patch the GDT in the low memory trampoline */
16823 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16824
16825 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16826 restart_pa = virt_to_phys(restart_va);
16827- restart_lowmem = (void (*)(unsigned int))restart_pa;
16828+ restart_lowmem = (void *)restart_pa;
16829
16830 /* GDT[0]: GDT self-pointer */
16831 lowmem_gdt[0] =
16832@@ -357,7 +361,33 @@ void machine_real_restart(unsigned int t
16833 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16834
16835 /* Jump to the identity-mapped low memory code */
16836+
16837+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16838+ gdt = get_cpu_gdt_table(smp_processor_id());
16839+ pax_open_kernel();
16840+#ifdef CONFIG_PAX_MEMORY_UDEREF
16841+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16842+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16843+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16844+#endif
16845+#ifdef CONFIG_PAX_KERNEXEC
16846+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16847+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16848+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16849+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16850+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16851+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16852+#endif
16853+ pax_close_kernel();
16854+#endif
16855+
16856+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16857+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16858+ unreachable();
16859+#else
16860 restart_lowmem(type);
16861+#endif
16862+
16863 }
16864 #ifdef CONFIG_APM_MODULE
16865 EXPORT_SYMBOL(machine_real_restart);
16866@@ -478,7 +508,7 @@ void __attribute__((weak)) mach_reboot_f
16867 {
16868 }
16869
16870-static void native_machine_emergency_restart(void)
16871+__noreturn static void native_machine_emergency_restart(void)
16872 {
16873 int i;
16874
16875@@ -593,13 +623,13 @@ void native_machine_shutdown(void)
16876 #endif
16877 }
16878
16879-static void __machine_emergency_restart(int emergency)
16880+static __noreturn void __machine_emergency_restart(int emergency)
16881 {
16882 reboot_emergency = emergency;
16883 machine_ops.emergency_restart();
16884 }
16885
16886-static void native_machine_restart(char *__unused)
16887+static __noreturn void native_machine_restart(char *__unused)
16888 {
16889 printk("machine restart\n");
16890
16891@@ -608,7 +638,7 @@ static void native_machine_restart(char
16892 __machine_emergency_restart(0);
16893 }
16894
16895-static void native_machine_halt(void)
16896+static __noreturn void native_machine_halt(void)
16897 {
16898 /* stop other cpus and apics */
16899 machine_shutdown();
16900@@ -619,7 +649,7 @@ static void native_machine_halt(void)
16901 stop_this_cpu(NULL);
16902 }
16903
16904-static void native_machine_power_off(void)
16905+__noreturn static void native_machine_power_off(void)
16906 {
16907 if (pm_power_off) {
16908 if (!reboot_force)
16909@@ -628,6 +658,7 @@ static void native_machine_power_off(voi
16910 }
16911 /* a fallback in case there is no PM info available */
16912 tboot_shutdown(TB_SHUTDOWN_HALT);
16913+ unreachable();
16914 }
16915
16916 struct machine_ops machine_ops = {
16917diff -urNp linux-2.6.39/arch/x86/kernel/setup.c linux-2.6.39/arch/x86/kernel/setup.c
16918--- linux-2.6.39/arch/x86/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
16919+++ linux-2.6.39/arch/x86/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
16920@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
efbe55a5
MT		 16921 * area (640->1Mb) as ram even though it is not.
16922 * take them out.
16923 */
16924- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16925+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16926 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16927 }
16928
66a7e928 16929@@ -775,14 +775,14 @@ void __init setup_arch(char **cmdline_p)
58c5fc13
MT		 16930
16931 if (!boot_params.hdr.root_flags)
16932 root_mountflags &= ~MS_RDONLY;
16933- init_mm.start_code = (unsigned long) _text;
16934- init_mm.end_code = (unsigned long) _etext;
16935+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16936+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16937 init_mm.end_data = (unsigned long) _edata;
16938 init_mm.brk = _brk_end;
16939
16940- code_resource.start = virt_to_phys(_text);
16941- code_resource.end = virt_to_phys(_etext)-1;
16942- data_resource.start = virt_to_phys(_etext);
16943+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16944+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16945+ data_resource.start = virt_to_phys(_sdata);
16946 data_resource.end = virt_to_phys(_edata)-1;
16947 bss_resource.start = virt_to_phys(&__bss_start);
16948 bss_resource.end = virt_to_phys(&__bss_stop)-1;
66a7e928
MT		 16949diff -urNp linux-2.6.39/arch/x86/kernel/setup_percpu.c linux-2.6.39/arch/x86/kernel/setup_percpu.c
16950--- linux-2.6.39/arch/x86/kernel/setup_percpu.c 2011-05-19 00:06:34.000000000 -0400
16951+++ linux-2.6.39/arch/x86/kernel/setup_percpu.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 16952@@ -21,19 +21,17 @@
16953 #include <asm/cpu.h>
16954 #include <asm/stackprotector.h>
58c5fc13 16955
6892158b 16956-DEFINE_PER_CPU(int, cpu_number);
58c5fc13 16957+#ifdef CONFIG_SMP
6892158b 16958+DEFINE_PER_CPU(unsigned int, cpu_number);
58c5fc13
MT		 16959 EXPORT_PER_CPU_SYMBOL(cpu_number);
16960+#endif
16961
16962-#ifdef CONFIG_X86_64
16963 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16964-#else
16965-#define BOOT_PERCPU_OFFSET 0
16966-#endif
16967
16968 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16969 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16970
16971-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16972+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16973 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16974 };
16975 EXPORT_SYMBOL(__per_cpu_offset);
bc901d79 16976@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
58c5fc13
MT		 16977 {
16978 #ifdef CONFIG_X86_32
ae4e228f
MT		 16979 struct desc_struct gdt;
16980+ unsigned long base = per_cpu_offset(cpu);
16981
58c5fc13
MT		 16982- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16983- 0x2 | DESCTYPE_S, 0x8);
16984- gdt.s = 1;
ae4e228f
MT		 16985+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16986+ 0x83 | DESCTYPE_S, 0xC);
16987 write_gdt_entry(get_cpu_gdt_table(cpu),
16988 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
58c5fc13 16989 #endif
bc901d79 16990@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
58c5fc13
MT		 16991 /* alrighty, percpu areas up and running */
16992 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16993 for_each_possible_cpu(cpu) {
16994+#ifdef CONFIG_CC_STACKPROTECTOR
16995+#ifdef CONFIG_x86_32
16996+ unsigned long canary = per_cpu(stack_canary, cpu);
16997+#endif
16998+#endif
ae4e228f 16999 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
58c5fc13
MT		 17000 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17001 per_cpu(cpu_number, cpu) = cpu;
66a7e928
MT		 17002@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
17003 */
57199397 17004 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
58c5fc13 17005 #endif
58c5fc13
MT		 17006+#ifdef CONFIG_CC_STACKPROTECTOR
17007+#ifdef CONFIG_x86_32
17008+ if (cpu == boot_cpu_id)
17009+ per_cpu(stack_canary, cpu) = canary;
17010+#endif
17011+#endif
17012 /*
57199397 17013 * Up to this point, the boot CPU has been using .init.data
58c5fc13 17014 * area. Reload any changed state for the boot CPU.
66a7e928
MT		 17015diff -urNp linux-2.6.39/arch/x86/kernel/signal.c linux-2.6.39/arch/x86/kernel/signal.c
17016--- linux-2.6.39/arch/x86/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
17017+++ linux-2.6.39/arch/x86/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
ae4e228f 17018@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
58c5fc13
MT		 17019 * Align the stack pointer according to the i386 ABI,
17020 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17021 */
17022- sp = ((sp + 4) & -16ul) - 4;
17023+ sp = ((sp - 12) & -16ul) - 4;
17024 #else /* !CONFIG_X86_32 */
17025 sp = round_down(sp, 16) - 8;
17026 #endif
ae4e228f
MT		 17027@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
17028 * Return an always-bogus address instead so we will die with SIGSEGV.
17029 */
17030 if (onsigstack && !likely(on_sig_stack(sp)))
17031- return (void __user *)-1L;
17032+ return (__force void __user *)-1L;
17033
17034 /* save i387 state */
17035 if (used_math() && save_i387_xstate(*fpstate) < 0)
17036- return (void __user *)-1L;
17037+ return (__force void __user *)-1L;
17038
17039 return (void __user *)sp;
17040 }
17041@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
58c5fc13
MT		 17042 }
17043
17044 if (current->mm->context.vdso)
17045- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
ae4e228f 17046+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
58c5fc13
MT		 17047 else
17048- restorer = &frame->retcode;
17049+ restorer = (void __user *)&frame->retcode;
17050 if (ka->sa.sa_flags & SA_RESTORER)
17051 restorer = ka->sa.sa_restorer;
17052
ae4e228f
MT		 17053@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
17054 * reasons and because gdb uses it as a signature to notice
17055 * signal handler stack frames.
17056 */
17057- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17058+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17059
17060 if (err)
17061 return -EFAULT;
6892158b 17062@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
58c5fc13
MT		 17063 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17064
17065 /* Set up to return from userspace. */
17066- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
6892158b
MT		 17067+ if (current->mm->context.vdso)
17068+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17069+ else
17070+ restorer = (void __user *)&frame->retcode;
58c5fc13
MT		 17071 if (ka->sa.sa_flags & SA_RESTORER)
17072 restorer = ka->sa.sa_restorer;
17073 put_user_ex(restorer, &frame->pretcode);
6892158b 17074@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
ae4e228f
MT		 17075 * reasons and because gdb uses it as a signature to notice
17076 * signal handler stack frames.
17077 */
17078- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17079+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17080 } put_user_catch(err);
17081
17082 if (err)
66a7e928
MT		 17083@@ -773,6 +776,8 @@ static void do_signal(struct pt_regs *re
17084 int signr;
17085 sigset_t *oldset;
17086
17087+ pax_track_stack();
17088+
17089 /*
17090 * We want the common case to go fast, which is why we may in certain
17091 * cases get here from kernel mode. Just return without doing anything
17092@@ -780,7 +785,7 @@ static void do_signal(struct pt_regs *re
58c5fc13
MT		 17093 * X86_32: vm86 regs switched out by assembly code before reaching
17094 * here, so testing against kernel CS suffices.
17095 */
17096- if (!user_mode(regs))
17097+ if (!user_mode_novm(regs))
17098 return;
17099
17100 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
66a7e928
MT		 17101diff -urNp linux-2.6.39/arch/x86/kernel/smpboot.c linux-2.6.39/arch/x86/kernel/smpboot.c
17102--- linux-2.6.39/arch/x86/kernel/smpboot.c 2011-05-19 00:06:34.000000000 -0400
17103+++ linux-2.6.39/arch/x86/kernel/smpboot.c 2011-05-22 19:36:30.000000000 -0400
17104@@ -696,17 +696,20 @@ static int __cpuinit do_boot_cpu(int api
71d190be
MT		 17105 set_idle_for_cpu(cpu, c_idle.idle);
17106 do_rest:
17107 per_cpu(current_task, cpu) = c_idle.idle;
17108+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
17109 #ifdef CONFIG_X86_32
17110 /* Stack for startup_32 can be just as for start_secondary onwards */
17111 irq_ctx_init(cpu);
17112 #else
17113 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
17114 initial_gs = per_cpu_offset(cpu);
17115- per_cpu(kernel_stack, cpu) =
17116- (unsigned long)task_stack_page(c_idle.idle) -
17117- KERNEL_STACK_OFFSET + THREAD_SIZE;
66a7e928 17118+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
58c5fc13
MT		 17119 #endif
17120+
ae4e228f 17121+ pax_open_kernel();
58c5fc13 17122 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
ae4e228f 17123+ pax_close_kernel();
58c5fc13
MT		 17124+
17125 initial_code = (unsigned long)start_secondary;
16454cff 17126 stack_start = c_idle.idle->thread.sp;
58c5fc13 17127
66a7e928 17128@@ -848,6 +851,12 @@ int __cpuinit native_cpu_up(unsigned int
df50ba0c
MT		 17129
17130 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
17131
17132+#ifdef CONFIG_PAX_PER_CPU_PGD
17133+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
17134+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17135+ KERNEL_PGD_PTRS);
17136+#endif
17137+
6892158b 17138 err = do_boot_cpu(apicid, cpu);
6892158b 17139 if (err) {
bc901d79 17140 pr_debug("do_boot_cpu failed %d\n", err);
66a7e928
MT		 17141diff -urNp linux-2.6.39/arch/x86/kernel/step.c linux-2.6.39/arch/x86/kernel/step.c
17142--- linux-2.6.39/arch/x86/kernel/step.c 2011-05-19 00:06:34.000000000 -0400
17143+++ linux-2.6.39/arch/x86/kernel/step.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 17144@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
17145 struct desc_struct *desc;
58c5fc13
MT		 17146 unsigned long base;
17147
17148- seg &= ~7UL;
17149+ seg >>= 3;
17150
17151 mutex_lock(&child->mm->context.lock);
17152- if (unlikely((seg >> 3) >= child->mm->context.size))
58c5fc13 17153+ if (unlikely(seg >= child->mm->context.size))
ae4e228f 17154 addr = -1L; /* bogus selector, access would fault */
58c5fc13 17155 else {
ae4e228f 17156 desc = child->mm->context.ldt + seg;
bc901d79
MT		 17157@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
17158 addr += base;
17159 }
17160 mutex_unlock(&child->mm->context.lock);
17161- }
17162+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
17163+ addr = ktla_ktva(addr);
17164
17165 return addr;
17166 }
17167@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
58c5fc13
MT		 17168 unsigned char opcode[15];
17169 unsigned long addr = convert_ip_to_linear(child, regs);
17170
17171+ if (addr == -EINVAL)
17172+ return 0;
17173+
17174 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
17175 for (i = 0; i < copied; i++) {
17176 switch (opcode[i]) {
bc901d79 17177@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
58c5fc13
MT		 17178
17179 #ifdef CONFIG_X86_64
17180 case 0x40 ... 0x4f:
17181- if (regs->cs != __USER_CS)
17182+ if ((regs->cs & 0xffff) != __USER_CS)
17183 /* 32-bit mode: register increment */
17184 return 0;
17185 /* 64-bit mode: REX prefix */
66a7e928
MT		 17186diff -urNp linux-2.6.39/arch/x86/kernel/syscall_table_32.S linux-2.6.39/arch/x86/kernel/syscall_table_32.S
17187--- linux-2.6.39/arch/x86/kernel/syscall_table_32.S 2011-05-19 00:06:34.000000000 -0400
17188+++ linux-2.6.39/arch/x86/kernel/syscall_table_32.S 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 17189@@ -1,3 +1,4 @@
17190+.section .rodata,"a",@progbits
17191 ENTRY(sys_call_table)
17192 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17193 .long sys_exit
66a7e928
MT		 17194diff -urNp linux-2.6.39/arch/x86/kernel/sys_i386_32.c linux-2.6.39/arch/x86/kernel/sys_i386_32.c
17195--- linux-2.6.39/arch/x86/kernel/sys_i386_32.c 2011-05-19 00:06:34.000000000 -0400
17196+++ linux-2.6.39/arch/x86/kernel/sys_i386_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 17197@@ -24,17 +24,224 @@
58c5fc13
MT		 17198
17199 #include <asm/syscalls.h>
17200
bc901d79
MT		 17201-/*
17202- * Do a system call from kernel instead of calling sys_execve so we
17203- * end up with proper pt_regs.
17204- */
17205-int kernel_execve(const char *filename,
17206- const char *const argv[],
17207- const char *const envp[])
58c5fc13 17208+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
bc901d79
MT		 17209 {
17210- long __res;
17211- asm volatile ("int $0x80"
17212- : "=a" (__res)
17213- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
17214- return __res;
58c5fc13
MT		 17215+ unsigned long pax_task_size = TASK_SIZE;
17216+
17217+#ifdef CONFIG_PAX_SEGMEXEC
17218+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17219+ pax_task_size = SEGMEXEC_TASK_SIZE;
17220+#endif
17221+
17222+ if (len > pax_task_size || addr > pax_task_size - len)
17223+ return -EINVAL;
17224+
17225+ return 0;
17226+}
17227+
58c5fc13
MT		 17228+unsigned long
17229+arch_get_unmapped_area(struct file *filp, unsigned long addr,
17230+ unsigned long len, unsigned long pgoff, unsigned long flags)
17231+{
17232+ struct mm_struct *mm = current->mm;
17233+ struct vm_area_struct *vma;
17234+ unsigned long start_addr, pax_task_size = TASK_SIZE;
17235+
17236+#ifdef CONFIG_PAX_SEGMEXEC
17237+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17238+ pax_task_size = SEGMEXEC_TASK_SIZE;
17239+#endif
17240+
6892158b
MT		 17241+ pax_task_size -= PAGE_SIZE;
17242+
58c5fc13
MT		 17243+ if (len > pax_task_size)
17244+ return -ENOMEM;
17245+
17246+ if (flags & MAP_FIXED)
17247+ return addr;
17248+
17249+#ifdef CONFIG_PAX_RANDMMAP
17250+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17251+#endif
17252+
17253+ if (addr) {
17254+ addr = PAGE_ALIGN(addr);
57199397
MT		 17255+ if (pax_task_size - len >= addr) {
17256+ vma = find_vma(mm, addr);
17257+ if (check_heap_stack_gap(vma, addr, len))
17258+ return addr;
17259+ }
58c5fc13
MT		 17260+ }
17261+ if (len > mm->cached_hole_size) {
17262+ start_addr = addr = mm->free_area_cache;
17263+ } else {
17264+ start_addr = addr = mm->mmap_base;
17265+ mm->cached_hole_size = 0;
17266+ }
17267+
17268+#ifdef CONFIG_PAX_PAGEEXEC
ae4e228f 17269+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
58c5fc13
MT		 17270+ start_addr = 0x00110000UL;
17271+
17272+#ifdef CONFIG_PAX_RANDMMAP
17273+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17274+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17275+#endif
17276+
17277+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17278+ start_addr = addr = mm->mmap_base;
17279+ else
17280+ addr = start_addr;
17281+ }
17282+#endif
17283+
17284+full_search:
17285+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17286+ /* At this point: (!vma || addr < vma->vm_end). */
17287+ if (pax_task_size - len < addr) {
17288+ /*
17289+ * Start a new search - just in case we missed
17290+ * some holes.
17291+ */
17292+ if (start_addr != mm->mmap_base) {
17293+ start_addr = addr = mm->mmap_base;
17294+ mm->cached_hole_size = 0;
17295+ goto full_search;
17296+ }
17297+ return -ENOMEM;
17298+ }
57199397
MT		 17299+ if (check_heap_stack_gap(vma, addr, len))
17300+ break;
58c5fc13
MT		 17301+ if (addr + mm->cached_hole_size < vma->vm_start)
17302+ mm->cached_hole_size = vma->vm_start - addr;
17303+ addr = vma->vm_end;
17304+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17305+ start_addr = addr = mm->mmap_base;
17306+ mm->cached_hole_size = 0;
17307+ goto full_search;
17308+ }
17309+ }
57199397
MT		 17310+
17311+ /*
17312+ * Remember the place where we stopped the search:
17313+ */
17314+ mm->free_area_cache = addr + len;
17315+ return addr;
58c5fc13
MT		 17316+}
17317+
17318+unsigned long
17319+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17320+ const unsigned long len, const unsigned long pgoff,
17321+ const unsigned long flags)
17322+{
17323+ struct vm_area_struct *vma;
17324+ struct mm_struct *mm = current->mm;
17325+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17326+
17327+#ifdef CONFIG_PAX_SEGMEXEC
17328+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17329+ pax_task_size = SEGMEXEC_TASK_SIZE;
17330+#endif
17331+
6892158b
MT		 17332+ pax_task_size -= PAGE_SIZE;
17333+
58c5fc13
MT		 17334+ /* requested length too big for entire address space */
17335+ if (len > pax_task_size)
17336+ return -ENOMEM;
17337+
17338+ if (flags & MAP_FIXED)
17339+ return addr;
17340+
17341+#ifdef CONFIG_PAX_PAGEEXEC
ae4e228f 17342+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
58c5fc13
MT		 17343+ goto bottomup;
17344+#endif
17345+
17346+#ifdef CONFIG_PAX_RANDMMAP
17347+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17348+#endif
17349+
17350+ /* requesting a specific address */
17351+ if (addr) {
17352+ addr = PAGE_ALIGN(addr);
57199397
MT		 17353+ if (pax_task_size - len >= addr) {
17354+ vma = find_vma(mm, addr);
17355+ if (check_heap_stack_gap(vma, addr, len))
17356+ return addr;
17357+ }
58c5fc13
MT		 17358+ }
17359+
17360+ /* check if free_area_cache is useful for us */
17361+ if (len <= mm->cached_hole_size) {
17362+ mm->cached_hole_size = 0;
17363+ mm->free_area_cache = mm->mmap_base;
17364+ }
17365+
17366+ /* either no address requested or can't fit in requested address hole */
17367+ addr = mm->free_area_cache;
17368+
17369+ /* make sure it can fit in the remaining address space */
17370+ if (addr > len) {
17371+ vma = find_vma(mm, addr-len);
57199397 17372+ if (check_heap_stack_gap(vma, addr - len, len))
58c5fc13
MT		 17373+ /* remember the address as a hint for next time */
17374+ return (mm->free_area_cache = addr-len);
17375+ }
17376+
17377+ if (mm->mmap_base < len)
17378+ goto bottomup;
17379+
17380+ addr = mm->mmap_base-len;
17381+
17382+ do {
17383+ /*
17384+ * Lookup failure means no vma is above this address,
17385+ * else if new region fits below vma->vm_start,
17386+ * return with success:
17387+ */
17388+ vma = find_vma(mm, addr);
57199397 17389+ if (check_heap_stack_gap(vma, addr, len))
58c5fc13
MT		 17390+ /* remember the address as a hint for next time */
17391+ return (mm->free_area_cache = addr);
17392+
17393+ /* remember the largest hole we saw so far */
17394+ if (addr + mm->cached_hole_size < vma->vm_start)
17395+ mm->cached_hole_size = vma->vm_start - addr;
17396+
17397+ /* try just below the current vma->vm_start */
16454cff
MT		 17398+ addr = skip_heap_stack_gap(vma, len);
17399+ } while (!IS_ERR_VALUE(addr));
58c5fc13
MT		 17400+
17401+bottomup:
17402+ /*
17403+ * A failed mmap() very likely causes application failure,
17404+ * so fall back to the bottom-up function here. This scenario
17405+ * can happen with large stack limits and large mmap()
17406+ * allocations.
17407+ */
17408+
17409+#ifdef CONFIG_PAX_SEGMEXEC
17410+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17411+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17412+ else
17413+#endif
17414+
17415+ mm->mmap_base = TASK_UNMAPPED_BASE;
17416+
17417+#ifdef CONFIG_PAX_RANDMMAP
17418+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17419+ mm->mmap_base += mm->delta_mmap;
17420+#endif
17421+
17422+ mm->free_area_cache = mm->mmap_base;
17423+ mm->cached_hole_size = ~0UL;
17424+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17425+ /*
17426+ * Restore the topdown base:
17427+ */
17428+ mm->mmap_base = base;
17429+ mm->free_area_cache = base;
17430+ mm->cached_hole_size = ~0UL;
17431+
17432+ return addr;
bc901d79 17433 }
66a7e928
MT		 17434diff -urNp linux-2.6.39/arch/x86/kernel/sys_x86_64.c linux-2.6.39/arch/x86/kernel/sys_x86_64.c
17435--- linux-2.6.39/arch/x86/kernel/sys_x86_64.c 2011-05-19 00:06:34.000000000 -0400
17436+++ linux-2.6.39/arch/x86/kernel/sys_x86_64.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 17437@@ -32,8 +32,8 @@ out:
58c5fc13
MT		 17438 return error;
17439 }
17440
17441-static void find_start_end(unsigned long flags, unsigned long *begin,
17442- unsigned long *end)
17443+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17444+ unsigned long *begin, unsigned long *end)
17445 {
17446 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17447 unsigned long new_begin;
ae4e228f 17448@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
58c5fc13
MT		 17449 *begin = new_begin;
17450 }
17451 } else {
17452- *begin = TASK_UNMAPPED_BASE;
17453+ *begin = mm->mmap_base;
17454 *end = TASK_SIZE;
17455 }
17456 }
57199397 17457@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
58c5fc13
MT		 17458 if (flags & MAP_FIXED)
17459 return addr;
17460
17461- find_start_end(flags, &begin, &end);
17462+ find_start_end(mm, flags, &begin, &end);
17463
17464 if (len > end)
17465 return -ENOMEM;
17466
17467+#ifdef CONFIG_PAX_RANDMMAP
17468+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17469+#endif
17470+
17471 if (addr) {
17472 addr = PAGE_ALIGN(addr);
17473 vma = find_vma(mm, addr);
57199397
MT		 17474- if (end - len >= addr &&
17475- (!vma || addr + len <= vma->vm_start))
17476+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17477 return addr;
17478 }
17479 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17480@@ -106,7 +109,7 @@ full_search:
17481 }
17482 return -ENOMEM;
17483 }
17484- if (!vma || addr + len <= vma->vm_start) {
17485+ if (check_heap_stack_gap(vma, addr, len)) {
17486 /*
17487 * Remember the place where we stopped the search:
17488 */
17489@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
58c5fc13
MT		 17490 {
17491 struct vm_area_struct *vma;
17492 struct mm_struct *mm = current->mm;
17493- unsigned long addr = addr0;
17494+ unsigned long base = mm->mmap_base, addr = addr0;
17495
17496 /* requested length too big for entire address space */
17497 if (len > TASK_SIZE)
16454cff 17498@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
58c5fc13
MT		 17499 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17500 goto bottomup;
17501
17502+#ifdef CONFIG_PAX_RANDMMAP
17503+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17504+#endif
17505+
17506 /* requesting a specific address */
17507 if (addr) {
17508 addr = PAGE_ALIGN(addr);
16454cff 17509- vma = find_vma(mm, addr);
57199397
MT		 17510- if (TASK_SIZE - len >= addr &&
17511- (!vma || addr + len <= vma->vm_start))
16454cff
MT		 17512- return addr;
17513+ if (TASK_SIZE - len >= addr) {
17514+ vma = find_vma(mm, addr);
17515+ if (check_heap_stack_gap(vma, addr, len))
17516+ return addr;
17517+ }
57199397
MT		 17518 }
17519
16454cff
MT		 17520 /* check if free_area_cache is useful for us */
17521@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
57199397
MT		 17522 /* make sure it can fit in the remaining address space */
17523 if (addr > len) {
17524 vma = find_vma(mm, addr-len);
17525- if (!vma || addr <= vma->vm_start)
17526+ if (check_heap_stack_gap(vma, addr - len, len))
17527 /* remember the address as a hint for next time */
17528 return mm->free_area_cache = addr-len;
17529 }
16454cff 17530@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
57199397
MT		 17531 * return with success:
17532 */
17533 vma = find_vma(mm, addr);
17534- if (!vma || addr+len <= vma->vm_start)
17535+ if (check_heap_stack_gap(vma, addr, len))
17536 /* remember the address as a hint for next time */
17537 return mm->free_area_cache = addr;
17538
16454cff
MT		 17539@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17540 mm->cached_hole_size = vma->vm_start - addr;
17541
17542 /* try just below the current vma->vm_start */
17543- addr = vma->vm_start-len;
17544- } while (len < vma->vm_start);
17545+ addr = skip_heap_stack_gap(vma, len);
17546+ } while (!IS_ERR_VALUE(addr));
17547
17548 bottomup:
17549 /*
17550@@ -198,13 +206,21 @@ bottomup:
58c5fc13
MT		 17551 * can happen with large stack limits and large mmap()
17552 * allocations.
17553 */
17554+ mm->mmap_base = TASK_UNMAPPED_BASE;
17555+
17556+#ifdef CONFIG_PAX_RANDMMAP
17557+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17558+ mm->mmap_base += mm->delta_mmap;
17559+#endif
17560+
17561+ mm->free_area_cache = mm->mmap_base;
17562 mm->cached_hole_size = ~0UL;
17563- mm->free_area_cache = TASK_UNMAPPED_BASE;
17564 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17565 /*
17566 * Restore the topdown base:
17567 */
17568- mm->free_area_cache = mm->mmap_base;
17569+ mm->mmap_base = base;
17570+ mm->free_area_cache = base;
17571 mm->cached_hole_size = ~0UL;
17572
17573 return addr;
66a7e928
MT		 17574diff -urNp linux-2.6.39/arch/x86/kernel/tboot.c linux-2.6.39/arch/x86/kernel/tboot.c
17575--- linux-2.6.39/arch/x86/kernel/tboot.c 2011-05-19 00:06:34.000000000 -0400
17576+++ linux-2.6.39/arch/x86/kernel/tboot.c 2011-05-22 19:36:30.000000000 -0400
17577@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17578
17579 void tboot_shutdown(u32 shutdown_type)
17580 {
17581- void (*shutdown)(void);
17582+ void (* __noreturn shutdown)(void);
17583
17584 if (!tboot_enabled())
17585 return;
17586@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17587
17588 switch_to_tboot_pt();
17589
17590- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17591+ shutdown = (void *)tboot->shutdown_entry;
17592 shutdown();
17593
17594 /* should not reach here */
8308f9c9
MT		 17595@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17596 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17597 }
17598
17599-static atomic_t ap_wfs_count;
17600+static atomic_unchecked_t ap_wfs_count;
17601
17602 static int tboot_wait_for_aps(int num_aps)
17603 {
17604@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(
17605 {
17606 switch (action) {
17607 case CPU_DYING:
17608- atomic_inc(&ap_wfs_count);
17609+ atomic_inc_unchecked(&ap_wfs_count);
17610 if (num_online_cpus() == 1)
17611- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17612+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17613 return NOTIFY_BAD;
17614 break;
17615 }
17616@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17617
17618 tboot_create_trampoline();
17619
17620- atomic_set(&ap_wfs_count, 0);
17621+ atomic_set_unchecked(&ap_wfs_count, 0);
17622 register_hotcpu_notifier(&tboot_cpu_notifier);
17623 return 0;
17624 }
66a7e928
MT		 17625diff -urNp linux-2.6.39/arch/x86/kernel/time.c linux-2.6.39/arch/x86/kernel/time.c
17626--- linux-2.6.39/arch/x86/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
17627+++ linux-2.6.39/arch/x86/kernel/time.c 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 17628@@ -22,17 +22,13 @@
17629 #include <asm/hpet.h>
17630 #include <asm/time.h>
ae4e228f
MT		 17631
17632-#ifdef CONFIG_X86_64
17633-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17634-#endif
17635-
17636 unsigned long profile_pc(struct pt_regs *regs)
17637 {
58c5fc13
MT		 17638 unsigned long pc = instruction_pointer(regs);
17639
58c5fc13
MT		 17640- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17641+ if (!user_mode(regs) && in_lock_functions(pc)) {
17642 #ifdef CONFIG_FRAME_POINTER
17643- return *(unsigned long *)(regs->bp + sizeof(long));
17644+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17645 #else
ae4e228f
MT		 17646 unsigned long *sp =
17647 (unsigned long *)kernel_stack_pointer(regs);
16454cff 17648@@ -41,11 +37,17 @@ unsigned long profile_pc(struct pt_regs
ae4e228f
MT		 17649 * or above a saved flags. Eflags has bits 22-31 zero,
17650 * kernel addresses don't.
17651 */
58c5fc13
MT		 17652+
17653+#ifdef CONFIG_PAX_KERNEXEC
17654+ return ktla_ktva(sp[0]);
17655+#else
17656 if (sp[0] >> 22)
17657 return sp[0];
17658 if (sp[1] >> 22)
17659 return sp[1];
17660 #endif
17661+
17662+#endif
17663 }
58c5fc13
MT		 17664 return pc;
17665 }
66a7e928
MT		 17666diff -urNp linux-2.6.39/arch/x86/kernel/tls.c linux-2.6.39/arch/x86/kernel/tls.c
17667--- linux-2.6.39/arch/x86/kernel/tls.c 2011-05-19 00:06:34.000000000 -0400
17668+++ linux-2.6.39/arch/x86/kernel/tls.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 17669@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
17670 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17671 return -EINVAL;
17672
17673+#ifdef CONFIG_PAX_SEGMEXEC
17674+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17675+ return -EINVAL;
17676+#endif
17677+
17678 set_tls_desc(p, idx, &info, 1);
17679
17680 return 0;
66a7e928
MT		 17681diff -urNp linux-2.6.39/arch/x86/kernel/trampoline_32.S linux-2.6.39/arch/x86/kernel/trampoline_32.S
17682--- linux-2.6.39/arch/x86/kernel/trampoline_32.S 2011-05-19 00:06:34.000000000 -0400
17683+++ linux-2.6.39/arch/x86/kernel/trampoline_32.S 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 17684@@ -32,6 +32,12 @@
17685 #include <asm/segment.h>
17686 #include <asm/page_types.h>
17687
17688+#ifdef CONFIG_PAX_KERNEXEC
17689+#define ta(X) (X)
17690+#else
17691+#define ta(X) ((X) - __PAGE_OFFSET)
17692+#endif
17693+
66a7e928
MT		 17694 #ifdef CONFIG_SMP
17695
17696 .section ".x86_trampoline","a"
17697@@ -62,7 +68,7 @@ r_base = .
ae4e228f
MT		 17698 inc %ax # protected mode (PE) bit
17699 lmsw %ax # into protected mode
17700 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17701- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17702+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17703
17704 # These need to be in the same 64K segment as the above;
17705 # hence we don't use the boot_gdt_descr defined in head.S
66a7e928
MT		 17706diff -urNp linux-2.6.39/arch/x86/kernel/trampoline_64.S linux-2.6.39/arch/x86/kernel/trampoline_64.S
17707--- linux-2.6.39/arch/x86/kernel/trampoline_64.S 2011-05-19 00:06:34.000000000 -0400
17708+++ linux-2.6.39/arch/x86/kernel/trampoline_64.S 2011-05-22 19:36:30.000000000 -0400
17709@@ -90,7 +90,7 @@ startup_32:
6892158b
MT		 17710 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17711 movl %eax, %ds
17712
17713- movl $X86_CR4_PAE, %eax
17714+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17715 movl %eax, %cr4 # Enable PAE mode
17716
17717 # Setup trampoline 4 level pagetables
17718@@ -138,7 +138,7 @@ tidt:
17719 # so the kernel can live anywhere
17720 .balign 4
17721 tgdt:
17722- .short tgdt_end - tgdt # gdt limit
17723+ .short tgdt_end - tgdt - 1 # gdt limit
17724 .long tgdt - r_base
17725 .short 0
17726 .quad 0x00cf9b000000ffff # __KERNEL32_CS
66a7e928
MT		 17727diff -urNp linux-2.6.39/arch/x86/kernel/traps.c linux-2.6.39/arch/x86/kernel/traps.c
17728--- linux-2.6.39/arch/x86/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
17729+++ linux-2.6.39/arch/x86/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
57199397 17730@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
58c5fc13
MT		 17731
17732 /* Do we ignore FPU interrupts ? */
17733 char ignore_fpu_irq;
17734-
17735-/*
17736- * The IDT has to be page-aligned to simplify the Pentium
ae4e228f 17737- * F0 0F bug workaround.
58c5fc13 17738- */
ae4e228f 17739-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
58c5fc13
MT		 17740 #endif
17741
17742 DECLARE_BITMAP(used_vectors, NR_VECTORS);
16454cff 17743@@ -117,13 +111,13 @@ static inline void preempt_conditional_c
58c5fc13 17744 }
ae4e228f
MT		 17745
17746 static void __kprobes
17747-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17748+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17749 long error_code, siginfo_t *info)
17750 {
58c5fc13
MT		 17751 struct task_struct *tsk = current;
17752
17753 #ifdef CONFIG_X86_32
17754- if (regs->flags & X86_VM_MASK) {
17755+ if (v8086_mode(regs)) {
17756 /*
17757 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17758 * On nmi (interrupt 2), do_trap should not be called.
16454cff 17759@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
58c5fc13
MT		 17760 }
17761 #endif
17762
17763- if (!user_mode(regs))
17764+ if (!user_mode_novm(regs))
17765 goto kernel_trap;
17766
17767 #ifdef CONFIG_X86_32
16454cff 17768@@ -157,7 +151,7 @@ trap_signal:
58c5fc13
MT		 17769 printk_ratelimit()) {
17770 printk(KERN_INFO
17771 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17772- tsk->comm, tsk->pid, str,
17773+ tsk->comm, task_pid_nr(tsk), str,
17774 regs->ip, regs->sp, error_code);
17775 print_vma_addr(" in ", regs->ip);
17776 printk("\n");
16454cff 17777@@ -174,8 +168,20 @@ kernel_trap:
ae4e228f
MT		 17778 if (!fixup_exception(regs)) {
17779 tsk->thread.error_code = error_code;
58c5fc13 17780 tsk->thread.trap_no = trapnr;
ae4e228f
MT		 17781+
17782+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17783+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17784+ str = "PAX: suspicious stack segment fault";
17785+#endif
17786+
58c5fc13
MT		 17787 die(str, regs, error_code);
17788 }
17789+
17790+#ifdef CONFIG_PAX_REFCOUNT
17791+ if (trapnr == 4)
17792+ pax_report_refcount_overflow(regs);
17793+#endif
17794+
17795 return;
17796
17797 #ifdef CONFIG_X86_32
16454cff 17798@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
58c5fc13
MT		 17799 conditional_sti(regs);
17800
17801 #ifdef CONFIG_X86_32
17802- if (regs->flags & X86_VM_MASK)
17803+ if (v8086_mode(regs))
17804 goto gp_in_vm86;
17805 #endif
17806
17807 tsk = current;
17808- if (!user_mode(regs))
17809+ if (!user_mode_novm(regs))
17810 goto gp_in_kernel;
17811
17812+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
ae4e228f 17813+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
58c5fc13
MT		 17814+ struct mm_struct *mm = tsk->mm;
17815+ unsigned long limit;
17816+
17817+ down_write(&mm->mmap_sem);
17818+ limit = mm->context.user_cs_limit;
17819+ if (limit < TASK_SIZE) {
17820+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17821+ up_write(&mm->mmap_sem);
17822+ return;
17823+ }
17824+ up_write(&mm->mmap_sem);
17825+ }
17826+#endif
17827+
17828 tsk->thread.error_code = error_code;
17829 tsk->thread.trap_no = 13;
17830
16454cff 17831@@ -304,6 +326,13 @@ gp_in_kernel:
58c5fc13
MT		 17832 if (notify_die(DIE_GPF, "general protection fault", regs,
17833 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17834 return;
17835+
17836+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
ae4e228f 17837+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
58c5fc13
MT		 17838+ die("PAX: suspicious general protection fault", regs, error_code);
17839+ else
17840+#endif
17841+
17842 die("general protection fault", regs, error_code);
17843 }
17844
16454cff 17845@@ -569,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
ae4e228f
MT		 17846 /* It's safe to allow irq's after DR6 has been saved */
17847 preempt_conditional_sti(regs);
58c5fc13 17848
ae4e228f
MT		 17849- if (regs->flags & X86_VM_MASK) {
17850+ if (v8086_mode(regs)) {
17851 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17852 error_code, 1);
bc901d79 17853 preempt_conditional_cli(regs);
16454cff 17854@@ -583,7 +612,7 @@ dotraplinkage void __kprobes do_debug(st
ae4e228f
MT		 17855 * We already checked v86 mode above, so we can check for kernel mode
17856 * by just checking the CPL of CS.
58c5fc13 17857 */
ae4e228f
MT		 17858- if ((dr6 & DR_STEP) && !user_mode(regs)) {
17859+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17860 tsk->thread.debugreg6 &= ~DR_STEP;
17861 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17862 regs->flags &= ~X86_EFLAGS_TF;
16454cff 17863@@ -612,7 +641,7 @@ void math_error(struct pt_regs *regs, in
58c5fc13 17864 return;
57199397
MT		 17865 conditional_sti(regs);
17866
17867- if (!user_mode_vm(regs))
17868+ if (!user_mode(regs))
17869 {
17870 if (!fixup_exception(regs)) {
17871 task->thread.error_code = error_code;
71d190be
MT		 17872@@ -723,7 +752,7 @@ asmlinkage void __attribute__((weak)) sm
17873 void __math_state_restore(void)
17874 {
17875 struct thread_info *thread = current_thread_info();
17876- struct task_struct *tsk = thread->task;
17877+ struct task_struct *tsk = current;
17878
17879 /*
17880 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17881@@ -750,8 +779,7 @@ void __math_state_restore(void)
17882 */
17883 asmlinkage void math_state_restore(void)
17884 {
17885- struct thread_info *thread = current_thread_info();
17886- struct task_struct *tsk = thread->task;
17887+ struct task_struct *tsk = current;
58c5fc13 17888
71d190be
MT		 17889 if (!tsk_used_math(tsk)) {
17890 local_irq_enable();
66a7e928
MT		 17891diff -urNp linux-2.6.39/arch/x86/kernel/vm86_32.c linux-2.6.39/arch/x86/kernel/vm86_32.c
17892--- linux-2.6.39/arch/x86/kernel/vm86_32.c 2011-05-19 00:06:34.000000000 -0400
17893+++ linux-2.6.39/arch/x86/kernel/vm86_32.c 2011-05-22 19:41:32.000000000 -0400
ae4e228f
MT		 17894@@ -41,6 +41,7 @@
17895 #include <linux/ptrace.h>
17896 #include <linux/audit.h>
17897 #include <linux/stddef.h>
17898+#include <linux/grsecurity.h>
17899
17900 #include <asm/uaccess.h>
17901 #include <asm/io.h>
17902@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
58c5fc13
MT		 17903 do_exit(SIGSEGV);
17904 }
17905
17906- tss = &per_cpu(init_tss, get_cpu());
17907+ tss = init_tss + get_cpu();
17908 current->thread.sp0 = current->thread.saved_sp0;
17909 current->thread.sysenter_cs = __KERNEL_CS;
17910 load_sp0(tss, &current->thread);
16454cff 17911@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
ae4e228f
MT		 17912 struct task_struct *tsk;
17913 int tmp, ret = -EPERM;
17914
17915+#ifdef CONFIG_GRKERNSEC_VM86
17916+ if (!capable(CAP_SYS_RAWIO)) {
17917+ gr_handle_vm86();
17918+ goto out;
17919+ }
17920+#endif
17921+
17922 tsk = current;
17923 if (tsk->thread.saved_sp0)
17924 goto out;
16454cff 17925@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
ae4e228f
MT		 17926 int tmp, ret;
17927 struct vm86plus_struct __user *v86;
17928
17929+#ifdef CONFIG_GRKERNSEC_VM86
17930+ if (!capable(CAP_SYS_RAWIO)) {
17931+ gr_handle_vm86();
17932+ ret = -EPERM;
17933+ goto out;
17934+ }
17935+#endif
17936+
17937 tsk = current;
17938 switch (cmd) {
17939 case VM86_REQUEST_IRQ:
16454cff 17940@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
58c5fc13
MT		 17941 tsk->thread.saved_fs = info->regs32->fs;
17942 tsk->thread.saved_gs = get_user_gs(info->regs32);
17943
17944- tss = &per_cpu(init_tss, get_cpu());
17945+ tss = init_tss + get_cpu();
17946 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17947 if (cpu_has_sep)
17948 tsk->thread.sysenter_cs = 0;
16454cff 17949@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
ae4e228f
MT		 17950 goto cannot_handle;
17951 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17952 goto cannot_handle;
17953- intr_ptr = (unsigned long __user *) (i << 2);
17954+ intr_ptr = (__force unsigned long __user *) (i << 2);
17955 if (get_user(segoffs, intr_ptr))
17956 goto cannot_handle;
17957 if ((segoffs >> 16) == BIOSSEG)
66a7e928
MT		 17958diff -urNp linux-2.6.39/arch/x86/kernel/vmlinux.lds.S linux-2.6.39/arch/x86/kernel/vmlinux.lds.S
17959--- linux-2.6.39/arch/x86/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
17960+++ linux-2.6.39/arch/x86/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
57199397 17961@@ -26,6 +26,13 @@
58c5fc13
MT		 17962 #include <asm/page_types.h>
17963 #include <asm/cache.h>
17964 #include <asm/boot.h>
17965+#include <asm/segment.h>
17966+
58c5fc13
MT		 17967+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17968+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17969+#else
17970+#define __KERNEL_TEXT_OFFSET 0
17971+#endif
17972
17973 #undef i386 /* in case the preprocessor is a 32bit one */
17974
bc901d79 17975@@ -34,11 +41,9 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
58c5fc13
MT		 17976 #ifdef CONFIG_X86_32
17977 OUTPUT_ARCH(i386)
17978 ENTRY(phys_startup_32)
17979-jiffies = jiffies_64;
17980 #else
17981 OUTPUT_ARCH(i386:x86-64)
17982 ENTRY(phys_startup_64)
17983-jiffies_64 = jiffies;
17984 #endif
17985
ae4e228f 17986 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
bc901d79 17987@@ -69,31 +74,46 @@ jiffies_64 = jiffies;
ae4e228f 17988
58c5fc13
MT		 17989 PHDRS {
17990 text PT_LOAD FLAGS(5); /* R_E */
57199397
MT		 17991+#ifdef CONFIG_X86_32
17992+ module PT_LOAD FLAGS(5); /* R_E */
17993+#endif
ae4e228f
MT		 17994+#ifdef CONFIG_XEN
17995+ rodata PT_LOAD FLAGS(5); /* R_E */
17996+#else
58c5fc13 17997+ rodata PT_LOAD FLAGS(4); /* R__ */
ae4e228f 17998+#endif
16454cff 17999 data PT_LOAD FLAGS(6); /* RW_ */
58c5fc13 18000 #ifdef CONFIG_X86_64
ae4e228f 18001 user PT_LOAD FLAGS(5); /* R_E */
58c5fc13
MT		 18002+#endif
18003+ init.begin PT_LOAD FLAGS(6); /* RW_ */
18004 #ifdef CONFIG_SMP
ae4e228f 18005 percpu PT_LOAD FLAGS(6); /* RW_ */
58c5fc13
MT		 18006 #endif
18007+ text.init PT_LOAD FLAGS(5); /* R_E */
18008+ text.exit PT_LOAD FLAGS(5); /* R_E */
18009 init PT_LOAD FLAGS(7); /* RWE */
18010-#endif
18011 note PT_NOTE FLAGS(0); /* ___ */
18012 }
18013
18014 SECTIONS
18015 {
18016 #ifdef CONFIG_X86_32
18017- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18018- phys_startup_32 = startup_32 - LOAD_OFFSET;
18019+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18020 #else
18021- . = __START_KERNEL;
18022- phys_startup_64 = startup_64 - LOAD_OFFSET;
18023+ . = __START_KERNEL;
18024 #endif
18025
18026 /* Text and read-only data */
ae4e228f
MT		 18027- .text : AT(ADDR(.text) - LOAD_OFFSET) {
18028- _text = .;
58c5fc13 18029+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
ae4e228f 18030 /* bootstrapping code */
58c5fc13
MT		 18031+#ifdef CONFIG_X86_32
18032+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18033+#else
18034+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18035+#endif
18036+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
ae4e228f
MT		 18037+ _text = .;
18038 HEAD_TEXT
58c5fc13 18039 #ifdef CONFIG_X86_32
58c5fc13 18040 . = ALIGN(PAGE_SIZE);
66a7e928 18041@@ -109,13 +129,47 @@ SECTIONS
ae4e228f
MT		 18042 IRQENTRY_TEXT
18043 *(.fixup)
18044 *(.gnu.warning)
18045- /* End of text section */
18046- _etext = .;
58c5fc13
MT		 18047 } :text = 0x9090
18048
18049- NOTES :text :note
18050+ . += __KERNEL_TEXT_OFFSET;
df50ba0c 18051+
58c5fc13
MT		 18052+#ifdef CONFIG_X86_32
18053+ . = ALIGN(PAGE_SIZE);
58c5fc13 18054+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
ae4e228f
MT		 18055+
18056+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
58c5fc13
MT		 18057+ MODULES_EXEC_VADDR = .;
18058+ BYTE(0)
ae4e228f 18059+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
57199397 18060+ . = ALIGN(HPAGE_SIZE);
58c5fc13 18061+ MODULES_EXEC_END = . - 1;
58c5fc13 18062+#endif
ae4e228f
MT		 18063+
18064+ } :module
58c5fc13
MT		 18065+#endif
18066+
57199397 18067+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
ae4e228f
MT		 18068+ /* End of text section */
18069+ _etext = . - __KERNEL_TEXT_OFFSET;
57199397 18070+ }
bc901d79
MT		 18071
18072- EXCEPTION_TABLE(16) :text = 0x9090
57199397
MT		 18073+#ifdef CONFIG_X86_32
18074+ . = ALIGN(PAGE_SIZE);
18075+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18076+ *(.idt)
18077+ . = ALIGN(PAGE_SIZE);
18078+ *(.empty_zero_page)
bc901d79
MT		 18079+ *(.initial_pg_fixmap)
18080+ *(.initial_pg_pmd)
18081+ *(.initial_page_table)
57199397
MT		 18082+ *(.swapper_pg_dir)
18083+ } :rodata
18084+#endif
18085+
18086+ . = ALIGN(PAGE_SIZE);
18087+ NOTES :rodata :note
bc901d79 18088+
57199397
MT		 18089+ EXCEPTION_TABLE(16) :rodata
18090
16454cff
MT		 18091 #if defined(CONFIG_DEBUG_RODATA)
18092 /* .text should occupy whole number of pages */
66a7e928 18093@@ -127,16 +181,20 @@ SECTIONS
57199397
MT		 18094
18095 /* Data */
18096 .data : AT(ADDR(.data) - LOAD_OFFSET) {
58c5fc13
MT		 18097+
18098+#ifdef CONFIG_PAX_KERNEXEC
bc901d79 18099+ . = ALIGN(HPAGE_SIZE);
58c5fc13 18100+#else
bc901d79 18101+ . = ALIGN(PAGE_SIZE);
58c5fc13
MT		 18102+#endif
18103+
18104 /* Start of data section */
18105 _sdata = .;
18106
18107 /* init_task */
18108 INIT_TASK_DATA(THREAD_SIZE)
18109
18110-#ifdef CONFIG_X86_32
18111- /* 32 bit has nosave before _edata */
18112 NOSAVE_DATA
18113-#endif
18114
18115 PAGE_ALIGNED_DATA(PAGE_SIZE)
ae4e228f 18116
66a7e928 18117@@ -145,6 +203,8 @@ SECTIONS
bc901d79
MT		 18118 DATA_DATA
18119 CONSTRUCTORS
18120
18121+ jiffies = jiffies_64;
18122+
18123 /* rarely changed data like cpu maps */
18124 READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES)
18125
66a7e928 18126@@ -199,12 +259,6 @@ SECTIONS
58c5fc13
MT		 18127 }
18128 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18129
ae4e228f 18130- . = ALIGN(L1_CACHE_BYTES);
58c5fc13
MT		 18131- .jiffies : AT(VLOAD(.jiffies)) {
18132- *(.jiffies)
18133- }
18134- jiffies = VVIRT(.jiffies);
18135-
18136 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18137 *(.vsyscall_3)
18138 }
66a7e928 18139@@ -220,12 +274,19 @@ SECTIONS
58c5fc13
MT		 18140 #endif /* CONFIG_X86_64 */
18141
18142 /* Init code and data - will be freed after init */
18143- . = ALIGN(PAGE_SIZE);
18144 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18145+ BYTE(0)
18146+
18147+#ifdef CONFIG_PAX_KERNEXEC
57199397 18148+ . = ALIGN(HPAGE_SIZE);
58c5fc13
MT		 18149+#else
18150+ . = ALIGN(PAGE_SIZE);
18151+#endif
18152+
18153 __init_begin = .; /* paired with __init_end */
18154- }
18155+ } :init.begin
18156
18157-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18158+#ifdef CONFIG_SMP
18159 /*
18160 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18161 * output PHDR, so the next output section - .init.text - should
66a7e928
MT		 18162@@ -234,12 +295,27 @@ SECTIONS
18163 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
58c5fc13
MT		 18164 #endif
18165
ae4e228f 18166- INIT_TEXT_SECTION(PAGE_SIZE)
58c5fc13
MT		 18167-#ifdef CONFIG_X86_64
18168- :init
18169-#endif
ae4e228f
MT		 18170+ . = ALIGN(PAGE_SIZE);
18171+ init_begin = .;
18172+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18173+ VMLINUX_SYMBOL(_sinittext) = .;
18174+ INIT_TEXT
18175+ VMLINUX_SYMBOL(_einittext) = .;
18176+ . = ALIGN(PAGE_SIZE);
58c5fc13 18177+ } :text.init
bc901d79
MT		 18178
18179- INIT_DATA_SECTION(16)
58c5fc13
MT		 18180+ /*
18181+ * .exit.text is discard at runtime, not link time, to deal with
18182+ * references from .altinstructions and .eh_frame
18183+ */
57199397 18184+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
58c5fc13
MT		 18185+ EXIT_TEXT
18186+ . = ALIGN(16);
18187+ } :text.exit
18188+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
bc901d79 18189+
ae4e228f
MT		 18190+ . = ALIGN(PAGE_SIZE);
18191+ INIT_DATA_SECTION(16) :init
58c5fc13 18192
66a7e928
MT		 18193 /*
18194 * Code and data for a variety of lowlevel trampolines, to be
18195@@ -306,19 +382,12 @@ SECTIONS
58c5fc13 18196 }
66a7e928 18197
bc901d79 18198 . = ALIGN(8);
58c5fc13
MT		 18199- /*
18200- * .exit.text is discard at runtime, not link time, to deal with
18201- * references from .altinstructions and .eh_frame
18202- */
18203- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
18204- EXIT_TEXT
18205- }
bc901d79 18206
58c5fc13
MT		 18207 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
18208 EXIT_DATA
18209 }
58c5fc13
MT		 18210
18211-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
18212+#ifndef CONFIG_SMP
66a7e928 18213 PERCPU(INTERNODE_CACHE_BYTES, PAGE_SIZE)
58c5fc13
MT		 18214 #endif
18215
66a7e928 18216@@ -337,16 +406,10 @@ SECTIONS
df50ba0c
MT		 18217 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
18218 __smp_locks = .;
18219 *(.smp_locks)
18220- . = ALIGN(PAGE_SIZE);
18221 __smp_locks_end = .;
18222+ . = ALIGN(PAGE_SIZE);
58c5fc13
MT		 18223 }
18224
18225-#ifdef CONFIG_X86_64
18226- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18227- NOSAVE_DATA
18228- }
18229-#endif
18230-
18231 /* BSS */
18232 . = ALIGN(PAGE_SIZE);
18233 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
66a7e928 18234@@ -362,6 +425,7 @@ SECTIONS
58c5fc13
MT		 18235 __brk_base = .;
18236 . += 64 * 1024; /* 64k alignment slop space */
18237 *(.brk_reservation) /* areas brk users have reserved */
57199397 18238+ . = ALIGN(HPAGE_SIZE);
58c5fc13
MT		 18239 __brk_limit = .;
18240 }
18241
66a7e928 18242@@ -388,13 +452,12 @@ SECTIONS
58c5fc13
MT		 18243 * for the boot processor.
18244 */
df50ba0c 18245 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
58c5fc13
MT		 18246-INIT_PER_CPU(gdt_page);
18247 INIT_PER_CPU(irq_stack_union);
18248
18249 /*
18250 * Build-time check on the image size:
18251 */
18252-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18253+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18254 "kernel image bigger than KERNEL_IMAGE_SIZE");
18255
18256 #ifdef CONFIG_SMP
66a7e928
MT		 18257diff -urNp linux-2.6.39/arch/x86/kernel/vsyscall_64.c linux-2.6.39/arch/x86/kernel/vsyscall_64.c
18258--- linux-2.6.39/arch/x86/kernel/vsyscall_64.c 2011-05-19 00:06:34.000000000 -0400
18259+++ linux-2.6.39/arch/x86/kernel/vsyscall_64.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 18260@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
58c5fc13
MT		 18261
18262 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
18263 /* copy vsyscall data */
18264+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
18265 vsyscall_gtod_data.clock.vread = clock->vread;
18266 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
18267 vsyscall_gtod_data.clock.mask = clock->mask;
6892158b 18268@@ -208,7 +209,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
58c5fc13
MT		 18269 We do this here because otherwise user space would do it on
18270 its own in a likely inferior way (no access to jiffies).
18271 If you don't like it pass NULL. */
18272- if (tcache && tcache->blob[0] == (j = __jiffies)) {
18273+ if (tcache && tcache->blob[0] == (j = jiffies)) {
18274 p = tcache->blob[1];
18275 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
18276 /* Load per CPU data from RDTSCP */
66a7e928
MT		 18277diff -urNp linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c
18278--- linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c 2011-05-19 00:06:34.000000000 -0400
18279+++ linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 18280@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18281 EXPORT_SYMBOL(copy_user_generic_string);
18282 EXPORT_SYMBOL(copy_user_generic_unrolled);
58c5fc13 18283 EXPORT_SYMBOL(__copy_user_nocache);
ae4e228f
MT		 18284-EXPORT_SYMBOL(_copy_from_user);
18285-EXPORT_SYMBOL(_copy_to_user);
58c5fc13
MT		 18286
18287 EXPORT_SYMBOL(copy_page);
ae4e228f 18288 EXPORT_SYMBOL(clear_page);
66a7e928
MT		 18289diff -urNp linux-2.6.39/arch/x86/kernel/xsave.c linux-2.6.39/arch/x86/kernel/xsave.c
18290--- linux-2.6.39/arch/x86/kernel/xsave.c 2011-05-19 00:06:34.000000000 -0400
18291+++ linux-2.6.39/arch/x86/kernel/xsave.c 2011-05-22 19:36:30.000000000 -0400
6892158b 18292@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
ae4e228f 18293 fx_sw_user->xstate_size > fx_sw_user->extended_size)
6892158b 18294 return -EINVAL;
ae4e228f
MT		 18295
18296- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18297+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18298 fx_sw_user->extended_size -
18299 FP_XSTATE_MAGIC2_SIZE));
6892158b
MT		 18300 if (err)
18301@@ -267,7 +267,7 @@ fx_only:
ae4e228f
MT		 18302 * the other extended state.
18303 */
18304 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18305- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18306+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
18307 }
18308
18309 /*
6892158b 18310@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
57199397 18311 if (use_xsave())
ae4e228f
MT		 18312 err = restore_user_xstate(buf);
18313 else
18314- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18315+ err = fxrstor_checking((struct i387_fxsave_struct __user *)
18316 buf);
18317 if (unlikely(err)) {
18318 /*
66a7e928
MT		 18319diff -urNp linux-2.6.39/arch/x86/kvm/emulate.c linux-2.6.39/arch/x86/kvm/emulate.c
18320--- linux-2.6.39/arch/x86/kvm/emulate.c 2011-05-19 00:06:34.000000000 -0400
18321+++ linux-2.6.39/arch/x86/kvm/emulate.c 2011-05-22 19:36:30.000000000 -0400
18322@@ -89,7 +89,7 @@
df50ba0c
MT		 18323 #define Src2ImmByte (2<<29)
18324 #define Src2One (3<<29)
bc901d79 18325 #define Src2Imm (4<<29)
57199397 18326-#define Src2Mask (7<<29)
df50ba0c
MT		 18327+#define Src2Mask (7U<<29)
18328
bc901d79
MT		 18329 #define X2(x...) x, x
18330 #define X3(x...) X2(x), x
66a7e928 18331@@ -190,6 +190,7 @@ struct group_dual {
ae4e228f 18332
bc901d79 18333 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
ae4e228f
MT		 18334 do { \
18335+ unsigned long _tmp; \
18336 __asm__ __volatile__ ( \
18337 _PRE_EFLAGS("0", "4", "2") \
18338 _op _suffix " %"_x"3,%1; " \
66a7e928 18339@@ -203,8 +204,6 @@ struct group_dual {
ae4e228f
MT		 18340 /* Raw emulation: instruction has two explicit operands. */
18341 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18342 do { \
18343- unsigned long _tmp; \
18344- \
18345 switch ((_dst).bytes) { \
18346 case 2: \
bc901d79 18347 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
66a7e928 18348@@ -220,7 +219,6 @@ struct group_dual {
ae4e228f
MT		 18349
18350 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18351 do { \
18352- unsigned long _tmp; \
18353 switch ((_dst).bytes) { \
18354 case 1: \
bc901d79 18355 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
66a7e928
MT		 18356diff -urNp linux-2.6.39/arch/x86/kvm/lapic.c linux-2.6.39/arch/x86/kvm/lapic.c
18357--- linux-2.6.39/arch/x86/kvm/lapic.c 2011-05-19 00:06:34.000000000 -0400
18358+++ linux-2.6.39/arch/x86/kvm/lapic.c 2011-05-22 19:36:30.000000000 -0400
6892158b 18359@@ -53,7 +53,7 @@
df50ba0c
MT		 18360 #define APIC_BUS_CYCLE_NS 1
18361
18362 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18363-#define apic_debug(fmt, arg...)
18364+#define apic_debug(fmt, arg...) do {} while (0)
18365
18366 #define APIC_LVT_NUM 6
18367 /* 14 is the version for Xeon and Pentium 8.4.8*/
66a7e928
MT		 18368diff -urNp linux-2.6.39/arch/x86/kvm/mmu.c linux-2.6.39/arch/x86/kvm/mmu.c
18369--- linux-2.6.39/arch/x86/kvm/mmu.c 2011-05-19 00:06:34.000000000 -0400
18370+++ linux-2.6.39/arch/x86/kvm/mmu.c 2011-05-22 19:36:30.000000000 -0400
18371@@ -3240,7 +3240,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
8308f9c9
MT		 18372
18373 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18374
18375- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18376+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18377
18378 /*
18379 * Assume that the pte write on a page table of the same type
66a7e928
MT		 18380@@ -3275,7 +3275,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18381 smp_rmb();
8308f9c9 18382
8308f9c9
MT		 18383 spin_lock(&vcpu->kvm->mmu_lock);
18384- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18385+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18386 gentry = 0;
8308f9c9 18387 kvm_mmu_free_some_pages(vcpu);
66a7e928
MT		 18388 ++vcpu->kvm->stat.mmu_pte_write;
18389diff -urNp linux-2.6.39/arch/x86/kvm/paging_tmpl.h linux-2.6.39/arch/x86/kvm/paging_tmpl.h
18390--- linux-2.6.39/arch/x86/kvm/paging_tmpl.h 2011-05-19 00:06:34.000000000 -0400
18391+++ linux-2.6.39/arch/x86/kvm/paging_tmpl.h 2011-05-22 19:36:30.000000000 -0400
18392@@ -552,6 +552,8 @@ static int FNAME(page_fault)(struct kvm_
18393 unsigned long mmu_seq;
18394 bool map_writable;
18395
18396+ pax_track_stack();
18397+
18398 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18399
18400 r = mmu_topup_memory_caches(vcpu);
18401@@ -672,7 +674,7 @@ static void FNAME(invlpg)(struct kvm_vcp
8308f9c9
MT		 18402 if (need_flush)
18403 kvm_flush_remote_tlbs(vcpu->kvm);
18404
18405- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18406+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18407
18408 spin_unlock(&vcpu->kvm->mmu_lock);
18409
66a7e928
MT		 18410diff -urNp linux-2.6.39/arch/x86/kvm/svm.c linux-2.6.39/arch/x86/kvm/svm.c
18411--- linux-2.6.39/arch/x86/kvm/svm.c 2011-05-19 00:06:34.000000000 -0400
18412+++ linux-2.6.39/arch/x86/kvm/svm.c 2011-05-22 19:36:30.000000000 -0400
18413@@ -3278,7 +3278,11 @@ static void reload_tss(struct kvm_vcpu *
58c5fc13
MT		 18414 int cpu = raw_smp_processor_id();
18415
ae4e228f 18416 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
58c5fc13 18417+
ae4e228f
MT		 18418+ pax_open_kernel();
18419 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18420+ pax_close_kernel();
58c5fc13
MT		 18421+
18422 load_TR_desc();
18423 }
18424
66a7e928
MT		 18425@@ -3656,6 +3660,10 @@ static void svm_vcpu_run(struct kvm_vcpu
18426 #endif
8308f9c9
MT		 18427 #endif
18428
18429+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18430+ __set_fs(current_thread_info()->addr_limit);
18431+#endif
18432+
18433 reload_tss(vcpu);
18434
18435 local_irq_disable();
66a7e928 18436@@ -3871,7 +3879,7 @@ static void svm_fpu_deactivate(struct kv
57199397 18437 update_cr0_intercept(svm);
58c5fc13
MT		 18438 }
18439
18440-static struct kvm_x86_ops svm_x86_ops = {
18441+static const struct kvm_x86_ops svm_x86_ops = {
18442 .cpu_has_kvm_support = has_svm,
18443 .disabled_by_bios = is_disabled,
18444 .hardware_setup = svm_hardware_setup,
66a7e928
MT		 18445diff -urNp linux-2.6.39/arch/x86/kvm/vmx.c linux-2.6.39/arch/x86/kvm/vmx.c
18446--- linux-2.6.39/arch/x86/kvm/vmx.c 2011-05-19 00:06:34.000000000 -0400
18447+++ linux-2.6.39/arch/x86/kvm/vmx.c 2011-05-22 19:36:30.000000000 -0400
16454cff 18448@@ -725,7 +725,11 @@ static void reload_tss(void)
bc901d79 18449 struct desc_struct *descs;
58c5fc13 18450
bc901d79 18451 descs = (void *)gdt->address;
58c5fc13 18452+
ae4e228f 18453+ pax_open_kernel();
58c5fc13 18454 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
ae4e228f 18455+ pax_close_kernel();
58c5fc13
MT		 18456+
18457 load_TR_desc();
18458 }
18459
66a7e928 18460@@ -1648,8 +1652,11 @@ static __init int hardware_setup(void)
58c5fc13
MT		 18461 if (!cpu_has_vmx_flexpriority())
18462 flexpriority_enabled = 0;
18463
18464- if (!cpu_has_vmx_tpr_shadow())
18465- kvm_x86_ops->update_cr8_intercept = NULL;
18466+ if (!cpu_has_vmx_tpr_shadow()) {
ae4e228f 18467+ pax_open_kernel();
58c5fc13 18468+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
ae4e228f 18469+ pax_close_kernel();
58c5fc13
MT		 18470+ }
18471
ae4e228f
MT		 18472 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18473 kvm_disable_largepages();
66a7e928 18474@@ -2693,7 +2700,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
57199397 18475 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
58c5fc13
MT		 18476
18477 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
18478- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
18479+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
18480 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
18481 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
57199397 18482 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
66a7e928 18483@@ -4068,6 +4075,12 @@ static void __noclone vmx_vcpu_run(struc
58c5fc13
MT		 18484 "jmp .Lkvm_vmx_return \n\t"
18485 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18486 ".Lkvm_vmx_return: "
18487+
18488+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18489+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18490+ ".Lkvm_vmx_return2: "
18491+#endif
18492+
18493 /* Save guest registers, load host registers, keep flags */
66a7e928
MT		 18494 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18495 "pop %0 \n\t"
18496@@ -4116,6 +4129,11 @@ static void __noclone vmx_vcpu_run(struc
58c5fc13 18497 #endif
66a7e928
MT		 18498 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18499 [wordsize]"i"(sizeof(ulong))
58c5fc13
MT		 18500+
18501+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18502+ ,[cs]"i"(__KERNEL_CS)
18503+#endif
18504+
18505 : "cc", "memory"
bc901d79 18506 , R"ax", R"bx", R"di", R"si"
58c5fc13 18507 #ifdef CONFIG_X86_64
66a7e928 18508@@ -4130,7 +4148,16 @@ static void __noclone vmx_vcpu_run(struc
bc901d79
MT		 18509
18510 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
58c5fc13
MT		 18511
18512- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
6892158b 18513+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
71d190be
MT		 18514+
18515+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
8308f9c9 18516+ loadsegment(fs, __KERNEL_PERCPU);
71d190be
MT		 18517+#endif
18518+
18519+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18520+ __set_fs(current_thread_info()->addr_limit);
18521+#endif
18522+
58c5fc13
MT		 18523 vmx->launched = 1;
18524
bc901d79 18525 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
66a7e928 18526@@ -4368,7 +4395,7 @@ static void vmx_set_supported_cpuid(u32
efbe55a5 18527 {
58c5fc13
MT		 18528 }
18529
18530-static struct kvm_x86_ops vmx_x86_ops = {
18531+static const struct kvm_x86_ops vmx_x86_ops = {
18532 .cpu_has_kvm_support = cpu_has_kvm_support,
18533 .disabled_by_bios = vmx_disabled_by_bios,
18534 .hardware_setup = hardware_setup,
66a7e928
MT		 18535diff -urNp linux-2.6.39/arch/x86/kvm/x86.c linux-2.6.39/arch/x86/kvm/x86.c
18536--- linux-2.6.39/arch/x86/kvm/x86.c 2011-05-19 00:06:34.000000000 -0400
18537+++ linux-2.6.39/arch/x86/kvm/x86.c 2011-05-22 19:36:30.000000000 -0400
18538@@ -94,7 +94,7 @@ static void update_cr8_intercept(struct
ae4e228f
MT		 18539 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
18540 struct kvm_cpuid_entry2 __user *entries);
58c5fc13
MT		 18541
18542-struct kvm_x86_ops *kvm_x86_ops;
18543+const struct kvm_x86_ops *kvm_x86_ops;
18544 EXPORT_SYMBOL_GPL(kvm_x86_ops);
18545
ae4e228f 18546 int ignore_msrs = 0;
66a7e928 18547@@ -2050,6 +2050,8 @@ long kvm_arch_dev_ioctl(struct file *fil
ae4e228f
MT		 18548 if (n < msr_list.nmsrs)
18549 goto out;
18550 r = -EFAULT;
18551+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18552+ goto out;
18553 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18554 num_msrs_to_save * sizeof(u32)))
18555 goto out;
66a7e928 18556@@ -2217,15 +2219,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
71d190be
MT		 18557 struct kvm_cpuid2 *cpuid,
18558 struct kvm_cpuid_entry2 __user *entries)
18559 {
18560- int r;
18561+ int r, i;
18562
18563 r = -E2BIG;
18564 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18565 goto out;
18566 r = -EFAULT;
18567- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18568- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18569+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18570 goto out;
18571+ for (i = 0; i < cpuid->nent; ++i) {
18572+ struct kvm_cpuid_entry2 cpuid_entry;
18573+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18574+ goto out;
18575+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18576+ }
18577 vcpu->arch.cpuid_nent = cpuid->nent;
18578 kvm_apic_set_version(vcpu);
18579 kvm_x86_ops->cpuid_update(vcpu);
66a7e928 18580@@ -2240,15 +2247,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
71d190be
MT		 18581 struct kvm_cpuid2 *cpuid,
18582 struct kvm_cpuid_entry2 __user *entries)
18583 {
18584- int r;
18585+ int r, i;
18586
18587 r = -E2BIG;
18588 if (cpuid->nent < vcpu->arch.cpuid_nent)
18589 goto out;
18590 r = -EFAULT;
18591- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18592- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18593+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18594 goto out;
18595+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18596+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18597+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18598+ goto out;
18599+ }
18600 return 0;
18601
18602 out:
66a7e928 18603@@ -2526,7 +2537,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
58c5fc13
MT		 18604 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18605 struct kvm_interrupt *irq)
18606 {
18607- if (irq->irq < 0 || irq->irq >= 256)
18608+ if (irq->irq >= 256)
18609 return -EINVAL;
18610 if (irqchip_in_kernel(vcpu->kvm))
18611 return -ENXIO;
66a7e928
MT		 18612@@ -4672,7 +4683,7 @@ static unsigned long kvm_get_guest_ip(vo
18613 return ip;
18614 }
18615
18616-static struct perf_guest_info_callbacks kvm_guest_cbs = {
18617+static const struct perf_guest_info_callbacks kvm_guest_cbs = {
18618 .is_in_guest = kvm_is_in_guest,
18619 .is_user_mode = kvm_is_user_mode,
18620 .get_guest_ip = kvm_get_guest_ip,
18621@@ -4690,10 +4701,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
ae4e228f 18622 }
57199397 18623 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
58c5fc13
MT		 18624
18625-int kvm_arch_init(void *opaque)
18626+int kvm_arch_init(const void *opaque)
18627 {
ae4e228f 18628 int r;
58c5fc13
MT		 18629- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18630+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
18631
18632 if (kvm_x86_ops) {
18633 printk(KERN_ERR "kvm: already loaded the other module\n");
66a7e928
MT		 18634diff -urNp linux-2.6.39/arch/x86/lib/atomic64_32.c linux-2.6.39/arch/x86/lib/atomic64_32.c
18635--- linux-2.6.39/arch/x86/lib/atomic64_32.c 2011-05-19 00:06:34.000000000 -0400
18636+++ linux-2.6.39/arch/x86/lib/atomic64_32.c 2011-05-22 19:36:30.000000000 -0400
18637@@ -8,18 +8,30 @@
8308f9c9
MT		 18638
18639 long long atomic64_read_cx8(long long, const atomic64_t *v);
18640 EXPORT_SYMBOL(atomic64_read_cx8);
18641+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18642+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18643 long long atomic64_set_cx8(long long, const atomic64_t *v);
18644 EXPORT_SYMBOL(atomic64_set_cx8);
66a7e928
MT		 18645+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18646+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
8308f9c9 18647 long long atomic64_xchg_cx8(long long, unsigned high);
66a7e928
MT		 18648 EXPORT_SYMBOL(atomic64_xchg_cx8);
18649 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18650 EXPORT_SYMBOL(atomic64_add_return_cx8);
18651+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18652+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18653 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
8308f9c9 18654 EXPORT_SYMBOL(atomic64_sub_return_cx8);
66a7e928
MT		 18655+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18656+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
8308f9c9
MT		 18657 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18658 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18659+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18660+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18661 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18662 EXPORT_SYMBOL(atomic64_dec_return_cx8);
66a7e928
MT		 18663+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18664+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
8308f9c9 18665 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
66a7e928
MT		 18666 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18667 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18668@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18669 #ifndef CONFIG_X86_CMPXCHG64
18670 long long atomic64_read_386(long long, const atomic64_t *v);
18671 EXPORT_SYMBOL(atomic64_read_386);
18672+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18673+EXPORT_SYMBOL(atomic64_read_unchecked_386);
18674 long long atomic64_set_386(long long, const atomic64_t *v);
18675 EXPORT_SYMBOL(atomic64_set_386);
18676+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18677+EXPORT_SYMBOL(atomic64_set_unchecked_386);
18678 long long atomic64_xchg_386(long long, unsigned high);
18679 EXPORT_SYMBOL(atomic64_xchg_386);
18680 long long atomic64_add_return_386(long long a, atomic64_t *v);
18681 EXPORT_SYMBOL(atomic64_add_return_386);
18682+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18683+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18684 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18685 EXPORT_SYMBOL(atomic64_sub_return_386);
18686+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18687+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18688 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18689 EXPORT_SYMBOL(atomic64_inc_return_386);
18690+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18691+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18692 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18693 EXPORT_SYMBOL(atomic64_dec_return_386);
18694+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18695+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18696 long long atomic64_add_386(long long a, atomic64_t *v);
18697 EXPORT_SYMBOL(atomic64_add_386);
18698+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18699+EXPORT_SYMBOL(atomic64_add_unchecked_386);
18700 long long atomic64_sub_386(long long a, atomic64_t *v);
18701 EXPORT_SYMBOL(atomic64_sub_386);
18702+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18703+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18704 long long atomic64_inc_386(long long a, atomic64_t *v);
18705 EXPORT_SYMBOL(atomic64_inc_386);
18706+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18707+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18708 long long atomic64_dec_386(long long a, atomic64_t *v);
18709 EXPORT_SYMBOL(atomic64_dec_386);
18710+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18711+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18712 long long atomic64_dec_if_positive_386(atomic64_t *v);
18713 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18714 int atomic64_inc_not_zero_386(atomic64_t *v);
18715diff -urNp linux-2.6.39/arch/x86/lib/atomic64_386_32.S linux-2.6.39/arch/x86/lib/atomic64_386_32.S
18716--- linux-2.6.39/arch/x86/lib/atomic64_386_32.S 2011-05-19 00:06:34.000000000 -0400
18717+++ linux-2.6.39/arch/x86/lib/atomic64_386_32.S 2011-05-22 19:36:30.000000000 -0400
18718@@ -48,6 +48,10 @@ BEGIN(read)
18719 movl (v), %eax
18720 movl 4(v), %edx
18721 RET_ENDP
18722+BEGIN(read_unchecked)
18723+ movl (v), %eax
18724+ movl 4(v), %edx
18725+RET_ENDP
18726 #undef v
18727
18728 #define v %esi
18729@@ -55,6 +59,10 @@ BEGIN(set)
18730 movl %ebx, (v)
18731 movl %ecx, 4(v)
18732 RET_ENDP
18733+BEGIN(set_unchecked)
18734+ movl %ebx, (v)
18735+ movl %ecx, 4(v)
18736+RET_ENDP
18737 #undef v
18738
18739 #define v %esi
18740@@ -70,6 +78,20 @@ RET_ENDP
18741 BEGIN(add)
18742 addl %eax, (v)
18743 adcl %edx, 4(v)
18744+
18745+#ifdef CONFIG_PAX_REFCOUNT
18746+ jno 0f
18747+ subl %eax, (v)
18748+ sbbl %edx, 4(v)
18749+ int $4
18750+0:
18751+ _ASM_EXTABLE(0b, 0b)
18752+#endif
18753+
18754+RET_ENDP
18755+BEGIN(add_unchecked)
18756+ addl %eax, (v)
18757+ adcl %edx, 4(v)
18758 RET_ENDP
18759 #undef v
18760
18761@@ -77,6 +99,24 @@ RET_ENDP
18762 BEGIN(add_return)
18763 addl (v), %eax
18764 adcl 4(v), %edx
18765+
18766+#ifdef CONFIG_PAX_REFCOUNT
18767+ into
18768+1234:
18769+ _ASM_EXTABLE(1234b, 2f)
18770+#endif
18771+
18772+ movl %eax, (v)
18773+ movl %edx, 4(v)
18774+
18775+#ifdef CONFIG_PAX_REFCOUNT
18776+2:
18777+#endif
18778+
18779+RET_ENDP
18780+BEGIN(add_return_unchecked)
18781+ addl (v), %eax
18782+ adcl 4(v), %edx
18783 movl %eax, (v)
18784 movl %edx, 4(v)
18785 RET_ENDP
18786@@ -86,6 +126,20 @@ RET_ENDP
18787 BEGIN(sub)
18788 subl %eax, (v)
18789 sbbl %edx, 4(v)
18790+
18791+#ifdef CONFIG_PAX_REFCOUNT
18792+ jno 0f
18793+ addl %eax, (v)
18794+ adcl %edx, 4(v)
18795+ int $4
18796+0:
18797+ _ASM_EXTABLE(0b, 0b)
18798+#endif
18799+
18800+RET_ENDP
18801+BEGIN(sub_unchecked)
18802+ subl %eax, (v)
18803+ sbbl %edx, 4(v)
18804 RET_ENDP
18805 #undef v
18806
18807@@ -96,6 +150,27 @@ BEGIN(sub_return)
18808 sbbl $0, %edx
18809 addl (v), %eax
18810 adcl 4(v), %edx
18811+
18812+#ifdef CONFIG_PAX_REFCOUNT
18813+ into
18814+1234:
18815+ _ASM_EXTABLE(1234b, 2f)
18816+#endif
18817+
18818+ movl %eax, (v)
18819+ movl %edx, 4(v)
18820+
18821+#ifdef CONFIG_PAX_REFCOUNT
18822+2:
18823+#endif
18824+
18825+RET_ENDP
18826+BEGIN(sub_return_unchecked)
18827+ negl %edx
18828+ negl %eax
18829+ sbbl $0, %edx
18830+ addl (v), %eax
18831+ adcl 4(v), %edx
18832 movl %eax, (v)
18833 movl %edx, 4(v)
18834 RET_ENDP
18835@@ -105,6 +180,20 @@ RET_ENDP
18836 BEGIN(inc)
18837 addl $1, (v)
18838 adcl $0, 4(v)
18839+
18840+#ifdef CONFIG_PAX_REFCOUNT
18841+ jno 0f
18842+ subl $1, (v)
18843+ sbbl $0, 4(v)
18844+ int $4
18845+0:
18846+ _ASM_EXTABLE(0b, 0b)
18847+#endif
18848+
18849+RET_ENDP
18850+BEGIN(inc_unchecked)
18851+ addl $1, (v)
18852+ adcl $0, 4(v)
18853 RET_ENDP
18854 #undef v
18855
18856@@ -114,6 +203,26 @@ BEGIN(inc_return)
18857 movl 4(v), %edx
18858 addl $1, %eax
18859 adcl $0, %edx
18860+
18861+#ifdef CONFIG_PAX_REFCOUNT
18862+ into
18863+1234:
18864+ _ASM_EXTABLE(1234b, 2f)
18865+#endif
18866+
18867+ movl %eax, (v)
18868+ movl %edx, 4(v)
18869+
18870+#ifdef CONFIG_PAX_REFCOUNT
18871+2:
18872+#endif
18873+
18874+RET_ENDP
18875+BEGIN(inc_return_unchecked)
18876+ movl (v), %eax
18877+ movl 4(v), %edx
18878+ addl $1, %eax
18879+ adcl $0, %edx
18880 movl %eax, (v)
18881 movl %edx, 4(v)
18882 RET_ENDP
18883@@ -123,6 +232,20 @@ RET_ENDP
18884 BEGIN(dec)
18885 subl $1, (v)
18886 sbbl $0, 4(v)
18887+
18888+#ifdef CONFIG_PAX_REFCOUNT
18889+ jno 0f
18890+ addl $1, (v)
18891+ adcl $0, 4(v)
18892+ int $4
18893+0:
18894+ _ASM_EXTABLE(0b, 0b)
18895+#endif
18896+
18897+RET_ENDP
18898+BEGIN(dec_unchecked)
18899+ subl $1, (v)
18900+ sbbl $0, 4(v)
18901 RET_ENDP
18902 #undef v
18903
18904@@ -132,6 +255,26 @@ BEGIN(dec_return)
18905 movl 4(v), %edx
18906 subl $1, %eax
18907 sbbl $0, %edx
18908+
18909+#ifdef CONFIG_PAX_REFCOUNT
18910+ into
18911+1234:
18912+ _ASM_EXTABLE(1234b, 2f)
18913+#endif
18914+
18915+ movl %eax, (v)
18916+ movl %edx, 4(v)
18917+
18918+#ifdef CONFIG_PAX_REFCOUNT
18919+2:
18920+#endif
18921+
18922+RET_ENDP
18923+BEGIN(dec_return_unchecked)
18924+ movl (v), %eax
18925+ movl 4(v), %edx
18926+ subl $1, %eax
18927+ sbbl $0, %edx
18928 movl %eax, (v)
18929 movl %edx, 4(v)
18930 RET_ENDP
18931@@ -143,6 +286,13 @@ BEGIN(add_unless)
18932 adcl %edx, %edi
18933 addl (v), %eax
18934 adcl 4(v), %edx
18935+
18936+#ifdef CONFIG_PAX_REFCOUNT
18937+ into
18938+1234:
18939+ _ASM_EXTABLE(1234b, 2f)
18940+#endif
18941+
18942 cmpl %eax, %esi
18943 je 3f
18944 1:
18945@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18946 1:
18947 addl $1, %eax
18948 adcl $0, %edx
18949+
18950+#ifdef CONFIG_PAX_REFCOUNT
18951+ into
18952+1234:
18953+ _ASM_EXTABLE(1234b, 2f)
18954+#endif
18955+
18956 movl %eax, (v)
18957 movl %edx, 4(v)
18958 movl $1, %eax
18959@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18960 movl 4(v), %edx
18961 subl $1, %eax
18962 sbbl $0, %edx
18963+
18964+#ifdef CONFIG_PAX_REFCOUNT
18965+ into
18966+1234:
18967+ _ASM_EXTABLE(1234b, 1f)
18968+#endif
18969+
18970 js 1f
18971 movl %eax, (v)
18972 movl %edx, 4(v)
18973diff -urNp linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S
18974--- linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S 2011-05-19 00:06:34.000000000 -0400
18975+++ linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S 2011-05-22 19:36:30.000000000 -0400
18976@@ -39,6 +39,14 @@ ENTRY(atomic64_read_cx8)
8308f9c9
MT		 18977 CFI_ENDPROC
18978 ENDPROC(atomic64_read_cx8)
18979
18980+ENTRY(atomic64_read_unchecked_cx8)
18981+ CFI_STARTPROC
18982+
18983+ read64 %ecx
18984+ ret
18985+ CFI_ENDPROC
66a7e928 18986+ENDPROC(atomic64_read_unchecked_cx8)
8308f9c9
MT		 18987+
18988 ENTRY(atomic64_set_cx8)
18989 CFI_STARTPROC
18990
66a7e928
MT		 18991@@ -52,6 +60,19 @@ ENTRY(atomic64_set_cx8)
18992 CFI_ENDPROC
18993 ENDPROC(atomic64_set_cx8)
18994
18995+ENTRY(atomic64_set_unchecked_cx8)
18996+ CFI_STARTPROC
18997+
18998+1:
18999+/* we don't need LOCK_PREFIX since aligned 64-bit writes
19000+ * are atomic on 586 and newer */
19001+ cmpxchg8b (%esi)
19002+ jne 1b
19003+
19004+ ret
19005+ CFI_ENDPROC
19006+ENDPROC(atomic64_set_unchecked_cx8)
19007+
19008 ENTRY(atomic64_xchg_cx8)
19009 CFI_STARTPROC
19010
19011@@ -66,8 +87,8 @@ ENTRY(atomic64_xchg_cx8)
8308f9c9
MT		 19012 CFI_ENDPROC
19013 ENDPROC(atomic64_xchg_cx8)
19014
19015-.macro addsub_return func ins insc
19016-ENTRY(atomic64_\func\()_return_cx8)
19017+.macro addsub_return func ins insc unchecked=""
19018+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19019 CFI_STARTPROC
19020 SAVE ebp
19021 SAVE ebx
66a7e928 19022@@ -84,27 +105,43 @@ ENTRY(atomic64_\func\()_return_cx8)
6892158b
MT		 19023 movl %edx, %ecx
19024 \ins\()l %esi, %ebx
19025 \insc\()l %edi, %ecx
19026+
8308f9c9 19027+.ifb \unchecked
6892158b
MT		 19028+#ifdef CONFIG_PAX_REFCOUNT
19029+ into
19030+2:
19031+ _ASM_EXTABLE(2b, 3f)
19032+#endif
8308f9c9 19033+.endif
6892158b
MT		 19034+
19035 LOCK_PREFIX
19036 cmpxchg8b (%ebp)
19037 jne 1b
19038-
19039-10:
19040 movl %ebx, %eax
19041 movl %ecx, %edx
19042+
8308f9c9 19043+.ifb \unchecked
6892158b
MT		 19044+#ifdef CONFIG_PAX_REFCOUNT
19045+3:
19046+#endif
8308f9c9 19047+.endif
6892158b
MT		 19048+
19049 RESTORE edi
19050 RESTORE esi
19051 RESTORE ebx
66a7e928
MT		 19052 RESTORE ebp
19053 ret
19054 CFI_ENDPROC
19055-ENDPROC(atomic64_\func\()_return_cx8)
19056+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19057 .endm
8308f9c9
MT		 19058
19059 addsub_return add add adc
19060 addsub_return sub sub sbb
19061+addsub_return add add adc _unchecked
66a7e928 19062+addsub_return sub sub sbb _unchecked
8308f9c9
MT		 19063
19064-.macro incdec_return func ins insc
19065-ENTRY(atomic64_\func\()_return_cx8)
19066+.macro incdec_return func ins insc unchecked
19067+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19068 CFI_STARTPROC
19069 SAVE ebx
19070
66a7e928 19071@@ -114,21 +151,38 @@ ENTRY(atomic64_\func\()_return_cx8)
6892158b
MT		 19072 movl %edx, %ecx
19073 \ins\()l $1, %ebx
19074 \insc\()l $0, %ecx
19075+
8308f9c9 19076+.ifb \unchecked
6892158b
MT		 19077+#ifdef CONFIG_PAX_REFCOUNT
19078+ into
19079+2:
19080+ _ASM_EXTABLE(2b, 3f)
19081+#endif
8308f9c9 19082+.endif
6892158b
MT		 19083+
19084 LOCK_PREFIX
19085 cmpxchg8b (%esi)
19086 jne 1b
19087
19088-10:
19089 movl %ebx, %eax
19090 movl %ecx, %edx
19091+
8308f9c9 19092+.ifb \unchecked
6892158b
MT		 19093+#ifdef CONFIG_PAX_REFCOUNT
19094+3:
19095+#endif
8308f9c9 19096+.endif
6892158b
MT		 19097+
19098 RESTORE ebx
19099 ret
19100 CFI_ENDPROC
66a7e928
MT		 19101-ENDPROC(atomic64_\func\()_return_cx8)
19102+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19103 .endm
8308f9c9
MT		 19104
19105 incdec_return inc add adc
19106 incdec_return dec sub sbb
19107+incdec_return inc add adc _unchecked
66a7e928 19108+incdec_return dec sub sbb _unchecked
8308f9c9
MT		 19109
19110 ENTRY(atomic64_dec_if_positive_cx8)
19111 CFI_STARTPROC
66a7e928
MT		 19112@@ -140,6 +194,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
19113 movl %edx, %ecx
19114 subl $1, %ebx
19115 sbb $0, %ecx
19116+
19117+#ifdef CONFIG_PAX_REFCOUNT
19118+ into
19119+1234:
19120+ _ASM_EXTABLE(1234b, 2f)
19121+#endif
19122+
19123 js 2f
19124 LOCK_PREFIX
19125 cmpxchg8b (%esi)
19126@@ -174,6 +235,13 @@ ENTRY(atomic64_add_unless_cx8)
6892158b
MT		 19127 movl %edx, %ecx
19128 addl %esi, %ebx
19129 adcl %edi, %ecx
19130+
19131+#ifdef CONFIG_PAX_REFCOUNT
19132+ into
19133+1234:
66a7e928 19134+ _ASM_EXTABLE(1234b, 3f)
6892158b
MT		 19135+#endif
19136+
19137 LOCK_PREFIX
19138 cmpxchg8b (%ebp)
19139 jne 1b
66a7e928 19140@@ -206,6 +274,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
6892158b
MT		 19141 movl %edx, %ecx
19142 addl $1, %ebx
19143 adcl $0, %ecx
19144+
19145+#ifdef CONFIG_PAX_REFCOUNT
19146+ into
19147+1234:
66a7e928 19148+ _ASM_EXTABLE(1234b, 3f)
6892158b
MT		 19149+#endif
19150+
19151 LOCK_PREFIX
19152 cmpxchg8b (%esi)
19153 jne 1b
66a7e928
MT		 19154diff -urNp linux-2.6.39/arch/x86/lib/checksum_32.S linux-2.6.39/arch/x86/lib/checksum_32.S
19155--- linux-2.6.39/arch/x86/lib/checksum_32.S 2011-05-19 00:06:34.000000000 -0400
19156+++ linux-2.6.39/arch/x86/lib/checksum_32.S 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 19157@@ -28,7 +28,8 @@
19158 #include <linux/linkage.h>
19159 #include <asm/dwarf2.h>
19160 #include <asm/errno.h>
19161-
19162+#include <asm/segment.h>
19163+
19164 /*
19165 * computes a partial checksum, e.g. for TCP/UDP fragments
19166 */
66a7e928 19167@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
58c5fc13
MT		 19168
19169 #define ARGBASE 16
19170 #define FP 12
19171-
19172-ENTRY(csum_partial_copy_generic)
19173+
19174+ENTRY(csum_partial_copy_generic_to_user)
19175 CFI_STARTPROC
bc901d79
MT		 19176+
19177+#ifdef CONFIG_PAX_MEMORY_UDEREF
66a7e928
MT		 19178+ pushl_cfi %gs
19179+ popl_cfi %es
58c5fc13 19180+ jmp csum_partial_copy_generic
bc901d79 19181+#endif
58c5fc13
MT		 19182+
19183+ENTRY(csum_partial_copy_generic_from_user)
bc901d79
MT		 19184+
19185+#ifdef CONFIG_PAX_MEMORY_UDEREF
66a7e928
MT		 19186+ pushl_cfi %gs
19187+ popl_cfi %ds
bc901d79 19188+#endif
58c5fc13
MT		 19189+
19190+ENTRY(csum_partial_copy_generic)
19191 subl $4,%esp
19192 CFI_ADJUST_CFA_OFFSET 4
66a7e928
MT		 19193 pushl_cfi %edi
19194@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
58c5fc13
MT		 19195 jmp 4f
19196 SRC(1: movw (%esi), %bx )
19197 addl $2, %esi
19198-DST( movw %bx, (%edi) )
19199+DST( movw %bx, %es:(%edi) )
19200 addl $2, %edi
19201 addw %bx, %ax
19202 adcl $0, %eax
66a7e928 19203@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
58c5fc13
MT		 19204 SRC(1: movl (%esi), %ebx )
19205 SRC( movl 4(%esi), %edx )
19206 adcl %ebx, %eax
19207-DST( movl %ebx, (%edi) )
19208+DST( movl %ebx, %es:(%edi) )
19209 adcl %edx, %eax
19210-DST( movl %edx, 4(%edi) )
19211+DST( movl %edx, %es:4(%edi) )
19212
19213 SRC( movl 8(%esi), %ebx )
19214 SRC( movl 12(%esi), %edx )
19215 adcl %ebx, %eax
19216-DST( movl %ebx, 8(%edi) )
19217+DST( movl %ebx, %es:8(%edi) )
19218 adcl %edx, %eax
19219-DST( movl %edx, 12(%edi) )
19220+DST( movl %edx, %es:12(%edi) )
19221
19222 SRC( movl 16(%esi), %ebx )
19223 SRC( movl 20(%esi), %edx )
19224 adcl %ebx, %eax
19225-DST( movl %ebx, 16(%edi) )
19226+DST( movl %ebx, %es:16(%edi) )
19227 adcl %edx, %eax
19228-DST( movl %edx, 20(%edi) )
19229+DST( movl %edx, %es:20(%edi) )
19230
19231 SRC( movl 24(%esi), %ebx )
19232 SRC( movl 28(%esi), %edx )
19233 adcl %ebx, %eax
19234-DST( movl %ebx, 24(%edi) )
19235+DST( movl %ebx, %es:24(%edi) )
19236 adcl %edx, %eax
19237-DST( movl %edx, 28(%edi) )
19238+DST( movl %edx, %es:28(%edi) )
19239
19240 lea 32(%esi), %esi
19241 lea 32(%edi), %edi
66a7e928 19242@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
58c5fc13
MT		 19243 shrl $2, %edx # This clears CF
19244 SRC(3: movl (%esi), %ebx )
19245 adcl %ebx, %eax
19246-DST( movl %ebx, (%edi) )
19247+DST( movl %ebx, %es:(%edi) )
19248 lea 4(%esi), %esi
19249 lea 4(%edi), %edi
19250 dec %edx
66a7e928 19251@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
58c5fc13
MT		 19252 jb 5f
19253 SRC( movw (%esi), %cx )
19254 leal 2(%esi), %esi
19255-DST( movw %cx, (%edi) )
19256+DST( movw %cx, %es:(%edi) )
19257 leal 2(%edi), %edi
19258 je 6f
19259 shll $16,%ecx
19260 SRC(5: movb (%esi), %cl )
19261-DST( movb %cl, (%edi) )
19262+DST( movb %cl, %es:(%edi) )
19263 6: addl %ecx, %eax
19264 adcl $0, %eax
19265 7:
66a7e928 19266@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
58c5fc13
MT		 19267
19268 6001:
19269 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19270- movl $-EFAULT, (%ebx)
19271+ movl $-EFAULT, %ss:(%ebx)
19272
19273 # zero the complete destination - computing the rest
19274 # is too much work
66a7e928 19275@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
58c5fc13
MT		 19276
19277 6002:
19278 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19279- movl $-EFAULT,(%ebx)
19280+ movl $-EFAULT,%ss:(%ebx)
19281 jmp 5000b
19282
19283 .previous
19284
66a7e928
MT		 19285+ pushl_cfi %ss
19286+ popl_cfi %ds
19287+ pushl_cfi %ss
19288+ popl_cfi %es
19289 popl_cfi %ebx
58c5fc13 19290 CFI_RESTORE ebx
66a7e928
MT		 19291 popl_cfi %esi
19292@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19293 popl_cfi %ecx # equivalent to addl $4,%esp
58c5fc13
MT		 19294 ret
19295 CFI_ENDPROC
19296-ENDPROC(csum_partial_copy_generic)
19297+ENDPROC(csum_partial_copy_generic_to_user)
19298
19299 #else
19300
19301 /* Version for PentiumII/PPro */
19302
19303 #define ROUND1(x) \
19304+ nop; nop; nop; \
19305 SRC(movl x(%esi), %ebx ) ; \
19306 addl %ebx, %eax ; \
19307- DST(movl %ebx, x(%edi) ) ;
19308+ DST(movl %ebx, %es:x(%edi)) ;
19309
19310 #define ROUND(x) \
19311+ nop; nop; nop; \
19312 SRC(movl x(%esi), %ebx ) ; \
19313 adcl %ebx, %eax ; \
19314- DST(movl %ebx, x(%edi) ) ;
19315+ DST(movl %ebx, %es:x(%edi)) ;
19316
19317 #define ARGBASE 12
19318-
19319-ENTRY(csum_partial_copy_generic)
19320+
19321+ENTRY(csum_partial_copy_generic_to_user)
19322 CFI_STARTPROC
bc901d79
MT		 19323+
19324+#ifdef CONFIG_PAX_MEMORY_UDEREF
66a7e928
MT		 19325+ pushl_cfi %gs
19326+ popl_cfi %es
58c5fc13 19327+ jmp csum_partial_copy_generic
bc901d79 19328+#endif
58c5fc13
MT		 19329+
19330+ENTRY(csum_partial_copy_generic_from_user)
bc901d79
MT		 19331+
19332+#ifdef CONFIG_PAX_MEMORY_UDEREF
66a7e928
MT		 19333+ pushl_cfi %gs
19334+ popl_cfi %ds
bc901d79 19335+#endif
58c5fc13
MT		 19336+
19337+ENTRY(csum_partial_copy_generic)
66a7e928 19338 pushl_cfi %ebx
58c5fc13 19339 CFI_REL_OFFSET ebx, 0
66a7e928
MT		 19340 pushl_cfi %edi
19341@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
58c5fc13
MT		 19342 subl %ebx, %edi
19343 lea -1(%esi),%edx
19344 andl $-32,%edx
19345- lea 3f(%ebx,%ebx), %ebx
19346+ lea 3f(%ebx,%ebx,2), %ebx
19347 testl %esi, %esi
19348 jmp *%ebx
19349 1: addl $64,%esi
66a7e928 19350@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
58c5fc13
MT		 19351 jb 5f
19352 SRC( movw (%esi), %dx )
19353 leal 2(%esi), %esi
19354-DST( movw %dx, (%edi) )
19355+DST( movw %dx, %es:(%edi) )
19356 leal 2(%edi), %edi
19357 je 6f
19358 shll $16,%edx
19359 5:
19360 SRC( movb (%esi), %dl )
19361-DST( movb %dl, (%edi) )
19362+DST( movb %dl, %es:(%edi) )
19363 6: addl %edx, %eax
19364 adcl $0, %eax
19365 7:
19366 .section .fixup, "ax"
19367 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19368- movl $-EFAULT, (%ebx)
19369+ movl $-EFAULT, %ss:(%ebx)
19370 # zero the complete destination (computing the rest is too much work)
19371 movl ARGBASE+8(%esp),%edi # dst
19372 movl ARGBASE+12(%esp),%ecx # len
66a7e928 19373@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
58c5fc13
MT		 19374 rep; stosb
19375 jmp 7b
19376 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19377- movl $-EFAULT, (%ebx)
19378+ movl $-EFAULT, %ss:(%ebx)
19379 jmp 7b
19380 .previous
19381
bc901d79 19382+#ifdef CONFIG_PAX_MEMORY_UDEREF
66a7e928
MT		 19383+ pushl_cfi %ss
19384+ popl_cfi %ds
19385+ pushl_cfi %ss
19386+ popl_cfi %es
bc901d79
MT		 19387+#endif
19388+
66a7e928 19389 popl_cfi %esi
58c5fc13 19390 CFI_RESTORE esi
66a7e928
MT		 19391 popl_cfi %edi
19392@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
58c5fc13
MT		 19393 CFI_RESTORE ebx
19394 ret
19395 CFI_ENDPROC
19396-ENDPROC(csum_partial_copy_generic)
19397+ENDPROC(csum_partial_copy_generic_to_user)
19398
19399 #undef ROUND
19400 #undef ROUND1
66a7e928
MT		 19401diff -urNp linux-2.6.39/arch/x86/lib/clear_page_64.S linux-2.6.39/arch/x86/lib/clear_page_64.S
19402--- linux-2.6.39/arch/x86/lib/clear_page_64.S 2011-05-19 00:06:34.000000000 -0400
19403+++ linux-2.6.39/arch/x86/lib/clear_page_64.S 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 19404@@ -43,7 +43,7 @@ ENDPROC(clear_page)
19405
19406 #include <asm/cpufeature.h>
19407
19408- .section .altinstr_replacement,"ax"
19409+ .section .altinstr_replacement,"a"
19410 1: .byte 0xeb /* jmp <disp8> */
19411 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19412 2:
66a7e928
MT		 19413diff -urNp linux-2.6.39/arch/x86/lib/copy_page_64.S linux-2.6.39/arch/x86/lib/copy_page_64.S
19414--- linux-2.6.39/arch/x86/lib/copy_page_64.S 2011-05-19 00:06:34.000000000 -0400
19415+++ linux-2.6.39/arch/x86/lib/copy_page_64.S 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 19416@@ -104,7 +104,7 @@ ENDPROC(copy_page)
19417
19418 #include <asm/cpufeature.h>
19419
19420- .section .altinstr_replacement,"ax"
19421+ .section .altinstr_replacement,"a"
19422 1: .byte 0xeb /* jmp <disp8> */
19423 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19424 2:
66a7e928
MT		 19425diff -urNp linux-2.6.39/arch/x86/lib/copy_user_64.S linux-2.6.39/arch/x86/lib/copy_user_64.S
19426--- linux-2.6.39/arch/x86/lib/copy_user_64.S 2011-05-19 00:06:34.000000000 -0400
19427+++ linux-2.6.39/arch/x86/lib/copy_user_64.S 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 19428@@ -15,13 +15,14 @@
19429 #include <asm/asm-offsets.h>
19430 #include <asm/thread_info.h>
19431 #include <asm/cpufeature.h>
19432+#include <asm/pgtable.h>
19433
19434 .macro ALTERNATIVE_JUMP feature,orig,alt
19435 0:
58c5fc13
MT		 19436 .byte 0xe9 /* 32bit jump */
19437 .long \orig-1f /* by default jump to orig */
19438 1:
19439- .section .altinstr_replacement,"ax"
19440+ .section .altinstr_replacement,"a"
19441 2: .byte 0xe9 /* near jump with 32bit immediate */
19442 .long \alt-1b /* offset */ /* or alternatively to alt */
19443 .previous
df50ba0c 19444@@ -64,37 +65,13 @@
58c5fc13
MT		 19445 #endif
19446 .endm
19447
19448-/* Standard copy_to_user with segment limit checking */
ae4e228f 19449-ENTRY(_copy_to_user)
58c5fc13
MT		 19450- CFI_STARTPROC
19451- GET_THREAD_INFO(%rax)
19452- movq %rdi,%rcx
19453- addq %rdx,%rcx
19454- jc bad_to_user
19455- cmpq TI_addr_limit(%rax),%rcx
19456- jae bad_to_user
19457- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19458- CFI_ENDPROC
ae4e228f 19459-ENDPROC(_copy_to_user)
58c5fc13
MT		 19460-
19461-/* Standard copy_from_user with segment limit checking */
ae4e228f 19462-ENTRY(_copy_from_user)
58c5fc13
MT		 19463- CFI_STARTPROC
19464- GET_THREAD_INFO(%rax)
19465- movq %rsi,%rcx
19466- addq %rdx,%rcx
19467- jc bad_from_user
19468- cmpq TI_addr_limit(%rax),%rcx
19469- jae bad_from_user
19470- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19471- CFI_ENDPROC
ae4e228f 19472-ENDPROC(_copy_from_user)
58c5fc13 19473-
df50ba0c
MT		 19474 .section .fixup,"ax"
19475 /* must zero dest */
58c5fc13
MT		 19476 ENTRY(bad_from_user)
19477 bad_from_user:
19478 CFI_STARTPROC
19479+ testl %edx,%edx
19480+ js bad_to_user
19481 movl %edx,%ecx
19482 xorl %eax,%eax
19483 rep
66a7e928
MT		 19484diff -urNp linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S
19485--- linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S 2011-05-19 00:06:34.000000000 -0400
19486+++ linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 19487@@ -14,6 +14,7 @@
19488 #include <asm/current.h>
19489 #include <asm/asm-offsets.h>
19490 #include <asm/thread_info.h>
19491+#include <asm/pgtable.h>
19492
19493 .macro ALIGN_DESTINATION
19494 #ifdef FIX_ALIGNMENT
19495@@ -50,6 +51,15 @@
19496 */
19497 ENTRY(__copy_user_nocache)
19498 CFI_STARTPROC
19499+
19500+#ifdef CONFIG_PAX_MEMORY_UDEREF
19501+ mov $PAX_USER_SHADOW_BASE,%rcx
19502+ cmp %rcx,%rsi
19503+ jae 1f
19504+ add %rcx,%rsi
19505+1:
19506+#endif
19507+
19508 cmpl $8,%edx
19509 jb 20f /* less then 8 bytes, go to byte copy loop */
19510 ALIGN_DESTINATION
66a7e928
MT		 19511diff -urNp linux-2.6.39/arch/x86/lib/csum-wrappers_64.c linux-2.6.39/arch/x86/lib/csum-wrappers_64.c
19512--- linux-2.6.39/arch/x86/lib/csum-wrappers_64.c 2011-05-19 00:06:34.000000000 -0400
19513+++ linux-2.6.39/arch/x86/lib/csum-wrappers_64.c 2011-05-22 19:36:30.000000000 -0400
8308f9c9 19514@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
df50ba0c
MT		 19515 len -= 2;
19516 }
19517 }
8308f9c9
MT		 19518+
19519+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 19520+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19521+ src += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 19522+#endif
19523+
df50ba0c
MT		 19524 isum = csum_partial_copy_generic((__force const void *)src,
19525 dst, len, isum, errp, NULL);
19526 if (unlikely(*errp))
8308f9c9 19527@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
df50ba0c
MT		 19528 }
19529
19530 *errp = 0;
8308f9c9
MT		 19531+
19532+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 19533+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19534+ dst += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 19535+#endif
19536+
df50ba0c
MT		 19537 return csum_partial_copy_generic(src, (void __force *)dst,
19538 len, isum, NULL, errp);
19539 }
66a7e928
MT		 19540diff -urNp linux-2.6.39/arch/x86/lib/getuser.S linux-2.6.39/arch/x86/lib/getuser.S
19541--- linux-2.6.39/arch/x86/lib/getuser.S 2011-05-19 00:06:34.000000000 -0400
19542+++ linux-2.6.39/arch/x86/lib/getuser.S 2011-05-22 19:36:30.000000000 -0400
bc901d79 19543@@ -33,14 +33,35 @@
58c5fc13
MT		 19544 #include <asm/asm-offsets.h>
19545 #include <asm/thread_info.h>
19546 #include <asm/asm.h>
19547+#include <asm/segment.h>
df50ba0c 19548+#include <asm/pgtable.h>
bc901d79
MT		 19549+
19550+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
16454cff 19551+#define __copyuser_seg gs;
bc901d79
MT		 19552+#else
19553+#define __copyuser_seg
19554+#endif
58c5fc13
MT		 19555
19556 .text
19557 ENTRY(__get_user_1)
ae4e228f 19558 CFI_STARTPROC
58c5fc13 19559+
bc901d79 19560+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 19561 GET_THREAD_INFO(%_ASM_DX)
19562 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19563 jae bad_get_user
bc901d79 19564-1: movzb (%_ASM_AX),%edx
df50ba0c
MT		 19565+
19566+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19567+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19568+ cmp %_ASM_DX,%_ASM_AX
19569+ jae 1234f
19570+ add %_ASM_DX,%_ASM_AX
19571+1234:
19572+#endif
19573+
58c5fc13
MT		 19574+#endif
19575+
16454cff 19576+1: __copyuser_seg movzb (%_ASM_AX),%edx
58c5fc13
MT		 19577 xor %eax,%eax
19578 ret
19579 CFI_ENDPROC
bc901d79 19580@@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
ae4e228f
MT		 19581 ENTRY(__get_user_2)
19582 CFI_STARTPROC
19583 add $1,%_ASM_AX
58c5fc13 19584+
bc901d79 19585+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 19586 jc bad_get_user
19587 GET_THREAD_INFO(%_ASM_DX)
19588 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19589 jae bad_get_user
bc901d79 19590-2: movzwl -1(%_ASM_AX),%edx
df50ba0c
MT		 19591+
19592+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19593+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19594+ cmp %_ASM_DX,%_ASM_AX
19595+ jae 1234f
19596+ add %_ASM_DX,%_ASM_AX
19597+1234:
19598+#endif
19599+
58c5fc13
MT		 19600+#endif
19601+
16454cff 19602+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
58c5fc13
MT		 19603 xor %eax,%eax
19604 ret
19605 CFI_ENDPROC
bc901d79 19606@@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
ae4e228f
MT		 19607 ENTRY(__get_user_4)
19608 CFI_STARTPROC
19609 add $3,%_ASM_AX
58c5fc13 19610+
bc901d79 19611+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 19612 jc bad_get_user
19613 GET_THREAD_INFO(%_ASM_DX)
19614 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19615 jae bad_get_user
bc901d79 19616-3: mov -3(%_ASM_AX),%edx
df50ba0c
MT		 19617+
19618+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19619+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19620+ cmp %_ASM_DX,%_ASM_AX
19621+ jae 1234f
19622+ add %_ASM_DX,%_ASM_AX
19623+1234:
19624+#endif
19625+
58c5fc13
MT		 19626+#endif
19627+
16454cff 19628+3: __copyuser_seg mov -3(%_ASM_AX),%edx
58c5fc13
MT		 19629 xor %eax,%eax
19630 ret
19631 CFI_ENDPROC
bc901d79 19632@@ -80,6 +127,15 @@ ENTRY(__get_user_8)
df50ba0c
MT		 19633 GET_THREAD_INFO(%_ASM_DX)
19634 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19635 jae bad_get_user
19636+
19637+#ifdef CONFIG_PAX_MEMORY_UDEREF
19638+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19639+ cmp %_ASM_DX,%_ASM_AX
19640+ jae 1234f
19641+ add %_ASM_DX,%_ASM_AX
19642+1234:
19643+#endif
19644+
19645 4: movq -7(%_ASM_AX),%_ASM_DX
19646 xor %eax,%eax
19647 ret
66a7e928
MT		 19648diff -urNp linux-2.6.39/arch/x86/lib/insn.c linux-2.6.39/arch/x86/lib/insn.c
19649--- linux-2.6.39/arch/x86/lib/insn.c 2011-05-19 00:06:34.000000000 -0400
19650+++ linux-2.6.39/arch/x86/lib/insn.c 2011-05-22 19:36:30.000000000 -0400
c52201e0 19651@@ -21,6 +21,11 @@
57199397
MT		 19652 #include <linux/string.h>
19653 #include <asm/inat.h>
19654 #include <asm/insn.h>
c52201e0 19655+#ifdef __KERNEL__
57199397 19656+#include <asm/pgtable_types.h>
c52201e0
MT		 19657+#else
19658+#define ktla_ktva(addr) addr
19659+#endif
57199397
MT		 19660
19661 #define get_next(t, insn) \
19662 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
c52201e0 19663@@ -40,8 +45,8 @@
57199397
MT		 19664 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19665 {
19666 memset(insn, 0, sizeof(*insn));
19667- insn->kaddr = kaddr;
19668- insn->next_byte = kaddr;
19669+ insn->kaddr = ktla_ktva(kaddr);
19670+ insn->next_byte = ktla_ktva(kaddr);
19671 insn->x86_64 = x86_64 ? 1 : 0;
19672 insn->opnd_bytes = 4;
19673 if (x86_64)
66a7e928
MT		 19674diff -urNp linux-2.6.39/arch/x86/lib/mmx_32.c linux-2.6.39/arch/x86/lib/mmx_32.c
19675--- linux-2.6.39/arch/x86/lib/mmx_32.c 2011-05-19 00:06:34.000000000 -0400
19676+++ linux-2.6.39/arch/x86/lib/mmx_32.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 19677@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
19678 {
19679 void *p;
19680 int i;
19681+ unsigned long cr0;
19682
19683 if (unlikely(in_interrupt()))
19684 return __memcpy(to, from, len);
19685@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
19686 kernel_fpu_begin();
19687
19688 __asm__ __volatile__ (
19689- "1: prefetch (%0)\n" /* This set is 28 bytes */
19690- " prefetch 64(%0)\n"
19691- " prefetch 128(%0)\n"
19692- " prefetch 192(%0)\n"
19693- " prefetch 256(%0)\n"
19694+ "1: prefetch (%1)\n" /* This set is 28 bytes */
19695+ " prefetch 64(%1)\n"
19696+ " prefetch 128(%1)\n"
19697+ " prefetch 192(%1)\n"
19698+ " prefetch 256(%1)\n"
19699 "2: \n"
19700 ".section .fixup, \"ax\"\n"
19701- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19702+ "3: \n"
19703+
19704+#ifdef CONFIG_PAX_KERNEXEC
19705+ " movl %%cr0, %0\n"
19706+ " movl %0, %%eax\n"
19707+ " andl $0xFFFEFFFF, %%eax\n"
19708+ " movl %%eax, %%cr0\n"
19709+#endif
19710+
19711+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19712+
19713+#ifdef CONFIG_PAX_KERNEXEC
19714+ " movl %0, %%cr0\n"
19715+#endif
19716+
19717 " jmp 2b\n"
19718 ".previous\n"
19719 _ASM_EXTABLE(1b, 3b)
19720- : : "r" (from));
19721+ : "=&r" (cr0) : "r" (from) : "ax");
19722
19723 for ( ; i > 5; i--) {
19724 __asm__ __volatile__ (
19725- "1: prefetch 320(%0)\n"
19726- "2: movq (%0), %%mm0\n"
19727- " movq 8(%0), %%mm1\n"
19728- " movq 16(%0), %%mm2\n"
19729- " movq 24(%0), %%mm3\n"
19730- " movq %%mm0, (%1)\n"
19731- " movq %%mm1, 8(%1)\n"
19732- " movq %%mm2, 16(%1)\n"
19733- " movq %%mm3, 24(%1)\n"
19734- " movq 32(%0), %%mm0\n"
19735- " movq 40(%0), %%mm1\n"
19736- " movq 48(%0), %%mm2\n"
19737- " movq 56(%0), %%mm3\n"
19738- " movq %%mm0, 32(%1)\n"
19739- " movq %%mm1, 40(%1)\n"
19740- " movq %%mm2, 48(%1)\n"
19741- " movq %%mm3, 56(%1)\n"
19742+ "1: prefetch 320(%1)\n"
19743+ "2: movq (%1), %%mm0\n"
19744+ " movq 8(%1), %%mm1\n"
19745+ " movq 16(%1), %%mm2\n"
19746+ " movq 24(%1), %%mm3\n"
19747+ " movq %%mm0, (%2)\n"
19748+ " movq %%mm1, 8(%2)\n"
19749+ " movq %%mm2, 16(%2)\n"
19750+ " movq %%mm3, 24(%2)\n"
19751+ " movq 32(%1), %%mm0\n"
19752+ " movq 40(%1), %%mm1\n"
19753+ " movq 48(%1), %%mm2\n"
19754+ " movq 56(%1), %%mm3\n"
19755+ " movq %%mm0, 32(%2)\n"
19756+ " movq %%mm1, 40(%2)\n"
19757+ " movq %%mm2, 48(%2)\n"
19758+ " movq %%mm3, 56(%2)\n"
19759 ".section .fixup, \"ax\"\n"
19760- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19761+ "3:\n"
19762+
19763+#ifdef CONFIG_PAX_KERNEXEC
19764+ " movl %%cr0, %0\n"
19765+ " movl %0, %%eax\n"
19766+ " andl $0xFFFEFFFF, %%eax\n"
19767+ " movl %%eax, %%cr0\n"
19768+#endif
19769+
19770+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19771+
19772+#ifdef CONFIG_PAX_KERNEXEC
19773+ " movl %0, %%cr0\n"
19774+#endif
19775+
19776 " jmp 2b\n"
19777 ".previous\n"
19778 _ASM_EXTABLE(1b, 3b)
19779- : : "r" (from), "r" (to) : "memory");
19780+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19781
19782 from += 64;
19783 to += 64;
19784@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
19785 static void fast_copy_page(void *to, void *from)
19786 {
19787 int i;
19788+ unsigned long cr0;
19789
19790 kernel_fpu_begin();
19791
19792@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
19793 * but that is for later. -AV
19794 */
19795 __asm__ __volatile__(
19796- "1: prefetch (%0)\n"
19797- " prefetch 64(%0)\n"
19798- " prefetch 128(%0)\n"
19799- " prefetch 192(%0)\n"
19800- " prefetch 256(%0)\n"
19801+ "1: prefetch (%1)\n"
19802+ " prefetch 64(%1)\n"
19803+ " prefetch 128(%1)\n"
19804+ " prefetch 192(%1)\n"
19805+ " prefetch 256(%1)\n"
19806 "2: \n"
19807 ".section .fixup, \"ax\"\n"
19808- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19809+ "3: \n"
19810+
19811+#ifdef CONFIG_PAX_KERNEXEC
19812+ " movl %%cr0, %0\n"
19813+ " movl %0, %%eax\n"
19814+ " andl $0xFFFEFFFF, %%eax\n"
19815+ " movl %%eax, %%cr0\n"
19816+#endif
19817+
19818+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19819+
19820+#ifdef CONFIG_PAX_KERNEXEC
19821+ " movl %0, %%cr0\n"
19822+#endif
19823+
19824 " jmp 2b\n"
19825 ".previous\n"
19826- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19827+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19828
19829 for (i = 0; i < (4096-320)/64; i++) {
19830 __asm__ __volatile__ (
19831- "1: prefetch 320(%0)\n"
19832- "2: movq (%0), %%mm0\n"
19833- " movntq %%mm0, (%1)\n"
19834- " movq 8(%0), %%mm1\n"
19835- " movntq %%mm1, 8(%1)\n"
19836- " movq 16(%0), %%mm2\n"
19837- " movntq %%mm2, 16(%1)\n"
19838- " movq 24(%0), %%mm3\n"
19839- " movntq %%mm3, 24(%1)\n"
19840- " movq 32(%0), %%mm4\n"
19841- " movntq %%mm4, 32(%1)\n"
19842- " movq 40(%0), %%mm5\n"
19843- " movntq %%mm5, 40(%1)\n"
19844- " movq 48(%0), %%mm6\n"
19845- " movntq %%mm6, 48(%1)\n"
19846- " movq 56(%0), %%mm7\n"
19847- " movntq %%mm7, 56(%1)\n"
19848+ "1: prefetch 320(%1)\n"
19849+ "2: movq (%1), %%mm0\n"
19850+ " movntq %%mm0, (%2)\n"
19851+ " movq 8(%1), %%mm1\n"
19852+ " movntq %%mm1, 8(%2)\n"
19853+ " movq 16(%1), %%mm2\n"
19854+ " movntq %%mm2, 16(%2)\n"
19855+ " movq 24(%1), %%mm3\n"
19856+ " movntq %%mm3, 24(%2)\n"
19857+ " movq 32(%1), %%mm4\n"
19858+ " movntq %%mm4, 32(%2)\n"
19859+ " movq 40(%1), %%mm5\n"
19860+ " movntq %%mm5, 40(%2)\n"
19861+ " movq 48(%1), %%mm6\n"
19862+ " movntq %%mm6, 48(%2)\n"
19863+ " movq 56(%1), %%mm7\n"
19864+ " movntq %%mm7, 56(%2)\n"
19865 ".section .fixup, \"ax\"\n"
19866- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19867+ "3:\n"
19868+
19869+#ifdef CONFIG_PAX_KERNEXEC
19870+ " movl %%cr0, %0\n"
19871+ " movl %0, %%eax\n"
19872+ " andl $0xFFFEFFFF, %%eax\n"
19873+ " movl %%eax, %%cr0\n"
19874+#endif
19875+
19876+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19877+
19878+#ifdef CONFIG_PAX_KERNEXEC
19879+ " movl %0, %%cr0\n"
19880+#endif
19881+
19882 " jmp 2b\n"
19883 ".previous\n"
19884- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
19885+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19886
19887 from += 64;
19888 to += 64;
19889@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
19890 static void fast_copy_page(void *to, void *from)
19891 {
19892 int i;
19893+ unsigned long cr0;
19894
19895 kernel_fpu_begin();
19896
19897 __asm__ __volatile__ (
19898- "1: prefetch (%0)\n"
19899- " prefetch 64(%0)\n"
19900- " prefetch 128(%0)\n"
19901- " prefetch 192(%0)\n"
19902- " prefetch 256(%0)\n"
19903+ "1: prefetch (%1)\n"
19904+ " prefetch 64(%1)\n"
19905+ " prefetch 128(%1)\n"
19906+ " prefetch 192(%1)\n"
19907+ " prefetch 256(%1)\n"
19908 "2: \n"
19909 ".section .fixup, \"ax\"\n"
19910- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19911+ "3: \n"
19912+
19913+#ifdef CONFIG_PAX_KERNEXEC
19914+ " movl %%cr0, %0\n"
19915+ " movl %0, %%eax\n"
19916+ " andl $0xFFFEFFFF, %%eax\n"
19917+ " movl %%eax, %%cr0\n"
19918+#endif
19919+
19920+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19921+
19922+#ifdef CONFIG_PAX_KERNEXEC
19923+ " movl %0, %%cr0\n"
19924+#endif
19925+
19926 " jmp 2b\n"
19927 ".previous\n"
19928- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19929+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19930
19931 for (i = 0; i < 4096/64; i++) {
19932 __asm__ __volatile__ (
19933- "1: prefetch 320(%0)\n"
19934- "2: movq (%0), %%mm0\n"
19935- " movq 8(%0), %%mm1\n"
19936- " movq 16(%0), %%mm2\n"
19937- " movq 24(%0), %%mm3\n"
19938- " movq %%mm0, (%1)\n"
19939- " movq %%mm1, 8(%1)\n"
19940- " movq %%mm2, 16(%1)\n"
19941- " movq %%mm3, 24(%1)\n"
19942- " movq 32(%0), %%mm0\n"
19943- " movq 40(%0), %%mm1\n"
19944- " movq 48(%0), %%mm2\n"
19945- " movq 56(%0), %%mm3\n"
19946- " movq %%mm0, 32(%1)\n"
19947- " movq %%mm1, 40(%1)\n"
19948- " movq %%mm2, 48(%1)\n"
19949- " movq %%mm3, 56(%1)\n"
19950+ "1: prefetch 320(%1)\n"
19951+ "2: movq (%1), %%mm0\n"
19952+ " movq 8(%1), %%mm1\n"
19953+ " movq 16(%1), %%mm2\n"
19954+ " movq 24(%1), %%mm3\n"
19955+ " movq %%mm0, (%2)\n"
19956+ " movq %%mm1, 8(%2)\n"
19957+ " movq %%mm2, 16(%2)\n"
19958+ " movq %%mm3, 24(%2)\n"
19959+ " movq 32(%1), %%mm0\n"
19960+ " movq 40(%1), %%mm1\n"
19961+ " movq 48(%1), %%mm2\n"
19962+ " movq 56(%1), %%mm3\n"
19963+ " movq %%mm0, 32(%2)\n"
19964+ " movq %%mm1, 40(%2)\n"
19965+ " movq %%mm2, 48(%2)\n"
19966+ " movq %%mm3, 56(%2)\n"
19967 ".section .fixup, \"ax\"\n"
19968- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19969+ "3:\n"
19970+
19971+#ifdef CONFIG_PAX_KERNEXEC
19972+ " movl %%cr0, %0\n"
19973+ " movl %0, %%eax\n"
19974+ " andl $0xFFFEFFFF, %%eax\n"
19975+ " movl %%eax, %%cr0\n"
19976+#endif
19977+
19978+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19979+
19980+#ifdef CONFIG_PAX_KERNEXEC
19981+ " movl %0, %%cr0\n"
19982+#endif
19983+
19984 " jmp 2b\n"
19985 ".previous\n"
19986 _ASM_EXTABLE(1b, 3b)
19987- : : "r" (from), "r" (to) : "memory");
19988+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19989
19990 from += 64;
19991 to += 64;
66a7e928
MT		 19992diff -urNp linux-2.6.39/arch/x86/lib/putuser.S linux-2.6.39/arch/x86/lib/putuser.S
19993--- linux-2.6.39/arch/x86/lib/putuser.S 2011-05-19 00:06:34.000000000 -0400
19994+++ linux-2.6.39/arch/x86/lib/putuser.S 2011-05-22 19:36:30.000000000 -0400
df50ba0c 19995@@ -15,7 +15,8 @@
58c5fc13
MT		 19996 #include <asm/thread_info.h>
19997 #include <asm/errno.h>
19998 #include <asm/asm.h>
df50ba0c 19999-
58c5fc13 20000+#include <asm/segment.h>
df50ba0c 20001+#include <asm/pgtable.h>
58c5fc13
MT		 20002
20003 /*
df50ba0c 20004 * __put_user_X
bc901d79 20005@@ -29,52 +30,119 @@
ae4e228f
MT		 20006 * as they get called from within inline assembly.
20007 */
20008
20009-#define ENTER CFI_STARTPROC ; \
20010- GET_THREAD_INFO(%_ASM_BX)
20011+#define ENTER CFI_STARTPROC
20012 #define EXIT ret ; \
20013 CFI_ENDPROC
20014
57199397
MT		 20015+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20016+#define _DEST %_ASM_CX,%_ASM_BX
20017+#else
20018+#define _DEST %_ASM_CX
20019+#endif
bc901d79
MT		 20020+
20021+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
16454cff 20022+#define __copyuser_seg gs;
bc901d79
MT		 20023+#else
20024+#define __copyuser_seg
20025+#endif
57199397 20026+
ae4e228f
MT		 20027 .text
20028 ENTRY(__put_user_1)
58c5fc13 20029 ENTER
58c5fc13 20030+
bc901d79 20031+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 20032+ GET_THREAD_INFO(%_ASM_BX)
20033 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20034 jae bad_put_user
57199397 20035-1: movb %al,(%_ASM_CX)
df50ba0c
MT		 20036+
20037+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20038+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20039+ cmp %_ASM_BX,%_ASM_CX
57199397
MT		 20040+ jb 1234f
20041+ xor %ebx,%ebx
df50ba0c
MT		 20042+1234:
20043+#endif
20044+
58c5fc13
MT		 20045+#endif
20046+
16454cff 20047+1: __copyuser_seg movb %al,(_DEST)
58c5fc13
MT		 20048 xor %eax,%eax
20049 EXIT
20050 ENDPROC(__put_user_1)
ae4e228f
MT		 20051
20052 ENTRY(__put_user_2)
20053 ENTER
58c5fc13 20054+
bc901d79 20055+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 20056+ GET_THREAD_INFO(%_ASM_BX)
20057 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20058 sub $1,%_ASM_BX
20059 cmp %_ASM_BX,%_ASM_CX
20060 jae bad_put_user
57199397 20061-2: movw %ax,(%_ASM_CX)
df50ba0c
MT		 20062+
20063+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20064+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20065+ cmp %_ASM_BX,%_ASM_CX
57199397
MT		 20066+ jb 1234f
20067+ xor %ebx,%ebx
df50ba0c
MT		 20068+1234:
20069+#endif
20070+
58c5fc13
MT		 20071+#endif
20072+
16454cff 20073+2: __copyuser_seg movw %ax,(_DEST)
58c5fc13
MT		 20074 xor %eax,%eax
20075 EXIT
20076 ENDPROC(__put_user_2)
ae4e228f
MT		 20077
20078 ENTRY(__put_user_4)
20079 ENTER
58c5fc13 20080+
bc901d79 20081+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 20082+ GET_THREAD_INFO(%_ASM_BX)
20083 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20084 sub $3,%_ASM_BX
20085 cmp %_ASM_BX,%_ASM_CX
20086 jae bad_put_user
57199397 20087-3: movl %eax,(%_ASM_CX)
df50ba0c
MT		 20088+
20089+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20090+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20091+ cmp %_ASM_BX,%_ASM_CX
57199397
MT		 20092+ jb 1234f
20093+ xor %ebx,%ebx
df50ba0c
MT		 20094+1234:
20095+#endif
20096+
58c5fc13
MT		 20097+#endif
20098+
16454cff 20099+3: __copyuser_seg movl %eax,(_DEST)
58c5fc13
MT		 20100 xor %eax,%eax
20101 EXIT
20102 ENDPROC(__put_user_4)
ae4e228f
MT		 20103
20104 ENTRY(__put_user_8)
20105 ENTER
58c5fc13 20106+
bc901d79 20107+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
ae4e228f
MT		 20108+ GET_THREAD_INFO(%_ASM_BX)
20109 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20110 sub $7,%_ASM_BX
20111 cmp %_ASM_BX,%_ASM_CX
20112 jae bad_put_user
57199397 20113-4: mov %_ASM_AX,(%_ASM_CX)
df50ba0c
MT		 20114+
20115+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20116+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20117+ cmp %_ASM_BX,%_ASM_CX
57199397
MT		 20118+ jb 1234f
20119+ xor %ebx,%ebx
df50ba0c
MT		 20120+1234:
20121+#endif
20122+
58c5fc13
MT		 20123+#endif
20124+
16454cff 20125+4: __copyuser_seg mov %_ASM_AX,(_DEST)
58c5fc13 20126 #ifdef CONFIG_X86_32
57199397 20127-5: movl %edx,4(%_ASM_CX)
16454cff 20128+5: __copyuser_seg movl %edx,4(_DEST)
58c5fc13 20129 #endif
58c5fc13
MT		 20130 xor %eax,%eax
20131 EXIT
66a7e928
MT		 20132diff -urNp linux-2.6.39/arch/x86/lib/usercopy_32.c linux-2.6.39/arch/x86/lib/usercopy_32.c
20133--- linux-2.6.39/arch/x86/lib/usercopy_32.c 2011-05-19 00:06:34.000000000 -0400
20134+++ linux-2.6.39/arch/x86/lib/usercopy_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 20135@@ -43,7 +43,7 @@ do { \
20136 __asm__ __volatile__( \
20137 " testl %1,%1\n" \
20138 " jz 2f\n" \
58c5fc13 20139- "0: lodsb\n" \
16454cff 20140+ "0: "__copyuser_seg"lodsb\n" \
bc901d79
MT		 20141 " stosb\n" \
20142 " testb %%al,%%al\n" \
20143 " jz 1f\n" \
20144@@ -128,10 +128,12 @@ do { \
20145 int __d0; \
20146 might_fault(); \
20147 __asm__ __volatile__( \
20148+ __COPYUSER_SET_ES \
20149 "0: rep; stosl\n" \
20150 " movl %2,%0\n" \
20151 "1: rep; stosb\n" \
20152 "2:\n" \
20153+ __COPYUSER_RESTORE_ES \
20154 ".section .fixup,\"ax\"\n" \
20155 "3: lea 0(%2,%0,4),%0\n" \
20156 " jmp 2b\n" \
20157@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
58c5fc13
MT		 20158 might_fault();
20159
20160 __asm__ __volatile__(
bc901d79 20161+ __COPYUSER_SET_ES
58c5fc13
MT		 20162 " testl %0, %0\n"
20163 " jz 3f\n"
bc901d79
MT		 20164 " andl %0,%%ecx\n"
20165@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
58c5fc13
MT		 20166 " subl %%ecx,%0\n"
20167 " addl %0,%%eax\n"
20168 "1:\n"
bc901d79 20169+ __COPYUSER_RESTORE_ES
58c5fc13
MT		 20170 ".section .fixup,\"ax\"\n"
20171 "2: xorl %%eax,%%eax\n"
20172 " jmp 1b\n"
bc901d79 20173@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
58c5fc13
MT		 20174
20175 #ifdef CONFIG_X86_INTEL_USERCOPY
20176 static unsigned long
20177-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20178+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
bc901d79
MT		 20179 {
20180 int d0, d1;
20181 __asm__ __volatile__(
20182@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20183 " .align 2,0x90\n"
20184 "3: movl 0(%4), %%eax\n"
20185 "4: movl 4(%4), %%edx\n"
20186- "5: movl %%eax, 0(%3)\n"
20187- "6: movl %%edx, 4(%3)\n"
16454cff
MT		 20188+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20189+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
bc901d79
MT		 20190 "7: movl 8(%4), %%eax\n"
20191 "8: movl 12(%4),%%edx\n"
20192- "9: movl %%eax, 8(%3)\n"
20193- "10: movl %%edx, 12(%3)\n"
16454cff
MT		 20194+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20195+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
bc901d79
MT		 20196 "11: movl 16(%4), %%eax\n"
20197 "12: movl 20(%4), %%edx\n"
20198- "13: movl %%eax, 16(%3)\n"
20199- "14: movl %%edx, 20(%3)\n"
16454cff
MT		 20200+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20201+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
bc901d79
MT		 20202 "15: movl 24(%4), %%eax\n"
20203 "16: movl 28(%4), %%edx\n"
20204- "17: movl %%eax, 24(%3)\n"
20205- "18: movl %%edx, 28(%3)\n"
16454cff
MT		 20206+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20207+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
bc901d79
MT		 20208 "19: movl 32(%4), %%eax\n"
20209 "20: movl 36(%4), %%edx\n"
20210- "21: movl %%eax, 32(%3)\n"
20211- "22: movl %%edx, 36(%3)\n"
16454cff
MT		 20212+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20213+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
bc901d79
MT		 20214 "23: movl 40(%4), %%eax\n"
20215 "24: movl 44(%4), %%edx\n"
20216- "25: movl %%eax, 40(%3)\n"
20217- "26: movl %%edx, 44(%3)\n"
16454cff
MT		 20218+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20219+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
bc901d79
MT		 20220 "27: movl 48(%4), %%eax\n"
20221 "28: movl 52(%4), %%edx\n"
20222- "29: movl %%eax, 48(%3)\n"
20223- "30: movl %%edx, 52(%3)\n"
16454cff
MT		 20224+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20225+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
bc901d79
MT		 20226 "31: movl 56(%4), %%eax\n"
20227 "32: movl 60(%4), %%edx\n"
20228- "33: movl %%eax, 56(%3)\n"
20229- "34: movl %%edx, 60(%3)\n"
16454cff
MT		 20230+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20231+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
bc901d79
MT		 20232 " addl $-64, %0\n"
20233 " addl $64, %4\n"
20234 " addl $64, %3\n"
20235@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
20236 " shrl $2, %0\n"
20237 " andl $3, %%eax\n"
20238 " cld\n"
20239+ __COPYUSER_SET_ES
20240 "99: rep; movsl\n"
20241 "36: movl %%eax, %0\n"
20242 "37: rep; movsb\n"
20243 "100:\n"
20244+ __COPYUSER_RESTORE_ES
58c5fc13
MT		 20245+ ".section .fixup,\"ax\"\n"
20246+ "101: lea 0(%%eax,%0,4),%0\n"
20247+ " jmp 100b\n"
20248+ ".previous\n"
20249+ ".section __ex_table,\"a\"\n"
20250+ " .align 4\n"
20251+ " .long 1b,100b\n"
20252+ " .long 2b,100b\n"
20253+ " .long 3b,100b\n"
20254+ " .long 4b,100b\n"
20255+ " .long 5b,100b\n"
20256+ " .long 6b,100b\n"
20257+ " .long 7b,100b\n"
20258+ " .long 8b,100b\n"
20259+ " .long 9b,100b\n"
20260+ " .long 10b,100b\n"
20261+ " .long 11b,100b\n"
20262+ " .long 12b,100b\n"
20263+ " .long 13b,100b\n"
20264+ " .long 14b,100b\n"
20265+ " .long 15b,100b\n"
20266+ " .long 16b,100b\n"
20267+ " .long 17b,100b\n"
20268+ " .long 18b,100b\n"
20269+ " .long 19b,100b\n"
20270+ " .long 20b,100b\n"
20271+ " .long 21b,100b\n"
20272+ " .long 22b,100b\n"
20273+ " .long 23b,100b\n"
20274+ " .long 24b,100b\n"
20275+ " .long 25b,100b\n"
20276+ " .long 26b,100b\n"
20277+ " .long 27b,100b\n"
20278+ " .long 28b,100b\n"
20279+ " .long 29b,100b\n"
20280+ " .long 30b,100b\n"
20281+ " .long 31b,100b\n"
20282+ " .long 32b,100b\n"
20283+ " .long 33b,100b\n"
20284+ " .long 34b,100b\n"
20285+ " .long 35b,100b\n"
20286+ " .long 36b,100b\n"
20287+ " .long 37b,100b\n"
20288+ " .long 99b,101b\n"
20289+ ".previous"
20290+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
bc901d79 20291+ : "1"(to), "2"(from), "0"(size)
58c5fc13
MT		 20292+ : "eax", "edx", "memory");
20293+ return size;
20294+}
20295+
20296+static unsigned long
20297+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
bc901d79
MT		 20298+{
20299+ int d0, d1;
20300+ __asm__ __volatile__(
20301+ " .align 2,0x90\n"
16454cff 20302+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
bc901d79
MT		 20303+ " cmpl $67, %0\n"
20304+ " jbe 3f\n"
16454cff 20305+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
bc901d79 20306+ " .align 2,0x90\n"
16454cff
MT		 20307+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20308+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
bc901d79
MT		 20309+ "5: movl %%eax, 0(%3)\n"
20310+ "6: movl %%edx, 4(%3)\n"
16454cff
MT		 20311+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20312+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
bc901d79
MT		 20313+ "9: movl %%eax, 8(%3)\n"
20314+ "10: movl %%edx, 12(%3)\n"
16454cff
MT		 20315+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20316+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
bc901d79
MT		 20317+ "13: movl %%eax, 16(%3)\n"
20318+ "14: movl %%edx, 20(%3)\n"
16454cff
MT		 20319+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20320+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
bc901d79
MT		 20321+ "17: movl %%eax, 24(%3)\n"
20322+ "18: movl %%edx, 28(%3)\n"
16454cff
MT		 20323+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20324+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
bc901d79
MT		 20325+ "21: movl %%eax, 32(%3)\n"
20326+ "22: movl %%edx, 36(%3)\n"
16454cff
MT		 20327+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20328+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
bc901d79
MT		 20329+ "25: movl %%eax, 40(%3)\n"
20330+ "26: movl %%edx, 44(%3)\n"
16454cff
MT		 20331+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20332+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
bc901d79
MT		 20333+ "29: movl %%eax, 48(%3)\n"
20334+ "30: movl %%edx, 52(%3)\n"
16454cff
MT		 20335+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20336+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
bc901d79
MT		 20337+ "33: movl %%eax, 56(%3)\n"
20338+ "34: movl %%edx, 60(%3)\n"
20339+ " addl $-64, %0\n"
20340+ " addl $64, %4\n"
20341+ " addl $64, %3\n"
20342+ " cmpl $63, %0\n"
20343+ " ja 1b\n"
20344+ "35: movl %0, %%eax\n"
20345+ " shrl $2, %0\n"
20346+ " andl $3, %%eax\n"
20347+ " cld\n"
16454cff 20348+ "99: rep; "__copyuser_seg" movsl\n"
bc901d79 20349+ "36: movl %%eax, %0\n"
16454cff 20350+ "37: rep; "__copyuser_seg" movsb\n"
bc901d79 20351+ "100:\n"
58c5fc13
MT		 20352 ".section .fixup,\"ax\"\n"
20353 "101: lea 0(%%eax,%0,4),%0\n"
20354 " jmp 100b\n"
bc901d79 20355@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
58c5fc13
MT		 20356 int d0, d1;
20357 __asm__ __volatile__(
58c5fc13 20358 " .align 2,0x90\n"
bc901d79 20359- "0: movl 32(%4), %%eax\n"
16454cff 20360+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
58c5fc13 20361 " cmpl $67, %0\n"
bc901d79
MT		 20362 " jbe 2f\n"
20363- "1: movl 64(%4), %%eax\n"
16454cff 20364+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
58c5fc13 20365 " .align 2,0x90\n"
bc901d79
MT		 20366- "2: movl 0(%4), %%eax\n"
20367- "21: movl 4(%4), %%edx\n"
16454cff
MT		 20368+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20369+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
bc901d79
MT		 20370 " movl %%eax, 0(%3)\n"
20371 " movl %%edx, 4(%3)\n"
20372- "3: movl 8(%4), %%eax\n"
20373- "31: movl 12(%4),%%edx\n"
16454cff
MT		 20374+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20375+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
bc901d79
MT		 20376 " movl %%eax, 8(%3)\n"
20377 " movl %%edx, 12(%3)\n"
20378- "4: movl 16(%4), %%eax\n"
20379- "41: movl 20(%4), %%edx\n"
16454cff
MT		 20380+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20381+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
bc901d79
MT		 20382 " movl %%eax, 16(%3)\n"
20383 " movl %%edx, 20(%3)\n"
20384- "10: movl 24(%4), %%eax\n"
20385- "51: movl 28(%4), %%edx\n"
16454cff
MT		 20386+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20387+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
bc901d79
MT		 20388 " movl %%eax, 24(%3)\n"
20389 " movl %%edx, 28(%3)\n"
20390- "11: movl 32(%4), %%eax\n"
20391- "61: movl 36(%4), %%edx\n"
16454cff
MT		 20392+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20393+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
bc901d79
MT		 20394 " movl %%eax, 32(%3)\n"
20395 " movl %%edx, 36(%3)\n"
20396- "12: movl 40(%4), %%eax\n"
20397- "71: movl 44(%4), %%edx\n"
16454cff
MT		 20398+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20399+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
bc901d79
MT		 20400 " movl %%eax, 40(%3)\n"
20401 " movl %%edx, 44(%3)\n"
20402- "13: movl 48(%4), %%eax\n"
20403- "81: movl 52(%4), %%edx\n"
16454cff
MT		 20404+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20405+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
bc901d79
MT		 20406 " movl %%eax, 48(%3)\n"
20407 " movl %%edx, 52(%3)\n"
20408- "14: movl 56(%4), %%eax\n"
20409- "91: movl 60(%4), %%edx\n"
16454cff
MT		 20410+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20411+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
bc901d79
MT		 20412 " movl %%eax, 56(%3)\n"
20413 " movl %%edx, 60(%3)\n"
58c5fc13 20414 " addl $-64, %0\n"
bc901d79
MT		 20415@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
20416 " shrl $2, %0\n"
20417 " andl $3, %%eax\n"
20418 " cld\n"
20419- "6: rep; movsl\n"
16454cff 20420+ "6: rep; "__copyuser_seg" movsl\n"
58c5fc13 20421 " movl %%eax,%0\n"
bc901d79 20422- "7: rep; movsb\n"
16454cff 20423+ "7: rep; "__copyuser_seg" movsb\n"
58c5fc13 20424 "8:\n"
58c5fc13
MT		 20425 ".section .fixup,\"ax\"\n"
20426 "9: lea 0(%%eax,%0,4),%0\n"
bc901d79 20427@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
58c5fc13
MT		 20428
20429 __asm__ __volatile__(
58c5fc13 20430 " .align 2,0x90\n"
bc901d79 20431- "0: movl 32(%4), %%eax\n"
16454cff 20432+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
58c5fc13 20433 " cmpl $67, %0\n"
bc901d79
MT		 20434 " jbe 2f\n"
20435- "1: movl 64(%4), %%eax\n"
16454cff 20436+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
58c5fc13 20437 " .align 2,0x90\n"
bc901d79
MT		 20438- "2: movl 0(%4), %%eax\n"
20439- "21: movl 4(%4), %%edx\n"
16454cff
MT		 20440+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20441+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
bc901d79
MT		 20442 " movnti %%eax, 0(%3)\n"
20443 " movnti %%edx, 4(%3)\n"
20444- "3: movl 8(%4), %%eax\n"
20445- "31: movl 12(%4),%%edx\n"
16454cff
MT		 20446+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20447+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
bc901d79
MT		 20448 " movnti %%eax, 8(%3)\n"
20449 " movnti %%edx, 12(%3)\n"
20450- "4: movl 16(%4), %%eax\n"
20451- "41: movl 20(%4), %%edx\n"
16454cff
MT		 20452+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20453+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
bc901d79
MT		 20454 " movnti %%eax, 16(%3)\n"
20455 " movnti %%edx, 20(%3)\n"
20456- "10: movl 24(%4), %%eax\n"
20457- "51: movl 28(%4), %%edx\n"
16454cff
MT		 20458+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20459+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
bc901d79
MT		 20460 " movnti %%eax, 24(%3)\n"
20461 " movnti %%edx, 28(%3)\n"
20462- "11: movl 32(%4), %%eax\n"
20463- "61: movl 36(%4), %%edx\n"
16454cff
MT		 20464+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20465+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
bc901d79
MT		 20466 " movnti %%eax, 32(%3)\n"
20467 " movnti %%edx, 36(%3)\n"
20468- "12: movl 40(%4), %%eax\n"
20469- "71: movl 44(%4), %%edx\n"
16454cff
MT		 20470+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20471+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
bc901d79
MT		 20472 " movnti %%eax, 40(%3)\n"
20473 " movnti %%edx, 44(%3)\n"
20474- "13: movl 48(%4), %%eax\n"
20475- "81: movl 52(%4), %%edx\n"
16454cff
MT		 20476+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20477+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
bc901d79
MT		 20478 " movnti %%eax, 48(%3)\n"
20479 " movnti %%edx, 52(%3)\n"
20480- "14: movl 56(%4), %%eax\n"
20481- "91: movl 60(%4), %%edx\n"
16454cff
MT		 20482+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20483+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
bc901d79
MT		 20484 " movnti %%eax, 56(%3)\n"
20485 " movnti %%edx, 60(%3)\n"
58c5fc13 20486 " addl $-64, %0\n"
bc901d79
MT		 20487@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
20488 " shrl $2, %0\n"
20489 " andl $3, %%eax\n"
20490 " cld\n"
20491- "6: rep; movsl\n"
16454cff 20492+ "6: rep; "__copyuser_seg" movsl\n"
58c5fc13 20493 " movl %%eax,%0\n"
bc901d79 20494- "7: rep; movsb\n"
16454cff 20495+ "7: rep; "__copyuser_seg" movsb\n"
58c5fc13 20496 "8:\n"
58c5fc13
MT		 20497 ".section .fixup,\"ax\"\n"
20498 "9: lea 0(%%eax,%0,4),%0\n"
bc901d79 20499@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
58c5fc13
MT		 20500
20501 __asm__ __volatile__(
58c5fc13 20502 " .align 2,0x90\n"
bc901d79 20503- "0: movl 32(%4), %%eax\n"
16454cff 20504+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
58c5fc13 20505 " cmpl $67, %0\n"
bc901d79
MT		 20506 " jbe 2f\n"
20507- "1: movl 64(%4), %%eax\n"
16454cff 20508+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
58c5fc13 20509 " .align 2,0x90\n"
bc901d79
MT		 20510- "2: movl 0(%4), %%eax\n"
20511- "21: movl 4(%4), %%edx\n"
16454cff
MT		 20512+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20513+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
bc901d79
MT		 20514 " movnti %%eax, 0(%3)\n"
20515 " movnti %%edx, 4(%3)\n"
20516- "3: movl 8(%4), %%eax\n"
20517- "31: movl 12(%4),%%edx\n"
16454cff
MT		 20518+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20519+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
bc901d79
MT		 20520 " movnti %%eax, 8(%3)\n"
20521 " movnti %%edx, 12(%3)\n"
20522- "4: movl 16(%4), %%eax\n"
20523- "41: movl 20(%4), %%edx\n"
16454cff
MT		 20524+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20525+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
bc901d79
MT		 20526 " movnti %%eax, 16(%3)\n"
20527 " movnti %%edx, 20(%3)\n"
20528- "10: movl 24(%4), %%eax\n"
20529- "51: movl 28(%4), %%edx\n"
16454cff
MT		 20530+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20531+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
bc901d79
MT		 20532 " movnti %%eax, 24(%3)\n"
20533 " movnti %%edx, 28(%3)\n"
20534- "11: movl 32(%4), %%eax\n"
20535- "61: movl 36(%4), %%edx\n"
16454cff
MT		 20536+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20537+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
bc901d79
MT		 20538 " movnti %%eax, 32(%3)\n"
20539 " movnti %%edx, 36(%3)\n"
20540- "12: movl 40(%4), %%eax\n"
20541- "71: movl 44(%4), %%edx\n"
16454cff
MT		 20542+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20543+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
bc901d79
MT		 20544 " movnti %%eax, 40(%3)\n"
20545 " movnti %%edx, 44(%3)\n"
20546- "13: movl 48(%4), %%eax\n"
20547- "81: movl 52(%4), %%edx\n"
16454cff
MT		 20548+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20549+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
bc901d79
MT		 20550 " movnti %%eax, 48(%3)\n"
20551 " movnti %%edx, 52(%3)\n"
20552- "14: movl 56(%4), %%eax\n"
20553- "91: movl 60(%4), %%edx\n"
16454cff
MT		 20554+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20555+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
bc901d79
MT		 20556 " movnti %%eax, 56(%3)\n"
20557 " movnti %%edx, 60(%3)\n"
58c5fc13 20558 " addl $-64, %0\n"
bc901d79
MT		 20559@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
20560 " shrl $2, %0\n"
20561 " andl $3, %%eax\n"
20562 " cld\n"
20563- "6: rep; movsl\n"
16454cff 20564+ "6: rep; "__copyuser_seg" movsl\n"
58c5fc13 20565 " movl %%eax,%0\n"
bc901d79 20566- "7: rep; movsb\n"
16454cff 20567+ "7: rep; "__copyuser_seg" movsb\n"
58c5fc13 20568 "8:\n"
58c5fc13
MT		 20569 ".section .fixup,\"ax\"\n"
20570 "9: lea 0(%%eax,%0,4),%0\n"
bc901d79 20571@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
58c5fc13
MT		 20572 */
20573 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
20574 unsigned long size);
20575-unsigned long __copy_user_intel(void __user *to, const void *from,
20576+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
20577+ unsigned long size);
20578+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
20579 unsigned long size);
20580 unsigned long __copy_user_zeroing_intel_nocache(void *to,
20581 const void __user *from, unsigned long size);
20582 #endif /* CONFIG_X86_INTEL_USERCOPY */
20583
20584 /* Generic arbitrary sized copy. */
20585-#define __copy_user(to, from, size) \
bc901d79
MT		 20586+#define __copy_user(to, from, size, prefix, set, restore) \
20587 do { \
20588 int __d0, __d1, __d2; \
20589 __asm__ __volatile__( \
20590+ set \
20591 " cmp $7,%0\n" \
20592 " jbe 1f\n" \
20593 " movl %1,%0\n" \
20594 " negl %0\n" \
20595 " andl $7,%0\n" \
20596 " subl %0,%3\n" \
58c5fc13 20597- "4: rep; movsb\n" \
16454cff 20598+ "4: rep; "prefix"movsb\n" \
bc901d79
MT		 20599 " movl %3,%0\n" \
20600 " shrl $2,%0\n" \
20601 " andl $3,%3\n" \
20602 " .align 2,0x90\n" \
58c5fc13 20603- "0: rep; movsl\n" \
16454cff 20604+ "0: rep; "prefix"movsl\n" \
bc901d79 20605 " movl %3,%0\n" \
58c5fc13 20606- "1: rep; movsb\n" \
16454cff 20607+ "1: rep; "prefix"movsb\n" \
bc901d79
MT		 20608 "2:\n" \
20609+ restore \
20610 ".section .fixup,\"ax\"\n" \
20611 "5: addl %3,%0\n" \
20612 " jmp 2b\n" \
20613@@ -682,14 +799,14 @@ do { \
20614 " negl %0\n" \
20615 " andl $7,%0\n" \
20616 " subl %0,%3\n" \
58c5fc13 20617- "4: rep; movsb\n" \
16454cff 20618+ "4: rep; "__copyuser_seg"movsb\n" \
bc901d79
MT		 20619 " movl %3,%0\n" \
20620 " shrl $2,%0\n" \
20621 " andl $3,%3\n" \
20622 " .align 2,0x90\n" \
58c5fc13 20623- "0: rep; movsl\n" \
16454cff 20624+ "0: rep; "__copyuser_seg"movsl\n" \
bc901d79 20625 " movl %3,%0\n" \
58c5fc13 20626- "1: rep; movsb\n" \
16454cff 20627+ "1: rep; "__copyuser_seg"movsb\n" \
bc901d79
MT		 20628 "2:\n" \
20629 ".section .fixup,\"ax\"\n" \
20630 "5: addl %3,%0\n" \
20631@@ -775,9 +892,9 @@ survive:
58c5fc13
MT		 20632 }
20633 #endif
20634 if (movsl_is_ok(to, from, n))
20635- __copy_user(to, from, n);
bc901d79 20636+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
58c5fc13
MT		 20637 else
20638- n = __copy_user_intel(to, from, n);
20639+ n = __generic_copy_to_user_intel(to, from, n);
20640 return n;
20641 }
20642 EXPORT_SYMBOL(__copy_to_user_ll);
bc901d79 20643@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
58c5fc13
MT		 20644 unsigned long n)
20645 {
20646 if (movsl_is_ok(to, from, n))
20647- __copy_user(to, from, n);
bc901d79 20648+ __copy_user(to, from, n, __copyuser_seg, "", "");
58c5fc13
MT		 20649 else
20650- n = __copy_user_intel((void __user *)to,
20651- (const void *)from, n);
20652+ n = __generic_copy_from_user_intel(to, from, n);
20653 return n;
20654 }
20655 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
71d190be 20656@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
58c5fc13
MT		 20657 if (n > 64 && cpu_has_xmm2)
20658 n = __copy_user_intel_nocache(to, from, n);
20659 else
20660- __copy_user(to, from, n);
bc901d79 20661+ __copy_user(to, from, n, __copyuser_seg, "", "");
58c5fc13
MT		 20662 #else
20663- __copy_user(to, from, n);
bc901d79 20664+ __copy_user(to, from, n, __copyuser_seg, "", "");
58c5fc13
MT		 20665 #endif
20666 return n;
20667 }
20668 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
20669
20670-/**
20671- * copy_to_user: - Copy a block of data into user space.
20672- * @to: Destination address, in user space.
20673- * @from: Source address, in kernel space.
20674- * @n: Number of bytes to copy.
20675- *
20676- * Context: User context only. This function may sleep.
20677- *
20678- * Copy data from kernel space to user space.
20679- *
20680- * Returns number of bytes that could not be copied.
20681- * On success, this will be zero.
20682- */
20683-unsigned long
20684-copy_to_user(void __user *to, const void *from, unsigned long n)
ae4e228f 20685+void copy_from_user_overflow(void)
58c5fc13
MT		 20686 {
20687- if (access_ok(VERIFY_WRITE, to, n))
20688- n = __copy_to_user(to, from, n);
20689- return n;
ae4e228f 20690+ WARN(1, "Buffer overflow detected!\n");
58c5fc13
MT		 20691 }
20692-EXPORT_SYMBOL(copy_to_user);
ae4e228f 20693+EXPORT_SYMBOL(copy_from_user_overflow);
58c5fc13
MT		 20694
20695-/**
20696- * copy_from_user: - Copy a block of data from user space.
20697- * @to: Destination address, in kernel space.
20698- * @from: Source address, in user space.
20699- * @n: Number of bytes to copy.
20700- *
20701- * Context: User context only. This function may sleep.
20702- *
20703- * Copy data from user space to kernel space.
20704- *
20705- * Returns number of bytes that could not be copied.
20706- * On success, this will be zero.
20707- *
20708- * If some data could not be copied, this function will pad the copied
20709- * data to the requested size using zero bytes.
20710- */
20711-unsigned long
ae4e228f
MT		 20712-_copy_from_user(void *to, const void __user *from, unsigned long n)
20713+void copy_to_user_overflow(void)
58c5fc13
MT		 20714 {
20715- if (access_ok(VERIFY_READ, from, n))
20716- n = __copy_from_user(to, from, n);
20717- else
20718- memset(to, 0, n);
20719- return n;
ae4e228f
MT		 20720+ WARN(1, "Buffer overflow detected!\n");
20721 }
20722-EXPORT_SYMBOL(_copy_from_user);
20723+EXPORT_SYMBOL(copy_to_user_overflow);
20724
20725-void copy_from_user_overflow(void)
20726+#ifdef CONFIG_PAX_MEMORY_UDEREF
bc901d79 20727+void __set_fs(mm_segment_t x)
ae4e228f
MT		 20728 {
20729- WARN(1, "Buffer overflow detected!\n");
bc901d79
MT		 20730+ switch (x.seg) {
20731+ case 0:
20732+ loadsegment(gs, 0);
20733+ break;
20734+ case TASK_SIZE_MAX:
20735+ loadsegment(gs, __USER_DS);
20736+ break;
20737+ case -1UL:
20738+ loadsegment(gs, __KERNEL_DS);
20739+ break;
20740+ default:
20741+ BUG();
20742+ }
20743+ return;
ae4e228f
MT		 20744 }
20745-EXPORT_SYMBOL(copy_from_user_overflow);
71d190be 20746+EXPORT_SYMBOL(__set_fs);
ae4e228f
MT		 20747+
20748+void set_fs(mm_segment_t x)
20749+{
58c5fc13 20750+ current_thread_info()->addr_limit = x;
bc901d79 20751+ __set_fs(x);
58c5fc13 20752+}
58c5fc13 20753+EXPORT_SYMBOL(set_fs);
bc901d79 20754+#endif
66a7e928
MT		 20755diff -urNp linux-2.6.39/arch/x86/lib/usercopy_64.c linux-2.6.39/arch/x86/lib/usercopy_64.c
20756--- linux-2.6.39/arch/x86/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
20757+++ linux-2.6.39/arch/x86/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
8308f9c9 20758@@ -42,6 +42,12 @@ long
df50ba0c
MT		 20759 __strncpy_from_user(char *dst, const char __user *src, long count)
20760 {
20761 long res;
8308f9c9
MT		 20762+
20763+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 20764+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20765+ src += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 20766+#endif
20767+
df50ba0c
MT		 20768 __do_strncpy_from_user(dst, src, count, res);
20769 return res;
20770 }
8308f9c9 20771@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
df50ba0c
MT		 20772 {
20773 long __d0;
20774 might_fault();
8308f9c9
MT		 20775+
20776+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 20777+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
20778+ addr += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 20779+#endif
20780+
df50ba0c
MT		 20781 /* no memory constraint because it doesn't change any memory gcc knows
20782 about */
20783 asm volatile(
8308f9c9 20784@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
df50ba0c
MT		 20785
20786 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
20787 {
20788- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20789+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
8308f9c9
MT		 20790+
20791+#ifdef CONFIG_PAX_MEMORY_UDEREF
df50ba0c
MT		 20792+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
20793+ to += PAX_USER_SHADOW_BASE;
20794+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
20795+ from += PAX_USER_SHADOW_BASE;
8308f9c9
MT		 20796+#endif
20797+
df50ba0c
MT		 20798 return copy_user_generic((__force void *)to, (__force void *)from, len);
20799- }
20800- return len;
20801+ }
20802+ return len;
20803 }
20804 EXPORT_SYMBOL(copy_in_user);
20805
66a7e928
MT		 20806diff -urNp linux-2.6.39/arch/x86/Makefile linux-2.6.39/arch/x86/Makefile
20807--- linux-2.6.39/arch/x86/Makefile 2011-05-19 00:06:34.000000000 -0400
20808+++ linux-2.6.39/arch/x86/Makefile 2011-05-22 19:36:30.000000000 -0400
bc901d79 20809@@ -195,3 +195,12 @@ define archhelp
57199397
MT		 20810 echo ' FDARGS="..." arguments for the booted kernel'
20811 echo ' FDINITRD=file initrd for the booted kernel'
20812 endef
20813+
20814+define OLD_LD
20815+
20816+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
20817+*** Please upgrade your binutils to 2.18 or newer
20818+endef
20819+
20820+archprepare:
20821+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
66a7e928
MT		 20822diff -urNp linux-2.6.39/arch/x86/mm/extable.c linux-2.6.39/arch/x86/mm/extable.c
20823--- linux-2.6.39/arch/x86/mm/extable.c 2011-05-19 00:06:34.000000000 -0400
20824+++ linux-2.6.39/arch/x86/mm/extable.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f 20825@@ -1,14 +1,71 @@
58c5fc13
MT		 20826 #include <linux/module.h>
20827 #include <linux/spinlock.h>
20828+#include <linux/sort.h>
20829 #include <asm/uaccess.h>
ae4e228f 20830+#include <asm/pgtable.h>
58c5fc13
MT		 20831
20832+/*
20833+ * The exception table needs to be sorted so that the binary
20834+ * search that we use to find entries in it works properly.
20835+ * This is used both for the kernel exception table and for
20836+ * the exception tables of modules that get loaded.
20837+ */
20838+static int cmp_ex(const void *a, const void *b)
20839+{
20840+ const struct exception_table_entry *x = a, *y = b;
20841+
20842+ /* avoid overflow */
20843+ if (x->insn > y->insn)
20844+ return 1;
20845+ if (x->insn < y->insn)
20846+ return -1;
20847+ return 0;
20848+}
20849+
20850+static void swap_ex(void *a, void *b, int size)
20851+{
20852+ struct exception_table_entry t, *x = a, *y = b;
20853+
58c5fc13
MT		 20854+ t = *x;
20855+
ae4e228f 20856+ pax_open_kernel();
58c5fc13
MT		 20857+ *x = *y;
20858+ *y = t;
ae4e228f 20859+ pax_close_kernel();
58c5fc13
MT		 20860+}
20861+
20862+void sort_extable(struct exception_table_entry *start,
20863+ struct exception_table_entry *finish)
20864+{
20865+ sort(start, finish - start, sizeof(struct exception_table_entry),
20866+ cmp_ex, swap_ex);
20867+}
20868+
20869+#ifdef CONFIG_MODULES
20870+/*
20871+ * If the exception table is sorted, any referring to the module init
20872+ * will be at the beginning or the end.
20873+ */
20874+void trim_init_extable(struct module *m)
20875+{
20876+ /*trim the beginning*/
20877+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
20878+ m->extable++;
20879+ m->num_exentries--;
20880+ }
20881+ /*trim the end*/
20882+ while (m->num_exentries &&
20883+ within_module_init(m->extable[m->num_exentries-1].insn, m))
20884+ m->num_exentries--;
20885+}
20886+#endif /* CONFIG_MODULES */
20887
20888 int fixup_exception(struct pt_regs *regs)
20889 {
20890 const struct exception_table_entry *fixup;
20891
20892 #ifdef CONFIG_PNPBIOS
20893- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
20894+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
20895 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
20896 extern u32 pnp_bios_is_utter_crap;
20897 pnp_bios_is_utter_crap = 1;
66a7e928
MT		 20898diff -urNp linux-2.6.39/arch/x86/mm/fault.c linux-2.6.39/arch/x86/mm/fault.c
20899--- linux-2.6.39/arch/x86/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
20900+++ linux-2.6.39/arch/x86/mm/fault.c 2011-05-22 20:33:41.000000000 -0400
bc901d79 20901@@ -12,10 +12,18 @@
58c5fc13 20902 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
ae4e228f 20903 #include <linux/perf_event.h> /* perf_sw_event */
bc901d79 20904 #include <linux/hugetlb.h> /* hstate_index_to_shift */
58c5fc13
MT		 20905+#include <linux/unistd.h>
20906+#include <linux/compiler.h>
20907
20908 #include <asm/traps.h> /* dotraplinkage, ... */
20909 #include <asm/pgalloc.h> /* pgd_*(), ... */
20910 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
20911+#include <asm/vsyscall.h>
20912+#include <asm/tlbflush.h>
df50ba0c
MT		 20913+
20914+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20915+#include <asm/stacktrace.h>
df50ba0c 20916+#endif
58c5fc13
MT		 20917
20918 /*
20919 * Page fault error code bits:
bc901d79 20920@@ -53,7 +61,7 @@ static inline int __kprobes notify_page_
58c5fc13
MT		 20921 int ret = 0;
20922
20923 /* kprobe_running() needs smp_processor_id() */
20924- if (kprobes_built_in() && !user_mode_vm(regs)) {
20925+ if (kprobes_built_in() && !user_mode(regs)) {
20926 preempt_disable();
20927 if (kprobe_running() && kprobe_fault_handler(regs, 14))
20928 ret = 1;
bc901d79
MT		 20929@@ -114,7 +122,10 @@ check_prefetch_opcode(struct pt_regs *re
20930 return !instr_lo || (instr_lo>>1) == 1;
20931 case 0x00:
20932 /* Prefetch instruction is 0x0F0D or 0x0F18 */
20933- if (probe_kernel_address(instr, opcode))
20934+ if (user_mode(regs)) {
20935+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20936+ return 0;
20937+ } else if (probe_kernel_address(instr, opcode))
20938 return 0;
20939
20940 *prefetch = (instr_lo == 0xF) &&
20941@@ -148,7 +159,10 @@ is_prefetch(struct pt_regs *regs, unsign
20942 while (instr < max_instr) {
20943 unsigned char opcode;
20944
20945- if (probe_kernel_address(instr, opcode))
20946+ if (user_mode(regs)) {
20947+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20948+ break;
20949+ } else if (probe_kernel_address(instr, opcode))
20950 break;
20951
20952 instr++;
20953@@ -179,6 +193,30 @@ force_sig_info_fault(int si_signo, int s
58c5fc13
MT		 20954 force_sig_info(si_signo, &info, tsk);
20955 }
20956
20957+#ifdef CONFIG_PAX_EMUTRAMP
20958+static int pax_handle_fetch_fault(struct pt_regs *regs);
20959+#endif
20960+
20961+#ifdef CONFIG_PAX_PAGEEXEC
20962+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
20963+{
20964+ pgd_t *pgd;
20965+ pud_t *pud;
20966+ pmd_t *pmd;
20967+
20968+ pgd = pgd_offset(mm, address);
20969+ if (!pgd_present(*pgd))
20970+ return NULL;
20971+ pud = pud_offset(pgd, address);
20972+ if (!pud_present(*pud))
20973+ return NULL;
20974+ pmd = pmd_offset(pud, address);
20975+ if (!pmd_present(*pmd))
20976+ return NULL;
20977+ return pmd;
20978+}
20979+#endif
20980+
20981 DEFINE_SPINLOCK(pgd_lock);
20982 LIST_HEAD(pgd_list);
20983
16454cff
MT		 20984@@ -229,10 +267,22 @@ void vmalloc_sync_all(void)
20985 for (address = VMALLOC_START & PMD_MASK;
20986 address >= TASK_SIZE && address < FIXADDR_TOP;
df50ba0c 20987 address += PMD_SIZE) {
df50ba0c
MT		 20988+
20989+#ifdef CONFIG_PAX_PER_CPU_PGD
20990+ unsigned long cpu;
20991+#else
20992 struct page *page;
20993+#endif
20994
16454cff 20995 spin_lock(&pgd_lock);
df50ba0c
MT		 20996+
20997+#ifdef CONFIG_PAX_PER_CPU_PGD
20998+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
20999+ pgd_t *pgd = get_cpu_pgd(cpu);
bc901d79 21000+ pmd_t *ret;
df50ba0c
MT		 21001+#else
21002 list_for_each_entry(page, &pgd_list, lru) {
df50ba0c 21003+ pgd_t *pgd = page_address(page);
bc901d79
MT		 21004 spinlock_t *pgt_lock;
21005 pmd_t *ret;
21006
16454cff 21007@@ -240,8 +290,13 @@ void vmalloc_sync_all(void)
bc901d79
MT		 21008 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21009
21010 spin_lock(pgt_lock);
21011- ret = vmalloc_sync_one(page_address(page), address);
df50ba0c
MT		 21012+#endif
21013+
bc901d79
MT		 21014+ ret = vmalloc_sync_one(pgd, address);
21015+
21016+#ifndef CONFIG_PAX_PER_CPU_PGD
21017 spin_unlock(pgt_lock);
21018+#endif
21019
21020 if (!ret)
df50ba0c 21021 break;
16454cff 21022@@ -275,6 +330,11 @@ static noinline __kprobes int vmalloc_fa
df50ba0c
MT		 21023 * an interrupt in the middle of a task switch..
21024 */
21025 pgd_paddr = read_cr3();
21026+
21027+#ifdef CONFIG_PAX_PER_CPU_PGD
21028+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21029+#endif
21030+
21031 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21032 if (!pmd_k)
21033 return -1;
16454cff 21034@@ -370,7 +430,14 @@ static noinline __kprobes int vmalloc_fa
df50ba0c
MT		 21035 * happen within a race in page table update. In the later
21036 * case just flush:
21037 */
21038+
21039+#ifdef CONFIG_PAX_PER_CPU_PGD
21040+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21041+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21042+#else
21043 pgd = pgd_offset(current->active_mm, address);
21044+#endif
21045+
21046 pgd_ref = pgd_offset_k(address);
21047 if (pgd_none(*pgd_ref))
21048 return -1;
16454cff 21049@@ -532,7 +599,7 @@ static int is_errata93(struct pt_regs *r
58c5fc13
MT		 21050 static int is_errata100(struct pt_regs *regs, unsigned long address)
21051 {
21052 #ifdef CONFIG_X86_64
21053- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21054+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21055 return 1;
21056 #endif
21057 return 0;
16454cff 21058@@ -559,7 +626,7 @@ static int is_f00f_bug(struct pt_regs *r
58c5fc13
MT		 21059 }
21060
21061 static const char nx_warning[] = KERN_CRIT
21062-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21063+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21064
21065 static void
21066 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
16454cff 21067@@ -568,15 +635,26 @@ show_fault_oops(struct pt_regs *regs, un
58c5fc13
MT		 21068 if (!oops_may_print())
21069 return;
21070
21071- if (error_code & PF_INSTR) {
ae4e228f 21072+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
58c5fc13
MT		 21073 unsigned int level;
21074
21075 pte_t *pte = lookup_address(address, &level);
21076
21077 if (pte && pte_present(*pte) && !pte_exec(*pte))
21078- printk(nx_warning, current_uid());
21079+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21080 }
21081
21082+#ifdef CONFIG_PAX_KERNEXEC
ae4e228f 21083+ if (init_mm.start_code <= address && address < init_mm.end_code) {
58c5fc13 21084+ if (current->signal->curr_ip)
ae4e228f
MT		 21085+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21086+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
58c5fc13
MT		 21087+ else
21088+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21089+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21090+ }
21091+#endif
21092+
21093 printk(KERN_ALERT "BUG: unable to handle kernel ");
21094 if (address < PAGE_SIZE)
21095 printk(KERN_CONT "NULL pointer dereference");
16454cff 21096@@ -701,6 +779,68 @@ __bad_area_nosemaphore(struct pt_regs *r
58c5fc13
MT		 21097 unsigned long address, int si_code)
21098 {
21099 struct task_struct *tsk = current;
21100+ struct mm_struct *mm = tsk->mm;
21101+
21102+#ifdef CONFIG_X86_64
6892158b 21103+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
58c5fc13
MT		 21104+ if (regs->ip == (unsigned long)vgettimeofday) {
21105+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21106+ return;
21107+ } else if (regs->ip == (unsigned long)vtime) {
21108+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21109+ return;
21110+ } else if (regs->ip == (unsigned long)vgetcpu) {
21111+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21112+ return;
21113+ }
21114+ }
21115+#endif
21116+
21117+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21118+ if (mm && (error_code & PF_USER)) {
21119+ unsigned long ip = regs->ip;
21120+
21121+ if (v8086_mode(regs))
6892158b 21122+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
58c5fc13
MT		 21123+
21124+ /*
21125+ * It's possible to have interrupts off here:
21126+ */
21127+ local_irq_enable();
21128+
21129+#ifdef CONFIG_PAX_PAGEEXEC
21130+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
6892158b 21131+ (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
58c5fc13
MT		 21132+
21133+#ifdef CONFIG_PAX_EMUTRAMP
21134+ switch (pax_handle_fetch_fault(regs)) {
21135+ case 2:
21136+ return;
21137+ }
21138+#endif
21139+
6892158b 21140+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
58c5fc13
MT		 21141+ do_group_exit(SIGKILL);
21142+ }
21143+#endif
21144+
21145+#ifdef CONFIG_PAX_SEGMEXEC
6892158b 21146+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
58c5fc13
MT		 21147+
21148+#ifdef CONFIG_PAX_EMUTRAMP
21149+ switch (pax_handle_fetch_fault(regs)) {
21150+ case 2:
21151+ return;
21152+ }
21153+#endif
21154+
6892158b 21155+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
58c5fc13
MT		 21156+ do_group_exit(SIGKILL);
21157+ }
21158+#endif
21159+
21160+ }
21161+#endif
21162
21163 /* User mode accesses just cause a SIGSEGV */
21164 if (error_code & PF_USER) {
16454cff 21165@@ -855,6 +995,99 @@ static int spurious_fault_check(unsigned
58c5fc13
MT		 21166 return 1;
21167 }
21168
21169+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21170+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21171+{
21172+ pte_t *pte;
21173+ pmd_t *pmd;
21174+ spinlock_t *ptl;
21175+ unsigned char pte_mask;
21176+
ae4e228f 21177+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
58c5fc13
MT		 21178+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21179+ return 0;
21180+
21181+ /* PaX: it's our fault, let's handle it if we can */
21182+
21183+ /* PaX: take a look at read faults before acquiring any locks */
21184+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21185+ /* instruction fetch attempt from a protected page in user mode */
21186+ up_read(&mm->mmap_sem);
21187+
21188+#ifdef CONFIG_PAX_EMUTRAMP
21189+ switch (pax_handle_fetch_fault(regs)) {
21190+ case 2:
21191+ return 1;
21192+ }
21193+#endif
21194+
21195+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21196+ do_group_exit(SIGKILL);
21197+ }
21198+
21199+ pmd = pax_get_pmd(mm, address);
21200+ if (unlikely(!pmd))
21201+ return 0;
21202+
21203+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21204+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21205+ pte_unmap_unlock(pte, ptl);
21206+ return 0;
21207+ }
21208+
21209+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21210+ /* write attempt to a protected page in user mode */
21211+ pte_unmap_unlock(pte, ptl);
21212+ return 0;
21213+ }
21214+
21215+#ifdef CONFIG_SMP
21216+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21217+#else
21218+ if (likely(address > get_limit(regs->cs)))
21219+#endif
21220+ {
21221+ set_pte(pte, pte_mkread(*pte));
21222+ __flush_tlb_one(address);
21223+ pte_unmap_unlock(pte, ptl);
21224+ up_read(&mm->mmap_sem);
21225+ return 1;
21226+ }
21227+
21228+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21229+
21230+ /*
21231+ * PaX: fill DTLB with user rights and retry
21232+ */
21233+ __asm__ __volatile__ (
58c5fc13
MT		 21234+ "orb %2,(%1)\n"
21235+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21236+/*
21237+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21238+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21239+ * page fault when examined during a TLB load attempt. this is true not only
21240+ * for PTEs holding a non-present entry but also present entries that will
21241+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21242+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21243+ * for our target pages since their PTEs are simply not in the TLBs at all.
21244+
21245+ * the best thing in omitting it is that we gain around 15-20% speed in the
21246+ * fast path of the page fault handler and can get rid of tracing since we
21247+ * can no longer flush unintended entries.
21248+ */
21249+ "invlpg (%0)\n"
21250+#endif
16454cff 21251+ __copyuser_seg"testb $0,(%0)\n"
58c5fc13 21252+ "xorb %3,(%1)\n"
58c5fc13 21253+ :
bc901d79 21254+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
58c5fc13
MT		 21255+ : "memory", "cc");
21256+ pte_unmap_unlock(pte, ptl);
21257+ up_read(&mm->mmap_sem);
21258+ return 1;
21259+}
21260+#endif
21261+
21262 /*
21263 * Handle a spurious fault caused by a stale TLB entry.
21264 *
16454cff 21265@@ -927,6 +1160,9 @@ int show_unhandled_signals = 1;
58c5fc13 21266 static inline int
bc901d79 21267 access_error(unsigned long error_code, struct vm_area_struct *vma)
58c5fc13 21268 {
ae4e228f 21269+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
58c5fc13
MT		 21270+ return 1;
21271+
bc901d79 21272 if (error_code & PF_WRITE) {
58c5fc13
MT		 21273 /* write, present and write, not present: */
21274 if (unlikely(!(vma->vm_flags & VM_WRITE)))
16454cff 21275@@ -960,19 +1196,33 @@ do_page_fault(struct pt_regs *regs, unsi
58c5fc13
MT		 21276 {
21277 struct vm_area_struct *vma;
21278 struct task_struct *tsk;
21279- unsigned long address;
21280 struct mm_struct *mm;
58c5fc13 21281 int fault;
bc901d79
MT		 21282 int write = error_code & PF_WRITE;
21283 unsigned int flags = FAULT_FLAG_ALLOW_RETRY |
21284 (write ? FAULT_FLAG_WRITE : 0);
58c5fc13
MT		 21285
21286+ /* Get the faulting address: */
df50ba0c
MT		 21287+ unsigned long address = read_cr2();
21288+
21289+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21290+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21291+ if (!search_exception_tables(regs->ip)) {
21292+ bad_area_nosemaphore(regs, error_code, address);
21293+ return;
21294+ }
21295+ if (address < PAX_USER_SHADOW_BASE) {
21296+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
bc901d79 21297+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
66a7e928 21298+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
df50ba0c
MT		 21299+ } else
21300+ address -= PAX_USER_SHADOW_BASE;
21301+ }
21302+#endif
58c5fc13
MT		 21303+
21304 tsk = current;
21305 mm = tsk->mm;
21306
21307- /* Get the faulting address: */
21308- address = read_cr2();
21309-
21310 /*
21311 * Detect and handle instructions that would cause a page fault for
21312 * both a tracked kernel page and a userspace page.
16454cff 21313@@ -1032,7 +1282,7 @@ do_page_fault(struct pt_regs *regs, unsi
58c5fc13
MT		 21314 * User-mode registers count as a user access even for any
21315 * potential system fault or CPU buglet:
21316 */
21317- if (user_mode_vm(regs)) {
21318+ if (user_mode(regs)) {
21319 local_irq_enable();
21320 error_code |= PF_USER;
21321 } else {
16454cff 21322@@ -1087,6 +1337,11 @@ retry:
58c5fc13
MT		 21323 might_sleep();
21324 }
21325
21326+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21327+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21328+ return;
21329+#endif
21330+
21331 vma = find_vma(mm, address);
21332 if (unlikely(!vma)) {
21333 bad_area(regs, error_code, address);
16454cff 21334@@ -1098,18 +1353,24 @@ retry:
58c5fc13
MT		 21335 bad_area(regs, error_code, address);
21336 return;
21337 }
21338- if (error_code & PF_USER) {
21339- /*
21340- * Accessing the stack below %sp is always a bug.
21341- * The large cushion allows instructions like enter
21342- * and pusha to work. ("enter $65535, $31" pushes
21343- * 32 pointers and then decrements %sp by 65535.)
21344- */
21345- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21346- bad_area(regs, error_code, address);
21347- return;
21348- }
21349+ /*
21350+ * Accessing the stack below %sp is always a bug.
21351+ * The large cushion allows instructions like enter
21352+ * and pusha to work. ("enter $65535, $31" pushes
21353+ * 32 pointers and then decrements %sp by 65535.)
21354+ */
21355+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21356+ bad_area(regs, error_code, address);
21357+ return;
df50ba0c 21358 }
58c5fc13
MT		 21359+
21360+#ifdef CONFIG_PAX_SEGMEXEC
21361+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21362+ bad_area(regs, error_code, address);
21363+ return;
df50ba0c 21364+ }
58c5fc13
MT		 21365+#endif
21366+
21367 if (unlikely(expand_stack(vma, address))) {
21368 bad_area(regs, error_code, address);
21369 return;
16454cff 21370@@ -1164,3 +1425,199 @@ good_area:
58c5fc13
MT		 21371
21372 up_read(&mm->mmap_sem);
21373 }
21374+
21375+#ifdef CONFIG_PAX_EMUTRAMP
21376+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21377+{
21378+ int err;
21379+
21380+ do { /* PaX: gcc trampoline emulation #1 */
21381+ unsigned char mov1, mov2;
21382+ unsigned short jmp;
21383+ unsigned int addr1, addr2;
21384+
21385+#ifdef CONFIG_X86_64
21386+ if ((regs->ip + 11) >> 32)
21387+ break;
21388+#endif
21389+
21390+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21391+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21392+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21393+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21394+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21395+
21396+ if (err)
21397+ break;
21398+
21399+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21400+ regs->cx = addr1;
21401+ regs->ax = addr2;
21402+ regs->ip = addr2;
21403+ return 2;
21404+ }
21405+ } while (0);
21406+
21407+ do { /* PaX: gcc trampoline emulation #2 */
21408+ unsigned char mov, jmp;
21409+ unsigned int addr1, addr2;
21410+
21411+#ifdef CONFIG_X86_64
21412+ if ((regs->ip + 9) >> 32)
21413+ break;
21414+#endif
21415+
21416+ err = get_user(mov, (unsigned char __user *)regs->ip);
21417+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21418+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21419+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21420+
21421+ if (err)
21422+ break;
21423+
21424+ if (mov == 0xB9 && jmp == 0xE9) {
21425+ regs->cx = addr1;
21426+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21427+ return 2;
21428+ }
21429+ } while (0);
21430+
21431+ return 1; /* PaX in action */
21432+}
21433+
21434+#ifdef CONFIG_X86_64
21435+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21436+{
21437+ int err;
21438+
21439+ do { /* PaX: gcc trampoline emulation #1 */
21440+ unsigned short mov1, mov2, jmp1;
21441+ unsigned char jmp2;
21442+ unsigned int addr1;
21443+ unsigned long addr2;
21444+
21445+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21446+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21447+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21448+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21449+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21450+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21451+
21452+ if (err)
21453+ break;
21454+
21455+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21456+ regs->r11 = addr1;
21457+ regs->r10 = addr2;
21458+ regs->ip = addr1;
21459+ return 2;
21460+ }
21461+ } while (0);
21462+
21463+ do { /* PaX: gcc trampoline emulation #2 */
21464+ unsigned short mov1, mov2, jmp1;
21465+ unsigned char jmp2;
21466+ unsigned long addr1, addr2;
21467+
21468+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21469+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21470+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21471+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21472+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21473+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21474+
21475+ if (err)
21476+ break;
21477+
21478+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21479+ regs->r11 = addr1;
21480+ regs->r10 = addr2;
21481+ regs->ip = addr1;
21482+ return 2;
21483+ }
21484+ } while (0);
21485+
21486+ return 1; /* PaX in action */
21487+}
21488+#endif
21489+
21490+/*
21491+ * PaX: decide what to do with offenders (regs->ip = fault address)
21492+ *
21493+ * returns 1 when task should be killed
21494+ * 2 when gcc trampoline was detected
21495+ */
21496+static int pax_handle_fetch_fault(struct pt_regs *regs)
21497+{
21498+ if (v8086_mode(regs))
21499+ return 1;
21500+
21501+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21502+ return 1;
21503+
21504+#ifdef CONFIG_X86_32
21505+ return pax_handle_fetch_fault_32(regs);
21506+#else
21507+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21508+ return pax_handle_fetch_fault_32(regs);
21509+ else
21510+ return pax_handle_fetch_fault_64(regs);
21511+#endif
21512+}
21513+#endif
21514+
21515+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21516+void pax_report_insns(void *pc, void *sp)
21517+{
21518+ long i;
21519+
21520+ printk(KERN_ERR "PAX: bytes at PC: ");
21521+ for (i = 0; i < 20; i++) {
21522+ unsigned char c;
ae4e228f 21523+ if (get_user(c, (__force unsigned char __user *)pc+i))
58c5fc13
MT		 21524+ printk(KERN_CONT "?? ");
21525+ else
21526+ printk(KERN_CONT "%02x ", c);
21527+ }
21528+ printk("\n");
21529+
21530+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
ae4e228f 21531+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
58c5fc13 21532+ unsigned long c;
ae4e228f 21533+ if (get_user(c, (__force unsigned long __user *)sp+i))
58c5fc13
MT		 21534+#ifdef CONFIG_X86_32
21535+ printk(KERN_CONT "???????? ");
21536+#else
21537+ printk(KERN_CONT "???????????????? ");
21538+#endif
21539+ else
21540+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
21541+ }
21542+ printk("\n");
21543+}
21544+#endif
58c5fc13 21545+
ae4e228f
MT		 21546+/**
21547+ * probe_kernel_write(): safely attempt to write to a location
21548+ * @dst: address to write to
21549+ * @src: pointer to the data that shall be written
21550+ * @size: size of the data chunk
21551+ *
21552+ * Safely write to address @dst from the buffer at @src. If a kernel fault
21553+ * happens, handle that and return -EFAULT.
21554+ */
21555+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
21556+{
21557+ long ret;
21558+ mm_segment_t old_fs = get_fs();
21559+
21560+ set_fs(KERNEL_DS);
21561+ pagefault_disable();
21562+ pax_open_kernel();
21563+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
21564+ pax_close_kernel();
21565+ pagefault_enable();
21566+ set_fs(old_fs);
21567+
21568+ return ret ? -EFAULT : 0;
21569+}
66a7e928
MT		 21570diff -urNp linux-2.6.39/arch/x86/mm/gup.c linux-2.6.39/arch/x86/mm/gup.c
21571--- linux-2.6.39/arch/x86/mm/gup.c 2011-05-19 00:06:34.000000000 -0400
21572+++ linux-2.6.39/arch/x86/mm/gup.c 2011-05-22 19:36:30.000000000 -0400
16454cff 21573@@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long
ae4e228f
MT		 21574 addr = start;
21575 len = (unsigned long) nr_pages << PAGE_SHIFT;
21576 end = start + len;
21577- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21578+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21579 (void __user *)start, len)))
21580 return 0;
58c5fc13 21581
66a7e928
MT		 21582diff -urNp linux-2.6.39/arch/x86/mm/highmem_32.c linux-2.6.39/arch/x86/mm/highmem_32.c
21583--- linux-2.6.39/arch/x86/mm/highmem_32.c 2011-05-19 00:06:34.000000000 -0400
21584+++ linux-2.6.39/arch/x86/mm/highmem_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 21585@@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
58c5fc13
MT		 21586 idx = type + KM_TYPE_NR*smp_processor_id();
21587 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21588 BUG_ON(!pte_none(*(kmap_pte-idx)));
21589+
ae4e228f 21590+ pax_open_kernel();
58c5fc13 21591 set_pte(kmap_pte-idx, mk_pte(page, prot));
ae4e228f 21592+ pax_close_kernel();
58c5fc13 21593
58c5fc13
MT		 21594 return (void *)vaddr;
21595 }
66a7e928
MT		 21596diff -urNp linux-2.6.39/arch/x86/mm/hugetlbpage.c linux-2.6.39/arch/x86/mm/hugetlbpage.c
21597--- linux-2.6.39/arch/x86/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
21598+++ linux-2.6.39/arch/x86/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
6892158b 21599@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
58c5fc13
MT		 21600 struct hstate *h = hstate_file(file);
21601 struct mm_struct *mm = current->mm;
21602 struct vm_area_struct *vma;
21603- unsigned long start_addr;
21604+ unsigned long start_addr, pax_task_size = TASK_SIZE;
21605+
21606+#ifdef CONFIG_PAX_SEGMEXEC
21607+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21608+ pax_task_size = SEGMEXEC_TASK_SIZE;
21609+#endif
6892158b
MT		 21610+
21611+ pax_task_size -= PAGE_SIZE;
58c5fc13
MT		 21612
21613 if (len > mm->cached_hole_size) {
21614- start_addr = mm->free_area_cache;
21615+ start_addr = mm->free_area_cache;
21616 } else {
21617- start_addr = TASK_UNMAPPED_BASE;
21618- mm->cached_hole_size = 0;
21619+ start_addr = mm->mmap_base;
21620+ mm->cached_hole_size = 0;
21621 }
21622
21623 full_search:
6892158b 21624@@ -280,26 +287,27 @@ full_search:
58c5fc13
MT		 21625
21626 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
21627 /* At this point: (!vma || addr < vma->vm_end). */
21628- if (TASK_SIZE - len < addr) {
21629+ if (pax_task_size - len < addr) {
21630 /*
21631 * Start a new search - just in case we missed
21632 * some holes.
21633 */
21634- if (start_addr != TASK_UNMAPPED_BASE) {
21635- start_addr = TASK_UNMAPPED_BASE;
21636+ if (start_addr != mm->mmap_base) {
21637+ start_addr = mm->mmap_base;
21638 mm->cached_hole_size = 0;
21639 goto full_search;
21640 }
57199397
MT		 21641 return -ENOMEM;
21642 }
21643- if (!vma || addr + len <= vma->vm_start) {
21644- mm->free_area_cache = addr + len;
21645- return addr;
21646- }
21647+ if (check_heap_stack_gap(vma, addr, len))
21648+ break;
21649 if (addr + mm->cached_hole_size < vma->vm_start)
21650 mm->cached_hole_size = vma->vm_start - addr;
21651 addr = ALIGN(vma->vm_end, huge_page_size(h));
21652 }
21653+
21654+ mm->free_area_cache = addr + len;
21655+ return addr;
21656 }
21657
21658 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
6892158b 21659@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
57199397 21660 {
58c5fc13
MT		 21661 struct hstate *h = hstate_file(file);
21662 struct mm_struct *mm = current->mm;
57199397 21663- struct vm_area_struct *vma, *prev_vma;
58c5fc13 21664- unsigned long base = mm->mmap_base, addr = addr0;
57199397 21665+ struct vm_area_struct *vma;
58c5fc13
MT		 21666+ unsigned long base = mm->mmap_base, addr;
21667 unsigned long largest_hole = mm->cached_hole_size;
21668- int first_time = 1;
21669
21670 /* don't allow allocations above current base */
21671 if (mm->free_area_cache > base)
16454cff 21672@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
58c5fc13
MT		 21673 largest_hole = 0;
21674 mm->free_area_cache = base;
21675 }
21676-try_again:
21677+
21678 /* make sure it can fit in the remaining address space */
21679 if (mm->free_area_cache < len)
21680 goto fail;
16454cff 21681
66a7e928 21682 /* either no address requested or can't fit in requested address hole */
16454cff
MT		 21683- addr = (mm->free_area_cache - len) & huge_page_mask(h);
21684+ addr = (mm->free_area_cache - len);
57199397 21685 do {
16454cff 21686+ addr &= huge_page_mask(h);
57199397
MT		 21687+ vma = find_vma(mm, addr);
21688 /*
21689 * Lookup failure means no vma is above this address,
21690 * i.e. return with success:
21691- */
21692- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
21693- return addr;
21694-
21695- /*
21696 * new region fits between prev_vma->vm_end and
21697 * vma->vm_start, use it:
21698 */
21699- if (addr + len <= vma->vm_start &&
21700- (!prev_vma || (addr >= prev_vma->vm_end))) {
21701+ if (check_heap_stack_gap(vma, addr, len)) {
21702 /* remember the address as a hint for next time */
21703- mm->cached_hole_size = largest_hole;
21704- return (mm->free_area_cache = addr);
21705- } else {
21706- /* pull free_area_cache down to the first hole */
21707- if (mm->free_area_cache == vma->vm_end) {
21708- mm->free_area_cache = vma->vm_start;
21709- mm->cached_hole_size = largest_hole;
21710- }
21711+ mm->cached_hole_size = largest_hole;
21712+ return (mm->free_area_cache = addr);
21713+ }
21714+ /* pull free_area_cache down to the first hole */
21715+ if (mm->free_area_cache == vma->vm_end) {
21716+ mm->free_area_cache = vma->vm_start;
21717+ mm->cached_hole_size = largest_hole;
21718 }
21719
21720 /* remember the largest hole we saw so far */
21721 if (addr + largest_hole < vma->vm_start)
21722- largest_hole = vma->vm_start - addr;
21723+ largest_hole = vma->vm_start - addr;
21724
21725 /* try just below the current vma->vm_start */
16454cff
MT		 21726- addr = (vma->vm_start - len) & huge_page_mask(h);
21727- } while (len <= vma->vm_start);
21728+ addr = skip_heap_stack_gap(vma, len);
21729+ } while (!IS_ERR_VALUE(addr));
58c5fc13
MT		 21730
21731 fail:
21732 /*
21733- * if hint left us with no space for the requested
21734- * mapping then try again:
21735- */
21736- if (first_time) {
21737- mm->free_area_cache = base;
21738- largest_hole = 0;
21739- first_time = 0;
21740- goto try_again;
21741- }
21742- /*
21743 * A failed mmap() very likely causes application failure,
21744 * so fall back to the bottom-up function here. This scenario
21745 * can happen with large stack limits and large mmap()
21746 * allocations.
21747 */
21748- mm->free_area_cache = TASK_UNMAPPED_BASE;
21749+
21750+#ifdef CONFIG_PAX_SEGMEXEC
21751+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21752+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
21753+ else
21754+#endif
21755+
21756+ mm->mmap_base = TASK_UNMAPPED_BASE;
21757+
21758+#ifdef CONFIG_PAX_RANDMMAP
21759+ if (mm->pax_flags & MF_PAX_RANDMMAP)
21760+ mm->mmap_base += mm->delta_mmap;
21761+#endif
21762+
21763+ mm->free_area_cache = mm->mmap_base;
21764 mm->cached_hole_size = ~0UL;
21765 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
21766 len, pgoff, flags);
16454cff 21767@@ -386,6 +392,7 @@ fail:
58c5fc13
MT		 21768 /*
21769 * Restore the topdown base:
21770 */
21771+ mm->mmap_base = base;
21772 mm->free_area_cache = base;
21773 mm->cached_hole_size = ~0UL;
21774
16454cff 21775@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
58c5fc13
MT		 21776 struct hstate *h = hstate_file(file);
21777 struct mm_struct *mm = current->mm;
21778 struct vm_area_struct *vma;
21779+ unsigned long pax_task_size = TASK_SIZE;
21780
21781 if (len & ~huge_page_mask(h))
21782 return -EINVAL;
21783- if (len > TASK_SIZE)
21784+
21785+#ifdef CONFIG_PAX_SEGMEXEC
21786+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21787+ pax_task_size = SEGMEXEC_TASK_SIZE;
21788+#endif
21789+
6892158b
MT		 21790+ pax_task_size -= PAGE_SIZE;
21791+
58c5fc13
MT		 21792+ if (len > pax_task_size)
21793 return -ENOMEM;
21794
21795 if (flags & MAP_FIXED) {
16454cff 21796@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
58c5fc13
MT		 21797 if (addr) {
21798 addr = ALIGN(addr, huge_page_size(h));
21799 vma = find_vma(mm, addr);
21800- if (TASK_SIZE - len >= addr &&
57199397
MT		 21801- (!vma || addr + len <= vma->vm_start))
21802+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
58c5fc13
MT		 21803 return addr;
21804 }
57199397 21805 if (mm->get_unmapped_area == arch_get_unmapped_area)
66a7e928
MT		 21806diff -urNp linux-2.6.39/arch/x86/mm/init_32.c linux-2.6.39/arch/x86/mm/init_32.c
21807--- linux-2.6.39/arch/x86/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
21808+++ linux-2.6.39/arch/x86/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
16454cff 21809@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
58c5fc13
MT		 21810 }
21811
21812 /*
21813- * Creates a middle page table and puts a pointer to it in the
21814- * given global directory entry. This only returns the gd entry
21815- * in non-PAE compilation mode, since the middle layer is folded.
21816- */
21817-static pmd_t * __init one_md_table_init(pgd_t *pgd)
21818-{
21819- pud_t *pud;
21820- pmd_t *pmd_table;
21821-
21822-#ifdef CONFIG_X86_PAE
21823- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
21824- if (after_bootmem)
ae4e228f 21825- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
58c5fc13
MT		 21826- else
21827- pmd_table = (pmd_t *)alloc_low_page();
21828- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
21829- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
21830- pud = pud_offset(pgd, 0);
21831- BUG_ON(pmd_table != pmd_offset(pud, 0));
21832-
21833- return pmd_table;
21834- }
21835-#endif
21836- pud = pud_offset(pgd, 0);
21837- pmd_table = pmd_offset(pud, 0);
21838-
21839- return pmd_table;
21840-}
21841-
21842-/*
21843 * Create a page table and place a pointer to it in a middle page
21844 * directory entry:
21845 */
16454cff 21846@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
58c5fc13
MT		 21847 page_table = (pte_t *)alloc_low_page();
21848
21849 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
21850+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21851+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
21852+#else
21853 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
21854+#endif
21855 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
21856 }
21857
21858 return pte_offset_kernel(pmd, 0);
21859 }
21860
21861+static pmd_t * __init one_md_table_init(pgd_t *pgd)
21862+{
21863+ pud_t *pud;
21864+ pmd_t *pmd_table;
21865+
21866+ pud = pud_offset(pgd, 0);
21867+ pmd_table = pmd_offset(pud, 0);
21868+
21869+ return pmd_table;
21870+}
21871+
21872 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
21873 {
21874 int pgd_idx = pgd_index(vaddr);
16454cff 21875@@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
58c5fc13
MT		 21876 int pgd_idx, pmd_idx;
21877 unsigned long vaddr;
21878 pgd_t *pgd;
21879+ pud_t *pud;
21880 pmd_t *pmd;
21881 pte_t *pte = NULL;
21882
16454cff 21883@@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
58c5fc13
MT		 21884 pgd = pgd_base + pgd_idx;
21885
21886 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
21887- pmd = one_md_table_init(pgd);
21888- pmd = pmd + pmd_index(vaddr);
21889+ pud = pud_offset(pgd, vaddr);
21890+ pmd = pmd_offset(pud, vaddr);
21891+
21892+#ifdef CONFIG_X86_PAE
21893+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21894+#endif
21895+
21896 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
21897 pmd++, pmd_idx++) {
21898 pte = page_table_kmap_check(one_page_table_init(pmd),
16454cff 21899@@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
58c5fc13
MT		 21900 }
21901 }
21902
21903-static inline int is_kernel_text(unsigned long addr)
21904+static inline int is_kernel_text(unsigned long start, unsigned long end)
21905 {
16454cff 21906- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
58c5fc13
MT		 21907- return 1;
21908- return 0;
ae4e228f 21909+ if ((start > ktla_ktva((unsigned long)_etext) ||
58c5fc13
MT		 21910+ end <= ktla_ktva((unsigned long)_stext)) &&
21911+ (start > ktla_ktva((unsigned long)_einittext) ||
21912+ end <= ktla_ktva((unsigned long)_sinittext)) &&
ae4e228f
MT		 21913+
21914+#ifdef CONFIG_ACPI_SLEEP
21915+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
21916+#endif
21917+
58c5fc13
MT		 21918+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
21919+ return 0;
21920+ return 1;
21921 }
21922
21923 /*
16454cff 21924@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
df50ba0c 21925 unsigned long last_map_addr = end;
58c5fc13
MT		 21926 unsigned long start_pfn, end_pfn;
21927 pgd_t *pgd_base = swapper_pg_dir;
21928- int pgd_idx, pmd_idx, pte_ofs;
21929+ unsigned int pgd_idx, pmd_idx, pte_ofs;
21930 unsigned long pfn;
21931 pgd_t *pgd;
21932+ pud_t *pud;
21933 pmd_t *pmd;
21934 pte_t *pte;
21935 unsigned pages_2m, pages_4k;
16454cff 21936@@ -281,8 +282,13 @@ repeat:
58c5fc13
MT		 21937 pfn = start_pfn;
21938 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21939 pgd = pgd_base + pgd_idx;
21940- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
21941- pmd = one_md_table_init(pgd);
21942+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
21943+ pud = pud_offset(pgd, 0);
21944+ pmd = pmd_offset(pud, 0);
21945+
21946+#ifdef CONFIG_X86_PAE
21947+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21948+#endif
21949
21950 if (pfn >= end_pfn)
21951 continue;
16454cff 21952@@ -294,14 +300,13 @@ repeat:
58c5fc13
MT		 21953 #endif
21954 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
21955 pmd++, pmd_idx++) {
21956- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
21957+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
21958
21959 /*
21960 * Map with big pages if possible, otherwise
21961 * create normal page tables:
21962 */
21963 if (use_pse) {
21964- unsigned int addr2;
21965 pgprot_t prot = PAGE_KERNEL_LARGE;
21966 /*
21967 * first pass will use the same initial
16454cff 21968@@ -311,11 +316,7 @@ repeat:
58c5fc13
MT		 21969 __pgprot(PTE_IDENT_ATTR |
21970 _PAGE_PSE);
21971
21972- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
21973- PAGE_OFFSET + PAGE_SIZE-1;
21974-
21975- if (is_kernel_text(addr) ||
21976- is_kernel_text(addr2))
21977+ if (is_kernel_text(address, address + PMD_SIZE))
21978 prot = PAGE_KERNEL_LARGE_EXEC;
21979
21980 pages_2m++;
16454cff 21981@@ -332,7 +333,7 @@ repeat:
58c5fc13
MT		 21982 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21983 pte += pte_ofs;
21984 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
21985- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
21986+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
21987 pgprot_t prot = PAGE_KERNEL;
21988 /*
21989 * first pass will use the same initial
16454cff 21990@@ -340,7 +341,7 @@ repeat:
58c5fc13
MT		 21991 */
21992 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
21993
21994- if (is_kernel_text(addr))
21995+ if (is_kernel_text(address, address + PAGE_SIZE))
21996 prot = PAGE_KERNEL_EXEC;
21997
21998 pages_4k++;
16454cff 21999@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
58c5fc13
MT		 22000
22001 pud = pud_offset(pgd, va);
22002 pmd = pmd_offset(pud, va);
22003- if (!pmd_present(*pmd))
22004+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22005 break;
22006
22007 pte = pte_offset_kernel(pmd, va);
16454cff 22008@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
58c5fc13
MT		 22009
22010 static void __init pagetable_init(void)
22011 {
22012- pgd_t *pgd_base = swapper_pg_dir;
22013-
22014- permanent_kmaps_init(pgd_base);
22015+ permanent_kmaps_init(swapper_pg_dir);
22016 }
22017
58c5fc13
MT		 22018-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22019+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22020 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22021
22022 /* user-defined highmem size */
66a7e928 22023@@ -754,6 +753,12 @@ void __init mem_init(void)
df50ba0c
MT		 22024
22025 pci_iommu_alloc();
22026
22027+#ifdef CONFIG_PAX_PER_CPU_PGD
22028+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22029+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22030+ KERNEL_PGD_PTRS);
22031+#endif
22032+
22033 #ifdef CONFIG_FLATMEM
22034 BUG_ON(!mem_map);
22035 #endif
66a7e928 22036@@ -771,7 +776,7 @@ void __init mem_init(void)
58c5fc13
MT		 22037 set_highmem_pages_init();
22038
22039 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22040- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22041+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22042 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22043
ae4e228f 22044 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
66a7e928 22045@@ -812,10 +817,10 @@ void __init mem_init(void)
58c5fc13
MT		 22046 ((unsigned long)&__init_end -
22047 (unsigned long)&__init_begin) >> 10,
22048
22049- (unsigned long)&_etext, (unsigned long)&_edata,
22050- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22051+ (unsigned long)&_sdata, (unsigned long)&_edata,
22052+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22053
22054- (unsigned long)&_text, (unsigned long)&_etext,
22055+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22056 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22057
22058 /*
66a7e928 22059@@ -893,6 +898,7 @@ void set_kernel_text_rw(void)
ae4e228f
MT		 22060 if (!kernel_set_to_readonly)
22061 return;
58c5fc13 22062
ae4e228f
MT		 22063+ start = ktla_ktva(start);
22064 pr_debug("Set kernel text: %lx - %lx for read write\n",
22065 start, start+size);
22066
66a7e928 22067@@ -907,6 +913,7 @@ void set_kernel_text_ro(void)
ae4e228f
MT		 22068 if (!kernel_set_to_readonly)
22069 return;
22070
22071+ start = ktla_ktva(start);
22072 pr_debug("Set kernel text: %lx - %lx for read only\n",
22073 start, start+size);
22074
66a7e928 22075@@ -935,6 +942,7 @@ void mark_rodata_ro(void)
ae4e228f
MT		 22076 unsigned long start = PFN_ALIGN(_text);
22077 unsigned long size = PFN_ALIGN(_etext) - start;
22078
22079+ start = ktla_ktva(start);
22080 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22081 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22082 size >> 10);
66a7e928
MT		 22083diff -urNp linux-2.6.39/arch/x86/mm/init_64.c linux-2.6.39/arch/x86/mm/init_64.c
22084--- linux-2.6.39/arch/x86/mm/init_64.c 2011-05-19 00:06:34.000000000 -0400
22085+++ linux-2.6.39/arch/x86/mm/init_64.c 2011-05-22 19:36:30.000000000 -0400
22086@@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpa
ae4e228f
MT		 22087 * around without checking the pgd every time.
22088 */
22089
22090-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22091+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22092 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22093
22094 int force_personality32;
66a7e928 22095@@ -107,12 +107,22 @@ void sync_global_pgds(unsigned long star
16454cff 22096
bc901d79
MT		 22097 for (address = start; address <= end; address += PGDIR_SIZE) {
22098 const pgd_t *pgd_ref = pgd_offset_k(address);
bc901d79
MT		 22099+
22100+#ifdef CONFIG_PAX_PER_CPU_PGD
22101+ unsigned long cpu;
22102+#else
22103 struct page *page;
22104+#endif
22105
22106 if (pgd_none(*pgd_ref))
22107 continue;
22108
16454cff 22109 spin_lock(&pgd_lock);
bc901d79
MT		 22110+
22111+#ifdef CONFIG_PAX_PER_CPU_PGD
22112+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22113+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22114+#else
22115 list_for_each_entry(page, &pgd_list, lru) {
22116 pgd_t *pgd;
22117 spinlock_t *pgt_lock;
66a7e928 22118@@ -121,6 +131,7 @@ void sync_global_pgds(unsigned long star
16454cff 22119 /* the pgt_lock only for Xen */
bc901d79
MT		 22120 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22121 spin_lock(pgt_lock);
22122+#endif
22123
22124 if (pgd_none(*pgd))
22125 set_pgd(pgd, *pgd_ref);
66a7e928 22126@@ -128,7 +139,10 @@ void sync_global_pgds(unsigned long star
bc901d79
MT		 22127 BUG_ON(pgd_page_vaddr(*pgd)
22128 != pgd_page_vaddr(*pgd_ref));
22129
22130+#ifndef CONFIG_PAX_PER_CPU_PGD
22131 spin_unlock(pgt_lock);
22132+#endif
22133+
22134 }
16454cff 22135 spin_unlock(&pgd_lock);
bc901d79 22136 }
66a7e928 22137@@ -202,7 +216,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
58c5fc13
MT		 22138 pmd = fill_pmd(pud, vaddr);
22139 pte = fill_pte(pmd, vaddr);
22140
ae4e228f 22141+ pax_open_kernel();
58c5fc13 22142 set_pte(pte, new_pte);
ae4e228f 22143+ pax_close_kernel();
58c5fc13 22144
58c5fc13
MT		 22145 /*
22146 * It's enough to flush this one mapping.
66a7e928 22147@@ -261,14 +277,12 @@ static void __init __init_extra_mapping(
58c5fc13
MT		 22148 pgd = pgd_offset_k((unsigned long)__va(phys));
22149 if (pgd_none(*pgd)) {
22150 pud = (pud_t *) spp_getpage();
22151- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22152- _PAGE_USER));
22153+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22154 }
22155 pud = pud_offset(pgd, (unsigned long)__va(phys));
22156 if (pud_none(*pud)) {
22157 pmd = (pmd_t *) spp_getpage();
22158- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22159- _PAGE_USER));
22160+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22161 }
22162 pmd = pmd_offset(pud, phys);
22163 BUG_ON(!pmd_none(*pmd));
66a7e928 22164@@ -698,6 +712,12 @@ void __init mem_init(void)
df50ba0c
MT		 22165
22166 pci_iommu_alloc();
22167
22168+#ifdef CONFIG_PAX_PER_CPU_PGD
22169+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22170+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22171+ KERNEL_PGD_PTRS);
22172+#endif
22173+
22174 /* clear_bss() already clear the empty_zero_page */
22175
22176 reservedpages = 0;
66a7e928 22177@@ -858,8 +878,8 @@ int kern_addr_valid(unsigned long addr)
58c5fc13
MT		 22178 static struct vm_area_struct gate_vma = {
22179 .vm_start = VSYSCALL_START,
22180 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22181- .vm_page_prot = PAGE_READONLY_EXEC,
22182- .vm_flags = VM_READ | VM_EXEC
22183+ .vm_page_prot = PAGE_READONLY,
22184+ .vm_flags = VM_READ
22185 };
22186
66a7e928
MT		 22187 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22188@@ -893,7 +913,7 @@ int in_gate_area_no_mm(unsigned long add
58c5fc13
MT		 22189
22190 const char *arch_vma_name(struct vm_area_struct *vma)
22191 {
22192- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22193+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22194 return "[vdso]";
22195 if (vma == &gate_vma)
22196 return "[vsyscall]";
66a7e928
MT		 22197diff -urNp linux-2.6.39/arch/x86/mm/init.c linux-2.6.39/arch/x86/mm/init.c
22198--- linux-2.6.39/arch/x86/mm/init.c 2011-05-19 00:06:34.000000000 -0400
22199+++ linux-2.6.39/arch/x86/mm/init.c 2011-05-23 19:01:08.000000000 -0400
22200@@ -33,7 +33,7 @@ int direct_gbpages
22201 static void __init find_early_table_space(unsigned long end, int use_pse,
22202 int use_gbpages)
22203 {
22204- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22205+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22206 phys_addr_t base;
22207
22208 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22209@@ -315,12 +315,25 @@ unsigned long __init_refok init_memory_m
57199397
MT		 22210 */
22211 int devmem_is_allowed(unsigned long pagenr)
22212 {
22213- if (pagenr <= 256)
71d190be 22214+#ifndef CONFIG_GRKERNSEC_KMEM
57199397
MT		 22215+ if (!pagenr)
22216+ return 1;
22217+#ifdef CONFIG_VM86
22218+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22219+ return 1;
22220+#endif
66a7e928
MT		 22221+#else
22222+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22223+ return 0;
71d190be
MT		 22224+#endif
22225+
57199397
MT		 22226+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22227 return 1;
22228 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22229 return 0;
66a7e928
MT		 22230 if (!page_is_ram(pagenr))
22231 return 1;
22232+
22233 return 0;
22234 }
22235
22236@@ -375,6 +388,86 @@ void free_init_pages(char *what, unsigne
57199397
MT		 22237
22238 void free_initmem(void)
22239 {
22240+
22241+#ifdef CONFIG_PAX_KERNEXEC
22242+#ifdef CONFIG_X86_32
22243+ /* PaX: limit KERNEL_CS to actual size */
22244+ unsigned long addr, limit;
22245+ struct desc_struct d;
22246+ int cpu;
22247+
22248+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22249+ limit = (limit - 1UL) >> PAGE_SHIFT;
22250+
22251+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22252+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22253+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22254+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22255+ }
22256+
22257+ /* PaX: make KERNEL_CS read-only */
22258+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22259+ if (!paravirt_enabled())
22260+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22261+/*
22262+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22263+ pgd = pgd_offset_k(addr);
22264+ pud = pud_offset(pgd, addr);
22265+ pmd = pmd_offset(pud, addr);
22266+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22267+ }
22268+*/
22269+#ifdef CONFIG_X86_PAE
22270+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22271+/*
22272+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22273+ pgd = pgd_offset_k(addr);
22274+ pud = pud_offset(pgd, addr);
22275+ pmd = pmd_offset(pud, addr);
22276+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22277+ }
22278+*/
22279+#endif
22280+
22281+#ifdef CONFIG_MODULES
22282+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22283+#endif
22284+
22285+#else
22286+ pgd_t *pgd;
22287+ pud_t *pud;
22288+ pmd_t *pmd;
22289+ unsigned long addr, end;
22290+
22291+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22292+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22293+ pgd = pgd_offset_k(addr);
22294+ pud = pud_offset(pgd, addr);
22295+ pmd = pmd_offset(pud, addr);
22296+ if (!pmd_present(*pmd))
22297+ continue;
22298+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22299+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22300+ else
22301+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22302+ }
22303+
22304+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22305+ end = addr + KERNEL_IMAGE_SIZE;
22306+ for (; addr < end; addr += PMD_SIZE) {
22307+ pgd = pgd_offset_k(addr);
22308+ pud = pud_offset(pgd, addr);
22309+ pmd = pmd_offset(pud, addr);
22310+ if (!pmd_present(*pmd))
22311+ continue;
22312+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22313+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
57199397
MT		 22314+ }
22315+#endif
22316+
22317+ flush_tlb_all();
22318+#endif
22319+
22320 free_init_pages("unused kernel memory",
22321 (unsigned long)(&__init_begin),
22322 (unsigned long)(&__init_end));
66a7e928
MT		 22323diff -urNp linux-2.6.39/arch/x86/mm/iomap_32.c linux-2.6.39/arch/x86/mm/iomap_32.c
22324--- linux-2.6.39/arch/x86/mm/iomap_32.c 2011-05-19 00:06:34.000000000 -0400
22325+++ linux-2.6.39/arch/x86/mm/iomap_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 22326@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
22327 type = kmap_atomic_idx_push();
58c5fc13
MT		 22328 idx = type + KM_TYPE_NR * smp_processor_id();
22329 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22330+
ae4e228f 22331+ pax_open_kernel();
58c5fc13 22332 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
ae4e228f 22333+ pax_close_kernel();
58c5fc13
MT		 22334+
22335 arch_flush_lazy_mmu_mode();
22336
22337 return (void *)vaddr;
66a7e928
MT		 22338diff -urNp linux-2.6.39/arch/x86/mm/ioremap.c linux-2.6.39/arch/x86/mm/ioremap.c
22339--- linux-2.6.39/arch/x86/mm/ioremap.c 2011-05-19 00:06:34.000000000 -0400
22340+++ linux-2.6.39/arch/x86/mm/ioremap.c 2011-05-22 19:36:30.000000000 -0400
6892158b
MT		 22341@@ -104,7 +104,7 @@ static void __iomem *__ioremap_caller(re
22342 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
58c5fc13
MT		 22343 int is_ram = page_is_ram(pfn);
22344
ae4e228f
MT		 22345- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22346+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22347 return NULL;
22348 WARN_ON_ONCE(is_ram);
58c5fc13 22349 }
6892158b 22350@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
58c5fc13
MT		 22351 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22352
22353 static __initdata int after_paging_init;
22354-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22355+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22356
22357 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22358 {
bc901d79 22359@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
58c5fc13
MT		 22360 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22361
22362 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22363- memset(bm_pte, 0, sizeof(bm_pte));
22364- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22365+ pmd_populate_user(&init_mm, pmd, bm_pte);
22366
22367 /*
22368 * The boot-ioremap range spans multiple pmds, for which
66a7e928
MT		 22369diff -urNp linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c
22370--- linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-19 00:06:34.000000000 -0400
22371+++ linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 22372@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
22373 * memory (e.g. tracked pages)? For now, we need this to avoid
22374 * invoking kmemcheck for PnP BIOS calls.
22375 */
22376- if (regs->flags & X86_VM_MASK)
22377+ if (v8086_mode(regs))
22378 return false;
22379- if (regs->cs != __KERNEL_CS)
22380+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22381 return false;
22382
22383 pte = kmemcheck_pte_lookup(address);
66a7e928
MT		 22384diff -urNp linux-2.6.39/arch/x86/mm/mmap.c linux-2.6.39/arch/x86/mm/mmap.c
22385--- linux-2.6.39/arch/x86/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
22386+++ linux-2.6.39/arch/x86/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 22387@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
22388 * Leave an at least ~128 MB hole with possible stack randomization.
58c5fc13 22389 */
ae4e228f 22390 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
58c5fc13
MT		 22391-#define MAX_GAP (TASK_SIZE/6*5)
22392+#define MAX_GAP (pax_task_size/6*5)
22393
22394 /*
22395 * True on X86_32 or when emulating IA32 on X86_64
ae4e228f 22396@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
58c5fc13
MT		 22397 return rnd << PAGE_SHIFT;
22398 }
22399
22400-static unsigned long mmap_base(void)
22401+static unsigned long mmap_base(struct mm_struct *mm)
22402 {
df50ba0c 22403 unsigned long gap = rlimit(RLIMIT_STACK);
58c5fc13
MT		 22404+ unsigned long pax_task_size = TASK_SIZE;
22405+
22406+#ifdef CONFIG_PAX_SEGMEXEC
22407+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22408+ pax_task_size = SEGMEXEC_TASK_SIZE;
22409+#endif
22410
22411 if (gap < MIN_GAP)
22412 gap = MIN_GAP;
22413 else if (gap > MAX_GAP)
22414 gap = MAX_GAP;
22415
22416- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22417+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22418 }
22419
22420 /*
22421 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22422 * does, but not when emulating X86_32
22423 */
22424-static unsigned long mmap_legacy_base(void)
22425+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22426 {
22427- if (mmap_is_ia32())
22428+ if (mmap_is_ia32()) {
22429+
22430+#ifdef CONFIG_PAX_SEGMEXEC
22431+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22432+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22433+ else
22434+#endif
22435+
22436 return TASK_UNMAPPED_BASE;
22437- else
22438+ } else
22439 return TASK_UNMAPPED_BASE + mmap_rnd();
22440 }
22441
ae4e228f 22442@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
58c5fc13
MT		 22443 void arch_pick_mmap_layout(struct mm_struct *mm)
22444 {
22445 if (mmap_is_legacy()) {
22446- mm->mmap_base = mmap_legacy_base();
22447+ mm->mmap_base = mmap_legacy_base(mm);
22448+
22449+#ifdef CONFIG_PAX_RANDMMAP
22450+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22451+ mm->mmap_base += mm->delta_mmap;
22452+#endif
22453+
22454 mm->get_unmapped_area = arch_get_unmapped_area;
22455 mm->unmap_area = arch_unmap_area;
22456 } else {
22457- mm->mmap_base = mmap_base();
22458+ mm->mmap_base = mmap_base(mm);
22459+
22460+#ifdef CONFIG_PAX_RANDMMAP
22461+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22462+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22463+#endif
22464+
22465 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22466 mm->unmap_area = arch_unmap_area_topdown;
22467 }
66a7e928
MT		 22468diff -urNp linux-2.6.39/arch/x86/mm/mmio-mod.c linux-2.6.39/arch/x86/mm/mmio-mod.c
22469--- linux-2.6.39/arch/x86/mm/mmio-mod.c 2011-05-19 00:06:34.000000000 -0400
22470+++ linux-2.6.39/arch/x86/mm/mmio-mod.c 2011-05-22 19:36:30.000000000 -0400
8308f9c9
MT		 22471@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
22472 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
22473 void __iomem *addr)
22474 {
22475- static atomic_t next_id;
22476+ static atomic_unchecked_t next_id;
22477 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
22478 /* These are page-unaligned. */
22479 struct mmiotrace_map map = {
22480@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
22481 .private = trace
22482 },
22483 .phys = offset,
22484- .id = atomic_inc_return(&next_id)
22485+ .id = atomic_inc_return_unchecked(&next_id)
22486 };
22487 map.map_id = trace->id;
22488
66a7e928
MT		 22489diff -urNp linux-2.6.39/arch/x86/mm/numa_32.c linux-2.6.39/arch/x86/mm/numa_32.c
22490--- linux-2.6.39/arch/x86/mm/numa_32.c 2011-05-19 00:06:34.000000000 -0400
22491+++ linux-2.6.39/arch/x86/mm/numa_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 22492@@ -99,7 +99,6 @@ unsigned long node_memmap_size_bytes(int
58c5fc13
MT		 22493 }
22494 #endif
22495
22496-extern unsigned long find_max_low_pfn(void);
22497 extern unsigned long highend_pfn, highstart_pfn;
22498
22499 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
66a7e928
MT		 22500diff -urNp linux-2.6.39/arch/x86/mm/pageattr.c linux-2.6.39/arch/x86/mm/pageattr.c
22501--- linux-2.6.39/arch/x86/mm/pageattr.c 2011-05-19 00:06:34.000000000 -0400
22502+++ linux-2.6.39/arch/x86/mm/pageattr.c 2011-05-22 19:36:30.000000000 -0400
16454cff 22503@@ -261,7 +261,7 @@ static inline pgprot_t static_protection
df50ba0c 22504 */
16454cff
MT		 22505 #ifdef CONFIG_PCI_BIOS
22506 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
df50ba0c
MT		 22507- pgprot_val(forbidden) |= _PAGE_NX;
22508+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
16454cff 22509 #endif
df50ba0c
MT		 22510
22511 /*
16454cff 22512@@ -269,9 +269,10 @@ static inline pgprot_t static_protection
58c5fc13
MT		 22513 * Does not cover __inittext since that is gone later on. On
22514 * 64bit we do not enforce !NX on the low mapping
22515 */
22516- if (within(address, (unsigned long)_text, (unsigned long)_etext))
df50ba0c 22517- pgprot_val(forbidden) |= _PAGE_NX;
58c5fc13 22518+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
df50ba0c 22519+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
58c5fc13
MT		 22520
22521+#ifdef CONFIG_DEBUG_RODATA
22522 /*
22523 * The .rodata section needs to be read-only. Using the pfn
22524 * catches all aliases.
16454cff 22525@@ -279,6 +280,7 @@ static inline pgprot_t static_protection
58c5fc13
MT		 22526 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
22527 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
22528 pgprot_val(forbidden) |= _PAGE_RW;
22529+#endif
22530
ae4e228f
MT		 22531 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
22532 /*
16454cff 22533@@ -317,6 +319,13 @@ static inline pgprot_t static_protection
df50ba0c
MT		 22534 }
22535 #endif
22536
22537+#ifdef CONFIG_PAX_KERNEXEC
22538+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
22539+ pgprot_val(forbidden) |= _PAGE_RW;
22540+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22541+ }
22542+#endif
22543+
22544 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
22545
22546 return prot;
16454cff 22547@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
58c5fc13
MT		 22548 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
22549 {
58c5fc13 22550 /* change init_mm */
ae4e228f 22551+ pax_open_kernel();
58c5fc13 22552 set_pte_atomic(kpte, pte);
58c5fc13
MT		 22553+
22554 #ifdef CONFIG_X86_32
22555 if (!SHARED_KERNEL_PMD) {
df50ba0c
MT		 22556+
22557+#ifdef CONFIG_PAX_PER_CPU_PGD
22558+ unsigned long cpu;
22559+#else
58c5fc13 22560 struct page *page;
df50ba0c
MT		 22561+#endif
22562
22563+#ifdef CONFIG_PAX_PER_CPU_PGD
22564+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22565+ pgd_t *pgd = get_cpu_pgd(cpu);
22566+#else
22567 list_for_each_entry(page, &pgd_list, lru) {
22568- pgd_t *pgd;
22569+ pgd_t *pgd = (pgd_t *)page_address(page);
22570+#endif
22571+
22572 pud_t *pud;
22573 pmd_t *pmd;
22574
22575- pgd = (pgd_t *)page_address(page) + pgd_index(address);
22576+ pgd += pgd_index(address);
22577 pud = pud_offset(pgd, address);
22578 pmd = pmd_offset(pud, address);
22579 set_pte_atomic((pte_t *)pmd, pte);
22580 }
22581 }
22582 #endif
22583+ pax_close_kernel();
22584 }
22585
22586 static int
66a7e928
MT		 22587diff -urNp linux-2.6.39/arch/x86/mm/pageattr-test.c linux-2.6.39/arch/x86/mm/pageattr-test.c
22588--- linux-2.6.39/arch/x86/mm/pageattr-test.c 2011-05-19 00:06:34.000000000 -0400
22589+++ linux-2.6.39/arch/x86/mm/pageattr-test.c 2011-05-22 19:36:30.000000000 -0400
57199397 22590@@ -36,7 +36,7 @@ enum {
58c5fc13 22591
57199397
MT		 22592 static int pte_testbit(pte_t pte)
22593 {
22594- return pte_flags(pte) & _PAGE_UNUSED1;
22595+ return pte_flags(pte) & _PAGE_CPA_TEST;
58c5fc13 22596 }
58c5fc13 22597
57199397 22598 struct split_state {
66a7e928
MT		 22599diff -urNp linux-2.6.39/arch/x86/mm/pat.c linux-2.6.39/arch/x86/mm/pat.c
22600--- linux-2.6.39/arch/x86/mm/pat.c 2011-05-19 00:06:34.000000000 -0400
22601+++ linux-2.6.39/arch/x86/mm/pat.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 22602@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
22603
22604 if (!entry) {
58c5fc13
MT		 22605 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
22606- current->comm, current->pid, start, end);
22607+ current->comm, task_pid_nr(current), start, end);
57199397 22608 return -EINVAL;
58c5fc13
MT		 22609 }
22610
57199397
MT		 22611@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
22612 while (cursor < to) {
22613 if (!devmem_is_allowed(pfn)) {
22614 printk(KERN_INFO
22615- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
22616- current->comm, from, to);
22617+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
22618+ current->comm, from, to, cursor);
22619 return 0;
22620 }
22621 cursor += PAGE_SIZE;
22622@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
58c5fc13
MT		 22623 printk(KERN_INFO
22624 "%s:%d ioremap_change_attr failed %s "
22625 "for %Lx-%Lx\n",
22626- current->comm, current->pid,
22627+ current->comm, task_pid_nr(current),
22628 cattr_name(flags),
22629 base, (unsigned long long)(base + size));
22630 return -EINVAL;
57199397
MT		 22631@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
22632 if (want_flags != flags) {
22633 printk(KERN_WARNING
22634 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
22635- current->comm, current->pid,
22636+ current->comm, task_pid_nr(current),
22637 cattr_name(want_flags),
22638 (unsigned long long)paddr,
22639 (unsigned long long)(paddr + size),
22640@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
58c5fc13
MT		 22641 free_memtype(paddr, paddr + size);
22642 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
22643 " for %Lx-%Lx, got %s\n",
22644- current->comm, current->pid,
22645+ current->comm, task_pid_nr(current),
22646 cattr_name(want_flags),
22647 (unsigned long long)paddr,
22648 (unsigned long long)(paddr + size),
66a7e928
MT		 22649diff -urNp linux-2.6.39/arch/x86/mm/pgtable_32.c linux-2.6.39/arch/x86/mm/pgtable_32.c
22650--- linux-2.6.39/arch/x86/mm/pgtable_32.c 2011-05-19 00:06:34.000000000 -0400
22651+++ linux-2.6.39/arch/x86/mm/pgtable_32.c 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 22652@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
22653 return;
22654 }
22655 pte = pte_offset_kernel(pmd, vaddr);
22656+
22657+ pax_open_kernel();
22658 if (pte_val(pteval))
22659 set_pte_at(&init_mm, vaddr, pte, pteval);
22660 else
22661 pte_clear(&init_mm, vaddr, pte);
22662+ pax_close_kernel();
22663
22664 /*
22665 * It's enough to flush this one mapping.
66a7e928
MT		 22666diff -urNp linux-2.6.39/arch/x86/mm/pgtable.c linux-2.6.39/arch/x86/mm/pgtable.c
22667--- linux-2.6.39/arch/x86/mm/pgtable.c 2011-05-19 00:06:34.000000000 -0400
22668+++ linux-2.6.39/arch/x86/mm/pgtable.c 2011-05-22 19:36:30.000000000 -0400
22669@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
df50ba0c
MT		 22670 list_del(&page->lru);
22671 }
22672
22673-#define UNSHARED_PTRS_PER_PGD \
22674- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22675+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22676+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
bc901d79 22677
df50ba0c
MT		 22678+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22679+{
22680+ while (count--)
bc901d79 22681+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
df50ba0c
MT		 22682+}
22683+#endif
22684+
22685+#ifdef CONFIG_PAX_PER_CPU_PGD
22686+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22687+{
22688+ while (count--)
22689+
22690+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22691+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
22692+#else
22693+ *dst++ = *src++;
22694+#endif
66a7e928 22695
df50ba0c
MT		 22696+}
22697+#endif
22698+
df50ba0c
MT		 22699+#ifdef CONFIG_X86_64
22700+#define pxd_t pud_t
22701+#define pyd_t pgd_t
22702+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
22703+#define pxd_free(mm, pud) pud_free((mm), (pud))
22704+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
22705+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
22706+#define PYD_SIZE PGDIR_SIZE
22707+#else
22708+#define pxd_t pmd_t
22709+#define pyd_t pud_t
22710+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
22711+#define pxd_free(mm, pud) pmd_free((mm), (pud))
22712+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
22713+#define pyd_offset(mm ,address) pud_offset((mm), (address))
22714+#define PYD_SIZE PUD_SIZE
22715+#endif
66a7e928
MT		 22716+
22717+#ifdef CONFIG_PAX_PER_CPU_PGD
22718+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
22719+static inline void pgd_dtor(pgd_t *pgd) {}
df50ba0c 22720+#else
bc901d79 22721 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
df50ba0c 22722 {
66a7e928
MT		 22723 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
22724@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
df50ba0c 22725 pgd_list_del(pgd);
16454cff 22726 spin_unlock(&pgd_lock);
df50ba0c
MT		 22727 }
22728+#endif
22729
22730 /*
22731 * List of all pgd's needed for non-PAE so it can invalidate entries
66a7e928 22732@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
df50ba0c
MT		 22733 * -- wli
22734 */
22735
22736-#ifdef CONFIG_X86_PAE
22737+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
22738 /*
22739 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
22740 * updating the top-level pagetable entries to guarantee the
66a7e928 22741@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
df50ba0c
MT		 22742 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
22743 * and initialize the kernel pmds here.
22744 */
22745-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
22746+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22747
22748 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
22749 {
66a7e928 22750@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
16454cff
MT		 22751 */
22752 flush_tlb_mm(mm);
df50ba0c
MT		 22753 }
22754+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
22755+#define PREALLOCATED_PXDS USER_PGD_PTRS
22756 #else /* !CONFIG_X86_PAE */
22757
22758 /* No need to prepopulate any pagetable entries in non-PAE modes. */
22759-#define PREALLOCATED_PMDS 0
22760+#define PREALLOCATED_PXDS 0
22761
22762 #endif /* CONFIG_X86_PAE */
22763
22764-static void free_pmds(pmd_t *pmds[])
22765+static void free_pxds(pxd_t *pxds[])
22766 {
22767 int i;
22768
22769- for(i = 0; i < PREALLOCATED_PMDS; i++)
22770- if (pmds[i])
22771- free_page((unsigned long)pmds[i]);
22772+ for(i = 0; i < PREALLOCATED_PXDS; i++)
22773+ if (pxds[i])
22774+ free_page((unsigned long)pxds[i]);
22775 }
22776
22777-static int preallocate_pmds(pmd_t *pmds[])
22778+static int preallocate_pxds(pxd_t *pxds[])
22779 {
22780 int i;
22781 bool failed = false;
22782
22783- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22784- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
22785- if (pmd == NULL)
22786+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22787+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
22788+ if (pxd == NULL)
22789 failed = true;
22790- pmds[i] = pmd;
22791+ pxds[i] = pxd;
22792 }
22793
22794 if (failed) {
22795- free_pmds(pmds);
22796+ free_pxds(pxds);
22797 return -ENOMEM;
22798 }
22799
66a7e928 22800@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
df50ba0c
MT		 22801 * preallocate which never got a corresponding vma will need to be
22802 * freed manually.
22803 */
22804-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
22805+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
22806 {
22807 int i;
22808
22809- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22810+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22811 pgd_t pgd = pgdp[i];
22812
22813 if (pgd_val(pgd) != 0) {
22814- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
22815+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
22816
22817- pgdp[i] = native_make_pgd(0);
22818+ set_pgd(pgdp + i, native_make_pgd(0));
22819
22820- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
22821- pmd_free(mm, pmd);
22822+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
22823+ pxd_free(mm, pxd);
22824 }
22825 }
22826 }
22827
22828-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
22829+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
22830 {
22831- pud_t *pud;
22832+ pyd_t *pyd;
22833 unsigned long addr;
22834 int i;
22835
22836- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
22837+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
22838 return;
22839
22840- pud = pud_offset(pgd, 0);
22841+#ifdef CONFIG_X86_64
22842+ pyd = pyd_offset(mm, 0L);
22843+#else
22844+ pyd = pyd_offset(pgd, 0L);
22845+#endif
22846
22847- for (addr = i = 0; i < PREALLOCATED_PMDS;
22848- i++, pud++, addr += PUD_SIZE) {
22849- pmd_t *pmd = pmds[i];
22850+ for (addr = i = 0; i < PREALLOCATED_PXDS;
22851+ i++, pyd++, addr += PYD_SIZE) {
22852+ pxd_t *pxd = pxds[i];
22853
22854 if (i >= KERNEL_PGD_BOUNDARY)
22855- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22856- sizeof(pmd_t) * PTRS_PER_PMD);
22857+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22858+ sizeof(pxd_t) * PTRS_PER_PMD);
22859
22860- pud_populate(mm, pud, pmd);
22861+ pyd_populate(mm, pyd, pxd);
22862 }
22863 }
22864
22865 pgd_t *pgd_alloc(struct mm_struct *mm)
22866 {
22867 pgd_t *pgd;
22868- pmd_t *pmds[PREALLOCATED_PMDS];
22869+ pxd_t *pxds[PREALLOCATED_PXDS];
df50ba0c
MT		 22870
22871 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
16454cff 22872
66a7e928 22873@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
df50ba0c
MT		 22874
22875 mm->pgd = pgd;
22876
22877- if (preallocate_pmds(pmds) != 0)
22878+ if (preallocate_pxds(pxds) != 0)
22879 goto out_free_pgd;
22880
22881 if (paravirt_pgd_alloc(mm) != 0)
22882- goto out_free_pmds;
22883+ goto out_free_pxds;
22884
22885 /*
22886 * Make sure that pre-populating the pmds is atomic with
66a7e928 22887@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
16454cff 22888 spin_lock(&pgd_lock);
df50ba0c 22889
bc901d79 22890 pgd_ctor(mm, pgd);
df50ba0c
MT		 22891- pgd_prepopulate_pmd(mm, pgd, pmds);
22892+ pgd_prepopulate_pxd(mm, pgd, pxds);
22893
16454cff 22894 spin_unlock(&pgd_lock);
df50ba0c
MT		 22895
22896 return pgd;
22897
22898-out_free_pmds:
22899- free_pmds(pmds);
22900+out_free_pxds:
22901+ free_pxds(pxds);
22902 out_free_pgd:
22903 free_page((unsigned long)pgd);
22904 out:
66a7e928 22905@@ -295,7 +344,7 @@ out:
df50ba0c
MT		 22906
22907 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
22908 {
22909- pgd_mop_up_pmds(mm, pgd);
22910+ pgd_mop_up_pxds(mm, pgd);
22911 pgd_dtor(pgd);
22912 paravirt_pgd_free(mm, pgd);
22913 free_page((unsigned long)pgd);
66a7e928
MT		 22914diff -urNp linux-2.6.39/arch/x86/mm/setup_nx.c linux-2.6.39/arch/x86/mm/setup_nx.c
22915--- linux-2.6.39/arch/x86/mm/setup_nx.c 2011-05-19 00:06:34.000000000 -0400
22916+++ linux-2.6.39/arch/x86/mm/setup_nx.c 2011-05-22 19:36:30.000000000 -0400
efbe55a5 22917@@ -5,8 +5,10 @@
df50ba0c
MT		 22918 #include <asm/pgtable.h>
22919 #include <asm/proto.h>
22920
22921+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22922 static int disable_nx __cpuinitdata;
df50ba0c 22923
efbe55a5 22924+#ifndef CONFIG_PAX_PAGEEXEC
df50ba0c
MT		 22925 /*
22926 * noexec = on|off
22927 *
efbe55a5 22928@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
df50ba0c
MT		 22929 return 0;
22930 }
22931 early_param("noexec", noexec_setup);
efbe55a5
MT		 22932+#endif
22933+
df50ba0c
MT		 22934+#endif
22935
22936 void __cpuinit x86_configure_nx(void)
22937 {
22938+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22939 if (cpu_has_nx && !disable_nx)
22940 __supported_pte_mask |= _PAGE_NX;
22941 else
22942+#endif
22943 __supported_pte_mask &= ~_PAGE_NX;
22944 }
22945
66a7e928
MT		 22946diff -urNp linux-2.6.39/arch/x86/mm/tlb.c linux-2.6.39/arch/x86/mm/tlb.c
22947--- linux-2.6.39/arch/x86/mm/tlb.c 2011-05-19 00:06:34.000000000 -0400
22948+++ linux-2.6.39/arch/x86/mm/tlb.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 22949@@ -65,7 +65,11 @@ void leave_mm(int cpu)
df50ba0c
MT		 22950 BUG();
22951 cpumask_clear_cpu(cpu,
22952 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
22953+
22954+#ifndef CONFIG_PAX_PER_CPU_PGD
22955 load_cr3(swapper_pg_dir);
22956+#endif
22957+
22958 }
22959 EXPORT_SYMBOL_GPL(leave_mm);
22960
66a7e928
MT		 22961diff -urNp linux-2.6.39/arch/x86/oprofile/backtrace.c linux-2.6.39/arch/x86/oprofile/backtrace.c
22962--- linux-2.6.39/arch/x86/oprofile/backtrace.c 2011-05-19 00:06:34.000000000 -0400
22963+++ linux-2.6.39/arch/x86/oprofile/backtrace.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 22964@@ -57,7 +57,7 @@ dump_user_backtrace_32(struct stack_fram
22965 struct stack_frame_ia32 *fp;
ae4e228f
MT		 22966
22967 /* Also check accessibility of one struct frame_head beyond */
22968- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
22969+ if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
22970 return NULL;
22971 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
22972 return NULL;
bc901d79 22973@@ -123,7 +123,7 @@ x86_backtrace(struct pt_regs * const reg
58c5fc13 22974 {
bc901d79 22975 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
58c5fc13
MT		 22976
22977- if (!user_mode_vm(regs)) {
22978+ if (!user_mode(regs)) {
22979 unsigned long stack = kernel_stack_pointer(regs);
22980 if (depth)
66a7e928
MT		 22981 dump_trace(NULL, regs, (unsigned long *)stack, 0,
22982diff -urNp linux-2.6.39/arch/x86/pci/ce4100.c linux-2.6.39/arch/x86/pci/ce4100.c
22983--- linux-2.6.39/arch/x86/pci/ce4100.c 2011-05-19 00:06:34.000000000 -0400
22984+++ linux-2.6.39/arch/x86/pci/ce4100.c 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 22985@@ -302,7 +302,7 @@ static int ce4100_conf_write(unsigned in
22986 return pci_direct_conf1.write(seg, bus, devfn, reg, len, value);
22987 }
22988
22989-struct pci_raw_ops ce4100_pci_conf = {
22990+const struct pci_raw_ops ce4100_pci_conf = {
22991 .read = ce4100_conf_read,
22992 .write = ce4100_conf_write,
22993 };
66a7e928
MT		 22994diff -urNp linux-2.6.39/arch/x86/pci/common.c linux-2.6.39/arch/x86/pci/common.c
22995--- linux-2.6.39/arch/x86/pci/common.c 2011-05-19 00:06:34.000000000 -0400
22996+++ linux-2.6.39/arch/x86/pci/common.c 2011-05-22 19:36:30.000000000 -0400
16454cff 22997@@ -33,8 +33,8 @@ int noioapicreroute = 1;
ae4e228f
MT		 22998 int pcibios_last_bus = -1;
22999 unsigned long pirq_table_addr;
23000 struct pci_bus *pci_root_bus;
23001-struct pci_raw_ops *raw_pci_ops;
23002-struct pci_raw_ops *raw_pci_ext_ops;
23003+const struct pci_raw_ops *raw_pci_ops;
23004+const struct pci_raw_ops *raw_pci_ext_ops;
23005
23006 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23007 int reg, int len, u32 *val)
66a7e928
MT		 23008diff -urNp linux-2.6.39/arch/x86/pci/direct.c linux-2.6.39/arch/x86/pci/direct.c
23009--- linux-2.6.39/arch/x86/pci/direct.c 2011-05-19 00:06:34.000000000 -0400
23010+++ linux-2.6.39/arch/x86/pci/direct.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 23011@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23012
23013 #undef PCI_CONF1_ADDRESS
23014
23015-struct pci_raw_ops pci_direct_conf1 = {
23016+const struct pci_raw_ops pci_direct_conf1 = {
23017 .read = pci_conf1_read,
23018 .write = pci_conf1_write,
23019 };
23020@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23021
23022 #undef PCI_CONF2_ADDRESS
23023
23024-struct pci_raw_ops pci_direct_conf2 = {
23025+const struct pci_raw_ops pci_direct_conf2 = {
23026 .read = pci_conf2_read,
23027 .write = pci_conf2_write,
23028 };
23029@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23030 * This should be close to trivial, but it isn't, because there are buggy
23031 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23032 */
23033-static int __init pci_sanity_check(struct pci_raw_ops *o)
23034+static int __init pci_sanity_check(const struct pci_raw_ops *o)
23035 {
23036 u32 x = 0;
23037 int year, devfn;
66a7e928
MT		 23038diff -urNp linux-2.6.39/arch/x86/pci/fixup.c linux-2.6.39/arch/x86/pci/fixup.c
23039--- linux-2.6.39/arch/x86/pci/fixup.c 2011-05-19 00:06:34.000000000 -0400
23040+++ linux-2.6.39/arch/x86/pci/fixup.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 23041@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
23042 DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
23043 },
23044 },
23045- { }
71d190be 23046+ {}
58c5fc13
MT		 23047 };
23048
23049 static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
66a7e928
MT		 23050diff -urNp linux-2.6.39/arch/x86/pci/mmconfig_32.c linux-2.6.39/arch/x86/pci/mmconfig_32.c
23051--- linux-2.6.39/arch/x86/pci/mmconfig_32.c 2011-05-19 00:06:34.000000000 -0400
23052+++ linux-2.6.39/arch/x86/pci/mmconfig_32.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 23053@@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int
23054 return 0;
23055 }
23056
23057-static struct pci_raw_ops pci_mmcfg = {
23058+static const struct pci_raw_ops pci_mmcfg = {
23059 .read = pci_mmcfg_read,
23060 .write = pci_mmcfg_write,
23061 };
66a7e928
MT		 23062diff -urNp linux-2.6.39/arch/x86/pci/mmconfig_64.c linux-2.6.39/arch/x86/pci/mmconfig_64.c
23063--- linux-2.6.39/arch/x86/pci/mmconfig_64.c 2011-05-19 00:06:34.000000000 -0400
23064+++ linux-2.6.39/arch/x86/pci/mmconfig_64.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 23065@@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int
23066 return 0;
23067 }
23068
23069-static struct pci_raw_ops pci_mmcfg = {
23070+static const struct pci_raw_ops pci_mmcfg = {
23071 .read = pci_mmcfg_read,
23072 .write = pci_mmcfg_write,
23073 };
66a7e928
MT		 23074diff -urNp linux-2.6.39/arch/x86/pci/mrst.c linux-2.6.39/arch/x86/pci/mrst.c
23075--- linux-2.6.39/arch/x86/pci/mrst.c 2011-05-19 00:06:34.000000000 -0400
23076+++ linux-2.6.39/arch/x86/pci/mrst.c 2011-05-22 19:36:30.000000000 -0400
23077@@ -218,7 +218,7 @@ static int mrst_pci_irq_enable(struct pc
23078 return 0;
23079 }
23080
23081-struct pci_ops pci_mrst_ops = {
23082+const struct pci_ops pci_mrst_ops = {
23083 .read = pci_read,
23084 .write = pci_write,
23085 };
23086diff -urNp linux-2.6.39/arch/x86/pci/numaq_32.c linux-2.6.39/arch/x86/pci/numaq_32.c
23087--- linux-2.6.39/arch/x86/pci/numaq_32.c 2011-05-19 00:06:34.000000000 -0400
23088+++ linux-2.6.39/arch/x86/pci/numaq_32.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 23089@@ -108,7 +108,7 @@ static int pci_conf1_mq_write(unsigned i
ae4e228f
MT		 23090
23091 #undef PCI_CONF1_MQ_ADDRESS
23092
23093-static struct pci_raw_ops pci_direct_conf1_mq = {
23094+static const struct pci_raw_ops pci_direct_conf1_mq = {
23095 .read = pci_conf1_mq_read,
23096 .write = pci_conf1_mq_write
23097 };
66a7e928
MT		 23098diff -urNp linux-2.6.39/arch/x86/pci/olpc.c linux-2.6.39/arch/x86/pci/olpc.c
23099--- linux-2.6.39/arch/x86/pci/olpc.c 2011-05-19 00:06:34.000000000 -0400
23100+++ linux-2.6.39/arch/x86/pci/olpc.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 23101@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23102 return 0;
23103 }
23104
23105-static struct pci_raw_ops pci_olpc_conf = {
23106+static const struct pci_raw_ops pci_olpc_conf = {
23107 .read = pci_olpc_read,
23108 .write = pci_olpc_write,
23109 };
66a7e928
MT		 23110diff -urNp linux-2.6.39/arch/x86/pci/pcbios.c linux-2.6.39/arch/x86/pci/pcbios.c
23111--- linux-2.6.39/arch/x86/pci/pcbios.c 2011-05-19 00:06:34.000000000 -0400
23112+++ linux-2.6.39/arch/x86/pci/pcbios.c 2011-05-22 19:36:30.000000000 -0400
16454cff 23113@@ -79,50 +79,93 @@ union bios32 {
58c5fc13
MT		 23114 static struct {
23115 unsigned long address;
23116 unsigned short segment;
23117-} bios32_indirect = { 0, __KERNEL_CS };
23118+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23119
23120 /*
23121 * Returns the entry point for the given service, NULL on error
23122 */
23123
23124-static unsigned long bios32_service(unsigned long service)
23125+static unsigned long __devinit bios32_service(unsigned long service)
23126 {
23127 unsigned char return_code; /* %al */
23128 unsigned long address; /* %ebx */
23129 unsigned long length; /* %ecx */
23130 unsigned long entry; /* %edx */
23131 unsigned long flags;
23132+ struct desc_struct d, *gdt;
58c5fc13
MT		 23133
23134 local_irq_save(flags);
23135- __asm__("lcall *(%%edi); cld"
23136+
23137+ gdt = get_cpu_gdt_table(smp_processor_id());
23138+
58c5fc13
MT		 23139+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23140+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23141+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23142+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23143+
58c5fc13
MT		 23144+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23145 : "=a" (return_code),
23146 "=b" (address),
23147 "=c" (length),
23148 "=d" (entry)
23149 : "0" (service),
23150 "1" (0),
23151- "D" (&bios32_indirect));
23152+ "D" (&bios32_indirect),
23153+ "r"(__PCIBIOS_DS)
23154+ : "memory");
23155+
ae4e228f 23156+ pax_open_kernel();
58c5fc13
MT		 23157+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23158+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23159+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23160+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
ae4e228f 23161+ pax_close_kernel();
58c5fc13
MT		 23162+
23163 local_irq_restore(flags);
23164
23165 switch (return_code) {
23166- case 0:
23167- return address + entry;
23168- case 0x80: /* Not present */
23169- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23170- return 0;
23171- default: /* Shouldn't happen */
23172- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23173- service, return_code);
23174+ case 0: {
23175+ int cpu;
23176+ unsigned char flags;
23177+
23178+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23179+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23180+ printk(KERN_WARNING "bios32_service: not valid\n");
23181 return 0;
23182+ }
23183+ address = address + PAGE_OFFSET;
23184+ length += 16UL; /* some BIOSs underreport this... */
23185+ flags = 4;
23186+ if (length >= 64*1024*1024) {
23187+ length >>= PAGE_SHIFT;
23188+ flags |= 8;
23189+ }
23190+
58c5fc13
MT		 23191+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23192+ gdt = get_cpu_gdt_table(cpu);
23193+ pack_descriptor(&d, address, length, 0x9b, flags);
23194+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23195+ pack_descriptor(&d, address, length, 0x93, flags);
23196+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23197+ }
58c5fc13
MT		 23198+ return entry;
23199+ }
23200+ case 0x80: /* Not present */
23201+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23202+ return 0;
23203+ default: /* Shouldn't happen */
23204+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23205+ service, return_code);
23206+ return 0;
23207 }
23208 }
23209
23210 static struct {
23211 unsigned long address;
23212 unsigned short segment;
23213-} pci_indirect = { 0, __KERNEL_CS };
23214+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23215
23216-static int pci_bios_present;
23217+static int pci_bios_present __read_only;
23218
23219 static int __devinit check_pcibios(void)
23220 {
16454cff 23221@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
58c5fc13
MT		 23222 unsigned long flags, pcibios_entry;
23223
23224 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23225- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23226+ pci_indirect.address = pcibios_entry;
23227
23228 local_irq_save(flags);
23229- __asm__(
23230- "lcall *(%%edi); cld\n\t"
23231+ __asm__("movw %w6, %%ds\n\t"
23232+ "lcall *%%ss:(%%edi); cld\n\t"
23233+ "push %%ss\n\t"
23234+ "pop %%ds\n\t"
23235 "jc 1f\n\t"
23236 "xor %%ah, %%ah\n"
23237 "1:"
16454cff 23238@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
58c5fc13
MT		 23239 "=b" (ebx),
23240 "=c" (ecx)
23241 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23242- "D" (&pci_indirect)
23243+ "D" (&pci_indirect),
23244+ "r" (__PCIBIOS_DS)
23245 : "memory");
23246 local_irq_restore(flags);
23247
16454cff 23248@@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
58c5fc13
MT		 23249
23250 switch (len) {
23251 case 1:
23252- __asm__("lcall *(%%esi); cld\n\t"
23253+ __asm__("movw %w6, %%ds\n\t"
23254+ "lcall *%%ss:(%%esi); cld\n\t"
23255+ "push %%ss\n\t"
23256+ "pop %%ds\n\t"
23257 "jc 1f\n\t"
23258 "xor %%ah, %%ah\n"
23259 "1:"
16454cff 23260@@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
58c5fc13
MT		 23261 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23262 "b" (bx),
23263 "D" ((long)reg),
23264- "S" (&pci_indirect));
23265+ "S" (&pci_indirect),
23266+ "r" (__PCIBIOS_DS));
23267 /*
23268 * Zero-extend the result beyond 8 bits, do not trust the
23269 * BIOS having done it:
16454cff 23270@@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
58c5fc13
MT		 23271 *value &= 0xff;
23272 break;
23273 case 2:
23274- __asm__("lcall *(%%esi); cld\n\t"
23275+ __asm__("movw %w6, %%ds\n\t"
23276+ "lcall *%%ss:(%%esi); cld\n\t"
23277+ "push %%ss\n\t"
23278+ "pop %%ds\n\t"
23279 "jc 1f\n\t"
23280 "xor %%ah, %%ah\n"
23281 "1:"
16454cff 23282@@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
58c5fc13
MT		 23283 : "1" (PCIBIOS_READ_CONFIG_WORD),
23284 "b" (bx),
23285 "D" ((long)reg),
23286- "S" (&pci_indirect));
23287+ "S" (&pci_indirect),
23288+ "r" (__PCIBIOS_DS));
23289 /*
23290 * Zero-extend the result beyond 16 bits, do not trust the
23291 * BIOS having done it:
16454cff 23292@@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
58c5fc13
MT		 23293 *value &= 0xffff;
23294 break;
23295 case 4:
23296- __asm__("lcall *(%%esi); cld\n\t"
23297+ __asm__("movw %w6, %%ds\n\t"
23298+ "lcall *%%ss:(%%esi); cld\n\t"
23299+ "push %%ss\n\t"
23300+ "pop %%ds\n\t"
23301 "jc 1f\n\t"
23302 "xor %%ah, %%ah\n"
23303 "1:"
16454cff 23304@@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
58c5fc13
MT		 23305 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23306 "b" (bx),
23307 "D" ((long)reg),
23308- "S" (&pci_indirect));
23309+ "S" (&pci_indirect),
23310+ "r" (__PCIBIOS_DS));
23311 break;
23312 }
23313
16454cff 23314@@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
58c5fc13
MT		 23315
23316 switch (len) {
23317 case 1:
23318- __asm__("lcall *(%%esi); cld\n\t"
23319+ __asm__("movw %w6, %%ds\n\t"
23320+ "lcall *%%ss:(%%esi); cld\n\t"
23321+ "push %%ss\n\t"
23322+ "pop %%ds\n\t"
23323 "jc 1f\n\t"
23324 "xor %%ah, %%ah\n"
23325 "1:"
16454cff 23326@@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
58c5fc13
MT		 23327 "c" (value),
23328 "b" (bx),
23329 "D" ((long)reg),
23330- "S" (&pci_indirect));
23331+ "S" (&pci_indirect),
23332+ "r" (__PCIBIOS_DS));
23333 break;
23334 case 2:
23335- __asm__("lcall *(%%esi); cld\n\t"
23336+ __asm__("movw %w6, %%ds\n\t"
23337+ "lcall *%%ss:(%%esi); cld\n\t"
23338+ "push %%ss\n\t"
23339+ "pop %%ds\n\t"
23340 "jc 1f\n\t"
23341 "xor %%ah, %%ah\n"
23342 "1:"
16454cff 23343@@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
58c5fc13
MT		 23344 "c" (value),
23345 "b" (bx),
23346 "D" ((long)reg),
23347- "S" (&pci_indirect));
23348+ "S" (&pci_indirect),
23349+ "r" (__PCIBIOS_DS));
23350 break;
23351 case 4:
23352- __asm__("lcall *(%%esi); cld\n\t"
23353+ __asm__("movw %w6, %%ds\n\t"
23354+ "lcall *%%ss:(%%esi); cld\n\t"
23355+ "push %%ss\n\t"
23356+ "pop %%ds\n\t"
23357 "jc 1f\n\t"
23358 "xor %%ah, %%ah\n"
23359 "1:"
16454cff 23360@@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
58c5fc13
MT		 23361 "c" (value),
23362 "b" (bx),
23363 "D" ((long)reg),
23364- "S" (&pci_indirect));
23365+ "S" (&pci_indirect),
23366+ "r" (__PCIBIOS_DS));
23367 break;
23368 }
23369
16454cff 23370@@ -301,7 +371,7 @@ static int pci_bios_write(unsigned int s
ae4e228f
MT		 23371 * Function table for BIOS32 access
23372 */
23373
23374-static struct pci_raw_ops pci_bios_access = {
23375+static const struct pci_raw_ops pci_bios_access = {
23376 .read = pci_bios_read,
23377 .write = pci_bios_write
23378 };
16454cff 23379@@ -310,7 +380,7 @@ static struct pci_raw_ops pci_bios_acces
ae4e228f
MT		 23380 * Try to find PCI BIOS.
23381 */
23382
23383-static struct pci_raw_ops * __devinit pci_find_bios(void)
23384+static const struct pci_raw_ops * __devinit pci_find_bios(void)
23385 {
23386 union bios32 *check;
23387 unsigned char sum;
16454cff 23388@@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
58c5fc13
MT		 23389
23390 DBG("PCI: Fetching IRQ routing table... ");
23391 __asm__("push %%es\n\t"
23392+ "movw %w8, %%ds\n\t"
23393 "push %%ds\n\t"
23394 "pop %%es\n\t"
23395- "lcall *(%%esi); cld\n\t"
23396+ "lcall *%%ss:(%%esi); cld\n\t"
23397 "pop %%es\n\t"
23398+ "push %%ss\n\t"
23399+ "pop %%ds\n"
23400 "jc 1f\n\t"
23401 "xor %%ah, %%ah\n"
23402 "1:"
16454cff 23403@@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
58c5fc13
MT		 23404 "1" (0),
23405 "D" ((long) &opt),
23406 "S" (&pci_indirect),
23407- "m" (opt)
23408+ "m" (opt),
23409+ "r" (__PCIBIOS_DS)
23410 : "memory");
23411 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
23412 if (ret & 0xff00)
16454cff 23413@@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
58c5fc13
MT		 23414 {
23415 int ret;
23416
23417- __asm__("lcall *(%%esi); cld\n\t"
23418+ __asm__("movw %w5, %%ds\n\t"
23419+ "lcall *%%ss:(%%esi); cld\n\t"
23420+ "push %%ss\n\t"
23421+ "pop %%ds\n"
23422 "jc 1f\n\t"
23423 "xor %%ah, %%ah\n"
23424 "1:"
16454cff 23425@@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
58c5fc13
MT		 23426 : "0" (PCIBIOS_SET_PCI_HW_INT),
23427 "b" ((dev->bus->number << 8) | dev->devfn),
23428 "c" ((irq << 8) | (pin + 10)),
23429- "S" (&pci_indirect));
23430+ "S" (&pci_indirect),
23431+ "r" (__PCIBIOS_DS));
23432 return !(ret & 0xff00);
23433 }
23434 EXPORT_SYMBOL(pcibios_set_irq_routing);
66a7e928
MT		 23435diff -urNp linux-2.6.39/arch/x86/pci/xen.c linux-2.6.39/arch/x86/pci/xen.c
23436--- linux-2.6.39/arch/x86/pci/xen.c 2011-05-19 00:06:34.000000000 -0400
23437+++ linux-2.6.39/arch/x86/pci/xen.c 2011-05-22 19:36:30.000000000 -0400
23438@@ -62,7 +62,7 @@ static int acpi_register_gsi_xen_hvm(str
23439 #include <linux/msi.h>
23440 #include <asm/msidef.h>
23441
23442-struct xen_pci_frontend_ops *xen_pci_frontend;
23443+const struct xen_pci_frontend_ops *xen_pci_frontend;
23444 EXPORT_SYMBOL_GPL(xen_pci_frontend);
23445
23446 #define XEN_PIRQ_MSI_DATA (MSI_DATA_TRIGGER_EDGE | \
23447diff -urNp linux-2.6.39/arch/x86/platform/efi/efi_32.c linux-2.6.39/arch/x86/platform/efi/efi_32.c
23448--- linux-2.6.39/arch/x86/platform/efi/efi_32.c 2011-05-19 00:06:34.000000000 -0400
23449+++ linux-2.6.39/arch/x86/platform/efi/efi_32.c 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 23450@@ -38,70 +38,37 @@
23451 */
23452
23453 static unsigned long efi_rt_eflags;
23454-static pgd_t efi_bak_pg_dir_pointer[2];
23455+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
23456
23457-void efi_call_phys_prelog(void)
23458+void __init efi_call_phys_prelog(void)
23459 {
23460- unsigned long cr4;
23461- unsigned long temp;
23462 struct desc_ptr gdt_descr;
23463
23464 local_irq_save(efi_rt_eflags);
23465
23466- /*
23467- * If I don't have PAE, I should just duplicate two entries in page
23468- * directory. If I have PAE, I just need to duplicate one entry in
23469- * page directory.
23470- */
23471- cr4 = read_cr4_safe();
23472-
23473- if (cr4 & X86_CR4_PAE) {
23474- efi_bak_pg_dir_pointer[0].pgd =
23475- swapper_pg_dir[pgd_index(0)].pgd;
23476- swapper_pg_dir[0].pgd =
23477- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23478- } else {
23479- efi_bak_pg_dir_pointer[0].pgd =
23480- swapper_pg_dir[pgd_index(0)].pgd;
23481- efi_bak_pg_dir_pointer[1].pgd =
23482- swapper_pg_dir[pgd_index(0x400000)].pgd;
23483- swapper_pg_dir[pgd_index(0)].pgd =
23484- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23485- temp = PAGE_OFFSET + 0x400000;
23486- swapper_pg_dir[pgd_index(0x400000)].pgd =
23487- swapper_pg_dir[pgd_index(temp)].pgd;
23488- }
23489+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
23490+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23491+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
23492
23493 /*
23494 * After the lock is released, the original page table is restored.
23495 */
23496 __flush_tlb_all();
23497
23498- gdt_descr.address = __pa(get_cpu_gdt_table(0));
23499+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
23500 gdt_descr.size = GDT_SIZE - 1;
23501 load_gdt(&gdt_descr);
23502 }
23503
23504-void efi_call_phys_epilog(void)
23505+void __init efi_call_phys_epilog(void)
23506 {
23507- unsigned long cr4;
23508 struct desc_ptr gdt_descr;
23509
23510- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
23511+ gdt_descr.address = get_cpu_gdt_table(0);
23512 gdt_descr.size = GDT_SIZE - 1;
23513 load_gdt(&gdt_descr);
23514
23515- cr4 = read_cr4_safe();
23516-
23517- if (cr4 & X86_CR4_PAE) {
23518- swapper_pg_dir[pgd_index(0)].pgd =
23519- efi_bak_pg_dir_pointer[0].pgd;
23520- } else {
23521- swapper_pg_dir[pgd_index(0)].pgd =
23522- efi_bak_pg_dir_pointer[0].pgd;
23523- swapper_pg_dir[pgd_index(0x400000)].pgd =
23524- efi_bak_pg_dir_pointer[1].pgd;
23525- }
23526+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
23527
23528 /*
23529 * After the lock is released, the original page table is restored.
66a7e928
MT		 23530diff -urNp linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S
23531--- linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S 2011-05-19 00:06:34.000000000 -0400
23532+++ linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S 2011-05-22 19:36:30.000000000 -0400
bc901d79
MT		 23533@@ -6,6 +6,7 @@
23534 */
23535
23536 #include <linux/linkage.h>
23537+#include <linux/init.h>
23538 #include <asm/page_types.h>
23539
23540 /*
23541@@ -20,7 +21,7 @@
23542 * service functions will comply with gcc calling convention, too.
23543 */
23544
23545-.text
23546+__INIT
23547 ENTRY(efi_call_phys)
23548 /*
23549 * 0. The function can only be called in Linux kernel. So CS has been
23550@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
23551 * The mapping of lower virtual memory has been created in prelog and
23552 * epilog.
23553 */
23554- movl $1f, %edx
23555- subl $__PAGE_OFFSET, %edx
23556- jmp *%edx
23557+ jmp 1f-__PAGE_OFFSET
23558 1:
23559
23560 /*
23561@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
23562 * parameter 2, ..., param n. To make things easy, we save the return
23563 * address of efi_call_phys in a global variable.
23564 */
23565- popl %edx
23566- movl %edx, saved_return_addr
23567- /* get the function pointer into ECX*/
23568- popl %ecx
23569- movl %ecx, efi_rt_function_ptr
23570- movl $2f, %edx
23571- subl $__PAGE_OFFSET, %edx
23572- pushl %edx
23573+ popl (saved_return_addr)
23574+ popl (efi_rt_function_ptr)
23575
23576 /*
23577 * 3. Clear PG bit in %CR0.
23578@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
23579 /*
23580 * 5. Call the physical function.
23581 */
23582- jmp *%ecx
23583+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
23584
23585-2:
23586 /*
23587 * 6. After EFI runtime service returns, control will return to
23588 * following instruction. We'd better readjust stack pointer first.
23589@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
23590 movl %cr0, %edx
23591 orl $0x80000000, %edx
23592 movl %edx, %cr0
23593- jmp 1f
23594-1:
23595+
23596 /*
23597 * 8. Now restore the virtual mode from flat mode by
23598 * adding EIP with PAGE_OFFSET.
23599 */
23600- movl $1f, %edx
23601- jmp *%edx
23602+ jmp 1f+__PAGE_OFFSET
23603 1:
23604
23605 /*
23606 * 9. Balance the stack. And because EAX contain the return value,
23607 * we'd better not clobber it.
23608 */
23609- leal efi_rt_function_ptr, %edx
23610- movl (%edx), %ecx
23611- pushl %ecx
23612+ pushl (efi_rt_function_ptr)
23613
23614 /*
23615- * 10. Push the saved return address onto the stack and return.
23616+ * 10. Return to the saved return address.
23617 */
23618- leal saved_return_addr, %edx
23619- movl (%edx), %ecx
23620- pushl %ecx
23621- ret
23622+ jmpl *(saved_return_addr)
23623 ENDPROC(efi_call_phys)
23624 .previous
23625
23626-.data
23627+__INITDATA
23628 saved_return_addr:
23629 .long 0
23630 efi_rt_function_ptr:
66a7e928
MT		 23631diff -urNp linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c
23632--- linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c 2011-05-19 00:06:34.000000000 -0400
23633+++ linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c 2011-05-22 19:36:30.000000000 -0400
23634@@ -154,7 +154,7 @@ void * __init prom_early_alloc(unsigned
23635 return res;
23636 }
23637
23638-static struct of_pdt_ops prom_olpc_ops __initdata = {
23639+static const struct of_pdt_ops prom_olpc_ops = {
23640 .nextprop = olpc_dt_nextprop,
23641 .getproplen = olpc_dt_getproplen,
23642 .getproperty = olpc_dt_getproperty,
23643diff -urNp linux-2.6.39/arch/x86/platform/uv/tlb_uv.c linux-2.6.39/arch/x86/platform/uv/tlb_uv.c
23644--- linux-2.6.39/arch/x86/platform/uv/tlb_uv.c 2011-05-19 00:06:34.000000000 -0400
23645+++ linux-2.6.39/arch/x86/platform/uv/tlb_uv.c 2011-05-22 19:36:30.000000000 -0400
23646@@ -342,6 +342,8 @@ static void uv_reset_with_ipi(struct bau
23647 cpumask_t mask;
23648 struct reset_args reset_args;
23649
23650+ pax_track_stack();
23651+
23652 reset_args.sender = sender;
23653
23654 cpus_clear(mask);
23655diff -urNp linux-2.6.39/arch/x86/power/cpu.c linux-2.6.39/arch/x86/power/cpu.c
23656--- linux-2.6.39/arch/x86/power/cpu.c 2011-05-19 00:06:34.000000000 -0400
23657+++ linux-2.6.39/arch/x86/power/cpu.c 2011-05-22 19:36:30.000000000 -0400
6892158b 23658@@ -130,7 +130,7 @@ static void do_fpu_end(void)
58c5fc13
MT		 23659 static void fix_processor_context(void)
23660 {
23661 int cpu = smp_processor_id();
23662- struct tss_struct *t = &per_cpu(init_tss, cpu);
23663+ struct tss_struct *t = init_tss + cpu;
58c5fc13
MT		 23664
23665 set_tss_desc(cpu, t); /*
23666 * This just modifies memory; should not be
6892158b 23667@@ -140,7 +140,9 @@ static void fix_processor_context(void)
58c5fc13
MT		 23668 */
23669
23670 #ifdef CONFIG_X86_64
ae4e228f 23671+ pax_open_kernel();
58c5fc13 23672 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
ae4e228f 23673+ pax_close_kernel();
58c5fc13 23674
58c5fc13
MT		 23675 syscall_init(); /* This sets MSR_*STAR and related */
23676 #endif
66a7e928
MT		 23677diff -urNp linux-2.6.39/arch/x86/vdso/Makefile linux-2.6.39/arch/x86/vdso/Makefile
23678--- linux-2.6.39/arch/x86/vdso/Makefile 2011-05-19 00:06:34.000000000 -0400
23679+++ linux-2.6.39/arch/x86/vdso/Makefile 2011-05-22 19:36:30.000000000 -0400
6892158b
MT		 23680@@ -123,7 +123,7 @@ quiet_cmd_vdso = VDSO $@
23681 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
23682 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
58c5fc13 23683
ae4e228f 23684-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
71d190be 23685+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
58c5fc13
MT		 23686 GCOV_PROFILE := n
23687
23688 #
66a7e928
MT		 23689diff -urNp linux-2.6.39/arch/x86/vdso/vclock_gettime.c linux-2.6.39/arch/x86/vdso/vclock_gettime.c
23690--- linux-2.6.39/arch/x86/vdso/vclock_gettime.c 2011-05-19 00:06:34.000000000 -0400
23691+++ linux-2.6.39/arch/x86/vdso/vclock_gettime.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 23692@@ -22,24 +22,48 @@
23693 #include <asm/hpet.h>
23694 #include <asm/unistd.h>
23695 #include <asm/io.h>
23696+#include <asm/fixmap.h>
23697 #include "vextern.h"
23698
23699 #define gtod vdso_vsyscall_gtod_data
23700
23701+notrace noinline long __vdso_fallback_time(long *t)
23702+{
23703+ long secs;
23704+ asm volatile("syscall"
23705+ : "=a" (secs)
23706+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
23707+ return secs;
23708+}
23709+
23710 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
23711 {
23712 long ret;
23713 asm("syscall" : "=a" (ret) :
23714- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
23715+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
23716 return ret;
23717 }
23718
23719+notrace static inline cycle_t __vdso_vread_hpet(void)
23720+{
23721+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
23722+}
23723+
23724+notrace static inline cycle_t __vdso_vread_tsc(void)
23725+{
23726+ cycle_t ret = (cycle_t)vget_cycles();
23727+
23728+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
23729+}
23730+
23731 notrace static inline long vgetns(void)
23732 {
23733 long v;
23734- cycles_t (*vread)(void);
23735- vread = gtod->clock.vread;
23736- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
23737+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
23738+ v = __vdso_vread_tsc();
23739+ else
23740+ v = __vdso_vread_hpet();
23741+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
23742 return (v * gtod->clock.mult) >> gtod->clock.shift;
23743 }
23744
ae4e228f 23745@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
58c5fc13
MT		 23746
23747 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
23748 {
ae4e228f 23749- if (likely(gtod->sysctl_enabled))
58c5fc13
MT		 23750+ if (likely(gtod->sysctl_enabled &&
23751+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23752+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23753 switch (clock) {
23754 case CLOCK_REALTIME:
ae4e228f
MT		 23755 if (likely(gtod->clock.vread))
23756@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
58c5fc13
MT		 23757 int clock_gettime(clockid_t, struct timespec *)
23758 __attribute__((weak, alias("__vdso_clock_gettime")));
23759
23760-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23761+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
23762 {
23763 long ret;
23764- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
23765+ asm("syscall" : "=a" (ret) :
23766+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
23767+ return ret;
23768+}
23769+
23770+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23771+{
23772+ if (likely(gtod->sysctl_enabled &&
23773+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23774+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23775+ {
23776 if (likely(tv != NULL)) {
23777 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
23778 offsetof(struct timespec, tv_nsec) ||
ae4e228f 23779@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
58c5fc13
MT		 23780 }
23781 return 0;
23782 }
23783- asm("syscall" : "=a" (ret) :
23784- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
23785- return ret;
23786+ return __vdso_fallback_gettimeofday(tv, tz);
23787 }
23788 int gettimeofday(struct timeval *, struct timezone *)
23789 __attribute__((weak, alias("__vdso_gettimeofday")));
66a7e928
MT		 23790diff -urNp linux-2.6.39/arch/x86/vdso/vdso32-setup.c linux-2.6.39/arch/x86/vdso/vdso32-setup.c
23791--- linux-2.6.39/arch/x86/vdso/vdso32-setup.c 2011-05-19 00:06:34.000000000 -0400
23792+++ linux-2.6.39/arch/x86/vdso/vdso32-setup.c 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 23793@@ -25,6 +25,7 @@
23794 #include <asm/tlbflush.h>
23795 #include <asm/vdso.h>
23796 #include <asm/proto.h>
23797+#include <asm/mman.h>
23798
23799 enum {
23800 VDSO_DISABLED = 0,
23801@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
23802 void enable_sep_cpu(void)
23803 {
23804 int cpu = get_cpu();
23805- struct tss_struct *tss = &per_cpu(init_tss, cpu);
23806+ struct tss_struct *tss = init_tss + cpu;
23807
23808 if (!boot_cpu_has(X86_FEATURE_SEP)) {
23809 put_cpu();
23810@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
23811 gate_vma.vm_start = FIXADDR_USER_START;
23812 gate_vma.vm_end = FIXADDR_USER_END;
23813 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
23814- gate_vma.vm_page_prot = __P101;
23815+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
23816 /*
23817 * Make sure the vDSO gets into every core dump.
23818 * Dumping its contents makes post-mortem fully interpretable later
23819@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
23820 if (compat)
23821 addr = VDSO_HIGH_BASE;
23822 else {
23823- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
23824+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
23825 if (IS_ERR_VALUE(addr)) {
23826 ret = addr;
23827 goto up_fail;
23828 }
23829 }
23830
23831- current->mm->context.vdso = (void *)addr;
23832+ current->mm->context.vdso = addr;
23833
23834 if (compat_uses_vma || !compat) {
23835 /*
ae4e228f
MT		 23836@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
23837 }
23838
23839 current_thread_info()->sysenter_return =
23840- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23841+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
58c5fc13
MT		 23842
23843 up_fail:
23844 if (ret)
23845- current->mm->context.vdso = NULL;
23846+ current->mm->context.vdso = 0;
23847
23848 up_write(&mm->mmap_sem);
23849
ae4e228f 23850@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
58c5fc13
MT		 23851
23852 const char *arch_vma_name(struct vm_area_struct *vma)
23853 {
23854- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
23855+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
23856 return "[vdso]";
23857+
23858+#ifdef CONFIG_PAX_SEGMEXEC
23859+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
23860+ return "[vdso]";
23861+#endif
23862+
23863 return NULL;
23864 }
23865
66a7e928
MT		 23866@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
23867 * Check to see if the corresponding task was created in compat vdso
23868 * mode.
23869 */
58c5fc13
MT		 23870- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
23871+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
23872 return &gate_vma;
23873 return NULL;
23874 }
66a7e928
MT		 23875diff -urNp linux-2.6.39/arch/x86/vdso/vdso.lds.S linux-2.6.39/arch/x86/vdso/vdso.lds.S
23876--- linux-2.6.39/arch/x86/vdso/vdso.lds.S 2011-05-19 00:06:34.000000000 -0400
23877+++ linux-2.6.39/arch/x86/vdso/vdso.lds.S 2011-05-22 19:36:30.000000000 -0400
57199397
MT		 23878@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
23879 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
23880 #include "vextern.h"
23881 #undef VEXTERN
23882+
23883+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
23884+VEXTERN(fallback_gettimeofday)
23885+VEXTERN(fallback_time)
23886+VEXTERN(getcpu)
23887+#undef VEXTERN
66a7e928
MT		 23888diff -urNp linux-2.6.39/arch/x86/vdso/vextern.h linux-2.6.39/arch/x86/vdso/vextern.h
23889--- linux-2.6.39/arch/x86/vdso/vextern.h 2011-05-19 00:06:34.000000000 -0400
23890+++ linux-2.6.39/arch/x86/vdso/vextern.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 23891@@ -11,6 +11,5 @@
23892 put into vextern.h and be referenced as a pointer with vdso prefix.
23893 The main kernel later fills in the values. */
23894
23895-VEXTERN(jiffies)
23896 VEXTERN(vgetcpu_mode)
23897 VEXTERN(vsyscall_gtod_data)
66a7e928
MT		 23898diff -urNp linux-2.6.39/arch/x86/vdso/vma.c linux-2.6.39/arch/x86/vdso/vma.c
23899--- linux-2.6.39/arch/x86/vdso/vma.c 2011-05-19 00:06:34.000000000 -0400
23900+++ linux-2.6.39/arch/x86/vdso/vma.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 23901@@ -58,7 +58,7 @@ static int __init init_vdso_vars(void)
58c5fc13
MT		 23902 if (!vbase)
23903 goto oom;
23904
23905- if (memcmp(vbase, "\177ELF", 4)) {
23906+ if (memcmp(vbase, ELFMAG, SELFMAG)) {
23907 printk("VDSO: I'm broken; not ELF\n");
23908 vdso_enabled = 0;
23909 }
6892158b 23910@@ -118,7 +118,7 @@ int arch_setup_additional_pages(struct l
58c5fc13
MT		 23911 goto up_fail;
23912 }
23913
23914- current->mm->context.vdso = (void *)addr;
23915+ current->mm->context.vdso = addr;
23916
23917 ret = install_special_mapping(mm, addr, vdso_size,
23918 VM_READ|VM_EXEC|
6892158b 23919@@ -126,7 +126,7 @@ int arch_setup_additional_pages(struct l
58c5fc13
MT		 23920 VM_ALWAYSDUMP,
23921 vdso_pages);
23922 if (ret) {
23923- current->mm->context.vdso = NULL;
23924+ current->mm->context.vdso = 0;
23925 goto up_fail;
23926 }
23927
6892158b 23928@@ -134,10 +134,3 @@ up_fail:
58c5fc13
MT		 23929 up_write(&mm->mmap_sem);
23930 return ret;
23931 }
23932-
23933-static __init int vdso_setup(char *s)
23934-{
23935- vdso_enabled = simple_strtoul(s, NULL, 0);
23936- return 0;
23937-}
23938-__setup("vdso=", vdso_setup);
66a7e928
MT		 23939diff -urNp linux-2.6.39/arch/x86/xen/enlighten.c linux-2.6.39/arch/x86/xen/enlighten.c
23940--- linux-2.6.39/arch/x86/xen/enlighten.c 2011-05-19 00:06:34.000000000 -0400
23941+++ linux-2.6.39/arch/x86/xen/enlighten.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 23942@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
58c5fc13
MT		 23943
23944 struct shared_info xen_dummy_shared_info;
23945
23946-void *xen_initial_gdt;
23947-
6892158b
MT		 23948 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
23949 __read_mostly int xen_have_vector_callback;
23950 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
66a7e928
MT		 23951@@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
23952 #endif
23953 };
23954
23955-static void xen_reboot(int reason)
23956+static __noreturn void xen_reboot(int reason)
23957 {
23958 struct sched_shutdown r = { .reason = reason };
23959
23960@@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
23961 BUG();
23962 }
23963
23964-static void xen_restart(char *msg)
23965+static __noreturn void xen_restart(char *msg)
23966 {
23967 xen_reboot(SHUTDOWN_reboot);
23968 }
23969
23970-static void xen_emergency_restart(void)
23971+static __noreturn void xen_emergency_restart(void)
23972 {
23973 xen_reboot(SHUTDOWN_reboot);
23974 }
23975
23976-static void xen_machine_halt(void)
23977+static __noreturn void xen_machine_halt(void)
23978 {
23979 xen_reboot(SHUTDOWN_poweroff);
23980 }
23981@@ -1127,7 +1125,17 @@ asmlinkage void __init xen_start_kernel(
df50ba0c
MT		 23982 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
23983
23984 /* Work out if we support NX */
23985- x86_configure_nx();
23986+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23987+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
57199397 23988+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
df50ba0c
MT		 23989+ unsigned l, h;
23990+
23991+ __supported_pte_mask |= _PAGE_NX;
23992+ rdmsr(MSR_EFER, l, h);
23993+ l |= EFER_NX;
23994+ wrmsr(MSR_EFER, l, h);
23995+ }
23996+#endif
23997
23998 xen_setup_features();
23999
66a7e928 24000@@ -1158,13 +1166,6 @@ asmlinkage void __init xen_start_kernel(
58c5fc13
MT		 24001
24002 machine_ops = xen_machine_ops;
24003
24004- /*
24005- * The only reliable way to retain the initial address of the
24006- * percpu gdt_page is to remember it here, so we can go and
24007- * mark it RW later, when the initial percpu area is freed.
24008- */
24009- xen_initial_gdt = &per_cpu(gdt_page, 0);
24010-
24011 xen_smp_init();
24012
16454cff 24013 #ifdef CONFIG_ACPI_NUMA
66a7e928
MT		 24014diff -urNp linux-2.6.39/arch/x86/xen/mmu.c linux-2.6.39/arch/x86/xen/mmu.c
24015--- linux-2.6.39/arch/x86/xen/mmu.c 2011-05-19 00:06:34.000000000 -0400
24016+++ linux-2.6.39/arch/x86/xen/mmu.c 2011-05-22 19:36:30.000000000 -0400
24017@@ -1791,6 +1791,8 @@ __init pgd_t *xen_setup_kernel_pagetable
58c5fc13
MT		 24018 convert_pfn_mfn(init_level4_pgt);
24019 convert_pfn_mfn(level3_ident_pgt);
24020 convert_pfn_mfn(level3_kernel_pgt);
24021+ convert_pfn_mfn(level3_vmalloc_pgt);
24022+ convert_pfn_mfn(level3_vmemmap_pgt);
24023
24024 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24025 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
66a7e928 24026@@ -1809,7 +1811,10 @@ __init pgd_t *xen_setup_kernel_pagetable
58c5fc13
MT		 24027 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24028 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24029 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24030+ set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
24031+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24032 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24033+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24034 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24035 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24036
66a7e928
MT		 24037diff -urNp linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c
24038--- linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c 2011-05-19 00:06:34.000000000 -0400
24039+++ linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 24040@@ -10,7 +10,7 @@
6892158b
MT		 24041
24042 int xen_swiotlb __read_mostly;
24043
24044-static struct dma_map_ops xen_swiotlb_dma_ops = {
24045+static const struct dma_map_ops xen_swiotlb_dma_ops = {
24046 .mapping_error = xen_swiotlb_dma_mapping_error,
24047 .alloc_coherent = xen_swiotlb_alloc_coherent,
24048 .free_coherent = xen_swiotlb_free_coherent,
66a7e928
MT		 24049diff -urNp linux-2.6.39/arch/x86/xen/smp.c linux-2.6.39/arch/x86/xen/smp.c
24050--- linux-2.6.39/arch/x86/xen/smp.c 2011-05-19 00:06:34.000000000 -0400
24051+++ linux-2.6.39/arch/x86/xen/smp.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 24052@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
58c5fc13
MT		 24053 {
24054 BUG_ON(smp_processor_id() != 0);
24055 native_smp_prepare_boot_cpu();
24056-
24057- /* We've switched to the "real" per-cpu gdt, so make sure the
24058- old memory can be recycled */
24059- make_lowmem_page_readwrite(xen_initial_gdt);
24060-
bc901d79 24061 xen_filter_cpu_maps();
58c5fc13
MT		 24062 xen_setup_vcpu_info_placement();
24063 }
bc901d79 24064@@ -259,12 +254,12 @@ cpu_initialize_context(unsigned int cpu,
58c5fc13
MT		 24065 gdt = get_cpu_gdt_table(cpu);
24066
24067 ctxt->flags = VGCF_IN_KERNEL;
24068- ctxt->user_regs.ds = __USER_DS;
24069- ctxt->user_regs.es = __USER_DS;
24070+ ctxt->user_regs.ds = __KERNEL_DS;
24071+ ctxt->user_regs.es = __KERNEL_DS;
24072 ctxt->user_regs.ss = __KERNEL_DS;
24073 #ifdef CONFIG_X86_32
24074 ctxt->user_regs.fs = __KERNEL_PERCPU;
bc901d79
MT		 24075- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24076+ savesegment(gs, ctxt->user_regs.gs);
24077 #else
24078 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24079 #endif
71d190be
MT		 24080@@ -315,13 +310,12 @@ static int __cpuinit xen_cpu_up(unsigned
24081 int rc;
24082
24083 per_cpu(current_task, cpu) = idle;
24084+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24085 #ifdef CONFIG_X86_32
24086 irq_ctx_init(cpu);
24087 #else
24088 clear_tsk_thread_flag(idle, TIF_FORK);
24089- per_cpu(kernel_stack, cpu) =
24090- (unsigned long)task_stack_page(idle) -
24091- KERNEL_STACK_OFFSET + THREAD_SIZE;
66a7e928 24092+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
71d190be
MT		 24093 #endif
24094 xen_setup_runstate_info(cpu);
24095 xen_setup_timer(cpu);
66a7e928
MT		 24096diff -urNp linux-2.6.39/arch/x86/xen/xen-asm_32.S linux-2.6.39/arch/x86/xen/xen-asm_32.S
24097--- linux-2.6.39/arch/x86/xen/xen-asm_32.S 2011-05-19 00:06:34.000000000 -0400
24098+++ linux-2.6.39/arch/x86/xen/xen-asm_32.S 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 24099@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24100 ESP_OFFSET=4 # bytes pushed onto stack
24101
24102 /*
24103- * Store vcpu_info pointer for easy access. Do it this way to
24104- * avoid having to reload %fs
24105+ * Store vcpu_info pointer for easy access.
24106 */
24107 #ifdef CONFIG_SMP
24108- GET_THREAD_INFO(%eax)
24109- movl TI_cpu(%eax), %eax
24110- movl __per_cpu_offset(,%eax,4), %eax
24111- mov xen_vcpu(%eax), %eax
24112+ push %fs
24113+ mov $(__KERNEL_PERCPU), %eax
24114+ mov %eax, %fs
24115+ mov PER_CPU_VAR(xen_vcpu), %eax
24116+ pop %fs
24117 #else
24118 movl xen_vcpu, %eax
24119 #endif
66a7e928
MT		 24120diff -urNp linux-2.6.39/arch/x86/xen/xen-head.S linux-2.6.39/arch/x86/xen/xen-head.S
24121--- linux-2.6.39/arch/x86/xen/xen-head.S 2011-05-19 00:06:34.000000000 -0400
24122+++ linux-2.6.39/arch/x86/xen/xen-head.S 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 24123@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24124 #ifdef CONFIG_X86_32
24125 mov %esi,xen_start_info
24126 mov $init_thread_union+THREAD_SIZE,%esp
24127+#ifdef CONFIG_SMP
24128+ movl $cpu_gdt_table,%edi
24129+ movl $__per_cpu_load,%eax
24130+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24131+ rorl $16,%eax
24132+ movb %al,__KERNEL_PERCPU + 4(%edi)
24133+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24134+ movl $__per_cpu_end - 1,%eax
24135+ subl $__per_cpu_start,%eax
24136+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24137+#endif
24138 #else
24139 mov %rsi,xen_start_info
24140 mov $init_thread_union+THREAD_SIZE,%rsp
66a7e928
MT		 24141diff -urNp linux-2.6.39/arch/x86/xen/xen-ops.h linux-2.6.39/arch/x86/xen/xen-ops.h
24142--- linux-2.6.39/arch/x86/xen/xen-ops.h 2011-05-19 00:06:34.000000000 -0400
24143+++ linux-2.6.39/arch/x86/xen/xen-ops.h 2011-05-22 19:36:30.000000000 -0400
58c5fc13
MT		 24144@@ -10,8 +10,6 @@
24145 extern const char xen_hypervisor_callback[];
24146 extern const char xen_failsafe_callback[];
24147
24148-extern void *xen_initial_gdt;
24149-
24150 struct trap_info;
24151 void xen_copy_trap_info(struct trap_info *traps);
24152
66a7e928
MT		 24153diff -urNp linux-2.6.39/block/blk-iopoll.c linux-2.6.39/block/blk-iopoll.c
24154--- linux-2.6.39/block/blk-iopoll.c 2011-05-19 00:06:34.000000000 -0400
24155+++ linux-2.6.39/block/blk-iopoll.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 24156@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24157 }
24158 EXPORT_SYMBOL(blk_iopoll_complete);
24159
24160-static void blk_iopoll_softirq(struct softirq_action *h)
24161+static void blk_iopoll_softirq(void)
24162 {
24163 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24164 int rearm = 0, budget = blk_iopoll_budget;
66a7e928
MT		 24165diff -urNp linux-2.6.39/block/blk-map.c linux-2.6.39/block/blk-map.c
24166--- linux-2.6.39/block/blk-map.c 2011-05-19 00:06:34.000000000 -0400
24167+++ linux-2.6.39/block/blk-map.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 24168@@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
ae4e228f
MT		 24169 if (!len || !kbuf)
24170 return -EINVAL;
58c5fc13 24171
bc901d79
MT		 24172- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24173+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
ae4e228f
MT		 24174 if (do_copy)
24175 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24176 else
66a7e928
MT		 24177diff -urNp linux-2.6.39/block/blk-softirq.c linux-2.6.39/block/blk-softirq.c
24178--- linux-2.6.39/block/blk-softirq.c 2011-05-19 00:06:34.000000000 -0400
24179+++ linux-2.6.39/block/blk-softirq.c 2011-05-22 19:36:30.000000000 -0400
ae4e228f
MT		 24180@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24181 * Softirq action handler - move entries to local list and loop over them
24182 * while passing them to the queue registered handler.
24183 */
24184-static void blk_done_softirq(struct softirq_action *h)
24185+static void blk_done_softirq(void)
24186 {
24187 struct list_head *cpu_list, local_list;
58c5fc13 24188
66a7e928
MT		 24189diff -urNp linux-2.6.39/block/bsg.c linux-2.6.39/block/bsg.c
24190--- linux-2.6.39/block/bsg.c 2011-05-19 00:06:34.000000000 -0400
24191+++ linux-2.6.39/block/bsg.c 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 24192@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24193 struct sg_io_v4 *hdr, struct bsg_device *bd,
24194 fmode_t has_write_perm)
24195 {
24196+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24197+ unsigned char *cmdptr;
24198+
24199 if (hdr->request_len > BLK_MAX_CDB) {
24200 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24201 if (!rq->cmd)
24202 return -ENOMEM;
24203- }
24204+ cmdptr = rq->cmd;
24205+ } else
24206+ cmdptr = tmpcmd;
24207
24208- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24209+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
24210 hdr->request_len))
24211 return -EFAULT;
24212
24213+ if (cmdptr != rq->cmd)
24214+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24215+
24216 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24217 if (blk_verify_command(rq->cmd, has_write_perm))
24218 return -EPERM;
66a7e928
MT		 24219diff -urNp linux-2.6.39/block/scsi_ioctl.c linux-2.6.39/block/scsi_ioctl.c
24220--- linux-2.6.39/block/scsi_ioctl.c 2011-05-19 00:06:34.000000000 -0400
24221+++ linux-2.6.39/block/scsi_ioctl.c 2011-05-22 19:36:30.000000000 -0400
71d190be
MT		 24222@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24223 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24224 struct sg_io_hdr *hdr, fmode_t mode)
24225 {
24226- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24227+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24228+ unsigned char *cmdptr;
24229+
24230+ if (rq->cmd != rq->__cmd)
24231+ cmdptr = rq->cmd;
24232+ else
24233+ cmdptr = tmpcmd;
24234+
24235+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24236 return -EFAULT;
24237+
24238+ if (cmdptr != rq->cmd)
24239+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24240+
24241 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24242 return -EPERM;
24243
24244@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
24245 int err;
24246 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24247 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24248+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24249+ unsigned char *cmdptr;
24250
24251 if (!sic)
24252 return -EINVAL;
24253@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
24254 */
24255 err = -EFAULT;
24256 rq->cmd_len = cmdlen;
24257- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24258+
24259+ if (rq->cmd != rq->__cmd)
24260+ cmdptr = rq->cmd;
24261+ else
24262+ cmdptr = tmpcmd;
24263+
24264+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24265 goto error;
24266
24267+ if (rq->cmd != cmdptr)
24268+ memcpy(rq->cmd, cmdptr, cmdlen);
24269+
24270 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24271 goto error;
24272
66a7e928
MT		 24273diff -urNp linux-2.6.39/crypto/serpent.c linux-2.6.39/crypto/serpent.c
24274--- linux-2.6.39/crypto/serpent.c 2011-05-19 00:06:34.000000000 -0400
24275+++ linux-2.6.39/crypto/serpent.c 2011-05-22 19:36:30.000000000 -0400
24276@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
24277 u32 r0,r1,r2,r3,r4;
24278 int i;
24279
24280+ pax_track_stack();
24281+
24282 /* Copy key, add padding */
24283
24284 for (i = 0; i < keylen; ++i)
24285diff -urNp linux-2.6.39/Documentation/dontdiff linux-2.6.39/Documentation/dontdiff
24286--- linux-2.6.39/Documentation/dontdiff 2011-05-19 00:06:34.000000000 -0400
24287+++ linux-2.6.39/Documentation/dontdiff 2011-05-22 19:36:30.000000000 -0400
24288@@ -1,13 +1,16 @@
24289 *.a
24290 *.aux
57199397 24291 *.bin
66a7e928 24292+*.cis
57199397
MT		 24293 *.cpio
24294 *.csp
24295+*.dbg
24296 *.dsp
24297 *.dvi
24298 *.elf
66a7e928
MT		 24299 *.eps
24300 *.fw
24301+*.gcno
24302 *.gen.S
24303 *.gif
24304 *.grep
24305@@ -38,8 +41,10 @@
57199397
MT		 24306 *.tab.h
24307 *.tex
24308 *.ver
24309+*.vim
24310 *.xml
24311 *_MODULES
24312+*_reg_safe.h
24313 *_vga16.c
24314 *~
24315 *.9
66a7e928 24316@@ -49,11 +54,16 @@
57199397
MT		 24317 53c700_d.h
24318 CVS
24319 ChangeSet
24320+GPATH
24321+GRTAGS
24322+GSYMS
24323+GTAGS
24324 Image
24325 Kerntypes
24326 Module.markers
24327 Module.symvers
24328 PENDING
24329+PERF*
24330 SCCS
24331 System.map*
24332 TAGS
66a7e928
MT		 24333@@ -80,8 +90,11 @@ btfixupprep
24334 build
24335 bvmlinux
57199397 24336 bzImage*
66a7e928 24337+capability_names.h
16454cff 24338 capflags.c
57199397
MT		 24339 classlist.h*
24340+clut_vga16.c
24341+common-cmds.h
24342 comp*.log
24343 compile.h*
24344 conf
66a7e928 24345@@ -106,16 +119,19 @@ fore200e_mkfirm
57199397
MT		 24346 fore200e_pca_fw.c*
24347 gconf
24348 gen-devlist
24349+gen-kdb_cmds.c
24350 gen_crc32table
24351 gen_init_cpio
24352 generated
24353 genheaders
24354 genksyms
24355 *_gray256.c
24356+hash
24357 ihex2fw
24358 ikconfig.h*
16454cff 24359 inat-tables.c
57199397
MT		 24360 initramfs_data.cpio
24361+initramfs_data.cpio.bz2
24362 initramfs_data.cpio.gz
24363 initramfs_list
16454cff 24364 int16.c
66a7e928 24365@@ -125,7 +141,6 @@ int32.c
16454cff
MT		 24366 int4.c
24367 int8.c
57199397
MT		 24368 kallsyms
24369-kconfig
24370 keywords.c
24371 ksym.c*
24372 ksym.h*
66a7e928 24373@@ -149,7 +164,9 @@ mkboot
57199397
MT		 24374 mkbugboot
24375 mkcpustr
24376 mkdep
24377+mkpiggy
24378 mkprep
24379+mkregtable
24380 mktables
24381 mktree
24382 modpost
66a7e928 24383@@ -165,6 +182,7 @@ parse.h
57199397
MT		 24384 patches*
24385 pca200e.bin
24386 pca200e_ecd.bin2
24387+perf-archive
24388 piggy.gz
57199397 24389 piggyback
16454cff 24390 piggy.S
66a7e928 24391@@ -180,7 +198,9 @@ r600_reg_safe.h
57199397
MT		 24392 raid6altivec*.c
24393 raid6int*.c
24394 raid6tables.c
24395+regdb.c
24396 relocs
66a7e928 24397+rlim_names.h
16454cff
MT		 24398 rn50_reg_safe.h
24399 rs600_reg_safe.h
66a7e928
MT		 24400 rv515_reg_safe.h
24401@@ -189,6 +209,7 @@ setup
57199397
MT		 24402 setup.bin
24403 setup.elf
24404 sImage
24405+slabinfo
24406 sm_tbl*
24407 split-include
24408 syscalltab.h
66a7e928 24409@@ -213,13 +234,17 @@ version.h*
57199397
MT		 24410 vmlinux
24411 vmlinux-*
24412 vmlinux.aout
24413+vmlinux.bin.all
24414+vmlinux.bin.bz2
24415 vmlinux.lds
24416+vmlinux.relocs
16454cff 24417 voffset.h
57199397
MT		 24418 vsyscall.lds
24419 vsyscall_32.lds
24420 wanxlfw.inc
24421 uImage
24422 unifdef
24423+utsrelease.h
24424 wakeup.bin
24425 wakeup.elf
24426 wakeup.lds
66a7e928
MT		 24427diff -urNp linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c
24428--- linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-19 00:06:34.000000000 -0400
24429+++ linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-22 19:36:30.000000000 -0400
24430@@ -368,7 +368,7 @@ static struct configfs_item_operations g
24431 * Note that, since no extra work is required on ->drop_item(),
24432 * no ->drop_item() is provided.
24433 */
24434-static struct configfs_group_operations group_children_group_ops = {
24435+static const struct configfs_group_operations group_children_group_ops = {
24436 .make_group = group_children_make_group,
24437 };
24438
24439diff -urNp linux-2.6.39/Documentation/filesystems/sysfs.txt linux-2.6.39/Documentation/filesystems/sysfs.txt
24440--- linux-2.6.39/Documentation/filesystems/sysfs.txt 2011-05-19 00:06:34.000000000 -0400
24441+++ linux-2.6.39/Documentation/filesystems/sysfs.txt 2011-05-22 19:36:30.000000000 -0400
24442@@ -125,8 +125,8 @@ set of sysfs operations for forwarding r
57199397
MT		 24443 show and store methods of the attribute owners.
24444
24445 struct sysfs_ops {
24446- ssize_t (*show)(struct kobject *, struct attribute *, char *);
6892158b 24447- ssize_t (*store)(struct kobject *, struct attribute *, const char *, size_t);
57199397 24448+ ssize_t (* const show)(struct kobject *, struct attribute *, char *);
6892158b 24449+ ssize_t (* const store)(struct kobject *, struct attribute *, const char *, size_t);
57199397
MT		 24450 };
24451
24452 [ Subsystems should have already defined a struct kobj_type as a
66a7e928
MT		 24453diff -urNp linux-2.6.39/Documentation/kernel-parameters.txt linux-2.6.39/Documentation/kernel-parameters.txt
24454--- linux-2.6.39/Documentation/kernel-parameters.txt 2011-05-19 00:06:34.000000000 -0400
24455+++ linux-2.6.39/Documentation/kernel-parameters.txt 2011-05-22 19:36:30.000000000 -0400
24456@@ -1879,6 +1879,13 @@ bytes respectively. Such letter suffixes
57199397
MT		 24457 the specified number of seconds. This is to be used if
24458 your oopses keep scrolling off the screen.
24459
bc901d79 24460+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
57199397 24461+ virtualization environments that don't cope well with the
bc901d79
MT		 24462+ expand down segment used by UDEREF on X86-32 or the frequent
24463+ page table updates on X86-64.
57199397 24464+
16454cff 24465+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
57199397
MT		 24466+
24467 pcbit= [HW,ISDN]
24468
24469 pcd. [PARIDE]
66a7e928
MT		 24470diff -urNp linux-2.6.39/drivers/acpi/acpi_ipmi.c linux-2.6.39/drivers/acpi/acpi_ipmi.c
24471--- linux-2.6.39/drivers/acpi/acpi_ipmi.c 2011-05-19 00:06:34.000000000 -0400
24472+++ linux-2.6.39/drivers/acpi/acpi_ipmi.c 2011-05-22 19:36:30.000000000 -0400
24473@@ -70,7 +70,7 @@ struct acpi_ipmi_device {
24474 struct ipmi_driver_data {
24475 struct list_head ipmi_devices;
24476 struct ipmi_smi_watcher bmc_events;
24477- struct ipmi_user_hndl ipmi_hndlrs;
24478+ const struct ipmi_user_hndl ipmi_hndlrs;
24479 struct mutex ipmi_lock;
24480 };
24481
24482diff -urNp linux-2.6.39/drivers/acpi/apei/cper.c linux-2.6.39/drivers/acpi/apei/cper.c
24483--- linux-2.6.39/drivers/acpi/apei/cper.c 2011-05-19 00:06:34.000000000 -0400
24484+++ linux-2.6.39/drivers/acpi/apei/cper.c 2011-05-22 19:36:30.000000000 -0400
24485@@ -38,12 +38,12 @@
8308f9c9
MT		 24486 */
24487 u64 cper_next_record_id(void)
24488 {
24489- static atomic64_t seq;
24490+ static atomic64_unchecked_t seq;
24491
24492- if (!atomic64_read(&seq))
24493- atomic64_set(&seq, ((u64)get_seconds()) << 32);
24494+ if (!atomic64_read_unchecked(&seq))
24495+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24496
24497- return atomic64_inc_return(&seq);
24498+ return atomic64_inc_return_unchecked(&seq);
24499 }
24500 EXPORT_SYMBOL_GPL(cper_next_record_id);
24501
66a7e928
MT		 24502diff -urNp linux-2.6.39/drivers/acpi/battery.c linux-2.6.39/drivers/acpi/battery.c
24503--- linux-2.6.39/drivers/acpi/battery.c 2011-05-19 00:06:34.000000000 -0400
24504+++ linux-2.6.39/drivers/acpi/battery.c 2011-05-22 19:36:30.000000000 -0400
24505@@ -864,7 +864,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
ae4e228f
MT		 24506 }
24507
24508 static struct battery_file {
24509- struct file_operations ops;
24510+ const struct file_operations ops;
24511 mode_t mode;
24512 const char *name;
24513 } acpi_battery_file[] = {
66a7e928
MT		 24514diff -urNp linux-2.6.39/drivers/acpi/dock.c linux-2.6.39/drivers/acpi/dock.c
24515--- linux-2.6.39/drivers/acpi/dock.c 2011-05-19 00:06:34.000000000 -0400
24516+++ linux-2.6.39/drivers/acpi/dock.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 24517@@ -77,7 +77,7 @@ struct dock_dependent_device {
ae4e228f
MT		 24518 struct list_head list;
24519 struct list_head hotplug_list;
24520 acpi_handle handle;
24521- struct acpi_dock_ops *ops;
24522+ const struct acpi_dock_ops *ops;
24523 void *context;
24524 };
24525
df50ba0c 24526@@ -589,7 +589,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
ae4e228f
MT		 24527 * the dock driver after _DCK is executed.
24528 */
24529 int
24530-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
24531+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
24532 void *context)
24533 {
24534 struct dock_dependent_device *dd;
66a7e928
MT		 24535diff -urNp linux-2.6.39/drivers/acpi/ec_sys.c linux-2.6.39/drivers/acpi/ec_sys.c
24536--- linux-2.6.39/drivers/acpi/ec_sys.c 2011-05-19 00:06:34.000000000 -0400
24537+++ linux-2.6.39/drivers/acpi/ec_sys.c 2011-05-22 19:36:30.000000000 -0400
24538@@ -92,7 +92,7 @@ static ssize_t acpi_ec_write_io(struct f
bc901d79
MT		 24539 return count;
24540 }
58c5fc13 24541
bc901d79
MT		 24542-static struct file_operations acpi_ec_io_ops = {
24543+static const struct file_operations acpi_ec_io_ops = {
24544 .owner = THIS_MODULE,
24545 .open = acpi_ec_open_io,
24546 .read = acpi_ec_read_io,
66a7e928
MT		 24547diff -urNp linux-2.6.39/drivers/acpi/fan.c linux-2.6.39/drivers/acpi/fan.c
24548--- linux-2.6.39/drivers/acpi/fan.c 2011-05-19 00:06:34.000000000 -0400
24549+++ linux-2.6.39/drivers/acpi/fan.c 2011-05-22 19:36:30.000000000 -0400
24550@@ -110,7 +110,7 @@ fan_set_cur_state(struct thermal_cooling
24551 return result;
24552 }
24553
24554-static struct thermal_cooling_device_ops fan_cooling_ops = {
24555+static const struct thermal_cooling_device_ops fan_cooling_ops = {
24556 .get_max_state = fan_get_max_state,
24557 .get_cur_state = fan_get_cur_state,
24558 .set_cur_state = fan_set_cur_state,
24559diff -urNp linux-2.6.39/drivers/acpi/power_meter.c linux-2.6.39/drivers/acpi/power_meter.c
24560--- linux-2.6.39/drivers/acpi/power_meter.c 2011-05-19 00:06:34.000000000 -0400
24561+++ linux-2.6.39/drivers/acpi/power_meter.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c
MT		 24562@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
24563 return res;
24564
24565 temp /= 1000;
24566- if (temp < 0)
24567- return -EINVAL;
24568
24569 mutex_lock(&resource->lock);
24570 resource->trip[attr->index - 7] = temp;
66a7e928
MT		 24571diff -urNp linux-2.6.39/drivers/acpi/proc.c linux-2.6.39/drivers/acpi/proc.c
24572--- linux-2.6.39/drivers/acpi/proc.c 2011-05-19 00:06:34.000000000 -0400
24573+++ linux-2.6.39/drivers/acpi/proc.c 2011-05-22 19:36:30.000000000 -0400
16454cff 24574@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
df50ba0c
MT		 24575 size_t count, loff_t * ppos)
24576 {
24577 struct list_head *node, *next;
24578- char strbuf[5];
24579- char str[5] = "";
24580- unsigned int len = count;
16454cff 24581-
df50ba0c
MT		 24582- if (len > 4)
24583- len = 4;
24584- if (len < 0)
24585- return -EFAULT;
16454cff 24586+ char strbuf[5] = {0};
df50ba0c
MT		 24587
24588- if (copy_from_user(strbuf, buffer, len))
16454cff
MT		 24589+ if (count > 4)
24590+ count = 4;
df50ba0c
MT		 24591+ if (copy_from_user(strbuf, buffer, count))
24592 return -EFAULT;
24593- strbuf[len] = '\0';
24594- sscanf(strbuf, "%s", str);
24595+ strbuf[count] = '\0';
24596
24597 mutex_lock(&acpi_device_lock);
24598 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
16454cff 24599@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
df50ba0c
MT		 24600 if (!dev->wakeup.flags.valid)
24601 continue;
24602
24603- if (!strncmp(dev->pnp.bus_id, str, 4)) {
24604+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
16454cff
MT		 24605 if (device_can_wakeup(&dev->dev)) {
24606 bool enable = !device_may_wakeup(&dev->dev);
24607 device_set_wakeup_enable(&dev->dev, enable);
66a7e928
MT		 24608diff -urNp linux-2.6.39/drivers/acpi/processor_driver.c linux-2.6.39/drivers/acpi/processor_driver.c
24609--- linux-2.6.39/drivers/acpi/processor_driver.c 2011-05-19 00:06:34.000000000 -0400
24610+++ linux-2.6.39/drivers/acpi/processor_driver.c 2011-05-22 19:36:30.000000000 -0400
16454cff 24611@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
58c5fc13 24612 return 0;
57199397 24613 #endif
58c5fc13
MT		 24614
24615- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
24616+ BUG_ON(pr->id >= nr_cpu_ids);
24617
24618 /*
24619 * Buggy BIOS check
66a7e928
MT		 24620diff -urNp linux-2.6.39/drivers/acpi/processor_idle.c linux-2.6.39/drivers/acpi/processor_idle.c
24621--- linux-2.6.39/drivers/acpi/processor_idle.c 2011-05-19 00:06:34.000000000 -0400
24622+++ linux-2.6.39/drivers/acpi/processor_idle.c 2011-05-22 19:36:30.000000000 -0400
16454cff 24623@@ -121,7 +121,7 @@ static struct dmi_system_id __cpuinitdat
ae4e228f
MT		 24624 DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
24625 DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
24626 (void *)1},
58c5fc13 24627- {},
71d190be 24628+ {}
58c5fc13
MT		 24629 };
24630
24631
66a7e928
MT		 24632diff -urNp linux-2.6.39/drivers/acpi/processor_thermal.c linux-2.6.39/drivers/acpi/processor_thermal.c
24633--- linux-2.6.39/drivers/acpi/processor_thermal.c 2011-05-19 00:06:34.000000000 -0400
24634+++ linux-2.6.39/drivers/acpi/processor_thermal.c 2011-05-22 19:36:30.000000000 -0400
24635@@ -244,7 +244,7 @@ processor_set_cur_state(struct thermal_c
24636 return result;
24637 }
24638
24639-struct thermal_cooling_device_ops processor_cooling_ops = {
24640+const struct thermal_cooling_device_ops processor_cooling_ops = {
24641 .get_max_state = processor_get_max_state,
24642 .get_cur_state = processor_get_cur_state,
24643 .set_cur_state = processor_set_cur_state,
24644diff -urNp linux-2.6.39/drivers/acpi/sysfs.c linux-2.6.39/drivers/acpi/sysfs.c
24645--- linux-2.6.39/drivers/acpi/sysfs.c 2011-05-19 00:06:34.000000000 -0400
24646+++ linux-2.6.39/drivers/acpi/sysfs.c 2011-05-22 19:36:30.000000000 -0400
24647@@ -149,12 +149,12 @@ static int param_get_debug_level(char *b
24648 return result;
24649 }
24650
24651-static struct kernel_param_ops param_ops_debug_layer = {
24652+static const struct kernel_param_ops param_ops_debug_layer = {
24653 .set = param_set_uint,
24654 .get = param_get_debug_layer,
24655 };
24656
24657-static struct kernel_param_ops param_ops_debug_level = {
24658+static const struct kernel_param_ops param_ops_debug_level = {
24659 .set = param_set_uint,
24660 .get = param_get_debug_level,
24661 };
24662diff -urNp linux-2.6.39/drivers/acpi/thermal.c linux-2.6.39/drivers/acpi/thermal.c
24663--- linux-2.6.39/drivers/acpi/thermal.c 2011-05-19 00:06:34.000000000 -0400
24664+++ linux-2.6.39/drivers/acpi/thermal.c 2011-05-22 19:36:30.000000000 -0400
24665@@ -812,7 +812,7 @@ acpi_thermal_unbind_cooling_device(struc
24666 thermal_zone_unbind_cooling_device);
24667 }
24668
24669-static struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24670+static const struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24671 .bind = acpi_thermal_bind_cooling_device,
24672 .unbind = acpi_thermal_unbind_cooling_device,
24673 .get_temp = thermal_get_temp,
24674diff -urNp linux-2.6.39/drivers/acpi/video.c linux-2.6.39/drivers/acpi/video.c
24675--- linux-2.6.39/drivers/acpi/video.c 2011-05-19 00:06:34.000000000 -0400
24676+++ linux-2.6.39/drivers/acpi/video.c 2011-05-22 19:36:30.000000000 -0400
24677@@ -308,7 +308,7 @@ video_set_cur_state(struct thermal_cooli
24678 return acpi_video_device_lcd_set_level(video, level);
24679 }
24680
24681-static struct thermal_cooling_device_ops video_cooling_ops = {
24682+static const struct thermal_cooling_device_ops video_cooling_ops = {
24683 .get_max_state = video_get_max_state,
24684 .get_cur_state = video_get_cur_state,
24685 .set_cur_state = video_set_cur_state,
24686diff -urNp linux-2.6.39/drivers/ata/acard-ahci.c linux-2.6.39/drivers/ata/acard-ahci.c
24687--- linux-2.6.39/drivers/ata/acard-ahci.c 2011-05-19 00:06:34.000000000 -0400
24688+++ linux-2.6.39/drivers/ata/acard-ahci.c 2011-05-22 19:36:30.000000000 -0400
16454cff
MT		 24689@@ -87,7 +87,7 @@ static struct scsi_host_template acard_a
24690 AHCI_SHT("acard-ahci"),
24691 };
ae4e228f 24692
16454cff
MT		 24693-static struct ata_port_operations acard_ops = {
24694+static const struct ata_port_operations acard_ops = {
24695 .inherits = &ahci_ops,
24696 .qc_prep = acard_ahci_qc_prep,
24697 .qc_fill_rtf = acard_ahci_qc_fill_rtf,
66a7e928
MT		 24698diff -urNp linux-2.6.39/drivers/ata/ahci.c linux-2.6.39/drivers/ata/ahci.c
24699--- linux-2.6.39/drivers/ata/ahci.c 2011-05-19 00:06:34.000000000 -0400
24700+++ linux-2.6.39/drivers/ata/ahci.c 2011-05-22 19:36:30.000000000 -0400
6892158b
MT		 24701@@ -94,17 +94,17 @@ static struct scsi_host_template ahci_sh
24702 AHCI_SHT("ahci"),
24703 };
ae4e228f
MT		 24704
24705-static struct ata_port_operations ahci_vt8251_ops = {
24706+static const struct ata_port_operations ahci_vt8251_ops = {
24707 .inherits = &ahci_ops,
24708 .hardreset = ahci_vt8251_hardreset,
24709 };
24710
24711-static struct ata_port_operations ahci_p5wdh_ops = {
24712+static const struct ata_port_operations ahci_p5wdh_ops = {
24713 .inherits = &ahci_ops,
24714 .hardreset = ahci_p5wdh_hardreset,
24715 };
24716
24717-static struct ata_port_operations ahci_sb600_ops = {
24718+static const struct ata_port_operations ahci_sb600_ops = {
24719 .inherits = &ahci_ops,
24720 .softreset = ahci_sb600_softreset,
24721 .pmp_softreset = ahci_sb600_softreset,
66a7e928
MT		 24722diff -urNp linux-2.6.39/drivers/ata/ahci.h linux-2.6.39/drivers/ata/ahci.h
24723--- linux-2.6.39/drivers/ata/ahci.h 2011-05-19 00:06:34.000000000 -0400
24724+++ linux-2.6.39/drivers/ata/ahci.h 2011-05-22 19:36:30.000000000 -0400
24725@@ -311,7 +311,7 @@ extern struct device_attribute *ahci_sde
6892158b
MT		 24726 .shost_attrs = ahci_shost_attrs, \
24727 .sdev_attrs = ahci_sdev_attrs
57199397 24728
57199397
MT		 24729-extern struct ata_port_operations ahci_ops;
24730+extern const struct ata_port_operations ahci_ops;
24731
16454cff
MT		 24732 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
24733 u32 opts);
66a7e928
MT		 24734diff -urNp linux-2.6.39/drivers/ata/ata_generic.c linux-2.6.39/drivers/ata/ata_generic.c
24735--- linux-2.6.39/drivers/ata/ata_generic.c 2011-05-19 00:06:34.000000000 -0400
24736+++ linux-2.6.39/drivers/ata/ata_generic.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 24737@@ -101,7 +101,7 @@ static struct scsi_host_template generic
ae4e228f
MT		 24738 ATA_BMDMA_SHT(DRV_NAME),
24739 };
24740
24741-static struct ata_port_operations generic_port_ops = {
24742+static const struct ata_port_operations generic_port_ops = {
24743 .inherits = &ata_bmdma_port_ops,
24744 .cable_detect = ata_cable_unknown,
24745 .set_mode = generic_set_mode,
66a7e928
MT		 24746diff -urNp linux-2.6.39/drivers/ata/ata_piix.c linux-2.6.39/drivers/ata/ata_piix.c
24747--- linux-2.6.39/drivers/ata/ata_piix.c 2011-05-19 00:06:34.000000000 -0400
24748+++ linux-2.6.39/drivers/ata/ata_piix.c 2011-05-22 19:36:30.000000000 -0400
24749@@ -335,12 +335,12 @@ static struct scsi_host_template piix_sh
ae4e228f
MT		 24750 ATA_BMDMA_SHT(DRV_NAME),
24751 };
24752
df50ba0c
MT		 24753-static struct ata_port_operations piix_sata_ops = {
24754+static const struct ata_port_operations piix_sata_ops = {
24755 .inherits = &ata_bmdma32_port_ops,
24756 .sff_irq_check = piix_irq_check,
24757 };
24758
ae4e228f
MT		 24759-static struct ata_port_operations piix_pata_ops = {
24760+static const struct ata_port_operations piix_pata_ops = {
df50ba0c 24761 .inherits = &piix_sata_ops,
ae4e228f
MT		 24762 .cable_detect = ata_cable_40wire,
24763 .set_piomode = piix_set_piomode,
66a7e928 24764@@ -348,12 +348,12 @@ static struct ata_port_operations piix_p
ae4e228f
MT		 24765 .prereset = piix_pata_prereset,
24766 };
24767
24768-static struct ata_port_operations piix_vmw_ops = {
24769+static const struct ata_port_operations piix_vmw_ops = {
24770 .inherits = &piix_pata_ops,
24771 .bmdma_status = piix_vmw_bmdma_status,
24772 };
24773
24774-static struct ata_port_operations ich_pata_ops = {
24775+static const struct ata_port_operations ich_pata_ops = {
24776 .inherits = &piix_pata_ops,
24777 .cable_detect = ich_pata_cable_detect,
24778 .set_dmamode = ich_set_dmamode,
66a7e928 24779@@ -369,7 +369,7 @@ static struct scsi_host_template piix_si
bc901d79 24780 .shost_attrs = piix_sidpr_shost_attrs,
ae4e228f
MT		 24781 };
24782
ae4e228f
MT		 24783-static struct ata_port_operations piix_sidpr_sata_ops = {
24784+static const struct ata_port_operations piix_sidpr_sata_ops = {
24785 .inherits = &piix_sata_ops,
24786 .hardreset = sata_std_hardreset,
24787 .scr_read = piix_sidpr_scr_read,
66a7e928
MT		 24788diff -urNp linux-2.6.39/drivers/ata/libahci.c linux-2.6.39/drivers/ata/libahci.c
24789--- linux-2.6.39/drivers/ata/libahci.c 2011-05-19 00:06:34.000000000 -0400
24790+++ linux-2.6.39/drivers/ata/libahci.c 2011-05-22 19:36:30.000000000 -0400
24791@@ -141,7 +141,7 @@ struct device_attribute *ahci_sdev_attrs
57199397 24792 };
6892158b 24793 EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
57199397
MT		 24794
24795-struct ata_port_operations ahci_ops = {
24796+const struct ata_port_operations ahci_ops = {
24797 .inherits = &sata_pmp_port_ops,
24798
24799 .qc_defer = ahci_pmp_qc_defer,
66a7e928
MT		 24800diff -urNp linux-2.6.39/drivers/ata/libata-acpi.c linux-2.6.39/drivers/ata/libata-acpi.c
24801--- linux-2.6.39/drivers/ata/libata-acpi.c 2011-05-19 00:06:34.000000000 -0400
24802+++ linux-2.6.39/drivers/ata/libata-acpi.c 2011-05-22 19:36:30.000000000 -0400
6892158b 24803@@ -218,12 +218,12 @@ static void ata_acpi_dev_uevent(acpi_han
ae4e228f
MT		 24804 ata_acpi_uevent(dev->link->ap, dev, event);
24805 }
24806
24807-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24808+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24809 .handler = ata_acpi_dev_notify_dock,
24810 .uevent = ata_acpi_dev_uevent,
24811 };
24812
24813-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24814+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24815 .handler = ata_acpi_ap_notify_dock,
24816 .uevent = ata_acpi_ap_uevent,
24817 };
66a7e928
MT		 24818diff -urNp linux-2.6.39/drivers/ata/libata-core.c linux-2.6.39/drivers/ata/libata-core.c
24819--- linux-2.6.39/drivers/ata/libata-core.c 2011-05-19 00:06:34.000000000 -0400
24820+++ linux-2.6.39/drivers/ata/libata-core.c 2011-05-22 19:36:30.000000000 -0400
24821@@ -4747,7 +4747,7 @@ void ata_qc_free(struct ata_queued_cmd *
6892158b
MT		 24822 struct ata_port *ap;
24823 unsigned int tag;
24824
24825- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24826+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24827 ap = qc->ap;
24828
24829 qc->flags = 0;
66a7e928 24830@@ -4763,7 +4763,7 @@ void __ata_qc_complete(struct ata_queued
6892158b
MT		 24831 struct ata_port *ap;
24832 struct ata_link *link;
24833
24834- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24835+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24836 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
24837 ap = qc->ap;
24838 link = qc->dev->link;
66a7e928 24839@@ -5756,7 +5756,7 @@ static void ata_host_stop(struct device
ae4e228f
MT		 24840 * LOCKING:
24841 * None.
24842 */
24843-static void ata_finalize_port_ops(struct ata_port_operations *ops)
24844+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
24845 {
24846 static DEFINE_SPINLOCK(lock);
24847 const struct ata_port_operations *cur;
66a7e928 24848@@ -5768,6 +5768,7 @@ static void ata_finalize_port_ops(struct
ae4e228f
MT		 24849 return;
24850
24851 spin_lock(&lock);
24852+ pax_open_kernel();
24853
24854 for (cur = ops->inherits; cur; cur = cur->inherits) {
24855 void **inherit = (void **)cur;
66a7e928 24856@@ -5781,8 +5782,9 @@ static void ata_finalize_port_ops(struct
ae4e228f
MT		 24857 if (IS_ERR(*pp))
24858 *pp = NULL;
24859
24860- ops->inherits = NULL;
24861+ ((struct ata_port_operations *)ops)->inherits = NULL;
24862
24863+ pax_close_kernel();
24864 spin_unlock(&lock);
24865 }
24866
66a7e928 24867@@ -5879,7 +5881,7 @@ int ata_host_start(struct ata_host *host
ae4e228f
MT		 24868 */
24869 /* KILLME - the only user left is ipr */
24870 void ata_host_init(struct ata_host *host, struct device *dev,
24871- unsigned long flags, struct ata_port_operations *ops)
24872+ unsigned long flags, const struct ata_port_operations *ops)
24873 {
24874 spin_lock_init(&host->lock);
bc901d79 24875 mutex_init(&host->eh_mutex);
66a7e928 24876@@ -6583,7 +6585,7 @@ static void ata_dummy_error_handler(stru
ae4e228f
MT		 24877 /* truly dummy */
24878 }
24879
24880-struct ata_port_operations ata_dummy_port_ops = {
24881+const struct ata_port_operations ata_dummy_port_ops = {
24882 .qc_prep = ata_noop_qc_prep,
24883 .qc_issue = ata_dummy_qc_issue,
24884 .error_handler = ata_dummy_error_handler,
66a7e928
MT		 24885diff -urNp linux-2.6.39/drivers/ata/libata-eh.c linux-2.6.39/drivers/ata/libata-eh.c
24886--- linux-2.6.39/drivers/ata/libata-eh.c 2011-05-19 00:06:34.000000000 -0400
24887+++ linux-2.6.39/drivers/ata/libata-eh.c 2011-05-22 19:36:30.000000000 -0400
24888@@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
24889 {
24890 struct ata_link *link;
24891
24892+ pax_track_stack();
24893+
24894 ata_for_each_link(link, ap, HOST_FIRST)
24895 ata_eh_link_report(link);
24896 }
24897@@ -3922,7 +3924,7 @@ void ata_do_eh(struct ata_port *ap, ata_
ae4e228f
MT		 24898 */
24899 void ata_std_error_handler(struct ata_port *ap)
24900 {
24901- struct ata_port_operations *ops = ap->ops;
24902+ const struct ata_port_operations *ops = ap->ops;
24903 ata_reset_fn_t hardreset = ops->hardreset;
24904
24905 /* ignore built-in hardreset if SCR access is not available */
66a7e928
MT		 24906diff -urNp linux-2.6.39/drivers/ata/libata-pmp.c linux-2.6.39/drivers/ata/libata-pmp.c
24907--- linux-2.6.39/drivers/ata/libata-pmp.c 2011-05-19 00:06:34.000000000 -0400
24908+++ linux-2.6.39/drivers/ata/libata-pmp.c 2011-05-22 19:36:30.000000000 -0400
bc901d79 24909@@ -912,7 +912,7 @@ static int sata_pmp_handle_link_fail(str
ae4e228f
MT		 24910 */
24911 static int sata_pmp_eh_recover(struct ata_port *ap)
24912 {
24913- struct ata_port_operations *ops = ap->ops;
24914+ const struct ata_port_operations *ops = ap->ops;
24915 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
24916 struct ata_link *pmp_link = &ap->link;
24917 struct ata_device *pmp_dev = pmp_link->device;
66a7e928
MT		 24918diff -urNp linux-2.6.39/drivers/ata/pata_acpi.c linux-2.6.39/drivers/ata/pata_acpi.c
24919--- linux-2.6.39/drivers/ata/pata_acpi.c 2011-05-19 00:06:34.000000000 -0400
24920+++ linux-2.6.39/drivers/ata/pata_acpi.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 24921@@ -216,7 +216,7 @@ static struct scsi_host_template pacpi_s
ae4e228f
MT		 24922 ATA_BMDMA_SHT(DRV_NAME),
24923 };
24924
24925-static struct ata_port_operations pacpi_ops = {
24926+static const struct ata_port_operations pacpi_ops = {
24927 .inherits = &ata_bmdma_port_ops,
24928 .qc_issue = pacpi_qc_issue,
24929 .cable_detect = pacpi_cable_detect,
66a7e928
MT		 24930diff -urNp linux-2.6.39/drivers/ata/pata_ali.c linux-2.6.39/drivers/ata/pata_ali.c
24931--- linux-2.6.39/drivers/ata/pata_ali.c 2011-05-19 00:06:34.000000000 -0400
24932+++ linux-2.6.39/drivers/ata/pata_ali.c 2011-05-22 19:36:30.000000000 -0400
df50ba0c 24933@@ -363,7 +363,7 @@ static struct scsi_host_template ali_sht
ae4e228f
MT		 24934 * Port operations for PIO only ALi
24935 */
24936
24937-static struct ata_port_operations ali_early_port_ops = {
24938+static const struct ata_port_operations ali_early_port_ops = {
24939 .inherits = &ata_sff_port_ops,
24940 .cable_detect = ata_cable_40wire,
24941 .set_piomode = ali_set_piomode,
df50ba0c 24942@@ -380,7 +380,7 @@ static const struct ata_port_operations
ae4e228f
MT		 24943 * Port operations for DMA capable ALi without cable
24944 * detect
24945 */
24946-static struct ata_port_operations ali_20_port_ops = {
24947+static const struct ata_port_operations ali_20_port_ops = {
24948 .inherits = &ali_dma_base_ops,
24949 .cable_detect = ata_cable_40wire,
24950 .mode_filter = ali_20_filter,
df50ba0c 24951@@ -391,7 +391,7 @@ static struct ata_port_operations ali_20
ae4e228f
MT		 24952 /*
24953 * Port operations for DMA capable ALi with cable detect
24954 */
24955-static struct ata_port_operations ali_c2_port_ops = {
24956+static const struct ata_port_operations ali_c2_port_ops = {
24957 .inherits = &ali_dma_base_ops,
24958 .check_atapi_dma = ali_check_atapi_dma,
24959 .cable_detect = ali_c2_cable_detect,
df50ba0c 24960@@ -402,7 +402,7 @@ static struct ata_port_operations ali_c2
ae4e228f
MT		 24961 /*
24962 * Port operations for DMA capable ALi with cable detect
24963 */
24964-static struct ata_port_operations ali_c4_port_ops = {
24965+static const struct ata_port_operations ali_c4_port_ops = {
24966 .inherits = &ali_dma_base_ops,
24967 .check_atapi_dma = ali_check_atapi_dma,
24968 .cable_detect = ali_c2_cable_detect,
df50ba0c 24969@@ -412,7 +412,7 @@ static struct ata_port_operations ali_c4
ae4e228f
MT		 24970 /*
24971 * Port operations for DMA capable ALi with cable detect and LBA48
24972 */
24973-static struct ata_port_operations ali_c5_port_ops = {
24974+static const struct ata_port_operations ali_c5_port_ops = {
24975 .inherits = &ali_dma_base_ops,
24976 .check_atapi_dma = ali_check_atapi_dma,
24977 .dev_config = ali_warn_atapi_dma,
66a7e928
MT		 24978diff -urNp linux-2.6.39/drivers/ata/pata_amd.c linux-2.6.39/drivers/ata/pata_amd.c
24979--- linux-2.6.39/drivers/ata/pata_amd.c 2011-05-19 00:06:34.000000000 -0400
24980+++ linux-2.6.39/drivers/ata/pata_amd.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 24981@@ -397,28 +397,28 @@ static const struct ata_port_operations
24982 .prereset = amd_pre_reset,
24983 };
24984
24985-static struct ata_port_operations amd33_port_ops = {
24986+static const struct ata_port_operations amd33_port_ops = {
24987 .inherits = &amd_base_port_ops,
24988 .cable_detect = ata_cable_40wire,
24989 .set_piomode = amd33_set_piomode,
24990 .set_dmamode = amd33_set_dmamode,
24991 };
24992
24993-static struct ata_port_operations amd66_port_ops = {
24994+static const struct ata_port_operations amd66_port_ops = {
24995 .inherits = &amd_base_port_ops,
24996 .cable_detect = ata_cable_unknown,
24997 .set_piomode = amd66_set_piomode,
24998 .set_dmamode = amd66_set_dmamode,
24999 };
25000
25001-static struct ata_port_operations amd100_port_ops = {
25002+static const struct ata_port_operations amd100_port_ops = {
25003 .inherits = &amd_base_port_ops,
25004 .cable_detect = ata_cable_unknown,
25005 .set_piomode = amd100_set_piomode,
25006 .set_dmamode = amd100_set_dmamode,
25007 };
25008
25009-static struct ata_port_operations amd133_port_ops = {
25010+static const struct ata_port_operations amd133_port_ops = {
25011 .inherits = &amd_base_port_ops,
25012 .cable_detect = amd_cable_detect,
25013 .set_piomode = amd133_set_piomode,
25014@@ -433,13 +433,13 @@ static const struct ata_port_operations
25015 .host_stop = nv_host_stop,
25016 };
25017
25018-static struct ata_port_operations nv100_port_ops = {
25019+static const struct ata_port_operations nv100_port_ops = {
25020 .inherits = &nv_base_port_ops,
25021 .set_piomode = nv100_set_piomode,
25022 .set_dmamode = nv100_set_dmamode,
25023 };
25024
25025-static struct ata_port_operations nv133_port_ops = {
25026+static const struct ata_port_operations nv133_port_ops = {
25027 .inherits = &nv_base_port_ops,
25028 .set_piomode = nv133_set_piomode,
25029 .set_dmamode = nv133_set_dmamode,
66a7e928
MT		 25030diff -urNp linux-2.6.39/drivers/ata/pata_arasan_cf.c linux-2.6.39/drivers/ata/pata_arasan_cf.c
25031--- linux-2.6.39/drivers/ata/pata_arasan_cf.c 2011-05-19 00:06:34.000000000 -0400
25032+++ linux-2.6.39/drivers/ata/pata_arasan_cf.c 2011-05-22 19:36:31.000000000 -0400
25033@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
25034 /* Handle platform specific quirks */
25035 if (pdata->quirk) {
25036 if (pdata->quirk & CF_BROKEN_PIO) {
25037- ap->ops->set_piomode = NULL;
25038+ pax_open_kernel();
25039+ *(void**)&ap->ops->set_piomode = NULL;
25040+ pax_close_kernel();
25041 ap->pio_mask = 0;
25042 }
25043 if (pdata->quirk & CF_BROKEN_MWDMA)
25044diff -urNp linux-2.6.39/drivers/ata/pata_artop.c linux-2.6.39/drivers/ata/pata_artop.c
25045--- linux-2.6.39/drivers/ata/pata_artop.c 2011-05-19 00:06:34.000000000 -0400
25046+++ linux-2.6.39/drivers/ata/pata_artop.c 2011-05-22 19:36:31.000000000 -0400
6892158b 25047@@ -312,7 +312,7 @@ static struct scsi_host_template artop_s
ae4e228f
MT		 25048 ATA_BMDMA_SHT(DRV_NAME),
25049 };
25050
25051-static struct ata_port_operations artop6210_ops = {
25052+static const struct ata_port_operations artop6210_ops = {
25053 .inherits = &ata_bmdma_port_ops,
25054 .cable_detect = ata_cable_40wire,
25055 .set_piomode = artop6210_set_piomode,
6892158b 25056@@ -321,7 +321,7 @@ static struct ata_port_operations artop6
ae4e228f
MT		 25057 .qc_defer = artop6210_qc_defer,
25058 };
25059
25060-static struct ata_port_operations artop6260_ops = {
25061+static const struct ata_port_operations artop6260_ops = {
25062 .inherits = &ata_bmdma_port_ops,
25063 .cable_detect = artop6260_cable_detect,
25064 .set_piomode = artop6260_set_piomode,
66a7e928
MT		 25065diff -urNp linux-2.6.39/drivers/ata/pata_at32.c linux-2.6.39/drivers/ata/pata_at32.c
25066--- linux-2.6.39/drivers/ata/pata_at32.c 2011-05-19 00:06:34.000000000 -0400
25067+++ linux-2.6.39/drivers/ata/pata_at32.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25068@@ -173,7 +173,7 @@ static struct scsi_host_template at32_sh
ae4e228f
MT		 25069 ATA_PIO_SHT(DRV_NAME),
25070 };
25071
25072-static struct ata_port_operations at32_port_ops = {
25073+static const struct ata_port_operations at32_port_ops = {
25074 .inherits = &ata_sff_port_ops,
25075 .cable_detect = ata_cable_40wire,
25076 .set_piomode = pata_at32_set_piomode,
66a7e928
MT		 25077diff -urNp linux-2.6.39/drivers/ata/pata_at91.c linux-2.6.39/drivers/ata/pata_at91.c
25078--- linux-2.6.39/drivers/ata/pata_at91.c 2011-05-19 00:06:34.000000000 -0400
25079+++ linux-2.6.39/drivers/ata/pata_at91.c 2011-05-22 19:36:31.000000000 -0400
25080@@ -212,7 +212,7 @@ static struct scsi_host_template pata_at
ae4e228f
MT		 25081 ATA_PIO_SHT(DRV_NAME),
25082 };
25083
25084-static struct ata_port_operations pata_at91_port_ops = {
25085+static const struct ata_port_operations pata_at91_port_ops = {
25086 .inherits = &ata_sff_port_ops,
25087
25088 .sff_data_xfer = pata_at91_data_xfer_noirq,
66a7e928
MT		 25089diff -urNp linux-2.6.39/drivers/ata/pata_atiixp.c linux-2.6.39/drivers/ata/pata_atiixp.c
25090--- linux-2.6.39/drivers/ata/pata_atiixp.c 2011-05-19 00:06:34.000000000 -0400
25091+++ linux-2.6.39/drivers/ata/pata_atiixp.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25092@@ -214,7 +214,7 @@ static struct scsi_host_template atiixp_
ae4e228f
MT		 25093 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25094 };
25095
25096-static struct ata_port_operations atiixp_port_ops = {
25097+static const struct ata_port_operations atiixp_port_ops = {
25098 .inherits = &ata_bmdma_port_ops,
25099
57199397 25100 .qc_prep = ata_bmdma_dumb_qc_prep,
66a7e928
MT		 25101diff -urNp linux-2.6.39/drivers/ata/pata_atp867x.c linux-2.6.39/drivers/ata/pata_atp867x.c
25102--- linux-2.6.39/drivers/ata/pata_atp867x.c 2011-05-19 00:06:34.000000000 -0400
25103+++ linux-2.6.39/drivers/ata/pata_atp867x.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25104@@ -275,7 +275,7 @@ static struct scsi_host_template atp867x
ae4e228f
MT		 25105 ATA_BMDMA_SHT(DRV_NAME),
25106 };
25107
25108-static struct ata_port_operations atp867x_ops = {
25109+static const struct ata_port_operations atp867x_ops = {
25110 .inherits = &ata_bmdma_port_ops,
25111 .cable_detect = atp867x_cable_detect,
25112 .set_piomode = atp867x_set_piomode,
66a7e928
MT		 25113diff -urNp linux-2.6.39/drivers/ata/pata_bf54x.c linux-2.6.39/drivers/ata/pata_bf54x.c
25114--- linux-2.6.39/drivers/ata/pata_bf54x.c 2011-05-19 00:06:34.000000000 -0400
25115+++ linux-2.6.39/drivers/ata/pata_bf54x.c 2011-05-22 19:36:31.000000000 -0400
57199397 25116@@ -1420,7 +1420,7 @@ static struct scsi_host_template bfin_sh
ae4e228f
MT		 25117 .dma_boundary = ATA_DMA_BOUNDARY,
25118 };
25119
25120-static struct ata_port_operations bfin_pata_ops = {
25121+static const struct ata_port_operations bfin_pata_ops = {
57199397 25122 .inherits = &ata_bmdma_port_ops,
ae4e228f
MT		 25123
25124 .set_piomode = bfin_set_piomode,
66a7e928
MT		 25125diff -urNp linux-2.6.39/drivers/ata/pata_cmd640.c linux-2.6.39/drivers/ata/pata_cmd640.c
25126--- linux-2.6.39/drivers/ata/pata_cmd640.c 2011-05-19 00:06:34.000000000 -0400
25127+++ linux-2.6.39/drivers/ata/pata_cmd640.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 25128@@ -176,7 +176,7 @@ static struct scsi_host_template cmd640_
57199397 25129 ATA_PIO_SHT(DRV_NAME),
ae4e228f
MT		 25130 };
25131
25132-static struct ata_port_operations cmd640_port_ops = {
25133+static const struct ata_port_operations cmd640_port_ops = {
57199397 25134 .inherits = &ata_sff_port_ops,
ae4e228f
MT		 25135 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25136 .sff_data_xfer = ata_sff_data_xfer_noirq,
66a7e928
MT		 25137diff -urNp linux-2.6.39/drivers/ata/pata_cmd64x.c linux-2.6.39/drivers/ata/pata_cmd64x.c
25138--- linux-2.6.39/drivers/ata/pata_cmd64x.c 2011-05-19 00:06:34.000000000 -0400
25139+++ linux-2.6.39/drivers/ata/pata_cmd64x.c 2011-05-22 19:36:31.000000000 -0400
6892158b 25140@@ -268,18 +268,18 @@ static const struct ata_port_operations
ae4e228f
MT		 25141 .set_dmamode = cmd64x_set_dmamode,
25142 };
25143
25144-static struct ata_port_operations cmd64x_port_ops = {
25145+static const struct ata_port_operations cmd64x_port_ops = {
25146 .inherits = &cmd64x_base_ops,
25147 .cable_detect = ata_cable_40wire,
25148 };
25149
25150-static struct ata_port_operations cmd646r1_port_ops = {
25151+static const struct ata_port_operations cmd646r1_port_ops = {
25152 .inherits = &cmd64x_base_ops,
25153 .bmdma_stop = cmd646r1_bmdma_stop,
25154 .cable_detect = ata_cable_40wire,
25155 };
25156
25157-static struct ata_port_operations cmd648_port_ops = {
25158+static const struct ata_port_operations cmd648_port_ops = {
25159 .inherits = &cmd64x_base_ops,
25160 .bmdma_stop = cmd648_bmdma_stop,
25161 .cable_detect = cmd648_cable_detect,
66a7e928
MT		 25162diff -urNp linux-2.6.39/drivers/ata/pata_cs5520.c linux-2.6.39/drivers/ata/pata_cs5520.c
25163--- linux-2.6.39/drivers/ata/pata_cs5520.c 2011-05-19 00:06:34.000000000 -0400
25164+++ linux-2.6.39/drivers/ata/pata_cs5520.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25165@@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
25166 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25167 };
25168
25169-static struct ata_port_operations cs5520_port_ops = {
25170+static const struct ata_port_operations cs5520_port_ops = {
25171 .inherits = &ata_bmdma_port_ops,
57199397 25172 .qc_prep = ata_bmdma_dumb_qc_prep,
ae4e228f 25173 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25174diff -urNp linux-2.6.39/drivers/ata/pata_cs5530.c linux-2.6.39/drivers/ata/pata_cs5530.c
25175--- linux-2.6.39/drivers/ata/pata_cs5530.c 2011-05-19 00:06:34.000000000 -0400
25176+++ linux-2.6.39/drivers/ata/pata_cs5530.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25177@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25178 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25179 };
25180
25181-static struct ata_port_operations cs5530_port_ops = {
25182+static const struct ata_port_operations cs5530_port_ops = {
25183 .inherits = &ata_bmdma_port_ops,
25184
57199397 25185 .qc_prep = ata_bmdma_dumb_qc_prep,
66a7e928
MT		 25186diff -urNp linux-2.6.39/drivers/ata/pata_cs5535.c linux-2.6.39/drivers/ata/pata_cs5535.c
25187--- linux-2.6.39/drivers/ata/pata_cs5535.c 2011-05-19 00:06:34.000000000 -0400
25188+++ linux-2.6.39/drivers/ata/pata_cs5535.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25189@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25190 ATA_BMDMA_SHT(DRV_NAME),
25191 };
25192
25193-static struct ata_port_operations cs5535_port_ops = {
25194+static const struct ata_port_operations cs5535_port_ops = {
25195 .inherits = &ata_bmdma_port_ops,
25196 .cable_detect = cs5535_cable_detect,
25197 .set_piomode = cs5535_set_piomode,
66a7e928
MT		 25198diff -urNp linux-2.6.39/drivers/ata/pata_cs5536.c linux-2.6.39/drivers/ata/pata_cs5536.c
25199--- linux-2.6.39/drivers/ata/pata_cs5536.c 2011-05-19 00:06:34.000000000 -0400
25200+++ linux-2.6.39/drivers/ata/pata_cs5536.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 25201@@ -233,7 +233,7 @@ static struct scsi_host_template cs5536_
ae4e228f
MT		 25202 ATA_BMDMA_SHT(DRV_NAME),
25203 };
25204
25205-static struct ata_port_operations cs5536_port_ops = {
25206+static const struct ata_port_operations cs5536_port_ops = {
25207 .inherits = &ata_bmdma32_port_ops,
25208 .cable_detect = cs5536_cable_detect,
25209 .set_piomode = cs5536_set_piomode,
66a7e928
MT		 25210diff -urNp linux-2.6.39/drivers/ata/pata_cypress.c linux-2.6.39/drivers/ata/pata_cypress.c
25211--- linux-2.6.39/drivers/ata/pata_cypress.c 2011-05-19 00:06:34.000000000 -0400
25212+++ linux-2.6.39/drivers/ata/pata_cypress.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25213@@ -115,7 +115,7 @@ static struct scsi_host_template cy82c69
ae4e228f
MT		 25214 ATA_BMDMA_SHT(DRV_NAME),
25215 };
25216
25217-static struct ata_port_operations cy82c693_port_ops = {
25218+static const struct ata_port_operations cy82c693_port_ops = {
25219 .inherits = &ata_bmdma_port_ops,
25220 .cable_detect = ata_cable_40wire,
25221 .set_piomode = cy82c693_set_piomode,
66a7e928
MT		 25222diff -urNp linux-2.6.39/drivers/ata/pata_efar.c linux-2.6.39/drivers/ata/pata_efar.c
25223--- linux-2.6.39/drivers/ata/pata_efar.c 2011-05-19 00:06:34.000000000 -0400
25224+++ linux-2.6.39/drivers/ata/pata_efar.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25225@@ -238,7 +238,7 @@ static struct scsi_host_template efar_sh
ae4e228f
MT		 25226 ATA_BMDMA_SHT(DRV_NAME),
25227 };
25228
25229-static struct ata_port_operations efar_ops = {
25230+static const struct ata_port_operations efar_ops = {
25231 .inherits = &ata_bmdma_port_ops,
25232 .cable_detect = efar_cable_detect,
25233 .set_piomode = efar_set_piomode,
66a7e928
MT		 25234diff -urNp linux-2.6.39/drivers/ata/pata_hpt366.c linux-2.6.39/drivers/ata/pata_hpt366.c
25235--- linux-2.6.39/drivers/ata/pata_hpt366.c 2011-05-19 00:06:34.000000000 -0400
25236+++ linux-2.6.39/drivers/ata/pata_hpt366.c 2011-05-22 19:36:31.000000000 -0400
25237@@ -276,7 +276,7 @@ static struct scsi_host_template hpt36x_
ae4e228f
MT		 25238 * Configuration for HPT366/68
25239 */
25240
25241-static struct ata_port_operations hpt366_port_ops = {
25242+static const struct ata_port_operations hpt366_port_ops = {
25243 .inherits = &ata_bmdma_port_ops,
25244 .cable_detect = hpt36x_cable_detect,
25245 .mode_filter = hpt366_filter,
66a7e928
MT		 25246diff -urNp linux-2.6.39/drivers/ata/pata_hpt37x.c linux-2.6.39/drivers/ata/pata_hpt37x.c
25247--- linux-2.6.39/drivers/ata/pata_hpt37x.c 2011-05-19 00:06:34.000000000 -0400
25248+++ linux-2.6.39/drivers/ata/pata_hpt37x.c 2011-05-22 19:36:31.000000000 -0400
25249@@ -589,7 +589,7 @@ static struct scsi_host_template hpt37x_
ae4e228f
MT		 25250 * Configuration for HPT370
25251 */
25252
25253-static struct ata_port_operations hpt370_port_ops = {
25254+static const struct ata_port_operations hpt370_port_ops = {
25255 .inherits = &ata_bmdma_port_ops,
25256
25257 .bmdma_stop = hpt370_bmdma_stop,
66a7e928 25258@@ -605,7 +605,7 @@ static struct ata_port_operations hpt370
ae4e228f
MT		 25259 * Configuration for HPT370A. Close to 370 but less filters
25260 */
25261
25262-static struct ata_port_operations hpt370a_port_ops = {
25263+static const struct ata_port_operations hpt370a_port_ops = {
25264 .inherits = &hpt370_port_ops,
25265 .mode_filter = hpt370a_filter,
25266 };
66a7e928 25267@@ -615,7 +615,7 @@ static struct ata_port_operations hpt370
16454cff 25268 * mode setting functionality.
ae4e228f
MT		 25269 */
25270
16454cff
MT		 25271-static struct ata_port_operations hpt302_port_ops = {
25272+static const struct ata_port_operations hpt302_port_ops = {
ae4e228f
MT		 25273 .inherits = &ata_bmdma_port_ops,
25274
25275 .bmdma_stop = hpt37x_bmdma_stop,
66a7e928 25276@@ -631,7 +631,7 @@ static struct ata_port_operations hpt302
16454cff
MT		 25277 * but we have a mode filter.
25278 */
25279
25280-static struct ata_port_operations hpt372_port_ops = {
25281+static const struct ata_port_operations hpt372_port_ops = {
25282 .inherits = &hpt302_port_ops,
25283 .mode_filter = hpt372_filter,
25284 };
66a7e928 25285@@ -641,7 +641,7 @@ static struct ata_port_operations hpt372
ae4e228f
MT		 25286 * but we have a different cable detection procedure for function 1.
25287 */
25288
25289-static struct ata_port_operations hpt374_fn1_port_ops = {
25290+static const struct ata_port_operations hpt374_fn1_port_ops = {
25291 .inherits = &hpt372_port_ops,
25292 .cable_detect = hpt374_fn1_cable_detect,
16454cff 25293 };
66a7e928
MT		 25294diff -urNp linux-2.6.39/drivers/ata/pata_hpt3x2n.c linux-2.6.39/drivers/ata/pata_hpt3x2n.c
25295--- linux-2.6.39/drivers/ata/pata_hpt3x2n.c 2011-05-19 00:06:34.000000000 -0400
25296+++ linux-2.6.39/drivers/ata/pata_hpt3x2n.c 2011-05-22 19:36:31.000000000 -0400
25297@@ -350,7 +350,7 @@ static struct scsi_host_template hpt3x2n
16454cff 25298 * Configuration for HPT302N/371N.
ae4e228f
MT		 25299 */
25300
16454cff
MT		 25301-static struct ata_port_operations hpt3xxn_port_ops = {
25302+static const struct ata_port_operations hpt3xxn_port_ops = {
ae4e228f
MT		 25303 .inherits = &ata_bmdma_port_ops,
25304
25305 .bmdma_stop = hpt3x2n_bmdma_stop,
66a7e928 25306@@ -368,7 +368,7 @@ static struct ata_port_operations hpt3xx
16454cff
MT		 25307 * Configuration for HPT372N. Same as 302N/371N but we have a mode filter.
25308 */
25309
25310-static struct ata_port_operations hpt372n_port_ops = {
25311+static const struct ata_port_operations hpt372n_port_ops = {
25312 .inherits = &hpt3xxn_port_ops,
25313 .mode_filter = &hpt372n_filter,
25314 };
66a7e928
MT		 25315diff -urNp linux-2.6.39/drivers/ata/pata_hpt3x3.c linux-2.6.39/drivers/ata/pata_hpt3x3.c
25316--- linux-2.6.39/drivers/ata/pata_hpt3x3.c 2011-05-19 00:06:34.000000000 -0400
25317+++ linux-2.6.39/drivers/ata/pata_hpt3x3.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25318@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
25319 ATA_BMDMA_SHT(DRV_NAME),
25320 };
25321
25322-static struct ata_port_operations hpt3x3_port_ops = {
25323+static const struct ata_port_operations hpt3x3_port_ops = {
25324 .inherits = &ata_bmdma_port_ops,
25325 .cable_detect = ata_cable_40wire,
25326 .set_piomode = hpt3x3_set_piomode,
66a7e928
MT		 25327diff -urNp linux-2.6.39/drivers/ata/pata_icside.c linux-2.6.39/drivers/ata/pata_icside.c
25328--- linux-2.6.39/drivers/ata/pata_icside.c 2011-05-19 00:06:34.000000000 -0400
25329+++ linux-2.6.39/drivers/ata/pata_icside.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25330@@ -320,7 +320,7 @@ static void pata_icside_postreset(struct
ae4e228f
MT		 25331 }
25332 }
25333
25334-static struct ata_port_operations pata_icside_port_ops = {
25335+static const struct ata_port_operations pata_icside_port_ops = {
57199397 25336 .inherits = &ata_bmdma_port_ops,
ae4e228f
MT		 25337 /* no need to build any PRD tables for DMA */
25338 .qc_prep = ata_noop_qc_prep,
66a7e928
MT		 25339diff -urNp linux-2.6.39/drivers/ata/pata_isapnp.c linux-2.6.39/drivers/ata/pata_isapnp.c
25340--- linux-2.6.39/drivers/ata/pata_isapnp.c 2011-05-19 00:06:34.000000000 -0400
25341+++ linux-2.6.39/drivers/ata/pata_isapnp.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25342@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
25343 ATA_PIO_SHT(DRV_NAME),
25344 };
25345
25346-static struct ata_port_operations isapnp_port_ops = {
25347+static const struct ata_port_operations isapnp_port_ops = {
25348 .inherits = &ata_sff_port_ops,
25349 .cable_detect = ata_cable_40wire,
25350 };
25351
25352-static struct ata_port_operations isapnp_noalt_port_ops = {
25353+static const struct ata_port_operations isapnp_noalt_port_ops = {
25354 .inherits = &ata_sff_port_ops,
25355 .cable_detect = ata_cable_40wire,
25356 /* No altstatus so we don't want to use the lost interrupt poll */
66a7e928
MT		 25357diff -urNp linux-2.6.39/drivers/ata/pata_it8213.c linux-2.6.39/drivers/ata/pata_it8213.c
25358--- linux-2.6.39/drivers/ata/pata_it8213.c 2011-05-19 00:06:34.000000000 -0400
25359+++ linux-2.6.39/drivers/ata/pata_it8213.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25360@@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
25361 };
25362
25363
25364-static struct ata_port_operations it8213_ops = {
25365+static const struct ata_port_operations it8213_ops = {
25366 .inherits = &ata_bmdma_port_ops,
25367 .cable_detect = it8213_cable_detect,
25368 .set_piomode = it8213_set_piomode,
66a7e928
MT		 25369diff -urNp linux-2.6.39/drivers/ata/pata_it821x.c linux-2.6.39/drivers/ata/pata_it821x.c
25370--- linux-2.6.39/drivers/ata/pata_it821x.c 2011-05-19 00:06:34.000000000 -0400
25371+++ linux-2.6.39/drivers/ata/pata_it821x.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25372@@ -801,7 +801,7 @@ static struct scsi_host_template it821x_
ae4e228f
MT		 25373 ATA_BMDMA_SHT(DRV_NAME),
25374 };
25375
25376-static struct ata_port_operations it821x_smart_port_ops = {
25377+static const struct ata_port_operations it821x_smart_port_ops = {
25378 .inherits = &ata_bmdma_port_ops,
25379
25380 .check_atapi_dma= it821x_check_atapi_dma,
df50ba0c 25381@@ -815,7 +815,7 @@ static struct ata_port_operations it821x
ae4e228f
MT		 25382 .port_start = it821x_port_start,
25383 };
25384
25385-static struct ata_port_operations it821x_passthru_port_ops = {
25386+static const struct ata_port_operations it821x_passthru_port_ops = {
25387 .inherits = &ata_bmdma_port_ops,
25388
25389 .check_atapi_dma= it821x_check_atapi_dma,
df50ba0c 25390@@ -831,7 +831,7 @@ static struct ata_port_operations it821x
ae4e228f
MT		 25391 .port_start = it821x_port_start,
25392 };
25393
25394-static struct ata_port_operations it821x_rdc_port_ops = {
25395+static const struct ata_port_operations it821x_rdc_port_ops = {
25396 .inherits = &ata_bmdma_port_ops,
25397
25398 .check_atapi_dma= it821x_check_atapi_dma,
66a7e928
MT		 25399diff -urNp linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c
25400--- linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c 2011-05-19 00:06:34.000000000 -0400
25401+++ linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25402@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
25403 ATA_PIO_SHT(DRV_NAME),
25404 };
25405
25406-static struct ata_port_operations ixp4xx_port_ops = {
25407+static const struct ata_port_operations ixp4xx_port_ops = {
25408 .inherits = &ata_sff_port_ops,
25409 .sff_data_xfer = ixp4xx_mmio_data_xfer,
25410 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25411diff -urNp linux-2.6.39/drivers/ata/pata_jmicron.c linux-2.6.39/drivers/ata/pata_jmicron.c
25412--- linux-2.6.39/drivers/ata/pata_jmicron.c 2011-05-19 00:06:34.000000000 -0400
25413+++ linux-2.6.39/drivers/ata/pata_jmicron.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25414@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
25415 ATA_BMDMA_SHT(DRV_NAME),
25416 };
25417
25418-static struct ata_port_operations jmicron_ops = {
25419+static const struct ata_port_operations jmicron_ops = {
25420 .inherits = &ata_bmdma_port_ops,
25421 .prereset = jmicron_pre_reset,
25422 };
66a7e928
MT		 25423diff -urNp linux-2.6.39/drivers/ata/pata_legacy.c linux-2.6.39/drivers/ata/pata_legacy.c
25424--- linux-2.6.39/drivers/ata/pata_legacy.c 2011-05-19 00:06:34.000000000 -0400
25425+++ linux-2.6.39/drivers/ata/pata_legacy.c 2011-05-22 19:36:31.000000000 -0400
6892158b 25426@@ -116,7 +116,7 @@ struct legacy_probe {
ae4e228f
MT		 25427
25428 struct legacy_controller {
25429 const char *name;
25430- struct ata_port_operations *ops;
25431+ const struct ata_port_operations *ops;
25432 unsigned int pio_mask;
25433 unsigned int flags;
25434 unsigned int pflags;
6892158b 25435@@ -239,12 +239,12 @@ static const struct ata_port_operations
ae4e228f
MT		 25436 * pio_mask as well.
25437 */
25438
25439-static struct ata_port_operations simple_port_ops = {
25440+static const struct ata_port_operations simple_port_ops = {
25441 .inherits = &legacy_base_port_ops,
25442 .sff_data_xfer = ata_sff_data_xfer_noirq,
25443 };
25444
25445-static struct ata_port_operations legacy_port_ops = {
25446+static const struct ata_port_operations legacy_port_ops = {
25447 .inherits = &legacy_base_port_ops,
25448 .sff_data_xfer = ata_sff_data_xfer_noirq,
25449 .set_mode = legacy_set_mode,
6892158b 25450@@ -340,7 +340,7 @@ static unsigned int pdc_data_xfer_vlb(st
ae4e228f
MT		 25451 return buflen;
25452 }
25453
25454-static struct ata_port_operations pdc20230_port_ops = {
25455+static const struct ata_port_operations pdc20230_port_ops = {
25456 .inherits = &legacy_base_port_ops,
25457 .set_piomode = pdc20230_set_piomode,
25458 .sff_data_xfer = pdc_data_xfer_vlb,
6892158b 25459@@ -373,7 +373,7 @@ static void ht6560a_set_piomode(struct a
ae4e228f
MT		 25460 ioread8(ap->ioaddr.status_addr);
25461 }
25462
25463-static struct ata_port_operations ht6560a_port_ops = {
25464+static const struct ata_port_operations ht6560a_port_ops = {
25465 .inherits = &legacy_base_port_ops,
25466 .set_piomode = ht6560a_set_piomode,
25467 };
6892158b 25468@@ -416,7 +416,7 @@ static void ht6560b_set_piomode(struct a
ae4e228f
MT		 25469 ioread8(ap->ioaddr.status_addr);
25470 }
25471
25472-static struct ata_port_operations ht6560b_port_ops = {
25473+static const struct ata_port_operations ht6560b_port_ops = {
25474 .inherits = &legacy_base_port_ops,
25475 .set_piomode = ht6560b_set_piomode,
25476 };
6892158b 25477@@ -515,7 +515,7 @@ static void opti82c611a_set_piomode(stru
ae4e228f
MT		 25478 }
25479
25480
25481-static struct ata_port_operations opti82c611a_port_ops = {
25482+static const struct ata_port_operations opti82c611a_port_ops = {
25483 .inherits = &legacy_base_port_ops,
25484 .set_piomode = opti82c611a_set_piomode,
25485 };
6892158b 25486@@ -625,7 +625,7 @@ static unsigned int opti82c46x_qc_issue(
ae4e228f
MT		 25487 return ata_sff_qc_issue(qc);
25488 }
25489
25490-static struct ata_port_operations opti82c46x_port_ops = {
25491+static const struct ata_port_operations opti82c46x_port_ops = {
25492 .inherits = &legacy_base_port_ops,
25493 .set_piomode = opti82c46x_set_piomode,
25494 .qc_issue = opti82c46x_qc_issue,
6892158b 25495@@ -787,20 +787,20 @@ static int qdi_port(struct platform_devi
ae4e228f
MT		 25496 return 0;
25497 }
25498
25499-static struct ata_port_operations qdi6500_port_ops = {
25500+static const struct ata_port_operations qdi6500_port_ops = {
25501 .inherits = &legacy_base_port_ops,
25502 .set_piomode = qdi6500_set_piomode,
25503 .qc_issue = qdi_qc_issue,
25504 .sff_data_xfer = vlb32_data_xfer,
25505 };
25506
25507-static struct ata_port_operations qdi6580_port_ops = {
25508+static const struct ata_port_operations qdi6580_port_ops = {
25509 .inherits = &legacy_base_port_ops,
25510 .set_piomode = qdi6580_set_piomode,
25511 .sff_data_xfer = vlb32_data_xfer,
25512 };
25513
25514-static struct ata_port_operations qdi6580dp_port_ops = {
25515+static const struct ata_port_operations qdi6580dp_port_ops = {
25516 .inherits = &legacy_base_port_ops,
25517 .set_piomode = qdi6580dp_set_piomode,
25518 .qc_issue = qdi_qc_issue,
6892158b 25519@@ -872,7 +872,7 @@ static int winbond_port(struct platform_
ae4e228f
MT		 25520 return 0;
25521 }
25522
25523-static struct ata_port_operations winbond_port_ops = {
25524+static const struct ata_port_operations winbond_port_ops = {
25525 .inherits = &legacy_base_port_ops,
25526 .set_piomode = winbond_set_piomode,
25527 .sff_data_xfer = vlb32_data_xfer,
6892158b 25528@@ -995,7 +995,7 @@ static __init int legacy_init_one(struct
ae4e228f
MT		 25529 int pio_modes = controller->pio_mask;
25530 unsigned long io = probe->port;
25531 u32 mask = (1 << probe->slot);
25532- struct ata_port_operations *ops = controller->ops;
25533+ const struct ata_port_operations *ops = controller->ops;
25534 struct legacy_data *ld = &legacy_data[probe->slot];
25535 struct ata_host *host = NULL;
25536 struct ata_port *ap;
66a7e928
MT		 25537diff -urNp linux-2.6.39/drivers/ata/pata_macio.c linux-2.6.39/drivers/ata/pata_macio.c
25538--- linux-2.6.39/drivers/ata/pata_macio.c 2011-05-19 00:06:34.000000000 -0400
25539+++ linux-2.6.39/drivers/ata/pata_macio.c 2011-05-22 19:36:31.000000000 -0400
57199397 25540@@ -918,9 +918,8 @@ static struct scsi_host_template pata_ma
ae4e228f
MT		 25541 .slave_configure = pata_macio_slave_config,
25542 };
25543
25544-static struct ata_port_operations pata_macio_ops = {
25545+static const struct ata_port_operations pata_macio_ops = {
57199397
MT		 25546 .inherits = &ata_bmdma_port_ops,
25547-
ae4e228f 25548 .freeze = pata_macio_freeze,
57199397
MT		 25549 .set_piomode = pata_macio_set_timings,
25550 .set_dmamode = pata_macio_set_timings,
66a7e928
MT		 25551diff -urNp linux-2.6.39/drivers/ata/pata_marvell.c linux-2.6.39/drivers/ata/pata_marvell.c
25552--- linux-2.6.39/drivers/ata/pata_marvell.c 2011-05-19 00:06:34.000000000 -0400
25553+++ linux-2.6.39/drivers/ata/pata_marvell.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25554@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
25555 ATA_BMDMA_SHT(DRV_NAME),
25556 };
25557
25558-static struct ata_port_operations marvell_ops = {
25559+static const struct ata_port_operations marvell_ops = {
25560 .inherits = &ata_bmdma_port_ops,
25561 .cable_detect = marvell_cable_detect,
25562 .prereset = marvell_pre_reset,
66a7e928
MT		 25563diff -urNp linux-2.6.39/drivers/ata/pata_mpc52xx.c linux-2.6.39/drivers/ata/pata_mpc52xx.c
25564--- linux-2.6.39/drivers/ata/pata_mpc52xx.c 2011-05-19 00:06:34.000000000 -0400
25565+++ linux-2.6.39/drivers/ata/pata_mpc52xx.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25566@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
25567 ATA_PIO_SHT(DRV_NAME),
25568 };
25569
25570-static struct ata_port_operations mpc52xx_ata_port_ops = {
25571+static const struct ata_port_operations mpc52xx_ata_port_ops = {
c52201e0 25572 .inherits = &ata_bmdma_port_ops,
ae4e228f
MT		 25573 .sff_dev_select = mpc52xx_ata_dev_select,
25574 .set_piomode = mpc52xx_ata_set_piomode,
66a7e928
MT		 25575diff -urNp linux-2.6.39/drivers/ata/pata_mpiix.c linux-2.6.39/drivers/ata/pata_mpiix.c
25576--- linux-2.6.39/drivers/ata/pata_mpiix.c 2011-05-19 00:06:34.000000000 -0400
25577+++ linux-2.6.39/drivers/ata/pata_mpiix.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25578@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
25579 ATA_PIO_SHT(DRV_NAME),
25580 };
25581
25582-static struct ata_port_operations mpiix_port_ops = {
25583+static const struct ata_port_operations mpiix_port_ops = {
25584 .inherits = &ata_sff_port_ops,
25585 .qc_issue = mpiix_qc_issue,
25586 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25587diff -urNp linux-2.6.39/drivers/ata/pata_netcell.c linux-2.6.39/drivers/ata/pata_netcell.c
25588--- linux-2.6.39/drivers/ata/pata_netcell.c 2011-05-19 00:06:34.000000000 -0400
25589+++ linux-2.6.39/drivers/ata/pata_netcell.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25590@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
25591 ATA_BMDMA_SHT(DRV_NAME),
25592 };
25593
25594-static struct ata_port_operations netcell_ops = {
25595+static const struct ata_port_operations netcell_ops = {
25596 .inherits = &ata_bmdma_port_ops,
25597 .cable_detect = ata_cable_80wire,
25598 .read_id = netcell_read_id,
66a7e928
MT		 25599diff -urNp linux-2.6.39/drivers/ata/pata_ninja32.c linux-2.6.39/drivers/ata/pata_ninja32.c
25600--- linux-2.6.39/drivers/ata/pata_ninja32.c 2011-05-19 00:06:34.000000000 -0400
25601+++ linux-2.6.39/drivers/ata/pata_ninja32.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25602@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
25603 ATA_BMDMA_SHT(DRV_NAME),
25604 };
25605
25606-static struct ata_port_operations ninja32_port_ops = {
25607+static const struct ata_port_operations ninja32_port_ops = {
25608 .inherits = &ata_bmdma_port_ops,
25609 .sff_dev_select = ninja32_dev_select,
25610 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25611diff -urNp linux-2.6.39/drivers/ata/pata_ns87410.c linux-2.6.39/drivers/ata/pata_ns87410.c
25612--- linux-2.6.39/drivers/ata/pata_ns87410.c 2011-05-19 00:06:34.000000000 -0400
25613+++ linux-2.6.39/drivers/ata/pata_ns87410.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25614@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
25615 ATA_PIO_SHT(DRV_NAME),
25616 };
25617
25618-static struct ata_port_operations ns87410_port_ops = {
25619+static const struct ata_port_operations ns87410_port_ops = {
25620 .inherits = &ata_sff_port_ops,
25621 .qc_issue = ns87410_qc_issue,
25622 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25623diff -urNp linux-2.6.39/drivers/ata/pata_ns87415.c linux-2.6.39/drivers/ata/pata_ns87415.c
25624--- linux-2.6.39/drivers/ata/pata_ns87415.c 2011-05-19 00:06:34.000000000 -0400
25625+++ linux-2.6.39/drivers/ata/pata_ns87415.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25626@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
25627 }
25628 #endif /* 87560 SuperIO Support */
25629
25630-static struct ata_port_operations ns87415_pata_ops = {
25631+static const struct ata_port_operations ns87415_pata_ops = {
25632 .inherits = &ata_bmdma_port_ops,
25633
25634 .check_atapi_dma = ns87415_check_atapi_dma,
25635@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
25636 };
25637
25638 #if defined(CONFIG_SUPERIO)
25639-static struct ata_port_operations ns87560_pata_ops = {
25640+static const struct ata_port_operations ns87560_pata_ops = {
25641 .inherits = &ns87415_pata_ops,
25642 .sff_tf_read = ns87560_tf_read,
25643 .sff_check_status = ns87560_check_status,
66a7e928
MT		 25644diff -urNp linux-2.6.39/drivers/ata/pata_octeon_cf.c linux-2.6.39/drivers/ata/pata_octeon_cf.c
25645--- linux-2.6.39/drivers/ata/pata_octeon_cf.c 2011-05-19 00:06:34.000000000 -0400
25646+++ linux-2.6.39/drivers/ata/pata_octeon_cf.c 2011-05-22 19:36:31.000000000 -0400
16454cff 25647@@ -780,7 +780,7 @@ static unsigned int octeon_cf_qc_issue(s
ae4e228f
MT		 25648 return 0;
25649 }
25650
16454cff
MT		 25651-static struct ata_port_operations octeon_cf_ops = {
25652+static struct ata_port_operations octeon_cf_ops = { /* cannot be const */
ae4e228f
MT		 25653 .inherits = &ata_sff_port_ops,
25654 .check_atapi_dma = octeon_cf_check_atapi_dma,
16454cff 25655 .qc_prep = ata_noop_qc_prep,
66a7e928
MT		 25656diff -urNp linux-2.6.39/drivers/ata/pata_oldpiix.c linux-2.6.39/drivers/ata/pata_oldpiix.c
25657--- linux-2.6.39/drivers/ata/pata_oldpiix.c 2011-05-19 00:06:34.000000000 -0400
25658+++ linux-2.6.39/drivers/ata/pata_oldpiix.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25659@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
25660 ATA_BMDMA_SHT(DRV_NAME),
25661 };
25662
25663-static struct ata_port_operations oldpiix_pata_ops = {
25664+static const struct ata_port_operations oldpiix_pata_ops = {
25665 .inherits = &ata_bmdma_port_ops,
25666 .qc_issue = oldpiix_qc_issue,
25667 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25668diff -urNp linux-2.6.39/drivers/ata/pata_opti.c linux-2.6.39/drivers/ata/pata_opti.c
25669--- linux-2.6.39/drivers/ata/pata_opti.c 2011-05-19 00:06:34.000000000 -0400
25670+++ linux-2.6.39/drivers/ata/pata_opti.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25671@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
25672 ATA_PIO_SHT(DRV_NAME),
25673 };
25674
25675-static struct ata_port_operations opti_port_ops = {
25676+static const struct ata_port_operations opti_port_ops = {
25677 .inherits = &ata_sff_port_ops,
25678 .cable_detect = ata_cable_40wire,
25679 .set_piomode = opti_set_piomode,
66a7e928
MT		 25680diff -urNp linux-2.6.39/drivers/ata/pata_optidma.c linux-2.6.39/drivers/ata/pata_optidma.c
25681--- linux-2.6.39/drivers/ata/pata_optidma.c 2011-05-19 00:06:34.000000000 -0400
25682+++ linux-2.6.39/drivers/ata/pata_optidma.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25683@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
25684 ATA_BMDMA_SHT(DRV_NAME),
25685 };
25686
25687-static struct ata_port_operations optidma_port_ops = {
25688+static const struct ata_port_operations optidma_port_ops = {
25689 .inherits = &ata_bmdma_port_ops,
25690 .cable_detect = ata_cable_40wire,
25691 .set_piomode = optidma_set_pio_mode,
25692@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
25693 .prereset = optidma_pre_reset,
25694 };
25695
25696-static struct ata_port_operations optiplus_port_ops = {
25697+static const struct ata_port_operations optiplus_port_ops = {
25698 .inherits = &optidma_port_ops,
25699 .set_piomode = optiplus_set_pio_mode,
25700 .set_dmamode = optiplus_set_dma_mode,
66a7e928
MT		 25701diff -urNp linux-2.6.39/drivers/ata/pata_palmld.c linux-2.6.39/drivers/ata/pata_palmld.c
25702--- linux-2.6.39/drivers/ata/pata_palmld.c 2011-05-19 00:06:34.000000000 -0400
25703+++ linux-2.6.39/drivers/ata/pata_palmld.c 2011-05-22 19:36:31.000000000 -0400
25704@@ -42,7 +42,7 @@ static struct scsi_host_template palmld_
ae4e228f
MT		 25705 ATA_PIO_SHT(DRV_NAME),
25706 };
25707
25708-static struct ata_port_operations palmld_port_ops = {
25709+static const struct ata_port_operations palmld_port_ops = {
25710 .inherits = &ata_sff_port_ops,
25711 .sff_data_xfer = ata_sff_data_xfer_noirq,
25712 .cable_detect = ata_cable_40wire,
66a7e928
MT		 25713diff -urNp linux-2.6.39/drivers/ata/pata_pcmcia.c linux-2.6.39/drivers/ata/pata_pcmcia.c
25714--- linux-2.6.39/drivers/ata/pata_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
25715+++ linux-2.6.39/drivers/ata/pata_pcmcia.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 25716@@ -151,14 +151,14 @@ static struct scsi_host_template pcmcia_
ae4e228f
MT		 25717 ATA_PIO_SHT(DRV_NAME),
25718 };
25719
25720-static struct ata_port_operations pcmcia_port_ops = {
25721+static const struct ata_port_operations pcmcia_port_ops = {
25722 .inherits = &ata_sff_port_ops,
25723 .sff_data_xfer = ata_sff_data_xfer_noirq,
25724 .cable_detect = ata_cable_40wire,
25725 .set_mode = pcmcia_set_mode,
25726 };
25727
25728-static struct ata_port_operations pcmcia_8bit_port_ops = {
25729+static const struct ata_port_operations pcmcia_8bit_port_ops = {
25730 .inherits = &ata_sff_port_ops,
25731 .sff_data_xfer = ata_data_xfer_8bit,
25732 .cable_detect = ata_cable_40wire,
bc901d79 25733@@ -205,7 +205,7 @@ static int pcmcia_init_one(struct pcmcia
ae4e228f
MT		 25734 unsigned long io_base, ctl_base;
25735 void __iomem *io_addr, *ctl_addr;
25736 int n_ports = 1;
25737- struct ata_port_operations *ops = &pcmcia_port_ops;
25738+ const struct ata_port_operations *ops = &pcmcia_port_ops;
25739
57199397 25740 /* Set up attributes in order to probe card and get resources */
bc901d79 25741 pdev->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO |
66a7e928
MT		 25742diff -urNp linux-2.6.39/drivers/ata/pata_pdc2027x.c linux-2.6.39/drivers/ata/pata_pdc2027x.c
25743--- linux-2.6.39/drivers/ata/pata_pdc2027x.c 2011-05-19 00:06:34.000000000 -0400
25744+++ linux-2.6.39/drivers/ata/pata_pdc2027x.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25745@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
25746 ATA_BMDMA_SHT(DRV_NAME),
25747 };
25748
25749-static struct ata_port_operations pdc2027x_pata100_ops = {
25750+static const struct ata_port_operations pdc2027x_pata100_ops = {
25751 .inherits = &ata_bmdma_port_ops,
25752 .check_atapi_dma = pdc2027x_check_atapi_dma,
25753 .cable_detect = pdc2027x_cable_detect,
25754 .prereset = pdc2027x_prereset,
25755 };
25756
25757-static struct ata_port_operations pdc2027x_pata133_ops = {
25758+static const struct ata_port_operations pdc2027x_pata133_ops = {
25759 .inherits = &pdc2027x_pata100_ops,
25760 .mode_filter = pdc2027x_mode_filter,
25761 .set_piomode = pdc2027x_set_piomode,
66a7e928
MT		 25762diff -urNp linux-2.6.39/drivers/ata/pata_pdc202xx_old.c linux-2.6.39/drivers/ata/pata_pdc202xx_old.c
25763--- linux-2.6.39/drivers/ata/pata_pdc202xx_old.c 2011-05-19 00:06:34.000000000 -0400
25764+++ linux-2.6.39/drivers/ata/pata_pdc202xx_old.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 25765@@ -295,7 +295,7 @@ static struct scsi_host_template pdc202x
ae4e228f
MT		 25766 ATA_BMDMA_SHT(DRV_NAME),
25767 };
25768
25769-static struct ata_port_operations pdc2024x_port_ops = {
25770+static const struct ata_port_operations pdc2024x_port_ops = {
25771 .inherits = &ata_bmdma_port_ops,
25772
25773 .cable_detect = ata_cable_40wire,
bc901d79
MT		 25774@@ -306,7 +306,7 @@ static struct ata_port_operations pdc202
25775 .sff_irq_check = pdc202xx_irq_check,
ae4e228f
MT		 25776 };
25777
25778-static struct ata_port_operations pdc2026x_port_ops = {
25779+static const struct ata_port_operations pdc2026x_port_ops = {
25780 .inherits = &pdc2024x_port_ops,
25781
25782 .check_atapi_dma = pdc2026x_check_atapi_dma,
66a7e928
MT		 25783diff -urNp linux-2.6.39/drivers/ata/pata_piccolo.c linux-2.6.39/drivers/ata/pata_piccolo.c
25784--- linux-2.6.39/drivers/ata/pata_piccolo.c 2011-05-19 00:06:34.000000000 -0400
25785+++ linux-2.6.39/drivers/ata/pata_piccolo.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25786@@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
25787 ATA_BMDMA_SHT(DRV_NAME),
25788 };
25789
25790-static struct ata_port_operations tosh_port_ops = {
25791+static const struct ata_port_operations tosh_port_ops = {
25792 .inherits = &ata_bmdma_port_ops,
25793 .cable_detect = ata_cable_unknown,
25794 .set_piomode = tosh_set_piomode,
66a7e928
MT		 25795diff -urNp linux-2.6.39/drivers/ata/pata_platform.c linux-2.6.39/drivers/ata/pata_platform.c
25796--- linux-2.6.39/drivers/ata/pata_platform.c 2011-05-19 00:06:34.000000000 -0400
25797+++ linux-2.6.39/drivers/ata/pata_platform.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25798@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
25799 ATA_PIO_SHT(DRV_NAME),
25800 };
25801
25802-static struct ata_port_operations pata_platform_port_ops = {
25803+static const struct ata_port_operations pata_platform_port_ops = {
25804 .inherits = &ata_sff_port_ops,
25805 .sff_data_xfer = ata_sff_data_xfer_noirq,
25806 .cable_detect = ata_cable_unknown,
66a7e928
MT		 25807diff -urNp linux-2.6.39/drivers/ata/pata_pxa.c linux-2.6.39/drivers/ata/pata_pxa.c
25808--- linux-2.6.39/drivers/ata/pata_pxa.c 2011-05-19 00:06:34.000000000 -0400
25809+++ linux-2.6.39/drivers/ata/pata_pxa.c 2011-05-22 19:36:31.000000000 -0400
6892158b
MT		 25810@@ -198,7 +198,7 @@ static struct scsi_host_template pxa_ata
25811 ATA_BMDMA_SHT(DRV_NAME),
25812 };
25813
25814-static struct ata_port_operations pxa_ata_port_ops = {
25815+static const struct ata_port_operations pxa_ata_port_ops = {
25816 .inherits = &ata_bmdma_port_ops,
25817 .cable_detect = ata_cable_40wire,
25818
66a7e928
MT		 25819diff -urNp linux-2.6.39/drivers/ata/pata_qdi.c linux-2.6.39/drivers/ata/pata_qdi.c
25820--- linux-2.6.39/drivers/ata/pata_qdi.c 2011-05-19 00:06:34.000000000 -0400
25821+++ linux-2.6.39/drivers/ata/pata_qdi.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25822@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
25823 ATA_PIO_SHT(DRV_NAME),
25824 };
25825
25826-static struct ata_port_operations qdi6500_port_ops = {
25827+static const struct ata_port_operations qdi6500_port_ops = {
25828 .inherits = &ata_sff_port_ops,
25829 .qc_issue = qdi_qc_issue,
25830 .sff_data_xfer = qdi_data_xfer,
25831@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
25832 .set_piomode = qdi6500_set_piomode,
25833 };
25834
25835-static struct ata_port_operations qdi6580_port_ops = {
25836+static const struct ata_port_operations qdi6580_port_ops = {
25837 .inherits = &qdi6500_port_ops,
25838 .set_piomode = qdi6580_set_piomode,
25839 };
66a7e928
MT		 25840diff -urNp linux-2.6.39/drivers/ata/pata_radisys.c linux-2.6.39/drivers/ata/pata_radisys.c
25841--- linux-2.6.39/drivers/ata/pata_radisys.c 2011-05-19 00:06:34.000000000 -0400
25842+++ linux-2.6.39/drivers/ata/pata_radisys.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25843@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
25844 ATA_BMDMA_SHT(DRV_NAME),
25845 };
25846
25847-static struct ata_port_operations radisys_pata_ops = {
25848+static const struct ata_port_operations radisys_pata_ops = {
25849 .inherits = &ata_bmdma_port_ops,
25850 .qc_issue = radisys_qc_issue,
25851 .cable_detect = ata_cable_unknown,
66a7e928
MT		 25852diff -urNp linux-2.6.39/drivers/ata/pata_rb532_cf.c linux-2.6.39/drivers/ata/pata_rb532_cf.c
25853--- linux-2.6.39/drivers/ata/pata_rb532_cf.c 2011-05-19 00:06:34.000000000 -0400
25854+++ linux-2.6.39/drivers/ata/pata_rb532_cf.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25855@@ -69,7 +69,7 @@ static irqreturn_t rb532_pata_irq_handle
ae4e228f
MT		 25856 return IRQ_HANDLED;
25857 }
25858
25859-static struct ata_port_operations rb532_pata_port_ops = {
25860+static const struct ata_port_operations rb532_pata_port_ops = {
25861 .inherits = &ata_sff_port_ops,
25862 .sff_data_xfer = ata_sff_data_xfer32,
25863 };
66a7e928
MT		 25864diff -urNp linux-2.6.39/drivers/ata/pata_rdc.c linux-2.6.39/drivers/ata/pata_rdc.c
25865--- linux-2.6.39/drivers/ata/pata_rdc.c 2011-05-19 00:06:34.000000000 -0400
25866+++ linux-2.6.39/drivers/ata/pata_rdc.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25867@@ -273,7 +273,7 @@ static void rdc_set_dmamode(struct ata_p
ae4e228f
MT		 25868 pci_write_config_byte(dev, 0x48, udma_enable);
25869 }
25870
25871-static struct ata_port_operations rdc_pata_ops = {
25872+static const struct ata_port_operations rdc_pata_ops = {
25873 .inherits = &ata_bmdma32_port_ops,
25874 .cable_detect = rdc_pata_cable_detect,
25875 .set_piomode = rdc_set_piomode,
66a7e928
MT		 25876diff -urNp linux-2.6.39/drivers/ata/pata_rz1000.c linux-2.6.39/drivers/ata/pata_rz1000.c
25877--- linux-2.6.39/drivers/ata/pata_rz1000.c 2011-05-19 00:06:34.000000000 -0400
25878+++ linux-2.6.39/drivers/ata/pata_rz1000.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25879@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
25880 ATA_PIO_SHT(DRV_NAME),
25881 };
25882
25883-static struct ata_port_operations rz1000_port_ops = {
25884+static const struct ata_port_operations rz1000_port_ops = {
25885 .inherits = &ata_sff_port_ops,
25886 .cable_detect = ata_cable_40wire,
25887 .set_mode = rz1000_set_mode,
66a7e928
MT		 25888diff -urNp linux-2.6.39/drivers/ata/pata_samsung_cf.c linux-2.6.39/drivers/ata/pata_samsung_cf.c
25889--- linux-2.6.39/drivers/ata/pata_samsung_cf.c 2011-05-19 00:06:34.000000000 -0400
25890+++ linux-2.6.39/drivers/ata/pata_samsung_cf.c 2011-05-22 19:36:31.000000000 -0400
6892158b
MT		 25891@@ -399,7 +399,7 @@ static struct scsi_host_template pata_s3
25892 ATA_PIO_SHT(DRV_NAME),
25893 };
25894
25895-static struct ata_port_operations pata_s3c_port_ops = {
25896+static const struct ata_port_operations pata_s3c_port_ops = {
25897 .inherits = &ata_sff_port_ops,
25898 .sff_check_status = pata_s3c_check_status,
25899 .sff_check_altstatus = pata_s3c_check_altstatus,
25900@@ -413,7 +413,7 @@ static struct ata_port_operations pata_s
25901 .set_piomode = pata_s3c_set_piomode,
25902 };
25903
25904-static struct ata_port_operations pata_s5p_port_ops = {
25905+static const struct ata_port_operations pata_s5p_port_ops = {
25906 .inherits = &ata_sff_port_ops,
25907 .set_piomode = pata_s3c_set_piomode,
25908 };
66a7e928
MT		 25909diff -urNp linux-2.6.39/drivers/ata/pata_sc1200.c linux-2.6.39/drivers/ata/pata_sc1200.c
25910--- linux-2.6.39/drivers/ata/pata_sc1200.c 2011-05-19 00:06:34.000000000 -0400
25911+++ linux-2.6.39/drivers/ata/pata_sc1200.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25912@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
25913 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25914 };
25915
25916-static struct ata_port_operations sc1200_port_ops = {
25917+static const struct ata_port_operations sc1200_port_ops = {
25918 .inherits = &ata_bmdma_port_ops,
57199397 25919 .qc_prep = ata_bmdma_dumb_qc_prep,
ae4e228f 25920 .qc_issue = sc1200_qc_issue,
66a7e928
MT		 25921diff -urNp linux-2.6.39/drivers/ata/pata_scc.c linux-2.6.39/drivers/ata/pata_scc.c
25922--- linux-2.6.39/drivers/ata/pata_scc.c 2011-05-19 00:06:34.000000000 -0400
25923+++ linux-2.6.39/drivers/ata/pata_scc.c 2011-05-22 19:36:31.000000000 -0400
6892158b 25924@@ -926,7 +926,7 @@ static struct scsi_host_template scc_sht
ae4e228f
MT		 25925 ATA_BMDMA_SHT(DRV_NAME),
25926 };
25927
25928-static struct ata_port_operations scc_pata_ops = {
25929+static const struct ata_port_operations scc_pata_ops = {
25930 .inherits = &ata_bmdma_port_ops,
25931
25932 .set_piomode = scc_set_piomode,
66a7e928
MT		 25933diff -urNp linux-2.6.39/drivers/ata/pata_sch.c linux-2.6.39/drivers/ata/pata_sch.c
25934--- linux-2.6.39/drivers/ata/pata_sch.c 2011-05-19 00:06:34.000000000 -0400
25935+++ linux-2.6.39/drivers/ata/pata_sch.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25936@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
25937 ATA_BMDMA_SHT(DRV_NAME),
25938 };
25939
25940-static struct ata_port_operations sch_pata_ops = {
25941+static const struct ata_port_operations sch_pata_ops = {
25942 .inherits = &ata_bmdma_port_ops,
25943 .cable_detect = ata_cable_unknown,
25944 .set_piomode = sch_set_piomode,
66a7e928
MT		 25945diff -urNp linux-2.6.39/drivers/ata/pata_serverworks.c linux-2.6.39/drivers/ata/pata_serverworks.c
25946--- linux-2.6.39/drivers/ata/pata_serverworks.c 2011-05-19 00:06:34.000000000 -0400
25947+++ linux-2.6.39/drivers/ata/pata_serverworks.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 25948@@ -300,7 +300,7 @@ static struct scsi_host_template serverw
ae4e228f
MT		 25949 ATA_BMDMA_SHT(DRV_NAME),
25950 };
25951
25952-static struct ata_port_operations serverworks_osb4_port_ops = {
25953+static const struct ata_port_operations serverworks_osb4_port_ops = {
25954 .inherits = &ata_bmdma_port_ops,
25955 .cable_detect = serverworks_cable_detect,
25956 .mode_filter = serverworks_osb4_filter,
df50ba0c 25957@@ -308,7 +308,7 @@ static struct ata_port_operations server
ae4e228f
MT		 25958 .set_dmamode = serverworks_set_dmamode,
25959 };
25960
25961-static struct ata_port_operations serverworks_csb_port_ops = {
25962+static const struct ata_port_operations serverworks_csb_port_ops = {
25963 .inherits = &serverworks_osb4_port_ops,
25964 .mode_filter = serverworks_csb_filter,
25965 };
66a7e928
MT		 25966diff -urNp linux-2.6.39/drivers/ata/pata_sil680.c linux-2.6.39/drivers/ata/pata_sil680.c
25967--- linux-2.6.39/drivers/ata/pata_sil680.c 2011-05-19 00:06:34.000000000 -0400
25968+++ linux-2.6.39/drivers/ata/pata_sil680.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 25969@@ -225,8 +225,7 @@ static struct scsi_host_template sil680_
ae4e228f
MT		 25970 ATA_BMDMA_SHT(DRV_NAME),
25971 };
25972
57199397 25973-
ae4e228f
MT		 25974-static struct ata_port_operations sil680_port_ops = {
25975+static const struct ata_port_operations sil680_port_ops = {
57199397
MT		 25976 .inherits = &ata_bmdma32_port_ops,
25977 .sff_exec_command = sil680_sff_exec_command,
bc901d79 25978 .sff_irq_check = sil680_sff_irq_check,
66a7e928
MT		 25979diff -urNp linux-2.6.39/drivers/ata/pata_sis.c linux-2.6.39/drivers/ata/pata_sis.c
25980--- linux-2.6.39/drivers/ata/pata_sis.c 2011-05-19 00:06:34.000000000 -0400
25981+++ linux-2.6.39/drivers/ata/pata_sis.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 25982@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
25983 ATA_BMDMA_SHT(DRV_NAME),
25984 };
25985
25986-static struct ata_port_operations sis_133_for_sata_ops = {
25987+static const struct ata_port_operations sis_133_for_sata_ops = {
25988 .inherits = &ata_bmdma_port_ops,
25989 .set_piomode = sis_133_set_piomode,
25990 .set_dmamode = sis_133_set_dmamode,
25991 .cable_detect = sis_133_cable_detect,
25992 };
25993
25994-static struct ata_port_operations sis_base_ops = {
25995+static const struct ata_port_operations sis_base_ops = {
25996 .inherits = &ata_bmdma_port_ops,
25997 .prereset = sis_pre_reset,
25998 };
25999
26000-static struct ata_port_operations sis_133_ops = {
26001+static const struct ata_port_operations sis_133_ops = {
26002 .inherits = &sis_base_ops,
26003 .set_piomode = sis_133_set_piomode,
26004 .set_dmamode = sis_133_set_dmamode,
26005 .cable_detect = sis_133_cable_detect,
26006 };
26007
26008-static struct ata_port_operations sis_133_early_ops = {
26009+static const struct ata_port_operations sis_133_early_ops = {
26010 .inherits = &sis_base_ops,
26011 .set_piomode = sis_100_set_piomode,
26012 .set_dmamode = sis_133_early_set_dmamode,
26013 .cable_detect = sis_66_cable_detect,
26014 };
26015
26016-static struct ata_port_operations sis_100_ops = {
26017+static const struct ata_port_operations sis_100_ops = {
26018 .inherits = &sis_base_ops,
26019 .set_piomode = sis_100_set_piomode,
26020 .set_dmamode = sis_100_set_dmamode,
26021 .cable_detect = sis_66_cable_detect,
26022 };
26023
26024-static struct ata_port_operations sis_66_ops = {
26025+static const struct ata_port_operations sis_66_ops = {
26026 .inherits = &sis_base_ops,
26027 .set_piomode = sis_old_set_piomode,
26028 .set_dmamode = sis_66_set_dmamode,
26029 .cable_detect = sis_66_cable_detect,
26030 };
26031
26032-static struct ata_port_operations sis_old_ops = {
26033+static const struct ata_port_operations sis_old_ops = {
26034 .inherits = &sis_base_ops,
26035 .set_piomode = sis_old_set_piomode,
26036 .set_dmamode = sis_old_set_dmamode,
66a7e928
MT		 26037diff -urNp linux-2.6.39/drivers/ata/pata_sl82c105.c linux-2.6.39/drivers/ata/pata_sl82c105.c
26038--- linux-2.6.39/drivers/ata/pata_sl82c105.c 2011-05-19 00:06:34.000000000 -0400
26039+++ linux-2.6.39/drivers/ata/pata_sl82c105.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 26040@@ -241,7 +241,7 @@ static struct scsi_host_template sl82c10
ae4e228f
MT		 26041 ATA_BMDMA_SHT(DRV_NAME),
26042 };
26043
26044-static struct ata_port_operations sl82c105_port_ops = {
26045+static const struct ata_port_operations sl82c105_port_ops = {
26046 .inherits = &ata_bmdma_port_ops,
26047 .qc_defer = sl82c105_qc_defer,
26048 .bmdma_start = sl82c105_bmdma_start,
66a7e928
MT		 26049diff -urNp linux-2.6.39/drivers/ata/pata_triflex.c linux-2.6.39/drivers/ata/pata_triflex.c
26050--- linux-2.6.39/drivers/ata/pata_triflex.c 2011-05-19 00:06:34.000000000 -0400
26051+++ linux-2.6.39/drivers/ata/pata_triflex.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 26052@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
26053 ATA_BMDMA_SHT(DRV_NAME),
26054 };
26055
26056-static struct ata_port_operations triflex_port_ops = {
26057+static const struct ata_port_operations triflex_port_ops = {
26058 .inherits = &ata_bmdma_port_ops,
26059 .bmdma_start = triflex_bmdma_start,
26060 .bmdma_stop = triflex_bmdma_stop,
66a7e928
MT		 26061diff -urNp linux-2.6.39/drivers/ata/pata_via.c linux-2.6.39/drivers/ata/pata_via.c
26062--- linux-2.6.39/drivers/ata/pata_via.c 2011-05-19 00:06:34.000000000 -0400
26063+++ linux-2.6.39/drivers/ata/pata_via.c 2011-05-22 19:36:31.000000000 -0400
6892158b 26064@@ -441,7 +441,7 @@ static struct scsi_host_template via_sht
ae4e228f
MT		 26065 ATA_BMDMA_SHT(DRV_NAME),
26066 };
26067
26068-static struct ata_port_operations via_port_ops = {
26069+static const struct ata_port_operations via_port_ops = {
26070 .inherits = &ata_bmdma_port_ops,
26071 .cable_detect = via_cable_detect,
26072 .set_piomode = via_set_piomode,
6892158b 26073@@ -452,7 +452,7 @@ static struct ata_port_operations via_po
ae4e228f
MT		 26074 .mode_filter = via_mode_filter,
26075 };
26076
26077-static struct ata_port_operations via_port_ops_noirq = {
26078+static const struct ata_port_operations via_port_ops_noirq = {
26079 .inherits = &via_port_ops,
26080 .sff_data_xfer = ata_sff_data_xfer_noirq,
26081 };
66a7e928
MT		 26082diff -urNp linux-2.6.39/drivers/ata/pdc_adma.c linux-2.6.39/drivers/ata/pdc_adma.c
26083--- linux-2.6.39/drivers/ata/pdc_adma.c 2011-05-19 00:06:34.000000000 -0400
26084+++ linux-2.6.39/drivers/ata/pdc_adma.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26085@@ -146,7 +146,7 @@ static struct scsi_host_template adma_at
ae4e228f
MT		 26086 .dma_boundary = ADMA_DMA_BOUNDARY,
26087 };
26088
26089-static struct ata_port_operations adma_ata_ops = {
26090+static const struct ata_port_operations adma_ata_ops = {
26091 .inherits = &ata_sff_port_ops,
26092
26093 .lost_interrupt = ATA_OP_NULL,
66a7e928
MT		 26094diff -urNp linux-2.6.39/drivers/ata/sata_dwc_460ex.c linux-2.6.39/drivers/ata/sata_dwc_460ex.c
26095--- linux-2.6.39/drivers/ata/sata_dwc_460ex.c 2011-05-19 00:06:34.000000000 -0400
26096+++ linux-2.6.39/drivers/ata/sata_dwc_460ex.c 2011-05-22 19:36:31.000000000 -0400
26097@@ -1598,7 +1598,7 @@ static struct scsi_host_template sata_dw
6892158b
MT		 26098 .dma_boundary = ATA_DMA_BOUNDARY,
26099 };
26100
26101-static struct ata_port_operations sata_dwc_ops = {
26102+static const struct ata_port_operations sata_dwc_ops = {
26103 .inherits = &ata_sff_port_ops,
26104
26105 .error_handler = sata_dwc_error_handler,
66a7e928
MT		 26106diff -urNp linux-2.6.39/drivers/ata/sata_fsl.c linux-2.6.39/drivers/ata/sata_fsl.c
26107--- linux-2.6.39/drivers/ata/sata_fsl.c 2011-05-19 00:06:34.000000000 -0400
26108+++ linux-2.6.39/drivers/ata/sata_fsl.c 2011-05-22 19:36:31.000000000 -0400
26109@@ -1268,7 +1268,7 @@ static struct scsi_host_template sata_fs
ae4e228f
MT		 26110 .dma_boundary = ATA_DMA_BOUNDARY,
26111 };
26112
26113-static struct ata_port_operations sata_fsl_ops = {
26114+static const struct ata_port_operations sata_fsl_ops = {
26115 .inherits = &sata_pmp_port_ops,
26116
26117 .qc_defer = ata_std_qc_defer,
66a7e928
MT		 26118diff -urNp linux-2.6.39/drivers/ata/sata_inic162x.c linux-2.6.39/drivers/ata/sata_inic162x.c
26119--- linux-2.6.39/drivers/ata/sata_inic162x.c 2011-05-19 00:06:34.000000000 -0400
26120+++ linux-2.6.39/drivers/ata/sata_inic162x.c 2011-05-22 19:36:31.000000000 -0400
57199397 26121@@ -705,7 +705,7 @@ static int inic_port_start(struct ata_po
ae4e228f
MT		 26122 return 0;
26123 }
26124
26125-static struct ata_port_operations inic_port_ops = {
26126+static const struct ata_port_operations inic_port_ops = {
26127 .inherits = &sata_port_ops,
26128
26129 .check_atapi_dma = inic_check_atapi_dma,
66a7e928
MT		 26130diff -urNp linux-2.6.39/drivers/ata/sata_mv.c linux-2.6.39/drivers/ata/sata_mv.c
26131--- linux-2.6.39/drivers/ata/sata_mv.c 2011-05-19 00:06:34.000000000 -0400
26132+++ linux-2.6.39/drivers/ata/sata_mv.c 2011-05-22 19:36:31.000000000 -0400
26133@@ -662,7 +662,7 @@ static struct scsi_host_template mv6_sht
ae4e228f
MT		 26134 .dma_boundary = MV_DMA_BOUNDARY,
26135 };
26136
26137-static struct ata_port_operations mv5_ops = {
26138+static const struct ata_port_operations mv5_ops = {
26139 .inherits = &ata_sff_port_ops,
26140
26141 .lost_interrupt = ATA_OP_NULL,
66a7e928 26142@@ -682,7 +682,7 @@ static struct ata_port_operations mv5_op
ae4e228f
MT		 26143 .port_stop = mv_port_stop,
26144 };
26145
26146-static struct ata_port_operations mv6_ops = {
26147+static const struct ata_port_operations mv6_ops = {
57199397
MT		 26148 .inherits = &ata_bmdma_port_ops,
26149
26150 .lost_interrupt = ATA_OP_NULL,
66a7e928 26151@@ -716,7 +716,7 @@ static struct ata_port_operations mv6_op
57199397 26152 .port_stop = mv_port_stop,
ae4e228f
MT		 26153 };
26154
26155-static struct ata_port_operations mv_iie_ops = {
26156+static const struct ata_port_operations mv_iie_ops = {
26157 .inherits = &mv6_ops,
26158 .dev_config = ATA_OP_NULL,
26159 .qc_prep = mv_qc_prep_iie,
66a7e928
MT		 26160diff -urNp linux-2.6.39/drivers/ata/sata_nv.c linux-2.6.39/drivers/ata/sata_nv.c
26161--- linux-2.6.39/drivers/ata/sata_nv.c 2011-05-19 00:06:34.000000000 -0400
26162+++ linux-2.6.39/drivers/ata/sata_nv.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26163@@ -465,7 +465,7 @@ static struct scsi_host_template nv_swnc
ae4e228f
MT		 26164 * cases. Define nv_hardreset() which only kicks in for post-boot
26165 * probing and use it for all variants.
26166 */
26167-static struct ata_port_operations nv_generic_ops = {
26168+static const struct ata_port_operations nv_generic_ops = {
26169 .inherits = &ata_bmdma_port_ops,
26170 .lost_interrupt = ATA_OP_NULL,
26171 .scr_read = nv_scr_read,
df50ba0c 26172@@ -473,20 +473,20 @@ static struct ata_port_operations nv_gen
ae4e228f
MT		 26173 .hardreset = nv_hardreset,
26174 };
26175
26176-static struct ata_port_operations nv_nf2_ops = {
26177+static const struct ata_port_operations nv_nf2_ops = {
26178 .inherits = &nv_generic_ops,
26179 .freeze = nv_nf2_freeze,
26180 .thaw = nv_nf2_thaw,
26181 };
26182
26183-static struct ata_port_operations nv_ck804_ops = {
26184+static const struct ata_port_operations nv_ck804_ops = {
26185 .inherits = &nv_generic_ops,
26186 .freeze = nv_ck804_freeze,
26187 .thaw = nv_ck804_thaw,
26188 .host_stop = nv_ck804_host_stop,
26189 };
26190
26191-static struct ata_port_operations nv_adma_ops = {
26192+static const struct ata_port_operations nv_adma_ops = {
26193 .inherits = &nv_ck804_ops,
26194
26195 .check_atapi_dma = nv_adma_check_atapi_dma,
df50ba0c 26196@@ -510,7 +510,7 @@ static struct ata_port_operations nv_adm
ae4e228f
MT		 26197 .host_stop = nv_adma_host_stop,
26198 };
26199
26200-static struct ata_port_operations nv_swncq_ops = {
26201+static const struct ata_port_operations nv_swncq_ops = {
26202 .inherits = &nv_generic_ops,
26203
26204 .qc_defer = ata_std_qc_defer,
66a7e928
MT		 26205diff -urNp linux-2.6.39/drivers/ata/sata_promise.c linux-2.6.39/drivers/ata/sata_promise.c
26206--- linux-2.6.39/drivers/ata/sata_promise.c 2011-05-19 00:06:34.000000000 -0400
26207+++ linux-2.6.39/drivers/ata/sata_promise.c 2011-05-22 19:36:31.000000000 -0400
26208@@ -194,7 +194,7 @@ static const struct ata_port_operations
ae4e228f
MT		 26209 .error_handler = pdc_error_handler,
26210 };
26211
26212-static struct ata_port_operations pdc_sata_ops = {
26213+static const struct ata_port_operations pdc_sata_ops = {
26214 .inherits = &pdc_common_ops,
26215 .cable_detect = pdc_sata_cable_detect,
26216 .freeze = pdc_sata_freeze,
66a7e928 26217@@ -207,14 +207,14 @@ static struct ata_port_operations pdc_sa
ae4e228f
MT		 26218
26219 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26220 and ->freeze/thaw that ignore the hotplug controls. */
26221-static struct ata_port_operations pdc_old_sata_ops = {
26222+static const struct ata_port_operations pdc_old_sata_ops = {
26223 .inherits = &pdc_sata_ops,
26224 .freeze = pdc_freeze,
26225 .thaw = pdc_thaw,
26226 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26227 };
26228
26229-static struct ata_port_operations pdc_pata_ops = {
26230+static const struct ata_port_operations pdc_pata_ops = {
26231 .inherits = &pdc_common_ops,
26232 .cable_detect = pdc_pata_cable_detect,
26233 .freeze = pdc_freeze,
66a7e928
MT		 26234diff -urNp linux-2.6.39/drivers/ata/sata_qstor.c linux-2.6.39/drivers/ata/sata_qstor.c
26235--- linux-2.6.39/drivers/ata/sata_qstor.c 2011-05-19 00:06:34.000000000 -0400
26236+++ linux-2.6.39/drivers/ata/sata_qstor.c 2011-05-22 19:36:31.000000000 -0400
57199397 26237@@ -131,7 +131,7 @@ static struct scsi_host_template qs_ata_
ae4e228f
MT		 26238 .dma_boundary = QS_DMA_BOUNDARY,
26239 };
26240
26241-static struct ata_port_operations qs_ata_ops = {
26242+static const struct ata_port_operations qs_ata_ops = {
26243 .inherits = &ata_sff_port_ops,
26244
26245 .check_atapi_dma = qs_check_atapi_dma,
66a7e928
MT		 26246diff -urNp linux-2.6.39/drivers/ata/sata_sil24.c linux-2.6.39/drivers/ata/sata_sil24.c
26247--- linux-2.6.39/drivers/ata/sata_sil24.c 2011-05-19 00:06:34.000000000 -0400
26248+++ linux-2.6.39/drivers/ata/sata_sil24.c 2011-05-22 19:36:31.000000000 -0400
26249@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
efbe55a5
MT		 26250 .dma_boundary = ATA_DMA_BOUNDARY,
26251 };
26252
26253-static struct ata_port_operations sil24_ops = {
26254+static const struct ata_port_operations sil24_ops = {
26255 .inherits = &sata_pmp_port_ops,
26256
26257 .qc_defer = sil24_qc_defer,
66a7e928
MT		 26258diff -urNp linux-2.6.39/drivers/ata/sata_sil.c linux-2.6.39/drivers/ata/sata_sil.c
26259--- linux-2.6.39/drivers/ata/sata_sil.c 2011-05-19 00:06:34.000000000 -0400
26260+++ linux-2.6.39/drivers/ata/sata_sil.c 2011-05-22 19:36:31.000000000 -0400
26261@@ -181,7 +181,7 @@ static struct scsi_host_template sil_sht
57199397
MT		 26262 .sg_tablesize = ATA_MAX_PRD
26263 };
26264
26265-static struct ata_port_operations sil_ops = {
26266+static const struct ata_port_operations sil_ops = {
26267 .inherits = &ata_bmdma32_port_ops,
26268 .dev_config = sil_dev_config,
26269 .set_mode = sil_set_mode,
66a7e928
MT		 26270diff -urNp linux-2.6.39/drivers/ata/sata_sis.c linux-2.6.39/drivers/ata/sata_sis.c
26271--- linux-2.6.39/drivers/ata/sata_sis.c 2011-05-19 00:06:34.000000000 -0400
26272+++ linux-2.6.39/drivers/ata/sata_sis.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 26273@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26274 ATA_BMDMA_SHT(DRV_NAME),
26275 };
26276
26277-static struct ata_port_operations sis_ops = {
26278+static const struct ata_port_operations sis_ops = {
26279 .inherits = &ata_bmdma_port_ops,
26280 .scr_read = sis_scr_read,
26281 .scr_write = sis_scr_write,
66a7e928
MT		 26282diff -urNp linux-2.6.39/drivers/ata/sata_svw.c linux-2.6.39/drivers/ata/sata_svw.c
26283--- linux-2.6.39/drivers/ata/sata_svw.c 2011-05-19 00:06:34.000000000 -0400
26284+++ linux-2.6.39/drivers/ata/sata_svw.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 26285@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26286 };
26287
26288
26289-static struct ata_port_operations k2_sata_ops = {
26290+static const struct ata_port_operations k2_sata_ops = {
26291 .inherits = &ata_bmdma_port_ops,
26292 .sff_tf_load = k2_sata_tf_load,
26293 .sff_tf_read = k2_sata_tf_read,
66a7e928
MT		 26294diff -urNp linux-2.6.39/drivers/ata/sata_sx4.c linux-2.6.39/drivers/ata/sata_sx4.c
26295--- linux-2.6.39/drivers/ata/sata_sx4.c 2011-05-19 00:06:34.000000000 -0400
26296+++ linux-2.6.39/drivers/ata/sata_sx4.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26297@@ -249,7 +249,7 @@ static struct scsi_host_template pdc_sat
ae4e228f
MT		 26298 };
26299
26300 /* TODO: inherit from base port_ops after converting to new EH */
26301-static struct ata_port_operations pdc_20621_ops = {
26302+static const struct ata_port_operations pdc_20621_ops = {
26303 .inherits = &ata_sff_port_ops,
26304
26305 .check_atapi_dma = pdc_check_atapi_dma,
66a7e928
MT		 26306diff -urNp linux-2.6.39/drivers/ata/sata_uli.c linux-2.6.39/drivers/ata/sata_uli.c
26307--- linux-2.6.39/drivers/ata/sata_uli.c 2011-05-19 00:06:34.000000000 -0400
26308+++ linux-2.6.39/drivers/ata/sata_uli.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26309@@ -80,7 +80,7 @@ static struct scsi_host_template uli_sht
ae4e228f
MT		 26310 ATA_BMDMA_SHT(DRV_NAME),
26311 };
26312
26313-static struct ata_port_operations uli_ops = {
26314+static const struct ata_port_operations uli_ops = {
26315 .inherits = &ata_bmdma_port_ops,
26316 .scr_read = uli_scr_read,
26317 .scr_write = uli_scr_write,
66a7e928
MT		 26318diff -urNp linux-2.6.39/drivers/ata/sata_via.c linux-2.6.39/drivers/ata/sata_via.c
26319--- linux-2.6.39/drivers/ata/sata_via.c 2011-05-19 00:06:34.000000000 -0400
26320+++ linux-2.6.39/drivers/ata/sata_via.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26321@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
ae4e228f
MT		 26322 ATA_BMDMA_SHT(DRV_NAME),
26323 };
26324
26325-static struct ata_port_operations svia_base_ops = {
26326+static const struct ata_port_operations svia_base_ops = {
26327 .inherits = &ata_bmdma_port_ops,
26328 .sff_tf_load = svia_tf_load,
26329 };
26330
26331-static struct ata_port_operations vt6420_sata_ops = {
26332+static const struct ata_port_operations vt6420_sata_ops = {
26333 .inherits = &svia_base_ops,
26334 .freeze = svia_noop_freeze,
26335 .prereset = vt6420_prereset,
df50ba0c 26336 .bmdma_start = vt6420_bmdma_start,
ae4e228f
MT		 26337 };
26338
26339-static struct ata_port_operations vt6421_pata_ops = {
26340+static const struct ata_port_operations vt6421_pata_ops = {
26341 .inherits = &svia_base_ops,
26342 .cable_detect = vt6421_pata_cable_detect,
26343 .set_piomode = vt6421_set_pio_mode,
26344 .set_dmamode = vt6421_set_dma_mode,
26345 };
26346
26347-static struct ata_port_operations vt6421_sata_ops = {
26348+static const struct ata_port_operations vt6421_sata_ops = {
26349 .inherits = &svia_base_ops,
26350 .scr_read = svia_scr_read,
26351 .scr_write = svia_scr_write,
26352 };
26353
26354-static struct ata_port_operations vt8251_ops = {
26355+static const struct ata_port_operations vt8251_ops = {
26356 .inherits = &svia_base_ops,
26357 .hardreset = sata_std_hardreset,
26358 .scr_read = vt8251_scr_read,
66a7e928
MT		 26359diff -urNp linux-2.6.39/drivers/ata/sata_vsc.c linux-2.6.39/drivers/ata/sata_vsc.c
26360--- linux-2.6.39/drivers/ata/sata_vsc.c 2011-05-19 00:06:34.000000000 -0400
26361+++ linux-2.6.39/drivers/ata/sata_vsc.c 2011-05-22 19:36:31.000000000 -0400
57199397 26362@@ -300,7 +300,7 @@ static struct scsi_host_template vsc_sat
ae4e228f
MT		 26363 };
26364
26365
26366-static struct ata_port_operations vsc_sata_ops = {
26367+static const struct ata_port_operations vsc_sata_ops = {
26368 .inherits = &ata_bmdma_port_ops,
26369 /* The IRQ handling is not quite standard SFF behaviour so we
26370 cannot use the default lost interrupt handler */
66a7e928
MT		 26371diff -urNp linux-2.6.39/drivers/atm/adummy.c linux-2.6.39/drivers/atm/adummy.c
26372--- linux-2.6.39/drivers/atm/adummy.c 2011-05-19 00:06:34.000000000 -0400
26373+++ linux-2.6.39/drivers/atm/adummy.c 2011-05-22 19:36:31.000000000 -0400
6892158b 26374@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
58c5fc13
MT		 26375 vcc->pop(vcc, skb);
26376 else
26377 dev_kfree_skb_any(skb);
26378- atomic_inc(&vcc->stats->tx);
26379+ atomic_inc_unchecked(&vcc->stats->tx);
26380
26381 return 0;
26382 }
66a7e928
MT		 26383diff -urNp linux-2.6.39/drivers/atm/ambassador.c linux-2.6.39/drivers/atm/ambassador.c
26384--- linux-2.6.39/drivers/atm/ambassador.c 2011-05-19 00:06:34.000000000 -0400
26385+++ linux-2.6.39/drivers/atm/ambassador.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26386@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
58c5fc13
MT		 26387 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
26388
26389 // VC layer stats
26390- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26391+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26392
26393 // free the descriptor
26394 kfree (tx_descr);
df50ba0c 26395@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
58c5fc13
MT		 26396 dump_skb ("<<<", vc, skb);
26397
26398 // VC layer stats
26399- atomic_inc(&atm_vcc->stats->rx);
26400+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26401 __net_timestamp(skb);
66a7e928 26402 // end of our responsibility
58c5fc13 26403 atm_vcc->push (atm_vcc, skb);
df50ba0c 26404@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
58c5fc13
MT		 26405 } else {
26406 PRINTK (KERN_INFO, "dropped over-size frame");
26407 // should we count this?
26408- atomic_inc(&atm_vcc->stats->rx_drop);
26409+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26410 }
26411
26412 } else {
df50ba0c 26413@@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
58c5fc13
MT		 26414 }
26415
26416 if (check_area (skb->data, skb->len)) {
26417- atomic_inc(&atm_vcc->stats->tx_err);
26418+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
26419 return -ENOMEM; // ?
26420 }
26421
66a7e928
MT		 26422diff -urNp linux-2.6.39/drivers/atm/atmtcp.c linux-2.6.39/drivers/atm/atmtcp.c
26423--- linux-2.6.39/drivers/atm/atmtcp.c 2011-05-19 00:06:34.000000000 -0400
26424+++ linux-2.6.39/drivers/atm/atmtcp.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26425@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
58c5fc13
MT		 26426 if (vcc->pop) vcc->pop(vcc,skb);
26427 else dev_kfree_skb(skb);
26428 if (dev_data) return 0;
26429- atomic_inc(&vcc->stats->tx_err);
26430+ atomic_inc_unchecked(&vcc->stats->tx_err);
26431 return -ENOLINK;
26432 }
26433 size = skb->len+sizeof(struct atmtcp_hdr);
df50ba0c 26434@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
58c5fc13
MT		 26435 if (!new_skb) {
26436 if (vcc->pop) vcc->pop(vcc,skb);
26437 else dev_kfree_skb(skb);
26438- atomic_inc(&vcc->stats->tx_err);
26439+ atomic_inc_unchecked(&vcc->stats->tx_err);
26440 return -ENOBUFS;
26441 }
26442 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
df50ba0c 26443@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
58c5fc13
MT		 26444 if (vcc->pop) vcc->pop(vcc,skb);
26445 else dev_kfree_skb(skb);
26446 out_vcc->push(out_vcc,new_skb);
26447- atomic_inc(&vcc->stats->tx);
26448- atomic_inc(&out_vcc->stats->rx);
26449+ atomic_inc_unchecked(&vcc->stats->tx);
26450+ atomic_inc_unchecked(&out_vcc->stats->rx);
26451 return 0;
26452 }
26453
df50ba0c 26454@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
58c5fc13
MT		 26455 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
26456 read_unlock(&vcc_sklist_lock);
26457 if (!out_vcc) {
26458- atomic_inc(&vcc->stats->tx_err);
26459+ atomic_inc_unchecked(&vcc->stats->tx_err);
26460 goto done;
26461 }
26462 skb_pull(skb,sizeof(struct atmtcp_hdr));
df50ba0c 26463@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
58c5fc13
MT		 26464 __net_timestamp(new_skb);
26465 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
26466 out_vcc->push(out_vcc,new_skb);
26467- atomic_inc(&vcc->stats->tx);
26468- atomic_inc(&out_vcc->stats->rx);
26469+ atomic_inc_unchecked(&vcc->stats->tx);
26470+ atomic_inc_unchecked(&out_vcc->stats->rx);
26471 done:
26472 if (vcc->pop) vcc->pop(vcc,skb);
26473 else dev_kfree_skb(skb);
66a7e928
MT		 26474diff -urNp linux-2.6.39/drivers/atm/eni.c linux-2.6.39/drivers/atm/eni.c
26475--- linux-2.6.39/drivers/atm/eni.c 2011-05-19 00:06:34.000000000 -0400
26476+++ linux-2.6.39/drivers/atm/eni.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26477@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
58c5fc13
MT		 26478 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
26479 vcc->dev->number);
26480 length = 0;
26481- atomic_inc(&vcc->stats->rx_err);
26482+ atomic_inc_unchecked(&vcc->stats->rx_err);
26483 }
26484 else {
26485 length = ATM_CELL_SIZE-1; /* no HEC */
df50ba0c 26486@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
58c5fc13
MT		 26487 size);
26488 }
26489 eff = length = 0;
26490- atomic_inc(&vcc->stats->rx_err);
26491+ atomic_inc_unchecked(&vcc->stats->rx_err);
26492 }
26493 else {
26494 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
df50ba0c 26495@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
58c5fc13
MT		 26496 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
26497 vcc->dev->number,vcc->vci,length,size << 2,descr);
26498 length = eff = 0;
26499- atomic_inc(&vcc->stats->rx_err);
26500+ atomic_inc_unchecked(&vcc->stats->rx_err);
26501 }
26502 }
26503 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
df50ba0c 26504@@ -771,7 +771,7 @@ rx_dequeued++;
58c5fc13
MT		 26505 vcc->push(vcc,skb);
26506 pushed++;
26507 }
26508- atomic_inc(&vcc->stats->rx);
26509+ atomic_inc_unchecked(&vcc->stats->rx);
26510 }
26511 wake_up(&eni_dev->rx_wait);
26512 }
df50ba0c 26513@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
58c5fc13
MT		 26514 PCI_DMA_TODEVICE);
26515 if (vcc->pop) vcc->pop(vcc,skb);
26516 else dev_kfree_skb_irq(skb);
26517- atomic_inc(&vcc->stats->tx);
26518+ atomic_inc_unchecked(&vcc->stats->tx);
26519 wake_up(&eni_dev->tx_wait);
26520 dma_complete++;
26521 }
66a7e928
MT		 26522diff -urNp linux-2.6.39/drivers/atm/firestream.c linux-2.6.39/drivers/atm/firestream.c
26523--- linux-2.6.39/drivers/atm/firestream.c 2011-05-19 00:06:34.000000000 -0400
26524+++ linux-2.6.39/drivers/atm/firestream.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26525@@ -749,7 +749,7 @@ static void process_txdone_queue (struct
58c5fc13
MT		 26526 }
26527 }
26528
26529- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26530+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26531
26532 fs_dprintk (FS_DEBUG_TXMEM, "i");
26533 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
df50ba0c 26534@@ -816,7 +816,7 @@ static void process_incoming (struct fs_
58c5fc13
MT		 26535 #endif
26536 skb_put (skb, qe->p1 & 0xffff);
26537 ATM_SKB(skb)->vcc = atm_vcc;
26538- atomic_inc(&atm_vcc->stats->rx);
26539+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26540 __net_timestamp(skb);
26541 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
26542 atm_vcc->push (atm_vcc, skb);
df50ba0c 26543@@ -837,12 +837,12 @@ static void process_incoming (struct fs_
58c5fc13
MT		 26544 kfree (pe);
26545 }
26546 if (atm_vcc)
26547- atomic_inc(&atm_vcc->stats->rx_drop);
26548+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26549 break;
26550 case 0x1f: /* Reassembly abort: no buffers. */
26551 /* Silently increment error counter. */
26552 if (atm_vcc)
26553- atomic_inc(&atm_vcc->stats->rx_drop);
26554+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26555 break;
26556 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
26557 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
66a7e928
MT		 26558diff -urNp linux-2.6.39/drivers/atm/fore200e.c linux-2.6.39/drivers/atm/fore200e.c
26559--- linux-2.6.39/drivers/atm/fore200e.c 2011-05-19 00:06:34.000000000 -0400
26560+++ linux-2.6.39/drivers/atm/fore200e.c 2011-05-22 19:36:31.000000000 -0400
57199397 26561@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
58c5fc13
MT		 26562 #endif
26563 /* check error condition */
26564 if (*entry->status & STATUS_ERROR)
26565- atomic_inc(&vcc->stats->tx_err);
26566+ atomic_inc_unchecked(&vcc->stats->tx_err);
26567 else
26568- atomic_inc(&vcc->stats->tx);
26569+ atomic_inc_unchecked(&vcc->stats->tx);
26570 }
26571 }
26572
57199397 26573@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
58c5fc13
MT		 26574 if (skb == NULL) {
26575 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
26576
26577- atomic_inc(&vcc->stats->rx_drop);
26578+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26579 return -ENOMEM;
26580 }
26581
57199397 26582@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
58c5fc13
MT		 26583
26584 dev_kfree_skb_any(skb);
26585
26586- atomic_inc(&vcc->stats->rx_drop);
26587+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26588 return -ENOMEM;
26589 }
26590
26591 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26592
26593 vcc->push(vcc, skb);
26594- atomic_inc(&vcc->stats->rx);
26595+ atomic_inc_unchecked(&vcc->stats->rx);
26596
26597 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26598
57199397 26599@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
58c5fc13
MT		 26600 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
26601 fore200e->atm_dev->number,
26602 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
26603- atomic_inc(&vcc->stats->rx_err);
26604+ atomic_inc_unchecked(&vcc->stats->rx_err);
26605 }
26606 }
26607
57199397 26608@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
58c5fc13
MT		 26609 goto retry_here;
26610 }
26611
26612- atomic_inc(&vcc->stats->tx_err);
26613+ atomic_inc_unchecked(&vcc->stats->tx_err);
26614
26615 fore200e->tx_sat++;
26616 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
66a7e928
MT		 26617diff -urNp linux-2.6.39/drivers/atm/he.c linux-2.6.39/drivers/atm/he.c
26618--- linux-2.6.39/drivers/atm/he.c 2011-05-19 00:06:34.000000000 -0400
26619+++ linux-2.6.39/drivers/atm/he.c 2011-05-22 19:36:31.000000000 -0400
6892158b 26620@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
58c5fc13
MT		 26621
26622 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
26623 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
26624- atomic_inc(&vcc->stats->rx_drop);
26625+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26626 goto return_host_buffers;
26627 }
26628
6892158b 26629@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
58c5fc13
MT		 26630 RBRQ_LEN_ERR(he_dev->rbrq_head)
26631 ? "LEN_ERR" : "",
26632 vcc->vpi, vcc->vci);
26633- atomic_inc(&vcc->stats->rx_err);
26634+ atomic_inc_unchecked(&vcc->stats->rx_err);
26635 goto return_host_buffers;
26636 }
26637
6892158b 26638@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
58c5fc13
MT		 26639 vcc->push(vcc, skb);
26640 spin_lock(&he_dev->global_lock);
26641
26642- atomic_inc(&vcc->stats->rx);
26643+ atomic_inc_unchecked(&vcc->stats->rx);
26644
26645 return_host_buffers:
26646 ++pdus_assembled;
6892158b 26647@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
58c5fc13
MT		 26648 tpd->vcc->pop(tpd->vcc, tpd->skb);
26649 else
26650 dev_kfree_skb_any(tpd->skb);
26651- atomic_inc(&tpd->vcc->stats->tx_err);
26652+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
26653 }
26654 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
26655 return;
6892158b 26656@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
58c5fc13
MT		 26657 vcc->pop(vcc, skb);
26658 else
26659 dev_kfree_skb_any(skb);
26660- atomic_inc(&vcc->stats->tx_err);
26661+ atomic_inc_unchecked(&vcc->stats->tx_err);
26662 return -EINVAL;
26663 }
26664
6892158b 26665@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
58c5fc13
MT		 26666 vcc->pop(vcc, skb);
26667 else
26668 dev_kfree_skb_any(skb);
26669- atomic_inc(&vcc->stats->tx_err);
26670+ atomic_inc_unchecked(&vcc->stats->tx_err);
26671 return -EINVAL;
26672 }
26673 #endif
6892158b 26674@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
58c5fc13
MT		 26675 vcc->pop(vcc, skb);
26676 else
26677 dev_kfree_skb_any(skb);
26678- atomic_inc(&vcc->stats->tx_err);
26679+ atomic_inc_unchecked(&vcc->stats->tx_err);
26680 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26681 return -ENOMEM;
26682 }
6892158b 26683@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
58c5fc13
MT		 26684 vcc->pop(vcc, skb);
26685 else
26686 dev_kfree_skb_any(skb);
26687- atomic_inc(&vcc->stats->tx_err);
26688+ atomic_inc_unchecked(&vcc->stats->tx_err);
26689 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26690 return -ENOMEM;
26691 }
6892158b 26692@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
58c5fc13
MT		 26693 __enqueue_tpd(he_dev, tpd, cid);
26694 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26695
26696- atomic_inc(&vcc->stats->tx);
26697+ atomic_inc_unchecked(&vcc->stats->tx);
26698
26699 return 0;
26700 }
66a7e928
MT		 26701diff -urNp linux-2.6.39/drivers/atm/horizon.c linux-2.6.39/drivers/atm/horizon.c
26702--- linux-2.6.39/drivers/atm/horizon.c 2011-05-19 00:06:34.000000000 -0400
26703+++ linux-2.6.39/drivers/atm/horizon.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26704@@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
58c5fc13
MT		 26705 {
26706 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
26707 // VC layer stats
26708- atomic_inc(&vcc->stats->rx);
26709+ atomic_inc_unchecked(&vcc->stats->rx);
26710 __net_timestamp(skb);
66a7e928 26711 // end of our responsibility
58c5fc13 26712 vcc->push (vcc, skb);
df50ba0c 26713@@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
58c5fc13
MT		 26714 dev->tx_iovec = NULL;
26715
26716 // VC layer stats
26717- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26718+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26719
26720 // free the skb
26721 hrz_kfree_skb (skb);
66a7e928
MT		 26722diff -urNp linux-2.6.39/drivers/atm/idt77252.c linux-2.6.39/drivers/atm/idt77252.c
26723--- linux-2.6.39/drivers/atm/idt77252.c 2011-05-19 00:06:34.000000000 -0400
26724+++ linux-2.6.39/drivers/atm/idt77252.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26725@@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
58c5fc13
MT		 26726 else
26727 dev_kfree_skb(skb);
26728
26729- atomic_inc(&vcc->stats->tx);
26730+ atomic_inc_unchecked(&vcc->stats->tx);
26731 }
26732
26733 atomic_dec(&scq->used);
df50ba0c 26734@@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
58c5fc13
MT		 26735 if ((sb = dev_alloc_skb(64)) == NULL) {
26736 printk("%s: Can't allocate buffers for aal0.\n",
26737 card->name);
26738- atomic_add(i, &vcc->stats->rx_drop);
26739+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
26740 break;
26741 }
26742 if (!atm_charge(vcc, sb->truesize)) {
26743 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
26744 card->name);
26745- atomic_add(i - 1, &vcc->stats->rx_drop);
26746+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
26747 dev_kfree_skb(sb);
26748 break;
26749 }
df50ba0c 26750@@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
58c5fc13
MT		 26751 ATM_SKB(sb)->vcc = vcc;
26752 __net_timestamp(sb);
26753 vcc->push(vcc, sb);
26754- atomic_inc(&vcc->stats->rx);
26755+ atomic_inc_unchecked(&vcc->stats->rx);
26756
26757 cell += ATM_CELL_PAYLOAD;
26758 }
df50ba0c 26759@@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
58c5fc13
MT		 26760 "(CDC: %08x)\n",
26761 card->name, len, rpp->len, readl(SAR_REG_CDC));
26762 recycle_rx_pool_skb(card, rpp);
26763- atomic_inc(&vcc->stats->rx_err);
26764+ atomic_inc_unchecked(&vcc->stats->rx_err);
26765 return;
26766 }
26767 if (stat & SAR_RSQE_CRC) {
26768 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
26769 recycle_rx_pool_skb(card, rpp);
26770- atomic_inc(&vcc->stats->rx_err);
26771+ atomic_inc_unchecked(&vcc->stats->rx_err);
26772 return;
26773 }
26774 if (skb_queue_len(&rpp->queue) > 1) {
df50ba0c 26775@@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
58c5fc13
MT		 26776 RXPRINTK("%s: Can't alloc RX skb.\n",
26777 card->name);
26778 recycle_rx_pool_skb(card, rpp);
26779- atomic_inc(&vcc->stats->rx_err);
26780+ atomic_inc_unchecked(&vcc->stats->rx_err);
26781 return;
26782 }
26783 if (!atm_charge(vcc, skb->truesize)) {
df50ba0c 26784@@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
58c5fc13
MT		 26785 __net_timestamp(skb);
26786
26787 vcc->push(vcc, skb);
26788- atomic_inc(&vcc->stats->rx);
26789+ atomic_inc_unchecked(&vcc->stats->rx);
26790
26791 return;
26792 }
df50ba0c 26793@@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
58c5fc13
MT		 26794 __net_timestamp(skb);
26795
26796 vcc->push(vcc, skb);
26797- atomic_inc(&vcc->stats->rx);
26798+ atomic_inc_unchecked(&vcc->stats->rx);
26799
26800 if (skb->truesize > SAR_FB_SIZE_3)
26801 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
df50ba0c 26802@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *car
58c5fc13
MT		 26803 if (vcc->qos.aal != ATM_AAL0) {
26804 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
26805 card->name, vpi, vci);
26806- atomic_inc(&vcc->stats->rx_drop);
26807+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26808 goto drop;
26809 }
26810
26811 if ((sb = dev_alloc_skb(64)) == NULL) {
26812 printk("%s: Can't allocate buffers for AAL0.\n",
26813 card->name);
26814- atomic_inc(&vcc->stats->rx_err);
26815+ atomic_inc_unchecked(&vcc->stats->rx_err);
26816 goto drop;
26817 }
26818
df50ba0c 26819@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *car
58c5fc13
MT		 26820 ATM_SKB(sb)->vcc = vcc;
26821 __net_timestamp(sb);
26822 vcc->push(vcc, sb);
26823- atomic_inc(&vcc->stats->rx);
26824+ atomic_inc_unchecked(&vcc->stats->rx);
26825
26826 drop:
26827 skb_pull(queue, 64);
df50ba0c 26828@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
58c5fc13
MT		 26829
26830 if (vc == NULL) {
26831 printk("%s: NULL connection in send().\n", card->name);
26832- atomic_inc(&vcc->stats->tx_err);
26833+ atomic_inc_unchecked(&vcc->stats->tx_err);
26834 dev_kfree_skb(skb);
26835 return -EINVAL;
26836 }
26837 if (!test_bit(VCF_TX, &vc->flags)) {
26838 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
26839- atomic_inc(&vcc->stats->tx_err);
26840+ atomic_inc_unchecked(&vcc->stats->tx_err);
26841 dev_kfree_skb(skb);
26842 return -EINVAL;
26843 }
df50ba0c 26844@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
58c5fc13
MT		 26845 break;
26846 default:
26847 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
26848- atomic_inc(&vcc->stats->tx_err);
26849+ atomic_inc_unchecked(&vcc->stats->tx_err);
26850 dev_kfree_skb(skb);
26851 return -EINVAL;
26852 }
26853
26854 if (skb_shinfo(skb)->nr_frags != 0) {
26855 printk("%s: No scatter-gather yet.\n", card->name);
26856- atomic_inc(&vcc->stats->tx_err);
26857+ atomic_inc_unchecked(&vcc->stats->tx_err);
26858 dev_kfree_skb(skb);
26859 return -EINVAL;
26860 }
df50ba0c 26861@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
58c5fc13
MT		 26862
26863 err = queue_skb(card, vc, skb, oam);
26864 if (err) {
26865- atomic_inc(&vcc->stats->tx_err);
26866+ atomic_inc_unchecked(&vcc->stats->tx_err);
26867 dev_kfree_skb(skb);
26868 return err;
26869 }
df50ba0c 26870@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
58c5fc13
MT		 26871 skb = dev_alloc_skb(64);
26872 if (!skb) {
26873 printk("%s: Out of memory in send_oam().\n", card->name);
26874- atomic_inc(&vcc->stats->tx_err);
26875+ atomic_inc_unchecked(&vcc->stats->tx_err);
26876 return -ENOMEM;
26877 }
26878 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
66a7e928
MT		 26879diff -urNp linux-2.6.39/drivers/atm/iphase.c linux-2.6.39/drivers/atm/iphase.c
26880--- linux-2.6.39/drivers/atm/iphase.c 2011-05-19 00:06:34.000000000 -0400
26881+++ linux-2.6.39/drivers/atm/iphase.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26882@@ -1124,7 +1124,7 @@ static int rx_pkt(struct atm_dev *dev)
58c5fc13
MT		 26883 status = (u_short) (buf_desc_ptr->desc_mode);
26884 if (status & (RX_CER | RX_PTE | RX_OFL))
26885 {
26886- atomic_inc(&vcc->stats->rx_err);
26887+ atomic_inc_unchecked(&vcc->stats->rx_err);
26888 IF_ERR(printk("IA: bad packet, dropping it");)
26889 if (status & RX_CER) {
26890 IF_ERR(printk(" cause: packet CRC error\n");)
df50ba0c 26891@@ -1147,7 +1147,7 @@ static int rx_pkt(struct atm_dev *dev)
58c5fc13
MT		 26892 len = dma_addr - buf_addr;
26893 if (len > iadev->rx_buf_sz) {
26894 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
26895- atomic_inc(&vcc->stats->rx_err);
26896+ atomic_inc_unchecked(&vcc->stats->rx_err);
26897 goto out_free_desc;
26898 }
26899
df50ba0c 26900@@ -1297,7 +1297,7 @@ static void rx_dle_intr(struct atm_dev *
58c5fc13
MT		 26901 ia_vcc = INPH_IA_VCC(vcc);
26902 if (ia_vcc == NULL)
26903 {
26904- atomic_inc(&vcc->stats->rx_err);
26905+ atomic_inc_unchecked(&vcc->stats->rx_err);
26906 dev_kfree_skb_any(skb);
26907 atm_return(vcc, atm_guess_pdu2truesize(len));
26908 goto INCR_DLE;
df50ba0c 26909@@ -1309,7 +1309,7 @@ static void rx_dle_intr(struct atm_dev *
58c5fc13
MT		 26910 if ((length > iadev->rx_buf_sz) || (length >
26911 (skb->len - sizeof(struct cpcs_trailer))))
26912 {
26913- atomic_inc(&vcc->stats->rx_err);
26914+ atomic_inc_unchecked(&vcc->stats->rx_err);
26915 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
26916 length, skb->len);)
26917 dev_kfree_skb_any(skb);
df50ba0c 26918@@ -1325,7 +1325,7 @@ static void rx_dle_intr(struct atm_dev *
58c5fc13
MT		 26919
26920 IF_RX(printk("rx_dle_intr: skb push");)
26921 vcc->push(vcc,skb);
26922- atomic_inc(&vcc->stats->rx);
26923+ atomic_inc_unchecked(&vcc->stats->rx);
26924 iadev->rx_pkt_cnt++;
26925 }
26926 INCR_DLE:
df50ba0c 26927@@ -2807,15 +2807,15 @@ static int ia_ioctl(struct atm_dev *dev,
58c5fc13
MT		 26928 {
26929 struct k_sonet_stats *stats;
26930 stats = &PRIV(_ia_dev[board])->sonet_stats;
26931- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
26932- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
26933- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
26934- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
26935- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
26936- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
26937- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
26938- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
26939- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
26940+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
26941+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
26942+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
26943+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
26944+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
26945+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
26946+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
26947+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
26948+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
26949 }
26950 ia_cmds.status = 0;
26951 break;
df50ba0c 26952@@ -2920,7 +2920,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
58c5fc13
MT		 26953 if ((desc == 0) || (desc > iadev->num_tx_desc))
26954 {
26955 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
26956- atomic_inc(&vcc->stats->tx);
26957+ atomic_inc_unchecked(&vcc->stats->tx);
26958 if (vcc->pop)
26959 vcc->pop(vcc, skb);
26960 else
df50ba0c 26961@@ -3025,14 +3025,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
58c5fc13
MT		 26962 ATM_DESC(skb) = vcc->vci;
26963 skb_queue_tail(&iadev->tx_dma_q, skb);
26964
26965- atomic_inc(&vcc->stats->tx);
26966+ atomic_inc_unchecked(&vcc->stats->tx);
26967 iadev->tx_pkt_cnt++;
26968 /* Increment transaction counter */
26969 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
26970
26971 #if 0
26972 /* add flow control logic */
26973- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
26974+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
26975 if (iavcc->vc_desc_cnt > 10) {
26976 vcc->tx_quota = vcc->tx_quota * 3 / 4;
26977 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
66a7e928
MT		 26978diff -urNp linux-2.6.39/drivers/atm/lanai.c linux-2.6.39/drivers/atm/lanai.c
26979--- linux-2.6.39/drivers/atm/lanai.c 2011-05-19 00:06:34.000000000 -0400
26980+++ linux-2.6.39/drivers/atm/lanai.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 26981@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
58c5fc13
MT		 26982 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
26983 lanai_endtx(lanai, lvcc);
26984 lanai_free_skb(lvcc->tx.atmvcc, skb);
26985- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
26986+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
26987 }
26988
26989 /* Try to fill the buffer - don't call unless there is backlog */
df50ba0c 26990@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
58c5fc13
MT		 26991 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
26992 __net_timestamp(skb);
26993 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
26994- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
26995+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
26996 out:
26997 lvcc->rx.buf.ptr = end;
26998 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
df50ba0c 26999@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
58c5fc13
MT		 27000 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
27001 "vcc %d\n", lanai->number, (unsigned int) s, vci);
27002 lanai->stats.service_rxnotaal5++;
27003- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27004+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27005 return 0;
27006 }
27007 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
df50ba0c 27008@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
58c5fc13
MT		 27009 int bytes;
27010 read_unlock(&vcc_sklist_lock);
27011 DPRINTK("got trashed rx pdu on vci %d\n", vci);
27012- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27013+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27014 lvcc->stats.x.aal5.service_trash++;
27015 bytes = (SERVICE_GET_END(s) * 16) -
27016 (((unsigned long) lvcc->rx.buf.ptr) -
df50ba0c 27017@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
58c5fc13
MT		 27018 }
27019 if (s & SERVICE_STREAM) {
27020 read_unlock(&vcc_sklist_lock);
27021- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27022+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27023 lvcc->stats.x.aal5.service_stream++;
27024 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
27025 "PDU on VCI %d!\n", lanai->number, vci);
df50ba0c 27026@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
58c5fc13
MT		 27027 return 0;
27028 }
27029 DPRINTK("got rx crc error on vci %d\n", vci);
27030- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27031+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27032 lvcc->stats.x.aal5.service_rxcrc++;
27033 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
27034 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
66a7e928
MT		 27035diff -urNp linux-2.6.39/drivers/atm/nicstar.c linux-2.6.39/drivers/atm/nicstar.c
27036--- linux-2.6.39/drivers/atm/nicstar.c 2011-05-19 00:06:34.000000000 -0400
27037+++ linux-2.6.39/drivers/atm/nicstar.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 27038@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
6892158b
MT		 27039 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
27040 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
27041 card->index);
27042- atomic_inc(&vcc->stats->tx_err);
27043+ atomic_inc_unchecked(&vcc->stats->tx_err);
27044 dev_kfree_skb_any(skb);
27045 return -EINVAL;
27046 }
bc901d79 27047@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
6892158b
MT		 27048 if (!vc->tx) {
27049 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
27050 card->index);
27051- atomic_inc(&vcc->stats->tx_err);
27052+ atomic_inc_unchecked(&vcc->stats->tx_err);
27053 dev_kfree_skb_any(skb);
27054 return -EINVAL;
27055 }
bc901d79 27056@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
6892158b
MT		 27057 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
27058 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
27059 card->index);
27060- atomic_inc(&vcc->stats->tx_err);
27061+ atomic_inc_unchecked(&vcc->stats->tx_err);
27062 dev_kfree_skb_any(skb);
27063 return -EINVAL;
27064 }
58c5fc13 27065
6892158b
MT		 27066 if (skb_shinfo(skb)->nr_frags != 0) {
27067 printk("nicstar%d: No scatter-gather yet.\n", card->index);
27068- atomic_inc(&vcc->stats->tx_err);
27069+ atomic_inc_unchecked(&vcc->stats->tx_err);
27070 dev_kfree_skb_any(skb);
27071 return -EINVAL;
27072 }
bc901d79 27073@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
6892158b
MT		 27074 }
27075
27076 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
27077- atomic_inc(&vcc->stats->tx_err);
27078+ atomic_inc_unchecked(&vcc->stats->tx_err);
27079 dev_kfree_skb_any(skb);
27080 return -EIO;
27081 }
27082- atomic_inc(&vcc->stats->tx);
27083+ atomic_inc_unchecked(&vcc->stats->tx);
27084
27085 return 0;
27086 }
bc901d79 27087@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27088 printk
27089 ("nicstar%d: Can't allocate buffers for aal0.\n",
27090 card->index);
27091- atomic_add(i, &vcc->stats->rx_drop);
27092+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
27093 break;
27094 }
27095 if (!atm_charge(vcc, sb->truesize)) {
27096 RXPRINTK
27097 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
27098 card->index);
27099- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27100+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27101 dev_kfree_skb_any(sb);
27102 break;
27103 }
bc901d79 27104@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27105 ATM_SKB(sb)->vcc = vcc;
27106 __net_timestamp(sb);
27107 vcc->push(vcc, sb);
27108- atomic_inc(&vcc->stats->rx);
27109+ atomic_inc_unchecked(&vcc->stats->rx);
27110 cell += ATM_CELL_PAYLOAD;
27111 }
27112
bc901d79 27113@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27114 if (iovb == NULL) {
27115 printk("nicstar%d: Out of iovec buffers.\n",
27116 card->index);
27117- atomic_inc(&vcc->stats->rx_drop);
27118+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27119 recycle_rx_buf(card, skb);
27120 return;
27121 }
bc901d79 27122@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27123 small or large buffer itself. */
27124 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
27125 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
27126- atomic_inc(&vcc->stats->rx_err);
27127+ atomic_inc_unchecked(&vcc->stats->rx_err);
27128 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27129 NS_MAX_IOVECS);
27130 NS_PRV_IOVCNT(iovb) = 0;
bc901d79 27131@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27132 ("nicstar%d: Expected a small buffer, and this is not one.\n",
27133 card->index);
27134 which_list(card, skb);
27135- atomic_inc(&vcc->stats->rx_err);
27136+ atomic_inc_unchecked(&vcc->stats->rx_err);
27137 recycle_rx_buf(card, skb);
27138 vc->rx_iov = NULL;
27139 recycle_iov_buf(card, iovb);
bc901d79 27140@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27141 ("nicstar%d: Expected a large buffer, and this is not one.\n",
27142 card->index);
27143 which_list(card, skb);
27144- atomic_inc(&vcc->stats->rx_err);
27145+ atomic_inc_unchecked(&vcc->stats->rx_err);
27146 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27147 NS_PRV_IOVCNT(iovb));
27148 vc->rx_iov = NULL;
bc901d79 27149@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27150 printk(" - PDU size mismatch.\n");
27151 else
27152 printk(".\n");
27153- atomic_inc(&vcc->stats->rx_err);
27154+ atomic_inc_unchecked(&vcc->stats->rx_err);
27155 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27156 NS_PRV_IOVCNT(iovb));
27157 vc->rx_iov = NULL;
bc901d79 27158@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27159 /* skb points to a small buffer */
27160 if (!atm_charge(vcc, skb->truesize)) {
27161 push_rxbufs(card, skb);
27162- atomic_inc(&vcc->stats->rx_drop);
27163+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27164 } else {
27165 skb_put(skb, len);
27166 dequeue_sm_buf(card, skb);
bc901d79 27167@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27168 ATM_SKB(skb)->vcc = vcc;
27169 __net_timestamp(skb);
27170 vcc->push(vcc, skb);
27171- atomic_inc(&vcc->stats->rx);
27172+ atomic_inc_unchecked(&vcc->stats->rx);
27173 }
27174 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
27175 struct sk_buff *sb;
bc901d79 27176@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27177 if (len <= NS_SMBUFSIZE) {
27178 if (!atm_charge(vcc, sb->truesize)) {
27179 push_rxbufs(card, sb);
27180- atomic_inc(&vcc->stats->rx_drop);
27181+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27182 } else {
27183 skb_put(sb, len);
27184 dequeue_sm_buf(card, sb);
bc901d79 27185@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27186 ATM_SKB(sb)->vcc = vcc;
27187 __net_timestamp(sb);
27188 vcc->push(vcc, sb);
27189- atomic_inc(&vcc->stats->rx);
27190+ atomic_inc_unchecked(&vcc->stats->rx);
27191 }
27192
27193 push_rxbufs(card, skb);
bc901d79 27194@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27195
27196 if (!atm_charge(vcc, skb->truesize)) {
27197 push_rxbufs(card, skb);
27198- atomic_inc(&vcc->stats->rx_drop);
27199+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27200 } else {
27201 dequeue_lg_buf(card, skb);
27202 #ifdef NS_USE_DESTRUCTORS
bc901d79 27203@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27204 ATM_SKB(skb)->vcc = vcc;
27205 __net_timestamp(skb);
27206 vcc->push(vcc, skb);
27207- atomic_inc(&vcc->stats->rx);
27208+ atomic_inc_unchecked(&vcc->stats->rx);
27209 }
27210
27211 push_rxbufs(card, sb);
bc901d79 27212@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27213 printk
27214 ("nicstar%d: Out of huge buffers.\n",
27215 card->index);
27216- atomic_inc(&vcc->stats->rx_drop);
27217+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27218 recycle_iovec_rx_bufs(card,
27219 (struct iovec *)
27220 iovb->data,
bc901d79 27221@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
6892158b
MT		 27222 card->hbpool.count++;
27223 } else
27224 dev_kfree_skb_any(hb);
27225- atomic_inc(&vcc->stats->rx_drop);
27226+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27227 } else {
27228 /* Copy the small buffer to the huge buffer */
27229 sb = (struct sk_buff *)iov->iov_base;
bc901d79 27230@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
58c5fc13 27231 #endif /* NS_USE_DESTRUCTORS */
6892158b
MT		 27232 __net_timestamp(hb);
27233 vcc->push(vcc, hb);
27234- atomic_inc(&vcc->stats->rx);
27235+ atomic_inc_unchecked(&vcc->stats->rx);
27236 }
27237 }
58c5fc13 27238
66a7e928
MT		 27239diff -urNp linux-2.6.39/drivers/atm/solos-pci.c linux-2.6.39/drivers/atm/solos-pci.c
27240--- linux-2.6.39/drivers/atm/solos-pci.c 2011-05-19 00:06:34.000000000 -0400
27241+++ linux-2.6.39/drivers/atm/solos-pci.c 2011-05-22 19:36:31.000000000 -0400
71d190be 27242@@ -715,7 +715,7 @@ void solos_bh(unsigned long card_arg)
58c5fc13
MT		 27243 }
27244 atm_charge(vcc, skb->truesize);
27245 vcc->push(vcc, skb);
27246- atomic_inc(&vcc->stats->rx);
27247+ atomic_inc_unchecked(&vcc->stats->rx);
27248 break;
27249
27250 case PKT_STATUS:
66a7e928
MT		 27251@@ -900,6 +900,8 @@ static int print_buffer(struct sk_buff *
27252 char msg[500];
27253 char item[10];
27254
27255+ pax_track_stack();
27256+
27257 len = buf->len;
27258 for (i = 0; i < len; i++){
27259 if(i % 8 == 0)
27260@@ -1009,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
58c5fc13
MT		 27261 vcc = SKB_CB(oldskb)->vcc;
27262
27263 if (vcc) {
27264- atomic_inc(&vcc->stats->tx);
27265+ atomic_inc_unchecked(&vcc->stats->tx);
27266 solos_pop(vcc, oldskb);
27267 } else
27268 dev_kfree_skb_irq(oldskb);
66a7e928
MT		 27269diff -urNp linux-2.6.39/drivers/atm/suni.c linux-2.6.39/drivers/atm/suni.c
27270--- linux-2.6.39/drivers/atm/suni.c 2011-05-19 00:06:34.000000000 -0400
27271+++ linux-2.6.39/drivers/atm/suni.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 27272@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
58c5fc13
MT		 27273
27274
27275 #define ADD_LIMITED(s,v) \
27276- atomic_add((v),&stats->s); \
27277- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27278+ atomic_add_unchecked((v),&stats->s); \
27279+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27280
27281
27282 static void suni_hz(unsigned long from_timer)
66a7e928
MT		 27283diff -urNp linux-2.6.39/drivers/atm/uPD98402.c linux-2.6.39/drivers/atm/uPD98402.c
27284--- linux-2.6.39/drivers/atm/uPD98402.c 2011-05-19 00:06:34.000000000 -0400
27285+++ linux-2.6.39/drivers/atm/uPD98402.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 27286@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
58c5fc13
MT		 27287 struct sonet_stats tmp;
27288 int error = 0;
27289
27290- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27291+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27292 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27293 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27294 if (zero && !error) {
df50ba0c 27295@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
58c5fc13
MT		 27296
27297
27298 #define ADD_LIMITED(s,v) \
27299- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27300- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27301- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27302+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27303+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27304+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27305
27306
27307 static void stat_event(struct atm_dev *dev)
df50ba0c 27308@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
58c5fc13
MT		 27309 if (reason & uPD98402_INT_PFM) stat_event(dev);
27310 if (reason & uPD98402_INT_PCO) {
27311 (void) GET(PCOCR); /* clear interrupt cause */
27312- atomic_add(GET(HECCT),
27313+ atomic_add_unchecked(GET(HECCT),
27314 &PRIV(dev)->sonet_stats.uncorr_hcs);
27315 }
27316 if ((reason & uPD98402_INT_RFO) &&
df50ba0c 27317@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
58c5fc13
MT		 27318 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
27319 uPD98402_INT_LOS),PIMR); /* enable them */
27320 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
27321- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27322- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
27323- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
27324+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27325+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
27326+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
27327 return 0;
27328 }
27329
66a7e928
MT		 27330diff -urNp linux-2.6.39/drivers/atm/zatm.c linux-2.6.39/drivers/atm/zatm.c
27331--- linux-2.6.39/drivers/atm/zatm.c 2011-05-19 00:06:34.000000000 -0400
27332+++ linux-2.6.39/drivers/atm/zatm.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 27333@@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
58c5fc13
MT		 27334 }
27335 if (!size) {
27336 dev_kfree_skb_irq(skb);
27337- if (vcc) atomic_inc(&vcc->stats->rx_err);
27338+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
27339 continue;
27340 }
27341 if (!atm_charge(vcc,skb->truesize)) {
df50ba0c 27342@@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
58c5fc13
MT		 27343 skb->len = size;
27344 ATM_SKB(skb)->vcc = vcc;
27345 vcc->push(vcc,skb);
27346- atomic_inc(&vcc->stats->rx);
27347+ atomic_inc_unchecked(&vcc->stats->rx);
27348 }
27349 zout(pos & 0xffff,MTA(mbx));
27350 #if 0 /* probably a stupid idea */
df50ba0c 27351@@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
58c5fc13
MT		 27352 skb_queue_head(&zatm_vcc->backlog,skb);
27353 break;
27354 }
27355- atomic_inc(&vcc->stats->tx);
27356+ atomic_inc_unchecked(&vcc->stats->tx);
27357 wake_up(&zatm_vcc->tx_wait);
27358 }
27359
66a7e928
MT		 27360diff -urNp linux-2.6.39/drivers/base/iommu.c linux-2.6.39/drivers/base/iommu.c
27361--- linux-2.6.39/drivers/base/iommu.c 2011-05-19 00:06:34.000000000 -0400
27362+++ linux-2.6.39/drivers/base/iommu.c 2011-05-22 19:36:31.000000000 -0400
27363@@ -23,9 +23,8 @@
27364 #include <linux/errno.h>
27365 #include <linux/iommu.h>
8308f9c9 27366
66a7e928
MT		 27367-static struct iommu_ops *iommu_ops;
27368-
27369-void register_iommu(struct iommu_ops *ops)
27370+static const struct iommu_ops *iommu_ops;
27371+void register_iommu(const struct iommu_ops *ops)
27372 {
27373 if (iommu_ops)
27374 BUG();
27375diff -urNp linux-2.6.39/drivers/base/power/generic_ops.c linux-2.6.39/drivers/base/power/generic_ops.c
27376--- linux-2.6.39/drivers/base/power/generic_ops.c 2011-05-19 00:06:34.000000000 -0400
27377+++ linux-2.6.39/drivers/base/power/generic_ops.c 2011-05-22 19:36:31.000000000 -0400
27378@@ -215,7 +215,7 @@ int pm_generic_restore(struct device *de
27379 EXPORT_SYMBOL_GPL(pm_generic_restore);
27380 #endif /* CONFIG_PM_SLEEP */
27381
27382-struct dev_pm_ops generic_subsys_pm_ops = {
27383+const struct dev_pm_ops generic_subsys_pm_ops = {
27384 #ifdef CONFIG_PM_SLEEP
27385 .suspend = pm_generic_suspend,
27386 .resume = pm_generic_resume,
27387diff -urNp linux-2.6.39/drivers/base/power/wakeup.c linux-2.6.39/drivers/base/power/wakeup.c
27388--- linux-2.6.39/drivers/base/power/wakeup.c 2011-05-19 00:06:34.000000000 -0400
27389+++ linux-2.6.39/drivers/base/power/wakeup.c 2011-05-22 19:36:31.000000000 -0400
27390@@ -29,14 +29,14 @@ bool events_check_enabled;
27391 * They need to be modified together atomically, so it's better to use one
27392 * atomic variable to hold them both.
27393 */
27394-static atomic_t combined_event_count = ATOMIC_INIT(0);
27395+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
8308f9c9 27396
66a7e928
MT		 27397 #define IN_PROGRESS_BITS (sizeof(int) * 4)
27398 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
27399
27400 static void split_counters(unsigned int *cnt, unsigned int *inpr)
27401 {
27402- unsigned int comb = atomic_read(&combined_event_count);
27403+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
27404
27405 *cnt = (comb >> IN_PROGRESS_BITS);
27406 *inpr = comb & MAX_IN_PROGRESS;
27407@@ -351,7 +351,7 @@ static void wakeup_source_activate(struc
27408 ws->last_time = ktime_get();
27409
27410 /* Increment the counter of events in progress. */
27411- atomic_inc(&combined_event_count);
27412+ atomic_inc_unchecked(&combined_event_count);
8308f9c9
MT		 27413 }
27414
66a7e928
MT		 27415 /**
27416@@ -441,7 +441,7 @@ static void wakeup_source_deactivate(str
27417 * Increment the counter of registered wakeup events and decrement the
27418 * couter of wakeup events in progress simultaneously.
27419 */
27420- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
27421+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
27422 }
8308f9c9 27423
66a7e928
MT		 27424 /**
27425diff -urNp linux-2.6.39/drivers/block/cciss.c linux-2.6.39/drivers/block/cciss.c
27426--- linux-2.6.39/drivers/block/cciss.c 2011-05-19 00:06:34.000000000 -0400
27427+++ linux-2.6.39/drivers/block/cciss.c 2011-05-22 19:41:32.000000000 -0400
27428@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_devic
27429 * product = Marketing Name for the board
27430 * access = Address of the struct of function pointers
27431 */
27432-static struct board_type products[] = {
27433+static const struct board_type products[] = {
27434 {0x40700E11, "Smart Array 5300", &SA5_access},
27435 {0x40800E11, "Smart Array 5i", &SA5B_access},
27436 {0x40820E11, "Smart Array 532", &SA5B_access},
27437@@ -1151,6 +1151,8 @@ static int cciss_ioctl32_passthru(struct
bc901d79
MT		 27438 int err;
27439 u32 cp;
27440
27441+ memset(&arg64, 0, sizeof(arg64));
27442+
27443 err = 0;
27444 err |=
27445 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
66a7e928
MT		 27446diff -urNp linux-2.6.39/drivers/block/cciss.h linux-2.6.39/drivers/block/cciss.h
27447--- linux-2.6.39/drivers/block/cciss.h 2011-05-19 00:06:34.000000000 -0400
27448+++ linux-2.6.39/drivers/block/cciss.h 2011-05-22 19:36:31.000000000 -0400
27449@@ -393,7 +393,7 @@ static bool SA5_performant_intr_pending(
27450 return register_value & SA5_OUTDB_STATUS_PERF_BIT;
27451 }
27452
27453-static struct access_method SA5_access = {
27454+static const struct access_method SA5_access = {
27455 SA5_submit_command,
27456 SA5_intr_mask,
27457 SA5_fifo_full,
27458@@ -401,7 +401,7 @@ static struct access_method SA5_access =
27459 SA5_completed,
27460 };
27461
27462-static struct access_method SA5B_access = {
27463+static const struct access_method SA5B_access = {
27464 SA5_submit_command,
27465 SA5B_intr_mask,
27466 SA5_fifo_full,
27467@@ -409,7 +409,7 @@ static struct access_method SA5B_access
27468 SA5_completed,
27469 };
27470
27471-static struct access_method SA5_performant_access = {
27472+static const struct access_method SA5_performant_access = {
27473 SA5_submit_command,
27474 SA5_performant_intr_mask,
27475 SA5_fifo_full,
27476@@ -420,7 +420,7 @@ static struct access_method SA5_performa
27477 struct board_type {
27478 __u32 board_id;
27479 char *product_name;
27480- struct access_method *access;
27481+ const struct access_method *access;
27482 int nr_cmds; /* Max cmds this kind of ctlr can handle. */
27483 };
27484
27485diff -urNp linux-2.6.39/drivers/block/cpqarray.c linux-2.6.39/drivers/block/cpqarray.c
27486--- linux-2.6.39/drivers/block/cpqarray.c 2011-05-19 00:06:34.000000000 -0400
27487+++ linux-2.6.39/drivers/block/cpqarray.c 2011-05-22 19:36:31.000000000 -0400
27488@@ -80,7 +80,7 @@ static int eisa[8];
27489 * product = Marketing Name for the board
27490 * access = Address of the struct of function pointers
27491 */
27492-static struct board_type products[] = {
27493+static const struct board_type products[] = {
27494 { 0x0040110E, "IDA", &smart1_access },
27495 { 0x0140110E, "IDA-2", &smart1_access },
27496 { 0x1040110E, "IAES", &smart1_access },
27497@@ -911,6 +911,8 @@ static void do_ida_request(struct reques
27498 struct scatterlist tmp_sg[SG_MAX];
27499 int i, dir, seg;
27500
27501+ pax_track_stack();
27502+
27503 queue_next:
27504 creq = blk_peek_request(q);
27505 if (!creq)
27506diff -urNp linux-2.6.39/drivers/block/cpqarray.h linux-2.6.39/drivers/block/cpqarray.h
27507--- linux-2.6.39/drivers/block/cpqarray.h 2011-05-19 00:06:34.000000000 -0400
27508+++ linux-2.6.39/drivers/block/cpqarray.h 2011-05-22 19:36:31.000000000 -0400
27509@@ -69,7 +69,7 @@ struct access_method {
27510 struct board_type {
27511 __u32 board_id;
27512 char *product_name;
27513- struct access_method *access;
27514+ const struct access_method *access;
27515 };
27516
27517 struct ctlr_info {
27518diff -urNp linux-2.6.39/drivers/block/DAC960.c linux-2.6.39/drivers/block/DAC960.c
27519--- linux-2.6.39/drivers/block/DAC960.c 2011-05-19 00:06:34.000000000 -0400
27520+++ linux-2.6.39/drivers/block/DAC960.c 2011-05-22 19:36:31.000000000 -0400
27521@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
27522 unsigned long flags;
27523 int Channel, TargetID;
27524
27525+ pax_track_stack();
27526+
27527 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
27528 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
27529 sizeof(DAC960_SCSI_Inquiry_T) +
27530diff -urNp linux-2.6.39/drivers/block/drbd/drbd_int.h linux-2.6.39/drivers/block/drbd/drbd_int.h
27531--- linux-2.6.39/drivers/block/drbd/drbd_int.h 2011-05-19 00:06:34.000000000 -0400
27532+++ linux-2.6.39/drivers/block/drbd/drbd_int.h 2011-05-22 19:36:31.000000000 -0400
27533@@ -736,7 +736,7 @@ struct drbd_request;
8308f9c9
MT		 27534 struct drbd_epoch {
27535 struct list_head list;
27536 unsigned int barrier_nr;
27537- atomic_t epoch_size; /* increased on every request added. */
27538+ atomic_unchecked_t epoch_size; /* increased on every request added. */
27539 atomic_t active; /* increased on every req. added, and dec on every finished. */
27540 unsigned long flags;
27541 };
66a7e928 27542@@ -1108,7 +1108,7 @@ struct drbd_conf {
8308f9c9
MT		 27543 void *int_dig_in;
27544 void *int_dig_vv;
27545 wait_queue_head_t seq_wait;
27546- atomic_t packet_seq;
27547+ atomic_unchecked_t packet_seq;
27548 unsigned int peer_seq;
27549 spinlock_t peer_seq_lock;
27550 unsigned int minor;
66a7e928
MT		 27551diff -urNp linux-2.6.39/drivers/block/drbd/drbd_main.c linux-2.6.39/drivers/block/drbd/drbd_main.c
27552--- linux-2.6.39/drivers/block/drbd/drbd_main.c 2011-05-19 00:06:34.000000000 -0400
27553+++ linux-2.6.39/drivers/block/drbd/drbd_main.c 2011-05-22 19:36:31.000000000 -0400
27554@@ -2387,7 +2387,7 @@ static int _drbd_send_ack(struct drbd_co
8308f9c9
MT		 27555 p.sector = sector;
27556 p.block_id = block_id;
27557 p.blksize = blksize;
27558- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
27559+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
27560
27561 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
66a7e928
MT		 27562 return false;
27563@@ -2686,7 +2686,7 @@ int drbd_send_dblock(struct drbd_conf *m
8308f9c9
MT		 27564 p.sector = cpu_to_be64(req->sector);
27565 p.block_id = (unsigned long)req;
27566 p.seq_num = cpu_to_be32(req->seq_num =
27567- atomic_add_return(1, &mdev->packet_seq));
27568+ atomic_add_return_unchecked(1, &mdev->packet_seq));
27569
27570 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
27571
66a7e928 27572@@ -2971,7 +2971,7 @@ void drbd_init_set_defaults(struct drbd_
8308f9c9
MT		 27573 atomic_set(&mdev->unacked_cnt, 0);
27574 atomic_set(&mdev->local_cnt, 0);
27575 atomic_set(&mdev->net_cnt, 0);
27576- atomic_set(&mdev->packet_seq, 0);
27577+ atomic_set_unchecked(&mdev->packet_seq, 0);
27578 atomic_set(&mdev->pp_in_use, 0);
27579 atomic_set(&mdev->pp_in_use_by_net, 0);
27580 atomic_set(&mdev->rs_sect_in, 0);
66a7e928 27581@@ -3051,8 +3051,8 @@ void drbd_mdev_cleanup(struct drbd_conf
8308f9c9
MT		 27582 mdev->receiver.t_state);
27583
27584 /* no need to lock it, I'm the only thread alive */
27585- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
27586- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
27587+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
27588+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
27589 mdev->al_writ_cnt =
27590 mdev->bm_writ_cnt =
27591 mdev->read_cnt =
66a7e928
MT		 27592diff -urNp linux-2.6.39/drivers/block/drbd/drbd_nl.c linux-2.6.39/drivers/block/drbd/drbd_nl.c
27593--- linux-2.6.39/drivers/block/drbd/drbd_nl.c 2011-05-19 00:06:34.000000000 -0400
27594+++ linux-2.6.39/drivers/block/drbd/drbd_nl.c 2011-05-22 19:36:31.000000000 -0400
27595@@ -2298,7 +2298,7 @@ static void drbd_connector_callback(stru
8308f9c9
MT		 27596 module_put(THIS_MODULE);
27597 }
27598
27599-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27600+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27601
27602 static unsigned short *
27603 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
66a7e928 27604@@ -2369,7 +2369,7 @@ void drbd_bcast_state(struct drbd_conf *
8308f9c9
MT		 27605 cn_reply->id.idx = CN_IDX_DRBD;
27606 cn_reply->id.val = CN_VAL_DRBD;
27607
27608- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27609+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27610 cn_reply->ack = 0; /* not used here. */
27611 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27612 (int)((char *)tl - (char *)reply->tag_list);
66a7e928 27613@@ -2401,7 +2401,7 @@ void drbd_bcast_ev_helper(struct drbd_co
8308f9c9
MT		 27614 cn_reply->id.idx = CN_IDX_DRBD;
27615 cn_reply->id.val = CN_VAL_DRBD;
27616
27617- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27618+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27619 cn_reply->ack = 0; /* not used here. */
27620 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27621 (int)((char *)tl - (char *)reply->tag_list);
66a7e928 27622@@ -2479,7 +2479,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
8308f9c9
MT		 27623 cn_reply->id.idx = CN_IDX_DRBD;
27624 cn_reply->id.val = CN_VAL_DRBD;
27625
27626- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
27627+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
27628 cn_reply->ack = 0; // not used here.
27629 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27630 (int)((char*)tl - (char*)reply->tag_list);
66a7e928 27631@@ -2518,7 +2518,7 @@ void drbd_bcast_sync_progress(struct drb
8308f9c9
MT		 27632 cn_reply->id.idx = CN_IDX_DRBD;
27633 cn_reply->id.val = CN_VAL_DRBD;
27634
27635- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27636+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27637 cn_reply->ack = 0; /* not used here. */
27638 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27639 (int)((char *)tl - (char *)reply->tag_list);
66a7e928
MT		 27640diff -urNp linux-2.6.39/drivers/block/drbd/drbd_receiver.c linux-2.6.39/drivers/block/drbd/drbd_receiver.c
27641--- linux-2.6.39/drivers/block/drbd/drbd_receiver.c 2011-05-19 00:06:34.000000000 -0400
27642+++ linux-2.6.39/drivers/block/drbd/drbd_receiver.c 2011-05-22 19:36:31.000000000 -0400
27643@@ -894,7 +894,7 @@ retry:
8308f9c9
MT		 27644 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
27645 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
27646
27647- atomic_set(&mdev->packet_seq, 0);
27648+ atomic_set_unchecked(&mdev->packet_seq, 0);
27649 mdev->peer_seq = 0;
27650
27651 drbd_thread_start(&mdev->asender);
66a7e928 27652@@ -990,7 +990,7 @@ static enum finish_epoch drbd_may_finish
8308f9c9
MT		 27653 do {
27654 next_epoch = NULL;
27655
27656- epoch_size = atomic_read(&epoch->epoch_size);
27657+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
27658
27659 switch (ev & ~EV_CLEANUP) {
27660 case EV_PUT:
66a7e928 27661@@ -1025,7 +1025,7 @@ static enum finish_epoch drbd_may_finish
8308f9c9
MT		 27662 rv = FE_DESTROYED;
27663 } else {
27664 epoch->flags = 0;
27665- atomic_set(&epoch->epoch_size, 0);
27666+ atomic_set_unchecked(&epoch->epoch_size, 0);
27667 /* atomic_set(&epoch->active, 0); is already zero */
27668 if (rv == FE_STILL_LIVE)
27669 rv = FE_RECYCLED;
66a7e928 27670@@ -1196,14 +1196,14 @@ static int receive_Barrier(struct drbd_c
8308f9c9
MT		 27671 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
27672 drbd_flush(mdev);
27673
27674- if (atomic_read(&mdev->current_epoch->epoch_size)) {
27675+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27676 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
27677 if (epoch)
27678 break;
27679 }
27680
27681 epoch = mdev->current_epoch;
27682- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
27683+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
27684
27685 D_ASSERT(atomic_read(&epoch->active) == 0);
27686 D_ASSERT(epoch->flags == 0);
66a7e928 27687@@ -1215,11 +1215,11 @@ static int receive_Barrier(struct drbd_c
8308f9c9
MT		 27688 }
27689
27690 epoch->flags = 0;
27691- atomic_set(&epoch->epoch_size, 0);
27692+ atomic_set_unchecked(&epoch->epoch_size, 0);
27693 atomic_set(&epoch->active, 0);
27694
27695 spin_lock(&mdev->epoch_lock);
27696- if (atomic_read(&mdev->current_epoch->epoch_size)) {
27697+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27698 list_add(&epoch->list, &mdev->current_epoch->list);
27699 mdev->current_epoch = epoch;
27700 mdev->epochs++;
66a7e928 27701@@ -1668,7 +1668,7 @@ static int receive_Data(struct drbd_conf
8308f9c9
MT		 27702 spin_unlock(&mdev->peer_seq_lock);
27703
27704 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
27705- atomic_inc(&mdev->current_epoch->epoch_size);
27706+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
27707 return drbd_drain_block(mdev, data_size);
27708 }
27709
66a7e928 27710@@ -1694,7 +1694,7 @@ static int receive_Data(struct drbd_conf
8308f9c9
MT		 27711
27712 spin_lock(&mdev->epoch_lock);
27713 e->epoch = mdev->current_epoch;
27714- atomic_inc(&e->epoch->epoch_size);
27715+ atomic_inc_unchecked(&e->epoch->epoch_size);
27716 atomic_inc(&e->epoch->active);
27717 spin_unlock(&mdev->epoch_lock);
27718
66a7e928 27719@@ -3905,7 +3905,7 @@ static void drbd_disconnect(struct drbd_
8308f9c9
MT		 27720 D_ASSERT(list_empty(&mdev->done_ee));
27721
27722 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
27723- atomic_set(&mdev->current_epoch->epoch_size, 0);
27724+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
27725 D_ASSERT(list_empty(&mdev->current_epoch->list));
27726 }
27727
66a7e928
MT		 27728diff -urNp linux-2.6.39/drivers/block/nbd.c linux-2.6.39/drivers/block/nbd.c
27729--- linux-2.6.39/drivers/block/nbd.c 2011-05-19 00:06:34.000000000 -0400
27730+++ linux-2.6.39/drivers/block/nbd.c 2011-05-22 19:36:31.000000000 -0400
27731@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
27732 struct kvec iov;
27733 sigset_t blocked, oldset;
27734
27735+ pax_track_stack();
27736+
27737 if (unlikely(!sock)) {
27738 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
27739 lo->disk->disk_name, (send ? "send" : "recv"));
27740@@ -571,6 +573,8 @@ static void do_nbd_request(struct reques
27741 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
27742 unsigned int cmd, unsigned long arg)
27743 {
27744+ pax_track_stack();
27745+
27746 switch (cmd) {
27747 case NBD_DISCONNECT: {
27748 struct request sreq;
27749diff -urNp linux-2.6.39/drivers/block/smart1,2.h linux-2.6.39/drivers/block/smart1,2.h
27750--- linux-2.6.39/drivers/block/smart1,2.h 2011-05-19 00:06:34.000000000 -0400
27751+++ linux-2.6.39/drivers/block/smart1,2.h 2011-05-22 19:36:31.000000000 -0400
27752@@ -107,7 +107,7 @@ static unsigned long smart4_intr_pending
27753 return 0 ;
27754 }
27755
27756-static struct access_method smart4_access = {
27757+static const struct access_method smart4_access = {
27758 smart4_submit_command,
27759 smart4_intr_mask,
27760 smart4_fifo_full,
27761@@ -143,7 +143,7 @@ static unsigned long smart2_intr_pending
27762 return readl(h->vaddr + INTR_PENDING);
27763 }
27764
27765-static struct access_method smart2_access = {
27766+static const struct access_method smart2_access = {
27767 smart2_submit_command,
27768 smart2_intr_mask,
27769 smart2_fifo_full,
27770@@ -179,7 +179,7 @@ static unsigned long smart2e_intr_pendin
27771 return inl(h->io_mem_addr + INTR_PENDING);
27772 }
27773
27774-static struct access_method smart2e_access = {
27775+static const struct access_method smart2e_access = {
27776 smart2e_submit_command,
27777 smart2e_intr_mask,
27778 smart2e_fifo_full,
27779@@ -269,7 +269,7 @@ static unsigned long smart1_intr_pending
27780 return chan;
27781 }
27782
27783-static struct access_method smart1_access = {
27784+static const struct access_method smart1_access = {
27785 smart1_submit_command,
27786 smart1_intr_mask,
27787 smart1_fifo_full,
27788diff -urNp linux-2.6.39/drivers/block/xsysace.c linux-2.6.39/drivers/block/xsysace.c
27789--- linux-2.6.39/drivers/block/xsysace.c 2011-05-19 00:06:34.000000000 -0400
27790+++ linux-2.6.39/drivers/block/xsysace.c 2011-05-22 19:36:31.000000000 -0400
27791@@ -262,7 +262,7 @@ static void ace_dataout_8(struct ace_dev
27792 ace->data_ptr = src;
27793 }
27794
27795-static struct ace_reg_ops ace_reg_8_ops = {
27796+static const struct ace_reg_ops ace_reg_8_ops = {
27797 .in = ace_in_8,
27798 .out = ace_out_8,
27799 .datain = ace_datain_8,
27800@@ -327,14 +327,14 @@ static void ace_dataout_le16(struct ace_
27801 ace->data_ptr = src;
27802 }
27803
27804-static struct ace_reg_ops ace_reg_be16_ops = {
27805+static const struct ace_reg_ops ace_reg_be16_ops = {
27806 .in = ace_in_be16,
27807 .out = ace_out_be16,
27808 .datain = ace_datain_be16,
27809 .dataout = ace_dataout_be16,
27810 };
27811
27812-static struct ace_reg_ops ace_reg_le16_ops = {
27813+static const struct ace_reg_ops ace_reg_le16_ops = {
27814 .in = ace_in_le16,
27815 .out = ace_out_le16,
27816 .datain = ace_datain_le16,
27817diff -urNp linux-2.6.39/drivers/char/agp/frontend.c linux-2.6.39/drivers/char/agp/frontend.c
27818--- linux-2.6.39/drivers/char/agp/frontend.c 2011-05-19 00:06:34.000000000 -0400
27819+++ linux-2.6.39/drivers/char/agp/frontend.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 27820@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
58c5fc13
MT		 27821 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
27822 return -EFAULT;
27823
27824- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
27825+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
27826 return -EFAULT;
27827
27828 client = agp_find_client_by_pid(reserve.pid);
66a7e928
MT		 27829diff -urNp linux-2.6.39/drivers/char/briq_panel.c linux-2.6.39/drivers/char/briq_panel.c
27830--- linux-2.6.39/drivers/char/briq_panel.c 2011-05-19 00:06:34.000000000 -0400
27831+++ linux-2.6.39/drivers/char/briq_panel.c 2011-05-22 19:41:32.000000000 -0400
71d190be
MT		 27832@@ -9,6 +9,7 @@
27833 #include <linux/types.h>
27834 #include <linux/errno.h>
27835 #include <linux/tty.h>
27836+#include <linux/mutex.h>
27837 #include <linux/timer.h>
27838 #include <linux/kernel.h>
27839 #include <linux/wait.h>
27840@@ -34,6 +35,7 @@ static int vfd_is_open;
27841 static unsigned char vfd[40];
27842 static int vfd_cursor;
27843 static unsigned char ledpb, led;
27844+static DEFINE_MUTEX(vfd_mutex);
27845
27846 static void update_vfd(void)
27847 {
27848@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
27849 if (!vfd_is_open)
27850 return -EBUSY;
27851
27852+ mutex_lock(&vfd_mutex);
27853 for (;;) {
27854 char c;
27855 if (!indx)
27856 break;
27857- if (get_user(c, buf))
27858+ if (get_user(c, buf)) {
27859+ mutex_unlock(&vfd_mutex);
27860 return -EFAULT;
27861+ }
27862 if (esc) {
27863 set_led(c);
27864 esc = 0;
27865@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
27866 buf++;
27867 }
27868 update_vfd();
27869+ mutex_unlock(&vfd_mutex);
27870
27871 return len;
27872 }
66a7e928
MT		 27873diff -urNp linux-2.6.39/drivers/char/genrtc.c linux-2.6.39/drivers/char/genrtc.c
27874--- linux-2.6.39/drivers/char/genrtc.c 2011-05-19 00:06:34.000000000 -0400
27875+++ linux-2.6.39/drivers/char/genrtc.c 2011-05-22 19:41:32.000000000 -0400
71d190be
MT		 27876@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
27877 switch (cmd) {
27878
27879 case RTC_PLL_GET:
27880+ memset(&pll, 0, sizeof(pll));
27881 if (get_rtc_pll(&pll))
27882 return -EINVAL;
27883 else
66a7e928
MT		 27884diff -urNp linux-2.6.39/drivers/char/hpet.c linux-2.6.39/drivers/char/hpet.c
27885--- linux-2.6.39/drivers/char/hpet.c 2011-05-19 00:06:34.000000000 -0400
27886+++ linux-2.6.39/drivers/char/hpet.c 2011-05-22 19:36:31.000000000 -0400
57199397 27887@@ -553,7 +553,7 @@ static inline unsigned long hpet_time_di
ae4e228f
MT		 27888 }
27889
df50ba0c 27890 static int
bc901d79
MT		 27891-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
27892+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
27893 struct hpet_info *info)
ae4e228f 27894 {
df50ba0c 27895 struct hpet_timer __iomem *timer;
66a7e928
MT		 27896diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c
27897--- linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c 2011-05-19 00:06:34.000000000 -0400
27898+++ linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c 2011-05-22 19:36:31.000000000 -0400
27899@@ -109,8 +109,7 @@ static int ipmi_fasync(int fd, struct fi
27900 return (result);
27901 }
27902
27903-static struct ipmi_user_hndl ipmi_hndlrs =
27904-{
27905+static const struct ipmi_user_hndl ipmi_hndlrs = {
27906 .ipmi_recv_hndl = file_receive_handler,
27907 };
27908
27909diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c
27910--- linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c 2011-05-19 00:06:34.000000000 -0400
27911+++ linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c 2011-05-22 19:36:31.000000000 -0400
27912@@ -82,7 +82,7 @@ struct ipmi_user {
27913 struct kref refcount;
27914
27915 /* The upper layer that handles receive messages. */
27916- struct ipmi_user_hndl *handler;
27917+ const struct ipmi_user_hndl *handler;
27918 void *handler_data;
27919
27920 /* The interface this user is bound to. */
ae4e228f 27921@@ -414,7 +414,7 @@ struct ipmi_smi {
58c5fc13
MT		 27922 struct proc_dir_entry *proc_dir;
27923 char proc_dir_name[10];
27924
27925- atomic_t stats[IPMI_NUM_STATS];
27926+ atomic_unchecked_t stats[IPMI_NUM_STATS];
27927
27928 /*
27929 * run_to_completion duplicate of smb_info, smi_info
ae4e228f 27930@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
58c5fc13
MT		 27931
27932
27933 #define ipmi_inc_stat(intf, stat) \
27934- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
27935+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
27936 #define ipmi_get_stat(intf, stat) \
27937- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
27938+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
27939
27940 static int is_lan_addr(struct ipmi_addr *addr)
27941 {
66a7e928
MT		 27942@@ -875,7 +875,7 @@ static int intf_err_seq(ipmi_smi_t int
27943
27944
27945 int ipmi_create_user(unsigned int if_num,
27946- struct ipmi_user_hndl *handler,
27947+ const struct ipmi_user_hndl *handler,
27948 void *handler_data,
27949 ipmi_user_t *user)
27950 {
16454cff 27951@@ -2844,7 +2844,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
58c5fc13
MT		 27952 INIT_LIST_HEAD(&intf->cmd_rcvrs);
27953 init_waitqueue_head(&intf->waitq);
27954 for (i = 0; i < IPMI_NUM_STATS; i++)
27955- atomic_set(&intf->stats[i], 0);
27956+ atomic_set_unchecked(&intf->stats[i], 0);
27957
27958 intf->proc_dir = NULL;
27959
66a7e928
MT		 27960@@ -4196,6 +4196,8 @@ static void send_panic_events(char *str)
27961 struct ipmi_smi_msg smi_msg;
27962 struct ipmi_recv_msg recv_msg;
27963
27964+ pax_track_stack();
27965+
27966 si = (struct ipmi_system_interface_addr *) &addr;
27967 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
27968 si->channel = IPMI_BMC_CHANNEL;
27969diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c
27970--- linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c 2011-05-19 00:06:34.000000000 -0400
27971+++ linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c 2011-05-22 19:36:31.000000000 -0400
27972@@ -133,7 +133,7 @@ static void receive_handler(struct ipmi_
27973 complete(comp);
27974 }
27975
27976-static struct ipmi_user_hndl ipmi_poweroff_handler = {
27977+static const struct ipmi_user_hndl ipmi_poweroff_handler = {
27978 .ipmi_recv_hndl = receive_handler
27979 };
27980
27981diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c
27982--- linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c 2011-05-19 00:06:34.000000000 -0400
27983+++ linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c 2011-05-22 19:36:31.000000000 -0400
27984@@ -276,7 +276,7 @@ struct smi_info {
58c5fc13
MT		 27985 unsigned char slave_addr;
27986
27987 /* Counters and things for the proc filesystem. */
27988- atomic_t stats[SI_NUM_STATS];
27989+ atomic_unchecked_t stats[SI_NUM_STATS];
27990
27991 struct task_struct *thread;
27992
66a7e928 27993@@ -285,9 +285,9 @@ struct smi_info {
58c5fc13
MT		 27994 };
27995
27996 #define smi_inc_stat(smi, stat) \
27997- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
27998+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
27999 #define smi_get_stat(smi, stat) \
28000- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28001+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28002
28003 #define SI_MAX_PARMS 4
28004
66a7e928 28005@@ -3198,7 +3198,7 @@ static int try_smi_init(struct smi_info
58c5fc13
MT		 28006 atomic_set(&new_smi->req_events, 0);
28007 new_smi->run_to_completion = 0;
28008 for (i = 0; i < SI_NUM_STATS; i++)
28009- atomic_set(&new_smi->stats[i], 0);
28010+ atomic_set_unchecked(&new_smi->stats[i], 0);
28011
57199397 28012 new_smi->interrupt_disabled = 1;
58c5fc13 28013 atomic_set(&new_smi->stop_operation, 0);
66a7e928
MT		 28014diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c
28015--- linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c 2011-05-19 00:06:34.000000000 -0400
28016+++ linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c 2011-05-22 19:36:31.000000000 -0400
28017@@ -216,7 +216,7 @@ static int set_param_timeout(const char
28018 return rv;
28019 }
71d190be 28020
66a7e928
MT		 28021-static struct kernel_param_ops param_ops_timeout = {
28022+static const struct kernel_param_ops param_ops_timeout = {
28023 .set = set_param_timeout,
28024 .get = param_get_int,
28025 };
28026@@ -278,14 +278,14 @@ static int set_param_wdog_ifnum(const ch
28027 return 0;
28028 }
71d190be 28029
66a7e928
MT		 28030-static struct kernel_param_ops param_ops_wdog_ifnum = {
28031+static const struct kernel_param_ops param_ops_wdog_ifnum = {
28032 .set = set_param_wdog_ifnum,
28033 .get = param_get_int,
28034 };
28035
28036 #define param_check_wdog_ifnum param_check_int
28037
28038-static struct kernel_param_ops param_ops_str = {
28039+static const struct kernel_param_ops param_ops_str = {
28040 .set = set_param_str,
28041 .get = get_param_str,
28042 };
28043@@ -953,7 +953,7 @@ static void ipmi_wdog_pretimeout_handler
28044 pretimeout_since_last_heartbeat = 1;
28045 }
28046
28047-static struct ipmi_user_hndl ipmi_hndlrs = {
28048+static const struct ipmi_user_hndl ipmi_hndlrs = {
28049 .ipmi_recv_hndl = ipmi_wdog_msg_handler,
28050 .ipmi_watchdog_pretimeout = ipmi_wdog_pretimeout_handler
28051 };
28052diff -urNp linux-2.6.39/drivers/char/Kconfig linux-2.6.39/drivers/char/Kconfig
28053--- linux-2.6.39/drivers/char/Kconfig 2011-05-19 00:06:34.000000000 -0400
28054+++ linux-2.6.39/drivers/char/Kconfig 2011-05-22 19:41:37.000000000 -0400
28055@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
71d190be
MT		 28056
28057 config DEVKMEM
28058 bool "/dev/kmem virtual device support"
28059- default y
28060+ default n
28061+ depends on !GRKERNSEC_KMEM
28062 help
28063 Say Y here if you want to support the /dev/kmem device. The
28064 /dev/kmem device is rarely used, but can be used for certain
66a7e928 28065@@ -596,6 +597,7 @@ config DEVPORT
71d190be
MT		 28066 bool
28067 depends on !M68K
28068 depends on ISA || PCI
28069+ depends on !GRKERNSEC_KMEM
28070 default y
28071
28072 source "drivers/s390/char/Kconfig"
66a7e928
MT		 28073diff -urNp linux-2.6.39/drivers/char/mem.c linux-2.6.39/drivers/char/mem.c
28074--- linux-2.6.39/drivers/char/mem.c 2011-05-19 00:06:34.000000000 -0400
28075+++ linux-2.6.39/drivers/char/mem.c 2011-05-22 19:41:37.000000000 -0400
58c5fc13
MT		 28076@@ -18,6 +18,7 @@
28077 #include <linux/raw.h>
28078 #include <linux/tty.h>
28079 #include <linux/capability.h>
28080+#include <linux/security.h>
28081 #include <linux/ptrace.h>
28082 #include <linux/device.h>
28083 #include <linux/highmem.h>
ae4e228f 28084@@ -34,6 +35,10 @@
58c5fc13
MT		 28085 # include <linux/efi.h>
28086 #endif
28087
28088+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28089+extern struct file_operations grsec_fops;
28090+#endif
28091+
ae4e228f
MT		 28092 static inline unsigned long size_inside_page(unsigned long start,
28093 unsigned long size)
28094 {
66a7e928 28095@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
71d190be
MT		 28096
28097 while (cursor < to) {
28098 if (!devmem_is_allowed(pfn)) {
28099+#ifdef CONFIG_GRKERNSEC_KMEM
28100+ gr_handle_mem_readwrite(from, to);
28101+#else
28102 printk(KERN_INFO
28103 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
28104 current->comm, from, to);
28105+#endif
28106 return 0;
28107 }
28108 cursor += PAGE_SIZE;
66a7e928 28109@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
71d190be
MT		 28110 }
28111 return 1;
28112 }
28113+#elif defined(CONFIG_GRKERNSEC_KMEM)
28114+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28115+{
28116+ return 0;
28117+}
28118 #else
28119 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28120 {
66a7e928 28121@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
57199397
MT		 28122
28123 while (count > 0) {
28124 unsigned long remaining;
28125+ char *temp;
28126
28127 sz = size_inside_page(p, count);
28128
66a7e928 28129@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
57199397
MT		 28130 if (!ptr)
28131 return -EFAULT;
28132
28133- remaining = copy_to_user(buf, ptr, sz);
28134+#ifdef CONFIG_PAX_USERCOPY
28135+ temp = kmalloc(sz, GFP_KERNEL);
28136+ if (!temp) {
28137+ unxlate_dev_mem_ptr(p, ptr);
28138+ return -ENOMEM;
28139+ }
28140+ memcpy(temp, ptr, sz);
28141+#else
28142+ temp = ptr;
28143+#endif
28144+
28145+ remaining = copy_to_user(buf, temp, sz);
28146+
28147+#ifdef CONFIG_PAX_USERCOPY
28148+ kfree(temp);
28149+#endif
28150+
28151 unxlate_dev_mem_ptr(p, ptr);
28152 if (remaining)
28153 return -EFAULT;
66a7e928 28154@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
57199397
MT		 28155 size_t count, loff_t *ppos)
28156 {
28157 unsigned long p = *ppos;
28158- ssize_t low_count, read, sz;
28159+ ssize_t low_count, read, sz, err = 0;
28160 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
28161- int err = 0;
28162
28163 read = 0;
28164 if (p < (unsigned long) high_memory) {
66a7e928 28165@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
57199397
MT		 28166 }
28167 #endif
28168 while (low_count > 0) {
28169+ char *temp;
28170+
28171 sz = size_inside_page(p, low_count);
28172
28173 /*
66a7e928 28174@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
57199397
MT		 28175 */
28176 kbuf = xlate_dev_kmem_ptr((char *)p);
28177
28178- if (copy_to_user(buf, kbuf, sz))
28179+#ifdef CONFIG_PAX_USERCOPY
28180+ temp = kmalloc(sz, GFP_KERNEL);
28181+ if (!temp)
28182+ return -ENOMEM;
28183+ memcpy(temp, kbuf, sz);
28184+#else
28185+ temp = kbuf;
28186+#endif
28187+
28188+ err = copy_to_user(buf, temp, sz);
28189+
28190+#ifdef CONFIG_PAX_USERCOPY
28191+ kfree(temp);
28192+#endif
28193+
28194+ if (err)
28195 return -EFAULT;
28196 buf += sz;
28197 p += sz;
66a7e928 28198@@ -854,6 +901,9 @@ static const struct memdev {
58c5fc13 28199 #ifdef CONFIG_CRASH_DUMP
ae4e228f 28200 [12] = { "oldmem", 0, &oldmem_fops, NULL },
58c5fc13
MT		 28201 #endif
28202+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
ae4e228f 28203+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
58c5fc13
MT		 28204+#endif
28205 };
28206
28207 static int memory_open(struct inode *inode, struct file *filp)
66a7e928
MT		 28208diff -urNp linux-2.6.39/drivers/char/mmtimer.c linux-2.6.39/drivers/char/mmtimer.c
28209--- linux-2.6.39/drivers/char/mmtimer.c 2011-05-19 00:06:34.000000000 -0400
28210+++ linux-2.6.39/drivers/char/mmtimer.c 2011-05-22 19:36:31.000000000 -0400
28211@@ -53,7 +53,7 @@ MODULE_LICENSE("GPL");
28212
28213 #define RTC_BITS 55 /* 55 bits for this implementation */
28214
28215-static struct k_clock sgi_clock;
28216+static const struct k_clock sgi_clock;
28217
28218 extern unsigned long sn_rtc_cycles_per_second;
28219
28220@@ -772,7 +772,7 @@ static int sgi_clock_getres(const clocki
28221 return 0;
28222 }
28223
28224-static struct k_clock sgi_clock = {
28225+static const struct k_clock sgi_clock = {
28226 .clock_set = sgi_clock_set,
28227 .clock_get = sgi_clock_get,
28228 .clock_getres = sgi_clock_getres,
28229diff -urNp linux-2.6.39/drivers/char/nvram.c linux-2.6.39/drivers/char/nvram.c
28230--- linux-2.6.39/drivers/char/nvram.c 2011-05-19 00:06:34.000000000 -0400
28231+++ linux-2.6.39/drivers/char/nvram.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 28232@@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
ae4e228f
MT		 28233
28234 spin_unlock_irq(&rtc_lock);
58c5fc13 28235
ae4e228f
MT		 28236- if (copy_to_user(buf, contents, tmp - contents))
28237+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
28238 return -EFAULT;
28239
28240 *ppos = i;
66a7e928
MT		 28241diff -urNp linux-2.6.39/drivers/char/random.c linux-2.6.39/drivers/char/random.c
28242--- linux-2.6.39/drivers/char/random.c 2011-05-19 00:06:34.000000000 -0400
28243+++ linux-2.6.39/drivers/char/random.c 2011-05-22 19:41:37.000000000 -0400
28244@@ -261,8 +261,13 @@
58c5fc13
MT		 28245 /*
28246 * Configuration information
28247 */
28248+#ifdef CONFIG_GRKERNSEC_RANDNET
28249+#define INPUT_POOL_WORDS 512
28250+#define OUTPUT_POOL_WORDS 128
28251+#else
28252 #define INPUT_POOL_WORDS 128
28253 #define OUTPUT_POOL_WORDS 32
28254+#endif
28255 #define SEC_XFER_SIZE 512
57199397 28256 #define EXTRACT_SIZE 10
58c5fc13 28257
66a7e928 28258@@ -300,10 +305,17 @@ static struct poolinfo {
58c5fc13
MT		 28259 int poolwords;
28260 int tap1, tap2, tap3, tap4, tap5;
28261 } poolinfo_table[] = {
28262+#ifdef CONFIG_GRKERNSEC_RANDNET
28263+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
28264+ { 512, 411, 308, 208, 104, 1 },
28265+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
28266+ { 128, 103, 76, 51, 25, 1 },
28267+#else
28268 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
28269 { 128, 103, 76, 51, 25, 1 },
28270 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
28271 { 32, 26, 20, 14, 7, 1 },
28272+#endif
28273 #if 0
28274 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
28275 { 2048, 1638, 1231, 819, 411, 1 },
66a7e928 28276@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
ae4e228f
MT		 28277
28278 extract_buf(r, tmp);
28279 i = min_t(int, nbytes, EXTRACT_SIZE);
28280- if (copy_to_user(buf, tmp, i)) {
28281+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
28282 ret = -EFAULT;
28283 break;
28284 }
66a7e928 28285@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
58c5fc13
MT		 28286 #include <linux/sysctl.h>
28287
28288 static int min_read_thresh = 8, min_write_thresh;
28289-static int max_read_thresh = INPUT_POOL_WORDS * 32;
28290+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
28291 static int max_write_thresh = INPUT_POOL_WORDS * 32;
28292 static char sysctl_bootid[16];
28293
66a7e928
MT		 28294diff -urNp linux-2.6.39/drivers/char/sonypi.c linux-2.6.39/drivers/char/sonypi.c
28295--- linux-2.6.39/drivers/char/sonypi.c 2011-05-19 00:06:34.000000000 -0400
28296+++ linux-2.6.39/drivers/char/sonypi.c 2011-05-22 19:36:31.000000000 -0400
c52201e0
MT		 28297@@ -55,6 +55,7 @@
28298 #include <asm/uaccess.h>
28299 #include <asm/io.h>
28300 #include <asm/system.h>
28301+#include <asm/local.h>
28302
28303 #include <linux/sonypi.h>
28304
28305@@ -491,7 +492,7 @@ static struct sonypi_device {
58c5fc13
MT		 28306 spinlock_t fifo_lock;
28307 wait_queue_head_t fifo_proc_list;
28308 struct fasync_struct *fifo_async;
28309- int open_count;
c52201e0 28310+ local_t open_count;
58c5fc13
MT		 28311 int model;
28312 struct input_dev *input_jog_dev;
28313 struct input_dev *input_key_dev;
c52201e0 28314@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
58c5fc13
MT		 28315 static int sonypi_misc_release(struct inode *inode, struct file *file)
28316 {
28317 mutex_lock(&sonypi_device.lock);
28318- sonypi_device.open_count--;
c52201e0 28319+ local_dec(&sonypi_device.open_count);
58c5fc13
MT		 28320 mutex_unlock(&sonypi_device.lock);
28321 return 0;
28322 }
c52201e0 28323@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
ae4e228f 28324 {
58c5fc13
MT		 28325 mutex_lock(&sonypi_device.lock);
28326 /* Flush input queue on first open */
28327- if (!sonypi_device.open_count)
c52201e0 28328+ if (!local_read(&sonypi_device.open_count))
ae4e228f 28329 kfifo_reset(&sonypi_device.fifo);
58c5fc13 28330- sonypi_device.open_count++;
c52201e0 28331+ local_inc(&sonypi_device.open_count);
58c5fc13 28332 mutex_unlock(&sonypi_device.lock);
ae4e228f 28333
58c5fc13 28334 return 0;
66a7e928
MT		 28335diff -urNp linux-2.6.39/drivers/char/tpm/tpm_bios.c linux-2.6.39/drivers/char/tpm/tpm_bios.c
28336--- linux-2.6.39/drivers/char/tpm/tpm_bios.c 2011-05-19 00:06:34.000000000 -0400
28337+++ linux-2.6.39/drivers/char/tpm/tpm_bios.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 28338@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
ae4e228f
MT		 28339 event = addr;
28340
28341 if ((event->event_type == 0 && event->event_size == 0) ||
28342- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
28343+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
28344 return NULL;
28345
28346 return addr;
df50ba0c 28347@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
ae4e228f
MT		 28348 return NULL;
28349
28350 if ((event->event_type == 0 && event->event_size == 0) ||
28351- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
28352+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
28353 return NULL;
28354
28355 (*pos)++;
df50ba0c 28356@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
ae4e228f
MT		 28357 int i;
28358
28359 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
28360- seq_putc(m, data[i]);
28361+ if (!seq_putc(m, data[i]))
28362+ return -EFAULT;
28363
58c5fc13
MT		 28364 return 0;
28365 }
df50ba0c 28366@@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log
ae4e228f 28367 log->bios_event_log_end = log->bios_event_log + len;
58c5fc13 28368
ae4e228f
MT		 28369 virt = acpi_os_map_memory(start, len);
28370+ if (!virt) {
28371+ kfree(log->bios_event_log);
28372+ log->bios_event_log = NULL;
28373+ return -EFAULT;
28374+ }
28375
28376 memcpy(log->bios_event_log, virt, len);
28377
66a7e928
MT		 28378diff -urNp linux-2.6.39/drivers/char/tpm/tpm.c linux-2.6.39/drivers/char/tpm/tpm.c
28379--- linux-2.6.39/drivers/char/tpm/tpm.c 2011-05-19 00:06:34.000000000 -0400
28380+++ linux-2.6.39/drivers/char/tpm/tpm.c 2011-05-22 19:36:31.000000000 -0400
16454cff
MT		 28381@@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c
28382 chip->vendor.req_complete_val)
28383 goto out_recv;
28384
28385- if ((status == chip->vendor.req_canceled)) {
28386+ if (status == chip->vendor.req_canceled) {
28387 dev_err(chip->dev, "Operation Canceled\n");
28388 rc = -ECANCELED;
28389 goto out;
66a7e928
MT		 28390@@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de
28391
28392 struct tpm_chip *chip = dev_get_drvdata(dev);
28393
28394+ pax_track_stack();
28395+
28396 tpm_cmd.header.in = tpm_readpubek_header;
28397 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
28398 "attempting to read the PUBEK");
28399diff -urNp linux-2.6.39/drivers/char/ttyprintk.c linux-2.6.39/drivers/char/ttyprintk.c
28400--- linux-2.6.39/drivers/char/ttyprintk.c 2011-05-19 00:06:34.000000000 -0400
28401+++ linux-2.6.39/drivers/char/ttyprintk.c 2011-05-22 19:36:31.000000000 -0400
28402@@ -170,7 +170,7 @@ static const struct tty_operations ttypr
28403 .ioctl = tpk_ioctl,
ae4e228f
MT		 28404 };
28405
66a7e928
MT		 28406-struct tty_port_operations null_ops = { };
28407+const struct tty_port_operations null_ops = { };
28408
28409 static struct tty_driver *ttyprintk_driver;
28410
28411diff -urNp linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c
28412--- linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-19 00:06:34.000000000 -0400
28413+++ linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-22 19:36:31.000000000 -0400
28414@@ -678,14 +678,14 @@ static int __devinit hwicap_setup(struct
28415 return retval;
28416 }
28417
28418-static struct hwicap_driver_config buffer_icap_config = {
28419+static const struct hwicap_driver_config buffer_icap_config = {
28420 .get_configuration = buffer_icap_get_configuration,
28421 .set_configuration = buffer_icap_set_configuration,
28422 .get_status = buffer_icap_get_status,
28423 .reset = buffer_icap_reset,
28424 };
28425
28426-static struct hwicap_driver_config fifo_icap_config = {
28427+static const struct hwicap_driver_config fifo_icap_config = {
28428 .get_configuration = fifo_icap_get_configuration,
28429 .set_configuration = fifo_icap_set_configuration,
28430 .get_status = fifo_icap_get_status,
28431diff -urNp linux-2.6.39/drivers/crypto/hifn_795x.c linux-2.6.39/drivers/crypto/hifn_795x.c
28432--- linux-2.6.39/drivers/crypto/hifn_795x.c 2011-05-19 00:06:34.000000000 -0400
28433+++ linux-2.6.39/drivers/crypto/hifn_795x.c 2011-05-22 19:36:31.000000000 -0400
28434@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
28435 0xCA, 0x34, 0x2B, 0x2E};
28436 struct scatterlist sg;
28437
28438+ pax_track_stack();
28439+
28440 memset(src, 0, sizeof(src));
28441 memset(ctx.key, 0, sizeof(ctx.key));
28442
28443diff -urNp linux-2.6.39/drivers/crypto/padlock-aes.c linux-2.6.39/drivers/crypto/padlock-aes.c
28444--- linux-2.6.39/drivers/crypto/padlock-aes.c 2011-05-19 00:06:34.000000000 -0400
28445+++ linux-2.6.39/drivers/crypto/padlock-aes.c 2011-05-22 19:36:31.000000000 -0400
28446@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
28447 struct crypto_aes_ctx gen_aes;
28448 int cpu;
28449
28450+ pax_track_stack();
28451+
28452 if (key_len % 8) {
28453 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
28454 return -EINVAL;
28455diff -urNp linux-2.6.39/drivers/dca/dca-core.c linux-2.6.39/drivers/dca/dca-core.c
28456--- linux-2.6.39/drivers/dca/dca-core.c 2011-05-19 00:06:34.000000000 -0400
28457+++ linux-2.6.39/drivers/dca/dca-core.c 2011-05-22 19:36:31.000000000 -0400
28458@@ -325,7 +325,7 @@ EXPORT_SYMBOL_GPL(dca_get_tag);
28459 * @ops - pointer to struct of dca operation function pointers
28460 * @priv_size - size of extra mem to be added for provider's needs
28461 */
28462-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size)
28463+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size)
28464 {
28465 struct dca_provider *dca;
28466 int alloc_size;
28467diff -urNp linux-2.6.39/drivers/dma/ioat/dca.c linux-2.6.39/drivers/dma/ioat/dca.c
28468--- linux-2.6.39/drivers/dma/ioat/dca.c 2011-05-19 00:06:34.000000000 -0400
28469+++ linux-2.6.39/drivers/dma/ioat/dca.c 2011-05-22 19:36:31.000000000 -0400
28470@@ -234,7 +234,7 @@ static int ioat_dca_dev_managed(struct d
28471 return 0;
28472 }
28473
28474-static struct dca_ops ioat_dca_ops = {
28475+static const struct dca_ops ioat_dca_ops = {
28476 .add_requester = ioat_dca_add_requester,
28477 .remove_requester = ioat_dca_remove_requester,
28478 .get_tag = ioat_dca_get_tag,
28479@@ -384,7 +384,7 @@ static u8 ioat2_dca_get_tag(struct dca_p
28480 return tag;
28481 }
28482
28483-static struct dca_ops ioat2_dca_ops = {
28484+static const struct dca_ops ioat2_dca_ops = {
28485 .add_requester = ioat2_dca_add_requester,
28486 .remove_requester = ioat2_dca_remove_requester,
28487 .get_tag = ioat2_dca_get_tag,
28488@@ -579,7 +579,7 @@ static u8 ioat3_dca_get_tag(struct dca_p
28489 return tag;
28490 }
28491
28492-static struct dca_ops ioat3_dca_ops = {
28493+static const struct dca_ops ioat3_dca_ops = {
28494 .add_requester = ioat3_dca_add_requester,
28495 .remove_requester = ioat3_dca_remove_requester,
28496 .get_tag = ioat3_dca_get_tag,
28497diff -urNp linux-2.6.39/drivers/edac/amd64_edac.h linux-2.6.39/drivers/edac/amd64_edac.h
28498--- linux-2.6.39/drivers/edac/amd64_edac.h 2011-05-19 00:06:34.000000000 -0400
28499+++ linux-2.6.39/drivers/edac/amd64_edac.h 2011-05-22 19:36:31.000000000 -0400
28500@@ -333,7 +333,7 @@ struct chip_select {
28501 };
28502
28503 struct amd64_pvt {
28504- struct low_ops *ops;
28505+ const struct low_ops *ops;
28506
28507 /* pci_device handles which we utilize */
28508 struct pci_dev *F1, *F2, *F3;
28509@@ -443,7 +443,7 @@ struct low_ops {
28510 struct amd64_family_type {
28511 const char *ctl_name;
28512 u16 f1_id, f3_id;
28513- struct low_ops ops;
28514+ const struct low_ops ops;
28515 };
28516
28517 int __amd64_write_pci_cfg_dword(struct pci_dev *pdev, int offset,
28518diff -urNp linux-2.6.39/drivers/edac/edac_mc_sysfs.c linux-2.6.39/drivers/edac/edac_mc_sysfs.c
28519--- linux-2.6.39/drivers/edac/edac_mc_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28520+++ linux-2.6.39/drivers/edac/edac_mc_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28521@@ -760,7 +760,7 @@ static void edac_inst_grp_release(struct
57199397
MT		 28522 }
28523
28524 /* Intermediate show/store table */
28525-static struct sysfs_ops inst_grp_ops = {
28526+static const struct sysfs_ops inst_grp_ops = {
28527 .show = inst_grp_show,
28528 .store = inst_grp_store
28529 };
66a7e928
MT		 28530diff -urNp linux-2.6.39/drivers/edac/edac_pci_sysfs.c linux-2.6.39/drivers/edac/edac_pci_sysfs.c
28531--- linux-2.6.39/drivers/edac/edac_pci_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28532+++ linux-2.6.39/drivers/edac/edac_pci_sysfs.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 28533@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
28534 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
28535 static int edac_pci_poll_msec = 1000; /* one second workq period */
28536
28537-static atomic_t pci_parity_count = ATOMIC_INIT(0);
28538-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
28539+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
28540+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
28541
28542 static struct kobject *edac_pci_top_main_kobj;
28543 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
28544@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
28545 edac_printk(KERN_CRIT, EDAC_PCI,
28546 "Signaled System Error on %s\n",
28547 pci_name(dev));
28548- atomic_inc(&pci_nonparity_count);
28549+ atomic_inc_unchecked(&pci_nonparity_count);
28550 }
28551
28552 if (status & (PCI_STATUS_PARITY)) {
28553@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
28554 "Master Data Parity Error on %s\n",
28555 pci_name(dev));
28556
28557- atomic_inc(&pci_parity_count);
28558+ atomic_inc_unchecked(&pci_parity_count);
28559 }
28560
28561 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28562@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
28563 "Detected Parity Error on %s\n",
28564 pci_name(dev));
28565
28566- atomic_inc(&pci_parity_count);
28567+ atomic_inc_unchecked(&pci_parity_count);
28568 }
28569 }
28570
28571@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
28572 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
28573 "Signaled System Error on %s\n",
28574 pci_name(dev));
28575- atomic_inc(&pci_nonparity_count);
28576+ atomic_inc_unchecked(&pci_nonparity_count);
28577 }
28578
28579 if (status & (PCI_STATUS_PARITY)) {
28580@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
28581 "Master Data Parity Error on "
28582 "%s\n", pci_name(dev));
28583
28584- atomic_inc(&pci_parity_count);
28585+ atomic_inc_unchecked(&pci_parity_count);
28586 }
28587
28588 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28589@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
28590 "Detected Parity Error on %s\n",
28591 pci_name(dev));
28592
28593- atomic_inc(&pci_parity_count);
28594+ atomic_inc_unchecked(&pci_parity_count);
28595 }
28596 }
28597 }
28598@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
28599 if (!check_pci_errors)
28600 return;
28601
28602- before_count = atomic_read(&pci_parity_count);
28603+ before_count = atomic_read_unchecked(&pci_parity_count);
28604
28605 /* scan all PCI devices looking for a Parity Error on devices and
28606 * bridges.
28607@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
28608 /* Only if operator has selected panic on PCI Error */
28609 if (edac_pci_get_panic_on_pe()) {
28610 /* If the count is different 'after' from 'before' */
28611- if (before_count != atomic_read(&pci_parity_count))
28612+ if (before_count != atomic_read_unchecked(&pci_parity_count))
28613 panic("EDAC: PCI Parity Error");
28614 }
28615 }
66a7e928
MT		 28616diff -urNp linux-2.6.39/drivers/firewire/core-cdev.c linux-2.6.39/drivers/firewire/core-cdev.c
28617--- linux-2.6.39/drivers/firewire/core-cdev.c 2011-05-19 00:06:34.000000000 -0400
28618+++ linux-2.6.39/drivers/firewire/core-cdev.c 2011-05-22 19:36:31.000000000 -0400
28619@@ -1312,8 +1312,7 @@ static int init_iso_resource(struct clie
df50ba0c 28620 int ret;
ae4e228f 28621
df50ba0c
MT		 28622 if ((request->channels == 0 && request->bandwidth == 0) ||
28623- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
28624- request->bandwidth < 0)
28625+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
28626 return -EINVAL;
ae4e228f 28627
df50ba0c 28628 r = kmalloc(sizeof(*r), GFP_KERNEL);
66a7e928
MT		 28629diff -urNp linux-2.6.39/drivers/firewire/core-transaction.c linux-2.6.39/drivers/firewire/core-transaction.c
28630--- linux-2.6.39/drivers/firewire/core-transaction.c 2011-05-19 00:06:34.000000000 -0400
28631+++ linux-2.6.39/drivers/firewire/core-transaction.c 2011-05-22 19:36:31.000000000 -0400
28632@@ -36,6 +36,7 @@
28633 #include <linux/string.h>
28634 #include <linux/timer.h>
28635 #include <linux/types.h>
28636+#include <linux/sched.h>
28637
28638 #include <asm/byteorder.h>
28639
28640@@ -420,6 +421,8 @@ int fw_run_transaction(struct fw_card *c
28641 struct transaction_callback_data d;
28642 struct fw_transaction t;
28643
28644+ pax_track_stack();
28645+
28646 init_timer_on_stack(&t.split_timeout_timer);
28647 init_completion(&d.done);
28648 d.payload = payload;
28649diff -urNp linux-2.6.39/drivers/firmware/dmi_scan.c linux-2.6.39/drivers/firmware/dmi_scan.c
28650--- linux-2.6.39/drivers/firmware/dmi_scan.c 2011-05-19 00:06:34.000000000 -0400
28651+++ linux-2.6.39/drivers/firmware/dmi_scan.c 2011-05-22 19:36:31.000000000 -0400
c52201e0 28652@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
58c5fc13
MT		 28653 }
28654 }
28655 else {
28656- /*
28657- * no iounmap() for that ioremap(); it would be a no-op, but
28658- * it's so early in setup that sucker gets confused into doing
28659- * what it shouldn't if we actually call it.
28660- */
28661 p = dmi_ioremap(0xF0000, 0x10000);
28662 if (p == NULL)
28663 goto error;
66a7e928
MT		 28664diff -urNp linux-2.6.39/drivers/gpio/vr41xx_giu.c linux-2.6.39/drivers/gpio/vr41xx_giu.c
28665--- linux-2.6.39/drivers/gpio/vr41xx_giu.c 2011-05-19 00:06:34.000000000 -0400
28666+++ linux-2.6.39/drivers/gpio/vr41xx_giu.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 28667@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
28668 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
28669 maskl, pendl, maskh, pendh);
28670
28671- atomic_inc(&irq_err_count);
28672+ atomic_inc_unchecked(&irq_err_count);
28673
28674 return -EINVAL;
28675 }
66a7e928
MT		 28676diff -urNp linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c
28677--- linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c 2011-05-19 00:06:34.000000000 -0400
28678+++ linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c 2011-05-22 19:36:31.000000000 -0400
6892158b
MT		 28679@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
28680 struct drm_crtc *tmp;
28681 int crtc_mask = 1;
28682
bc901d79 28683- WARN(!crtc, "checking null crtc?\n");
6892158b
MT		 28684+ BUG_ON(!crtc);
28685
28686 dev = crtc->dev;
28687
66a7e928
MT		 28688@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
28689 struct drm_encoder *encoder;
28690 bool ret = true;
28691
28692+ pax_track_stack();
28693+
28694 crtc->enabled = drm_helper_crtc_in_use(crtc);
28695 if (!crtc->enabled)
28696 return true;
28697diff -urNp linux-2.6.39/drivers/gpu/drm/drm_drv.c linux-2.6.39/drivers/gpu/drm/drm_drv.c
28698--- linux-2.6.39/drivers/gpu/drm/drm_drv.c 2011-05-19 00:06:34.000000000 -0400
28699+++ linux-2.6.39/drivers/gpu/drm/drm_drv.c 2011-05-22 19:36:31.000000000 -0400
28700@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
ae4e228f
MT		 28701
28702 dev = file_priv->minor->dev;
58c5fc13
MT		 28703 atomic_inc(&dev->ioctl_count);
28704- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
28705+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
28706 ++file_priv->ioctl_count;
28707
28708 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
66a7e928
MT		 28709diff -urNp linux-2.6.39/drivers/gpu/drm/drm_fops.c linux-2.6.39/drivers/gpu/drm/drm_fops.c
28710--- linux-2.6.39/drivers/gpu/drm/drm_fops.c 2011-05-19 00:06:34.000000000 -0400
28711+++ linux-2.6.39/drivers/gpu/drm/drm_fops.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 28712@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
58c5fc13
MT		 28713 }
28714
28715 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
28716- atomic_set(&dev->counts[i], 0);
28717+ atomic_set_unchecked(&dev->counts[i], 0);
28718
28719 dev->sigdata.lock = NULL;
28720
bc901d79 28721@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
58c5fc13
MT		 28722
28723 retcode = drm_open_helper(inode, filp, dev);
28724 if (!retcode) {
28725- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
6892158b 28726- if (!dev->open_count++)
58c5fc13 28727+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
c52201e0 28728+ if (local_inc_return(&dev->open_count) == 1)
58c5fc13 28729 retcode = drm_setup(dev);
6892158b
MT		 28730 }
28731 if (!retcode) {
16454cff 28732@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
58c5fc13 28733
6892158b 28734 mutex_lock(&drm_global_mutex);
58c5fc13
MT		 28735
28736- DRM_DEBUG("open_count = %d\n", dev->open_count);
c52201e0 28737+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
58c5fc13
MT		 28738
28739 if (dev->driver->preclose)
28740 dev->driver->preclose(dev, file_priv);
16454cff 28741@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
58c5fc13
MT		 28742 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
28743 task_pid_nr(current),
28744 (long)old_encode_dev(file_priv->minor->device),
28745- dev->open_count);
c52201e0 28746+ local_read(&dev->open_count));
58c5fc13
MT		 28747
28748 /* if the master has gone away we can't do anything with the lock */
28749 if (file_priv->minor->master)
16454cff 28750@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
58c5fc13
MT		 28751 * End inline drm_release
28752 */
28753
28754- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
58c5fc13 28755- if (!--dev->open_count) {
6892158b 28756+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
c52201e0 28757+ if (local_dec_and_test(&dev->open_count)) {
58c5fc13
MT		 28758 if (atomic_read(&dev->ioctl_count)) {
28759 DRM_ERROR("Device busy: %d\n",
28760 atomic_read(&dev->ioctl_count));
66a7e928
MT		 28761diff -urNp linux-2.6.39/drivers/gpu/drm/drm_global.c linux-2.6.39/drivers/gpu/drm/drm_global.c
28762--- linux-2.6.39/drivers/gpu/drm/drm_global.c 2011-05-19 00:06:34.000000000 -0400
28763+++ linux-2.6.39/drivers/gpu/drm/drm_global.c 2011-05-22 19:36:31.000000000 -0400
6892158b
MT		 28764@@ -36,7 +36,7 @@
28765 struct drm_global_item {
28766 struct mutex mutex;
28767 void *object;
28768- int refcount;
28769+ atomic_t refcount;
28770 };
28771
28772 static struct drm_global_item glob[DRM_GLOBAL_NUM];
28773@@ -49,7 +49,7 @@ void drm_global_init(void)
28774 struct drm_global_item *item = &glob[i];
28775 mutex_init(&item->mutex);
28776 item->object = NULL;
28777- item->refcount = 0;
28778+ atomic_set(&item->refcount, 0);
28779 }
28780 }
28781
28782@@ -59,7 +59,7 @@ void drm_global_release(void)
28783 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
28784 struct drm_global_item *item = &glob[i];
28785 BUG_ON(item->object != NULL);
28786- BUG_ON(item->refcount != 0);
28787+ BUG_ON(atomic_read(&item->refcount) != 0);
28788 }
28789 }
28790
28791@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
28792 void *object;
28793
28794 mutex_lock(&item->mutex);
28795- if (item->refcount == 0) {
28796+ if (atomic_read(&item->refcount) == 0) {
28797 item->object = kzalloc(ref->size, GFP_KERNEL);
28798 if (unlikely(item->object == NULL)) {
28799 ret = -ENOMEM;
28800@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
28801 goto out_err;
28802
28803 }
28804- ++item->refcount;
28805+ atomic_inc(&item->refcount);
28806 ref->object = item->object;
28807 object = item->object;
28808 mutex_unlock(&item->mutex);
28809@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
28810 struct drm_global_item *item = &glob[ref->global_type];
28811
28812 mutex_lock(&item->mutex);
28813- BUG_ON(item->refcount == 0);
28814+ BUG_ON(atomic_read(&item->refcount) == 0);
28815 BUG_ON(ref->object != item->object);
28816- if (--item->refcount == 0) {
28817+ if (atomic_dec_and_test(&item->refcount)) {
28818 ref->release(ref);
28819 item->object = NULL;
28820 }
66a7e928
MT		 28821diff -urNp linux-2.6.39/drivers/gpu/drm/drm_info.c linux-2.6.39/drivers/gpu/drm/drm_info.c
28822--- linux-2.6.39/drivers/gpu/drm/drm_info.c 2011-05-19 00:06:34.000000000 -0400
28823+++ linux-2.6.39/drivers/gpu/drm/drm_info.c 2011-05-22 19:41:37.000000000 -0400
28824@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
6892158b
MT		 28825 struct drm_local_map *map;
28826 struct drm_map_list *r_list;
28827
28828- /* Hardcoded from _DRM_FRAME_BUFFER,
28829- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28830- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28831- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28832+ static const char * const types[] = {
28833+ [_DRM_FRAME_BUFFER] = "FB",
28834+ [_DRM_REGISTERS] = "REG",
28835+ [_DRM_SHM] = "SHM",
28836+ [_DRM_AGP] = "AGP",
28837+ [_DRM_SCATTER_GATHER] = "SG",
28838+ [_DRM_CONSISTENT] = "PCI",
28839+ [_DRM_GEM] = "GEM" };
28840 const char *type;
28841 int i;
28842
66a7e928 28843@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
6892158b
MT		 28844 map = r_list->map;
28845 if (!map)
28846 continue;
28847- if (map->type < 0 || map->type > 5)
28848+ if (map->type >= ARRAY_SIZE(types))
28849 type = "??";
28850 else
28851 type = types[map->type];
66a7e928 28852@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
16454cff
MT		 28853 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28854 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28855 vma->vm_flags & VM_IO ? 'i' : '-',
28856+#ifdef CONFIG_GRKERNSEC_HIDESYM
28857+ 0);
28858+#else
28859 vma->vm_pgoff);
28860+#endif
28861
28862 #if defined(__i386__)
28863 pgprot = pgprot_val(vma->vm_page_prot);
66a7e928
MT		 28864diff -urNp linux-2.6.39/drivers/gpu/drm/drm_ioctl.c linux-2.6.39/drivers/gpu/drm/drm_ioctl.c
28865--- linux-2.6.39/drivers/gpu/drm/drm_ioctl.c 2011-05-19 00:06:34.000000000 -0400
28866+++ linux-2.6.39/drivers/gpu/drm/drm_ioctl.c 2011-05-22 19:36:31.000000000 -0400
28867@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
58c5fc13
MT		 28868 stats->data[i].value =
28869 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28870 else
28871- stats->data[i].value = atomic_read(&dev->counts[i]);
28872+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28873 stats->data[i].type = dev->types[i];
28874 }
28875
66a7e928
MT		 28876diff -urNp linux-2.6.39/drivers/gpu/drm/drm_lock.c linux-2.6.39/drivers/gpu/drm/drm_lock.c
28877--- linux-2.6.39/drivers/gpu/drm/drm_lock.c 2011-05-19 00:06:34.000000000 -0400
28878+++ linux-2.6.39/drivers/gpu/drm/drm_lock.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 28879@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
58c5fc13
MT		 28880 if (drm_lock_take(&master->lock, lock->context)) {
28881 master->lock.file_priv = file_priv;
28882 master->lock.lock_time = jiffies;
28883- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28884+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28885 break; /* Got lock */
28886 }
28887
bc901d79 28888@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
58c5fc13
MT		 28889 return -EINVAL;
28890 }
28891
28892- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28893+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28894
bc901d79
MT		 28895 if (drm_lock_free(&master->lock, lock->context)) {
28896 /* FIXME: Should really bail out here. */
66a7e928
MT		 28897diff -urNp linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c
28898--- linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c 2011-05-19 00:06:34.000000000 -0400
28899+++ linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c 2011-05-22 19:36:31.000000000 -0400
28900@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
58c5fc13
MT		 28901 dma->buflist[vertex->idx],
28902 vertex->discard, vertex->used);
28903
28904- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28905- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28906+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28907+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28908 sarea_priv->last_enqueue = dev_priv->counter - 1;
28909 sarea_priv->last_dispatch = (int)hw_status[5];
28910
66a7e928 28911@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
58c5fc13
MT		 28912 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28913 mc->last_render);
28914
28915- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28916- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28917+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28918+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28919 sarea_priv->last_enqueue = dev_priv->counter - 1;
28920 sarea_priv->last_dispatch = (int)hw_status[5];
28921
66a7e928
MT		 28922diff -urNp linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h
28923--- linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h 2011-05-19 00:06:34.000000000 -0400
28924+++ linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 28925@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28926 int page_flipping;
28927
28928 wait_queue_head_t irq_queue;
28929- atomic_t irq_received;
28930- atomic_t irq_emitted;
28931+ atomic_unchecked_t irq_received;
28932+ atomic_unchecked_t irq_emitted;
28933
28934 int front_offset;
28935 } drm_i810_private_t;
66a7e928
MT		 28936diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c
28937--- linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-19 00:06:34.000000000 -0400
28938+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 28939@@ -390,7 +390,7 @@ static void ch7017_destroy(struct intel_
57199397
MT		 28940 }
28941 }
28942
28943-struct intel_dvo_dev_ops ch7017_ops = {
28944+const struct intel_dvo_dev_ops ch7017_ops = {
28945 .init = ch7017_init,
28946 .detect = ch7017_detect,
28947 .mode_valid = ch7017_mode_valid,
66a7e928
MT		 28948diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c
28949--- linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-19 00:06:34.000000000 -0400
28950+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 28951@@ -320,7 +320,7 @@ static void ch7xxx_destroy(struct intel_
57199397
MT		 28952 }
28953 }
28954
28955-struct intel_dvo_dev_ops ch7xxx_ops = {
28956+const struct intel_dvo_dev_ops ch7xxx_ops = {
28957 .init = ch7xxx_init,
28958 .detect = ch7xxx_detect,
28959 .mode_valid = ch7xxx_mode_valid,
66a7e928
MT		 28960diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo.h linux-2.6.39/drivers/gpu/drm/i915/dvo.h
28961--- linux-2.6.39/drivers/gpu/drm/i915/dvo.h 2011-05-19 00:06:34.000000000 -0400
28962+++ linux-2.6.39/drivers/gpu/drm/i915/dvo.h 2011-05-22 19:36:31.000000000 -0400
6892158b 28963@@ -122,23 +122,23 @@ struct intel_dvo_dev_ops {
ae4e228f
MT		 28964 *
28965 * \return singly-linked list of modes or NULL if no modes found.
28966 */
28967- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
28968+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
28969
28970 /**
28971 * Clean up driver-specific bits of the output
28972 */
28973- void (*destroy) (struct intel_dvo_device *dvo);
28974+ void (* const destroy) (struct intel_dvo_device *dvo);
28975
28976 /**
28977 * Debugging hook to dump device registers to log file
28978 */
28979- void (*dump_regs)(struct intel_dvo_device *dvo);
28980+ void (* const dump_regs)(struct intel_dvo_device *dvo);
28981 };
28982
28983-extern struct intel_dvo_dev_ops sil164_ops;
28984-extern struct intel_dvo_dev_ops ch7xxx_ops;
28985-extern struct intel_dvo_dev_ops ivch_ops;
28986-extern struct intel_dvo_dev_ops tfp410_ops;
28987-extern struct intel_dvo_dev_ops ch7017_ops;
28988+extern const struct intel_dvo_dev_ops sil164_ops;
28989+extern const struct intel_dvo_dev_ops ch7xxx_ops;
28990+extern const struct intel_dvo_dev_ops ivch_ops;
28991+extern const struct intel_dvo_dev_ops tfp410_ops;
28992+extern const struct intel_dvo_dev_ops ch7017_ops;
28993
28994 #endif /* _INTEL_DVO_H */
66a7e928
MT		 28995diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c
28996--- linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-19 00:06:34.000000000 -0400
28997+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 28998@@ -410,7 +410,7 @@ static void ivch_destroy(struct intel_dv
ae4e228f
MT		 28999 }
29000 }
29001
29002-struct intel_dvo_dev_ops ivch_ops= {
29003+const struct intel_dvo_dev_ops ivch_ops= {
29004 .init = ivch_init,
29005 .dpms = ivch_dpms,
57199397 29006 .mode_valid = ivch_mode_valid,
66a7e928
MT		 29007diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c
29008--- linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-19 00:06:34.000000000 -0400
29009+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 29010@@ -252,7 +252,7 @@ static void sil164_destroy(struct intel_
ae4e228f
MT		 29011 }
29012 }
29013
29014-struct intel_dvo_dev_ops sil164_ops = {
29015+const struct intel_dvo_dev_ops sil164_ops = {
29016 .init = sil164_init,
29017 .detect = sil164_detect,
29018 .mode_valid = sil164_mode_valid,
66a7e928
MT		 29019diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c
29020--- linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-19 00:06:34.000000000 -0400
29021+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 29022@@ -293,7 +293,7 @@ static void tfp410_destroy(struct intel_
ae4e228f
MT		 29023 }
29024 }
29025
29026-struct intel_dvo_dev_ops tfp410_ops = {
29027+const struct intel_dvo_dev_ops tfp410_ops = {
29028 .init = tfp410_init,
29029 .detect = tfp410_detect,
29030 .mode_valid = tfp410_mode_valid,
66a7e928
MT		 29031diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c
29032--- linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-19 00:06:34.000000000 -0400
29033+++ linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29034@@ -496,7 +496,7 @@ static int i915_interrupt_info(struct se
29035 I915_READ(GTIMR));
29036 }
29037 seq_printf(m, "Interrupts received: %d\n",
29038- atomic_read(&dev_priv->irq_received));
29039+ atomic_read_unchecked(&dev_priv->irq_received));
29040 for (i = 0; i < I915_NUM_RINGS; i++) {
29041 if (IS_GEN6(dev)) {
29042 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
66a7e928
MT		 29043diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c
29044--- linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c 2011-05-19 00:06:34.000000000 -0400
29045+++ linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c 2011-05-22 19:36:31.000000000 -0400
29046@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(s
efbe55a5
MT		 29047 bool can_switch;
29048
29049 spin_lock(&dev->count_lock);
29050- can_switch = (dev->open_count == 0);
c52201e0 29051+ can_switch = (local_read(&dev->open_count) == 0);
efbe55a5
MT		 29052 spin_unlock(&dev->count_lock);
29053 return can_switch;
29054 }
66a7e928
MT		 29055diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c
29056--- linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c 2011-05-19 00:06:34.000000000 -0400
29057+++ linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c 2011-05-22 19:36:31.000000000 -0400
29058@@ -679,7 +679,7 @@ static const struct dev_pm_ops i915_pm_o
ae4e228f
MT		 29059 .restore = i915_pm_resume,
29060 };
29061
58c5fc13
MT		 29062-static struct vm_operations_struct i915_gem_vm_ops = {
29063+static const struct vm_operations_struct i915_gem_vm_ops = {
29064 .fault = i915_gem_fault,
29065 .open = drm_gem_vm_open,
29066 .close = drm_gem_vm_close,
66a7e928
MT		 29067diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h
29068--- linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h 2011-05-19 00:06:34.000000000 -0400
29069+++ linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h 2011-05-22 19:36:31.000000000 -0400
29070@@ -287,7 +287,7 @@ typedef struct drm_i915_private {
8308f9c9
MT		 29071 int current_page;
29072 int page_flipping;
29073
29074- atomic_t irq_received;
29075+ atomic_unchecked_t irq_received;
8308f9c9
MT		 29076
29077 /* protects the irq masks */
66a7e928
MT		 29078 spinlock_t irq_lock;
29079@@ -848,7 +848,7 @@ struct drm_i915_gem_object {
8308f9c9
MT		 29080 * will be page flipped away on the next vblank. When it
29081 * reaches 0, dev_priv->pending_flip_queue will be woken up.
29082 */
29083- atomic_t pending_flip;
29084+ atomic_unchecked_t pending_flip;
29085 };
29086
29087 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
66a7e928 29088@@ -1232,7 +1232,7 @@ extern int intel_setup_gmbus(struct drm_
71d190be
MT		 29089 extern void intel_teardown_gmbus(struct drm_device *dev);
29090 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
29091 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
29092-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29093+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29094 {
29095 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
29096 }
66a7e928
MT		 29097diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c
29098--- linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-19 00:06:34.000000000 -0400
29099+++ linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-22 19:36:31.000000000 -0400
29100@@ -192,7 +192,7 @@ i915_gem_object_set_to_gpu_domain(struct
29101 i915_gem_release_mmap(obj);
29102
29103 if (obj->base.pending_write_domain)
29104- cd->flips |= atomic_read(&obj->pending_flip);
29105+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
29106
29107 /* The actual obj->write_domain will be updated with
29108 * pending_write_domain after we emit the accumulated flush for all
29109diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c
29110--- linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c 2011-05-19 00:06:34.000000000 -0400
29111+++ linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c 2011-05-22 19:36:31.000000000 -0400
29112@@ -1101,7 +1101,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
29113 int ret = IRQ_NONE, pipe;
29114 bool blc_event = false;
8308f9c9
MT		 29115
29116- atomic_inc(&dev_priv->irq_received);
29117+ atomic_inc_unchecked(&dev_priv->irq_received);
29118
29119 if (HAS_PCH_SPLIT(dev))
29120 return ironlake_irq_handler(dev);
66a7e928 29121@@ -1655,7 +1655,7 @@ void i915_driver_irq_preinstall(struct d
8308f9c9 29122 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
66a7e928 29123 int pipe;
8308f9c9
MT		 29124
29125- atomic_set(&dev_priv->irq_received, 0);
29126+ atomic_set_unchecked(&dev_priv->irq_received, 0);
29127
29128 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
29129 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
66a7e928
MT		 29130diff -urNp linux-2.6.39/drivers/gpu/drm/i915/intel_display.c linux-2.6.39/drivers/gpu/drm/i915/intel_display.c
29131--- linux-2.6.39/drivers/gpu/drm/i915/intel_display.c 2011-05-19 00:06:34.000000000 -0400
29132+++ linux-2.6.39/drivers/gpu/drm/i915/intel_display.c 2011-05-22 19:36:31.000000000 -0400
29133@@ -2244,7 +2244,7 @@ intel_pipe_set_base(struct drm_crtc *crt
8308f9c9
MT		 29134
29135 wait_event(dev_priv->pending_flip_queue,
29136 atomic_read(&dev_priv->mm.wedged) ||
29137- atomic_read(&obj->pending_flip) == 0);
29138+ atomic_read_unchecked(&obj->pending_flip) == 0);
29139
29140 /* Big Hammer, we also need to ensure that any pending
29141 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
66a7e928 29142@@ -2712,7 +2712,7 @@ static void intel_crtc_wait_for_pending_
8308f9c9
MT		 29143 obj = to_intel_framebuffer(crtc->fb)->obj;
29144 dev_priv = crtc->dev->dev_private;
29145 wait_event(dev_priv->pending_flip_queue,
29146- atomic_read(&obj->pending_flip) == 0);
29147+ atomic_read_unchecked(&obj->pending_flip) == 0);
29148 }
29149
29150 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
66a7e928 29151@@ -6016,7 +6016,7 @@ static void do_intel_finish_page_flip(st
8308f9c9
MT		 29152
29153 atomic_clear_mask(1 << intel_crtc->plane,
29154 &obj->pending_flip.counter);
29155- if (atomic_read(&obj->pending_flip) == 0)
29156+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
29157 wake_up(&dev_priv->pending_flip_queue);
29158
29159 schedule_work(&work->work);
66a7e928 29160@@ -6145,7 +6145,7 @@ static int intel_crtc_page_flip(struct d
8308f9c9
MT		 29161 /* Block clients from rendering to the new back buffer until
29162 * the flip occurs and the object is no longer visible.
29163 */
29164- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29165+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29166
29167 switch (INTEL_INFO(dev)->gen) {
29168 case 2:
66a7e928
MT		 29169diff -urNp linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h
29170--- linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h 2011-05-19 00:06:34.000000000 -0400
29171+++ linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29172@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
29173 u32 clear_cmd;
29174 u32 maccess;
29175
29176- atomic_t vbl_received; /**< Number of vblanks received. */
29177+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
29178 wait_queue_head_t fence_queue;
29179- atomic_t last_fence_retired;
29180+ atomic_unchecked_t last_fence_retired;
29181 u32 next_fence_to_post;
29182
29183 unsigned int fb_cpp;
66a7e928
MT		 29184diff -urNp linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c
29185--- linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c 2011-05-19 00:06:34.000000000 -0400
29186+++ linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29187@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
29188 if (crtc != 0)
29189 return 0;
29190
29191- return atomic_read(&dev_priv->vbl_received);
29192+ return atomic_read_unchecked(&dev_priv->vbl_received);
29193 }
29194
29195
29196@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29197 /* VBLANK interrupt */
29198 if (status & MGA_VLINEPEN) {
29199 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
29200- atomic_inc(&dev_priv->vbl_received);
29201+ atomic_inc_unchecked(&dev_priv->vbl_received);
29202 drm_handle_vblank(dev, 0);
29203 handled = 1;
29204 }
29205@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29206 if ((prim_start & ~0x03) != (prim_end & ~0x03))
29207 MGA_WRITE(MGA_PRIMEND, prim_end);
29208
29209- atomic_inc(&dev_priv->last_fence_retired);
29210+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
29211 DRM_WAKEUP(&dev_priv->fence_queue);
29212 handled = 1;
29213 }
29214@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
29215 * using fences.
29216 */
29217 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
29218- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
29219+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
29220 - *sequence) <= (1 << 23)));
29221
29222 *sequence = cur_fence;
66a7e928
MT		 29223diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c
29224--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-19 00:06:34.000000000 -0400
29225+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-22 19:36:31.000000000 -0400
29226@@ -141,7 +141,7 @@ static int nouveau_dsm_get_client_id(str
29227 return VGA_SWITCHEROO_DIS;
29228 }
29229
29230-static struct vga_switcheroo_handler nouveau_dsm_handler = {
29231+static const struct vga_switcheroo_handler nouveau_dsm_handler = {
29232 .switchto = nouveau_dsm_switchto,
29233 .power_state = nouveau_dsm_power_state,
29234 .init = nouveau_dsm_init,
29235diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h
29236--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-19 00:06:34.000000000 -0400
29237+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-23 17:07:00.000000000 -0400
29238@@ -228,7 +228,7 @@ struct nouveau_channel {
8308f9c9
MT		 29239 struct list_head pending;
29240 uint32_t sequence;
29241 uint32_t sequence_ack;
29242- atomic_t last_sequence_irq;
29243+ atomic_unchecked_t last_sequence_irq;
29244 } fence;
29245
29246 /* DMA push buffer */
66a7e928
MT		 29247@@ -520,8 +520,8 @@ struct nouveau_vram_engine {
29248
29249 struct nouveau_engine {
29250 struct nouveau_instmem_engine instmem;
29251- struct nouveau_mc_engine mc;
29252- struct nouveau_timer_engine timer;
29253+ struct nouveau_mc_engine mc;
29254+ struct nouveau_timer_engine timer;
29255 struct nouveau_fb_engine fb;
29256 struct nouveau_pgraph_engine graph;
29257 struct nouveau_fifo_engine fifo;
29258@@ -529,7 +529,7 @@ struct nouveau_engine {
29259 struct nouveau_gpio_engine gpio;
29260 struct nouveau_pm_engine pm;
29261 struct nouveau_crypt_engine crypt;
29262- struct nouveau_vram_engine vram;
29263+ struct nouveau_vram_engine vram;
29264 };
29265
29266 struct nouveau_pll_vals {
29267@@ -662,7 +662,7 @@ struct drm_nouveau_private {
8308f9c9
MT		 29268 struct drm_global_reference mem_global_ref;
29269 struct ttm_bo_global_ref bo_global_ref;
29270 struct ttm_bo_device bdev;
29271- atomic_t validate_sequence;
29272+ atomic_unchecked_t validate_sequence;
29273 } ttm;
29274
29275 struct {
66a7e928
MT		 29276diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c
29277--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-19 00:06:34.000000000 -0400
29278+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-22 19:36:31.000000000 -0400
29279@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
8308f9c9
MT		 29280 if (USE_REFCNT(dev))
29281 sequence = nvchan_rd32(chan, 0x48);
29282 else
29283- sequence = atomic_read(&chan->fence.last_sequence_irq);
29284+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
29285
29286 if (chan->fence.sequence_ack == sequence)
29287 goto out;
66a7e928
MT		 29288@@ -553,7 +553,7 @@ nouveau_fence_channel_init(struct nouvea
29289 out_initialised:
8308f9c9
MT		 29290 INIT_LIST_HEAD(&chan->fence.pending);
29291 spin_lock_init(&chan->fence.lock);
29292- atomic_set(&chan->fence.last_sequence_irq, 0);
29293+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
8308f9c9
MT		 29294 return 0;
29295 }
66a7e928
MT		 29296
29297diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c
29298--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-19 00:06:34.000000000 -0400
29299+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-22 19:36:31.000000000 -0400
29300@@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
8308f9c9
MT		 29301 int trycnt = 0;
29302 int ret, i;
29303
29304- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
29305+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
29306 retry:
29307 if (++trycnt > 100000) {
29308 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
66a7e928
MT		 29309diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c
29310--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-19 00:06:34.000000000 -0400
29311+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-22 19:36:31.000000000 -0400
29312@@ -583,7 +583,7 @@ static bool nouveau_switcheroo_can_switc
efbe55a5
MT		 29313 bool can_switch;
29314
29315 spin_lock(&dev->count_lock);
29316- can_switch = (dev->open_count == 0);
c52201e0 29317+ can_switch = (local_read(&dev->open_count) == 0);
efbe55a5
MT		 29318 spin_unlock(&dev->count_lock);
29319 return can_switch;
29320 }
66a7e928
MT		 29321diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c
29322--- linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-19 00:06:34.000000000 -0400
29323+++ linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29324@@ -552,7 +552,7 @@ static int
29325 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
29326 u32 class, u32 mthd, u32 data)
29327 {
29328- atomic_set(&chan->fence.last_sequence_irq, data);
29329+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
29330 return 0;
29331 }
29332
66a7e928
MT		 29333diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c
29334--- linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c 2011-05-19 00:06:34.000000000 -0400
29335+++ linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29336@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
29337
29338 /* GH: Simple idle check.
29339 */
29340- atomic_set(&dev_priv->idle_count, 0);
29341+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29342
29343 /* We don't support anything other than bus-mastering ring mode,
29344 * but the ring can be in either AGP or PCI space for the ring
66a7e928
MT		 29345diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h
29346--- linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h 2011-05-19 00:06:34.000000000 -0400
29347+++ linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29348@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
29349 int is_pci;
29350 unsigned long cce_buffers_offset;
29351
29352- atomic_t idle_count;
29353+ atomic_unchecked_t idle_count;
29354
29355 int page_flipping;
29356 int current_page;
29357 u32 crtc_offset;
29358 u32 crtc_offset_cntl;
29359
29360- atomic_t vbl_received;
29361+ atomic_unchecked_t vbl_received;
29362
29363 u32 color_fmt;
29364 unsigned int front_offset;
66a7e928
MT		 29365diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c
29366--- linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c 2011-05-19 00:06:34.000000000 -0400
29367+++ linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29368@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
29369 if (crtc != 0)
29370 return 0;
29371
29372- return atomic_read(&dev_priv->vbl_received);
29373+ return atomic_read_unchecked(&dev_priv->vbl_received);
29374 }
29375
29376 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
29377@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
29378 /* VBLANK interrupt */
29379 if (status & R128_CRTC_VBLANK_INT) {
29380 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
29381- atomic_inc(&dev_priv->vbl_received);
29382+ atomic_inc_unchecked(&dev_priv->vbl_received);
29383 drm_handle_vblank(dev, 0);
29384 return IRQ_HANDLED;
29385 }
66a7e928
MT		 29386diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_state.c linux-2.6.39/drivers/gpu/drm/r128/r128_state.c
29387--- linux-2.6.39/drivers/gpu/drm/r128/r128_state.c 2011-05-19 00:06:34.000000000 -0400
29388+++ linux-2.6.39/drivers/gpu/drm/r128/r128_state.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29389@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
29390
29391 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
29392 {
29393- if (atomic_read(&dev_priv->idle_count) == 0)
29394+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
29395 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
29396 else
29397- atomic_set(&dev_priv->idle_count, 0);
29398+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29399 }
29400
29401 #endif
66a7e928
MT		 29402diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/atom.c linux-2.6.39/drivers/gpu/drm/radeon/atom.c
29403--- linux-2.6.39/drivers/gpu/drm/radeon/atom.c 2011-05-19 00:06:34.000000000 -0400
29404+++ linux-2.6.39/drivers/gpu/drm/radeon/atom.c 2011-05-22 19:36:31.000000000 -0400
29405@@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c
29406 char name[512];
29407 int i;
29408
29409+ pax_track_stack();
29410+
29411 ctx->card = card;
29412 ctx->bios = bios;
29413
29414diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c
29415--- linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c 2011-05-19 00:06:34.000000000 -0400
29416+++ linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 29417@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
29418 regex_t mask_rex;
29419 regmatch_t match[4];
29420 char buf[1024];
29421- size_t end;
29422+ long end;
29423 int len;
29424 int done = 0;
29425 int r;
29426 unsigned o;
29427 struct offset *offset;
29428 char last_reg_s[10];
29429- int last_reg;
29430+ unsigned long last_reg;
29431
29432 if (regcomp
29433 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
66a7e928
MT		 29434diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c
29435--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-19 00:06:34.000000000 -0400
29436+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-22 19:36:31.000000000 -0400
29437@@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
29438 struct radeon_gpio_rec gpio;
29439 struct radeon_hpd hpd;
29440
29441+ pax_track_stack();
29442+
29443 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
29444 return false;
29445
29446diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c
29447--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-19 00:06:34.000000000 -0400
29448+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-22 19:36:31.000000000 -0400
29449@@ -234,7 +234,7 @@ static int radeon_atpx_get_client_id(str
29450 return VGA_SWITCHEROO_DIS;
29451 }
29452
29453-static struct vga_switcheroo_handler radeon_atpx_handler = {
29454+static const struct vga_switcheroo_handler radeon_atpx_handler = {
29455 .switchto = radeon_atpx_switchto,
29456 .power_state = radeon_atpx_power_state,
29457 .init = radeon_atpx_init,
29458diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c
29459--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c 2011-05-19 00:06:34.000000000 -0400
29460+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c 2011-05-22 19:36:31.000000000 -0400
29461@@ -674,7 +674,7 @@ static bool radeon_switcheroo_can_switch
df50ba0c 29462 bool can_switch;
58c5fc13 29463
df50ba0c
MT		 29464 spin_lock(&dev->count_lock);
29465- can_switch = (dev->open_count == 0);
c52201e0 29466+ can_switch = (local_read(&dev->open_count) == 0);
df50ba0c
MT		 29467 spin_unlock(&dev->count_lock);
29468 return can_switch;
29469 }
66a7e928
MT		 29470diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c
29471--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c 2011-05-19 00:06:34.000000000 -0400
29472+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c 2011-05-22 19:36:31.000000000 -0400
29473@@ -934,6 +934,8 @@ void radeon_compute_pll_legacy(struct ra
29474 uint32_t post_div;
29475 u32 pll_out_min, pll_out_max;
29476
29477+ pax_track_stack();
29478+
29479 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
29480 freq = freq * 1000;
29481
29482diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h
29483--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-19 00:06:34.000000000 -0400
29484+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29485@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
29486
29487 /* SW interrupt */
29488 wait_queue_head_t swi_queue;
29489- atomic_t swi_emitted;
29490+ atomic_unchecked_t swi_emitted;
29491 int vblank_crtc;
29492 uint32_t irq_enable_reg;
29493 uint32_t r500_disp_irq_reg;
66a7e928
MT		 29494diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c
29495--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-19 00:06:34.000000000 -0400
29496+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29497@@ -49,7 +49,7 @@ int radeon_fence_emit(struct radeon_devi
29498 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
29499 return 0;
29500 }
29501- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
29502+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
29503 if (!rdev->cp.ready) {
29504 /* FIXME: cp is not running assume everythings is done right
29505 * away
66a7e928 29506@@ -352,7 +352,7 @@ int radeon_fence_driver_init(struct rade
8308f9c9
MT		 29507 return r;
29508 }
29509 WREG32(rdev->fence_drv.scratch_reg, 0);
29510- atomic_set(&rdev->fence_drv.seq, 0);
29511+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
29512 INIT_LIST_HEAD(&rdev->fence_drv.created);
29513 INIT_LIST_HEAD(&rdev->fence_drv.emited);
29514 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
66a7e928
MT		 29515diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon.h linux-2.6.39/drivers/gpu/drm/radeon/radeon.h
29516--- linux-2.6.39/drivers/gpu/drm/radeon/radeon.h 2011-05-19 00:06:34.000000000 -0400
29517+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29518@@ -189,7 +189,7 @@ extern int sumo_get_temp(struct radeon_d
29519 */
29520 struct radeon_fence_driver {
29521 uint32_t scratch_reg;
29522- atomic_t seq;
29523+ atomic_unchecked_t seq;
29524 uint32_t last_seq;
29525 unsigned long last_jiffies;
29526 unsigned long last_timeout;
66a7e928
MT		 29527diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c
29528--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-19 00:06:34.000000000 -0400
29529+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-22 19:36:31.000000000 -0400
71d190be
MT		 29530@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
29531 request = compat_alloc_user_space(sizeof(*request));
29532 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
29533 || __put_user(req32.param, &request->param)
29534- || __put_user((void __user *)(unsigned long)req32.value,
29535+ || __put_user((unsigned long)req32.value,
29536 &request->value))
29537 return -EFAULT;
29538
66a7e928
MT		 29539diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c
29540--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-19 00:06:34.000000000 -0400
29541+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29542@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
29543 unsigned int ret;
29544 RING_LOCALS;
29545
29546- atomic_inc(&dev_priv->swi_emitted);
29547- ret = atomic_read(&dev_priv->swi_emitted);
29548+ atomic_inc_unchecked(&dev_priv->swi_emitted);
29549+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
29550
29551 BEGIN_RING(4);
29552 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
29553@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
29554 drm_radeon_private_t *dev_priv =
29555 (drm_radeon_private_t *) dev->dev_private;
29556
29557- atomic_set(&dev_priv->swi_emitted, 0);
29558+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
29559 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
29560
29561 dev->max_vblank_count = 0x001fffff;
66a7e928
MT		 29562diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c
29563--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c 2011-05-19 00:06:34.000000000 -0400
29564+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c 2011-05-22 19:36:31.000000000 -0400
efbe55a5 29565@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
ae4e228f
MT		 29566 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
29567 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
29568
29569- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29570+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29571 sarea_priv->nbox * sizeof(depth_boxes[0])))
29572 return -EFAULT;
29573
efbe55a5 29574@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
58c5fc13
MT		 29575 {
29576 drm_radeon_private_t *dev_priv = dev->dev_private;
29577 drm_radeon_getparam_t *param = data;
29578- int value;
29579+ int value = 0;
29580
29581 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
29582
66a7e928
MT		 29583diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c
29584--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-19 00:06:34.000000000 -0400
29585+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-22 19:36:31.000000000 -0400
16454cff
MT		 29586@@ -603,8 +603,9 @@ void radeon_ttm_set_active_vram_size(str
29587 man->size = size >> PAGE_SHIFT;
58c5fc13
MT		 29588 }
29589
29590-static struct vm_operations_struct radeon_ttm_vm_ops;
ae4e228f 29591-static const struct vm_operations_struct *ttm_vm_ops = NULL;
57199397
MT		 29592+extern int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
29593+extern void ttm_bo_vm_open(struct vm_area_struct *vma);
29594+extern void ttm_bo_vm_close(struct vm_area_struct *vma);
29595
29596 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29597 {
16454cff 29598@@ -612,17 +613,22 @@ static int radeon_ttm_fault(struct vm_ar
57199397
MT		 29599 struct radeon_device *rdev;
29600 int r;
29601
29602- bo = (struct ttm_buffer_object *)vma->vm_private_data;
58c5fc13 29603- if (bo == NULL) {
57199397
MT		 29604+ bo = (struct ttm_buffer_object *)vma->vm_private_data;
29605+ if (!bo)
29606 return VM_FAULT_NOPAGE;
58c5fc13 29607- }
57199397
MT		 29608 rdev = radeon_get_rdev(bo->bdev);
29609 mutex_lock(&rdev->vram_mutex);
58c5fc13 29610- r = ttm_vm_ops->fault(vma, vmf);
57199397
MT		 29611+ r = ttm_bo_vm_fault(vma, vmf);
29612 mutex_unlock(&rdev->vram_mutex);
29613 return r;
29614 }
29615
29616+static const struct vm_operations_struct radeon_ttm_vm_ops = {
29617+ .fault = radeon_ttm_fault,
29618+ .open = ttm_bo_vm_open,
29619+ .close = ttm_bo_vm_close
29620+};
29621+
58c5fc13
MT		 29622 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
29623 {
29624 struct drm_file *file_priv;
16454cff 29625@@ -635,18 +641,11 @@ int radeon_mmap(struct file *filp, struc
58c5fc13 29626
bc901d79 29627 file_priv = filp->private_data;
58c5fc13
MT		 29628 rdev = file_priv->minor->dev->dev_private;
29629- if (rdev == NULL) {
29630+ if (!rdev)
29631 return -EINVAL;
29632- }
57199397 29633 r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
58c5fc13 29634- if (unlikely(r != 0)) {
57199397
MT		 29635+ if (r)
29636 return r;
58c5fc13
MT		 29637- }
29638- if (unlikely(ttm_vm_ops == NULL)) {
29639- ttm_vm_ops = vma->vm_ops;
29640- radeon_ttm_vm_ops = *ttm_vm_ops;
29641- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29642- }
57199397
MT		 29643 vma->vm_ops = &radeon_ttm_vm_ops;
29644 return 0;
58c5fc13 29645 }
66a7e928
MT		 29646diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/rs690.c linux-2.6.39/drivers/gpu/drm/radeon/rs690.c
29647--- linux-2.6.39/drivers/gpu/drm/radeon/rs690.c 2011-05-19 00:06:34.000000000 -0400
29648+++ linux-2.6.39/drivers/gpu/drm/radeon/rs690.c 2011-05-22 19:36:31.000000000 -0400
71d190be
MT		 29649@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
29650 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
29651 rdev->pm.sideport_bandwidth.full)
29652 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
29653- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
29654+ read_delay_latency.full = dfixed_const(800 * 1000);
29655 read_delay_latency.full = dfixed_div(read_delay_latency,
29656 rdev->pm.igp_sideport_mclk);
29657+ a.full = dfixed_const(370);
29658+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
29659 } else {
29660 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
29661 rdev->pm.k8_bandwidth.full)
66a7e928
MT		 29662diff -urNp linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c
29663--- linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-19 00:06:34.000000000 -0400
29664+++ linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-22 19:36:31.000000000 -0400
57199397
MT		 29665@@ -69,11 +69,11 @@ static struct ttm_buffer_object *ttm_bo_
29666 return best_bo;
29667 }
29668
29669-static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29670+int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
58c5fc13
MT		 29671 {
29672 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
29673 vma->vm_private_data;
29674- struct ttm_bo_device *bdev = bo->bdev;
29675+ struct ttm_bo_device *bdev;
57199397
MT		 29676 unsigned long page_offset;
29677 unsigned long page_last;
29678 unsigned long pfn;
16454cff
MT		 29679@@ -83,8 +83,12 @@ static int ttm_bo_vm_fault(struct vm_are
29680 int i;
58c5fc13
MT		 29681 unsigned long address = (unsigned long)vmf->virtual_address;
29682 int retval = VM_FAULT_NOPAGE;
16454cff
MT		 29683- struct ttm_mem_type_manager *man =
29684- &bdev->man[bo->mem.mem_type];
29685+ struct ttm_mem_type_manager *man;
29686+
58c5fc13
MT		 29687+ if (!bo)
29688+ return VM_FAULT_NOPAGE;
29689+ bdev = bo->bdev;
16454cff
MT		 29690+ man = &bdev->man[bo->mem.mem_type];
29691
58c5fc13
MT		 29692 /*
29693 * Work around locking order reversal in fault / nopfn
16454cff 29694@@ -219,22 +223,25 @@ out_unlock:
6892158b 29695 ttm_bo_unreserve(bo);
57199397
MT		 29696 return retval;
29697 }
6892158b 29698+EXPORT_SYMBOL(ttm_bo_vm_fault);
57199397
MT		 29699
29700-static void ttm_bo_vm_open(struct vm_area_struct *vma)
29701+void ttm_bo_vm_open(struct vm_area_struct *vma)
29702 {
29703 struct ttm_buffer_object *bo =
29704 (struct ttm_buffer_object *)vma->vm_private_data;
6892158b 29705
57199397
MT		 29706 (void)ttm_bo_reference(bo);
29707 }
6892158b 29708+EXPORT_SYMBOL(ttm_bo_vm_open);
57199397
MT		 29709
29710-static void ttm_bo_vm_close(struct vm_area_struct *vma)
29711+void ttm_bo_vm_close(struct vm_area_struct *vma)
29712 {
29713 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)vma->vm_private_data;
29714
6892158b
MT		 29715 ttm_bo_unref(&bo);
29716 vma->vm_private_data = NULL;
ae4e228f 29717 }
6892158b 29718+EXPORT_SYMBOL(ttm_bo_vm_close);
ae4e228f 29719
6892158b
MT		 29720 static const struct vm_operations_struct ttm_bo_vm_ops = {
29721 .fault = ttm_bo_vm_fault,
66a7e928
MT		 29722diff -urNp linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c
29723--- linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-19 00:06:34.000000000 -0400
29724+++ linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-22 19:36:31.000000000 -0400
29725@@ -397,9 +397,9 @@ static int ttm_pool_get_num_unused_pages
8308f9c9
MT		 29726 */
29727 static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
29728 {
29729- static atomic_t start_pool = ATOMIC_INIT(0);
29730+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
29731 unsigned i;
29732- unsigned pool_offset = atomic_add_return(1, &start_pool);
29733+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
29734 struct ttm_page_pool *pool;
29735
29736 pool_offset = pool_offset % NUM_POOLS;
66a7e928
MT		 29737diff -urNp linux-2.6.39/drivers/gpu/drm/via/via_drv.h linux-2.6.39/drivers/gpu/drm/via/via_drv.h
29738--- linux-2.6.39/drivers/gpu/drm/via/via_drv.h 2011-05-19 00:06:34.000000000 -0400
29739+++ linux-2.6.39/drivers/gpu/drm/via/via_drv.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29740@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
29741 typedef uint32_t maskarray_t[5];
29742
29743 typedef struct drm_via_irq {
29744- atomic_t irq_received;
29745+ atomic_unchecked_t irq_received;
29746 uint32_t pending_mask;
29747 uint32_t enable_mask;
29748 wait_queue_head_t irq_queue;
29749@@ -75,7 +75,7 @@ typedef struct drm_via_private {
29750 struct timeval last_vblank;
29751 int last_vblank_valid;
29752 unsigned usec_per_vblank;
29753- atomic_t vbl_received;
29754+ atomic_unchecked_t vbl_received;
29755 drm_via_state_t hc_state;
29756 char pci_buf[VIA_PCI_BUF_SIZE];
29757 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
66a7e928
MT		 29758diff -urNp linux-2.6.39/drivers/gpu/drm/via/via_irq.c linux-2.6.39/drivers/gpu/drm/via/via_irq.c
29759--- linux-2.6.39/drivers/gpu/drm/via/via_irq.c 2011-05-19 00:06:34.000000000 -0400
29760+++ linux-2.6.39/drivers/gpu/drm/via/via_irq.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29761@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
29762 if (crtc != 0)
29763 return 0;
29764
29765- return atomic_read(&dev_priv->vbl_received);
29766+ return atomic_read_unchecked(&dev_priv->vbl_received);
29767 }
29768
29769 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29770@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
29771
29772 status = VIA_READ(VIA_REG_INTERRUPT);
29773 if (status & VIA_IRQ_VBLANK_PENDING) {
29774- atomic_inc(&dev_priv->vbl_received);
29775- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
29776+ atomic_inc_unchecked(&dev_priv->vbl_received);
29777+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
29778 do_gettimeofday(&cur_vblank);
29779 if (dev_priv->last_vblank_valid) {
29780 dev_priv->usec_per_vblank =
29781@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29782 dev_priv->last_vblank = cur_vblank;
29783 dev_priv->last_vblank_valid = 1;
29784 }
29785- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
29786+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
29787 DRM_DEBUG("US per vblank is: %u\n",
29788 dev_priv->usec_per_vblank);
29789 }
29790@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29791
29792 for (i = 0; i < dev_priv->num_irqs; ++i) {
29793 if (status & cur_irq->pending_mask) {
29794- atomic_inc(&cur_irq->irq_received);
29795+ atomic_inc_unchecked(&cur_irq->irq_received);
29796 DRM_WAKEUP(&cur_irq->irq_queue);
29797 handled = 1;
29798 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
29799@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
29800 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29801 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
29802 masks[irq][4]));
29803- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
29804+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
29805 } else {
29806 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29807 (((cur_irq_sequence =
29808- atomic_read(&cur_irq->irq_received)) -
29809+ atomic_read_unchecked(&cur_irq->irq_received)) -
29810 *sequence) <= (1 << 23)));
29811 }
29812 *sequence = cur_irq_sequence;
29813@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
29814 }
29815
29816 for (i = 0; i < dev_priv->num_irqs; ++i) {
29817- atomic_set(&cur_irq->irq_received, 0);
29818+ atomic_set_unchecked(&cur_irq->irq_received, 0);
29819 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
29820 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
29821 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
29822@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
29823 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
29824 case VIA_IRQ_RELATIVE:
29825 irqwait->request.sequence +=
29826- atomic_read(&cur_irq->irq_received);
29827+ atomic_read_unchecked(&cur_irq->irq_received);
29828 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
29829 case VIA_IRQ_ABSOLUTE:
29830 break;
66a7e928
MT		 29831diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
29832--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-19 00:06:34.000000000 -0400
29833+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29834@@ -240,7 +240,7 @@ struct vmw_private {
29835 * Fencing and IRQs.
29836 */
29837
29838- atomic_t fence_seq;
29839+ atomic_unchecked_t fence_seq;
29840 wait_queue_head_t fence_queue;
29841 wait_queue_head_t fifo_queue;
29842 atomic_t fence_queue_waiters;
66a7e928
MT		 29843diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29844--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-19 00:06:34.000000000 -0400
29845+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29846@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
29847 while (!vmw_lag_lt(queue, us)) {
29848 spin_lock(&queue->lock);
29849 if (list_empty(&queue->head))
29850- sequence = atomic_read(&dev_priv->fence_seq);
29851+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29852 else {
29853 fence = list_first_entry(&queue->head,
29854 struct vmw_fence, head);
66a7e928
MT		 29855diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29856--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-19 00:06:34.000000000 -0400
29857+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29858@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
29859 (unsigned int) min,
29860 (unsigned int) fifo->capabilities);
29861
29862- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29863+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29864 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29865 vmw_fence_queue_init(&fifo->fence_queue);
29866 return vmw_fifo_send_fence(dev_priv, &dummy);
29867@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
29868
29869 fm = vmw_fifo_reserve(dev_priv, bytes);
29870 if (unlikely(fm == NULL)) {
29871- *sequence = atomic_read(&dev_priv->fence_seq);
29872+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29873 ret = -ENOMEM;
29874 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29875 false, 3*HZ);
29876@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
29877 }
29878
29879 do {
29880- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29881+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29882 } while (*sequence == 0);
29883
29884 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
71d190be
MT		 29885@@ -534,7 +534,7 @@ static int vmw_fifo_vm_fault(struct vm_a
29886 return VM_FAULT_SIGBUS;
29887 }
29888
29889-static struct vm_operations_struct vmw_fifo_vm_ops = {
29890+static const struct vm_operations_struct vmw_fifo_vm_ops = {
29891 .fault = vmw_fifo_vm_fault,
29892 .open = NULL,
29893 .close = NULL
66a7e928
MT		 29894diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29895--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-19 00:06:34.000000000 -0400
29896+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 29897@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
29898 * emitted. Then the fence is stale and signaled.
29899 */
29900
29901- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29902+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29903 > VMW_FENCE_WRAP);
29904
29905 return ret;
29906@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
29907
29908 if (fifo_idle)
29909 down_read(&fifo_state->rwsem);
29910- signal_seq = atomic_read(&dev_priv->fence_seq);
29911+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29912 ret = 0;
29913
29914 for (;;) {
66a7e928
MT		 29915diff -urNp linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c
29916--- linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c 2011-05-19 00:06:34.000000000 -0400
29917+++ linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c 2011-05-22 19:36:31.000000000 -0400
29918@@ -53,7 +53,7 @@ struct vgasr_priv {
29919 int registered_clients;
29920 struct vga_switcheroo_client clients[VGA_SWITCHEROO_MAX_CLIENTS];
29921
29922- struct vga_switcheroo_handler *handler;
29923+ const struct vga_switcheroo_handler *handler;
29924 };
29925
29926 static int vga_switcheroo_debugfs_init(struct vgasr_priv *priv);
29927@@ -62,7 +62,7 @@ static void vga_switcheroo_debugfs_fini(
29928 /* only one switcheroo per system */
29929 static struct vgasr_priv vgasr_priv;
29930
29931-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
29932+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler)
29933 {
29934 mutex_lock(&vgasr_mutex);
29935 if (vgasr_priv.handler) {
29936diff -urNp linux-2.6.39/drivers/hid/hid-core.c linux-2.6.39/drivers/hid/hid-core.c
29937--- linux-2.6.39/drivers/hid/hid-core.c 2011-05-19 00:06:34.000000000 -0400
29938+++ linux-2.6.39/drivers/hid/hid-core.c 2011-05-22 19:36:31.000000000 -0400
29939@@ -1888,7 +1888,7 @@ static bool hid_ignore(struct hid_device
8308f9c9
MT		 29940
29941 int hid_add_device(struct hid_device *hdev)
29942 {
29943- static atomic_t id = ATOMIC_INIT(0);
29944+ static atomic_unchecked_t id = ATOMIC_INIT(0);
29945 int ret;
29946
29947 if (WARN_ON(hdev->status & HID_STAT_ADDED))
66a7e928 29948@@ -1903,7 +1903,7 @@ int hid_add_device(struct hid_device *hd
8308f9c9
MT		 29949 /* XXX hack, any other cleaner solution after the driver core
29950 * is converted to allow more than 20 bytes as the device name? */
29951 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29952- hdev->vendor, hdev->product, atomic_inc_return(&id));
29953+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29954
29955 hid_debug_register(hdev, dev_name(&hdev->dev));
29956 ret = device_add(&hdev->dev);
66a7e928
MT		 29957diff -urNp linux-2.6.39/drivers/hid/hid-picolcd.c linux-2.6.39/drivers/hid/hid-picolcd.c
29958--- linux-2.6.39/drivers/hid/hid-picolcd.c 2011-05-19 00:06:34.000000000 -0400
29959+++ linux-2.6.39/drivers/hid/hid-picolcd.c 2011-05-22 19:36:31.000000000 -0400
29960@@ -1037,7 +1037,7 @@ static int picolcd_check_lcd_fb(struct l
29961 return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
29962 }
29963
29964-static struct lcd_ops picolcd_lcdops = {
29965+static const struct lcd_ops picolcd_lcdops = {
29966 .get_contrast = picolcd_get_contrast,
29967 .set_contrast = picolcd_set_contrast,
29968 .check_fb = picolcd_check_lcd_fb,
29969diff -urNp linux-2.6.39/drivers/hid/usbhid/hiddev.c linux-2.6.39/drivers/hid/usbhid/hiddev.c
29970--- linux-2.6.39/drivers/hid/usbhid/hiddev.c 2011-05-19 00:06:34.000000000 -0400
29971+++ linux-2.6.39/drivers/hid/usbhid/hiddev.c 2011-05-22 19:36:31.000000000 -0400
16454cff
MT		 29972@@ -613,7 +613,7 @@ static long hiddev_ioctl(struct file *fi
29973 break;
ae4e228f 29974
df50ba0c
MT		 29975 case HIDIOCAPPLICATION:
29976- if (arg < 0 || arg >= hid->maxapplication)
29977+ if (arg >= hid->maxapplication)
16454cff 29978 break;
df50ba0c
MT		 29979
29980 for (i = 0; i < hid->maxcollection; i++)
66a7e928
MT		 29981diff -urNp linux-2.6.39/drivers/hwmon/ibmaem.c linux-2.6.39/drivers/hwmon/ibmaem.c
29982--- linux-2.6.39/drivers/hwmon/ibmaem.c 2011-05-19 00:06:34.000000000 -0400
29983+++ linux-2.6.39/drivers/hwmon/ibmaem.c 2011-05-22 19:36:31.000000000 -0400
29984@@ -238,7 +238,7 @@ struct aem_read_sensor_resp {
29985 struct aem_driver_data {
29986 struct list_head aem_devices;
29987 struct ipmi_smi_watcher bmc_events;
29988- struct ipmi_user_hndl ipmi_hndlrs;
29989+ const struct ipmi_user_hndl ipmi_hndlrs;
29990 };
8308f9c9 29991
66a7e928
MT		 29992 static void aem_register_bmc(int iface, struct device *dev);
29993diff -urNp linux-2.6.39/drivers/hwmon/ibmpex.c linux-2.6.39/drivers/hwmon/ibmpex.c
29994--- linux-2.6.39/drivers/hwmon/ibmpex.c 2011-05-19 00:06:34.000000000 -0400
29995+++ linux-2.6.39/drivers/hwmon/ibmpex.c 2011-05-22 19:36:31.000000000 -0400
29996@@ -110,7 +110,7 @@ struct ibmpex_bmc_data {
29997 struct ibmpex_driver_data {
29998 struct list_head bmc_data;
29999 struct ipmi_smi_watcher bmc_events;
30000- struct ipmi_user_hndl ipmi_hndlrs;
30001+ const struct ipmi_user_hndl ipmi_hndlrs;
30002 };
8308f9c9 30003
66a7e928
MT		 30004 static struct ibmpex_driver_data driver_data = {
30005diff -urNp linux-2.6.39/drivers/hwmon/sht15.c linux-2.6.39/drivers/hwmon/sht15.c
30006--- linux-2.6.39/drivers/hwmon/sht15.c 2011-05-19 00:06:34.000000000 -0400
30007+++ linux-2.6.39/drivers/hwmon/sht15.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30008@@ -113,7 +113,7 @@ struct sht15_data {
30009 int supply_uV;
30010 int supply_uV_valid;
30011 struct work_struct update_supply_work;
30012- atomic_t interrupt_handled;
30013+ atomic_unchecked_t interrupt_handled;
30014 };
30015
30016 /**
30017@@ -246,13 +246,13 @@ static inline int sht15_update_single_va
30018 return ret;
30019
30020 gpio_direction_input(data->pdata->gpio_data);
30021- atomic_set(&data->interrupt_handled, 0);
30022+ atomic_set_unchecked(&data->interrupt_handled, 0);
30023
30024 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30025 if (gpio_get_value(data->pdata->gpio_data) == 0) {
30026 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
66a7e928 30027 /* Only relevant if the interrupt hasn't occurred. */
8308f9c9
MT		 30028- if (!atomic_read(&data->interrupt_handled))
30029+ if (!atomic_read_unchecked(&data->interrupt_handled))
30030 schedule_work(&data->read_work);
30031 }
30032 ret = wait_event_timeout(data->wait_queue,
30033@@ -399,7 +399,7 @@ static irqreturn_t sht15_interrupt_fired
30034 struct sht15_data *data = d;
30035 /* First disable the interrupt */
30036 disable_irq_nosync(irq);
30037- atomic_inc(&data->interrupt_handled);
30038+ atomic_inc_unchecked(&data->interrupt_handled);
30039 /* Then schedule a reading work struct */
30040 if (data->flag != SHT15_READING_NOTHING)
30041 schedule_work(&data->read_work);
30042@@ -450,11 +450,11 @@ static void sht15_bh_read_data(struct wo
30043 here as could have gone low in meantime so verify
30044 it hasn't!
30045 */
30046- atomic_set(&data->interrupt_handled, 0);
30047+ atomic_set_unchecked(&data->interrupt_handled, 0);
30048 enable_irq(gpio_to_irq(data->pdata->gpio_data));
66a7e928 30049 /* If still not occurred or another handler has been scheduled */
8308f9c9
MT		 30050 if (gpio_get_value(data->pdata->gpio_data)
30051- || atomic_read(&data->interrupt_handled))
30052+ || atomic_read_unchecked(&data->interrupt_handled))
30053 return;
30054 }
30055 /* Read the data back from the device */
66a7e928
MT		 30056diff -urNp linux-2.6.39/drivers/hwmon/w83791d.c linux-2.6.39/drivers/hwmon/w83791d.c
30057--- linux-2.6.39/drivers/hwmon/w83791d.c 2011-05-19 00:06:34.000000000 -0400
30058+++ linux-2.6.39/drivers/hwmon/w83791d.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f 30059@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
58c5fc13
MT		 30060 struct i2c_board_info *info);
30061 static int w83791d_remove(struct i2c_client *client);
30062
30063-static int w83791d_read(struct i2c_client *client, u8 register);
30064-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
30065+static int w83791d_read(struct i2c_client *client, u8 reg);
30066+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
30067 static struct w83791d_data *w83791d_update_device(struct device *dev);
30068
30069 #ifdef DEBUG
66a7e928
MT		 30070diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-at91.c linux-2.6.39/drivers/i2c/busses/i2c-at91.c
30071--- linux-2.6.39/drivers/i2c/busses/i2c-at91.c 2011-05-19 00:06:34.000000000 -0400
30072+++ linux-2.6.39/drivers/i2c/busses/i2c-at91.c 2011-05-22 19:36:31.000000000 -0400
30073@@ -181,7 +181,7 @@ static u32 at91_func(struct i2c_adapter
30074 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30075 }
30076
30077-static struct i2c_algorithm at91_algorithm = {
30078+static const struct i2c_algorithm at91_algorithm = {
30079 .master_xfer = at91_xfer,
30080 .functionality = at91_func,
30081 };
30082diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c
30083--- linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-19 00:06:34.000000000 -0400
30084+++ linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-22 19:36:31.000000000 -0400
30085@@ -599,7 +599,7 @@ static u32 bfin_twi_functionality(struct
30086 I2C_FUNC_I2C | I2C_FUNC_SMBUS_I2C_BLOCK;
30087 }
30088
30089-static struct i2c_algorithm bfin_twi_algorithm = {
30090+static const struct i2c_algorithm bfin_twi_algorithm = {
30091 .master_xfer = bfin_twi_master_xfer,
30092 .smbus_xfer = bfin_twi_smbus_xfer,
30093 .functionality = bfin_twi_functionality,
30094diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-davinci.c linux-2.6.39/drivers/i2c/busses/i2c-davinci.c
30095--- linux-2.6.39/drivers/i2c/busses/i2c-davinci.c 2011-05-19 00:06:34.000000000 -0400
30096+++ linux-2.6.39/drivers/i2c/busses/i2c-davinci.c 2011-05-22 19:36:31.000000000 -0400
30097@@ -630,7 +630,7 @@ static inline void i2c_davinci_cpufreq_d
30098 }
30099 #endif
30100
30101-static struct i2c_algorithm i2c_davinci_algo = {
30102+static const struct i2c_algorithm i2c_davinci_algo = {
30103 .master_xfer = i2c_davinci_xfer,
30104 .functionality = i2c_davinci_func,
30105 };
30106diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-designware.c linux-2.6.39/drivers/i2c/busses/i2c-designware.c
30107--- linux-2.6.39/drivers/i2c/busses/i2c-designware.c 2011-05-19 00:06:34.000000000 -0400
30108+++ linux-2.6.39/drivers/i2c/busses/i2c-designware.c 2011-05-22 19:36:31.000000000 -0400
30109@@ -689,7 +689,7 @@ tx_aborted:
30110 return IRQ_HANDLED;
30111 }
30112
30113-static struct i2c_algorithm i2c_dw_algo = {
30114+static const struct i2c_algorithm i2c_dw_algo = {
30115 .master_xfer = i2c_dw_xfer,
30116 .functionality = i2c_dw_func,
30117 };
30118diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c
30119--- linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c 2011-05-19 00:06:34.000000000 -0400
30120+++ linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c 2011-05-22 19:36:31.000000000 -0400
30121@@ -708,7 +708,7 @@ static u32 pch_i2c_func(struct i2c_adapt
30122 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_10BIT_ADDR;
30123 }
30124
30125-static struct i2c_algorithm pch_algorithm = {
30126+static const struct i2c_algorithm pch_algorithm = {
30127 .master_xfer = pch_i2c_xfer,
30128 .functionality = pch_i2c_func
30129 };
30130diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-imx.c linux-2.6.39/drivers/i2c/busses/i2c-imx.c
30131--- linux-2.6.39/drivers/i2c/busses/i2c-imx.c 2011-05-19 00:06:34.000000000 -0400
30132+++ linux-2.6.39/drivers/i2c/busses/i2c-imx.c 2011-05-22 19:36:31.000000000 -0400
30133@@ -457,7 +457,7 @@ static u32 i2c_imx_func(struct i2c_adapt
30134 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30135 }
30136
30137-static struct i2c_algorithm i2c_imx_algo = {
30138+static const struct i2c_algorithm i2c_imx_algo = {
30139 .master_xfer = i2c_imx_xfer,
30140 .functionality = i2c_imx_func,
30141 };
30142diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c
30143--- linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c 2011-05-19 00:06:34.000000000 -0400
30144+++ linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c 2011-05-22 19:36:31.000000000 -0400
30145@@ -917,7 +917,7 @@ err:
30146 return IRQ_HANDLED;
30147 }
30148
30149-static struct i2c_algorithm intel_mid_i2c_algorithm = {
30150+static const struct i2c_algorithm intel_mid_i2c_algorithm = {
30151 .master_xfer = intel_mid_i2c_xfer,
30152 .functionality = intel_mid_i2c_func,
30153 };
30154diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c
30155--- linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c 2011-05-19 00:06:34.000000000 -0400
30156+++ linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c 2011-05-22 19:36:31.000000000 -0400
30157@@ -303,7 +303,7 @@ static u32 nforce2_func(struct i2c_adapt
30158 I2C_FUNC_SMBUS_BLOCK_DATA : 0);
30159 }
30160
30161-static struct i2c_algorithm smbus_algorithm = {
30162+static const struct i2c_algorithm smbus_algorithm = {
30163 .smbus_xfer = nforce2_access,
30164 .functionality = nforce2_func,
30165 };
30166diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c
30167--- linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
30168+++ linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-22 19:36:31.000000000 -0400
30169@@ -615,7 +615,7 @@ static u32 pmcmsptwi_i2c_func(struct i2c
30170
30171 /* -- Initialization -- */
30172
30173-static struct i2c_algorithm pmcmsptwi_algo = {
30174+static const struct i2c_algorithm pmcmsptwi_algo = {
30175 .master_xfer = pmcmsptwi_master_xfer,
30176 .functionality = pmcmsptwi_i2c_func,
30177 };
30178diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-pnx.c linux-2.6.39/drivers/i2c/busses/i2c-pnx.c
30179--- linux-2.6.39/drivers/i2c/busses/i2c-pnx.c 2011-05-19 00:06:34.000000000 -0400
30180+++ linux-2.6.39/drivers/i2c/busses/i2c-pnx.c 2011-05-22 19:36:31.000000000 -0400
30181@@ -535,7 +535,7 @@ static u32 i2c_pnx_func(struct i2c_adapt
30182 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30183 }
30184
30185-static struct i2c_algorithm pnx_algorithm = {
30186+static const struct i2c_algorithm pnx_algorithm = {
30187 .master_xfer = i2c_pnx_xfer,
30188 .functionality = i2c_pnx_func,
30189 };
30190diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-puv3.c linux-2.6.39/drivers/i2c/busses/i2c-puv3.c
30191--- linux-2.6.39/drivers/i2c/busses/i2c-puv3.c 2011-05-19 00:06:34.000000000 -0400
30192+++ linux-2.6.39/drivers/i2c/busses/i2c-puv3.c 2011-05-22 19:36:31.000000000 -0400
30193@@ -176,7 +176,7 @@ static u32 puv3_i2c_func(struct i2c_adap
30194 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30195 }
30196
30197-static struct i2c_algorithm puv3_i2c_algorithm = {
30198+static const struct i2c_algorithm puv3_i2c_algorithm = {
30199 .master_xfer = puv3_i2c_xfer,
30200 .functionality = puv3_i2c_func,
30201 };
30202diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-s6000.c linux-2.6.39/drivers/i2c/busses/i2c-s6000.c
30203--- linux-2.6.39/drivers/i2c/busses/i2c-s6000.c 2011-05-19 00:06:34.000000000 -0400
30204+++ linux-2.6.39/drivers/i2c/busses/i2c-s6000.c 2011-05-22 19:36:31.000000000 -0400
30205@@ -243,7 +243,7 @@ static u32 s6i2c_functionality(struct i2
30206 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30207 }
30208
30209-static struct i2c_algorithm s6i2c_algorithm = {
30210+static const struct i2c_algorithm s6i2c_algorithm = {
30211 .master_xfer = s6i2c_master_xfer,
30212 .functionality = s6i2c_functionality,
30213 };
30214diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c
30215--- linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-19 00:06:34.000000000 -0400
30216+++ linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-22 19:36:31.000000000 -0400
30217@@ -529,7 +529,7 @@ static u32 sh_mobile_i2c_func(struct i2c
30218 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30219 }
30220
30221-static struct i2c_algorithm sh_mobile_i2c_algorithm = {
30222+static const struct i2c_algorithm sh_mobile_i2c_algorithm = {
30223 .functionality = sh_mobile_i2c_func,
30224 .master_xfer = sh_mobile_i2c_xfer,
30225 };
30226diff -urNp linux-2.6.39/drivers/ide/ide-cd.c linux-2.6.39/drivers/ide/ide-cd.c
30227--- linux-2.6.39/drivers/ide/ide-cd.c 2011-05-19 00:06:34.000000000 -0400
30228+++ linux-2.6.39/drivers/ide/ide-cd.c 2011-05-22 19:36:31.000000000 -0400
30229@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
ae4e228f
MT		 30230 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
30231 if ((unsigned long)buf & alignment
30232 || blk_rq_bytes(rq) & q->dma_pad_mask
30233- || object_is_on_stack(buf))
30234+ || object_starts_on_stack(buf))
30235 drive->dma = 0;
30236 }
30237 }
66a7e928
MT		 30238diff -urNp linux-2.6.39/drivers/ide/ide-floppy.c linux-2.6.39/drivers/ide/ide-floppy.c
30239--- linux-2.6.39/drivers/ide/ide-floppy.c 2011-05-19 00:06:34.000000000 -0400
30240+++ linux-2.6.39/drivers/ide/ide-floppy.c 2011-05-22 19:36:31.000000000 -0400
30241@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
30242 u8 pc_buf[256], header_len, desc_cnt;
30243 int i, rc = 1, blocks, length;
30244
30245+ pax_track_stack();
30246+
30247 ide_debug_log(IDE_DBG_FUNC, "enter");
30248
30249 drive->bios_cyl = 0;
30250diff -urNp linux-2.6.39/drivers/ide/it821x.c linux-2.6.39/drivers/ide/it821x.c
30251--- linux-2.6.39/drivers/ide/it821x.c 2011-05-19 00:06:34.000000000 -0400
30252+++ linux-2.6.39/drivers/ide/it821x.c 2011-05-22 19:36:31.000000000 -0400
30253@@ -508,7 +508,7 @@ static void it821x_quirkproc(ide_drive_t
30254
30255 }
30256
30257-static struct ide_dma_ops it821x_pass_through_dma_ops = {
30258+static const struct ide_dma_ops it821x_pass_through_dma_ops = {
30259 .dma_host_set = ide_dma_host_set,
30260 .dma_setup = ide_dma_setup,
30261 .dma_start = it821x_dma_start,
30262diff -urNp linux-2.6.39/drivers/ide/setup-pci.c linux-2.6.39/drivers/ide/setup-pci.c
30263--- linux-2.6.39/drivers/ide/setup-pci.c 2011-05-19 00:06:34.000000000 -0400
30264+++ linux-2.6.39/drivers/ide/setup-pci.c 2011-05-22 19:36:31.000000000 -0400
30265@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
30266 int ret, i, n_ports = dev2 ? 4 : 2;
30267 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
30268
30269+ pax_track_stack();
30270+
30271 for (i = 0; i < n_ports / 2; i++) {
30272 ret = ide_setup_pci_controller(pdev[i], d, !i);
30273 if (ret < 0)
30274diff -urNp linux-2.6.39/drivers/ide/trm290.c linux-2.6.39/drivers/ide/trm290.c
30275--- linux-2.6.39/drivers/ide/trm290.c 2011-05-19 00:06:34.000000000 -0400
30276+++ linux-2.6.39/drivers/ide/trm290.c 2011-05-22 19:36:31.000000000 -0400
30277@@ -314,7 +314,7 @@ static const struct ide_tp_ops trm290_tp
30278 .output_data = ide_output_data,
30279 };
30280
30281-static struct ide_dma_ops trm290_dma_ops = {
30282+static const struct ide_dma_ops trm290_dma_ops = {
30283 .dma_host_set = trm290_dma_host_set,
30284 .dma_setup = trm290_dma_setup,
30285 .dma_start = trm290_dma_start,
30286diff -urNp linux-2.6.39/drivers/infiniband/core/cm.c linux-2.6.39/drivers/infiniband/core/cm.c
30287--- linux-2.6.39/drivers/infiniband/core/cm.c 2011-05-19 00:06:34.000000000 -0400
30288+++ linux-2.6.39/drivers/infiniband/core/cm.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 30289@@ -113,7 +113,7 @@ static char const counter_group_names[CM
ae4e228f
MT		 30290
30291 struct cm_counter_group {
30292 struct kobject obj;
30293- atomic_long_t counter[CM_ATTR_COUNT];
30294+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30295 };
30296
30297 struct cm_counter_attribute {
df50ba0c 30298@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
ae4e228f
MT		 30299 struct ib_mad_send_buf *msg = NULL;
30300 int ret;
30301
30302- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30303+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30304 counter[CM_REQ_COUNTER]);
30305
30306 /* Quick state check to discard duplicate REQs. */
df50ba0c 30307@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
ae4e228f
MT		 30308 if (!cm_id_priv)
30309 return;
58c5fc13 30310
ae4e228f
MT		 30311- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30312+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30313 counter[CM_REP_COUNTER]);
30314 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30315 if (ret)
df50ba0c 30316@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
ae4e228f
MT		 30317 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30318 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30319 spin_unlock_irq(&cm_id_priv->lock);
30320- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30321+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30322 counter[CM_RTU_COUNTER]);
30323 goto out;
30324 }
66a7e928 30325@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
ae4e228f
MT		 30326 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30327 dreq_msg->local_comm_id);
30328 if (!cm_id_priv) {
30329- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30330+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30331 counter[CM_DREQ_COUNTER]);
30332 cm_issue_drep(work->port, work->mad_recv_wc);
30333 return -EINVAL;
66a7e928 30334@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
ae4e228f
MT		 30335 case IB_CM_MRA_REP_RCVD:
30336 break;
30337 case IB_CM_TIMEWAIT:
30338- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30339+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30340 counter[CM_DREQ_COUNTER]);
30341 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30342 goto unlock;
66a7e928 30343@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
ae4e228f
MT		 30344 cm_free_msg(msg);
30345 goto deref;
30346 case IB_CM_DREQ_RCVD:
30347- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30348+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30349 counter[CM_DREQ_COUNTER]);
30350 goto unlock;
30351 default:
66a7e928 30352@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
ae4e228f
MT		 30353 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30354 cm_id_priv->msg, timeout)) {
30355 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30356- atomic_long_inc(&work->port->
30357+ atomic_long_inc_unchecked(&work->port->
30358 counter_group[CM_RECV_DUPLICATES].
30359 counter[CM_MRA_COUNTER]);
30360 goto out;
66a7e928 30361@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
ae4e228f
MT		 30362 break;
30363 case IB_CM_MRA_REQ_RCVD:
30364 case IB_CM_MRA_REP_RCVD:
30365- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30366+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30367 counter[CM_MRA_COUNTER]);
30368 /* fall through */
30369 default:
66a7e928 30370@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
ae4e228f
MT		 30371 case IB_CM_LAP_IDLE:
30372 break;
30373 case IB_CM_MRA_LAP_SENT:
30374- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30375+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30376 counter[CM_LAP_COUNTER]);
30377 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30378 goto unlock;
66a7e928 30379@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
ae4e228f
MT		 30380 cm_free_msg(msg);
30381 goto deref;
30382 case IB_CM_LAP_RCVD:
30383- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30384+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30385 counter[CM_LAP_COUNTER]);
30386 goto unlock;
30387 default:
66a7e928 30388@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
ae4e228f
MT		 30389 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30390 if (cur_cm_id_priv) {
30391 spin_unlock_irq(&cm.lock);
30392- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30393+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30394 counter[CM_SIDR_REQ_COUNTER]);
30395 goto out; /* Duplicate message. */
30396 }
66a7e928 30397@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
ae4e228f
MT		 30398 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30399 msg->retries = 1;
30400
30401- atomic_long_add(1 + msg->retries,
30402+ atomic_long_add_unchecked(1 + msg->retries,
30403 &port->counter_group[CM_XMIT].counter[attr_index]);
30404 if (msg->retries)
30405- atomic_long_add(msg->retries,
30406+ atomic_long_add_unchecked(msg->retries,
30407 &port->counter_group[CM_XMIT_RETRIES].
30408 counter[attr_index]);
30409
66a7e928 30410@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
ae4e228f
MT		 30411 }
30412
30413 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30414- atomic_long_inc(&port->counter_group[CM_RECV].
30415+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30416 counter[attr_id - CM_ATTR_ID_OFFSET]);
30417
30418 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
66a7e928 30419@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
ae4e228f
MT		 30420 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30421
30422 return sprintf(buf, "%ld\n",
30423- atomic_long_read(&group->counter[cm_attr->index]));
30424+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30425 }
30426
df50ba0c 30427 static const struct sysfs_ops cm_counter_ops = {
66a7e928
MT		 30428diff -urNp linux-2.6.39/drivers/infiniband/core/fmr_pool.c linux-2.6.39/drivers/infiniband/core/fmr_pool.c
30429--- linux-2.6.39/drivers/infiniband/core/fmr_pool.c 2011-05-19 00:06:34.000000000 -0400
30430+++ linux-2.6.39/drivers/infiniband/core/fmr_pool.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30431@@ -97,8 +97,8 @@ struct ib_fmr_pool {
30432
30433 struct task_struct *thread;
30434
30435- atomic_t req_ser;
30436- atomic_t flush_ser;
30437+ atomic_unchecked_t req_ser;
30438+ atomic_unchecked_t flush_ser;
30439
30440 wait_queue_head_t force_wait;
30441 };
30442@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
30443 struct ib_fmr_pool *pool = pool_ptr;
30444
30445 do {
30446- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30447+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30448 ib_fmr_batch_release(pool);
30449
30450- atomic_inc(&pool->flush_ser);
30451+ atomic_inc_unchecked(&pool->flush_ser);
30452 wake_up_interruptible(&pool->force_wait);
30453
30454 if (pool->flush_function)
30455@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
30456 }
30457
30458 set_current_state(TASK_INTERRUPTIBLE);
30459- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30460+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30461 !kthread_should_stop())
30462 schedule();
30463 __set_current_state(TASK_RUNNING);
30464@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
30465 pool->dirty_watermark = params->dirty_watermark;
30466 pool->dirty_len = 0;
30467 spin_lock_init(&pool->pool_lock);
30468- atomic_set(&pool->req_ser, 0);
30469- atomic_set(&pool->flush_ser, 0);
30470+ atomic_set_unchecked(&pool->req_ser, 0);
30471+ atomic_set_unchecked(&pool->flush_ser, 0);
30472 init_waitqueue_head(&pool->force_wait);
30473
30474 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30475@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
30476 }
30477 spin_unlock_irq(&pool->pool_lock);
30478
30479- serial = atomic_inc_return(&pool->req_ser);
30480+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30481 wake_up_process(pool->thread);
30482
30483 if (wait_event_interruptible(pool->force_wait,
30484- atomic_read(&pool->flush_ser) - serial >= 0))
30485+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30486 return -EINTR;
30487
30488 return 0;
30489@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
30490 } else {
30491 list_add_tail(&fmr->list, &pool->dirty_list);
30492 if (++pool->dirty_len >= pool->dirty_watermark) {
30493- atomic_inc(&pool->req_ser);
30494+ atomic_inc_unchecked(&pool->req_ser);
30495 wake_up_process(pool->thread);
30496 }
30497 }
66a7e928
MT		 30498diff -urNp linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c
30499--- linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c 2011-05-19 00:06:34.000000000 -0400
30500+++ linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30501@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
30502 int err;
30503 struct fw_ri_tpte tpt;
30504 u32 stag_idx;
30505- static atomic_t key;
30506+ static atomic_unchecked_t key;
30507
30508 if (c4iw_fatal_error(rdev))
30509 return -EIO;
30510@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
30511 &rdev->resource.tpt_fifo_lock);
30512 if (!stag_idx)
30513 return -ENOMEM;
30514- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30515+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30516 }
30517 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30518 __func__, stag_state, type, pdid, stag_idx);
66a7e928
MT		 30519diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c
30520--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-19 00:06:34.000000000 -0400
30521+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-22 19:36:31.000000000 -0400
30522@@ -175,7 +175,7 @@ static void ipath_dma_free_coherent(stru
30523 free_pages((unsigned long) cpu_addr, get_order(size));
30524 }
30525
30526-struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30527+const struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30528 ipath_mapping_error,
30529 ipath_dma_map_single,
30530 ipath_dma_unmap_single,
30531diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c
30532--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-19 00:06:34.000000000 -0400
30533+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-22 19:36:31.000000000 -0400
30534@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
30535 struct infinipath_counters counters;
30536 struct ipath_devdata *dd;
30537
30538+ pax_track_stack();
30539+
30540 dd = file->f_path.dentry->d_inode->i_private;
30541 dd->ipath_f_read_counters(dd, &counters);
30542
30543diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c
30544--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-19 00:06:34.000000000 -0400
30545+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-22 19:36:31.000000000 -0400
30546@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30547 struct ib_atomic_eth *ateth;
30548 struct ipath_ack_entry *e;
30549 u64 vaddr;
30550- atomic64_t *maddr;
30551+ atomic64_unchecked_t *maddr;
30552 u64 sdata;
30553 u32 rkey;
30554 u8 next;
30555@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30556 IB_ACCESS_REMOTE_ATOMIC)))
30557 goto nack_acc_unlck;
30558 /* Perform atomic OP and save result. */
30559- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30560+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30561 sdata = be64_to_cpu(ateth->swap_data);
30562 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30563 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30564- (u64) atomic64_add_return(sdata, maddr) - sdata :
30565+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30566 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30567 be64_to_cpu(ateth->compare_data),
30568 sdata);
30569diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c
30570--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-19 00:06:34.000000000 -0400
30571+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-22 19:36:31.000000000 -0400
30572@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
30573 unsigned long flags;
30574 struct ib_wc wc;
30575 u64 sdata;
30576- atomic64_t *maddr;
30577+ atomic64_unchecked_t *maddr;
30578 enum ib_wc_status send_status;
30579
30580 /*
30581@@ -382,11 +382,11 @@ again:
30582 IB_ACCESS_REMOTE_ATOMIC)))
30583 goto acc_err;
30584 /* Perform atomic OP and save result. */
30585- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30586+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30587 sdata = wqe->wr.wr.atomic.compare_add;
30588 *(u64 *) sqp->s_sge.sge.vaddr =
30589 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30590- (u64) atomic64_add_return(sdata, maddr) - sdata :
30591+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30592 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30593 sdata, wqe->wr.wr.atomic.swap);
30594 goto send_comp;
30595diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h
30596--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-19 00:06:34.000000000 -0400
30597+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-22 19:36:31.000000000 -0400
30598@@ -931,6 +931,6 @@ extern unsigned int ib_ipath_max_srq_wrs
30599
30600 extern const u32 ib_ipath_rnr_table[];
30601
30602-extern struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30603+extern const struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30604
30605 #endif /* IPATH_VERBS_H */
30606diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes.c linux-2.6.39/drivers/infiniband/hw/nes/nes.c
30607--- linux-2.6.39/drivers/infiniband/hw/nes/nes.c 2011-05-19 00:06:34.000000000 -0400
30608+++ linux-2.6.39/drivers/infiniband/hw/nes/nes.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30609@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
30610 LIST_HEAD(nes_adapter_list);
30611 static LIST_HEAD(nes_dev_list);
30612
30613-atomic_t qps_destroyed;
30614+atomic_unchecked_t qps_destroyed;
30615
30616 static unsigned int ee_flsh_adapter;
30617 static unsigned int sysfs_nonidx_addr;
66a7e928 30618@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
8308f9c9
MT		 30619 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30620 struct nes_adapter *nesadapter = nesdev->nesadapter;
30621
30622- atomic_inc(&qps_destroyed);
30623+ atomic_inc_unchecked(&qps_destroyed);
30624
30625 /* Free the control structures */
30626
66a7e928
MT		 30627diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c
30628--- linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c 2011-05-19 00:06:34.000000000 -0400
30629+++ linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30630@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30631 u32 cm_packets_retrans;
30632 u32 cm_packets_created;
30633 u32 cm_packets_received;
30634-atomic_t cm_listens_created;
30635-atomic_t cm_listens_destroyed;
30636+atomic_unchecked_t cm_listens_created;
30637+atomic_unchecked_t cm_listens_destroyed;
30638 u32 cm_backlog_drops;
30639-atomic_t cm_loopbacks;
30640-atomic_t cm_nodes_created;
30641-atomic_t cm_nodes_destroyed;
30642-atomic_t cm_accel_dropped_pkts;
30643-atomic_t cm_resets_recvd;
30644+atomic_unchecked_t cm_loopbacks;
30645+atomic_unchecked_t cm_nodes_created;
30646+atomic_unchecked_t cm_nodes_destroyed;
30647+atomic_unchecked_t cm_accel_dropped_pkts;
30648+atomic_unchecked_t cm_resets_recvd;
30649
30650 static inline int mini_cm_accelerated(struct nes_cm_core *,
30651 struct nes_cm_node *);
30652@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30653
30654 static struct nes_cm_core *g_cm_core;
30655
30656-atomic_t cm_connects;
30657-atomic_t cm_accepts;
30658-atomic_t cm_disconnects;
30659-atomic_t cm_closes;
30660-atomic_t cm_connecteds;
30661-atomic_t cm_connect_reqs;
30662-atomic_t cm_rejects;
30663+atomic_unchecked_t cm_connects;
30664+atomic_unchecked_t cm_accepts;
30665+atomic_unchecked_t cm_disconnects;
30666+atomic_unchecked_t cm_closes;
30667+atomic_unchecked_t cm_connecteds;
30668+atomic_unchecked_t cm_connect_reqs;
30669+atomic_unchecked_t cm_rejects;
30670
30671
30672 /**
30673@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
30674 kfree(listener);
30675 listener = NULL;
30676 ret = 0;
30677- atomic_inc(&cm_listens_destroyed);
30678+ atomic_inc_unchecked(&cm_listens_destroyed);
30679 } else {
30680 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30681 }
66a7e928 30682@@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
8308f9c9
MT		 30683 cm_node->rem_mac);
30684
30685 add_hte_node(cm_core, cm_node);
30686- atomic_inc(&cm_nodes_created);
30687+ atomic_inc_unchecked(&cm_nodes_created);
30688
30689 return cm_node;
30690 }
66a7e928 30691@@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
8308f9c9
MT		 30692 }
30693
30694 atomic_dec(&cm_core->node_cnt);
30695- atomic_inc(&cm_nodes_destroyed);
30696+ atomic_inc_unchecked(&cm_nodes_destroyed);
30697 nesqp = cm_node->nesqp;
30698 if (nesqp) {
30699 nesqp->cm_node = NULL;
66a7e928 30700@@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
8308f9c9
MT		 30701
30702 static void drop_packet(struct sk_buff *skb)
30703 {
30704- atomic_inc(&cm_accel_dropped_pkts);
30705+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30706 dev_kfree_skb_any(skb);
30707 }
30708
66a7e928 30709@@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
8308f9c9
MT		 30710 {
30711
30712 int reset = 0; /* whether to send reset in case of err.. */
30713- atomic_inc(&cm_resets_recvd);
30714+ atomic_inc_unchecked(&cm_resets_recvd);
30715 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30716 " refcnt=%d\n", cm_node, cm_node->state,
30717 atomic_read(&cm_node->ref_count));
66a7e928 30718@@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
8308f9c9
MT		 30719 rem_ref_cm_node(cm_node->cm_core, cm_node);
30720 return NULL;
30721 }
30722- atomic_inc(&cm_loopbacks);
30723+ atomic_inc_unchecked(&cm_loopbacks);
30724 loopbackremotenode->loopbackpartner = cm_node;
30725 loopbackremotenode->tcp_cntxt.rcv_wscale =
30726 NES_CM_DEFAULT_RCV_WND_SCALE;
66a7e928 30727@@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
8308f9c9
MT		 30728 add_ref_cm_node(cm_node);
30729 } else if (cm_node->state == NES_CM_STATE_TSA) {
30730 rem_ref_cm_node(cm_core, cm_node);
30731- atomic_inc(&cm_accel_dropped_pkts);
30732+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30733 dev_kfree_skb_any(skb);
30734 break;
30735 }
66a7e928 30736@@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
8308f9c9
MT		 30737
30738 if ((cm_id) && (cm_id->event_handler)) {
30739 if (issue_disconn) {
30740- atomic_inc(&cm_disconnects);
30741+ atomic_inc_unchecked(&cm_disconnects);
30742 cm_event.event = IW_CM_EVENT_DISCONNECT;
30743 cm_event.status = disconn_status;
30744 cm_event.local_addr = cm_id->local_addr;
66a7e928 30745@@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
8308f9c9
MT		 30746 }
30747
30748 if (issue_close) {
30749- atomic_inc(&cm_closes);
30750+ atomic_inc_unchecked(&cm_closes);
30751 nes_disconnect(nesqp, 1);
30752
30753 cm_id->provider_data = nesqp;
66a7e928 30754@@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
8308f9c9
MT		 30755
30756 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30757 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30758- atomic_inc(&cm_accepts);
30759+ atomic_inc_unchecked(&cm_accepts);
30760
30761 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30762 netdev_refcnt_read(nesvnic->netdev));
66a7e928 30763@@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
8308f9c9
MT		 30764
30765 struct nes_cm_core *cm_core;
30766
30767- atomic_inc(&cm_rejects);
30768+ atomic_inc_unchecked(&cm_rejects);
30769 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30770 loopback = cm_node->loopbackpartner;
30771 cm_core = cm_node->cm_core;
66a7e928 30772@@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
8308f9c9
MT		 30773 ntohl(cm_id->local_addr.sin_addr.s_addr),
30774 ntohs(cm_id->local_addr.sin_port));
30775
30776- atomic_inc(&cm_connects);
30777+ atomic_inc_unchecked(&cm_connects);
30778 nesqp->active_conn = 1;
30779
30780 /* cache the cm_id in the qp */
66a7e928 30781@@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
8308f9c9
MT		 30782 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30783 return err;
30784 }
30785- atomic_inc(&cm_listens_created);
30786+ atomic_inc_unchecked(&cm_listens_created);
30787 }
30788
30789 cm_id->add_ref(cm_id);
66a7e928 30790@@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
8308f9c9
MT		 30791 if (nesqp->destroyed) {
30792 return;
30793 }
30794- atomic_inc(&cm_connecteds);
30795+ atomic_inc_unchecked(&cm_connecteds);
30796 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30797 " local port 0x%04X. jiffies = %lu.\n",
30798 nesqp->hwqp.qp_id,
66a7e928 30799@@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
8308f9c9
MT		 30800
30801 cm_id->add_ref(cm_id);
30802 ret = cm_id->event_handler(cm_id, &cm_event);
30803- atomic_inc(&cm_closes);
30804+ atomic_inc_unchecked(&cm_closes);
30805 cm_event.event = IW_CM_EVENT_CLOSE;
30806 cm_event.status = IW_CM_EVENT_STATUS_OK;
30807 cm_event.provider_data = cm_id->provider_data;
66a7e928 30808@@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
8308f9c9
MT		 30809 return;
30810 cm_id = cm_node->cm_id;
30811
30812- atomic_inc(&cm_connect_reqs);
30813+ atomic_inc_unchecked(&cm_connect_reqs);
30814 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30815 cm_node, cm_id, jiffies);
30816
66a7e928 30817@@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
8308f9c9
MT		 30818 return;
30819 cm_id = cm_node->cm_id;
30820
30821- atomic_inc(&cm_connect_reqs);
30822+ atomic_inc_unchecked(&cm_connect_reqs);
30823 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30824 cm_node, cm_id, jiffies);
30825
66a7e928
MT		 30826diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes.h linux-2.6.39/drivers/infiniband/hw/nes/nes.h
30827--- linux-2.6.39/drivers/infiniband/hw/nes/nes.h 2011-05-19 00:06:34.000000000 -0400
30828+++ linux-2.6.39/drivers/infiniband/hw/nes/nes.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30829@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30830 extern unsigned int wqm_quanta;
30831 extern struct list_head nes_adapter_list;
30832
30833-extern atomic_t cm_connects;
30834-extern atomic_t cm_accepts;
30835-extern atomic_t cm_disconnects;
30836-extern atomic_t cm_closes;
30837-extern atomic_t cm_connecteds;
30838-extern atomic_t cm_connect_reqs;
30839-extern atomic_t cm_rejects;
30840-extern atomic_t mod_qp_timouts;
30841-extern atomic_t qps_created;
30842-extern atomic_t qps_destroyed;
30843-extern atomic_t sw_qps_destroyed;
30844+extern atomic_unchecked_t cm_connects;
30845+extern atomic_unchecked_t cm_accepts;
30846+extern atomic_unchecked_t cm_disconnects;
30847+extern atomic_unchecked_t cm_closes;
30848+extern atomic_unchecked_t cm_connecteds;
30849+extern atomic_unchecked_t cm_connect_reqs;
30850+extern atomic_unchecked_t cm_rejects;
30851+extern atomic_unchecked_t mod_qp_timouts;
30852+extern atomic_unchecked_t qps_created;
30853+extern atomic_unchecked_t qps_destroyed;
30854+extern atomic_unchecked_t sw_qps_destroyed;
30855 extern u32 mh_detected;
30856 extern u32 mh_pauses_sent;
30857 extern u32 cm_packets_sent;
30858@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30859 extern u32 cm_packets_received;
30860 extern u32 cm_packets_dropped;
30861 extern u32 cm_packets_retrans;
30862-extern atomic_t cm_listens_created;
30863-extern atomic_t cm_listens_destroyed;
30864+extern atomic_unchecked_t cm_listens_created;
30865+extern atomic_unchecked_t cm_listens_destroyed;
30866 extern u32 cm_backlog_drops;
30867-extern atomic_t cm_loopbacks;
30868-extern atomic_t cm_nodes_created;
30869-extern atomic_t cm_nodes_destroyed;
30870-extern atomic_t cm_accel_dropped_pkts;
30871-extern atomic_t cm_resets_recvd;
30872+extern atomic_unchecked_t cm_loopbacks;
30873+extern atomic_unchecked_t cm_nodes_created;
30874+extern atomic_unchecked_t cm_nodes_destroyed;
30875+extern atomic_unchecked_t cm_accel_dropped_pkts;
30876+extern atomic_unchecked_t cm_resets_recvd;
30877
30878 extern u32 int_mod_timer_init;
30879 extern u32 int_mod_cq_depth_256;
66a7e928
MT		 30880diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c
30881--- linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c 2011-05-19 00:06:34.000000000 -0400
30882+++ linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30883@@ -1302,31 +1302,31 @@ static void nes_netdev_get_ethtool_stats
30884 target_stat_values[++index] = mh_detected;
30885 target_stat_values[++index] = mh_pauses_sent;
30886 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30887- target_stat_values[++index] = atomic_read(&cm_connects);
30888- target_stat_values[++index] = atomic_read(&cm_accepts);
30889- target_stat_values[++index] = atomic_read(&cm_disconnects);
30890- target_stat_values[++index] = atomic_read(&cm_connecteds);
30891- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30892- target_stat_values[++index] = atomic_read(&cm_rejects);
30893- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30894- target_stat_values[++index] = atomic_read(&qps_created);
30895- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30896- target_stat_values[++index] = atomic_read(&qps_destroyed);
30897- target_stat_values[++index] = atomic_read(&cm_closes);
30898+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30899+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30900+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30901+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30902+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30903+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30904+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30905+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30906+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30907+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30908+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30909 target_stat_values[++index] = cm_packets_sent;
30910 target_stat_values[++index] = cm_packets_bounced;
30911 target_stat_values[++index] = cm_packets_created;
30912 target_stat_values[++index] = cm_packets_received;
30913 target_stat_values[++index] = cm_packets_dropped;
30914 target_stat_values[++index] = cm_packets_retrans;
30915- target_stat_values[++index] = atomic_read(&cm_listens_created);
30916- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30917+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30918+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30919 target_stat_values[++index] = cm_backlog_drops;
30920- target_stat_values[++index] = atomic_read(&cm_loopbacks);
30921- target_stat_values[++index] = atomic_read(&cm_nodes_created);
30922- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30923- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30924- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30925+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30926+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30927+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30928+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30929+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30930 target_stat_values[++index] = nesadapter->free_4kpbl;
30931 target_stat_values[++index] = nesadapter->free_256pbl;
30932 target_stat_values[++index] = int_mod_timer_init;
66a7e928
MT		 30933diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c
30934--- linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-19 00:06:34.000000000 -0400
30935+++ linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 30936@@ -46,9 +46,9 @@
30937
30938 #include <rdma/ib_umem.h>
30939
30940-atomic_t mod_qp_timouts;
30941-atomic_t qps_created;
30942-atomic_t sw_qps_destroyed;
30943+atomic_unchecked_t mod_qp_timouts;
30944+atomic_unchecked_t qps_created;
30945+atomic_unchecked_t sw_qps_destroyed;
30946
30947 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30948
30949@@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
30950 if (init_attr->create_flags)
30951 return ERR_PTR(-EINVAL);
30952
30953- atomic_inc(&qps_created);
30954+ atomic_inc_unchecked(&qps_created);
30955 switch (init_attr->qp_type) {
30956 case IB_QPT_RC:
30957 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30958@@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
30959 struct iw_cm_event cm_event;
30960 int ret;
30961
30962- atomic_inc(&sw_qps_destroyed);
30963+ atomic_inc_unchecked(&sw_qps_destroyed);
30964 nesqp->destroyed = 1;
30965
30966 /* Blow away the connection if it exists. */
66a7e928
MT		 30967diff -urNp linux-2.6.39/drivers/infiniband/hw/qib/qib.h linux-2.6.39/drivers/infiniband/hw/qib/qib.h
30968--- linux-2.6.39/drivers/infiniband/hw/qib/qib.h 2011-05-19 00:06:34.000000000 -0400
30969+++ linux-2.6.39/drivers/infiniband/hw/qib/qib.h 2011-05-22 19:36:31.000000000 -0400
6892158b 30970@@ -51,6 +51,7 @@
57199397
MT		 30971 #include <linux/completion.h>
30972 #include <linux/kref.h>
30973 #include <linux/sched.h>
30974+#include <linux/slab.h>
30975
30976 #include "qib_common.h"
30977 #include "qib_verbs.h"
66a7e928
MT		 30978@@ -87,7 +88,7 @@ struct qlogic_ib_stats {
30979 };
30980
30981 extern struct qlogic_ib_stats qib_stats;
30982-extern struct pci_error_handlers qib_pci_err_handler;
30983+extern const struct pci_error_handlers qib_pci_err_handler;
30984 extern struct pci_driver qib_driver;
30985
30986 #define QIB_CHIP_SWVERSION QIB_CHIP_VERS_MAJ
30987diff -urNp linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c
30988--- linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-19 00:06:34.000000000 -0400
30989+++ linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-22 19:36:31.000000000 -0400
30990@@ -75,7 +75,7 @@ static void qib_vma_close(struct vm_area
30991 kref_put(&ip->ref, qib_release_mmap_info);
30992 }
30993
30994-static struct vm_operations_struct qib_vm_ops = {
30995+static const struct vm_operations_struct qib_vm_ops = {
30996 .open = qib_vma_open,
30997 .close = qib_vma_close,
30998 };
30999diff -urNp linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c
31000--- linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-19 00:06:34.000000000 -0400
31001+++ linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-22 19:36:31.000000000 -0400
31002@@ -735,7 +735,7 @@ qib_pci_resume(struct pci_dev *pdev)
31003 qib_init(dd, 1); /* same as re-init after reset */
31004 }
31005
31006-struct pci_error_handlers qib_pci_err_handler = {
31007+const struct pci_error_handlers qib_pci_err_handler = {
31008 .error_detected = qib_pci_error_detected,
31009 .mmio_enabled = qib_pci_mmio_enabled,
31010 .link_reset = qib_pci_link_reset,
31011diff -urNp linux-2.6.39/drivers/input/gameport/gameport.c linux-2.6.39/drivers/input/gameport/gameport.c
31012--- linux-2.6.39/drivers/input/gameport/gameport.c 2011-05-19 00:06:34.000000000 -0400
31013+++ linux-2.6.39/drivers/input/gameport/gameport.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31014@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
31015 */
31016 static void gameport_init_port(struct gameport *gameport)
31017 {
31018- static atomic_t gameport_no = ATOMIC_INIT(0);
31019+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
31020
31021 __module_get(THIS_MODULE);
31022
31023 mutex_init(&gameport->drv_mutex);
31024 device_initialize(&gameport->dev);
31025 dev_set_name(&gameport->dev, "gameport%lu",
31026- (unsigned long)atomic_inc_return(&gameport_no) - 1);
31027+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
31028 gameport->dev.bus = &gameport_bus;
31029 gameport->dev.release = gameport_release_port;
31030 if (gameport->parent)
66a7e928
MT		 31031diff -urNp linux-2.6.39/drivers/input/input.c linux-2.6.39/drivers/input/input.c
31032--- linux-2.6.39/drivers/input/input.c 2011-05-19 00:06:34.000000000 -0400
31033+++ linux-2.6.39/drivers/input/input.c 2011-05-22 19:36:31.000000000 -0400
31034@@ -1815,7 +1815,7 @@ static void input_cleanse_bitmasks(struc
8308f9c9
MT		 31035 */
31036 int input_register_device(struct input_dev *dev)
31037 {
31038- static atomic_t input_no = ATOMIC_INIT(0);
31039+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
31040 struct input_handler *handler;
31041 const char *path;
31042 int error;
66a7e928
MT		 31043@@ -1852,7 +1852,7 @@ int input_register_device(struct input_d
31044 dev->setkeycode = input_default_setkeycode;
8308f9c9
MT		 31045
31046 dev_set_name(&dev->dev, "input%ld",
31047- (unsigned long) atomic_inc_return(&input_no) - 1);
31048+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
31049
31050 error = device_add(&dev->dev);
31051 if (error)
66a7e928
MT		 31052diff -urNp linux-2.6.39/drivers/input/joystick/sidewinder.c linux-2.6.39/drivers/input/joystick/sidewinder.c
31053--- linux-2.6.39/drivers/input/joystick/sidewinder.c 2011-05-19 00:06:34.000000000 -0400
31054+++ linux-2.6.39/drivers/input/joystick/sidewinder.c 2011-05-22 19:36:31.000000000 -0400
31055@@ -30,6 +30,7 @@
31056 #include <linux/kernel.h>
31057 #include <linux/module.h>
31058 #include <linux/slab.h>
31059+#include <linux/sched.h>
31060 #include <linux/init.h>
31061 #include <linux/input.h>
31062 #include <linux/gameport.h>
31063@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
31064 unsigned char buf[SW_LENGTH];
31065 int i;
31066
31067+ pax_track_stack();
31068+
31069 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
31070
31071 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
31072diff -urNp linux-2.6.39/drivers/input/joystick/xpad.c linux-2.6.39/drivers/input/joystick/xpad.c
31073--- linux-2.6.39/drivers/input/joystick/xpad.c 2011-05-19 00:06:34.000000000 -0400
31074+++ linux-2.6.39/drivers/input/joystick/xpad.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31075@@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
31076
31077 static int xpad_led_probe(struct usb_xpad *xpad)
31078 {
31079- static atomic_t led_seq = ATOMIC_INIT(0);
31080+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
31081 long led_no;
31082 struct xpad_led *led;
31083 struct led_classdev *led_cdev;
31084@@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
31085 if (!led)
31086 return -ENOMEM;
31087
31088- led_no = (long)atomic_inc_return(&led_seq) - 1;
31089+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
31090
31091 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
31092 led->xpad = xpad;
66a7e928
MT		 31093diff -urNp linux-2.6.39/drivers/input/mousedev.c linux-2.6.39/drivers/input/mousedev.c
31094--- linux-2.6.39/drivers/input/mousedev.c 2011-05-19 00:06:34.000000000 -0400
31095+++ linux-2.6.39/drivers/input/mousedev.c 2011-05-22 19:36:31.000000000 -0400
16454cff 31096@@ -764,7 +764,7 @@ static ssize_t mousedev_read(struct file
ae4e228f
MT		 31097
31098 spin_unlock_irq(&client->packet_lock);
31099
31100- if (copy_to_user(buffer, data, count))
31101+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
31102 return -EFAULT;
31103
31104 return count;
66a7e928
MT		 31105diff -urNp linux-2.6.39/drivers/input/serio/serio.c linux-2.6.39/drivers/input/serio/serio.c
31106--- linux-2.6.39/drivers/input/serio/serio.c 2011-05-19 00:06:34.000000000 -0400
31107+++ linux-2.6.39/drivers/input/serio/serio.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31108@@ -497,7 +497,7 @@ static void serio_release_port(struct de
31109 */
31110 static void serio_init_port(struct serio *serio)
31111 {
31112- static atomic_t serio_no = ATOMIC_INIT(0);
31113+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
31114
31115 __module_get(THIS_MODULE);
31116
31117@@ -508,7 +508,7 @@ static void serio_init_port(struct serio
31118 mutex_init(&serio->drv_mutex);
31119 device_initialize(&serio->dev);
31120 dev_set_name(&serio->dev, "serio%ld",
31121- (long)atomic_inc_return(&serio_no) - 1);
31122+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
31123 serio->dev.bus = &serio_bus;
31124 serio->dev.release = serio_release_port;
31125 serio->dev.groups = serio_device_attr_groups;
66a7e928
MT		 31126diff -urNp linux-2.6.39/drivers/isdn/capi/capi.c linux-2.6.39/drivers/isdn/capi/capi.c
31127--- linux-2.6.39/drivers/isdn/capi/capi.c 2011-05-19 00:06:34.000000000 -0400
31128+++ linux-2.6.39/drivers/isdn/capi/capi.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31129@@ -89,8 +89,8 @@ struct capiminor {
31130
31131 struct capi20_appl *ap;
31132 u32 ncci;
31133- atomic_t datahandle;
31134- atomic_t msgid;
31135+ atomic_unchecked_t datahandle;
31136+ atomic_unchecked_t msgid;
31137
31138 struct tty_port port;
31139 int ttyinstop;
31140@@ -414,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *m
31141 capimsg_setu16(s, 2, mp->ap->applid);
31142 capimsg_setu8 (s, 4, CAPI_DATA_B3);
31143 capimsg_setu8 (s, 5, CAPI_RESP);
31144- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
31145+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
31146 capimsg_setu32(s, 8, mp->ncci);
31147 capimsg_setu16(s, 12, datahandle);
31148 }
31149@@ -547,14 +547,14 @@ static void handle_minor_send(struct cap
31150 mp->outbytes -= len;
31151 spin_unlock_bh(&mp->outlock);
31152
31153- datahandle = atomic_inc_return(&mp->datahandle);
31154+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
31155 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
31156 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31157 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31158 capimsg_setu16(skb->data, 2, mp->ap->applid);
31159 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
31160 capimsg_setu8 (skb->data, 5, CAPI_REQ);
31161- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
31162+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
31163 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
31164 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
31165 capimsg_setu16(skb->data, 16, len); /* Data length */
66a7e928
MT		 31166diff -urNp linux-2.6.39/drivers/isdn/gigaset/common.c linux-2.6.39/drivers/isdn/gigaset/common.c
31167--- linux-2.6.39/drivers/isdn/gigaset/common.c 2011-05-19 00:06:34.000000000 -0400
31168+++ linux-2.6.39/drivers/isdn/gigaset/common.c 2011-05-22 19:36:31.000000000 -0400
57199397 31169@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
58c5fc13
MT		 31170 cs->commands_pending = 0;
31171 cs->cur_at_seq = 0;
31172 cs->gotfwver = -1;
31173- cs->open_count = 0;
c52201e0 31174+ local_set(&cs->open_count, 0);
58c5fc13
MT		 31175 cs->dev = NULL;
31176 cs->tty = NULL;
31177 cs->tty_dev = NULL;
66a7e928
MT		 31178diff -urNp linux-2.6.39/drivers/isdn/gigaset/gigaset.h linux-2.6.39/drivers/isdn/gigaset/gigaset.h
31179--- linux-2.6.39/drivers/isdn/gigaset/gigaset.h 2011-05-19 00:06:34.000000000 -0400
31180+++ linux-2.6.39/drivers/isdn/gigaset/gigaset.h 2011-05-22 19:36:31.000000000 -0400
c52201e0
MT		 31181@@ -35,6 +35,7 @@
31182 #include <linux/tty_driver.h>
31183 #include <linux/list.h>
31184 #include <asm/atomic.h>
31185+#include <asm/local.h>
31186
31187 #define GIG_VERSION {0, 5, 0, 0}
31188 #define GIG_COMPAT {0, 4, 0, 0}
31189@@ -433,7 +434,7 @@ struct cardstate {
58c5fc13
MT		 31190 spinlock_t cmdlock;
31191 unsigned curlen, cmdbytes;
31192
31193- unsigned open_count;
c52201e0 31194+ local_t open_count;
58c5fc13
MT		 31195 struct tty_struct *tty;
31196 struct tasklet_struct if_wake_tasklet;
31197 unsigned control_state;
66a7e928
MT		 31198diff -urNp linux-2.6.39/drivers/isdn/gigaset/interface.c linux-2.6.39/drivers/isdn/gigaset/interface.c
31199--- linux-2.6.39/drivers/isdn/gigaset/interface.c 2011-05-19 00:06:34.000000000 -0400
31200+++ linux-2.6.39/drivers/isdn/gigaset/interface.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 31201@@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
ae4e228f 31202 return -ERESTARTSYS;
58c5fc13
MT		 31203 tty->driver_data = cs;
31204
31205- ++cs->open_count;
31206-
31207- if (cs->open_count == 1) {
c52201e0 31208+ if (local_inc_return(&cs->open_count) == 1) {
58c5fc13
MT		 31209 spin_lock_irqsave(&cs->lock, flags);
31210 cs->tty = tty;
31211 spin_unlock_irqrestore(&cs->lock, flags);
df50ba0c 31212@@ -190,10 +188,10 @@ static void if_close(struct tty_struct *
58c5fc13
MT		 31213
31214 if (!cs->connected)
31215 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31216- else if (!cs->open_count)
c52201e0 31217+ else if (!local_read(&cs->open_count))
58c5fc13
MT		 31218 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31219 else {
31220- if (!--cs->open_count) {
c52201e0 31221+ if (!local_dec_return(&cs->open_count)) {
58c5fc13
MT		 31222 spin_lock_irqsave(&cs->lock, flags);
31223 cs->tty = NULL;
31224 spin_unlock_irqrestore(&cs->lock, flags);
df50ba0c 31225@@ -228,7 +226,7 @@ static int if_ioctl(struct tty_struct *t
58c5fc13
MT		 31226 if (!cs->connected) {
31227 gig_dbg(DEBUG_IF, "not connected");
31228 retval = -ENODEV;
31229- } else if (!cs->open_count)
c52201e0 31230+ } else if (!local_read(&cs->open_count))
58c5fc13
MT		 31231 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31232 else {
31233 retval = 0;
6892158b 31234@@ -358,7 +356,7 @@ static int if_write(struct tty_struct *t
58c5fc13 31235 retval = -ENODEV;
6892158b
MT		 31236 goto done;
31237 }
31238- if (!cs->open_count) {
c52201e0 31239+ if (!local_read(&cs->open_count)) {
58c5fc13 31240 dev_warn(cs->dev, "%s: device not opened\n", __func__);
6892158b
MT		 31241 retval = -ENODEV;
31242 goto done;
31243@@ -411,7 +409,7 @@ static int if_write_room(struct tty_stru
58c5fc13
MT		 31244 if (!cs->connected) {
31245 gig_dbg(DEBUG_IF, "not connected");
31246 retval = -ENODEV;
31247- } else if (!cs->open_count)
c52201e0 31248+ } else if (!local_read(&cs->open_count))
58c5fc13
MT		 31249 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31250 else if (cs->mstate != MS_LOCKED) {
31251 dev_warn(cs->dev, "can't write to unlocked device\n");
6892158b 31252@@ -441,7 +439,7 @@ static int if_chars_in_buffer(struct tty
ae4e228f
MT		 31253
31254 if (!cs->connected)
58c5fc13 31255 gig_dbg(DEBUG_IF, "not connected");
ae4e228f 31256- else if (!cs->open_count)
c52201e0 31257+ else if (!local_read(&cs->open_count))
58c5fc13 31258 dev_warn(cs->dev, "%s: device not opened\n", __func__);
ae4e228f 31259 else if (cs->mstate != MS_LOCKED)
58c5fc13 31260 dev_warn(cs->dev, "can't write to unlocked device\n");
6892158b 31261@@ -469,7 +467,7 @@ static void if_throttle(struct tty_struc
58c5fc13
MT		 31262
31263 if (!cs->connected)
31264 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31265- else if (!cs->open_count)
c52201e0 31266+ else if (!local_read(&cs->open_count))
58c5fc13 31267 dev_warn(cs->dev, "%s: device not opened\n", __func__);
ae4e228f 31268 else
df50ba0c 31269 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
6892158b 31270@@ -493,7 +491,7 @@ static void if_unthrottle(struct tty_str
58c5fc13
MT		 31271
31272 if (!cs->connected)
31273 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31274- else if (!cs->open_count)
c52201e0 31275+ else if (!local_read(&cs->open_count))
58c5fc13 31276 dev_warn(cs->dev, "%s: device not opened\n", __func__);
ae4e228f 31277 else
df50ba0c 31278 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
6892158b 31279@@ -524,7 +522,7 @@ static void if_set_termios(struct tty_st
58c5fc13
MT		 31280 goto out;
31281 }
31282
31283- if (!cs->open_count) {
c52201e0 31284+ if (!local_read(&cs->open_count)) {
58c5fc13
MT		 31285 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31286 goto out;
31287 }
66a7e928
MT		 31288diff -urNp linux-2.6.39/drivers/isdn/hardware/avm/b1.c linux-2.6.39/drivers/isdn/hardware/avm/b1.c
31289--- linux-2.6.39/drivers/isdn/hardware/avm/b1.c 2011-05-19 00:06:34.000000000 -0400
31290+++ linux-2.6.39/drivers/isdn/hardware/avm/b1.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 31291@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
ae4e228f
MT		 31292 }
31293 if (left) {
31294 if (t4file->user) {
31295- if (copy_from_user(buf, dp, left))
bc901d79 31296+ if (left > sizeof buf || copy_from_user(buf, dp, left))
ae4e228f
MT		 31297 return -EFAULT;
31298 } else {
31299 memcpy(buf, dp, left);
df50ba0c 31300@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
ae4e228f
MT		 31301 }
31302 if (left) {
31303 if (config->user) {
31304- if (copy_from_user(buf, dp, left))
bc901d79 31305+ if (left > sizeof buf || copy_from_user(buf, dp, left))
ae4e228f
MT		 31306 return -EFAULT;
31307 } else {
31308 memcpy(buf, dp, left);
66a7e928
MT		 31309diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c
31310--- linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-19 00:06:34.000000000 -0400
31311+++ linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-22 19:36:31.000000000 -0400
31312@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
31313 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31314 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31315
31316+ pax_track_stack();
31317
31318 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31319 {
31320diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c
31321--- linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c 2011-05-19 00:06:34.000000000 -0400
31322+++ linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c 2011-05-22 19:36:31.000000000 -0400
31323@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31324 IDI_SYNC_REQ req;
31325 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31326
31327+ pax_track_stack();
31328+
31329 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31330
31331 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31332diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c
31333--- linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-19 00:06:34.000000000 -0400
31334+++ linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-22 19:36:31.000000000 -0400
31335@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
31336 IDI_SYNC_REQ req;
31337 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31338
31339+ pax_track_stack();
31340+
31341 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31342
31343 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31344diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c
31345--- linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-19 00:06:34.000000000 -0400
31346+++ linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-22 19:36:31.000000000 -0400
31347@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
31348 IDI_SYNC_REQ req;
31349 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31350
31351+ pax_track_stack();
31352+
31353 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31354
31355 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31356diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c
31357--- linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c 2011-05-19 00:06:34.000000000 -0400
31358+++ linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c 2011-05-22 19:36:31.000000000 -0400
31359@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
31360 IDI_SYNC_REQ req;
31361 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31362
31363+ pax_track_stack();
31364+
31365 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31366
31367 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31368diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/message.c linux-2.6.39/drivers/isdn/hardware/eicon/message.c
31369--- linux-2.6.39/drivers/isdn/hardware/eicon/message.c 2011-05-19 00:06:34.000000000 -0400
31370+++ linux-2.6.39/drivers/isdn/hardware/eicon/message.c 2011-05-22 19:36:31.000000000 -0400
31371@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
31372 dword d;
31373 word w;
31374
31375+ pax_track_stack();
31376+
31377 a = plci->adapter;
31378 Id = ((word)plci->Id<<8)|a->Id;
31379 PUT_WORD(&SS_Ind[4],0x0000);
31380@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
31381 word j, n, w;
31382 dword d;
31383
31384+ pax_track_stack();
31385+
31386
31387 for(i=0;i<8;i++) bp_parms[i].length = 0;
31388 for(i=0;i<2;i++) global_config[i].length = 0;
31389@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
31390 const byte llc3[] = {4,3,2,2,6,6,0};
31391 const byte header[] = {0,2,3,3,0,0,0};
31392
31393+ pax_track_stack();
31394+
31395 for(i=0;i<8;i++) bp_parms[i].length = 0;
31396 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31397 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31398@@ -14760,6 +14766,8 @@ static void group_optimization(DIVA_CAPI
31399 word appl_number_group_type[MAX_APPL];
31400 PLCI *auxplci;
31401
31402+ pax_track_stack();
31403+
31404 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31405
31406 if(!a->group_optimization_enabled)
31407diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c
31408--- linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-19 00:06:34.000000000 -0400
31409+++ linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-22 19:36:31.000000000 -0400
31410@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
31411 IDI_SYNC_REQ req;
31412 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31413
31414+ pax_track_stack();
31415+
31416 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31417
31418 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31419diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_common.c linux-2.6.39/drivers/isdn/i4l/isdn_common.c
31420--- linux-2.6.39/drivers/isdn/i4l/isdn_common.c 2011-05-19 00:06:34.000000000 -0400
31421+++ linux-2.6.39/drivers/isdn/i4l/isdn_common.c 2011-05-22 19:36:31.000000000 -0400
31422@@ -1292,6 +1292,8 @@ isdn_ioctl(struct file *file, uint cmd,
31423 } iocpar;
31424 void __user *argp = (void __user *)arg;
31425
31426+ pax_track_stack();
31427+
31428 #define name iocpar.name
31429 #define bname iocpar.bname
31430 #define iocts iocpar.iocts
31431diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_net.c linux-2.6.39/drivers/isdn/i4l/isdn_net.c
31432--- linux-2.6.39/drivers/isdn/i4l/isdn_net.c 2011-05-19 00:06:34.000000000 -0400
31433+++ linux-2.6.39/drivers/isdn/i4l/isdn_net.c 2011-05-22 19:36:31.000000000 -0400
31434@@ -400,7 +400,7 @@ isdn_net_stat_callback(int idx, isdn_ctr
31435 isdn_net_local *lp = p->local;
31436 #ifdef CONFIG_ISDN_X25
31437 struct concap_proto *cprot = lp->netdev->cprot;
31438- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31439+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31440 #endif
31441 switch (cmd) {
31442 case ISDN_STAT_BSENT:
31443@@ -831,7 +831,7 @@ isdn_net_hangup(struct net_device *d)
31444 isdn_ctrl cmd;
31445 #ifdef CONFIG_ISDN_X25
31446 struct concap_proto *cprot = lp->netdev->cprot;
31447- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31448+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31449 #endif
31450
31451 if (lp->flags & ISDN_NET_CONNECTED) {
31452diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c
31453--- linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c 2011-05-19 00:06:34.000000000 -0400
31454+++ linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c 2011-05-22 19:36:31.000000000 -0400
31455@@ -52,7 +52,7 @@ static int isdn_x25iface_connect_ind( st
31456 static int isdn_x25iface_disconn_ind( struct concap_proto * );
31457
31458
31459-static struct concap_proto_ops ix25_pops = {
31460+static const struct concap_proto_ops ix25_pops = {
31461 &isdn_x25iface_proto_new,
31462 &isdn_x25iface_proto_del,
31463 &isdn_x25iface_proto_restart,
31464diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h
31465--- linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h 2011-05-19 00:06:34.000000000 -0400
31466+++ linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h 2011-05-22 19:36:31.000000000 -0400
31467@@ -23,7 +23,7 @@
31468 #include <linux/isdn.h>
31469 #include <linux/concap.h>
31470
31471-extern struct concap_proto_ops * isdn_x25iface_concap_proto_ops_pt;
31472+extern const struct concap_proto_ops *isdn_x25iface_concap_proto_ops_pt;
31473 extern struct concap_proto * isdn_x25iface_proto_new(void);
31474
31475
31476diff -urNp linux-2.6.39/drivers/isdn/icn/icn.c linux-2.6.39/drivers/isdn/icn/icn.c
31477--- linux-2.6.39/drivers/isdn/icn/icn.c 2011-05-19 00:06:34.000000000 -0400
31478+++ linux-2.6.39/drivers/isdn/icn/icn.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 31479@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
ae4e228f
MT		 31480 if (count > len)
31481 count = len;
31482 if (user) {
31483- if (copy_from_user(msg, buf, count))
bc901d79 31484+ if (count > sizeof msg || copy_from_user(msg, buf, count))
ae4e228f
MT		 31485 return -EFAULT;
31486 } else
31487 memcpy(msg, buf, count);
66a7e928
MT		 31488diff -urNp linux-2.6.39/drivers/lguest/core.c linux-2.6.39/drivers/lguest/core.c
31489--- linux-2.6.39/drivers/lguest/core.c 2011-05-19 00:06:34.000000000 -0400
31490+++ linux-2.6.39/drivers/lguest/core.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 31491@@ -92,9 +92,17 @@ static __init int map_switcher(void)
58c5fc13
MT		 31492 * it's worked so far. The end address needs +1 because __get_vm_area
31493 * allocates an extra guard page, so we need space for that.
31494 */
31495+
31496+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31497+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31498+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31499+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31500+#else
31501 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31502 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31503 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31504+#endif
31505+
31506 if (!switcher_vma) {
31507 err = -ENOMEM;
31508 printk("lguest: could not map switcher pages high\n");
bc901d79
MT		 31509@@ -119,7 +127,7 @@ static __init int map_switcher(void)
31510 * Now the Switcher is mapped at the right address, we can't fail!
31511 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
31512 */
31513- memcpy(switcher_vma->addr, start_switcher_text,
31514+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31515 end_switcher_text - start_switcher_text);
31516
31517 printk(KERN_INFO "lguest: mapped switcher at %p\n",
66a7e928
MT		 31518diff -urNp linux-2.6.39/drivers/lguest/lguest_device.c linux-2.6.39/drivers/lguest/lguest_device.c
31519--- linux-2.6.39/drivers/lguest/lguest_device.c 2011-05-19 00:06:34.000000000 -0400
31520+++ linux-2.6.39/drivers/lguest/lguest_device.c 2011-05-22 19:36:31.000000000 -0400
31521@@ -374,7 +374,7 @@ error:
31522 }
31523
31524 /* The ops structure which hooks everything together. */
31525-static struct virtio_config_ops lguest_config_ops = {
31526+static const struct virtio_config_ops lguest_config_ops = {
31527 .get_features = lg_get_features,
31528 .finalize_features = lg_finalize_features,
31529 .get = lg_get,
31530diff -urNp linux-2.6.39/drivers/lguest/x86/core.c linux-2.6.39/drivers/lguest/x86/core.c
31531--- linux-2.6.39/drivers/lguest/x86/core.c 2011-05-19 00:06:34.000000000 -0400
31532+++ linux-2.6.39/drivers/lguest/x86/core.c 2011-05-22 19:36:31.000000000 -0400
bc901d79
MT		 31533@@ -59,7 +59,7 @@ static struct {
31534 /* Offset from where switcher.S was compiled to where we've copied it */
31535 static unsigned long switcher_offset(void)
31536 {
31537- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31538+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31539 }
31540
31541 /* This cpu's struct lguest_pages. */
31542@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
31543 * These copies are pretty cheap, so we do them unconditionally: */
31544 /* Save the current Host top-level page directory.
31545 */
31546+
31547+#ifdef CONFIG_PAX_PER_CPU_PGD
31548+ pages->state.host_cr3 = read_cr3();
31549+#else
31550 pages->state.host_cr3 = __pa(current->mm->pgd);
31551+#endif
31552+
31553 /*
31554 * Set up the Guest's page tables to see this CPU's pages (and no
31555 * other CPU's pages).
31556@@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
31557 * compiled-in switcher code and the high-mapped copy we just made.
31558 */
31559 for (i = 0; i < IDT_ENTRIES; i++)
31560- default_idt_entries[i] += switcher_offset();
31561+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31562
31563 /*
31564 * Set up the Switcher's per-cpu areas.
31565@@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
31566 * it will be undisturbed when we switch. To change %cs and jump we
31567 * need this structure to feed to Intel's "lcall" instruction.
31568 */
31569- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31570+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31571 lguest_entry.segment = LGUEST_CS;
31572
31573 /*
66a7e928
MT		 31574diff -urNp linux-2.6.39/drivers/lguest/x86/switcher_32.S linux-2.6.39/drivers/lguest/x86/switcher_32.S
31575--- linux-2.6.39/drivers/lguest/x86/switcher_32.S 2011-05-19 00:06:34.000000000 -0400
31576+++ linux-2.6.39/drivers/lguest/x86/switcher_32.S 2011-05-22 19:36:31.000000000 -0400
bc901d79
MT		 31577@@ -87,6 +87,7 @@
31578 #include <asm/page.h>
31579 #include <asm/segment.h>
31580 #include <asm/lguest.h>
31581+#include <asm/processor-flags.h>
31582
31583 // We mark the start of the code to copy
31584 // It's placed in .text tho it's never run here
31585@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31586 // Changes type when we load it: damn Intel!
31587 // For after we switch over our page tables
31588 // That entry will be read-only: we'd crash.
31589+
31590+#ifdef CONFIG_PAX_KERNEXEC
31591+ mov %cr0, %edx
31592+ xor $X86_CR0_WP, %edx
31593+ mov %edx, %cr0
31594+#endif
31595+
31596 movl $(GDT_ENTRY_TSS*8), %edx
31597 ltr %dx
31598
31599@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31600 // Let's clear it again for our return.
31601 // The GDT descriptor of the Host
31602 // Points to the table after two "size" bytes
31603- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31604+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31605 // Clear "used" from type field (byte 5, bit 2)
31606- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31607+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31608+
31609+#ifdef CONFIG_PAX_KERNEXEC
31610+ mov %cr0, %eax
31611+ xor $X86_CR0_WP, %eax
31612+ mov %eax, %cr0
31613+#endif
31614
31615 // Once our page table's switched, the Guest is live!
31616 // The Host fades as we run this final step.
31617@@ -295,13 +309,12 @@ deliver_to_host:
31618 // I consulted gcc, and it gave
31619 // These instructions, which I gladly credit:
31620 leal (%edx,%ebx,8), %eax
31621- movzwl (%eax),%edx
31622- movl 4(%eax), %eax
31623- xorw %ax, %ax
31624- orl %eax, %edx
31625+ movl 4(%eax), %edx
31626+ movw (%eax), %dx
31627 // Now the address of the handler's in %edx
31628 // We call it now: its "iret" drops us home.
31629- jmp *%edx
31630+ ljmp $__KERNEL_CS, $1f
31631+1: jmp *%edx
31632
31633 // Every interrupt can come to us here
31634 // But we must truly tell each apart.
66a7e928
MT		 31635diff -urNp linux-2.6.39/drivers/md/dm.c linux-2.6.39/drivers/md/dm.c
31636--- linux-2.6.39/drivers/md/dm.c 2011-05-19 00:06:34.000000000 -0400
31637+++ linux-2.6.39/drivers/md/dm.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31638@@ -162,9 +162,9 @@ struct mapped_device {
31639 /*
31640 * Event handling.
31641 */
31642- atomic_t event_nr;
31643+ atomic_unchecked_t event_nr;
31644 wait_queue_head_t eventq;
31645- atomic_t uevent_seq;
31646+ atomic_unchecked_t uevent_seq;
31647 struct list_head uevent_list;
31648 spinlock_t uevent_lock; /* Protect access to uevent_list */
31649
66a7e928 31650@@ -1836,8 +1836,8 @@ static struct mapped_device *alloc_dev(i
8308f9c9
MT		 31651 rwlock_init(&md->map_lock);
31652 atomic_set(&md->holders, 1);
31653 atomic_set(&md->open_count, 0);
31654- atomic_set(&md->event_nr, 0);
31655- atomic_set(&md->uevent_seq, 0);
31656+ atomic_set_unchecked(&md->event_nr, 0);
31657+ atomic_set_unchecked(&md->uevent_seq, 0);
31658 INIT_LIST_HEAD(&md->uevent_list);
31659 spin_lock_init(&md->uevent_lock);
31660
66a7e928 31661@@ -1971,7 +1971,7 @@ static void event_callback(void *context
8308f9c9
MT		 31662
31663 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31664
31665- atomic_inc(&md->event_nr);
31666+ atomic_inc_unchecked(&md->event_nr);
31667 wake_up(&md->eventq);
31668 }
31669
66a7e928 31670@@ -2547,18 +2547,18 @@ int dm_kobject_uevent(struct mapped_devi
8308f9c9
MT		 31671
31672 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31673 {
31674- return atomic_add_return(1, &md->uevent_seq);
31675+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31676 }
31677
31678 uint32_t dm_get_event_nr(struct mapped_device *md)
31679 {
31680- return atomic_read(&md->event_nr);
31681+ return atomic_read_unchecked(&md->event_nr);
31682 }
31683
31684 int dm_wait_event(struct mapped_device *md, int event_nr)
31685 {
31686 return wait_event_interruptible(md->eventq,
31687- (event_nr != atomic_read(&md->event_nr)));
31688+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31689 }
31690
31691 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
66a7e928
MT		 31692diff -urNp linux-2.6.39/drivers/md/dm-crypt.c linux-2.6.39/drivers/md/dm-crypt.c
31693--- linux-2.6.39/drivers/md/dm-crypt.c 2011-05-19 00:06:34.000000000 -0400
31694+++ linux-2.6.39/drivers/md/dm-crypt.c 2011-05-22 19:36:31.000000000 -0400
31695@@ -138,7 +138,7 @@ struct crypt_config {
31696 char *cipher;
31697 char *cipher_string;
31698
31699- struct crypt_iv_operations *iv_gen_ops;
31700+ const struct crypt_iv_operations *iv_gen_ops;
31701 union {
31702 struct iv_essiv_private essiv;
31703 struct iv_benbi_private benbi;
31704@@ -620,15 +620,15 @@ static int crypt_iv_lmk_post(struct cryp
31705 return r;
31706 }
31707
31708-static struct crypt_iv_operations crypt_iv_plain_ops = {
31709+static const struct crypt_iv_operations crypt_iv_plain_ops = {
31710 .generator = crypt_iv_plain_gen
31711 };
31712
31713-static struct crypt_iv_operations crypt_iv_plain64_ops = {
31714+static const struct crypt_iv_operations crypt_iv_plain64_ops = {
31715 .generator = crypt_iv_plain64_gen
31716 };
31717
31718-static struct crypt_iv_operations crypt_iv_essiv_ops = {
31719+static const struct crypt_iv_operations crypt_iv_essiv_ops = {
31720 .ctr = crypt_iv_essiv_ctr,
31721 .dtr = crypt_iv_essiv_dtr,
31722 .init = crypt_iv_essiv_init,
31723@@ -636,17 +636,17 @@ static struct crypt_iv_operations crypt_
31724 .generator = crypt_iv_essiv_gen
31725 };
31726
31727-static struct crypt_iv_operations crypt_iv_benbi_ops = {
31728+static const struct crypt_iv_operations crypt_iv_benbi_ops = {
31729 .ctr = crypt_iv_benbi_ctr,
31730 .dtr = crypt_iv_benbi_dtr,
31731 .generator = crypt_iv_benbi_gen
31732 };
31733
31734-static struct crypt_iv_operations crypt_iv_null_ops = {
31735+static const struct crypt_iv_operations crypt_iv_null_ops = {
31736 .generator = crypt_iv_null_gen
31737 };
31738
31739-static struct crypt_iv_operations crypt_iv_lmk_ops = {
31740+static const struct crypt_iv_operations crypt_iv_lmk_ops = {
31741 .ctr = crypt_iv_lmk_ctr,
31742 .dtr = crypt_iv_lmk_dtr,
31743 .init = crypt_iv_lmk_init,
31744diff -urNp linux-2.6.39/drivers/md/dm-ioctl.c linux-2.6.39/drivers/md/dm-ioctl.c
31745--- linux-2.6.39/drivers/md/dm-ioctl.c 2011-05-19 00:06:34.000000000 -0400
31746+++ linux-2.6.39/drivers/md/dm-ioctl.c 2011-05-22 19:36:31.000000000 -0400
31747@@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
16454cff
MT		 31748 cmd == DM_LIST_VERSIONS_CMD)
31749 return 0;
31750
31751- if ((cmd == DM_DEV_CREATE_CMD)) {
31752+ if (cmd == DM_DEV_CREATE_CMD) {
31753 if (!*param->name) {
31754 DMWARN("name not supplied when creating device");
31755 return -EINVAL;
66a7e928
MT		 31756diff -urNp linux-2.6.39/drivers/md/dm-raid1.c linux-2.6.39/drivers/md/dm-raid1.c
31757--- linux-2.6.39/drivers/md/dm-raid1.c 2011-05-19 00:06:34.000000000 -0400
31758+++ linux-2.6.39/drivers/md/dm-raid1.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31759@@ -42,7 +42,7 @@ enum dm_raid1_error {
31760
31761 struct mirror {
31762 struct mirror_set *ms;
31763- atomic_t error_count;
31764+ atomic_unchecked_t error_count;
31765 unsigned long error_type;
31766 struct dm_dev *dev;
31767 sector_t offset;
31768@@ -187,7 +187,7 @@ static struct mirror *get_valid_mirror(s
31769 struct mirror *m;
31770
31771 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31772- if (!atomic_read(&m->error_count))
31773+ if (!atomic_read_unchecked(&m->error_count))
31774 return m;
31775
31776 return NULL;
31777@@ -219,7 +219,7 @@ static void fail_mirror(struct mirror *m
31778 * simple way to tell if a device has encountered
31779 * errors.
31780 */
31781- atomic_inc(&m->error_count);
31782+ atomic_inc_unchecked(&m->error_count);
31783
31784 if (test_and_set_bit(error_type, &m->error_type))
31785 return;
31786@@ -410,7 +410,7 @@ static struct mirror *choose_mirror(stru
31787 struct mirror *m = get_default_mirror(ms);
31788
31789 do {
31790- if (likely(!atomic_read(&m->error_count)))
31791+ if (likely(!atomic_read_unchecked(&m->error_count)))
31792 return m;
31793
31794 if (m-- == ms->mirror)
31795@@ -424,7 +424,7 @@ static int default_ok(struct mirror *m)
31796 {
31797 struct mirror *default_mirror = get_default_mirror(m->ms);
31798
31799- return !atomic_read(&default_mirror->error_count);
31800+ return !atomic_read_unchecked(&default_mirror->error_count);
31801 }
31802
31803 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31804@@ -561,7 +561,7 @@ static void do_reads(struct mirror_set *
31805 */
31806 if (likely(region_in_sync(ms, region, 1)))
31807 m = choose_mirror(ms, bio->bi_sector);
31808- else if (m && atomic_read(&m->error_count))
31809+ else if (m && atomic_read_unchecked(&m->error_count))
31810 m = NULL;
31811
31812 if (likely(m))
66a7e928 31813@@ -939,7 +939,7 @@ static int get_mirror(struct mirror_set
8308f9c9
MT		 31814 }
31815
31816 ms->mirror[mirror].ms = ms;
31817- atomic_set(&(ms->mirror[mirror].error_count), 0);
31818+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31819 ms->mirror[mirror].error_type = 0;
31820 ms->mirror[mirror].offset = offset;
31821
66a7e928 31822@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
8308f9c9
MT		 31823 */
31824 static char device_status_char(struct mirror *m)
31825 {
31826- if (!atomic_read(&(m->error_count)))
31827+ if (!atomic_read_unchecked(&(m->error_count)))
31828 return 'A';
31829
31830 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
66a7e928
MT		 31831diff -urNp linux-2.6.39/drivers/md/dm-stripe.c linux-2.6.39/drivers/md/dm-stripe.c
31832--- linux-2.6.39/drivers/md/dm-stripe.c 2011-05-19 00:06:34.000000000 -0400
31833+++ linux-2.6.39/drivers/md/dm-stripe.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31834@@ -20,7 +20,7 @@ struct stripe {
31835 struct dm_dev *dev;
31836 sector_t physical_start;
31837
31838- atomic_t error_count;
31839+ atomic_unchecked_t error_count;
31840 };
31841
31842 struct stripe_c {
31843@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
31844 kfree(sc);
31845 return r;
31846 }
31847- atomic_set(&(sc->stripe[i].error_count), 0);
31848+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31849 }
31850
31851 ti->private = sc;
31852@@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
31853 DMEMIT("%d ", sc->stripes);
31854 for (i = 0; i < sc->stripes; i++) {
31855 DMEMIT("%s ", sc->stripe[i].dev->name);
31856- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31857+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31858 'D' : 'A';
31859 }
31860 buffer[i] = '\0';
31861@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
31862 */
31863 for (i = 0; i < sc->stripes; i++)
31864 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31865- atomic_inc(&(sc->stripe[i].error_count));
31866- if (atomic_read(&(sc->stripe[i].error_count)) <
31867+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31868+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31869 DM_IO_ERROR_THRESHOLD)
31870 schedule_work(&sc->trigger_event);
31871 }
66a7e928
MT		 31872diff -urNp linux-2.6.39/drivers/md/dm-table.c linux-2.6.39/drivers/md/dm-table.c
31873--- linux-2.6.39/drivers/md/dm-table.c 2011-05-19 00:06:34.000000000 -0400
31874+++ linux-2.6.39/drivers/md/dm-table.c 2011-05-22 19:36:31.000000000 -0400
31875@@ -373,7 +373,7 @@ static int device_area_is_invalid(struct
58c5fc13
MT		 31876 if (!dev_size)
31877 return 0;
31878
31879- if ((start >= dev_size) || (start + len > dev_size)) {
31880+ if ((start >= dev_size) || (len > dev_size - start)) {
31881 DMWARN("%s: %s too small for target: "
31882 "start=%llu, len=%llu, dev_size=%llu",
31883 dm_device_name(ti->table->md), bdevname(bdev, b),
66a7e928
MT		 31884diff -urNp linux-2.6.39/drivers/md/md.c linux-2.6.39/drivers/md/md.c
31885--- linux-2.6.39/drivers/md/md.c 2011-05-19 00:06:34.000000000 -0400
31886+++ linux-2.6.39/drivers/md/md.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 31887@@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
31888 * start build, activate spare
31889 */
31890 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31891-static atomic_t md_event_count;
31892+static atomic_unchecked_t md_event_count;
31893 void md_new_event(mddev_t *mddev)
31894 {
31895- atomic_inc(&md_event_count);
31896+ atomic_inc_unchecked(&md_event_count);
31897 wake_up(&md_event_waiters);
31898 }
31899 EXPORT_SYMBOL_GPL(md_new_event);
31900@@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31901 */
31902 static void md_new_event_inintr(mddev_t *mddev)
31903 {
31904- atomic_inc(&md_event_count);
31905+ atomic_inc_unchecked(&md_event_count);
31906 wake_up(&md_event_waiters);
31907 }
31908
66a7e928 31909@@ -1454,7 +1454,7 @@ static int super_1_load(mdk_rdev_t *rdev
8308f9c9
MT		 31910
31911 rdev->preferred_minor = 0xffff;
31912 rdev->data_offset = le64_to_cpu(sb->data_offset);
31913- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31914+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31915
31916 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31917 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
66a7e928 31918@@ -1632,7 +1632,7 @@ static void super_1_sync(mddev_t *mddev,
8308f9c9
MT		 31919 else
31920 sb->resync_offset = cpu_to_le64(0);
31921
31922- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31923+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31924
31925 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31926 sb->size = cpu_to_le64(mddev->dev_sectors);
66a7e928 31927@@ -2414,7 +2414,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
8308f9c9
MT		 31928 static ssize_t
31929 errors_show(mdk_rdev_t *rdev, char *page)
31930 {
31931- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31932+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31933 }
31934
31935 static ssize_t
66a7e928 31936@@ -2423,7 +2423,7 @@ errors_store(mdk_rdev_t *rdev, const cha
8308f9c9
MT		 31937 char *e;
31938 unsigned long n = simple_strtoul(buf, &e, 10);
31939 if (*buf && (*e == 0 || *e == '\n')) {
31940- atomic_set(&rdev->corrected_errors, n);
31941+ atomic_set_unchecked(&rdev->corrected_errors, n);
31942 return len;
31943 }
31944 return -EINVAL;
66a7e928 31945@@ -2779,8 +2779,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
8308f9c9
MT		 31946 rdev->last_read_error.tv_sec = 0;
31947 rdev->last_read_error.tv_nsec = 0;
31948 atomic_set(&rdev->nr_pending, 0);
31949- atomic_set(&rdev->read_errors, 0);
31950- atomic_set(&rdev->corrected_errors, 0);
31951+ atomic_set_unchecked(&rdev->read_errors, 0);
31952+ atomic_set_unchecked(&rdev->corrected_errors, 0);
31953
31954 INIT_LIST_HEAD(&rdev->same_set);
31955 init_waitqueue_head(&rdev->blocked_wait);
66a7e928 31956@@ -6383,7 +6383,7 @@ static int md_seq_show(struct seq_file *
8308f9c9
MT		 31957
31958 spin_unlock(&pers_lock);
31959 seq_printf(seq, "\n");
31960- mi->event = atomic_read(&md_event_count);
31961+ mi->event = atomic_read_unchecked(&md_event_count);
31962 return 0;
31963 }
31964 if (v == (void*)2) {
66a7e928 31965@@ -6472,7 +6472,7 @@ static int md_seq_show(struct seq_file *
58c5fc13
MT		 31966 chunk_kb ? "KB" : "B");
31967 if (bitmap->file) {
31968 seq_printf(seq, ", file: ");
31969- seq_path(seq, &bitmap->file->f_path, " \t\n");
31970+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31971 }
31972
31973 seq_printf(seq, "\n");
66a7e928 31974@@ -6506,7 +6506,7 @@ static int md_seq_open(struct inode *ino
8308f9c9
MT		 31975 else {
31976 struct seq_file *p = file->private_data;
31977 p->private = mi;
31978- mi->event = atomic_read(&md_event_count);
31979+ mi->event = atomic_read_unchecked(&md_event_count);
31980 }
31981 return error;
31982 }
66a7e928 31983@@ -6522,7 +6522,7 @@ static unsigned int mdstat_poll(struct f
8308f9c9
MT		 31984 /* always allow read */
31985 mask = POLLIN | POLLRDNORM;
31986
31987- if (mi->event != atomic_read(&md_event_count))
31988+ if (mi->event != atomic_read_unchecked(&md_event_count))
31989 mask |= POLLERR | POLLPRI;
31990 return mask;
31991 }
66a7e928 31992@@ -6566,7 +6566,7 @@ static int is_mddev_idle(mddev_t *mddev,
58c5fc13
MT		 31993 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
31994 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
31995 (int)part_stat_read(&disk->part0, sectors[1]) -
31996- atomic_read(&disk->sync_io);
31997+ atomic_read_unchecked(&disk->sync_io);
31998 /* sync IO will cause sync_io to increase before the disk_stats
31999 * as sync_io is counted when a request starts, and
32000 * disk_stats is counted when it completes.
66a7e928
MT		 32001diff -urNp linux-2.6.39/drivers/md/md.h linux-2.6.39/drivers/md/md.h
32002--- linux-2.6.39/drivers/md/md.h 2011-05-19 00:06:34.000000000 -0400
32003+++ linux-2.6.39/drivers/md/md.h 2011-05-22 19:36:31.000000000 -0400
32004@@ -97,13 +97,13 @@ struct mdk_rdev_s
8308f9c9
MT		 32005 * only maintained for arrays that
32006 * support hot removal
32007 */
32008- atomic_t read_errors; /* number of consecutive read errors that
32009+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
32010 * we have tried to ignore.
32011 */
32012 struct timespec last_read_error; /* monotonic time since our
32013 * last read error
32014 */
32015- atomic_t corrected_errors; /* number of corrected read errors,
32016+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
32017 * for reporting to userspace and storing
32018 * in superblock.
32019 */
66a7e928 32020@@ -342,7 +342,7 @@ static inline void rdev_dec_pending(mdk_
58c5fc13
MT		 32021
32022 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
32023 {
32024- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32025+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32026 }
32027
32028 struct mdk_personality
66a7e928
MT		 32029diff -urNp linux-2.6.39/drivers/md/raid10.c linux-2.6.39/drivers/md/raid10.c
32030--- linux-2.6.39/drivers/md/raid10.c 2011-05-19 00:06:34.000000000 -0400
32031+++ linux-2.6.39/drivers/md/raid10.c 2011-05-22 19:36:31.000000000 -0400
32032@@ -1209,7 +1209,7 @@ static void end_sync_read(struct bio *bi
8308f9c9
MT		 32033 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
32034 set_bit(R10BIO_Uptodate, &r10_bio->state);
32035 else {
32036- atomic_add(r10_bio->sectors,
32037+ atomic_add_unchecked(r10_bio->sectors,
32038 &conf->mirrors[d].rdev->corrected_errors);
32039 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
32040 md_error(r10_bio->mddev,
66a7e928 32041@@ -1417,7 +1417,7 @@ static void check_decay_read_errors(mdde
8308f9c9
MT		 32042 {
32043 struct timespec cur_time_mon;
32044 unsigned long hours_since_last;
32045- unsigned int read_errors = atomic_read(&rdev->read_errors);
32046+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
32047
32048 ktime_get_ts(&cur_time_mon);
32049
66a7e928 32050@@ -1439,9 +1439,9 @@ static void check_decay_read_errors(mdde
8308f9c9
MT		 32051 * overflowing the shift of read_errors by hours_since_last.
32052 */
32053 if (hours_since_last >= 8 * sizeof(read_errors))
32054- atomic_set(&rdev->read_errors, 0);
32055+ atomic_set_unchecked(&rdev->read_errors, 0);
32056 else
32057- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
32058+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
32059 }
32060
32061 /*
66a7e928 32062@@ -1476,8 +1476,8 @@ static void fix_read_error(conf_t *conf,
8308f9c9
MT		 32063 }
32064
32065 check_decay_read_errors(mddev, rdev);
32066- atomic_inc(&rdev->read_errors);
32067- cur_read_error_count = atomic_read(&rdev->read_errors);
32068+ atomic_inc_unchecked(&rdev->read_errors);
32069+ cur_read_error_count = atomic_read_unchecked(&rdev->read_errors);
32070 if (cur_read_error_count > max_read_errors) {
32071 rcu_read_unlock();
32072 printk(KERN_NOTICE
66a7e928 32073@@ -1550,7 +1550,7 @@ static void fix_read_error(conf_t *conf,
8308f9c9
MT		 32074 test_bit(In_sync, &rdev->flags)) {
32075 atomic_inc(&rdev->nr_pending);
32076 rcu_read_unlock();
32077- atomic_add(s, &rdev->corrected_errors);
32078+ atomic_add_unchecked(s, &rdev->corrected_errors);
32079 if (sync_page_io(rdev,
32080 r10_bio->devs[sl].addr +
32081 sect,
66a7e928
MT		 32082diff -urNp linux-2.6.39/drivers/md/raid1.c linux-2.6.39/drivers/md/raid1.c
32083--- linux-2.6.39/drivers/md/raid1.c 2011-05-19 00:06:34.000000000 -0400
32084+++ linux-2.6.39/drivers/md/raid1.c 2011-05-22 19:36:31.000000000 -0400
32085@@ -1342,7 +1342,7 @@ static void sync_request_write(mddev_t *
8308f9c9
MT		 32086 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
32087 continue;
32088 rdev = conf->mirrors[d].rdev;
32089- atomic_add(s, &rdev->corrected_errors);
32090+ atomic_add_unchecked(s, &rdev->corrected_errors);
32091 if (sync_page_io(rdev,
32092 sect,
32093 s<<9,
66a7e928 32094@@ -1488,7 +1488,7 @@ static void fix_read_error(conf_t *conf,
8308f9c9
MT		 32095 /* Well, this device is dead */
32096 md_error(mddev, rdev);
32097 else {
32098- atomic_add(s, &rdev->corrected_errors);
32099+ atomic_add_unchecked(s, &rdev->corrected_errors);
32100 printk(KERN_INFO
32101 "md/raid1:%s: read error corrected "
32102 "(%d sectors at %llu on %s)\n",
66a7e928
MT		 32103diff -urNp linux-2.6.39/drivers/md/raid5.c linux-2.6.39/drivers/md/raid5.c
32104--- linux-2.6.39/drivers/md/raid5.c 2011-05-19 00:06:34.000000000 -0400
32105+++ linux-2.6.39/drivers/md/raid5.c 2011-05-22 19:36:31.000000000 -0400
32106@@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
8308f9c9
MT		 32107 bi->bi_next = NULL;
32108 if (rw == WRITE &&
32109 test_bit(R5_ReWrite, &sh->dev[i].flags))
32110- atomic_add(STRIPE_SECTORS,
32111+ atomic_add_unchecked(STRIPE_SECTORS,
32112 &rdev->corrected_errors);
32113 generic_make_request(bi);
32114 } else {
66a7e928 32115@@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
8308f9c9
MT		 32116 clear_bit(R5_ReadError, &sh->dev[i].flags);
32117 clear_bit(R5_ReWrite, &sh->dev[i].flags);
32118 }
32119- if (atomic_read(&conf->disks[i].rdev->read_errors))
32120- atomic_set(&conf->disks[i].rdev->read_errors, 0);
32121+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
32122+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
32123 } else {
32124 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
32125 int retry = 0;
32126 rdev = conf->disks[i].rdev;
32127
32128 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
32129- atomic_inc(&rdev->read_errors);
32130+ atomic_inc_unchecked(&rdev->read_errors);
32131 if (conf->mddev->degraded >= conf->max_degraded)
32132 printk_rl(KERN_WARNING
32133 "md/raid:%s: read error not correctable "
66a7e928 32134@@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
8308f9c9
MT		 32135 (unsigned long long)(sh->sector
32136 + rdev->data_offset),
32137 bdn);
32138- else if (atomic_read(&rdev->read_errors)
32139+ else if (atomic_read_unchecked(&rdev->read_errors)
32140 > conf->max_nr_stripes)
32141 printk(KERN_WARNING
32142 "md/raid:%s: Too many read errors, failing device %s.\n",
66a7e928
MT		 32143@@ -1947,6 +1947,7 @@ static sector_t compute_blocknr(struct s
32144 sector_t r_sector;
32145 struct stripe_head sh2;
32146
32147+ pax_track_stack();
32148
32149 chunk_offset = sector_div(new_sector, sectors_per_chunk);
32150 stripe = new_sector;
32151diff -urNp linux-2.6.39/drivers/media/common/saa7146_hlp.c linux-2.6.39/drivers/media/common/saa7146_hlp.c
32152--- linux-2.6.39/drivers/media/common/saa7146_hlp.c 2011-05-19 00:06:34.000000000 -0400
32153+++ linux-2.6.39/drivers/media/common/saa7146_hlp.c 2011-05-22 19:36:31.000000000 -0400
32154@@ -353,6 +353,8 @@ static void calculate_clipping_registers
32155
32156 int x[32], y[32], w[32], h[32];
32157
32158+ pax_track_stack();
32159+
32160 /* clear out memory */
32161 memset(&line_list[0], 0x00, sizeof(u32)*32);
32162 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
32163diff -urNp linux-2.6.39/drivers/media/common/saa7146_vbi.c linux-2.6.39/drivers/media/common/saa7146_vbi.c
32164--- linux-2.6.39/drivers/media/common/saa7146_vbi.c 2011-05-19 00:06:34.000000000 -0400
32165+++ linux-2.6.39/drivers/media/common/saa7146_vbi.c 2011-05-22 19:36:31.000000000 -0400
32166@@ -501,7 +501,7 @@ static ssize_t vbi_read(struct file *fil
32167 return ret;
32168 }
32169
32170-struct saa7146_use_ops saa7146_vbi_uops = {
32171+const struct saa7146_use_ops saa7146_vbi_uops = {
32172 .init = vbi_init,
32173 .open = vbi_open,
32174 .release = vbi_close,
32175diff -urNp linux-2.6.39/drivers/media/common/saa7146_video.c linux-2.6.39/drivers/media/common/saa7146_video.c
32176--- linux-2.6.39/drivers/media/common/saa7146_video.c 2011-05-19 00:06:34.000000000 -0400
32177+++ linux-2.6.39/drivers/media/common/saa7146_video.c 2011-05-22 19:36:31.000000000 -0400
32178@@ -1420,7 +1420,7 @@ out:
32179 return ret;
32180 }
32181
32182-struct saa7146_use_ops saa7146_video_uops = {
32183+const struct saa7146_use_ops saa7146_video_uops = {
32184 .init = video_init,
32185 .open = video_open,
32186 .release = video_close,
32187diff -urNp linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c
32188--- linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c 2011-05-19 00:06:34.000000000 -0400
32189+++ linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c 2011-05-22 19:36:31.000000000 -0400
32190@@ -418,7 +418,7 @@ static u32 functionality(struct i2c_adap
32191 return I2C_FUNC_I2C;
32192 }
32193
32194-static struct i2c_algorithm dm1105_algo = {
32195+static const struct i2c_algorithm dm1105_algo = {
32196 .master_xfer = dm1105_i2c_xfer,
32197 .functionality = functionality,
32198 };
32199diff -urNp linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
32200--- linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-19 00:06:34.000000000 -0400
32201+++ linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-22 19:36:31.000000000 -0400
32202@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
32203 u8 buf[HOST_LINK_BUF_SIZE];
32204 int i;
32205
32206+ pax_track_stack();
32207+
32208 dprintk("%s\n", __func__);
32209
32210 /* check if we have space for a link buf in the rx_buffer */
32211@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
32212 unsigned long timeout;
32213 int written;
32214
32215+ pax_track_stack();
32216+
32217 dprintk("%s\n", __func__);
32218
32219 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
32220diff -urNp linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c
32221--- linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-19 00:06:34.000000000 -0400
32222+++ linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-22 19:36:31.000000000 -0400
16454cff 32223@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
ae4e228f
MT		 32224 const struct dvb_device *template, void *priv, int type)
32225 {
32226 struct dvb_device *dvbdev;
16454cff
MT		 32227- struct file_operations *dvbdevfops;
32228+ struct file_operations *dvbdevfops; /* cannot be const, see this function */
ae4e228f
MT		 32229 struct device *clsdev;
32230 int minor;
16454cff 32231 int id;
66a7e928
MT		 32232diff -urNp linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c
32233--- linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-19 00:06:34.000000000 -0400
32234+++ linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-22 19:36:31.000000000 -0400
32235@@ -391,6 +391,8 @@ int dib0700_download_firmware(struct usb
32236
32237 u8 buf[260];
32238
32239+ pax_track_stack();
32240+
32241 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
32242 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
32243 hx.addr, hx.len, hx.chk);
32244diff -urNp linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c
32245--- linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-19 00:06:34.000000000 -0400
32246+++ linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-22 19:36:31.000000000 -0400
32247@@ -663,6 +663,7 @@ static int lme2510_download_firmware(str
32248 packet_size = 0x31;
32249 len_in = 1;
32250
32251+ pax_track_stack();
32252
32253 info("FRM Starting Firmware Download");
32254
32255@@ -715,6 +716,8 @@ static void lme_coldreset(struct usb_dev
32256 int ret = 0, len_in;
32257 u8 data[512] = {0};
32258
32259+ pax_track_stack();
32260+
32261 data[0] = 0x0a;
32262 len_in = 1;
32263 info("FRM Firmware Cold Reset");
32264diff -urNp linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c
32265--- linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c 2011-05-19 00:06:34.000000000 -0400
32266+++ linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c 2011-05-22 19:36:31.000000000 -0400
32267@@ -1913,7 +1913,7 @@ static u32 dib7000p_i2c_func(struct i2c_
32268 return I2C_FUNC_I2C;
32269 }
32270
32271-static struct i2c_algorithm dib7090_tuner_xfer_algo = {
32272+static const struct i2c_algorithm dib7090_tuner_xfer_algo = {
32273 .master_xfer = dib7090_tuner_xfer,
32274 .functionality = dib7000p_i2c_func,
32275 };
32276diff -urNp linux-2.6.39/drivers/media/dvb/frontends/dib9000.c linux-2.6.39/drivers/media/dvb/frontends/dib9000.c
32277--- linux-2.6.39/drivers/media/dvb/frontends/dib9000.c 2011-05-19 00:06:34.000000000 -0400
32278+++ linux-2.6.39/drivers/media/dvb/frontends/dib9000.c 2011-05-22 19:36:31.000000000 -0400
32279@@ -1649,12 +1649,12 @@ static u32 dib9000_i2c_func(struct i2c_a
32280 return I2C_FUNC_I2C;
32281 }
32282
32283-static struct i2c_algorithm dib9000_tuner_algo = {
32284+static const struct i2c_algorithm dib9000_tuner_algo = {
32285 .master_xfer = dib9000_tuner_xfer,
32286 .functionality = dib9000_i2c_func,
32287 };
32288
32289-static struct i2c_algorithm dib9000_component_bus_algo = {
32290+static const struct i2c_algorithm dib9000_component_bus_algo = {
32291 .master_xfer = dib9000_fw_component_bus_xfer,
32292 .functionality = dib9000_i2c_func,
32293 };
32294diff -urNp linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c
32295--- linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c 2011-05-19 00:06:34.000000000 -0400
32296+++ linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c 2011-05-22 19:36:31.000000000 -0400
32297@@ -212,12 +212,12 @@ static int dibx000_i2c_master_xfer_gpio3
32298 return num;
32299 }
32300
32301-static struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32302+static const struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32303 .master_xfer = dibx000_i2c_master_xfer_gpio12,
32304 .functionality = dibx000_i2c_func,
32305 };
32306
32307-static struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32308+static const struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32309 .master_xfer = dibx000_i2c_master_xfer_gpio34,
32310 .functionality = dibx000_i2c_func,
32311 };
32312@@ -270,7 +270,7 @@ static int dibx000_i2c_gated_gpio67_xfer
32313 return i2c_transfer(mst->i2c_adap, m, 2 + num) == 2 + num ? num : -EIO;
32314 }
32315
32316-static struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32317+static const struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32318 .master_xfer = dibx000_i2c_gated_gpio67_xfer,
32319 .functionality = dibx000_i2c_func,
32320 };
32321@@ -301,7 +301,7 @@ static int dibx000_i2c_gated_tuner_xfer(
32322 return i2c_transfer(mst->i2c_adap, m, 2 + num) == 2 + num ? num : -EIO;
32323 }
32324
32325-static struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32326+static const struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32327 .master_xfer = dibx000_i2c_gated_tuner_xfer,
32328 .functionality = dibx000_i2c_func,
32329 };
32330@@ -354,7 +354,7 @@ void dibx000_reset_i2c_master(struct dib
32331 EXPORT_SYMBOL(dibx000_reset_i2c_master);
32332
32333 static int i2c_adapter_init(struct i2c_adapter *i2c_adap,
32334- struct i2c_algorithm *algo, const char *name,
32335+ const struct i2c_algorithm *algo, const char *name,
32336 struct dibx000_i2c_master *mst)
32337 {
32338 strncpy(i2c_adap->name, name, sizeof(i2c_adap->name));
32339diff -urNp linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c
32340--- linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c 2011-05-19 00:06:34.000000000 -0400
32341+++ linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c 2011-05-22 19:36:31.000000000 -0400
32342@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
32343 int ret = -1;
32344 int sync;
32345
32346+ pax_track_stack();
32347+
32348 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
32349
32350 fcp = 3000;
32351diff -urNp linux-2.6.39/drivers/media/dvb/frontends/or51211.c linux-2.6.39/drivers/media/dvb/frontends/or51211.c
32352--- linux-2.6.39/drivers/media/dvb/frontends/or51211.c 2011-05-19 00:06:34.000000000 -0400
32353+++ linux-2.6.39/drivers/media/dvb/frontends/or51211.c 2011-05-22 19:36:31.000000000 -0400
32354@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
32355 u8 tudata[585];
32356 int i;
32357
32358+ pax_track_stack();
32359+
32360 dprintk("Firmware is %zd bytes\n",fw->size);
32361
32362 /* Get eprom data */
32363diff -urNp linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c
32364--- linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c 2011-05-19 00:06:34.000000000 -0400
32365+++ linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c 2011-05-22 19:36:31.000000000 -0400
32366@@ -870,7 +870,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(
32367 return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
32368 }
32369
32370-static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32371+static const struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32372 .master_xfer = s5h1420_tuner_i2c_tuner_xfer,
32373 .functionality = s5h1420_tuner_i2c_func,
32374 };
32375diff -urNp linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c
32376--- linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-19 00:06:34.000000000 -0400
32377+++ linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-22 19:36:31.000000000 -0400
32378@@ -212,7 +212,7 @@ static u32 mantis_i2c_func(struct i2c_ad
32379 return I2C_FUNC_SMBUS_EMUL;
32380 }
32381
32382-static struct i2c_algorithm mantis_algo = {
32383+static const struct i2c_algorithm mantis_algo = {
32384 .master_xfer = mantis_i2c_xfer,
32385 .functionality = mantis_i2c_func,
32386 };
32387diff -urNp linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c
32388--- linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-19 00:06:34.000000000 -0400
32389+++ linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-22 19:36:31.000000000 -0400
32390@@ -1614,7 +1614,7 @@ static int fe_send_command(struct dvb_fr
32391 return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
32392 }
32393
32394-static struct ttusbdecfe_config fe_config = {
32395+static const struct ttusbdecfe_config fe_config = {
32396 .send_command = fe_send_command
32397 };
32398
32399diff -urNp linux-2.6.39/drivers/media/radio/radio-cadet.c linux-2.6.39/drivers/media/radio/radio-cadet.c
32400--- linux-2.6.39/drivers/media/radio/radio-cadet.c 2011-05-19 00:06:34.000000000 -0400
32401+++ linux-2.6.39/drivers/media/radio/radio-cadet.c 2011-05-22 19:36:31.000000000 -0400
16454cff
MT		 32402@@ -349,7 +349,7 @@ static ssize_t cadet_read(struct file *f
32403 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
32404 mutex_unlock(&dev->lock);
32405
32406- if (copy_to_user(data, readbuf, i))
32407+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
32408 return -EFAULT;
32409 return i;
32410 }
66a7e928
MT		 32411diff -urNp linux-2.6.39/drivers/media/radio/radio-si4713.c linux-2.6.39/drivers/media/radio/radio-si4713.c
32412--- linux-2.6.39/drivers/media/radio/radio-si4713.c 2011-05-19 00:06:34.000000000 -0400
32413+++ linux-2.6.39/drivers/media/radio/radio-si4713.c 2011-05-22 19:36:31.000000000 -0400
32414@@ -231,7 +231,7 @@ static long radio_si4713_default(struct
32415 ioctl, cmd, arg);
32416 }
32417
32418-static struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32419+static const struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32420 .vidioc_enumaudout = radio_si4713_enumaudout,
32421 .vidioc_g_audout = radio_si4713_g_audout,
32422 .vidioc_s_audout = radio_si4713_s_audout,
32423diff -urNp linux-2.6.39/drivers/media/rc/ir-lirc-codec.c linux-2.6.39/drivers/media/rc/ir-lirc-codec.c
32424--- linux-2.6.39/drivers/media/rc/ir-lirc-codec.c 2011-05-19 00:06:34.000000000 -0400
32425+++ linux-2.6.39/drivers/media/rc/ir-lirc-codec.c 2011-05-22 19:36:31.000000000 -0400
16454cff 32426@@ -277,7 +277,7 @@ static void ir_lirc_close(void *data)
bc901d79
MT		 32427 return;
32428 }
32429
32430-static struct file_operations lirc_fops = {
32431+static const struct file_operations lirc_fops = {
32432 .owner = THIS_MODULE,
32433 .write = ir_lirc_transmit_ir,
32434 .unlocked_ioctl = ir_lirc_ioctl,
66a7e928
MT		 32435diff -urNp linux-2.6.39/drivers/media/rc/lirc_dev.c linux-2.6.39/drivers/media/rc/lirc_dev.c
32436--- linux-2.6.39/drivers/media/rc/lirc_dev.c 2011-05-19 00:06:34.000000000 -0400
32437+++ linux-2.6.39/drivers/media/rc/lirc_dev.c 2011-05-22 19:36:31.000000000 -0400
bc901d79 32438@@ -151,7 +151,7 @@ static int lirc_thread(void *irctl)
6892158b
MT		 32439 }
32440
32441
bc901d79
MT		 32442-static struct file_operations lirc_dev_fops = {
32443+static const struct file_operations lirc_dev_fops = {
6892158b
MT		 32444 .owner = THIS_MODULE,
32445 .read = lirc_dev_fop_read,
32446 .write = lirc_dev_fop_write,
66a7e928
MT		 32447diff -urNp linux-2.6.39/drivers/media/rc/rc-main.c linux-2.6.39/drivers/media/rc/rc-main.c
32448--- linux-2.6.39/drivers/media/rc/rc-main.c 2011-05-19 00:06:34.000000000 -0400
32449+++ linux-2.6.39/drivers/media/rc/rc-main.c 2011-05-22 19:36:31.000000000 -0400
32450@@ -996,7 +996,7 @@ EXPORT_SYMBOL_GPL(rc_free_device);
8308f9c9
MT		 32451
32452 int rc_register_device(struct rc_dev *dev)
32453 {
32454- static atomic_t devno = ATOMIC_INIT(0);
32455+ static atomic_unchecked_t devno = ATOMIC_INIT(0);
32456 struct rc_map *rc_map;
32457 const char *path;
32458 int rc;
66a7e928 32459@@ -1019,7 +1019,7 @@ int rc_register_device(struct rc_dev *de
8308f9c9
MT		 32460 if (dev->close)
32461 dev->input_dev->close = ir_close;
32462
32463- dev->devno = (unsigned long)(atomic_inc_return(&devno) - 1);
32464+ dev->devno = (unsigned long)(atomic_inc_return_unchecked(&devno) - 1);
32465 dev_set_name(&dev->dev, "rc%ld", dev->devno);
32466 dev_set_drvdata(&dev->dev, dev);
32467 rc = device_add(&dev->dev);
66a7e928
MT		 32468diff -urNp linux-2.6.39/drivers/media/video/au0828/au0828.h linux-2.6.39/drivers/media/video/au0828/au0828.h
32469--- linux-2.6.39/drivers/media/video/au0828/au0828.h 2011-05-19 00:06:34.000000000 -0400
32470+++ linux-2.6.39/drivers/media/video/au0828/au0828.h 2011-05-22 19:36:31.000000000 -0400
32471@@ -191,7 +191,7 @@ struct au0828_dev {
32472
32473 /* I2C */
32474 struct i2c_adapter i2c_adap;
32475- struct i2c_algorithm i2c_algo;
32476+ struct i2c_algorithm i2c_algo;
32477 struct i2c_client i2c_client;
32478 u32 i2c_rc;
32479
32480diff -urNp linux-2.6.39/drivers/media/video/cafe_ccic.c linux-2.6.39/drivers/media/video/cafe_ccic.c
32481--- linux-2.6.39/drivers/media/video/cafe_ccic.c 2011-05-19 00:06:34.000000000 -0400
32482+++ linux-2.6.39/drivers/media/video/cafe_ccic.c 2011-05-22 19:36:31.000000000 -0400
32483@@ -520,7 +520,7 @@ static u32 cafe_smbus_func(struct i2c_ad
32484 I2C_FUNC_SMBUS_WRITE_BYTE_DATA;
32485 }
32486
32487-static struct i2c_algorithm cafe_smbus_algo = {
32488+static const struct i2c_algorithm cafe_smbus_algo = {
32489 .smbus_xfer = cafe_smbus_xfer,
32490 .functionality = cafe_smbus_func
32491 };
32492diff -urNp linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c
32493--- linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-19 00:06:34.000000000 -0400
32494+++ linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-22 19:36:31.000000000 -0400
32495@@ -314,7 +314,7 @@ static struct page *snd_pcm_get_vmalloc_
32496 return vmalloc_to_page(pageptr);
32497 }
32498
32499-static struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32500+static const struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32501 .open = snd_cx18_pcm_capture_open,
32502 .close = snd_cx18_pcm_capture_close,
32503 .ioctl = snd_cx18_pcm_ioctl,
32504diff -urNp linux-2.6.39/drivers/media/video/cx18/cx18-driver.c linux-2.6.39/drivers/media/video/cx18/cx18-driver.c
32505--- linux-2.6.39/drivers/media/video/cx18/cx18-driver.c 2011-05-19 00:06:34.000000000 -0400
32506+++ linux-2.6.39/drivers/media/video/cx18/cx18-driver.c 2011-05-22 19:36:31.000000000 -0400
32507@@ -61,7 +61,7 @@ static struct pci_device_id cx18_pci_tbl
8308f9c9
MT		 32508
32509 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
32510
32511-static atomic_t cx18_instance = ATOMIC_INIT(0);
32512+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
32513
32514 /* Parameter declarations */
32515 static int cardtype[CX18_MAX_CARDS];
66a7e928
MT		 32516@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
32517 struct i2c_client c;
32518 u8 eedata[256];
32519
32520+ pax_track_stack();
32521+
32522 memset(&c, 0, sizeof(c));
32523 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32524 c.adapter = &cx->i2c_adap[0];
32525@@ -892,7 +894,7 @@ static int __devinit cx18_probe(struct p
8308f9c9
MT		 32526 struct cx18 *cx;
32527
32528 /* FIXME - module parameter arrays constrain max instances */
32529- i = atomic_inc_return(&cx18_instance) - 1;
32530+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
32531 if (i >= CX18_MAX_CARDS) {
32532 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
32533 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
66a7e928
MT		 32534diff -urNp linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c
32535--- linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32536+++ linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32537@@ -613,7 +613,7 @@ static struct page *snd_pcm_get_vmalloc_
32538 return vmalloc_to_page(pageptr);
32539 }
32540
32541-static struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32542+static const struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32543 .open = snd_cx231xx_capture_open,
32544 .close = snd_cx231xx_pcm_close,
32545 .ioctl = snd_pcm_lib_ioctl,
32546diff -urNp linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c
32547--- linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32548+++ linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32549@@ -435,7 +435,7 @@ static u32 functionality(struct i2c_adap
32550 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32551 }
32552
32553-static struct i2c_algorithm cx231xx_algo = {
32554+static const struct i2c_algorithm cx231xx_algo = {
32555 .master_xfer = cx231xx_i2c_xfer,
32556 .functionality = functionality,
32557 };
32558diff -urNp linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c
32559--- linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c 2011-05-19 00:06:34.000000000 -0400
32560+++ linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c 2011-05-22 19:36:31.000000000 -0400
32561@@ -53,6 +53,8 @@ static void cx23885_input_process_measur
32562 bool handle = false;
32563 struct ir_raw_event ir_core_event[64];
32564
32565+ pax_track_stack();
32566+
32567 do {
32568 num = 0;
32569 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
32570diff -urNp linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c
32571--- linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c 2011-05-19 00:06:34.000000000 -0400
32572+++ linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c 2011-05-22 19:36:31.000000000 -0400
32573@@ -519,7 +519,7 @@ static struct page *snd_cx88_page(struct
32574 /*
32575 * operators
32576 */
32577-static struct snd_pcm_ops snd_cx88_pcm_ops = {
32578+static const struct snd_pcm_ops snd_cx88_pcm_ops = {
32579 .open = snd_cx88_pcm_open,
32580 .close = snd_cx88_close,
32581 .ioctl = snd_pcm_lib_ioctl,
32582diff -urNp linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h
32583--- linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-19 00:06:34.000000000 -0400
32584+++ linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-22 19:36:31.000000000 -0400
32585@@ -99,7 +99,7 @@ struct ccdc_hw_device {
32586 /* module owner */
32587 struct module *owner;
32588 /* hw ops */
32589- struct ccdc_hw_ops hw_ops;
32590+ const struct ccdc_hw_ops hw_ops;
32591 };
32592
32593 /* Used by CCDC module to register & unregister with vpfe capture driver */
32594diff -urNp linux-2.6.39/drivers/media/video/davinci/vpss.c linux-2.6.39/drivers/media/video/davinci/vpss.c
32595--- linux-2.6.39/drivers/media/video/davinci/vpss.c 2011-05-19 00:06:34.000000000 -0400
32596+++ linux-2.6.39/drivers/media/video/davinci/vpss.c 2011-05-22 19:36:31.000000000 -0400
32597@@ -103,7 +103,7 @@ struct vpss_oper_config {
32598 __iomem void *vpss_regs_base1;
32599 enum vpss_platform_type platform;
32600 spinlock_t vpss_lock;
32601- struct vpss_hw_ops hw_ops;
32602+ const struct vpss_hw_ops hw_ops;
32603 };
32604
32605 static struct vpss_oper_config oper_cfg;
32606diff -urNp linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c
32607--- linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32608+++ linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32609@@ -432,7 +432,7 @@ static struct page *snd_pcm_get_vmalloc_
32610 return vmalloc_to_page(pageptr);
32611 }
32612
32613-static struct snd_pcm_ops snd_em28xx_pcm_capture = {
32614+static const struct snd_pcm_ops snd_em28xx_pcm_capture = {
32615 .open = snd_em28xx_capture_open,
32616 .close = snd_em28xx_pcm_close,
32617 .ioctl = snd_pcm_lib_ioctl,
32618diff -urNp linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c
32619--- linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32620+++ linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32621@@ -451,7 +451,7 @@ static u32 functionality(struct i2c_adap
32622 return I2C_FUNC_SMBUS_EMUL;
32623 }
32624
32625-static struct i2c_algorithm em28xx_algo = {
32626+static const struct i2c_algorithm em28xx_algo = {
32627 .master_xfer = em28xx_i2c_xfer,
32628 .functionality = functionality,
32629 };
32630diff -urNp linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c
32631--- linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-19 00:06:34.000000000 -0400
32632+++ linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-22 19:36:31.000000000 -0400
32633@@ -179,7 +179,7 @@ static u32 hdpvr_functionality(struct i2
32634 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
32635 }
32636
32637-static struct i2c_algorithm hdpvr_algo = {
32638+static const struct i2c_algorithm hdpvr_algo = {
32639 .master_xfer = hdpvr_transfer,
32640 .functionality = hdpvr_functionality,
32641 };
32642diff -urNp linux-2.6.39/drivers/media/video/imx074.c linux-2.6.39/drivers/media/video/imx074.c
32643--- linux-2.6.39/drivers/media/video/imx074.c 2011-05-19 00:06:34.000000000 -0400
32644+++ linux-2.6.39/drivers/media/video/imx074.c 2011-05-22 19:36:31.000000000 -0400
32645@@ -267,7 +267,7 @@ static int imx074_g_chip_ident(struct v4
32646 return 0;
32647 }
32648
32649-static struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32650+static const struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32651 .s_stream = imx074_s_stream,
32652 .s_mbus_fmt = imx074_s_fmt,
32653 .g_mbus_fmt = imx074_g_fmt,
32654@@ -277,7 +277,7 @@ static struct v4l2_subdev_video_ops imx0
32655 .cropcap = imx074_cropcap,
32656 };
32657
32658-static struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32659+static const struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32660 .g_chip_ident = imx074_g_chip_ident,
32661 };
32662
32663diff -urNp linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c
32664--- linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c 2011-05-19 00:06:34.000000000 -0400
32665+++ linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 32666@@ -80,7 +80,7 @@ static struct pci_device_id ivtv_pci_tbl
32667 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
32668
32669 /* ivtv instance counter */
32670-static atomic_t ivtv_instance = ATOMIC_INIT(0);
32671+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
32672
32673 /* Parameter declarations */
32674 static int cardtype[IVTV_MAX_CARDS];
66a7e928
MT		 32675diff -urNp linux-2.6.39/drivers/media/video/mt9m001.c linux-2.6.39/drivers/media/video/mt9m001.c
32676--- linux-2.6.39/drivers/media/video/mt9m001.c 2011-05-19 00:06:34.000000000 -0400
32677+++ linux-2.6.39/drivers/media/video/mt9m001.c 2011-05-22 19:36:31.000000000 -0400
32678@@ -691,7 +691,7 @@ static int mt9m001_g_skip_top_lines(stru
32679 return 0;
32680 }
32681
32682-static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32683+static const struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32684 .g_ctrl = mt9m001_g_ctrl,
32685 .s_ctrl = mt9m001_s_ctrl,
32686 .g_chip_ident = mt9m001_g_chip_ident,
32687@@ -714,7 +714,7 @@ static int mt9m001_enum_fmt(struct v4l2_
32688 return 0;
32689 }
32690
32691-static struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32692+static const struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32693 .s_stream = mt9m001_s_stream,
32694 .s_mbus_fmt = mt9m001_s_fmt,
32695 .g_mbus_fmt = mt9m001_g_fmt,
32696@@ -725,7 +725,7 @@ static struct v4l2_subdev_video_ops mt9m
32697 .enum_mbus_fmt = mt9m001_enum_fmt,
32698 };
32699
32700-static struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32701+static const struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32702 .g_skip_top_lines = mt9m001_g_skip_top_lines,
32703 };
32704
32705diff -urNp linux-2.6.39/drivers/media/video/mt9t031.c linux-2.6.39/drivers/media/video/mt9t031.c
32706--- linux-2.6.39/drivers/media/video/mt9t031.c 2011-05-19 00:06:34.000000000 -0400
32707+++ linux-2.6.39/drivers/media/video/mt9t031.c 2011-05-22 19:36:31.000000000 -0400
32708@@ -725,7 +725,7 @@ static int mt9t031_runtime_resume(struct
32709 return 0;
32710 }
32711
32712-static struct dev_pm_ops mt9t031_dev_pm_ops = {
32713+static const struct dev_pm_ops mt9t031_dev_pm_ops = {
32714 .runtime_suspend = mt9t031_runtime_suspend,
32715 .runtime_resume = mt9t031_runtime_resume,
32716 };
32717@@ -788,7 +788,7 @@ static int mt9t031_g_skip_top_lines(stru
32718 return 0;
32719 }
32720
32721-static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32722+static const struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32723 .g_ctrl = mt9t031_g_ctrl,
32724 .s_ctrl = mt9t031_s_ctrl,
32725 .g_chip_ident = mt9t031_g_chip_ident,
32726@@ -808,7 +808,7 @@ static int mt9t031_enum_fmt(struct v4l2_
32727 return 0;
32728 }
32729
32730-static struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32731+static const struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32732 .s_stream = mt9t031_s_stream,
32733 .s_mbus_fmt = mt9t031_s_fmt,
32734 .g_mbus_fmt = mt9t031_g_fmt,
32735@@ -819,7 +819,7 @@ static struct v4l2_subdev_video_ops mt9t
32736 .enum_mbus_fmt = mt9t031_enum_fmt,
32737 };
32738
32739-static struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32740+static const struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32741 .g_skip_top_lines = mt9t031_g_skip_top_lines,
32742 };
32743
32744diff -urNp linux-2.6.39/drivers/media/video/mt9v022.c linux-2.6.39/drivers/media/video/mt9v022.c
32745--- linux-2.6.39/drivers/media/video/mt9v022.c 2011-05-19 00:06:34.000000000 -0400
32746+++ linux-2.6.39/drivers/media/video/mt9v022.c 2011-05-22 19:36:31.000000000 -0400
32747@@ -825,7 +825,7 @@ static int mt9v022_g_skip_top_lines(stru
32748 return 0;
32749 }
32750
32751-static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32752+static const struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32753 .g_ctrl = mt9v022_g_ctrl,
32754 .s_ctrl = mt9v022_s_ctrl,
32755 .g_chip_ident = mt9v022_g_chip_ident,
32756@@ -848,7 +848,7 @@ static int mt9v022_enum_fmt(struct v4l2_
32757 return 0;
32758 }
32759
32760-static struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32761+static const struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32762 .s_stream = mt9v022_s_stream,
32763 .s_mbus_fmt = mt9v022_s_fmt,
32764 .g_mbus_fmt = mt9v022_g_fmt,
32765@@ -859,7 +859,7 @@ static struct v4l2_subdev_video_ops mt9v
32766 .enum_mbus_fmt = mt9v022_enum_fmt,
32767 };
32768
32769-static struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32770+static const struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32771 .g_skip_top_lines = mt9v022_g_skip_top_lines,
32772 };
32773
32774diff -urNp linux-2.6.39/drivers/media/video/mx2_camera.c linux-2.6.39/drivers/media/video/mx2_camera.c
32775--- linux-2.6.39/drivers/media/video/mx2_camera.c 2011-05-19 00:06:34.000000000 -0400
32776+++ linux-2.6.39/drivers/media/video/mx2_camera.c 2011-05-22 19:36:31.000000000 -0400
32777@@ -668,7 +668,7 @@ static void mx2_videobuf_release(struct
32778 free_buffer(vq, buf);
32779 }
32780
32781-static struct videobuf_queue_ops mx2_videobuf_ops = {
32782+static const struct videobuf_queue_ops mx2_videobuf_ops = {
32783 .buf_setup = mx2_videobuf_setup,
32784 .buf_prepare = mx2_videobuf_prepare,
32785 .buf_queue = mx2_videobuf_queue,
32786diff -urNp linux-2.6.39/drivers/media/video/omap24xxcam.c linux-2.6.39/drivers/media/video/omap24xxcam.c
32787--- linux-2.6.39/drivers/media/video/omap24xxcam.c 2011-05-19 00:06:34.000000000 -0400
32788+++ linux-2.6.39/drivers/media/video/omap24xxcam.c 2011-05-22 19:36:31.000000000 -0400
32789@@ -403,7 +403,7 @@ static void omap24xxcam_vbq_complete(str
8308f9c9
MT		 32790 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
32791
32792 do_gettimeofday(&vb->ts);
32793- vb->field_count = atomic_add_return(2, &fh->field_count);
32794+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
32795 if (csr & csr_error) {
32796 vb->state = VIDEOBUF_ERROR;
32797 if (!atomic_read(&fh->cam->in_reset)) {
66a7e928
MT		 32798diff -urNp linux-2.6.39/drivers/media/video/omap24xxcam.h linux-2.6.39/drivers/media/video/omap24xxcam.h
32799--- linux-2.6.39/drivers/media/video/omap24xxcam.h 2011-05-19 00:06:34.000000000 -0400
32800+++ linux-2.6.39/drivers/media/video/omap24xxcam.h 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 32801@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
32802 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
32803 struct videobuf_queue vbq;
32804 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
32805- atomic_t field_count; /* field counter for videobuf_buffer */
32806+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
32807 /* accessing cam here doesn't need serialisation: it's constant */
32808 struct omap24xxcam_device *cam;
32809 };
66a7e928
MT		 32810diff -urNp linux-2.6.39/drivers/media/video/omap3isp/isp.h linux-2.6.39/drivers/media/video/omap3isp/isp.h
32811--- linux-2.6.39/drivers/media/video/omap3isp/isp.h 2011-05-19 00:06:34.000000000 -0400
32812+++ linux-2.6.39/drivers/media/video/omap3isp/isp.h 2011-05-22 19:36:31.000000000 -0400
32813@@ -290,7 +290,7 @@ struct isp_device {
32814
32815 struct iommu *iommu;
32816
32817- struct isp_platform_callback platform_cb;
32818+ const struct isp_platform_callback platform_cb;
32819 };
32820
32821 #define v4l2_dev_to_isp_device(dev) \
32822diff -urNp linux-2.6.39/drivers/media/video/ov2640.c linux-2.6.39/drivers/media/video/ov2640.c
32823--- linux-2.6.39/drivers/media/video/ov2640.c 2011-05-19 00:06:34.000000000 -0400
32824+++ linux-2.6.39/drivers/media/video/ov2640.c 2011-05-22 19:36:31.000000000 -0400
32825@@ -1080,7 +1080,7 @@ static struct soc_camera_ops ov2640_ops
32826 .num_controls = ARRAY_SIZE(ov2640_controls),
32827 };
32828
32829-static struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32830+static const struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32831 .g_ctrl = ov2640_g_ctrl,
32832 .s_ctrl = ov2640_s_ctrl,
32833 .g_chip_ident = ov2640_g_chip_ident,
32834@@ -1090,7 +1090,7 @@ static struct v4l2_subdev_core_ops ov264
32835 #endif
32836 };
32837
32838-static struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32839+static const struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32840 .s_stream = ov2640_s_stream,
32841 .g_mbus_fmt = ov2640_g_fmt,
32842 .s_mbus_fmt = ov2640_s_fmt,
32843diff -urNp linux-2.6.39/drivers/media/video/ov772x.c linux-2.6.39/drivers/media/video/ov772x.c
32844--- linux-2.6.39/drivers/media/video/ov772x.c 2011-05-19 00:06:34.000000000 -0400
32845+++ linux-2.6.39/drivers/media/video/ov772x.c 2011-05-22 19:36:31.000000000 -0400
32846@@ -1079,7 +1079,7 @@ static struct soc_camera_ops ov772x_ops
32847 .num_controls = ARRAY_SIZE(ov772x_controls),
32848 };
32849
32850-static struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
32851+static const struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
32852 .g_ctrl = ov772x_g_ctrl,
32853 .s_ctrl = ov772x_s_ctrl,
32854 .g_chip_ident = ov772x_g_chip_ident,
32855@@ -1099,7 +1099,7 @@ static int ov772x_enum_fmt(struct v4l2_s
32856 return 0;
32857 }
32858
32859-static struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
32860+static const struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
32861 .s_stream = ov772x_s_stream,
32862 .g_mbus_fmt = ov772x_g_fmt,
32863 .s_mbus_fmt = ov772x_s_fmt,
32864diff -urNp linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32865--- linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-19 00:06:34.000000000 -0400
32866+++ linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-22 19:36:31.000000000 -0400
32867@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
32868 u8 *eeprom;
32869 struct tveeprom tvdata;
32870
32871+ pax_track_stack();
32872+
32873 memset(&tvdata,0,sizeof(tvdata));
32874
32875 eeprom = pvr2_eeprom_fetch(hdw);
32876diff -urNp linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
32877--- linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-19 00:06:34.000000000 -0400
32878+++ linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-22 19:36:31.000000000 -0400
32879@@ -527,7 +527,7 @@ static u32 pvr2_i2c_functionality(struct
32880 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32881 }
32882
32883-static struct i2c_algorithm pvr2_i2c_algo_template = {
32884+static const struct i2c_algorithm pvr2_i2c_algo_template = {
32885 .master_xfer = pvr2_i2c_xfer,
32886 .functionality = pvr2_i2c_functionality,
32887 };
32888diff -urNp linux-2.6.39/drivers/media/video/rj54n1cb0c.c linux-2.6.39/drivers/media/video/rj54n1cb0c.c
32889--- linux-2.6.39/drivers/media/video/rj54n1cb0c.c 2011-05-19 00:06:34.000000000 -0400
32890+++ linux-2.6.39/drivers/media/video/rj54n1cb0c.c 2011-05-22 19:36:31.000000000 -0400
32891@@ -1327,7 +1327,7 @@ static int rj54n1_s_ctrl(struct v4l2_sub
32892 return 0;
32893 }
32894
32895-static struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
32896+static const struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
32897 .g_ctrl = rj54n1_g_ctrl,
32898 .s_ctrl = rj54n1_s_ctrl,
32899 .g_chip_ident = rj54n1_g_chip_ident,
32900@@ -1337,7 +1337,7 @@ static struct v4l2_subdev_core_ops rj54n
32901 #endif
32902 };
32903
32904-static struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
32905+static const struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
32906 .s_stream = rj54n1_s_stream,
32907 .s_mbus_fmt = rj54n1_s_fmt,
32908 .g_mbus_fmt = rj54n1_g_fmt,
32909diff -urNp linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c
32910--- linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-19 00:06:34.000000000 -0400
32911+++ linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-22 19:36:31.000000000 -0400
32912@@ -376,7 +376,7 @@ static void fimc_unlock(struct vb2_queue
32913 mutex_unlock(&ctx->fimc_dev->lock);
32914 }
32915
32916-static struct vb2_ops fimc_capture_qops = {
32917+static const struct vb2_ops fimc_capture_qops = {
32918 .queue_setup = queue_setup,
32919 .buf_prepare = buffer_prepare,
32920 .buf_queue = buffer_queue,
32921diff -urNp linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c
32922--- linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-19 00:06:34.000000000 -0400
32923+++ linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-22 19:36:31.000000000 -0400
32924@@ -768,7 +768,7 @@ static void fimc_unlock(struct vb2_queue
32925 mutex_unlock(&ctx->fimc_dev->lock);
32926 }
32927
32928-static struct vb2_ops fimc_qops = {
32929+static const struct vb2_ops fimc_qops = {
32930 .queue_setup = fimc_queue_setup,
32931 .buf_prepare = fimc_buf_prepare,
32932 .buf_queue = fimc_buf_queue,
32933diff -urNp linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c
32934--- linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c 2011-05-19 00:06:34.000000000 -0400
32935+++ linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c 2011-05-22 19:36:31.000000000 -0400
32936@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
32937 unsigned char localPAT[256];
32938 unsigned char localPMT[256];
32939
32940+ pax_track_stack();
32941+
32942 /* Set video format - must be done first as it resets other settings */
32943 set_reg8(client, 0x41, h->video_format);
32944
32945diff -urNp linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c
32946--- linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-19 00:06:34.000000000 -0400
32947+++ linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-22 19:36:31.000000000 -0400
32948@@ -808,7 +808,7 @@ static struct page *snd_card_saa7134_pag
32949 * ALSA capture callbacks definition
32950 */
32951
32952-static struct snd_pcm_ops snd_card_saa7134_capture_ops = {
32953+static const struct snd_pcm_ops snd_card_saa7134_capture_ops = {
32954 .open = snd_card_saa7134_capture_open,
32955 .close = snd_card_saa7134_capture_close,
32956 .ioctl = snd_pcm_lib_ioctl,
32957diff -urNp linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c
32958--- linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-19 00:06:34.000000000 -0400
32959+++ linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-22 19:36:31.000000000 -0400
32960@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
32961 u8 tmp[512];
32962 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32963
32964+ pax_track_stack();
32965+
32966 /* While any outstand message on the bus exists... */
32967 do {
32968
32969@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
32970 u8 tmp[512];
32971 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32972
32973+ pax_track_stack();
32974+
32975 while (loop) {
32976
32977 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
32978diff -urNp linux-2.6.39/drivers/media/video/sh_mobile_csi2.c linux-2.6.39/drivers/media/video/sh_mobile_csi2.c
32979--- linux-2.6.39/drivers/media/video/sh_mobile_csi2.c 2011-05-19 00:06:34.000000000 -0400
32980+++ linux-2.6.39/drivers/media/video/sh_mobile_csi2.c 2011-05-22 19:36:31.000000000 -0400
32981@@ -127,12 +127,12 @@ static int sh_csi2_s_fmt(struct v4l2_sub
32982 return 0;
32983 }
32984
32985-static struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
32986+static const struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
32987 .s_mbus_fmt = sh_csi2_s_fmt,
32988 .try_mbus_fmt = sh_csi2_try_fmt,
32989 };
32990
32991-static struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
32992+static const struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
32993
32994 static struct v4l2_subdev_ops sh_csi2_subdev_ops = {
32995 .core = &sh_csi2_subdev_core_ops,
32996diff -urNp linux-2.6.39/drivers/media/video/soc_camera_platform.c linux-2.6.39/drivers/media/video/soc_camera_platform.c
32997--- linux-2.6.39/drivers/media/video/soc_camera_platform.c 2011-05-19 00:06:34.000000000 -0400
32998+++ linux-2.6.39/drivers/media/video/soc_camera_platform.c 2011-05-22 19:36:31.000000000 -0400
32999@@ -70,7 +70,7 @@ static int soc_camera_platform_fill_fmt(
33000 return 0;
33001 }
33002
33003-static struct v4l2_subdev_core_ops platform_subdev_core_ops;
33004+static const struct v4l2_subdev_core_ops platform_subdev_core_ops;
33005
33006 static int soc_camera_platform_enum_fmt(struct v4l2_subdev *sd, unsigned int index,
33007 enum v4l2_mbus_pixelcode *code)
33008@@ -115,7 +115,7 @@ static int soc_camera_platform_cropcap(s
33009 return 0;
33010 }
33011
33012-static struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33013+static const struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33014 .s_stream = soc_camera_platform_s_stream,
33015 .enum_mbus_fmt = soc_camera_platform_enum_fmt,
33016 .cropcap = soc_camera_platform_cropcap,
33017diff -urNp linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c
33018--- linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c 2011-05-19 00:06:34.000000000 -0400
33019+++ linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c 2011-05-22 19:36:31.000000000 -0400
33020@@ -265,7 +265,7 @@ static struct page *snd_pcm_pd_get_page(
33021 return vmalloc_to_page(pageptr);
33022 }
33023
33024-static struct snd_pcm_ops pcm_capture_ops = {
33025+static const struct snd_pcm_ops pcm_capture_ops = {
33026 .open = snd_pd_capture_open,
33027 .close = snd_pd_pcm_close,
33028 .ioctl = snd_pcm_lib_ioctl,
33029diff -urNp linux-2.6.39/drivers/media/video/tw9910.c linux-2.6.39/drivers/media/video/tw9910.c
33030--- linux-2.6.39/drivers/media/video/tw9910.c 2011-05-19 00:06:34.000000000 -0400
33031+++ linux-2.6.39/drivers/media/video/tw9910.c 2011-05-22 19:36:31.000000000 -0400
33032@@ -894,7 +894,7 @@ static struct soc_camera_ops tw9910_ops
33033 .enum_input = tw9910_enum_input,
33034 };
33035
33036-static struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33037+static const struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33038 .g_chip_ident = tw9910_g_chip_ident,
33039 .s_std = tw9910_s_std,
33040 #ifdef CONFIG_VIDEO_ADV_DEBUG
33041@@ -913,7 +913,7 @@ static int tw9910_enum_fmt(struct v4l2_s
33042 return 0;
33043 }
33044
33045-static struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33046+static const struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33047 .s_stream = tw9910_s_stream,
33048 .g_mbus_fmt = tw9910_g_fmt,
33049 .s_mbus_fmt = tw9910_s_fmt,
33050diff -urNp linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c
33051--- linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c 2011-05-19 00:06:34.000000000 -0400
33052+++ linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c 2011-05-22 19:36:31.000000000 -0400
33053@@ -799,6 +799,8 @@ static enum parse_state usbvision_parse_
33054 unsigned char rv, gv, bv;
33055 static unsigned char *Y, *U, *V;
33056
33057+ pax_track_stack();
33058+
33059 frame = usbvision->cur_frame;
33060 image_size = frame->frmwidth * frame->frmheight;
33061 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
33062diff -urNp linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c
33063--- linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-19 00:06:34.000000000 -0400
33064+++ linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-22 19:36:31.000000000 -0400
33065@@ -189,7 +189,7 @@ static u32 functionality(struct i2c_adap
33066
33067 /* -----exported algorithm data: ------------------------------------- */
33068
33069-static struct i2c_algorithm usbvision_algo = {
33070+static const struct i2c_algorithm usbvision_algo = {
33071 .master_xfer = usbvision_i2c_xfer,
33072 .smbus_xfer = NULL,
33073 .functionality = functionality,
33074diff -urNp linux-2.6.39/drivers/media/video/v4l2-device.c linux-2.6.39/drivers/media/video/v4l2-device.c
33075--- linux-2.6.39/drivers/media/video/v4l2-device.c 2011-05-19 00:06:34.000000000 -0400
33076+++ linux-2.6.39/drivers/media/video/v4l2-device.c 2011-05-22 19:36:31.000000000 -0400
33077@@ -71,9 +71,9 @@ int v4l2_device_put(struct v4l2_device *
33078 EXPORT_SYMBOL_GPL(v4l2_device_put);
8308f9c9
MT		 33079
33080 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
33081- atomic_t *instance)
33082+ atomic_unchecked_t *instance)
33083 {
33084- int num = atomic_inc_return(instance) - 1;
33085+ int num = atomic_inc_return_unchecked(instance) - 1;
33086 int len = strlen(basename);
33087
33088 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
66a7e928
MT		 33089diff -urNp linux-2.6.39/drivers/media/video/videobuf-dma-sg.c linux-2.6.39/drivers/media/video/videobuf-dma-sg.c
33090--- linux-2.6.39/drivers/media/video/videobuf-dma-sg.c 2011-05-19 00:06:34.000000000 -0400
33091+++ linux-2.6.39/drivers/media/video/videobuf-dma-sg.c 2011-05-22 19:36:31.000000000 -0400
33092@@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
33093 {
33094 struct videobuf_queue q;
33095
33096+ pax_track_stack();
33097+
33098 /* Required to make generic handler to call __videobuf_alloc */
33099 q.int_ops = &sg_ops;
33100
33101diff -urNp linux-2.6.39/drivers/message/fusion/mptbase.c linux-2.6.39/drivers/message/fusion/mptbase.c
33102--- linux-2.6.39/drivers/message/fusion/mptbase.c 2011-05-19 00:06:34.000000000 -0400
33103+++ linux-2.6.39/drivers/message/fusion/mptbase.c 2011-05-22 19:41:37.000000000 -0400
33104@@ -143,7 +143,7 @@ static int MptDriverClass[MPT_MAX_PRO
33105 static MPT_EVHANDLER MptEvHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33106 /* Reset handler lookup table */
33107 static MPT_RESETHANDLER MptResetHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33108-static struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33109+static const struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33110
33111 #ifdef CONFIG_PROC_FS
33112 static struct proc_dir_entry *mpt_proc_root_dir;
33113@@ -772,7 +772,7 @@ mpt_reset_deregister(u8 cb_idx)
33114 * @cb_idx: MPT protocol driver index
33115 */
33116 int
33117-mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33118+mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33119 {
33120 MPT_ADAPTER *ioc;
33121 const struct pci_device_id *id;
33122@@ -801,7 +801,7 @@ mpt_device_driver_register(struct mpt_pc
33123 void
33124 mpt_device_driver_deregister(u8 cb_idx)
33125 {
33126- struct mpt_pci_driver *dd_cbfunc;
33127+ const struct mpt_pci_driver *dd_cbfunc;
33128 MPT_ADAPTER *ioc;
33129
33130 if (!cb_idx || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
bc901d79 33131@@ -6683,8 +6683,13 @@ static int mpt_iocinfo_proc_show(struct
6892158b
MT		 33132 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33133 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
57199397
MT		 33134
33135+#ifdef CONFIG_GRKERNSEC_HIDESYM
6892158b 33136+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
57199397 33137+#else
6892158b 33138 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
57199397
MT		 33139 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33140+#endif
33141+
33142 /*
33143 * Rounding UP to nearest 4-kB boundary here...
33144 */
66a7e928
MT		 33145diff -urNp linux-2.6.39/drivers/message/fusion/mptbase.h linux-2.6.39/drivers/message/fusion/mptbase.h
33146--- linux-2.6.39/drivers/message/fusion/mptbase.h 2011-05-19 00:06:34.000000000 -0400
33147+++ linux-2.6.39/drivers/message/fusion/mptbase.h 2011-05-22 19:36:31.000000000 -0400
33148@@ -908,7 +908,7 @@ extern int mpt_event_register(u8 cb_idx
33149 extern void mpt_event_deregister(u8 cb_idx);
33150 extern int mpt_reset_register(u8 cb_idx, MPT_RESETHANDLER reset_func);
33151 extern void mpt_reset_deregister(u8 cb_idx);
33152-extern int mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33153+extern int mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33154 extern void mpt_device_driver_deregister(u8 cb_idx);
33155 extern MPT_FRAME_HDR *mpt_get_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc);
33156 extern void mpt_free_msg_frame(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf);
33157diff -urNp linux-2.6.39/drivers/message/fusion/mptctl.c linux-2.6.39/drivers/message/fusion/mptctl.c
33158--- linux-2.6.39/drivers/message/fusion/mptctl.c 2011-05-19 00:06:34.000000000 -0400
33159+++ linux-2.6.39/drivers/message/fusion/mptctl.c 2011-05-22 19:36:31.000000000 -0400
33160@@ -3000,7 +3000,7 @@ mptctl_remove(struct pci_dev *pdev)
33161 {
33162 }
33163
33164-static struct mpt_pci_driver mptctl_driver = {
33165+static const struct mpt_pci_driver mptctl_driver = {
33166 .probe = mptctl_probe,
33167 .remove = mptctl_remove,
33168 };
33169diff -urNp linux-2.6.39/drivers/message/fusion/mptsas.c linux-2.6.39/drivers/message/fusion/mptsas.c
33170--- linux-2.6.39/drivers/message/fusion/mptsas.c 2011-05-19 00:06:34.000000000 -0400
33171+++ linux-2.6.39/drivers/message/fusion/mptsas.c 2011-05-22 19:36:31.000000000 -0400
6892158b 33172@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
df50ba0c
MT		 33173 return 0;
33174 }
33175
33176+static inline void
33177+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33178+{
33179+ if (phy_info->port_details) {
33180+ phy_info->port_details->rphy = rphy;
33181+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33182+ ioc->name, rphy));
33183+ }
33184+
33185+ if (rphy) {
33186+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33187+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33188+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33189+ ioc->name, rphy, rphy->dev.release));
33190+ }
33191+}
33192+
33193 /* no mutex */
33194 static void
33195 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
6892158b 33196@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
df50ba0c
MT		 33197 return NULL;
33198 }
33199
33200-static inline void
33201-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33202-{
33203- if (phy_info->port_details) {
33204- phy_info->port_details->rphy = rphy;
33205- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33206- ioc->name, rphy));
33207- }
33208-
33209- if (rphy) {
33210- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33211- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33212- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33213- ioc->name, rphy, rphy->dev.release));
33214- }
33215-}
33216-
33217 static inline struct sas_port *
33218 mptsas_get_port(struct mptsas_phyinfo *phy_info)
33219 {
66a7e928
MT		 33220diff -urNp linux-2.6.39/drivers/message/fusion/mptscsih.c linux-2.6.39/drivers/message/fusion/mptscsih.c
33221--- linux-2.6.39/drivers/message/fusion/mptscsih.c 2011-05-19 00:06:34.000000000 -0400
33222+++ linux-2.6.39/drivers/message/fusion/mptscsih.c 2011-05-22 19:36:31.000000000 -0400
6892158b
MT		 33223@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
33224
33225 h = shost_priv(SChost);
33226
33227- if (h) {
33228- if (h->info_kbuf == NULL)
33229- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33230- return h->info_kbuf;
33231- h->info_kbuf[0] = '\0';
33232+ if (!h)
33233+ return NULL;
33234
33235- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33236- h->info_kbuf[size-1] = '\0';
33237- }
33238+ if (h->info_kbuf == NULL)
33239+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33240+ return h->info_kbuf;
33241+ h->info_kbuf[0] = '\0';
33242+
33243+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33244+ h->info_kbuf[size-1] = '\0';
33245
33246 return h->info_kbuf;
33247 }
66a7e928
MT		 33248diff -urNp linux-2.6.39/drivers/message/i2o/i2o_config.c linux-2.6.39/drivers/message/i2o/i2o_config.c
33249--- linux-2.6.39/drivers/message/i2o/i2o_config.c 2011-05-19 00:06:34.000000000 -0400
33250+++ linux-2.6.39/drivers/message/i2o/i2o_config.c 2011-05-22 19:36:31.000000000 -0400
33251@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
33252 struct i2o_message *msg;
33253 unsigned int iop;
33254
33255+ pax_track_stack();
33256+
33257 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
33258 return -EFAULT;
33259
33260diff -urNp linux-2.6.39/drivers/message/i2o/i2o_proc.c linux-2.6.39/drivers/message/i2o/i2o_proc.c
33261--- linux-2.6.39/drivers/message/i2o/i2o_proc.c 2011-05-19 00:06:34.000000000 -0400
33262+++ linux-2.6.39/drivers/message/i2o/i2o_proc.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 33263@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
58c5fc13
MT		 33264 "Array Controller Device"
33265 };
33266
33267-static char *chtostr(u8 * chars, int n)
33268-{
33269- char tmp[256];
33270- tmp[0] = 0;
33271- return strncat(tmp, (char *)chars, n);
33272-}
33273-
33274 static int i2o_report_query_status(struct seq_file *seq, int block_status,
33275 char *group)
33276 {
df50ba0c 33277@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
58c5fc13
MT		 33278
33279 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
33280 seq_printf(seq, "%-#8x", ddm_table.module_id);
33281- seq_printf(seq, "%-29s",
33282- chtostr(ddm_table.module_name_version, 28));
33283+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
33284 seq_printf(seq, "%9d ", ddm_table.data_size);
33285 seq_printf(seq, "%8d", ddm_table.code_size);
33286
df50ba0c 33287@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
58c5fc13
MT		 33288
33289 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
33290 seq_printf(seq, "%-#8x", dst->module_id);
33291- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
33292- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
33293+ seq_printf(seq, "%-.28s", dst->module_name_version);
33294+ seq_printf(seq, "%-.8s", dst->date);
33295 seq_printf(seq, "%8d ", dst->module_size);
33296 seq_printf(seq, "%8d ", dst->mpb_size);
33297 seq_printf(seq, "0x%04x", dst->module_flags);
df50ba0c 33298@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
58c5fc13
MT		 33299 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
33300 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
33301 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
33302- seq_printf(seq, "Vendor info : %s\n",
33303- chtostr((u8 *) (work32 + 2), 16));
33304- seq_printf(seq, "Product info : %s\n",
33305- chtostr((u8 *) (work32 + 6), 16));
33306- seq_printf(seq, "Description : %s\n",
33307- chtostr((u8 *) (work32 + 10), 16));
33308- seq_printf(seq, "Product rev. : %s\n",
33309- chtostr((u8 *) (work32 + 14), 8));
33310+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
33311+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
33312+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
33313+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
33314
33315 seq_printf(seq, "Serial number : ");
33316 print_serial_number(seq, (u8 *) (work32 + 16),
df50ba0c 33317@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
58c5fc13
MT		 33318 }
33319
33320 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
33321- seq_printf(seq, "Module name : %s\n",
33322- chtostr(result.module_name, 24));
33323- seq_printf(seq, "Module revision : %s\n",
33324- chtostr(result.module_rev, 8));
33325+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
33326+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
33327
33328 seq_printf(seq, "Serial number : ");
33329 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
df50ba0c 33330@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
58c5fc13
MT		 33331 return 0;
33332 }
33333
33334- seq_printf(seq, "Device name : %s\n",
33335- chtostr(result.device_name, 64));
33336- seq_printf(seq, "Service name : %s\n",
33337- chtostr(result.service_name, 64));
33338- seq_printf(seq, "Physical name : %s\n",
33339- chtostr(result.physical_location, 64));
33340- seq_printf(seq, "Instance number : %s\n",
33341- chtostr(result.instance_number, 4));
33342+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
33343+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
33344+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
33345+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
33346
33347 return 0;
33348 }
66a7e928
MT		 33349diff -urNp linux-2.6.39/drivers/message/i2o/iop.c linux-2.6.39/drivers/message/i2o/iop.c
33350--- linux-2.6.39/drivers/message/i2o/iop.c 2011-05-19 00:06:34.000000000 -0400
33351+++ linux-2.6.39/drivers/message/i2o/iop.c 2011-05-22 19:36:31.000000000 -0400
8308f9c9
MT		 33352@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
33353
33354 spin_lock_irqsave(&c->context_list_lock, flags);
33355
33356- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
33357- atomic_inc(&c->context_list_counter);
33358+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
33359+ atomic_inc_unchecked(&c->context_list_counter);
33360
33361- entry->context = atomic_read(&c->context_list_counter);
33362+ entry->context = atomic_read_unchecked(&c->context_list_counter);
33363
33364 list_add(&entry->list, &c->context_list);
33365
33366@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
33367
33368 #if BITS_PER_LONG == 64
33369 spin_lock_init(&c->context_list_lock);
33370- atomic_set(&c->context_list_counter, 0);
33371+ atomic_set_unchecked(&c->context_list_counter, 0);
33372 INIT_LIST_HEAD(&c->context_list);
33373 #endif
33374
66a7e928
MT		 33375diff -urNp linux-2.6.39/drivers/mfd/ab3100-core.c linux-2.6.39/drivers/mfd/ab3100-core.c
33376--- linux-2.6.39/drivers/mfd/ab3100-core.c 2011-05-19 00:06:34.000000000 -0400
33377+++ linux-2.6.39/drivers/mfd/ab3100-core.c 2011-05-22 19:36:31.000000000 -0400
33378@@ -385,7 +385,7 @@ static int ab3100_event_registers_startu
33379 return 0;
33380 }
33381
33382-static struct abx500_ops ab3100_ops = {
33383+static const struct abx500_ops ab3100_ops = {
33384 .get_chip_id = ab3100_get_chip_id,
33385 .set_register = set_register_interruptible,
33386 .get_register = get_register_interruptible,
33387diff -urNp linux-2.6.39/drivers/mfd/ab3550-core.c linux-2.6.39/drivers/mfd/ab3550-core.c
33388--- linux-2.6.39/drivers/mfd/ab3550-core.c 2011-05-19 00:06:34.000000000 -0400
33389+++ linux-2.6.39/drivers/mfd/ab3550-core.c 2011-05-22 19:36:31.000000000 -0400
33390@@ -676,7 +676,7 @@ static int ab3550_startup_irq_enabled(st
33391 return val;
33392 }
33393
33394-static struct abx500_ops ab3550_ops = {
33395+static const struct abx500_ops ab3550_ops = {
33396 .get_chip_id = ab3550_get_chip_id,
33397 .get_register = ab3550_get_register_interruptible,
33398 .set_register = ab3550_set_register_interruptible,
33399diff -urNp linux-2.6.39/drivers/mfd/ab8500-core.c linux-2.6.39/drivers/mfd/ab8500-core.c
33400--- linux-2.6.39/drivers/mfd/ab8500-core.c 2011-05-19 00:06:34.000000000 -0400
33401+++ linux-2.6.39/drivers/mfd/ab8500-core.c 2011-05-22 19:36:31.000000000 -0400
33402@@ -223,7 +223,7 @@ static int ab8500_mask_and_set_register(
33403
33404 }
33405
33406-static struct abx500_ops ab8500_ops = {
33407+static const struct abx500_ops ab8500_ops = {
33408 .get_chip_id = ab8500_get_chip_id,
33409 .get_register = ab8500_get_register,
33410 .set_register = ab8500_set_register,
33411diff -urNp linux-2.6.39/drivers/mfd/abx500-core.c linux-2.6.39/drivers/mfd/abx500-core.c
33412--- linux-2.6.39/drivers/mfd/abx500-core.c 2011-05-19 00:06:34.000000000 -0400
33413+++ linux-2.6.39/drivers/mfd/abx500-core.c 2011-05-22 19:36:31.000000000 -0400
33414@@ -18,7 +18,7 @@ struct abx500_device_entry {
33415 struct device *dev;
33416 };
33417
33418-static void lookup_ops(struct device *dev, struct abx500_ops **ops)
33419+static void lookup_ops(struct device *dev, const struct abx500_ops **ops)
33420 {
33421 struct abx500_device_entry *dev_entry;
33422
33423@@ -31,7 +31,7 @@ static void lookup_ops(struct device *de
33424 }
33425 }
33426
33427-int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
33428+int abx500_register_ops(struct device *dev, const struct abx500_ops *ops)
33429 {
33430 struct abx500_device_entry *dev_entry;
33431
33432@@ -65,7 +65,7 @@ EXPORT_SYMBOL(abx500_remove_ops);
33433 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
33434 u8 value)
33435 {
33436- struct abx500_ops *ops;
33437+ const struct abx500_ops *ops;
33438
33439 lookup_ops(dev->parent, &ops);
33440 if ((ops != NULL) && (ops->set_register != NULL))
33441@@ -78,7 +78,7 @@ EXPORT_SYMBOL(abx500_set_register_interr
33442 int abx500_get_register_interruptible(struct device *dev, u8 bank, u8 reg,
33443 u8 *value)
33444 {
33445- struct abx500_ops *ops;
33446+ const struct abx500_ops *ops;
33447
33448 lookup_ops(dev->parent, &ops);
33449 if ((ops != NULL) && (ops->get_register != NULL))
33450@@ -91,7 +91,7 @@ EXPORT_SYMBOL(abx500_get_register_interr
33451 int abx500_get_register_page_interruptible(struct device *dev, u8 bank,
33452 u8 first_reg, u8 *regvals, u8 numregs)
33453 {
33454- struct abx500_ops *ops;
33455+ const struct abx500_ops *ops;
33456
33457 lookup_ops(dev->parent, &ops);
33458 if ((ops != NULL) && (ops->get_register_page != NULL))
33459@@ -105,7 +105,7 @@ EXPORT_SYMBOL(abx500_get_register_page_i
33460 int abx500_mask_and_set_register_interruptible(struct device *dev, u8 bank,
33461 u8 reg, u8 bitmask, u8 bitvalues)
33462 {
33463- struct abx500_ops *ops;
33464+ const struct abx500_ops *ops;
33465
33466 lookup_ops(dev->parent, &ops);
33467 if ((ops != NULL) && (ops->mask_and_set_register != NULL))
33468@@ -118,7 +118,7 @@ EXPORT_SYMBOL(abx500_mask_and_set_regist
33469
33470 int abx500_get_chip_id(struct device *dev)
33471 {
33472- struct abx500_ops *ops;
33473+ const struct abx500_ops *ops;
33474
33475 lookup_ops(dev->parent, &ops);
33476 if ((ops != NULL) && (ops->get_chip_id != NULL))
33477@@ -130,7 +130,7 @@ EXPORT_SYMBOL(abx500_get_chip_id);
33478
33479 int abx500_event_registers_startup_state_get(struct device *dev, u8 *event)
33480 {
33481- struct abx500_ops *ops;
33482+ const struct abx500_ops *ops;
33483
33484 lookup_ops(dev->parent, &ops);
33485 if ((ops != NULL) && (ops->event_registers_startup_state_get != NULL))
33486@@ -142,7 +142,7 @@ EXPORT_SYMBOL(abx500_event_registers_sta
33487
33488 int abx500_startup_irq_enabled(struct device *dev, unsigned int irq)
33489 {
33490- struct abx500_ops *ops;
33491+ const struct abx500_ops *ops;
33492
33493 lookup_ops(dev->parent, &ops);
33494 if ((ops != NULL) && (ops->startup_irq_enabled != NULL))
33495diff -urNp linux-2.6.39/drivers/mfd/janz-cmodio.c linux-2.6.39/drivers/mfd/janz-cmodio.c
33496--- linux-2.6.39/drivers/mfd/janz-cmodio.c 2011-05-19 00:06:34.000000000 -0400
33497+++ linux-2.6.39/drivers/mfd/janz-cmodio.c 2011-05-22 19:36:31.000000000 -0400
57199397
MT		 33498@@ -13,6 +13,7 @@
33499
33500 #include <linux/kernel.h>
33501 #include <linux/module.h>
33502+#include <linux/slab.h>
33503 #include <linux/init.h>
33504 #include <linux/pci.h>
33505 #include <linux/interrupt.h>
66a7e928
MT		 33506diff -urNp linux-2.6.39/drivers/mfd/mcp-sa11x0.c linux-2.6.39/drivers/mfd/mcp-sa11x0.c
33507--- linux-2.6.39/drivers/mfd/mcp-sa11x0.c 2011-05-19 00:06:34.000000000 -0400
33508+++ linux-2.6.39/drivers/mfd/mcp-sa11x0.c 2011-05-22 19:36:31.000000000 -0400
33509@@ -128,7 +128,7 @@ static void mcp_sa11x0_disable(struct mc
33510 /*
33511 * Our methods.
33512 */
33513-static struct mcp_ops mcp_sa11x0 = {
33514+static const struct mcp_ops mcp_sa11x0 = {
33515 .set_telecom_divisor = mcp_sa11x0_set_telecom_divisor,
33516 .set_audio_divisor = mcp_sa11x0_set_audio_divisor,
33517 .reg_write = mcp_sa11x0_write,
33518diff -urNp linux-2.6.39/drivers/mfd/wm8350-i2c.c linux-2.6.39/drivers/mfd/wm8350-i2c.c
33519--- linux-2.6.39/drivers/mfd/wm8350-i2c.c 2011-05-19 00:06:34.000000000 -0400
33520+++ linux-2.6.39/drivers/mfd/wm8350-i2c.c 2011-05-22 19:36:31.000000000 -0400
33521@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
33522 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
33523 int ret;
33524
33525+ pax_track_stack();
33526+
33527 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
33528 return -EINVAL;
33529
33530diff -urNp linux-2.6.39/drivers/misc/enclosure.c linux-2.6.39/drivers/misc/enclosure.c
33531--- linux-2.6.39/drivers/misc/enclosure.c 2011-05-19 00:06:34.000000000 -0400
33532+++ linux-2.6.39/drivers/misc/enclosure.c 2011-05-22 19:36:31.000000000 -0400
33533@@ -161,7 +161,7 @@ enclosure_register(struct device *dev, c
33534 }
33535 EXPORT_SYMBOL_GPL(enclosure_register);
33536
33537-static struct enclosure_component_callbacks enclosure_null_callbacks;
33538+static const struct enclosure_component_callbacks enclosure_null_callbacks;
33539
33540 /**
33541 * enclosure_unregister - remove an enclosure
33542diff -urNp linux-2.6.39/drivers/misc/kgdbts.c linux-2.6.39/drivers/misc/kgdbts.c
33543--- linux-2.6.39/drivers/misc/kgdbts.c 2011-05-19 00:06:34.000000000 -0400
33544+++ linux-2.6.39/drivers/misc/kgdbts.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 33545@@ -118,7 +118,7 @@
33546 } while (0)
33547 #define MAX_CONFIG_LEN 40
33548
33549-static struct kgdb_io kgdbts_io_ops;
33550+static const struct kgdb_io kgdbts_io_ops;
33551 static char get_buf[BUFMAX];
33552 static int get_buf_cnt;
33553 static char put_buf[BUFMAX];
bc901d79 33554@@ -1103,7 +1103,7 @@ static void kgdbts_post_exp_handler(void
ae4e228f
MT		 33555 module_put(THIS_MODULE);
33556 }
33557
33558-static struct kgdb_io kgdbts_io_ops = {
33559+static const struct kgdb_io kgdbts_io_ops = {
33560 .name = "kgdbts",
33561 .read_char = kgdbts_get_char,
33562 .write_char = kgdbts_put_char,
66a7e928
MT		 33563diff -urNp linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c
33564--- linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-19 00:06:34.000000000 -0400
33565+++ linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-22 19:36:31.000000000 -0400
33566@@ -435,7 +435,7 @@ static irqreturn_t lis302dl_interrupt(in
33567 * the lid is closed. This leads to interrupts as soon as a little move
33568 * is done.
33569 */
33570- atomic_inc(&lis3_dev.count);
33571+ atomic_inc_unchecked(&lis3_dev.count);
33572
33573 wake_up_interruptible(&lis3_dev.misc_wait);
33574 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
33575@@ -518,7 +518,7 @@ static int lis3lv02d_misc_open(struct in
33576 if (lis3_dev.pm_dev)
33577 pm_runtime_get_sync(lis3_dev.pm_dev);
33578
33579- atomic_set(&lis3_dev.count, 0);
33580+ atomic_set_unchecked(&lis3_dev.count, 0);
33581 return 0;
33582 }
33583
33584@@ -545,7 +545,7 @@ static ssize_t lis3lv02d_misc_read(struc
33585 add_wait_queue(&lis3_dev.misc_wait, &wait);
33586 while (true) {
33587 set_current_state(TASK_INTERRUPTIBLE);
33588- data = atomic_xchg(&lis3_dev.count, 0);
33589+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
33590 if (data)
33591 break;
33592
33593@@ -583,7 +583,7 @@ out:
33594 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
33595 {
33596 poll_wait(file, &lis3_dev.misc_wait, wait);
33597- if (atomic_read(&lis3_dev.count))
33598+ if (atomic_read_unchecked(&lis3_dev.count))
33599 return POLLIN | POLLRDNORM;
33600 return 0;
33601 }
33602diff -urNp linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h
33603--- linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-19 00:06:34.000000000 -0400
33604+++ linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-22 19:36:31.000000000 -0400
33605@@ -265,7 +265,7 @@ struct lis3lv02d {
33606 struct input_polled_dev *idev; /* input device */
33607 struct platform_device *pdev; /* platform device */
33608 struct regulator_bulk_data regulators[2];
33609- atomic_t count; /* interrupt count after last read */
33610+ atomic_unchecked_t count; /* interrupt count after last read */
33611 union axis_conversion ac; /* hw -> logical axis */
33612 int mapped_btns[3];
33613
33614diff -urNp linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c
33615--- linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c 2011-05-19 00:06:34.000000000 -0400
33616+++ linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 33617@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
33618 unsigned long nsec;
33619
33620 nsec = CLKS2NSEC(clks);
33621- atomic_long_inc(&mcs_op_statistics[op].count);
33622- atomic_long_add(nsec, &mcs_op_statistics[op].total);
33623+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
33624+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
33625 if (mcs_op_statistics[op].max < nsec)
33626 mcs_op_statistics[op].max = nsec;
33627 }
66a7e928
MT		 33628diff -urNp linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c
33629--- linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c 2011-05-19 00:06:34.000000000 -0400
33630+++ linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 33631@@ -32,9 +32,9 @@
33632
33633 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
33634
33635-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
33636+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
33637 {
33638- unsigned long val = atomic_long_read(v);
33639+ unsigned long val = atomic_long_read_unchecked(v);
33640
33641 seq_printf(s, "%16lu %s\n", val, id);
33642 }
33643@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
33644
33645 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
33646 for (op = 0; op < mcsop_last; op++) {
33647- count = atomic_long_read(&mcs_op_statistics[op].count);
33648- total = atomic_long_read(&mcs_op_statistics[op].total);
33649+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
33650+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
33651 max = mcs_op_statistics[op].max;
33652 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
33653 count ? total / count : 0, max);
66a7e928
MT		 33654diff -urNp linux-2.6.39/drivers/misc/sgi-gru/grutables.h linux-2.6.39/drivers/misc/sgi-gru/grutables.h
33655--- linux-2.6.39/drivers/misc/sgi-gru/grutables.h 2011-05-19 00:06:34.000000000 -0400
33656+++ linux-2.6.39/drivers/misc/sgi-gru/grutables.h 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 33657@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
33658 * GRU statistics.
33659 */
33660 struct gru_stats_s {
33661- atomic_long_t vdata_alloc;
33662- atomic_long_t vdata_free;
33663- atomic_long_t gts_alloc;
33664- atomic_long_t gts_free;
33665- atomic_long_t gms_alloc;
33666- atomic_long_t gms_free;
33667- atomic_long_t gts_double_allocate;
33668- atomic_long_t assign_context;
33669- atomic_long_t assign_context_failed;
33670- atomic_long_t free_context;
33671- atomic_long_t load_user_context;
33672- atomic_long_t load_kernel_context;
33673- atomic_long_t lock_kernel_context;
33674- atomic_long_t unlock_kernel_context;
33675- atomic_long_t steal_user_context;
33676- atomic_long_t steal_kernel_context;
33677- atomic_long_t steal_context_failed;
33678- atomic_long_t nopfn;
33679- atomic_long_t asid_new;
33680- atomic_long_t asid_next;
33681- atomic_long_t asid_wrap;
33682- atomic_long_t asid_reuse;
33683- atomic_long_t intr;
33684- atomic_long_t intr_cbr;
33685- atomic_long_t intr_tfh;
33686- atomic_long_t intr_spurious;
33687- atomic_long_t intr_mm_lock_failed;
33688- atomic_long_t call_os;
33689- atomic_long_t call_os_wait_queue;
33690- atomic_long_t user_flush_tlb;
33691- atomic_long_t user_unload_context;
33692- atomic_long_t user_exception;
33693- atomic_long_t set_context_option;
33694- atomic_long_t check_context_retarget_intr;
33695- atomic_long_t check_context_unload;
33696- atomic_long_t tlb_dropin;
33697- atomic_long_t tlb_preload_page;
33698- atomic_long_t tlb_dropin_fail_no_asid;
33699- atomic_long_t tlb_dropin_fail_upm;
33700- atomic_long_t tlb_dropin_fail_invalid;
33701- atomic_long_t tlb_dropin_fail_range_active;
33702- atomic_long_t tlb_dropin_fail_idle;
33703- atomic_long_t tlb_dropin_fail_fmm;
33704- atomic_long_t tlb_dropin_fail_no_exception;
33705- atomic_long_t tfh_stale_on_fault;
33706- atomic_long_t mmu_invalidate_range;
33707- atomic_long_t mmu_invalidate_page;
33708- atomic_long_t flush_tlb;
33709- atomic_long_t flush_tlb_gru;
33710- atomic_long_t flush_tlb_gru_tgh;
33711- atomic_long_t flush_tlb_gru_zero_asid;
33712-
33713- atomic_long_t copy_gpa;
33714- atomic_long_t read_gpa;
33715-
33716- atomic_long_t mesq_receive;
33717- atomic_long_t mesq_receive_none;
33718- atomic_long_t mesq_send;
33719- atomic_long_t mesq_send_failed;
33720- atomic_long_t mesq_noop;
33721- atomic_long_t mesq_send_unexpected_error;
33722- atomic_long_t mesq_send_lb_overflow;
33723- atomic_long_t mesq_send_qlimit_reached;
33724- atomic_long_t mesq_send_amo_nacked;
33725- atomic_long_t mesq_send_put_nacked;
33726- atomic_long_t mesq_page_overflow;
33727- atomic_long_t mesq_qf_locked;
33728- atomic_long_t mesq_qf_noop_not_full;
33729- atomic_long_t mesq_qf_switch_head_failed;
33730- atomic_long_t mesq_qf_unexpected_error;
33731- atomic_long_t mesq_noop_unexpected_error;
33732- atomic_long_t mesq_noop_lb_overflow;
33733- atomic_long_t mesq_noop_qlimit_reached;
33734- atomic_long_t mesq_noop_amo_nacked;
33735- atomic_long_t mesq_noop_put_nacked;
33736- atomic_long_t mesq_noop_page_overflow;
33737+ atomic_long_unchecked_t vdata_alloc;
33738+ atomic_long_unchecked_t vdata_free;
33739+ atomic_long_unchecked_t gts_alloc;
33740+ atomic_long_unchecked_t gts_free;
33741+ atomic_long_unchecked_t gms_alloc;
33742+ atomic_long_unchecked_t gms_free;
33743+ atomic_long_unchecked_t gts_double_allocate;
33744+ atomic_long_unchecked_t assign_context;
33745+ atomic_long_unchecked_t assign_context_failed;
33746+ atomic_long_unchecked_t free_context;
33747+ atomic_long_unchecked_t load_user_context;
33748+ atomic_long_unchecked_t load_kernel_context;
33749+ atomic_long_unchecked_t lock_kernel_context;
33750+ atomic_long_unchecked_t unlock_kernel_context;
33751+ atomic_long_unchecked_t steal_user_context;
33752+ atomic_long_unchecked_t steal_kernel_context;
33753+ atomic_long_unchecked_t steal_context_failed;
33754+ atomic_long_unchecked_t nopfn;
33755+ atomic_long_unchecked_t asid_new;
33756+ atomic_long_unchecked_t asid_next;
33757+ atomic_long_unchecked_t asid_wrap;
33758+ atomic_long_unchecked_t asid_reuse;
33759+ atomic_long_unchecked_t intr;
33760+ atomic_long_unchecked_t intr_cbr;
33761+ atomic_long_unchecked_t intr_tfh;
33762+ atomic_long_unchecked_t intr_spurious;
33763+ atomic_long_unchecked_t intr_mm_lock_failed;
33764+ atomic_long_unchecked_t call_os;
33765+ atomic_long_unchecked_t call_os_wait_queue;
33766+ atomic_long_unchecked_t user_flush_tlb;
33767+ atomic_long_unchecked_t user_unload_context;
33768+ atomic_long_unchecked_t user_exception;
33769+ atomic_long_unchecked_t set_context_option;
33770+ atomic_long_unchecked_t check_context_retarget_intr;
33771+ atomic_long_unchecked_t check_context_unload;
33772+ atomic_long_unchecked_t tlb_dropin;
33773+ atomic_long_unchecked_t tlb_preload_page;
33774+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
33775+ atomic_long_unchecked_t tlb_dropin_fail_upm;
33776+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
33777+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
33778+ atomic_long_unchecked_t tlb_dropin_fail_idle;
33779+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
33780+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
33781+ atomic_long_unchecked_t tfh_stale_on_fault;
33782+ atomic_long_unchecked_t mmu_invalidate_range;
33783+ atomic_long_unchecked_t mmu_invalidate_page;
33784+ atomic_long_unchecked_t flush_tlb;
33785+ atomic_long_unchecked_t flush_tlb_gru;
33786+ atomic_long_unchecked_t flush_tlb_gru_tgh;
33787+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
33788+
33789+ atomic_long_unchecked_t copy_gpa;
33790+ atomic_long_unchecked_t read_gpa;
33791+
33792+ atomic_long_unchecked_t mesq_receive;
33793+ atomic_long_unchecked_t mesq_receive_none;
33794+ atomic_long_unchecked_t mesq_send;
33795+ atomic_long_unchecked_t mesq_send_failed;
33796+ atomic_long_unchecked_t mesq_noop;
33797+ atomic_long_unchecked_t mesq_send_unexpected_error;
33798+ atomic_long_unchecked_t mesq_send_lb_overflow;
33799+ atomic_long_unchecked_t mesq_send_qlimit_reached;
33800+ atomic_long_unchecked_t mesq_send_amo_nacked;
33801+ atomic_long_unchecked_t mesq_send_put_nacked;
33802+ atomic_long_unchecked_t mesq_page_overflow;
33803+ atomic_long_unchecked_t mesq_qf_locked;
33804+ atomic_long_unchecked_t mesq_qf_noop_not_full;
33805+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
33806+ atomic_long_unchecked_t mesq_qf_unexpected_error;
33807+ atomic_long_unchecked_t mesq_noop_unexpected_error;
33808+ atomic_long_unchecked_t mesq_noop_lb_overflow;
33809+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
33810+ atomic_long_unchecked_t mesq_noop_amo_nacked;
33811+ atomic_long_unchecked_t mesq_noop_put_nacked;
33812+ atomic_long_unchecked_t mesq_noop_page_overflow;
58c5fc13 33813
58c5fc13 33814 };
58c5fc13 33815
ae4e228f
MT		 33816@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
33817 tghop_invalidate, mcsop_last};
58c5fc13 33818
ae4e228f
MT		 33819 struct mcs_op_statistic {
33820- atomic_long_t count;
33821- atomic_long_t total;
33822+ atomic_long_unchecked_t count;
33823+ atomic_long_unchecked_t total;
33824 unsigned long max;
58c5fc13
MT		 33825 };
33826
ae4e228f 33827@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
58c5fc13 33828
ae4e228f
MT		 33829 #define STAT(id) do { \
33830 if (gru_options & OPT_STATS) \
33831- atomic_long_inc(&gru_stats.id); \
33832+ atomic_long_inc_unchecked(&gru_stats.id); \
33833 } while (0)
58c5fc13 33834
ae4e228f 33835 #ifdef CONFIG_SGI_GRU_DEBUG
66a7e928
MT		 33836diff -urNp linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c
33837--- linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-19 00:06:34.000000000 -0400
33838+++ linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-22 19:36:31.000000000 -0400
33839@@ -2351,7 +2351,7 @@ xpc_received_payload_sn2(struct xpc_chan
33840 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
33841 }
33842
33843-static struct xpc_arch_operations xpc_arch_ops_sn2 = {
33844+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
33845 .setup_partitions = xpc_setup_partitions_sn2,
33846 .teardown_partitions = xpc_teardown_partitions_sn2,
33847 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
33848diff -urNp linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c
33849--- linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c 2011-05-19 00:06:34.000000000 -0400
33850+++ linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c 2011-05-22 19:36:31.000000000 -0400
33851@@ -1674,7 +1674,7 @@ xpc_received_payload_uv(struct xpc_chann
33852 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
33853 }
33854
33855-static struct xpc_arch_operations xpc_arch_ops_uv = {
33856+static const struct xpc_arch_operations xpc_arch_ops_uv = {
33857 .setup_partitions = xpc_setup_partitions_uv,
33858 .teardown_partitions = xpc_teardown_partitions_uv,
33859 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
33860diff -urNp linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c
33861--- linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c 2011-05-19 00:06:34.000000000 -0400
33862+++ linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c 2011-05-22 19:36:31.000000000 -0400
33863@@ -644,7 +644,7 @@ static ssize_t pcie_gadget_target_attr_s
33864 return ret;
33865 }
33866
33867-static struct configfs_item_operations pcie_gadget_target_item_ops = {
33868+static const struct configfs_item_operations pcie_gadget_target_item_ops = {
33869 .show_attribute = pcie_gadget_target_attr_show,
33870 .store_attribute = pcie_gadget_target_attr_store,
33871 };
33872diff -urNp linux-2.6.39/drivers/mmc/host/davinci_mmc.c linux-2.6.39/drivers/mmc/host/davinci_mmc.c
33873--- linux-2.6.39/drivers/mmc/host/davinci_mmc.c 2011-05-19 00:06:34.000000000 -0400
33874+++ linux-2.6.39/drivers/mmc/host/davinci_mmc.c 2011-05-22 19:36:31.000000000 -0400
33875@@ -1133,7 +1133,7 @@ static void mmc_davinci_enable_sdio_irq(
33876 }
33877 }
33878
33879-static struct mmc_host_ops mmc_davinci_ops = {
33880+static const struct mmc_host_ops mmc_davinci_ops = {
33881 .request = mmc_davinci_request,
33882 .set_ios = mmc_davinci_set_ios,
33883 .get_cd = mmc_davinci_get_cd,
33884diff -urNp linux-2.6.39/drivers/mmc/host/dw_mmc.c linux-2.6.39/drivers/mmc/host/dw_mmc.c
33885--- linux-2.6.39/drivers/mmc/host/dw_mmc.c 2011-05-19 00:06:34.000000000 -0400
33886+++ linux-2.6.39/drivers/mmc/host/dw_mmc.c 2011-05-22 19:36:31.000000000 -0400
33887@@ -417,7 +417,7 @@ static int dw_mci_idmac_init(struct dw_m
33888 return 0;
33889 }
33890
33891-static struct dw_mci_dma_ops dw_mci_idmac_ops = {
33892+static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
33893 .init = dw_mci_idmac_init,
33894 .start = dw_mci_idmac_start_dma,
33895 .stop = dw_mci_idmac_stop_dma,
33896diff -urNp linux-2.6.39/drivers/mmc/host/s3cmci.c linux-2.6.39/drivers/mmc/host/s3cmci.c
33897--- linux-2.6.39/drivers/mmc/host/s3cmci.c 2011-05-19 00:06:34.000000000 -0400
33898+++ linux-2.6.39/drivers/mmc/host/s3cmci.c 2011-05-22 19:36:31.000000000 -0400
33899@@ -1349,7 +1349,7 @@ static void s3cmci_enable_sdio_irq(struc
33900 s3cmci_check_sdio_irq(host);
33901 }
33902
33903-static struct mmc_host_ops s3cmci_ops = {
33904+static const struct mmc_host_ops s3cmci_ops = {
33905 .request = s3cmci_request,
33906 .set_ios = s3cmci_set_ios,
33907 .get_ro = s3cmci_get_ro,
33908diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c
33909--- linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-19 00:06:34.000000000 -0400
33910+++ linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-22 19:36:31.000000000 -0400
33911@@ -81,7 +81,7 @@ out:
33912 host->clock = clock;
33913 }
33914
33915-static struct sdhci_ops sdhci_cns3xxx_ops = {
33916+static const struct sdhci_ops sdhci_cns3xxx_ops = {
33917 .get_max_clock = sdhci_cns3xxx_get_max_clk,
33918 .set_clock = sdhci_cns3xxx_set_clock,
33919 };
33920diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-dove.c linux-2.6.39/drivers/mmc/host/sdhci-dove.c
33921--- linux-2.6.39/drivers/mmc/host/sdhci-dove.c 2011-05-19 00:06:34.000000000 -0400
33922+++ linux-2.6.39/drivers/mmc/host/sdhci-dove.c 2011-05-22 19:36:31.000000000 -0400
33923@@ -56,7 +56,7 @@ static u32 sdhci_dove_readl(struct sdhci
33924 return ret;
33925 }
33926
33927-static struct sdhci_ops sdhci_dove_ops = {
33928+static const struct sdhci_ops sdhci_dove_ops = {
33929 .read_w = sdhci_dove_readw,
33930 .read_l = sdhci_dove_readl,
33931 };
33932diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c
33933--- linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-19 00:06:34.000000000 -0400
33934+++ linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-22 19:36:31.000000000 -0400
33935@@ -201,7 +201,7 @@ static unsigned int esdhc_pltfm_get_ro(s
33936 return -ENOSYS;
33937 }
33938
33939-static struct sdhci_ops sdhci_esdhc_ops = {
33940+static const struct sdhci_ops sdhci_esdhc_ops = {
33941 .read_l = esdhc_readl_le,
33942 .read_w = esdhc_readw_le,
33943 .write_l = esdhc_writel_le,
33944diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-of.h linux-2.6.39/drivers/mmc/host/sdhci-of.h
33945--- linux-2.6.39/drivers/mmc/host/sdhci-of.h 2011-05-19 00:06:34.000000000 -0400
33946+++ linux-2.6.39/drivers/mmc/host/sdhci-of.h 2011-05-22 19:36:31.000000000 -0400
33947@@ -21,7 +21,7 @@
33948
33949 struct sdhci_of_data {
33950 unsigned int quirks;
33951- struct sdhci_ops ops;
33952+ const struct sdhci_ops ops;
33953 };
33954
33955 struct sdhci_of_host {
33956diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-pci.c linux-2.6.39/drivers/mmc/host/sdhci-pci.c
33957--- linux-2.6.39/drivers/mmc/host/sdhci-pci.c 2011-05-19 00:06:34.000000000 -0400
33958+++ linux-2.6.39/drivers/mmc/host/sdhci-pci.c 2011-05-22 19:36:31.000000000 -0400
33959@@ -786,7 +786,7 @@ static int sdhci_pci_enable_dma(struct s
33960 return 0;
33961 }
33962
33963-static struct sdhci_ops sdhci_pci_ops = {
33964+static const struct sdhci_ops sdhci_pci_ops = {
33965 .enable_dma = sdhci_pci_enable_dma,
33966 };
33967
33968diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c
33969--- linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c 2011-05-19 00:06:34.000000000 -0400
33970+++ linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c 2011-05-22 19:36:31.000000000 -0400
33971@@ -41,7 +41,7 @@
33972 * *
33973 \*****************************************************************************/
33974
33975-static struct sdhci_ops sdhci_pltfm_ops = {
33976+static const struct sdhci_ops sdhci_pltfm_ops = {
33977 };
33978
33979 /*****************************************************************************\
33980diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-pxa.c linux-2.6.39/drivers/mmc/host/sdhci-pxa.c
33981--- linux-2.6.39/drivers/mmc/host/sdhci-pxa.c 2011-05-19 00:06:34.000000000 -0400
33982+++ linux-2.6.39/drivers/mmc/host/sdhci-pxa.c 2011-05-22 19:36:31.000000000 -0400
33983@@ -69,7 +69,7 @@ static void set_clock(struct sdhci_host
33984 }
33985 }
33986
33987-static struct sdhci_ops sdhci_pxa_ops = {
33988+static const struct sdhci_ops sdhci_pxa_ops = {
33989 .set_clock = set_clock,
33990 };
33991
33992diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-s3c.c linux-2.6.39/drivers/mmc/host/sdhci-s3c.c
33993--- linux-2.6.39/drivers/mmc/host/sdhci-s3c.c 2011-05-19 00:06:34.000000000 -0400
33994+++ linux-2.6.39/drivers/mmc/host/sdhci-s3c.c 2011-05-22 19:36:31.000000000 -0400
33995@@ -309,7 +309,7 @@ static int sdhci_s3c_platform_8bit_width
33996 return 0;
33997 }
33998
33999-static struct sdhci_ops sdhci_s3c_ops = {
34000+static const struct sdhci_ops sdhci_s3c_ops = {
34001 .get_max_clock = sdhci_s3c_get_max_clk,
34002 .set_clock = sdhci_s3c_set_clock,
34003 .get_min_clock = sdhci_s3c_get_min_clock,
34004diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-spear.c linux-2.6.39/drivers/mmc/host/sdhci-spear.c
34005--- linux-2.6.39/drivers/mmc/host/sdhci-spear.c 2011-05-19 00:06:34.000000000 -0400
34006+++ linux-2.6.39/drivers/mmc/host/sdhci-spear.c 2011-05-22 19:36:31.000000000 -0400
34007@@ -32,7 +32,7 @@ struct spear_sdhci {
34008 };
34009
34010 /* sdhci ops */
34011-static struct sdhci_ops sdhci_pltfm_ops = {
34012+static const struct sdhci_ops sdhci_pltfm_ops = {
34013 /* Nothing to do for now. */
34014 };
34015
34016diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-tegra.c linux-2.6.39/drivers/mmc/host/sdhci-tegra.c
34017--- linux-2.6.39/drivers/mmc/host/sdhci-tegra.c 2011-05-19 00:06:34.000000000 -0400
34018+++ linux-2.6.39/drivers/mmc/host/sdhci-tegra.c 2011-05-22 19:36:31.000000000 -0400
34019@@ -242,7 +242,7 @@ static void tegra_sdhci_pltfm_exit(struc
34020 clk_put(pltfm_host->clk);
34021 }
34022
34023-static struct sdhci_ops tegra_sdhci_ops = {
34024+static const struct sdhci_ops tegra_sdhci_ops = {
34025 .get_ro = tegra_sdhci_get_ro,
34026 .read_l = tegra_sdhci_readl,
34027 .read_w = tegra_sdhci_readw,
34028diff -urNp linux-2.6.39/drivers/mmc/host/sdricoh_cs.c linux-2.6.39/drivers/mmc/host/sdricoh_cs.c
34029--- linux-2.6.39/drivers/mmc/host/sdricoh_cs.c 2011-05-19 00:06:34.000000000 -0400
34030+++ linux-2.6.39/drivers/mmc/host/sdricoh_cs.c 2011-05-22 19:36:31.000000000 -0400
34031@@ -387,7 +387,7 @@ static int sdricoh_get_ro(struct mmc_hos
34032 return (status & STATUS_CARD_LOCKED);
34033 }
34034
34035-static struct mmc_host_ops sdricoh_ops = {
34036+static const struct mmc_host_ops sdricoh_ops = {
34037 .request = sdricoh_request,
34038 .set_ios = sdricoh_set_ios,
34039 .get_ro = sdricoh_get_ro,
34040diff -urNp linux-2.6.39/drivers/mmc/host/sh_mmcif.c linux-2.6.39/drivers/mmc/host/sh_mmcif.c
34041--- linux-2.6.39/drivers/mmc/host/sh_mmcif.c 2011-05-19 00:06:34.000000000 -0400
34042+++ linux-2.6.39/drivers/mmc/host/sh_mmcif.c 2011-05-22 19:36:31.000000000 -0400
34043@@ -872,7 +872,7 @@ static int sh_mmcif_get_cd(struct mmc_ho
34044 return p->get_cd(host->pd);
34045 }
34046
34047-static struct mmc_host_ops sh_mmcif_ops = {
34048+static const struct mmc_host_ops sh_mmcif_ops = {
34049 .request = sh_mmcif_request,
34050 .set_ios = sh_mmcif_set_ios,
34051 .get_cd = sh_mmcif_get_cd,
34052diff -urNp linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c
34053--- linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-19 00:06:34.000000000 -0400
34054+++ linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-22 19:36:31.000000000 -0400
34055@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
34056 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
34057 unsigned long timeo = jiffies + HZ;
34058
34059+ pax_track_stack();
34060+
34061 /* Prevent setting state FL_SYNCING for chip in suspended state. */
34062 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
34063 goto sleep;
34064@@ -1657,6 +1659,8 @@ static int __xipram do_write_buffer(stru
34065 unsigned long initial_adr;
34066 int initial_len = len;
34067
34068+ pax_track_stack();
34069+
34070 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
34071 adr += chip->start;
34072 initial_adr = adr;
34073@@ -1875,6 +1879,8 @@ static int __xipram do_erase_oneblock(st
34074 int retries = 3;
34075 int ret;
34076
34077+ pax_track_stack();
34078+
34079 adr += chip->start;
34080
34081 retry:
34082diff -urNp linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c
34083--- linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-19 00:06:34.000000000 -0400
34084+++ linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-22 19:36:31.000000000 -0400
34085@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
34086 unsigned long cmd_addr;
34087 struct cfi_private *cfi = map->fldrv_priv;
34088
34089+ pax_track_stack();
34090+
34091 adr += chip->start;
34092
34093 /* Ensure cmd read/writes are aligned. */
34094@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
34095 DECLARE_WAITQUEUE(wait, current);
34096 int wbufsize, z;
34097
34098+ pax_track_stack();
34099+
34100 /* M58LW064A requires bus alignment for buffer wriets -- saw */
34101 if (adr & (map_bankwidth(map)-1))
34102 return -EINVAL;
34103@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
34104 DECLARE_WAITQUEUE(wait, current);
34105 int ret = 0;
34106
34107+ pax_track_stack();
34108+
34109 adr += chip->start;
34110
34111 /* Let's determine this according to the interleave only once */
34112@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
34113 unsigned long timeo = jiffies + HZ;
34114 DECLARE_WAITQUEUE(wait, current);
34115
34116+ pax_track_stack();
34117+
34118 adr += chip->start;
34119
34120 /* Let's determine this according to the interleave only once */
34121@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
34122 unsigned long timeo = jiffies + HZ;
34123 DECLARE_WAITQUEUE(wait, current);
34124
34125+ pax_track_stack();
34126+
34127 adr += chip->start;
34128
34129 /* Let's determine this according to the interleave only once */
34130diff -urNp linux-2.6.39/drivers/mtd/devices/doc2000.c linux-2.6.39/drivers/mtd/devices/doc2000.c
34131--- linux-2.6.39/drivers/mtd/devices/doc2000.c 2011-05-19 00:06:34.000000000 -0400
34132+++ linux-2.6.39/drivers/mtd/devices/doc2000.c 2011-05-22 19:36:31.000000000 -0400
58c5fc13
MT		 34133@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
34134
34135 /* The ECC will not be calculated correctly if less than 512 is written */
34136 /* DBB-
34137- if (len != 0x200 && eccbuf)
34138+ if (len != 0x200)
34139 printk(KERN_WARNING
34140 "ECC needs a full sector write (adr: %lx size %lx)\n",
34141 (long) to, (long) len);
66a7e928
MT		 34142diff -urNp linux-2.6.39/drivers/mtd/devices/doc2001.c linux-2.6.39/drivers/mtd/devices/doc2001.c
34143--- linux-2.6.39/drivers/mtd/devices/doc2001.c 2011-05-19 00:06:34.000000000 -0400
34144+++ linux-2.6.39/drivers/mtd/devices/doc2001.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 34145@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
34146 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
34147
58c5fc13 34148 /* Don't allow read past end of device */
ae4e228f
MT		 34149- if (from >= this->totlen)
34150+ if (from >= this->totlen || !len)
58c5fc13 34151 return -EINVAL;
58c5fc13
MT		 34152
34153 /* Don't allow a single read to cross a 512-byte block boundary */
66a7e928
MT		 34154diff -urNp linux-2.6.39/drivers/mtd/ftl.c linux-2.6.39/drivers/mtd/ftl.c
34155--- linux-2.6.39/drivers/mtd/ftl.c 2011-05-19 00:06:34.000000000 -0400
34156+++ linux-2.6.39/drivers/mtd/ftl.c 2011-05-22 19:36:31.000000000 -0400
34157@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
34158 loff_t offset;
34159 uint16_t srcunitswap = cpu_to_le16(srcunit);
34160
34161+ pax_track_stack();
34162+
34163 eun = &part->EUNInfo[srcunit];
34164 xfer = &part->XferInfo[xferunit];
34165 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
34166diff -urNp linux-2.6.39/drivers/mtd/inftlcore.c linux-2.6.39/drivers/mtd/inftlcore.c
34167--- linux-2.6.39/drivers/mtd/inftlcore.c 2011-05-19 00:06:34.000000000 -0400
34168+++ linux-2.6.39/drivers/mtd/inftlcore.c 2011-05-22 19:36:31.000000000 -0400
34169@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
34170 struct inftl_oob oob;
34171 size_t retlen;
34172
34173+ pax_track_stack();
34174+
34175 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
34176 "pending=%d)\n", inftl, thisVUC, pendingblock);
34177
34178diff -urNp linux-2.6.39/drivers/mtd/inftlmount.c linux-2.6.39/drivers/mtd/inftlmount.c
34179--- linux-2.6.39/drivers/mtd/inftlmount.c 2011-05-19 00:06:34.000000000 -0400
34180+++ linux-2.6.39/drivers/mtd/inftlmount.c 2011-05-22 19:36:31.000000000 -0400
34181@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
34182 struct INFTLPartition *ip;
34183 size_t retlen;
34184
34185+ pax_track_stack();
34186+
34187 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
34188
34189 /*
34190diff -urNp linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c
34191--- linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c 2011-05-19 00:06:34.000000000 -0400
34192+++ linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c 2011-05-22 19:36:31.000000000 -0400
34193@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
34194 {
34195 map_word pfow_val[4];
34196
34197+ pax_track_stack();
34198+
34199 /* Check identification string */
34200 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
34201 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
34202diff -urNp linux-2.6.39/drivers/mtd/mtdchar.c linux-2.6.39/drivers/mtd/mtdchar.c
34203--- linux-2.6.39/drivers/mtd/mtdchar.c 2011-05-19 00:06:34.000000000 -0400
34204+++ linux-2.6.39/drivers/mtd/mtdchar.c 2011-05-22 19:36:31.000000000 -0400
34205@@ -560,6 +560,8 @@ static int mtd_ioctl(struct file *file,
34206 u_long size;
34207 struct mtd_info_user info;
34208
34209+ pax_track_stack();
34210+
34211 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
34212
34213 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
34214diff -urNp linux-2.6.39/drivers/mtd/nand/denali.c linux-2.6.39/drivers/mtd/nand/denali.c
34215--- linux-2.6.39/drivers/mtd/nand/denali.c 2011-05-19 00:06:34.000000000 -0400
34216+++ linux-2.6.39/drivers/mtd/nand/denali.c 2011-05-22 19:36:31.000000000 -0400
6892158b 34217@@ -25,6 +25,7 @@
57199397
MT		 34218 #include <linux/pci.h>
34219 #include <linux/mtd/mtd.h>
34220 #include <linux/module.h>
34221+#include <linux/slab.h>
34222
34223 #include "denali.h"
34224
66a7e928
MT		 34225diff -urNp linux-2.6.39/drivers/mtd/nftlcore.c linux-2.6.39/drivers/mtd/nftlcore.c
34226--- linux-2.6.39/drivers/mtd/nftlcore.c 2011-05-19 00:06:34.000000000 -0400
34227+++ linux-2.6.39/drivers/mtd/nftlcore.c 2011-05-22 19:36:31.000000000 -0400
34228@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
34229 int inplace = 1;
34230 size_t retlen;
34231
34232+ pax_track_stack();
34233+
34234 memset(BlockMap, 0xff, sizeof(BlockMap));
34235 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
34236
34237diff -urNp linux-2.6.39/drivers/mtd/nftlmount.c linux-2.6.39/drivers/mtd/nftlmount.c
34238--- linux-2.6.39/drivers/mtd/nftlmount.c 2011-05-19 00:06:34.000000000 -0400
34239+++ linux-2.6.39/drivers/mtd/nftlmount.c 2011-05-22 19:36:31.000000000 -0400
34240@@ -24,6 +24,7 @@
34241 #include <asm/errno.h>
34242 #include <linux/delay.h>
34243 #include <linux/slab.h>
34244+#include <linux/sched.h>
34245 #include <linux/mtd/mtd.h>
34246 #include <linux/mtd/nand.h>
34247 #include <linux/mtd/nftl.h>
34248@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
34249 struct mtd_info *mtd = nftl->mbd.mtd;
34250 unsigned int i;
34251
34252+ pax_track_stack();
34253+
34254 /* Assume logical EraseSize == physical erasesize for starting the scan.
34255 We'll sort it out later if we find a MediaHeader which says otherwise */
34256 /* Actually, we won't. The new DiskOnChip driver has already scanned
34257diff -urNp linux-2.6.39/drivers/mtd/ubi/build.c linux-2.6.39/drivers/mtd/ubi/build.c
34258--- linux-2.6.39/drivers/mtd/ubi/build.c 2011-05-19 00:06:34.000000000 -0400
34259+++ linux-2.6.39/drivers/mtd/ubi/build.c 2011-05-22 19:36:31.000000000 -0400
34260@@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
ae4e228f
MT		 34261 static int __init bytes_str_to_int(const char *str)
34262 {
34263 char *endp;
34264- unsigned long result;
34265+ unsigned long result, scale = 1;
58c5fc13
MT		 34266
34267 result = simple_strtoul(str, &endp, 0);
ae4e228f 34268 if (str == endp || result >= INT_MAX) {
66a7e928 34269@@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
ae4e228f
MT		 34270
34271 switch (*endp) {
34272 case 'G':
34273- result *= 1024;
34274+ scale *= 1024;
34275 case 'M':
34276- result *= 1024;
34277+ scale *= 1024;
34278 case 'K':
34279- result *= 1024;
34280+ scale *= 1024;
34281 if (endp[1] == 'i' && endp[2] == 'B')
34282 endp += 2;
34283 case '\0':
66a7e928 34284@@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
58c5fc13 34285 return -EINVAL;
ae4e228f
MT		 34286 }
34287
34288- return result;
34289+ if ((intoverflow_t)result*scale >= INT_MAX) {
34290+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
34291+ str);
34292+ return -EINVAL;
34293+ }
34294+
34295+ return result*scale;
34296 }
34297
34298 /**
66a7e928
MT		 34299diff -urNp linux-2.6.39/drivers/net/bcm63xx_enet.c linux-2.6.39/drivers/net/bcm63xx_enet.c
34300--- linux-2.6.39/drivers/net/bcm63xx_enet.c 2011-05-19 00:06:34.000000000 -0400
34301+++ linux-2.6.39/drivers/net/bcm63xx_enet.c 2011-05-22 19:36:31.000000000 -0400
34302@@ -1469,7 +1469,7 @@ static int bcm_enet_set_pauseparam(struc
34303 return 0;
34304 }
34305
34306-static struct ethtool_ops bcm_enet_ethtool_ops = {
34307+static const struct ethtool_ops bcm_enet_ethtool_ops = {
34308 .get_strings = bcm_enet_get_strings,
34309 .get_sset_count = bcm_enet_get_sset_count,
34310 .get_ethtool_stats = bcm_enet_get_ethtool_stats,
34311diff -urNp linux-2.6.39/drivers/net/bna/bnad_ethtool.c linux-2.6.39/drivers/net/bna/bnad_ethtool.c
34312--- linux-2.6.39/drivers/net/bna/bnad_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34313+++ linux-2.6.39/drivers/net/bna/bnad_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34314@@ -1242,7 +1242,7 @@ bnad_get_sset_count(struct net_device *n
34315 }
34316 }
34317
34318-static struct ethtool_ops bnad_ethtool_ops = {
34319+static const struct ethtool_ops bnad_ethtool_ops = {
34320 .get_settings = bnad_get_settings,
34321 .set_settings = bnad_set_settings,
34322 .get_drvinfo = bnad_get_drvinfo,
34323diff -urNp linux-2.6.39/drivers/net/bnx2.c linux-2.6.39/drivers/net/bnx2.c
34324--- linux-2.6.39/drivers/net/bnx2.c 2011-05-19 00:06:34.000000000 -0400
34325+++ linux-2.6.39/drivers/net/bnx2.c 2011-05-22 19:36:31.000000000 -0400
34326@@ -5828,6 +5828,8 @@ bnx2_test_nvram(struct bnx2 *bp)
34327 int rc = 0;
34328 u32 magic, csum;
34329
34330+ pax_track_stack();
34331+
34332 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
34333 goto test_nvram_done;
34334
34335diff -urNp linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c
34336--- linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34337+++ linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34338@@ -1788,6 +1788,8 @@ static int bnx2x_test_nvram(struct bnx2x
34339 int i, rc;
34340 u32 magic, crc;
34341
34342+ pax_track_stack();
34343+
34344 if (BP_NOMCP(bp))
34345 return 0;
34346
34347diff -urNp linux-2.6.39/drivers/net/chelsio/pm3393.c linux-2.6.39/drivers/net/chelsio/pm3393.c
34348--- linux-2.6.39/drivers/net/chelsio/pm3393.c 2011-05-19 00:06:34.000000000 -0400
34349+++ linux-2.6.39/drivers/net/chelsio/pm3393.c 2011-05-22 19:36:31.000000000 -0400
34350@@ -571,7 +571,7 @@ static void pm3393_destroy(struct cmac *
34351 kfree(cmac);
34352 }
34353
34354-static struct cmac_ops pm3393_ops = {
34355+static const struct cmac_ops pm3393_ops = {
34356 .destroy = pm3393_destroy,
34357 .reset = pm3393_reset,
34358 .interrupt_enable = pm3393_interrupt_enable,
34359diff -urNp linux-2.6.39/drivers/net/chelsio/vsc7326.c linux-2.6.39/drivers/net/chelsio/vsc7326.c
34360--- linux-2.6.39/drivers/net/chelsio/vsc7326.c 2011-05-19 00:06:34.000000000 -0400
34361+++ linux-2.6.39/drivers/net/chelsio/vsc7326.c 2011-05-22 19:36:31.000000000 -0400
34362@@ -666,7 +666,7 @@ static void mac_destroy(struct cmac *mac
34363 kfree(mac);
34364 }
34365
34366-static struct cmac_ops vsc7326_ops = {
34367+static const struct cmac_ops vsc7326_ops = {
34368 .destroy = mac_destroy,
34369 .reset = mac_reset,
34370 .interrupt_handler = mac_intr_handler,
34371diff -urNp linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c
34372--- linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c 2011-05-19 00:06:34.000000000 -0400
34373+++ linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c 2011-05-22 19:36:31.000000000 -0400
34374@@ -3428,6 +3428,8 @@ static int __devinit enable_msix(struct
34375 unsigned int nchan = adap->params.nports;
34376 struct msix_entry entries[MAX_INGQ + 1];
34377
34378+ pax_track_stack();
34379+
34380 for (i = 0; i < ARRAY_SIZE(entries); ++i)
34381 entries[i].entry = i;
34382
34383diff -urNp linux-2.6.39/drivers/net/cxgb4/t4_hw.c linux-2.6.39/drivers/net/cxgb4/t4_hw.c
34384--- linux-2.6.39/drivers/net/cxgb4/t4_hw.c 2011-05-19 00:06:34.000000000 -0400
34385+++ linux-2.6.39/drivers/net/cxgb4/t4_hw.c 2011-05-22 19:36:31.000000000 -0400
34386@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
34387 u8 vpd[VPD_LEN], csum;
34388 unsigned int vpdr_len, kw_offset, id_len;
34389
34390+ pax_track_stack();
34391+
34392 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
34393 if (ret < 0)
34394 return ret;
34395diff -urNp linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c
34396--- linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-19 00:06:34.000000000 -0400
34397+++ linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-22 19:36:31.000000000 -0400
34398@@ -1572,7 +1572,7 @@ static int cxgb4vf_set_tso(struct net_de
34399 return 0;
34400 }
34401
34402-static struct ethtool_ops cxgb4vf_ethtool_ops = {
34403+static const struct ethtool_ops cxgb4vf_ethtool_ops = {
34404 .get_settings = cxgb4vf_get_settings,
34405 .get_drvinfo = cxgb4vf_get_drvinfo,
34406 .get_msglevel = cxgb4vf_get_msglevel,
34407diff -urNp linux-2.6.39/drivers/net/e1000e/82571.c linux-2.6.39/drivers/net/e1000e/82571.c
34408--- linux-2.6.39/drivers/net/e1000e/82571.c 2011-05-19 00:06:34.000000000 -0400
34409+++ linux-2.6.39/drivers/net/e1000e/82571.c 2011-05-22 19:36:31.000000000 -0400
16454cff 34410@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
ae4e228f
MT		 34411 {
34412 struct e1000_hw *hw = &adapter->hw;
34413 struct e1000_mac_info *mac = &hw->mac;
16454cff
MT		 34414- struct e1000_mac_operations *func = &mac->ops;
34415+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
ae4e228f
MT		 34416 u32 swsm = 0;
34417 u32 swsm2 = 0;
16454cff
MT		 34418 bool force_clear_smbi = false;
34419@@ -1930,7 +1930,7 @@ static void e1000_clear_hw_cntrs_82571(s
ae4e228f
MT		 34420 er32(ICRXDMTC);
34421 }
34422
34423-static struct e1000_mac_operations e82571_mac_ops = {
34424+static const struct e1000_mac_operations e82571_mac_ops = {
34425 /* .check_mng_mode: mac type dependent */
34426 /* .check_for_link: media type dependent */
34427 .id_led_init = e1000e_id_led_init,
16454cff 34428@@ -1952,7 +1952,7 @@ static struct e1000_mac_operations e8257
df50ba0c 34429 .read_mac_addr = e1000_read_mac_addr_82571,
ae4e228f
MT		 34430 };
34431
34432-static struct e1000_phy_operations e82_phy_ops_igp = {
34433+static const struct e1000_phy_operations e82_phy_ops_igp = {
34434 .acquire = e1000_get_hw_semaphore_82571,
34435 .check_polarity = e1000_check_polarity_igp,
34436 .check_reset_block = e1000e_check_reset_block_generic,
16454cff 34437@@ -1970,7 +1970,7 @@ static struct e1000_phy_operations e82_p
ae4e228f
MT		 34438 .cfg_on_link_up = NULL,
34439 };
34440
34441-static struct e1000_phy_operations e82_phy_ops_m88 = {
34442+static const struct e1000_phy_operations e82_phy_ops_m88 = {
34443 .acquire = e1000_get_hw_semaphore_82571,
34444 .check_polarity = e1000_check_polarity_m88,
34445 .check_reset_block = e1000e_check_reset_block_generic,
16454cff 34446@@ -1988,7 +1988,7 @@ static struct e1000_phy_operations e82_p
ae4e228f
MT		 34447 .cfg_on_link_up = NULL,
34448 };
34449
34450-static struct e1000_phy_operations e82_phy_ops_bm = {
34451+static const struct e1000_phy_operations e82_phy_ops_bm = {
34452 .acquire = e1000_get_hw_semaphore_82571,
34453 .check_polarity = e1000_check_polarity_m88,
34454 .check_reset_block = e1000e_check_reset_block_generic,
16454cff 34455@@ -2006,7 +2006,7 @@ static struct e1000_phy_operations e82_p
ae4e228f
MT		 34456 .cfg_on_link_up = NULL,
34457 };
34458
34459-static struct e1000_nvm_operations e82571_nvm_ops = {
34460+static const struct e1000_nvm_operations e82571_nvm_ops = {
34461 .acquire = e1000_acquire_nvm_82571,
34462 .read = e1000e_read_nvm_eerd,
34463 .release = e1000_release_nvm_82571,
66a7e928
MT		 34464diff -urNp linux-2.6.39/drivers/net/e1000e/e1000.h linux-2.6.39/drivers/net/e1000e/e1000.h
34465--- linux-2.6.39/drivers/net/e1000e/e1000.h 2011-05-19 00:06:34.000000000 -0400
34466+++ linux-2.6.39/drivers/net/e1000e/e1000.h 2011-05-22 19:36:31.000000000 -0400
34467@@ -409,9 +409,9 @@ struct e1000_info {
ae4e228f
MT		 34468 u32 pba;
34469 u32 max_hw_frame_size;
34470 s32 (*get_variants)(struct e1000_adapter *);
34471- struct e1000_mac_operations *mac_ops;
34472- struct e1000_phy_operations *phy_ops;
34473- struct e1000_nvm_operations *nvm_ops;
34474+ const struct e1000_mac_operations *mac_ops;
34475+ const struct e1000_phy_operations *phy_ops;
34476+ const struct e1000_nvm_operations *nvm_ops;
34477 };
34478
34479 /* hardware capability, feature, and workaround flags */
66a7e928
MT		 34480diff -urNp linux-2.6.39/drivers/net/e1000e/es2lan.c linux-2.6.39/drivers/net/e1000e/es2lan.c
34481--- linux-2.6.39/drivers/net/e1000e/es2lan.c 2011-05-19 00:06:34.000000000 -0400
34482+++ linux-2.6.39/drivers/net/e1000e/es2lan.c 2011-05-22 19:36:31.000000000 -0400
16454cff 34483@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
ae4e228f
MT		 34484 {
34485 struct e1000_hw *hw = &adapter->hw;
34486 struct e1000_mac_info *mac = &hw->mac;
16454cff
MT		 34487- struct e1000_mac_operations *func = &mac->ops;
34488+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
ae4e228f
MT		 34489
34490 /* Set media type */
16454cff
MT		 34491 switch (adapter->pdev->device) {
34492@@ -1431,7 +1431,7 @@ static void e1000_clear_hw_cntrs_80003es
ae4e228f
MT		 34493 er32(ICRXDMTC);
34494 }
34495
34496-static struct e1000_mac_operations es2_mac_ops = {
34497+static const struct e1000_mac_operations es2_mac_ops = {
df50ba0c 34498 .read_mac_addr = e1000_read_mac_addr_80003es2lan,
ae4e228f
MT		 34499 .id_led_init = e1000e_id_led_init,
34500 .check_mng_mode = e1000e_check_mng_mode_generic,
16454cff 34501@@ -1453,7 +1453,7 @@ static struct e1000_mac_operations es2_m
ae4e228f
MT		 34502 .setup_led = e1000e_setup_led_generic,
34503 };
34504
34505-static struct e1000_phy_operations es2_phy_ops = {
34506+static const struct e1000_phy_operations es2_phy_ops = {
34507 .acquire = e1000_acquire_phy_80003es2lan,
34508 .check_polarity = e1000_check_polarity_m88,
34509 .check_reset_block = e1000e_check_reset_block_generic,
16454cff 34510@@ -1471,7 +1471,7 @@ static struct e1000_phy_operations es2_p
ae4e228f
MT		 34511 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
34512 };
34513
34514-static struct e1000_nvm_operations es2_nvm_ops = {
34515+static const struct e1000_nvm_operations es2_nvm_ops = {
34516 .acquire = e1000_acquire_nvm_80003es2lan,
34517 .read = e1000e_read_nvm_eerd,
34518 .release = e1000_release_nvm_80003es2lan,
66a7e928
MT		 34519diff -urNp linux-2.6.39/drivers/net/e1000e/hw.h linux-2.6.39/drivers/net/e1000e/hw.h
34520--- linux-2.6.39/drivers/net/e1000e/hw.h 2011-05-19 00:06:34.000000000 -0400
34521+++ linux-2.6.39/drivers/net/e1000e/hw.h 2011-05-22 19:36:31.000000000 -0400
34522@@ -811,6 +811,7 @@ struct e1000_nvm_operations {
ae4e228f
MT		 34523 };
34524
34525 struct e1000_mac_info {
bc901d79
MT		 34526+ /* cannot be const see e1000_init_mac_params_ich8lan */
34527 struct e1000_mac_operations ops;
66a7e928
MT		 34528 u8 addr[ETH_ALEN];
34529 u8 perm_addr[ETH_ALEN];
34530@@ -852,6 +853,7 @@ struct e1000_mac_info {
bc901d79
MT		 34531 };
34532
34533 struct e1000_phy_info {
34534+ /* Cannot be const see e1000_init_phy_params_82571() */
34535 struct e1000_phy_operations ops;
34536
34537 enum e1000_phy_type type;
66a7e928 34538@@ -886,6 +888,7 @@ struct e1000_phy_info {
ae4e228f
MT		 34539 };
34540
34541 struct e1000_nvm_info {
34542+ /* cannot be const */
34543 struct e1000_nvm_operations ops;
34544
34545 enum e1000_nvm_type type;
66a7e928
MT		 34546diff -urNp linux-2.6.39/drivers/net/e1000e/ich8lan.c linux-2.6.39/drivers/net/e1000e/ich8lan.c
34547--- linux-2.6.39/drivers/net/e1000e/ich8lan.c 2011-05-19 00:06:34.000000000 -0400
34548+++ linux-2.6.39/drivers/net/e1000e/ich8lan.c 2011-05-22 19:36:31.000000000 -0400
34549@@ -3866,7 +3866,7 @@ static void e1000_clear_hw_cntrs_ich8lan
ae4e228f
MT		 34550 }
34551 }
34552
34553-static struct e1000_mac_operations ich8_mac_ops = {
34554+static const struct e1000_mac_operations ich8_mac_ops = {
34555 .id_led_init = e1000e_id_led_init,
6892158b 34556 /* check_mng_mode dependent on mac type */
ae4e228f 34557 .check_for_link = e1000_check_for_copper_link_ich8lan,
66a7e928 34558@@ -3885,7 +3885,7 @@ static struct e1000_mac_operations ich8_
ae4e228f
MT		 34559 /* id_led_init dependent on mac type */
34560 };
34561
34562-static struct e1000_phy_operations ich8_phy_ops = {
34563+static const struct e1000_phy_operations ich8_phy_ops = {
34564 .acquire = e1000_acquire_swflag_ich8lan,
34565 .check_reset_block = e1000_check_reset_block_ich8lan,
34566 .commit = NULL,
66a7e928 34567@@ -3899,7 +3899,7 @@ static struct e1000_phy_operations ich8_
ae4e228f
MT		 34568 .write_reg = e1000e_write_phy_reg_igp,
34569 };
34570
34571-static struct e1000_nvm_operations ich8_nvm_ops = {
34572+static const struct e1000_nvm_operations ich8_nvm_ops = {
34573 .acquire = e1000_acquire_nvm_ich8lan,
34574 .read = e1000_read_nvm_ich8lan,
34575 .release = e1000_release_nvm_ich8lan,
66a7e928
MT		 34576diff -urNp linux-2.6.39/drivers/net/greth.c linux-2.6.39/drivers/net/greth.c
34577--- linux-2.6.39/drivers/net/greth.c 2011-05-19 00:06:34.000000000 -0400
34578+++ linux-2.6.39/drivers/net/greth.c 2011-05-22 19:36:31.000000000 -0400
34579@@ -1192,7 +1192,7 @@ static const struct ethtool_ops greth_et
34580 .get_link = ethtool_op_get_link,
34581 };
34582
34583-static struct net_device_ops greth_netdev_ops = {
34584+static const struct net_device_ops greth_netdev_ops = {
34585 .ndo_open = greth_open,
34586 .ndo_stop = greth_close,
34587 .ndo_start_xmit = greth_start_xmit,
34588diff -urNp linux-2.6.39/drivers/net/hamradio/6pack.c linux-2.6.39/drivers/net/hamradio/6pack.c
34589--- linux-2.6.39/drivers/net/hamradio/6pack.c 2011-05-19 00:06:34.000000000 -0400
34590+++ linux-2.6.39/drivers/net/hamradio/6pack.c 2011-05-22 19:36:31.000000000 -0400
34591@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
34592 unsigned char buf[512];
34593 int count1;
34594
34595+ pax_track_stack();
34596+
34597 if (!count)
34598 return;
34599
34600diff -urNp linux-2.6.39/drivers/net/ibm_newemac/phy.c linux-2.6.39/drivers/net/ibm_newemac/phy.c
34601--- linux-2.6.39/drivers/net/ibm_newemac/phy.c 2011-05-19 00:06:34.000000000 -0400
34602+++ linux-2.6.39/drivers/net/ibm_newemac/phy.c 2011-05-22 19:36:31.000000000 -0400
34603@@ -273,7 +273,7 @@ static int genmii_read_link(struct mii_p
34604 }
34605
34606 /* Generic implementation for most 10/100/1000 PHYs */
34607-static struct mii_phy_ops generic_phy_ops = {
34608+static const struct mii_phy_ops generic_phy_ops = {
34609 .setup_aneg = genmii_setup_aneg,
34610 .setup_forced = genmii_setup_forced,
34611 .poll_link = genmii_poll_link,
34612@@ -337,7 +337,7 @@ static int cis8201_init(struct mii_phy *
34613 return 0;
34614 }
34615
34616-static struct mii_phy_ops cis8201_phy_ops = {
34617+static const struct mii_phy_ops cis8201_phy_ops = {
34618 .init = cis8201_init,
34619 .setup_aneg = genmii_setup_aneg,
34620 .setup_forced = genmii_setup_forced,
34621@@ -417,7 +417,7 @@ static int et1011c_init(struct mii_phy *
34622 return 0;
34623 }
34624
34625-static struct mii_phy_ops et1011c_phy_ops = {
34626+static const struct mii_phy_ops et1011c_phy_ops = {
34627 .init = et1011c_init,
34628 .setup_aneg = genmii_setup_aneg,
34629 .setup_forced = genmii_setup_forced,
34630@@ -436,7 +436,7 @@ static struct mii_phy_def et1011c_phy_de
34631
34632
34633
34634-static struct mii_phy_ops m88e1111_phy_ops = {
34635+static const struct mii_phy_ops m88e1111_phy_ops = {
34636 .init = m88e1111_init,
34637 .setup_aneg = genmii_setup_aneg,
34638 .setup_forced = genmii_setup_forced,
34639@@ -452,7 +452,7 @@ static struct mii_phy_def m88e1111_phy_d
34640 .ops = &m88e1111_phy_ops,
34641 };
34642
34643-static struct mii_phy_ops m88e1112_phy_ops = {
34644+static const struct mii_phy_ops m88e1112_phy_ops = {
34645 .init = m88e1112_init,
34646 .setup_aneg = genmii_setup_aneg,
34647 .setup_forced = genmii_setup_forced,
34648diff -urNp linux-2.6.39/drivers/net/ibmveth.c linux-2.6.39/drivers/net/ibmveth.c
34649--- linux-2.6.39/drivers/net/ibmveth.c 2011-05-19 00:06:34.000000000 -0400
34650+++ linux-2.6.39/drivers/net/ibmveth.c 2011-05-22 19:36:31.000000000 -0400
34651@@ -1625,7 +1625,7 @@ static struct vio_device_id ibmveth_devi
34652 };
34653 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
34654
34655-static struct dev_pm_ops ibmveth_pm_ops = {
34656+static const struct dev_pm_ops ibmveth_pm_ops = {
34657 .resume = ibmveth_resume
34658 };
34659
34660diff -urNp linux-2.6.39/drivers/net/igb/e1000_82575.c linux-2.6.39/drivers/net/igb/e1000_82575.c
34661--- linux-2.6.39/drivers/net/igb/e1000_82575.c 2011-05-19 00:06:34.000000000 -0400
34662+++ linux-2.6.39/drivers/net/igb/e1000_82575.c 2011-05-22 19:36:31.000000000 -0400
34663@@ -2029,7 +2029,7 @@ out:
ae4e228f
MT		 34664 return ret_val;
34665 }
34666
34667-static struct e1000_mac_operations e1000_mac_ops_82575 = {
34668+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
34669 .init_hw = igb_init_hw_82575,
34670 .check_for_link = igb_check_for_link_82575,
34671 .rar_set = igb_rar_set,
66a7e928 34672@@ -2037,13 +2037,13 @@ static struct e1000_mac_operations e1000
ae4e228f
MT		 34673 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
34674 };
34675
34676-static struct e1000_phy_operations e1000_phy_ops_82575 = {
34677+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
34678 .acquire = igb_acquire_phy_82575,
34679 .get_cfg_done = igb_get_cfg_done_82575,
34680 .release = igb_release_phy_82575,
34681 };
34682
34683-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34684+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34685 .acquire = igb_acquire_nvm_82575,
34686 .read = igb_read_nvm_eerd,
34687 .release = igb_release_nvm_82575,
66a7e928
MT		 34688diff -urNp linux-2.6.39/drivers/net/igb/e1000_hw.h linux-2.6.39/drivers/net/igb/e1000_hw.h
34689--- linux-2.6.39/drivers/net/igb/e1000_hw.h 2011-05-19 00:06:34.000000000 -0400
34690+++ linux-2.6.39/drivers/net/igb/e1000_hw.h 2011-05-22 19:36:31.000000000 -0400
34691@@ -342,14 +342,15 @@ struct e1000_nvm_operations {
ae4e228f
MT		 34692
34693 struct e1000_info {
34694 s32 (*get_invariants)(struct e1000_hw *);
34695- struct e1000_mac_operations *mac_ops;
34696- struct e1000_phy_operations *phy_ops;
34697- struct e1000_nvm_operations *nvm_ops;
34698+ const struct e1000_mac_operations *mac_ops;
34699+ const struct e1000_phy_operations *phy_ops;
34700+ const struct e1000_nvm_operations *nvm_ops;
34701 };
34702
34703 extern const struct e1000_info e1000_82575_info;
bc901d79
MT		 34704
34705 struct e1000_mac_info {
34706+ /* cannot be const see igb_get_invariants_82575() */
34707 struct e1000_mac_operations ops;
34708
34709 u8 addr[6];
66a7e928 34710@@ -388,6 +389,7 @@ struct e1000_mac_info {
bc901d79
MT		 34711 };
34712
34713 struct e1000_phy_info {
34714+ /* cannot be const see igb_get_invariants_82575() */
34715 struct e1000_phy_operations ops;
34716
34717 enum e1000_phy_type type;
66a7e928 34718@@ -423,6 +425,7 @@ struct e1000_phy_info {
ae4e228f
MT		 34719 };
34720
34721 struct e1000_nvm_info {
34722+ /* cannot be const */
34723 struct e1000_nvm_operations ops;
ae4e228f 34724 enum e1000_nvm_type type;
66a7e928
MT		 34725 enum e1000_nvm_override override;
34726diff -urNp linux-2.6.39/drivers/net/igbvf/vf.h linux-2.6.39/drivers/net/igbvf/vf.h
34727--- linux-2.6.39/drivers/net/igbvf/vf.h 2011-05-19 00:06:34.000000000 -0400
34728+++ linux-2.6.39/drivers/net/igbvf/vf.h 2011-05-22 19:36:31.000000000 -0400
16454cff 34729@@ -191,6 +191,7 @@ struct e1000_mac_operations {
bc901d79
MT		 34730 };
34731
34732 struct e1000_mac_info {
34733+ /* cannot be const see e1000_init_mac_params_vf() */
34734 struct e1000_mac_operations ops;
34735 u8 addr[6];
34736 u8 perm_addr[6];
66a7e928
MT		 34737diff -urNp linux-2.6.39/drivers/net/irda/sh_irda.c linux-2.6.39/drivers/net/irda/sh_irda.c
34738--- linux-2.6.39/drivers/net/irda/sh_irda.c 2011-05-19 00:06:34.000000000 -0400
34739+++ linux-2.6.39/drivers/net/irda/sh_irda.c 2011-05-22 19:36:31.000000000 -0400
34740@@ -307,7 +307,7 @@ static int xir_fte(struct sh_irda_self *
34741 return 0;
34742 }
34743
34744-static struct sh_irda_xir_func xir_func = {
34745+static const struct sh_irda_xir_func xir_func = {
34746 .xir_fre = xir_fre,
34747 .xir_trov = xir_trov,
34748 .xir_9 = xir_9,
34749@@ -321,7 +321,7 @@ static struct sh_irda_xir_func xir_func
34750 *
34751 * MIR/FIR are not supported now
34752 *=====================================*/
34753-static struct sh_irda_xir_func mfir_func = {
34754+static const struct sh_irda_xir_func mfir_func = {
34755 .xir_fre = xir_fre,
34756 .xir_trov = xir_trov,
34757 .xir_9 = xir_9,
34758@@ -400,7 +400,7 @@ static int sir_fte(struct sh_irda_self *
34759 return 0;
34760 }
34761
34762-static struct sh_irda_xir_func sir_func = {
34763+static const struct sh_irda_xir_func sir_func = {
34764 .xir_fre = sir_fre,
34765 .xir_trov = sir_trov,
34766 .xir_9 = sir_tot,
34767@@ -411,7 +411,7 @@ static struct sh_irda_xir_func sir_func
34768 static void sh_irda_set_mode(struct sh_irda_self *self, enum sh_irda_mode mode)
34769 {
34770 struct device *dev = &self->ndev->dev;
34771- struct sh_irda_xir_func *func;
34772+ const struct sh_irda_xir_func *func;
34773 const char *name;
34774 u16 data;
34775
34776diff -urNp linux-2.6.39/drivers/net/ixgb/ixgb_main.c linux-2.6.39/drivers/net/ixgb/ixgb_main.c
34777--- linux-2.6.39/drivers/net/ixgb/ixgb_main.c 2011-05-19 00:06:34.000000000 -0400
34778+++ linux-2.6.39/drivers/net/ixgb/ixgb_main.c 2011-05-22 19:36:31.000000000 -0400
34779@@ -1069,6 +1069,8 @@ ixgb_set_multi(struct net_device *netdev
34780 u32 rctl;
34781 int i;
34782
34783+ pax_track_stack();
34784+
34785 /* Check for Promiscuous and All Multicast modes */
34786
34787 rctl = IXGB_READ_REG(hw, RCTL);
34788diff -urNp linux-2.6.39/drivers/net/ixgb/ixgb_param.c linux-2.6.39/drivers/net/ixgb/ixgb_param.c
34789--- linux-2.6.39/drivers/net/ixgb/ixgb_param.c 2011-05-19 00:06:34.000000000 -0400
34790+++ linux-2.6.39/drivers/net/ixgb/ixgb_param.c 2011-05-22 19:36:31.000000000 -0400
34791@@ -261,6 +261,9 @@ void __devinit
34792 ixgb_check_options(struct ixgb_adapter *adapter)
34793 {
34794 int bd = adapter->bd_number;
34795+
34796+ pax_track_stack();
34797+
34798 if (bd >= IXGB_MAX_NIC) {
34799 pr_notice("Warning: no configuration for board #%i\n", bd);
34800 pr_notice("Using defaults for all values\n");
34801diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c
34802--- linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c 2011-05-19 00:06:34.000000000 -0400
34803+++ linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c 2011-05-22 19:36:31.000000000 -0400
34804@@ -2099,7 +2099,7 @@ static struct ixgbe_phy_operations phy_o
34805 .check_overtemp = &ixgbe_tn_check_overtemp,
34806 };
34807
34808-struct ixgbe_info ixgbe_82599_info = {
34809+const struct ixgbe_info ixgbe_82599_info = {
34810 .mac = ixgbe_mac_82599EB,
34811 .get_invariants = &ixgbe_get_invariants_82599,
34812 .mac_ops = &mac_ops_82599,
34813diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe.h linux-2.6.39/drivers/net/ixgbe/ixgbe.h
34814--- linux-2.6.39/drivers/net/ixgbe/ixgbe.h 2011-05-19 00:06:34.000000000 -0400
34815+++ linux-2.6.39/drivers/net/ixgbe/ixgbe.h 2011-05-22 19:36:31.000000000 -0400
34816@@ -493,8 +493,8 @@ enum ixgbe_boards {
34817 };
34818
34819 extern struct ixgbe_info ixgbe_82598_info;
34820-extern struct ixgbe_info ixgbe_82599_info;
34821-extern struct ixgbe_info ixgbe_X540_info;
34822+extern const struct ixgbe_info ixgbe_82599_info;
34823+extern const struct ixgbe_info ixgbe_X540_info;
34824 #ifdef CONFIG_IXGBE_DCB
34825 extern const struct dcbnl_rtnl_ops dcbnl_ops;
34826 extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg,
34827diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h
34828--- linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h 2011-05-19 00:06:34.000000000 -0400
34829+++ linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h 2011-05-22 19:36:31.000000000 -0400
34830@@ -2572,7 +2572,7 @@ struct ixgbe_phy_operations {
34831 };
34832
34833 struct ixgbe_eeprom_info {
34834- struct ixgbe_eeprom_operations ops;
34835+ struct ixgbe_eeprom_operations ops;
34836 enum ixgbe_eeprom_type type;
34837 u32 semaphore_delay;
34838 u16 word_size;
34839@@ -2581,7 +2581,7 @@ struct ixgbe_eeprom_info {
34840
34841 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
34842 struct ixgbe_mac_info {
34843- struct ixgbe_mac_operations ops;
34844+ struct ixgbe_mac_operations ops;
34845 enum ixgbe_mac_type type;
34846 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34847 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34848@@ -2608,7 +2608,7 @@ struct ixgbe_mac_info {
34849 };
34850
34851 struct ixgbe_phy_info {
34852- struct ixgbe_phy_operations ops;
34853+ struct ixgbe_phy_operations ops;
34854 struct mdio_if_info mdio;
34855 enum ixgbe_phy_type type;
34856 u32 id;
34857diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c
34858--- linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c 2011-05-19 00:06:34.000000000 -0400
34859+++ linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c 2011-05-22 19:36:31.000000000 -0400
34860@@ -727,7 +727,7 @@ static struct ixgbe_phy_operations phy_o
34861 .check_overtemp = &ixgbe_tn_check_overtemp,
34862 };
34863
34864-struct ixgbe_info ixgbe_X540_info = {
34865+const struct ixgbe_info ixgbe_X540_info = {
34866 .mac = ixgbe_mac_X540,
34867 .get_invariants = &ixgbe_get_invariants_X540,
34868 .mac_ops = &mac_ops_X540,
34869diff -urNp linux-2.6.39/drivers/net/ixgbevf/ethtool.c linux-2.6.39/drivers/net/ixgbevf/ethtool.c
34870--- linux-2.6.39/drivers/net/ixgbevf/ethtool.c 2011-05-19 00:06:34.000000000 -0400
34871+++ linux-2.6.39/drivers/net/ixgbevf/ethtool.c 2011-05-22 19:36:31.000000000 -0400
34872@@ -709,7 +709,7 @@ static int ixgbevf_nway_reset(struct net
34873 return 0;
34874 }
34875
34876-static struct ethtool_ops ixgbevf_ethtool_ops = {
34877+static const struct ethtool_ops ixgbevf_ethtool_ops = {
34878 .get_settings = ixgbevf_get_settings,
34879 .get_drvinfo = ixgbevf_get_drvinfo,
34880 .get_regs_len = ixgbevf_get_regs_len,
34881diff -urNp linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h
34882--- linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h 2011-05-19 00:06:34.000000000 -0400
34883+++ linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h 2011-05-22 19:36:31.000000000 -0400
34884@@ -279,7 +279,7 @@ enum ixgbevf_boards {
34885
34886 extern struct ixgbevf_info ixgbevf_82599_vf_info;
34887 extern struct ixgbevf_info ixgbevf_X540_vf_info;
34888-extern struct ixgbe_mac_operations ixgbevf_mbx_ops;
34889+extern const struct ixgbe_mac_operations ixgbevf_mbx_ops;
34890
34891 /* needed by ethtool.c */
34892 extern char ixgbevf_driver_name[];
34893diff -urNp linux-2.6.39/drivers/net/ixgbevf/vf.c linux-2.6.39/drivers/net/ixgbevf/vf.c
34894--- linux-2.6.39/drivers/net/ixgbevf/vf.c 2011-05-19 00:06:34.000000000 -0400
34895+++ linux-2.6.39/drivers/net/ixgbevf/vf.c 2011-05-22 19:36:31.000000000 -0400
34896@@ -368,7 +368,7 @@ static s32 ixgbevf_check_mac_link_vf(str
34897 return 0;
34898 }
34899
34900-static struct ixgbe_mac_operations ixgbevf_mac_ops = {
34901+static const struct ixgbe_mac_operations ixgbevf_mac_ops = {
34902 .init_hw = ixgbevf_init_hw_vf,
34903 .reset_hw = ixgbevf_reset_hw_vf,
34904 .start_hw = ixgbevf_start_hw_vf,
34905@@ -381,12 +381,12 @@ static struct ixgbe_mac_operations ixgbe
34906 .set_vfta = ixgbevf_set_vfta_vf,
34907 };
34908
34909-struct ixgbevf_info ixgbevf_82599_vf_info = {
34910+const struct ixgbevf_info ixgbevf_82599_vf_info = {
34911 .mac = ixgbe_mac_82599_vf,
34912 .mac_ops = &ixgbevf_mac_ops,
34913 };
34914
34915-struct ixgbevf_info ixgbevf_X540_vf_info = {
34916+const struct ixgbevf_info ixgbevf_X540_vf_info = {
34917 .mac = ixgbe_mac_X540_vf,
34918 .mac_ops = &ixgbevf_mac_ops,
34919 };
34920diff -urNp linux-2.6.39/drivers/net/ixgbevf/vf.h linux-2.6.39/drivers/net/ixgbevf/vf.h
34921--- linux-2.6.39/drivers/net/ixgbevf/vf.h 2011-05-19 00:06:34.000000000 -0400
34922+++ linux-2.6.39/drivers/net/ixgbevf/vf.h 2011-05-22 19:36:31.000000000 -0400
34923@@ -166,7 +166,7 @@ struct ixgbevf_hw_stats {
34924
34925 struct ixgbevf_info {
34926 enum ixgbe_mac_type mac;
34927- struct ixgbe_mac_operations *mac_ops;
34928+ const struct ixgbe_mac_operations *mac_ops;
34929 };
34930
34931 #endif /* __IXGBE_VF_H__ */
34932diff -urNp linux-2.6.39/drivers/net/ksz884x.c linux-2.6.39/drivers/net/ksz884x.c
34933--- linux-2.6.39/drivers/net/ksz884x.c 2011-05-19 00:06:34.000000000 -0400
34934+++ linux-2.6.39/drivers/net/ksz884x.c 2011-05-22 19:36:31.000000000 -0400
34935@@ -6536,6 +6536,8 @@ static void netdev_get_ethtool_stats(str
34936 int rc;
34937 u64 counter[TOTAL_PORT_COUNTER_NUM];
34938
34939+ pax_track_stack();
34940+
34941 mutex_lock(&hw_priv->lock);
34942 n = SWITCH_PORT_NUM;
34943 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
34944@@ -6637,7 +6639,7 @@ static int netdev_set_rx_csum(struct net
34945 return 0;
34946 }
34947
34948-static struct ethtool_ops netdev_ethtool_ops = {
34949+static const struct ethtool_ops netdev_ethtool_ops = {
34950 .get_settings = netdev_get_settings,
34951 .set_settings = netdev_set_settings,
34952 .nway_reset = netdev_nway_reset,
34953diff -urNp linux-2.6.39/drivers/net/mlx4/main.c linux-2.6.39/drivers/net/mlx4/main.c
34954--- linux-2.6.39/drivers/net/mlx4/main.c 2011-05-19 00:06:34.000000000 -0400
34955+++ linux-2.6.39/drivers/net/mlx4/main.c 2011-05-22 19:36:31.000000000 -0400
34956@@ -40,6 +40,7 @@
34957 #include <linux/dma-mapping.h>
34958 #include <linux/slab.h>
34959 #include <linux/io-mapping.h>
34960+#include <linux/sched.h>
34961
34962 #include <linux/mlx4/device.h>
34963 #include <linux/mlx4/doorbell.h>
34964@@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
34965 u64 icm_size;
34966 int err;
34967
34968+ pax_track_stack();
34969+
34970 err = mlx4_QUERY_FW(dev);
34971 if (err) {
34972 if (err == -EACCES)
34973diff -urNp linux-2.6.39/drivers/net/netconsole.c linux-2.6.39/drivers/net/netconsole.c
34974--- linux-2.6.39/drivers/net/netconsole.c 2011-05-19 00:06:34.000000000 -0400
34975+++ linux-2.6.39/drivers/net/netconsole.c 2011-05-22 19:36:31.000000000 -0400
34976@@ -634,7 +634,7 @@ static void drop_netconsole_target(struc
34977 config_item_put(&nt->item);
34978 }
34979
34980-static struct configfs_group_operations netconsole_subsys_group_ops = {
34981+static const struct configfs_group_operations netconsole_subsys_group_ops = {
34982 .make_item = make_netconsole_target,
34983 .drop_item = drop_netconsole_target,
34984 };
34985diff -urNp linux-2.6.39/drivers/net/niu.c linux-2.6.39/drivers/net/niu.c
34986--- linux-2.6.39/drivers/net/niu.c 2011-05-19 00:06:34.000000000 -0400
34987+++ linux-2.6.39/drivers/net/niu.c 2011-05-22 19:36:31.000000000 -0400
34988@@ -9067,6 +9067,8 @@ static void __devinit niu_try_msix(struc
34989 int i, num_irqs, err;
34990 u8 first_ldg;
34991
34992+ pax_track_stack();
34993+
34994 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
34995 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
34996 ldg_num_map[i] = first_ldg + i;
34997diff -urNp linux-2.6.39/drivers/net/pcnet32.c linux-2.6.39/drivers/net/pcnet32.c
34998--- linux-2.6.39/drivers/net/pcnet32.c 2011-05-19 00:06:34.000000000 -0400
34999+++ linux-2.6.39/drivers/net/pcnet32.c 2011-05-22 19:36:31.000000000 -0400
df50ba0c 35000@@ -82,7 +82,7 @@ static int cards_found;
58c5fc13
MT		 35001 /*
35002 * VLB I/O addresses
35003 */
35004-static unsigned int pcnet32_portlist[] __initdata =
35005+static unsigned int pcnet32_portlist[] __devinitdata =
35006 { 0x300, 0x320, 0x340, 0x360, 0 };
35007
df50ba0c 35008 static int pcnet32_debug;
66a7e928
MT		 35009@@ -379,7 +379,7 @@ static int pcnet32_wio_check(unsigned lo
35010 return inw(addr + PCNET32_WIO_RAP) == 88;
35011 }
35012
35013-static struct pcnet32_access pcnet32_wio = {
35014+static const struct pcnet32_access pcnet32_wio = {
35015 .read_csr = pcnet32_wio_read_csr,
35016 .write_csr = pcnet32_wio_write_csr,
35017 .read_bcr = pcnet32_wio_read_bcr,
35018@@ -434,7 +434,7 @@ static int pcnet32_dwio_check(unsigned l
35019 return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
35020 }
35021
35022-static struct pcnet32_access pcnet32_dwio = {
35023+static const struct pcnet32_access pcnet32_dwio = {
35024 .read_csr = pcnet32_dwio_read_csr,
35025 .write_csr = pcnet32_dwio_write_csr,
35026 .read_bcr = pcnet32_dwio_read_bcr,
35027@@ -1546,7 +1546,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35028 int chip_version;
35029 char *chipname;
35030 struct net_device *dev;
35031- struct pcnet32_access *a = NULL;
35032+ const struct pcnet32_access *a = NULL;
35033 u8 promaddr[6];
35034 int ret = -ENODEV;
35035
35036diff -urNp linux-2.6.39/drivers/net/ppp_generic.c linux-2.6.39/drivers/net/ppp_generic.c
35037--- linux-2.6.39/drivers/net/ppp_generic.c 2011-05-19 00:06:34.000000000 -0400
35038+++ linux-2.6.39/drivers/net/ppp_generic.c 2011-05-22 19:36:31.000000000 -0400
35039@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
ae4e228f
MT		 35040 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
35041 struct ppp_stats stats;
35042 struct ppp_comp_stats cstats;
35043- char *vers;
35044
35045 switch (cmd) {
35046 case SIOCGPPPSTATS:
66a7e928 35047@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
ae4e228f
MT		 35048 break;
35049
35050 case SIOCGPPPVER:
35051- vers = PPP_VERSION;
35052- if (copy_to_user(addr, vers, strlen(vers) + 1))
35053+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
35054 break;
35055 err = 0;
35056 break;
66a7e928
MT		 35057diff -urNp linux-2.6.39/drivers/net/qlcnic/qlcnic.h linux-2.6.39/drivers/net/qlcnic/qlcnic.h
35058--- linux-2.6.39/drivers/net/qlcnic/qlcnic.h 2011-05-19 00:06:34.000000000 -0400
35059+++ linux-2.6.39/drivers/net/qlcnic/qlcnic.h 2011-05-22 19:36:31.000000000 -0400
35060@@ -1037,7 +1037,7 @@ struct qlcnic_adapter {
35061 struct vlan_group *vlgrp;
35062 struct qlcnic_npar_info *npars;
35063 struct qlcnic_eswitch *eswitch;
35064- struct qlcnic_nic_template *nic_ops;
35065+ const struct qlcnic_nic_template *nic_ops;
35066
35067 struct qlcnic_adapter_stats stats;
35068
35069diff -urNp linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c
35070--- linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c 2011-05-19 00:06:34.000000000 -0400
35071+++ linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c 2011-05-22 19:36:31.000000000 -0400
35072@@ -340,13 +340,13 @@ static const struct net_device_ops qlcni
35073 #endif
35074 };
35075
35076-static struct qlcnic_nic_template qlcnic_ops = {
35077+static const struct qlcnic_nic_template qlcnic_ops = {
35078 .config_bridged_mode = qlcnic_config_bridged_mode,
35079 .config_led = qlcnic_config_led,
35080 .start_firmware = qlcnic_start_firmware
35081 };
35082
35083-static struct qlcnic_nic_template qlcnic_vf_ops = {
35084+static const struct qlcnic_nic_template qlcnic_vf_ops = {
35085 .config_bridged_mode = qlcnicvf_config_bridged_mode,
35086 .config_led = qlcnicvf_config_led,
35087 .start_firmware = qlcnicvf_start_firmware
35088diff -urNp linux-2.6.39/drivers/net/qlge/qlge.h linux-2.6.39/drivers/net/qlge/qlge.h
35089--- linux-2.6.39/drivers/net/qlge/qlge.h 2011-05-19 00:06:34.000000000 -0400
35090+++ linux-2.6.39/drivers/net/qlge/qlge.h 2011-05-22 19:36:31.000000000 -0400
35091@@ -2134,7 +2134,7 @@ struct ql_adapter {
35092 struct delayed_work mpi_idc_work;
35093 struct delayed_work mpi_core_to_log;
35094 struct completion ide_completion;
35095- struct nic_operations *nic_ops;
35096+ const struct nic_operations *nic_ops;
35097 u16 device_id;
35098 struct timer_list timer;
35099 atomic_t lb_count;
35100diff -urNp linux-2.6.39/drivers/net/qlge/qlge_main.c linux-2.6.39/drivers/net/qlge/qlge_main.c
35101--- linux-2.6.39/drivers/net/qlge/qlge_main.c 2011-05-19 00:06:34.000000000 -0400
35102+++ linux-2.6.39/drivers/net/qlge/qlge_main.c 2011-05-22 19:36:31.000000000 -0400
35103@@ -4412,12 +4412,12 @@ error:
35104 rtnl_unlock();
35105 }
35106
35107-static struct nic_operations qla8012_nic_ops = {
35108+static const struct nic_operations qla8012_nic_ops = {
35109 .get_flash = ql_get_8012_flash_params,
35110 .port_initialize = ql_8012_port_initialize,
35111 };
35112
35113-static struct nic_operations qla8000_nic_ops = {
35114+static const struct nic_operations qla8000_nic_ops = {
35115 .get_flash = ql_get_8000_flash_params,
35116 .port_initialize = ql_8000_port_initialize,
35117 };
35118diff -urNp linux-2.6.39/drivers/net/sfc/falcon.c linux-2.6.39/drivers/net/sfc/falcon.c
35119--- linux-2.6.39/drivers/net/sfc/falcon.c 2011-05-19 00:06:34.000000000 -0400
35120+++ linux-2.6.39/drivers/net/sfc/falcon.c 2011-05-22 19:36:31.000000000 -0400
35121@@ -1703,7 +1703,7 @@ static int falcon_set_wol(struct efx_nic
35122 **************************************************************************
35123 */
35124
35125-struct efx_nic_type falcon_a1_nic_type = {
35126+const struct efx_nic_type falcon_a1_nic_type = {
35127 .probe = falcon_probe_nic,
35128 .remove = falcon_remove_nic,
35129 .init = falcon_init_nic,
35130@@ -1744,7 +1744,7 @@ struct efx_nic_type falcon_a1_nic_type =
35131 .reset_world_flags = ETH_RESET_IRQ,
35132 };
35133
35134-struct efx_nic_type falcon_b0_nic_type = {
35135+const struct efx_nic_type falcon_b0_nic_type = {
35136 .probe = falcon_probe_nic,
35137 .remove = falcon_remove_nic,
35138 .init = falcon_init_nic,
35139diff -urNp linux-2.6.39/drivers/net/sfc/mtd.c linux-2.6.39/drivers/net/sfc/mtd.c
35140--- linux-2.6.39/drivers/net/sfc/mtd.c 2011-05-19 00:06:34.000000000 -0400
35141+++ linux-2.6.39/drivers/net/sfc/mtd.c 2011-05-22 19:36:31.000000000 -0400
35142@@ -382,7 +382,7 @@ static int falcon_mtd_sync(struct mtd_in
35143 return rc;
35144 }
35145
35146-static struct efx_mtd_ops falcon_mtd_ops = {
35147+static const struct efx_mtd_ops falcon_mtd_ops = {
35148 .read = falcon_mtd_read,
35149 .erase = falcon_mtd_erase,
35150 .write = falcon_mtd_write,
35151@@ -560,7 +560,7 @@ static int siena_mtd_sync(struct mtd_inf
35152 return rc;
35153 }
35154
35155-static struct efx_mtd_ops siena_mtd_ops = {
35156+static const struct efx_mtd_ops siena_mtd_ops = {
35157 .read = siena_mtd_read,
35158 .erase = siena_mtd_erase,
35159 .write = siena_mtd_write,
35160diff -urNp linux-2.6.39/drivers/net/sfc/nic.h linux-2.6.39/drivers/net/sfc/nic.h
35161--- linux-2.6.39/drivers/net/sfc/nic.h 2011-05-19 00:06:34.000000000 -0400
35162+++ linux-2.6.39/drivers/net/sfc/nic.h 2011-05-22 19:36:31.000000000 -0400
35163@@ -152,9 +152,9 @@ struct siena_nic_data {
35164 int wol_filter_id;
35165 };
35166
35167-extern struct efx_nic_type falcon_a1_nic_type;
35168-extern struct efx_nic_type falcon_b0_nic_type;
35169-extern struct efx_nic_type siena_a0_nic_type;
35170+extern const struct efx_nic_type falcon_a1_nic_type;
35171+extern const struct efx_nic_type falcon_b0_nic_type;
35172+extern const struct efx_nic_type siena_a0_nic_type;
35173
35174 /**************************************************************************
35175 *
35176diff -urNp linux-2.6.39/drivers/net/sfc/siena.c linux-2.6.39/drivers/net/sfc/siena.c
35177--- linux-2.6.39/drivers/net/sfc/siena.c 2011-05-19 00:06:34.000000000 -0400
35178+++ linux-2.6.39/drivers/net/sfc/siena.c 2011-05-22 19:36:31.000000000 -0400
35179@@ -599,7 +599,7 @@ static void siena_init_wol(struct efx_ni
35180 **************************************************************************
35181 */
35182
35183-struct efx_nic_type siena_a0_nic_type = {
35184+const struct efx_nic_type siena_a0_nic_type = {
35185 .probe = siena_probe_nic,
35186 .remove = siena_remove_nic,
35187 .init = siena_init_nic,
35188diff -urNp linux-2.6.39/drivers/net/sh_eth.c linux-2.6.39/drivers/net/sh_eth.c
35189--- linux-2.6.39/drivers/net/sh_eth.c 2011-05-19 00:06:34.000000000 -0400
35190+++ linux-2.6.39/drivers/net/sh_eth.c 2011-05-22 19:36:31.000000000 -0400
35191@@ -1360,7 +1360,7 @@ static void sh_eth_get_strings(struct ne
35192 }
35193 }
35194
35195-static struct ethtool_ops sh_eth_ethtool_ops = {
35196+static const struct ethtool_ops sh_eth_ethtool_ops = {
35197 .get_settings = sh_eth_get_settings,
35198 .set_settings = sh_eth_set_settings,
35199 .nway_reset = sh_eth_nway_reset,
35200diff -urNp linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c
35201--- linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35202+++ linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35203@@ -348,7 +348,7 @@ static int stmmac_set_wol(struct net_dev
35204 return 0;
35205 }
35206
35207-static struct ethtool_ops stmmac_ethtool_ops = {
35208+static const struct ethtool_ops stmmac_ethtool_ops = {
35209 .begin = stmmac_check_if_running,
35210 .get_drvinfo = stmmac_ethtool_getdrvinfo,
35211 .get_settings = stmmac_ethtool_getsettings,
35212diff -urNp linux-2.6.39/drivers/net/sungem_phy.c linux-2.6.39/drivers/net/sungem_phy.c
35213--- linux-2.6.39/drivers/net/sungem_phy.c 2011-05-19 00:06:34.000000000 -0400
35214+++ linux-2.6.39/drivers/net/sungem_phy.c 2011-05-22 19:36:31.000000000 -0400
35215@@ -886,7 +886,7 @@ static int marvell_read_link(struct mii_
35216 SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
35217
35218 /* Broadcom BCM 5201 */
35219-static struct mii_phy_ops bcm5201_phy_ops = {
35220+static const struct mii_phy_ops bcm5201_phy_ops = {
35221 .init = bcm5201_init,
35222 .suspend = bcm5201_suspend,
35223 .setup_aneg = genmii_setup_aneg,
35224@@ -905,7 +905,7 @@ static struct mii_phy_def bcm5201_phy_de
35225 };
35226
35227 /* Broadcom BCM 5221 */
35228-static struct mii_phy_ops bcm5221_phy_ops = {
35229+static const struct mii_phy_ops bcm5221_phy_ops = {
35230 .suspend = bcm5221_suspend,
35231 .init = bcm5221_init,
35232 .setup_aneg = genmii_setup_aneg,
35233@@ -924,7 +924,7 @@ static struct mii_phy_def bcm5221_phy_de
35234 };
35235
35236 /* Broadcom BCM 5241 */
35237-static struct mii_phy_ops bcm5241_phy_ops = {
35238+static const struct mii_phy_ops bcm5241_phy_ops = {
35239 .suspend = bcm5241_suspend,
35240 .init = bcm5241_init,
35241 .setup_aneg = genmii_setup_aneg,
35242@@ -942,7 +942,7 @@ static struct mii_phy_def bcm5241_phy_de
35243 };
35244
35245 /* Broadcom BCM 5400 */
35246-static struct mii_phy_ops bcm5400_phy_ops = {
35247+static const struct mii_phy_ops bcm5400_phy_ops = {
35248 .init = bcm5400_init,
35249 .suspend = bcm5400_suspend,
35250 .setup_aneg = bcm54xx_setup_aneg,
35251@@ -961,7 +961,7 @@ static struct mii_phy_def bcm5400_phy_de
35252 };
35253
35254 /* Broadcom BCM 5401 */
35255-static struct mii_phy_ops bcm5401_phy_ops = {
35256+static const struct mii_phy_ops bcm5401_phy_ops = {
35257 .init = bcm5401_init,
35258 .suspend = bcm5401_suspend,
35259 .setup_aneg = bcm54xx_setup_aneg,
35260@@ -980,7 +980,7 @@ static struct mii_phy_def bcm5401_phy_de
35261 };
35262
35263 /* Broadcom BCM 5411 */
35264-static struct mii_phy_ops bcm5411_phy_ops = {
35265+static const struct mii_phy_ops bcm5411_phy_ops = {
35266 .init = bcm5411_init,
35267 .suspend = generic_suspend,
35268 .setup_aneg = bcm54xx_setup_aneg,
35269@@ -999,7 +999,7 @@ static struct mii_phy_def bcm5411_phy_de
35270 };
35271
35272 /* Broadcom BCM 5421 */
35273-static struct mii_phy_ops bcm5421_phy_ops = {
35274+static const struct mii_phy_ops bcm5421_phy_ops = {
35275 .init = bcm5421_init,
35276 .suspend = generic_suspend,
35277 .setup_aneg = bcm54xx_setup_aneg,
35278@@ -1019,7 +1019,7 @@ static struct mii_phy_def bcm5421_phy_de
35279 };
35280
35281 /* Broadcom BCM 5421 built-in K2 */
35282-static struct mii_phy_ops bcm5421k2_phy_ops = {
35283+static const struct mii_phy_ops bcm5421k2_phy_ops = {
35284 .init = bcm5421_init,
35285 .suspend = generic_suspend,
35286 .setup_aneg = bcm54xx_setup_aneg,
35287@@ -1037,7 +1037,7 @@ static struct mii_phy_def bcm5421k2_phy_
35288 .ops = &bcm5421k2_phy_ops
35289 };
35290
35291-static struct mii_phy_ops bcm5461_phy_ops = {
35292+static const struct mii_phy_ops bcm5461_phy_ops = {
35293 .init = bcm5421_init,
35294 .suspend = generic_suspend,
35295 .setup_aneg = bcm54xx_setup_aneg,
35296@@ -1057,7 +1057,7 @@ static struct mii_phy_def bcm5461_phy_de
35297 };
35298
35299 /* Broadcom BCM 5462 built-in Vesta */
35300-static struct mii_phy_ops bcm5462V_phy_ops = {
35301+static const struct mii_phy_ops bcm5462V_phy_ops = {
35302 .init = bcm5421_init,
35303 .suspend = generic_suspend,
35304 .setup_aneg = bcm54xx_setup_aneg,
35305@@ -1076,7 +1076,7 @@ static struct mii_phy_def bcm5462V_phy_d
35306 };
35307
35308 /* Marvell 88E1101 amd 88E1111 */
35309-static struct mii_phy_ops marvell88e1101_phy_ops = {
35310+static const struct mii_phy_ops marvell88e1101_phy_ops = {
35311 .suspend = generic_suspend,
35312 .setup_aneg = marvell_setup_aneg,
35313 .setup_forced = marvell_setup_forced,
35314@@ -1084,7 +1084,7 @@ static struct mii_phy_ops marvell88e1101
35315 .read_link = marvell_read_link
35316 };
35317
35318-static struct mii_phy_ops marvell88e1111_phy_ops = {
35319+static const struct mii_phy_ops marvell88e1111_phy_ops = {
35320 .init = marvell88e1111_init,
35321 .suspend = generic_suspend,
35322 .setup_aneg = marvell_setup_aneg,
35323@@ -1122,7 +1122,7 @@ static struct mii_phy_def marvell88e1111
35324 };
35325
35326 /* Generic implementation for most 10/100 PHYs */
35327-static struct mii_phy_ops generic_phy_ops = {
35328+static const struct mii_phy_ops generic_phy_ops = {
35329 .setup_aneg = genmii_setup_aneg,
35330 .setup_forced = genmii_setup_forced,
35331 .poll_link = genmii_poll_link,
35332diff -urNp linux-2.6.39/drivers/net/tg3.h linux-2.6.39/drivers/net/tg3.h
35333--- linux-2.6.39/drivers/net/tg3.h 2011-05-19 00:06:34.000000000 -0400
35334+++ linux-2.6.39/drivers/net/tg3.h 2011-05-22 19:36:31.000000000 -0400
6892158b 35335@@ -131,6 +131,7 @@
58c5fc13
MT		 35336 #define CHIPREV_ID_5750_A0 0x4000
35337 #define CHIPREV_ID_5750_A1 0x4001
35338 #define CHIPREV_ID_5750_A3 0x4003
35339+#define CHIPREV_ID_5750_C1 0x4201
35340 #define CHIPREV_ID_5750_C2 0x4202
35341 #define CHIPREV_ID_5752_A0_HW 0x5000
35342 #define CHIPREV_ID_5752_A0 0x6000
66a7e928
MT		 35343diff -urNp linux-2.6.39/drivers/net/tile/tilepro.c linux-2.6.39/drivers/net/tile/tilepro.c
35344--- linux-2.6.39/drivers/net/tile/tilepro.c 2011-05-19 00:06:34.000000000 -0400
35345+++ linux-2.6.39/drivers/net/tile/tilepro.c 2011-05-22 19:36:31.000000000 -0400
35346@@ -2263,7 +2263,7 @@ static int tile_net_get_mac(struct net_d
35347 }
35348
35349
35350-static struct net_device_ops tile_net_ops = {
35351+static const struct net_device_ops tile_net_ops = {
35352 .ndo_open = tile_net_open,
35353 .ndo_stop = tile_net_stop,
35354 .ndo_start_xmit = tile_net_tx,
35355diff -urNp linux-2.6.39/drivers/net/tulip/de2104x.c linux-2.6.39/drivers/net/tulip/de2104x.c
35356--- linux-2.6.39/drivers/net/tulip/de2104x.c 2011-05-19 00:06:34.000000000 -0400
35357+++ linux-2.6.39/drivers/net/tulip/de2104x.c 2011-05-22 19:36:31.000000000 -0400
35358@@ -1817,6 +1817,8 @@ static void __devinit de21041_get_srom_i
35359 struct de_srom_info_leaf *il;
35360 void *bufp;
35361
35362+ pax_track_stack();
35363+
35364 /* download entire eeprom */
35365 for (i = 0; i < DE_EEPROM_WORDS; i++)
35366 ((__le16 *)ee_data)[i] =
35367diff -urNp linux-2.6.39/drivers/net/tulip/de4x5.c linux-2.6.39/drivers/net/tulip/de4x5.c
35368--- linux-2.6.39/drivers/net/tulip/de4x5.c 2011-05-19 00:06:34.000000000 -0400
35369+++ linux-2.6.39/drivers/net/tulip/de4x5.c 2011-05-22 19:36:31.000000000 -0400
57199397 35370@@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
ae4e228f
MT		 35371 for (i=0; i<ETH_ALEN; i++) {
35372 tmp.addr[i] = dev->dev_addr[i];
35373 }
35374- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
bc901d79 35375+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
ae4e228f
MT		 35376 break;
35377
35378 case DE4X5_SET_HWADDR: /* Set the hardware address */
57199397 35379@@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
ae4e228f
MT		 35380 spin_lock_irqsave(&lp->lock, flags);
35381 memcpy(&statbuf, &lp->pktStats, ioc->len);
35382 spin_unlock_irqrestore(&lp->lock, flags);
35383- if (copy_to_user(ioc->data, &statbuf, ioc->len))
bc901d79 35384+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
ae4e228f
MT		 35385 return -EFAULT;
35386 break;
35387 }
66a7e928
MT		 35388diff -urNp linux-2.6.39/drivers/net/usb/asix.c linux-2.6.39/drivers/net/usb/asix.c
35389--- linux-2.6.39/drivers/net/usb/asix.c 2011-05-19 00:06:34.000000000 -0400
35390+++ linux-2.6.39/drivers/net/usb/asix.c 2011-05-22 19:36:31.000000000 -0400
35391@@ -1098,7 +1098,7 @@ out:
35392 return ret;
35393 }
35394
35395-static struct ethtool_ops ax88178_ethtool_ops = {
35396+static const struct ethtool_ops ax88178_ethtool_ops = {
35397 .get_drvinfo = asix_get_drvinfo,
35398 .get_link = asix_get_link,
35399 .get_msglevel = usbnet_get_msglevel,
35400diff -urNp linux-2.6.39/drivers/net/usb/cdc_ncm.c linux-2.6.39/drivers/net/usb/cdc_ncm.c
35401--- linux-2.6.39/drivers/net/usb/cdc_ncm.c 2011-05-19 00:06:34.000000000 -0400
35402+++ linux-2.6.39/drivers/net/usb/cdc_ncm.c 2011-05-22 19:36:31.000000000 -0400
35403@@ -141,7 +141,7 @@ struct cdc_ncm_ctx {
35404 static void cdc_ncm_tx_timeout(unsigned long arg);
35405 static const struct driver_info cdc_ncm_info;
35406 static struct usb_driver cdc_ncm_driver;
35407-static struct ethtool_ops cdc_ncm_ethtool_ops;
35408+static const struct ethtool_ops cdc_ncm_ethtool_ops;
35409
35410 static const struct usb_device_id cdc_devs[] = {
35411 { USB_INTERFACE_INFO(USB_CLASS_COMM,
35412@@ -1257,7 +1257,7 @@ static struct usb_driver cdc_ncm_driver
35413 .supports_autosuspend = 1,
35414 };
35415
35416-static struct ethtool_ops cdc_ncm_ethtool_ops = {
35417+static const struct ethtool_ops cdc_ncm_ethtool_ops = {
35418 .get_drvinfo = cdc_ncm_get_drvinfo,
35419 .get_link = usbnet_get_link,
35420 .get_msglevel = usbnet_get_msglevel,
35421diff -urNp linux-2.6.39/drivers/net/usb/hso.c linux-2.6.39/drivers/net/usb/hso.c
35422--- linux-2.6.39/drivers/net/usb/hso.c 2011-05-19 00:06:34.000000000 -0400
35423+++ linux-2.6.39/drivers/net/usb/hso.c 2011-05-22 19:36:31.000000000 -0400
c52201e0
MT		 35424@@ -71,7 +71,7 @@
35425 #include <asm/byteorder.h>
35426 #include <linux/serial_core.h>
35427 #include <linux/serial.h>
35428-
35429+#include <asm/local.h>
35430
35431 #define MOD_AUTHOR "Option Wireless"
35432 #define MOD_DESCRIPTION "USB High Speed Option driver"
6892158b 35433@@ -257,7 +257,7 @@ struct hso_serial {
58c5fc13
MT		 35434
35435 /* from usb_serial_port */
35436 struct tty_struct *tty;
35437- int open_count;
c52201e0 35438+ local_t open_count;
58c5fc13
MT		 35439 spinlock_t serial_lock;
35440
35441 int (*write_data) (struct hso_serial *serial);
16454cff 35442@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
58c5fc13
MT		 35443 struct urb *urb;
35444
35445 urb = serial->rx_urb[0];
35446- if (serial->open_count > 0) {
c52201e0 35447+ if (local_read(&serial->open_count) > 0) {
58c5fc13
MT		 35448 count = put_rxbuf_data(urb, serial);
35449 if (count == -1)
35450 return;
16454cff 35451@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
58c5fc13
MT		 35452 DUMP1(urb->transfer_buffer, urb->actual_length);
35453
35454 /* Anyone listening? */
35455- if (serial->open_count == 0)
c52201e0 35456+ if (local_read(&serial->open_count) == 0)
58c5fc13
MT		 35457 return;
35458
35459 if (status == 0) {
16454cff 35460@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
58c5fc13
MT		 35461 spin_unlock_irq(&serial->serial_lock);
35462
35463 /* check for port already opened, if not set the termios */
35464- serial->open_count++;
35465- if (serial->open_count == 1) {
c52201e0 35466+ if (local_inc_return(&serial->open_count) == 1) {
58c5fc13
MT		 35467 serial->rx_state = RX_IDLE;
35468 /* Force default termio settings */
57199397 35469 _hso_serial_set_termios(tty, NULL);
16454cff 35470@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
58c5fc13
MT		 35471 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35472 if (result) {
35473 hso_stop_serial_device(serial->parent);
35474- serial->open_count--;
c52201e0 35475+ local_dec(&serial->open_count);
58c5fc13
MT		 35476 kref_put(&serial->parent->ref, hso_serial_ref_free);
35477 }
35478 } else {
16454cff 35479@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
58c5fc13
MT		 35480
35481 /* reset the rts and dtr */
35482 /* do the actual close */
35483- serial->open_count--;
c52201e0 35484+ local_dec(&serial->open_count);
ae4e228f 35485
58c5fc13
MT		 35486- if (serial->open_count <= 0) {
35487- serial->open_count = 0;
c52201e0
MT		 35488+ if (local_read(&serial->open_count) <= 0) {
35489+ local_set(&serial->open_count, 0);
58c5fc13
MT		 35490 spin_lock_irq(&serial->serial_lock);
35491 if (serial->tty == tty) {
35492 serial->tty->driver_data = NULL;
16454cff 35493@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
58c5fc13
MT		 35494
35495 /* the actual setup */
35496 spin_lock_irqsave(&serial->serial_lock, flags);
35497- if (serial->open_count)
c52201e0 35498+ if (local_read(&serial->open_count))
58c5fc13
MT		 35499 _hso_serial_set_termios(tty, old);
35500 else
35501 tty->termios = old;
16454cff 35502@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
ae4e228f
MT		 35503 D1("Pending read interrupt on port %d\n", i);
35504 spin_lock(&serial->serial_lock);
35505 if (serial->rx_state == RX_IDLE &&
35506- serial->open_count > 0) {
c52201e0 35507+ local_read(&serial->open_count) > 0) {
ae4e228f
MT		 35508 /* Setup and send a ctrl req read on
35509 * port i */
35510 if (!serial->rx_urb_filled[0]) {
16454cff 35511@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
58c5fc13
MT		 35512 /* Start all serial ports */
35513 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35514 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35515- if (dev2ser(serial_table[i])->open_count) {
c52201e0 35516+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
58c5fc13
MT		 35517 result =
35518 hso_start_serial_device(serial_table[i], GFP_NOIO);
35519 hso_kick_transmit(dev2ser(serial_table[i]));
66a7e928
MT		 35520diff -urNp linux-2.6.39/drivers/net/usb/ipheth.c linux-2.6.39/drivers/net/usb/ipheth.c
35521--- linux-2.6.39/drivers/net/usb/ipheth.c 2011-05-19 00:06:34.000000000 -0400
35522+++ linux-2.6.39/drivers/net/usb/ipheth.c 2011-05-22 19:36:31.000000000 -0400
35523@@ -421,7 +421,7 @@ static u32 ipheth_ethtool_op_get_link(st
35524 return netif_carrier_ok(dev->net);
35525 }
35526
35527-static struct ethtool_ops ops = {
35528+static const struct ethtool_ops ops = {
35529 .get_link = ipheth_ethtool_op_get_link
35530 };
35531
35532diff -urNp linux-2.6.39/drivers/net/usb/sierra_net.c linux-2.6.39/drivers/net/usb/sierra_net.c
35533--- linux-2.6.39/drivers/net/usb/sierra_net.c 2011-05-19 00:06:34.000000000 -0400
35534+++ linux-2.6.39/drivers/net/usb/sierra_net.c 2011-05-22 19:36:31.000000000 -0400
35535@@ -618,7 +618,7 @@ static u32 sierra_net_get_link(struct ne
35536 return sierra_net_get_private(dev)->link_up && netif_running(net);
35537 }
35538
35539-static struct ethtool_ops sierra_net_ethtool_ops = {
35540+static const struct ethtool_ops sierra_net_ethtool_ops = {
35541 .get_drvinfo = sierra_net_get_drvinfo,
35542 .get_link = sierra_net_get_link,
35543 .get_msglevel = usbnet_get_msglevel,
35544diff -urNp linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c
35545--- linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35546+++ linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35547@@ -631,8 +631,7 @@ vmxnet3_set_rss_indir(struct net_device
71d190be
MT		 35548 * Return with error code if any of the queue indices
35549 * is out of range
35550 */
35551- if (p->ring_index[i] < 0 ||
35552- p->ring_index[i] >= adapter->num_rx_queues)
35553+ if (p->ring_index[i] >= adapter->num_rx_queues)
35554 return -EINVAL;
35555 }
35556
66a7e928
MT		 35557diff -urNp linux-2.6.39/drivers/net/vxge/vxge-config.h linux-2.6.39/drivers/net/vxge/vxge-config.h
35558--- linux-2.6.39/drivers/net/vxge/vxge-config.h 2011-05-19 00:06:34.000000000 -0400
35559+++ linux-2.6.39/drivers/net/vxge/vxge-config.h 2011-05-22 19:36:31.000000000 -0400
35560@@ -834,7 +834,7 @@ struct vxge_hw_device_hw_info {
35561 struct vxge_hw_device_attr {
35562 void __iomem *bar0;
35563 struct pci_dev *pdev;
35564- struct vxge_hw_uld_cbs uld_callbacks;
35565+ struct vxge_hw_uld_cbs uld_callbacks;
35566 };
35567
35568 #define VXGE_HW_DEVICE_LINK_STATE_SET(hldev, ls) (hldev->link_state = ls)
35569diff -urNp linux-2.6.39/drivers/net/vxge/vxge-main.c linux-2.6.39/drivers/net/vxge/vxge-main.c
35570--- linux-2.6.39/drivers/net/vxge/vxge-main.c 2011-05-19 00:06:34.000000000 -0400
35571+++ linux-2.6.39/drivers/net/vxge/vxge-main.c 2011-05-22 19:36:31.000000000 -0400
35572@@ -97,6 +97,8 @@ static inline void VXGE_COMPLETE_VPATH_T
35573 struct sk_buff *completed[NR_SKB_COMPLETED];
35574 int more;
35575
35576+ pax_track_stack();
35577+
35578 do {
35579 more = 0;
35580 skb_ptr = completed;
35581@@ -1927,6 +1929,8 @@ static enum vxge_hw_status vxge_rth_conf
35582 u8 mtable[256] = {0}; /* CPU to vpath mapping */
35583 int index;
35584
35585+ pax_track_stack();
35586+
35587 /*
35588 * Filling
35589 * - itable with bucket numbers
35590diff -urNp linux-2.6.39/drivers/net/wan/cycx_x25.c linux-2.6.39/drivers/net/wan/cycx_x25.c
35591--- linux-2.6.39/drivers/net/wan/cycx_x25.c 2011-05-19 00:06:34.000000000 -0400
35592+++ linux-2.6.39/drivers/net/wan/cycx_x25.c 2011-05-22 19:36:31.000000000 -0400
35593@@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
35594 unsigned char hex[1024],
35595 * phex = hex;
35596
35597+ pax_track_stack();
35598+
35599 if (len >= (sizeof(hex) / 2))
35600 len = (sizeof(hex) / 2) - 1;
35601
35602diff -urNp linux-2.6.39/drivers/net/wan/lapbether.c linux-2.6.39/drivers/net/wan/lapbether.c
35603--- linux-2.6.39/drivers/net/wan/lapbether.c 2011-05-19 00:06:34.000000000 -0400
35604+++ linux-2.6.39/drivers/net/wan/lapbether.c 2011-05-22 19:36:31.000000000 -0400
35605@@ -259,7 +259,7 @@ static int lapbeth_set_mac_address(struc
35606 }
35607
35608
35609-static struct lapb_register_struct lapbeth_callbacks = {
35610+static const struct lapb_register_struct lapbeth_callbacks = {
35611 .connect_confirmation = lapbeth_connected,
35612 .connect_indication = lapbeth_connected,
35613 .disconnect_confirmation = lapbeth_disconnected,
35614diff -urNp linux-2.6.39/drivers/net/wan/x25_asy.c linux-2.6.39/drivers/net/wan/x25_asy.c
35615--- linux-2.6.39/drivers/net/wan/x25_asy.c 2011-05-19 00:06:34.000000000 -0400
35616+++ linux-2.6.39/drivers/net/wan/x25_asy.c 2011-05-22 19:36:31.000000000 -0400
35617@@ -434,7 +434,7 @@ static void x25_asy_disconnected(struct
35618 netif_rx(skb);
35619 }
35620
35621-static struct lapb_register_struct x25_asy_callbacks = {
35622+static const struct lapb_register_struct x25_asy_callbacks = {
35623 .connect_confirmation = x25_asy_connected,
35624 .connect_indication = x25_asy_connected,
35625 .disconnect_confirmation = x25_asy_disconnected,
35626diff -urNp linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c
35627--- linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c 2011-05-19 00:06:34.000000000 -0400
35628+++ linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c 2011-05-22 19:36:31.000000000 -0400
35629@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
35630 int do_autopm = 1;
35631 DECLARE_COMPLETION_ONSTACK(notif_completion);
35632
35633+ pax_track_stack();
35634+
35635 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
35636 i2400m, ack, ack_size);
35637 BUG_ON(_ack == i2400m->bm_ack_buf);
35638diff -urNp linux-2.6.39/drivers/net/wireless/airo.c linux-2.6.39/drivers/net/wireless/airo.c
35639--- linux-2.6.39/drivers/net/wireless/airo.c 2011-05-19 00:06:34.000000000 -0400
35640+++ linux-2.6.39/drivers/net/wireless/airo.c 2011-05-22 19:36:31.000000000 -0400
35641@@ -3001,6 +3001,8 @@ static void airo_process_scan_results (s
35642 BSSListElement * loop_net;
35643 BSSListElement * tmp_net;
35644
35645+ pax_track_stack();
35646+
35647 /* Blow away current list of scan results */
35648 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
35649 list_move_tail (&loop_net->list, &ai->network_free_list);
35650@@ -3792,6 +3794,8 @@ static u16 setup_card(struct airo_info *
35651 WepKeyRid wkr;
35652 int rc;
35653
35654+ pax_track_stack();
35655+
35656 memset( &mySsid, 0, sizeof( mySsid ) );
35657 kfree (ai->flash);
35658 ai->flash = NULL;
35659@@ -4760,6 +4764,8 @@ static int proc_stats_rid_open( struct i
35660 __le32 *vals = stats.vals;
35661 int len;
35662
35663+ pax_track_stack();
35664+
35665 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35666 return -ENOMEM;
35667 data = file->private_data;
35668@@ -5483,6 +5489,8 @@ static int proc_BSSList_open( struct ino
35669 /* If doLoseSync is not 1, we won't do a Lose Sync */
35670 int doLoseSync = -1;
35671
35672+ pax_track_stack();
35673+
35674 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35675 return -ENOMEM;
35676 data = file->private_data;
35677@@ -7190,6 +7198,8 @@ static int airo_get_aplist(struct net_de
35678 int i;
35679 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
35680
35681+ pax_track_stack();
35682+
35683 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
35684 if (!qual)
35685 return -ENOMEM;
35686@@ -7750,6 +7760,8 @@ static void airo_read_wireless_stats(str
35687 CapabilityRid cap_rid;
35688 __le32 *vals = stats_rid.vals;
35689
35690+ pax_track_stack();
35691+
35692 /* Get stats out of the card */
35693 clear_bit(JOB_WSTATS, &local->jobs);
35694 if (local->power.event) {
35695diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c
35696--- linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c 2011-05-19 00:06:34.000000000 -0400
35697+++ linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c 2011-05-22 19:36:31.000000000 -0400
35698@@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
35699 unsigned int v;
35700 u64 tsf;
35701
35702+ pax_track_stack();
35703+
35704 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
35705 len += snprintf(buf+len, sizeof(buf)-len,
35706 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
35707@@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
35708 unsigned int len = 0;
35709 unsigned int i;
35710
35711+ pax_track_stack();
35712+
35713 len += snprintf(buf+len, sizeof(buf)-len,
35714 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
35715
35716@@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
35717 unsigned int i;
35718 unsigned int v;
35719
35720+ pax_track_stack();
35721+
35722 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
35723 sc->ah->ah_ant_mode);
35724 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
35725@@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
35726 unsigned int len = 0;
35727 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
35728
35729+ pax_track_stack();
35730+
35731 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
35732 sc->bssidmask);
35733 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
35734@@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
35735 unsigned int len = 0;
35736 int i;
35737
35738+ pax_track_stack();
35739+
35740 len += snprintf(buf+len, sizeof(buf)-len,
35741 "RX\n---------------------\n");
35742 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
35743@@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
35744 char buf[700];
35745 unsigned int len = 0;
35746
35747+ pax_track_stack();
35748+
35749 len += snprintf(buf+len, sizeof(buf)-len,
35750 "HW has PHY error counters:\t%s\n",
35751 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
35752@@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
35753 struct ath5k_buf *bf, *bf0;
35754 int i, n;
35755
35756+ pax_track_stack();
35757+
35758 len += snprintf(buf+len, sizeof(buf)-len,
35759 "available txbuffers: %d\n", sc->txbuf_len);
35760
35761diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c
35762--- linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-19 00:06:34.000000000 -0400
35763+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-22 19:36:31.000000000 -0400
35764@@ -734,6 +734,8 @@ static void ar9003_hw_tx_iq_cal(struct a
35765 s32 i, j, ip, im, nmeasurement;
35766 u8 nchains = get_streams(common->tx_chainmask);
35767
35768+ pax_track_stack();
35769+
35770 for (ip = 0; ip < MPASS; ip++) {
35771 REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
35772 AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
35773@@ -856,6 +858,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
35774 int i, ip, im, j;
35775 int nmeasurement;
35776
35777+ pax_track_stack();
35778+
35779 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
35780 if (ah->txchainmask & (1 << i))
35781 num_chains++;
35782diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
35783--- linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-19 00:06:34.000000000 -0400
35784+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-22 19:36:31.000000000 -0400
35785@@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
35786 int theta_low_bin = 0;
35787 int i;
35788
35789+ pax_track_stack();
35790+
35791 /* disregard any bin that contains <= 16 samples */
35792 thresh_accum_cnt = 16;
35793 scale_factor = 5;
35794diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c
35795--- linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c 2011-05-19 00:06:34.000000000 -0400
35796+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c 2011-05-22 19:36:31.000000000 -0400
35797@@ -335,6 +335,8 @@ static ssize_t read_file_interrupt(struc
35798 char buf[512];
35799 unsigned int len = 0;
35800
35801+ pax_track_stack();
35802+
35803 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
35804 len += snprintf(buf + len, sizeof(buf) - len,
35805 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
35806@@ -422,6 +424,8 @@ static ssize_t read_file_wiphy(struct fi
35807 u8 addr[ETH_ALEN];
35808 u32 tmp;
35809
35810+ pax_track_stack();
35811+
35812 len += snprintf(buf + len, sizeof(buf) - len,
35813 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
35814 wiphy_name(sc->hw->wiphy),
35815diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c
35816--- linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-19 00:06:34.000000000 -0400
35817+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-22 19:36:31.000000000 -0400
35818@@ -737,6 +737,8 @@ static ssize_t read_file_tgt_stats(struc
35819 unsigned int len = 0;
35820 int ret = 0;
35821
35822+ pax_track_stack();
35823+
35824 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
35825
35826 WMI_CMD(WMI_TGT_STATS_CMDID);
35827@@ -782,6 +784,8 @@ static ssize_t read_file_xmit(struct fil
35828 char buf[512];
35829 unsigned int len = 0;
35830
35831+ pax_track_stack();
35832+
35833 len += snprintf(buf + len, sizeof(buf) - len,
35834 "%20s : %10u\n", "Buffers queued",
35835 priv->debug.tx_stats.buf_queued);
35836@@ -831,6 +835,8 @@ static ssize_t read_file_recv(struct fil
35837 char buf[512];
35838 unsigned int len = 0;
35839
35840+ pax_track_stack();
35841+
35842 len += snprintf(buf + len, sizeof(buf) - len,
35843 "%20s : %10u\n", "SKBs allocated",
35844 priv->debug.rx_stats.skb_allocated);
35845@@ -1816,7 +1822,7 @@ static void ath9k_htc_set_coverage_class
35846 mutex_unlock(&priv->mutex);
35847 }
35848
35849-struct ieee80211_ops ath9k_htc_ops = {
35850+const struct ieee80211_ops ath9k_htc_ops = {
35851 .tx = ath9k_htc_tx,
35852 .start = ath9k_htc_start,
35853 .stop = ath9k_htc_stop,
35854diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h
35855--- linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h 2011-05-19 00:06:34.000000000 -0400
35856+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h 2011-05-22 19:36:31.000000000 -0400
35857@@ -42,7 +42,7 @@
35858 #define TSF_TO_TU(_h, _l) \
35859 ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
35860
35861-extern struct ieee80211_ops ath9k_htc_ops;
35862+extern const struct ieee80211_ops ath9k_htc_ops;
35863 extern int htc_modparam_nohwcrypt;
35864
35865 enum htc_phymode {
35866diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h
35867--- linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h 2011-05-19 00:06:34.000000000 -0400
35868+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h 2011-05-22 19:36:31.000000000 -0400
35869@@ -753,9 +753,7 @@ struct ath_hw {
35870 } enable_32kHz_clock;
35871
35872 /* Private to hardware code */
35873- struct ath_hw_private_ops private_ops;
35874- /* Accessed by the lower level driver */
35875- struct ath_hw_ops ops;
35876+ struct ath_hw_private_ops private_ops;struct ath_hw_ops ops;
35877
35878 /* Used to program the radio on non single-chip devices */
35879 u32 *analogBank0Data;
35880diff -urNp linux-2.6.39/drivers/net/wireless/b43/debugfs.c linux-2.6.39/drivers/net/wireless/b43/debugfs.c
35881--- linux-2.6.39/drivers/net/wireless/b43/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35882+++ linux-2.6.39/drivers/net/wireless/b43/debugfs.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 35883@@ -43,7 +43,7 @@ static struct dentry *rootdir;
35884 struct b43_debugfs_fops {
35885 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
35886 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
35887- struct file_operations fops;
35888+ const struct file_operations fops;
35889 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
35890 size_t file_struct_offset;
35891 };
66a7e928
MT		 35892diff -urNp linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c
35893--- linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35894+++ linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c 2011-05-22 19:36:31.000000000 -0400
ae4e228f
MT		 35895@@ -44,7 +44,7 @@ static struct dentry *rootdir;
35896 struct b43legacy_debugfs_fops {
35897 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
35898 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
35899- struct file_operations fops;
35900+ const struct file_operations fops;
35901 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
35902 size_t file_struct_offset;
35903 /* Take wl->irq_lock before calling read/write? */
66a7e928
MT		 35904diff -urNp linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c
35905--- linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-19 00:06:34.000000000 -0400
35906+++ linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-22 19:36:31.000000000 -0400
35907@@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
35908 int err;
35909 DECLARE_SSID_BUF(ssid);
35910
35911+ pax_track_stack();
35912+
35913 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
35914
35915 if (ssid_len)
35916@@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
35917 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
35918 int err;
35919
35920+ pax_track_stack();
35921+
35922 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
35923 idx, keylen, len);
35924
35925diff -urNp linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c
35926--- linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-19 00:06:34.000000000 -0400
35927+++ linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-22 19:36:31.000000000 -0400
35928@@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
35929 unsigned long flags;
35930 DECLARE_SSID_BUF(ssid);
35931
35932+ pax_track_stack();
35933+
35934 LIBIPW_DEBUG_SCAN("'%s' (%pM"
35935 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
35936 print_ssid(ssid, info_element->data, info_element->len),
35937diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c
35938--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-19 00:06:34.000000000 -0400
35939+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-22 19:36:31.000000000 -0400
35940@@ -2630,7 +2630,7 @@ static int iwl3945_load_bsm(struct iwl_p
35941 return 0;
35942 }
35943
35944-static struct iwl_hcmd_ops iwl3945_hcmd = {
35945+static const struct iwl_hcmd_ops iwl3945_hcmd = {
35946 .rxon_assoc = iwl3945_send_rxon_assoc,
35947 .commit_rxon = iwl3945_commit_rxon,
35948 };
35949@@ -2675,7 +2675,7 @@ static const struct iwl_legacy_ops iwl39
35950 .manage_ibss_station = iwl3945_manage_ibss_station,
35951 };
35952
35953-static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
35954+static const struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
35955 .get_hcmd_size = iwl3945_get_hcmd_size,
35956 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
35957 .request_scan = iwl3945_request_scan,
35958diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c
35959--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-19 00:06:34.000000000 -0400
35960+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-22 19:36:32.000000000 -0400
35961@@ -1904,7 +1904,7 @@ static void iwl4965_rx_handler_setup(str
35962 priv->rx_handlers[BEACON_NOTIFICATION] = iwl4965_rx_beacon_notif;
35963 }
35964
35965-static struct iwl_hcmd_ops iwl4965_hcmd = {
35966+static const struct iwl_hcmd_ops iwl4965_hcmd = {
35967 .rxon_assoc = iwl4965_send_rxon_assoc,
35968 .commit_rxon = iwl4965_commit_rxon,
35969 .set_rxon_chain = iwl4965_set_rxon_chain,
35970@@ -2056,7 +2056,7 @@ static void iwl4965_config_ap(struct iwl
35971 iwl4965_send_beacon_cmd(priv);
35972 }
35973
35974-static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
35975+static const struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
35976 .get_hcmd_size = iwl4965_get_hcmd_size,
35977 .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
35978 .request_scan = iwl4965_request_scan,
35979@@ -2114,7 +2114,7 @@ static const struct iwl_legacy_ops iwl49
35980 .update_bcast_stations = iwl4965_update_bcast_stations,
35981 };
35982
35983-struct ieee80211_ops iwl4965_hw_ops = {
35984+const struct ieee80211_ops iwl4965_hw_ops = {
35985 .tx = iwl4965_mac_tx,
35986 .start = iwl4965_mac_start,
35987 .stop = iwl4965_mac_stop,
35988diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h
35989--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-19 00:06:34.000000000 -0400
35990+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-22 19:36:32.000000000 -0400
35991@@ -70,7 +70,7 @@ extern struct iwl_cfg iwl4965_cfg;
35992
35993 extern struct iwl_mod_params iwl4965_mod_params;
35994
35995-extern struct ieee80211_ops iwl4965_hw_ops;
35996+extern const struct ieee80211_ops iwl4965_hw_ops;
35997
35998 /* tx queue */
35999 void iwl4965_free_tfds_in_queue(struct iwl_priv *priv,
36000diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h
36001--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36002+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36003@@ -150,7 +150,7 @@ struct iwl_lib_ops {
36004 int (*set_channel_switch)(struct iwl_priv *priv,
36005 struct ieee80211_channel_switch *ch_switch);
36006 /* power management */
36007- struct iwl_apm_ops apm_ops;
36008+ const struct iwl_apm_ops apm_ops;
36009
36010 /* power */
36011 int (*send_tx_power) (struct iwl_priv *priv);
36012@@ -160,12 +160,12 @@ struct iwl_lib_ops {
36013 struct iwl_eeprom_ops eeprom_ops;
36014
36015 /* temperature */
36016- struct iwl_temp_ops temp_ops;
36017+ const struct iwl_temp_ops temp_ops;
36018 /* check for plcp health */
36019 bool (*check_plcp_health)(struct iwl_priv *priv,
36020 struct iwl_rx_packet *pkt);
36021
36022- struct iwl_debugfs_ops debugfs_ops;
36023+ const struct iwl_debugfs_ops debugfs_ops;
36024
36025 };
36026
36027diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c
36028--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-19 00:06:34.000000000 -0400
36029+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-22 19:36:32.000000000 -0400
36030@@ -422,11 +422,11 @@ static struct iwl_lib_ops iwl6030_lib =
36031 }
36032 };
36033
36034-static struct iwl_nic_ops iwl6050_nic_ops = {
36035+static const struct iwl_nic_ops iwl6050_nic_ops = {
36036 .additional_nic_config = &iwl6050_additional_nic_config,
36037 };
36038
36039-static struct iwl_nic_ops iwl6150_nic_ops = {
36040+static const struct iwl_nic_ops iwl6150_nic_ops = {
36041 .additional_nic_config = &iwl6150_additional_nic_config,
36042 };
36043
36044diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h
36045--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-19 00:06:34.000000000 -0400
36046+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-22 19:36:32.000000000 -0400
36047@@ -109,9 +109,9 @@ extern struct iwl_cfg iwl230_bg_cfg;
36048 extern struct iwl_cfg iwl230_bgn_cfg;
36049
36050 extern struct iwl_mod_params iwlagn_mod_params;
36051-extern struct iwl_hcmd_ops iwlagn_hcmd;
36052-extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
36053-extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36054+extern const struct iwl_hcmd_ops iwlagn_hcmd;
36055+extern const struct iwl_hcmd_ops iwlagn_bt_hcmd;
36056+extern const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36057
36058 extern struct ieee80211_ops iwlagn_hw_ops;
36059 extern struct ieee80211_ops iwl4965_hw_ops;
36060diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
36061--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-19 00:06:34.000000000 -0400
36062+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-22 19:36:32.000000000 -0400
36063@@ -363,7 +363,7 @@ static int iwlagn_set_pan_params(struct
36064 return ret;
36065 }
36066
36067-struct iwl_hcmd_ops iwlagn_hcmd = {
36068+const struct iwl_hcmd_ops iwlagn_hcmd = {
36069 .rxon_assoc = iwlagn_send_rxon_assoc,
36070 .commit_rxon = iwlagn_commit_rxon,
36071 .set_rxon_chain = iwlagn_set_rxon_chain,
36072@@ -372,7 +372,7 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
36073 .set_pan_params = iwlagn_set_pan_params,
36074 };
36075
36076-struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36077+const struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36078 .rxon_assoc = iwlagn_send_rxon_assoc,
36079 .commit_rxon = iwlagn_commit_rxon,
36080 .set_rxon_chain = iwlagn_set_rxon_chain,
36081@@ -381,7 +381,7 @@ struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36082 .set_pan_params = iwlagn_set_pan_params,
36083 };
36084
36085-struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36086+const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36087 .get_hcmd_size = iwlagn_get_hcmd_size,
36088 .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
36089 .gain_computation = iwlagn_gain_computation,
36090diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
36091--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-19 00:06:34.000000000 -0400
36092+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-22 19:36:32.000000000 -0400
36093@@ -883,6 +883,8 @@ static void rs_tx_status(void *priv_r, s
36094 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
36095 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
36096
36097+ pax_track_stack();
36098+
36099 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
36100
36101 /* Treat uninitialized rate scaling data same as non-existing. */
36102@@ -2894,6 +2896,8 @@ static void rs_fill_link_cmd(struct iwl_
36103 container_of(lq_sta, struct iwl_station_priv, lq_sta);
36104 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
36105
36106+ pax_track_stack();
36107+
36108 /* Override starting rate (index 0) if needed for debug purposes */
36109 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
36110
36111diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h
36112--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36113+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36114@@ -198,28 +198,25 @@ struct iwl_lib_ops {
36115 int (*set_channel_switch)(struct iwl_priv *priv,
36116 struct ieee80211_channel_switch *ch_switch);
36117 /* power management */
36118- struct iwl_apm_ops apm_ops;
36119+ const struct iwl_apm_ops apm_ops;
36120
36121 /* power */
36122 int (*send_tx_power) (struct iwl_priv *priv);
36123 void (*update_chain_flags)(struct iwl_priv *priv);
36124
36125 /* isr */
36126- struct iwl_isr_ops isr_ops;
36127+ const struct iwl_isr_ops isr_ops;
36128
36129 /* eeprom operations (as defined in iwl-eeprom.h) */
36130 struct iwl_eeprom_ops eeprom_ops;
36131
36132 /* temperature */
36133- struct iwl_temp_ops temp_ops;
36134+ const struct iwl_temp_ops temp_ops;
36135
36136 int (*txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36137 void (*dev_txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36138
36139- struct iwl_debugfs_ops debugfs_ops;
36140-
36141- /* thermal throttling */
36142- struct iwl_tt_ops tt_ops;
36143+ const struct iwl_debugfs_ops debugfs_ops;const struct iwl_tt_ops tt_ops;
36144 };
36145
36146 struct iwl_led_ops {
36147diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c
36148--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-19 00:06:34.000000000 -0400
36149+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-22 19:36:32.000000000 -0400
36150@@ -549,6 +549,8 @@ static ssize_t iwl_dbgfs_status_read(str
36151 int pos = 0;
36152 const size_t bufsz = sizeof(buf);
36153
36154+ pax_track_stack();
36155+
36156 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
36157 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
36158 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
36159@@ -681,6 +683,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
36160 char buf[256 * NUM_IWL_RXON_CTX];
36161 const size_t bufsz = sizeof(buf);
36162
36163+ pax_track_stack();
36164+
36165 for_each_context(priv, ctx) {
36166 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
36167 ctx->ctxid);
36168diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h
36169--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-19 00:06:34.000000000 -0400
36170+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-22 19:36:32.000000000 -0400
df50ba0c
MT		 36171@@ -68,8 +68,8 @@ do {
36172 } while (0)
ae4e228f 36173
df50ba0c
MT		 36174 #else
36175-#define IWL_DEBUG(__priv, level, fmt, args...)
36176-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
36177+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
36178+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
36179 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
6892158b 36180 const void *p, u32 len)
df50ba0c 36181 {}
66a7e928
MT		 36182diff -urNp linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c
36183--- linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
36184+++ linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
36185@@ -763,7 +763,7 @@ static int iwm_cfg80211_flush_pmksa(stru
36186 }
36187
36188
36189-static struct cfg80211_ops iwm_cfg80211_ops = {
36190+static const struct cfg80211_ops iwm_cfg80211_ops = {
36191 .change_virtual_intf = iwm_cfg80211_change_iface,
36192 .add_key = iwm_cfg80211_add_key,
36193 .get_key = iwm_cfg80211_get_key,
36194diff -urNp linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c
36195--- linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36196+++ linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36197@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
36198 int buf_len = 512;
36199 size_t len = 0;
36200
36201+ pax_track_stack();
36202+
36203 if (*ppos != 0)
36204 return 0;
36205 if (count < sizeof(buf))
36206diff -urNp linux-2.6.39/drivers/net/wireless/libertas/cfg.c linux-2.6.39/drivers/net/wireless/libertas/cfg.c
36207--- linux-2.6.39/drivers/net/wireless/libertas/cfg.c 2011-05-19 00:06:34.000000000 -0400
36208+++ linux-2.6.39/drivers/net/wireless/libertas/cfg.c 2011-05-22 19:36:32.000000000 -0400
36209@@ -2003,7 +2003,7 @@ static int lbs_leave_ibss(struct wiphy *
36210 * Initialization
36211 */
36212
36213-static struct cfg80211_ops lbs_cfg80211_ops = {
36214+static const struct cfg80211_ops lbs_cfg80211_ops = {
36215 .set_channel = lbs_cfg_set_channel,
36216 .scan = lbs_cfg_scan,
36217 .connect = lbs_cfg_connect,
36218diff -urNp linux-2.6.39/drivers/net/wireless/libertas/debugfs.c linux-2.6.39/drivers/net/wireless/libertas/debugfs.c
36219--- linux-2.6.39/drivers/net/wireless/libertas/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36220+++ linux-2.6.39/drivers/net/wireless/libertas/debugfs.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 36221@@ -702,7 +702,7 @@ out_unlock:
ae4e228f
MT		 36222 struct lbs_debugfs_files {
36223 const char *name;
36224 int perm;
36225- struct file_operations fops;
36226+ const struct file_operations fops;
36227 };
36228
36229 static const struct lbs_debugfs_files debugfs_files[] = {
66a7e928
MT		 36230diff -urNp linux-2.6.39/drivers/net/wireless/rndis_wlan.c linux-2.6.39/drivers/net/wireless/rndis_wlan.c
36231--- linux-2.6.39/drivers/net/wireless/rndis_wlan.c 2011-05-19 00:06:34.000000000 -0400
36232+++ linux-2.6.39/drivers/net/wireless/rndis_wlan.c 2011-05-22 19:36:32.000000000 -0400
16454cff 36233@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
df50ba0c
MT		 36234
36235 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
36236
36237- if (rts_threshold < 0 || rts_threshold > 2347)
36238+ if (rts_threshold > 2347)
36239 rts_threshold = 2347;
36240
36241 tmp = cpu_to_le32(rts_threshold);
66a7e928
MT		 36242diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c
36243--- linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c 2011-05-19 00:06:34.000000000 -0400
36244+++ linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c 2011-05-22 19:36:32.000000000 -0400
36245@@ -1869,7 +1869,7 @@ int rtl_pci_resume(struct pci_dev *pdev)
36246 }
36247 EXPORT_SYMBOL(rtl_pci_resume);
36248
36249-struct rtl_intf_ops rtl_pci_ops = {
36250+const struct rtl_intf_ops rtl_pci_ops = {
36251 .adapter_start = rtl_pci_start,
36252 .adapter_stop = rtl_pci_stop,
36253 .adapter_tx = rtl_pci_tx,
36254diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h
36255--- linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h 2011-05-19 00:06:34.000000000 -0400
36256+++ linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h 2011-05-22 19:36:32.000000000 -0400
36257@@ -234,7 +234,7 @@ struct rtl_pci_priv {
36258
36259 int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw);
36260
36261-extern struct rtl_intf_ops rtl_pci_ops;
36262+extern const struct rtl_intf_ops rtl_pci_ops;
36263
36264 int __devinit rtl_pci_probe(struct pci_dev *pdev,
36265 const struct pci_device_id *id);
36266diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
36267--- linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-19 00:06:34.000000000 -0400
36268+++ linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-22 19:36:32.000000000 -0400
36269@@ -827,6 +827,8 @@ static bool _rtl92c_phy_sw_chnl_step_by_
36270 u8 rfpath;
36271 u8 num_total_rfpath = rtlphy->num_total_rfpath;
36272
36273+ pax_track_stack();
36274+
36275 precommoncmdcnt = 0;
36276 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
36277 MAX_PRECMD_CNT,
36278diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
36279--- linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-19 00:06:34.000000000 -0400
36280+++ linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-22 19:36:32.000000000 -0400
36281@@ -96,7 +96,7 @@ void rtl92c_deinit_sw_vars(struct ieee80
36282 }
36283 }
36284
36285-static struct rtl_hal_ops rtl8192ce_hal_ops = {
36286+static const struct rtl_hal_ops rtl8192ce_hal_ops = {
36287 .init_sw_vars = rtl92c_init_sw_vars,
36288 .deinit_sw_vars = rtl92c_deinit_sw_vars,
36289 .read_eeprom_info = rtl92ce_read_eeprom_info,
36290@@ -151,7 +151,7 @@ static struct rtl_mod_params rtl92ce_mod
36291 .sw_crypto = 0,
36292 };
36293
36294-static struct rtl_hal_cfg rtl92ce_hal_cfg = {
36295+static const struct rtl_hal_cfg rtl92ce_hal_cfg = {
36296 .name = "rtl92c_pci",
36297 .fw_name = "rtlwifi/rtl8192cfw.bin",
36298 .ops = &rtl8192ce_hal_ops,
36299diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
36300--- linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-19 00:06:34.000000000 -0400
36301+++ linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-22 19:36:32.000000000 -0400
36302@@ -77,7 +77,7 @@ static void rtl92cu_deinit_sw_vars(struc
36303 }
36304 }
36305
36306-static struct rtl_hal_ops rtl8192cu_hal_ops = {
36307+static const struct rtl_hal_ops rtl8192cu_hal_ops = {
36308 .init_sw_vars = rtl92cu_init_sw_vars,
36309 .deinit_sw_vars = rtl92cu_deinit_sw_vars,
36310 .read_chip_version = rtl92c_read_chip_version,
36311@@ -147,7 +147,7 @@ static struct rtl_hal_usbint_cfg rtl92cu
36312 .usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
36313 };
36314
36315-static struct rtl_hal_cfg rtl92cu_hal_cfg = {
36316+static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
36317 .name = "rtl92c_usb",
36318 .fw_name = "rtlwifi/rtl8192cufw.bin",
36319 .ops = &rtl8192cu_hal_ops,
36320diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c
36321--- linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c 2011-05-19 00:06:34.000000000 -0400
36322+++ linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c 2011-05-22 19:36:32.000000000 -0400
36323@@ -913,7 +913,7 @@ static bool rtl_usb_tx_chk_waitq_insert(
36324 return false;
36325 }
36326
36327-static struct rtl_intf_ops rtl_usb_ops = {
36328+static const struct rtl_intf_ops rtl_usb_ops = {
36329 .adapter_start = rtl_usb_start,
36330 .adapter_stop = rtl_usb_stop,
36331 .adapter_tx = rtl_usb_tx,
36332diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h
36333--- linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h 2011-05-19 00:06:34.000000000 -0400
36334+++ linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h 2011-05-22 19:36:32.000000000 -0400
36335@@ -1447,7 +1447,7 @@ struct rtl_hal_cfg {
36336 u8 bar_id;
36337 char *name;
36338 char *fw_name;
36339- struct rtl_hal_ops *ops;
36340+ const struct rtl_hal_ops *ops;
36341 struct rtl_mod_params *mod_params;
36342 struct rtl_hal_usbint_cfg *usb_interface_cfg;
36343
36344@@ -1533,7 +1533,7 @@ struct rtl_priv {
36345 *intf_ops : for diff interrface usb/pcie
36346 */
36347 struct rtl_hal_cfg *cfg;
36348- struct rtl_intf_ops *intf_ops;
36349+ const struct rtl_intf_ops *intf_ops;
36350
36351 /*this var will be set by set_bit,
36352 and was used to indicate status of
36353diff -urNp linux-2.6.39/drivers/net/wireless/wl12xx/spi.c linux-2.6.39/drivers/net/wireless/wl12xx/spi.c
36354--- linux-2.6.39/drivers/net/wireless/wl12xx/spi.c 2011-05-19 00:06:34.000000000 -0400
36355+++ linux-2.6.39/drivers/net/wireless/wl12xx/spi.c 2011-05-22 19:36:32.000000000 -0400
36356@@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
36357 u32 chunk_len;
36358 int i;
36359
36360+ pax_track_stack();
36361+
36362 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
36363
36364 spi_message_init(&m);
36365diff -urNp linux-2.6.39/drivers/net/xen-netback/interface.c linux-2.6.39/drivers/net/xen-netback/interface.c
36366--- linux-2.6.39/drivers/net/xen-netback/interface.c 2011-05-19 00:06:34.000000000 -0400
36367+++ linux-2.6.39/drivers/net/xen-netback/interface.c 2011-05-22 19:36:32.000000000 -0400
36368@@ -273,7 +273,7 @@ static void xenvif_get_strings(struct ne
36369 }
36370 }
36371
36372-static struct ethtool_ops xenvif_ethtool_ops = {
36373+static const struct ethtool_ops xenvif_ethtool_ops = {
36374 .get_tx_csum = ethtool_op_get_tx_csum,
36375 .set_tx_csum = xenvif_set_tx_csum,
36376 .get_sg = ethtool_op_get_sg,
36377diff -urNp linux-2.6.39/drivers/net/xilinx_emaclite.c linux-2.6.39/drivers/net/xilinx_emaclite.c
36378--- linux-2.6.39/drivers/net/xilinx_emaclite.c 2011-05-19 00:06:34.000000000 -0400
36379+++ linux-2.6.39/drivers/net/xilinx_emaclite.c 2011-05-22 19:36:32.000000000 -0400
36380@@ -1085,7 +1085,7 @@ static bool get_bool(struct platform_dev
36381 }
36382 }
36383
36384-static struct net_device_ops xemaclite_netdev_ops;
36385+static const struct net_device_ops xemaclite_netdev_ops;
36386
36387 /**
36388 * xemaclite_of_probe - Probe method for the Emaclite device.
36389@@ -1264,7 +1264,7 @@ xemaclite_poll_controller(struct net_dev
36390 }
36391 #endif
36392
36393-static struct net_device_ops xemaclite_netdev_ops = {
36394+static const struct net_device_ops xemaclite_netdev_ops = {
36395 .ndo_open = xemaclite_open,
36396 .ndo_stop = xemaclite_close,
36397 .ndo_start_xmit = xemaclite_send,
36398diff -urNp linux-2.6.39/drivers/nfc/pn544.c linux-2.6.39/drivers/nfc/pn544.c
36399--- linux-2.6.39/drivers/nfc/pn544.c 2011-05-19 00:06:34.000000000 -0400
36400+++ linux-2.6.39/drivers/nfc/pn544.c 2011-05-22 19:36:32.000000000 -0400
36401@@ -89,7 +89,7 @@ static ssize_t pn544_test(struct device
36402
36403 static int pn544_enable(struct pn544_info *info, int mode)
36404 {
36405- struct pn544_nfc_platform_data *pdata;
36406+ const struct pn544_nfc_platform_data *pdata;
36407 struct i2c_client *client = info->i2c_dev;
36408
36409 int r;
36410@@ -118,7 +118,7 @@ static int pn544_enable(struct pn544_inf
36411
36412 static void pn544_disable(struct pn544_info *info)
36413 {
36414- struct pn544_nfc_platform_data *pdata;
36415+ const struct pn544_nfc_platform_data *pdata;
36416 struct i2c_client *client = info->i2c_dev;
36417
36418 pdata = client->dev.platform_data;
36419@@ -509,7 +509,7 @@ static long pn544_ioctl(struct file *fil
36420 struct pn544_info *info = container_of(file->private_data,
36421 struct pn544_info, miscdev);
36422 struct i2c_client *client = info->i2c_dev;
36423- struct pn544_nfc_platform_data *pdata;
36424+ const struct pn544_nfc_platform_data *pdata;
36425 unsigned int val;
36426 int r = 0;
36427
36428@@ -715,7 +715,7 @@ static int __devinit pn544_probe(struct
36429 const struct i2c_device_id *id)
36430 {
36431 struct pn544_info *info;
36432- struct pn544_nfc_platform_data *pdata;
36433+ const struct pn544_nfc_platform_data *pdata;
36434 int r = 0;
36435
36436 dev_dbg(&client->dev, "%s\n", __func__);
36437diff -urNp linux-2.6.39/drivers/of/pdt.c linux-2.6.39/drivers/of/pdt.c
36438--- linux-2.6.39/drivers/of/pdt.c 2011-05-19 00:06:34.000000000 -0400
36439+++ linux-2.6.39/drivers/of/pdt.c 2011-05-22 19:36:32.000000000 -0400
36440@@ -24,7 +24,7 @@
36441 #include <linux/of_pdt.h>
36442 #include <asm/prom.h>
36443
36444-static struct of_pdt_ops *of_pdt_prom_ops __initdata;
36445+static const struct of_pdt_ops *of_pdt_prom_ops;
36446
36447 void __initdata (*of_pdt_build_more)(struct device_node *dp,
36448 struct device_node ***nextp);
36449diff -urNp linux-2.6.39/drivers/oprofile/buffer_sync.c linux-2.6.39/drivers/oprofile/buffer_sync.c
36450--- linux-2.6.39/drivers/oprofile/buffer_sync.c 2011-05-19 00:06:34.000000000 -0400
36451+++ linux-2.6.39/drivers/oprofile/buffer_sync.c 2011-05-22 19:36:32.000000000 -0400
6892158b 36452@@ -342,7 +342,7 @@ static void add_data(struct op_entry *en
58c5fc13
MT		 36453 if (cookie == NO_COOKIE)
36454 offset = pc;
36455 if (cookie == INVALID_COOKIE) {
36456- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36457+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36458 offset = pc;
36459 }
36460 if (cookie != last_cookie) {
6892158b 36461@@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct
58c5fc13
MT		 36462 /* add userspace sample */
36463
36464 if (!mm) {
36465- atomic_inc(&oprofile_stats.sample_lost_no_mm);
36466+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
36467 return 0;
36468 }
36469
36470 cookie = lookup_dcookie(mm, s->eip, &offset);
36471
36472 if (cookie == INVALID_COOKIE) {
36473- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36474+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36475 return 0;
36476 }
36477
6892158b 36478@@ -562,7 +562,7 @@ void sync_buffer(int cpu)
58c5fc13
MT		 36479 /* ignore backtraces if failed to add a sample */
36480 if (state == sb_bt_start) {
36481 state = sb_bt_ignore;
36482- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
36483+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
36484 }
36485 }
36486 release_mm(mm);
66a7e928
MT		 36487diff -urNp linux-2.6.39/drivers/oprofile/event_buffer.c linux-2.6.39/drivers/oprofile/event_buffer.c
36488--- linux-2.6.39/drivers/oprofile/event_buffer.c 2011-05-19 00:06:34.000000000 -0400
36489+++ linux-2.6.39/drivers/oprofile/event_buffer.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 36490@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
36491 }
36492
58c5fc13
MT		 36493 if (buffer_pos == buffer_size) {
36494- atomic_inc(&oprofile_stats.event_lost_overflow);
36495+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
36496 return;
36497 }
36498
66a7e928
MT		 36499diff -urNp linux-2.6.39/drivers/oprofile/oprof.c linux-2.6.39/drivers/oprofile/oprof.c
36500--- linux-2.6.39/drivers/oprofile/oprof.c 2011-05-19 00:06:34.000000000 -0400
36501+++ linux-2.6.39/drivers/oprofile/oprof.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 36502@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
36503 if (oprofile_ops.switch_events())
36504 return;
58c5fc13 36505
ae4e228f
MT		 36506- atomic_inc(&oprofile_stats.multiplex_counter);
36507+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
36508 start_switch_worker();
36509 }
58c5fc13 36510
66a7e928
MT		 36511diff -urNp linux-2.6.39/drivers/oprofile/oprofilefs.c linux-2.6.39/drivers/oprofile/oprofilefs.c
36512--- linux-2.6.39/drivers/oprofile/oprofilefs.c 2011-05-19 00:06:34.000000000 -0400
36513+++ linux-2.6.39/drivers/oprofile/oprofilefs.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 36514@@ -186,7 +186,7 @@ static const struct file_operations atom
57199397
MT		 36515
36516
36517 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
36518- char const *name, atomic_t *val)
36519+ char const *name, atomic_unchecked_t *val)
36520 {
bc901d79
MT		 36521 return __oprofilefs_create_file(sb, root, name,
36522 &atomic_ro_fops, 0444, val);
66a7e928
MT		 36523diff -urNp linux-2.6.39/drivers/oprofile/oprofile_stats.c linux-2.6.39/drivers/oprofile/oprofile_stats.c
36524--- linux-2.6.39/drivers/oprofile/oprofile_stats.c 2011-05-19 00:06:34.000000000 -0400
36525+++ linux-2.6.39/drivers/oprofile/oprofile_stats.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f 36526@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
58c5fc13
MT		 36527 cpu_buf->sample_invalid_eip = 0;
36528 }
36529
36530- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
36531- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
36532- atomic_set(&oprofile_stats.event_lost_overflow, 0);
36533- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
ae4e228f 36534- atomic_set(&oprofile_stats.multiplex_counter, 0);
58c5fc13
MT		 36535+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
36536+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
36537+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
36538+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
ae4e228f 36539+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
58c5fc13
MT		 36540 }
36541
36542
66a7e928
MT		 36543diff -urNp linux-2.6.39/drivers/oprofile/oprofile_stats.h linux-2.6.39/drivers/oprofile/oprofile_stats.h
36544--- linux-2.6.39/drivers/oprofile/oprofile_stats.h 2011-05-19 00:06:34.000000000 -0400
36545+++ linux-2.6.39/drivers/oprofile/oprofile_stats.h 2011-05-22 19:36:32.000000000 -0400
ae4e228f 36546@@ -13,11 +13,11 @@
58c5fc13
MT		 36547 #include <asm/atomic.h>
36548
36549 struct oprofile_stat_struct {
36550- atomic_t sample_lost_no_mm;
36551- atomic_t sample_lost_no_mapping;
36552- atomic_t bt_lost_no_mapping;
36553- atomic_t event_lost_overflow;
ae4e228f 36554- atomic_t multiplex_counter;
58c5fc13
MT		 36555+ atomic_unchecked_t sample_lost_no_mm;
36556+ atomic_unchecked_t sample_lost_no_mapping;
36557+ atomic_unchecked_t bt_lost_no_mapping;
36558+ atomic_unchecked_t event_lost_overflow;
ae4e228f 36559+ atomic_unchecked_t multiplex_counter;
58c5fc13
MT		 36560 };
36561
36562 extern struct oprofile_stat_struct oprofile_stats;
66a7e928
MT		 36563diff -urNp linux-2.6.39/drivers/parisc/dino.c linux-2.6.39/drivers/parisc/dino.c
36564--- linux-2.6.39/drivers/parisc/dino.c 2011-05-19 00:06:34.000000000 -0400
36565+++ linux-2.6.39/drivers/parisc/dino.c 2011-05-22 19:36:32.000000000 -0400
36566@@ -238,7 +238,7 @@ static int dino_cfg_write(struct pci_bus
36567 return 0;
36568 }
36569
36570-static struct pci_ops dino_cfg_ops = {
36571+static const struct pci_ops dino_cfg_ops = {
36572 .read = dino_cfg_read,
36573 .write = dino_cfg_write,
36574 };
36575diff -urNp linux-2.6.39/drivers/parisc/lba_pci.c linux-2.6.39/drivers/parisc/lba_pci.c
36576--- linux-2.6.39/drivers/parisc/lba_pci.c 2011-05-19 00:06:34.000000000 -0400
36577+++ linux-2.6.39/drivers/parisc/lba_pci.c 2011-05-22 19:36:32.000000000 -0400
36578@@ -468,7 +468,7 @@ static int elroy_cfg_write(struct pci_bu
36579 }
36580
36581
36582-static struct pci_ops elroy_cfg_ops = {
36583+static const struct pci_ops elroy_cfg_ops = {
36584 .read = elroy_cfg_read,
36585 .write = elroy_cfg_write,
36586 };
36587@@ -541,7 +541,7 @@ static int mercury_cfg_write(struct pci_
36588 return 0;
36589 }
36590
36591-static struct pci_ops mercury_cfg_ops = {
36592+static const struct pci_ops mercury_cfg_ops = {
36593 .read = mercury_cfg_read,
36594 .write = mercury_cfg_write,
36595 };
36596@@ -1405,7 +1405,7 @@ lba_driver_probe(struct parisc_device *d
36597 {
36598 struct lba_device *lba_dev;
36599 struct pci_bus *lba_bus;
36600- struct pci_ops *cfg_ops;
36601+ const struct pci_ops *cfg_ops;
36602 u32 func_class;
36603 void *tmp_obj;
36604 char *version;
36605diff -urNp linux-2.6.39/drivers/parport/procfs.c linux-2.6.39/drivers/parport/procfs.c
36606--- linux-2.6.39/drivers/parport/procfs.c 2011-05-19 00:06:34.000000000 -0400
36607+++ linux-2.6.39/drivers/parport/procfs.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 36608@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
36609
36610 *ppos += len;
36611
36612- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
bc901d79 36613+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
ae4e228f
MT		 36614 }
36615
36616 #ifdef CONFIG_PARPORT_1284
36617@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
36618
36619 *ppos += len;
36620
36621- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
bc901d79 36622+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
ae4e228f
MT		 36623 }
36624 #endif /* IEEE1284.3 support. */
36625
66a7e928
MT		 36626diff -urNp linux-2.6.39/drivers/pci/access.c linux-2.6.39/drivers/pci/access.c
36627--- linux-2.6.39/drivers/pci/access.c 2011-05-19 00:06:34.000000000 -0400
36628+++ linux-2.6.39/drivers/pci/access.c 2011-05-22 19:36:32.000000000 -0400
36629@@ -74,9 +74,9 @@ EXPORT_SYMBOL(pci_bus_write_config_dword
36630 *
36631 * Return previous raw operations
36632 */
36633-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops)
36634+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops)
36635 {
36636- struct pci_ops *old_ops;
36637+ const struct pci_ops *old_ops;
36638 unsigned long flags;
36639
36640 raw_spin_lock_irqsave(&pci_lock, flags);
36641diff -urNp linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c
36642--- linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c 2011-05-19 00:06:34.000000000 -0400
36643+++ linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 36644@@ -110,7 +110,7 @@ static int post_dock_fixups(struct notif
ae4e228f
MT		 36645 }
36646
36647
36648-static struct acpi_dock_ops acpiphp_dock_ops = {
36649+static const struct acpi_dock_ops acpiphp_dock_ops = {
36650 .handler = handle_hotplug_event_func,
36651 };
36652
66a7e928
MT		 36653diff -urNp linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c
36654--- linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-19 00:06:34.000000000 -0400
36655+++ linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 36656@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
36657
36658 void compaq_nvram_init (void __iomem *rom_start)
36659 {
36660+
36661+#ifndef CONFIG_PAX_KERNEXEC
36662 if (rom_start) {
36663 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
36664 }
36665+#endif
36666+
36667 dbg("int15 entry = %p\n", compaq_int15_entry_point);
36668
36669 /* initialize our int15 lock */
66a7e928
MT		 36670diff -urNp linux-2.6.39/drivers/pci/hotplug/shpchp.h linux-2.6.39/drivers/pci/hotplug/shpchp.h
36671--- linux-2.6.39/drivers/pci/hotplug/shpchp.h 2011-05-19 00:06:34.000000000 -0400
36672+++ linux-2.6.39/drivers/pci/hotplug/shpchp.h 2011-05-22 19:36:32.000000000 -0400
36673@@ -86,7 +86,7 @@ struct slot {
36674 u8 presence_save;
36675 u8 pwr_save;
36676 struct controller *ctrl;
36677- struct hpc_ops *hpc_ops;
36678+ const struct hpc_ops *hpc_ops;
36679 struct hotplug_slot *hotplug_slot;
36680 struct list_head slot_list;
36681 struct delayed_work work; /* work for button event */
36682@@ -107,7 +107,7 @@ struct controller {
36683 int slot_num_inc; /* 1 or -1 */
36684 struct pci_dev *pci_dev;
36685 struct list_head slot_list;
36686- struct hpc_ops *hpc_ops;
36687+ const struct hpc_ops *hpc_ops;
36688 wait_queue_head_t queue; /* sleep & wake process */
36689 u8 slot_device_offset;
36690 u32 pcix_misc2_reg; /* for amd pogo errata */
36691diff -urNp linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c
36692--- linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c 2011-05-19 00:06:34.000000000 -0400
36693+++ linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c 2011-05-22 19:36:32.000000000 -0400
36694@@ -910,7 +910,7 @@ static int shpc_get_max_bus_speed(struct
36695 return retval;
36696 }
36697
36698-static struct hpc_ops shpchp_hpc_ops = {
36699+static const struct hpc_ops shpchp_hpc_ops = {
36700 .power_on_slot = hpc_power_on_slot,
36701 .slot_enable = hpc_slot_enable,
36702 .slot_disable = hpc_slot_disable,
36703diff -urNp linux-2.6.39/drivers/pci/intel-iommu.c linux-2.6.39/drivers/pci/intel-iommu.c
36704--- linux-2.6.39/drivers/pci/intel-iommu.c 2011-05-19 00:06:34.000000000 -0400
36705+++ linux-2.6.39/drivers/pci/intel-iommu.c 2011-05-22 19:36:32.000000000 -0400
36706@@ -391,7 +391,7 @@ static int intel_iommu_strict;
36707 static DEFINE_SPINLOCK(device_domain_lock);
36708 static LIST_HEAD(device_domain_list);
36709
36710-static struct iommu_ops intel_iommu_ops;
36711+static const struct iommu_ops intel_iommu_ops;
36712
36713 static int __init intel_iommu_setup(char *str)
36714 {
36715@@ -2945,7 +2945,7 @@ static int intel_mapping_error(struct de
ae4e228f
MT		 36716 return !dma_addr;
36717 }
36718
36719-struct dma_map_ops intel_dma_ops = {
36720+const struct dma_map_ops intel_dma_ops = {
36721 .alloc_coherent = intel_alloc_coherent,
36722 .free_coherent = intel_free_coherent,
36723 .map_sg = intel_map_sg,
66a7e928
MT		 36724@@ -3739,7 +3739,7 @@ static int intel_iommu_domain_has_cap(st
36725 return 0;
36726 }
36727
36728-static struct iommu_ops intel_iommu_ops = {
36729+static const struct iommu_ops intel_iommu_ops = {
36730 .domain_init = intel_iommu_domain_init,
36731 .domain_destroy = intel_iommu_domain_destroy,
36732 .attach_dev = intel_iommu_attach_device,
36733diff -urNp linux-2.6.39/drivers/pci/pci-acpi.c linux-2.6.39/drivers/pci/pci-acpi.c
36734--- linux-2.6.39/drivers/pci/pci-acpi.c 2011-05-19 00:06:34.000000000 -0400
36735+++ linux-2.6.39/drivers/pci/pci-acpi.c 2011-05-22 19:36:32.000000000 -0400
36736@@ -332,7 +332,7 @@ static int acpi_pci_run_wake(struct pci_
36737 return 0;
36738 }
36739
36740-static struct pci_platform_pm_ops acpi_pci_platform_pm = {
36741+static const struct pci_platform_pm_ops acpi_pci_platform_pm = {
36742 .is_manageable = acpi_pci_power_manageable,
36743 .set_state = acpi_pci_set_power_state,
36744 .choose_state = acpi_pci_choose_state,
36745diff -urNp linux-2.6.39/drivers/pci/pci.c linux-2.6.39/drivers/pci/pci.c
36746--- linux-2.6.39/drivers/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
36747+++ linux-2.6.39/drivers/pci/pci.c 2011-05-22 19:36:32.000000000 -0400
36748@@ -480,9 +480,9 @@ pci_restore_bars(struct pci_dev *dev)
36749 pci_update_resource(dev, i);
36750 }
36751
36752-static struct pci_platform_pm_ops *pci_platform_pm;
36753+static const struct pci_platform_pm_ops *pci_platform_pm;
36754
36755-int pci_set_platform_pm(struct pci_platform_pm_ops *ops)
36756+int pci_set_platform_pm(const struct pci_platform_pm_ops *ops)
36757 {
36758 if (!ops->is_manageable || !ops->set_state || !ops->choose_state
36759 || !ops->sleep_wake || !ops->can_wakeup)
36760diff -urNp linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c
36761--- linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-19 00:06:34.000000000 -0400
36762+++ linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-22 19:36:32.000000000 -0400
36763@@ -239,7 +239,7 @@ static bool find_source_device(struct pc
36764 static int report_error_detected(struct pci_dev *dev, void *data)
36765 {
36766 pci_ers_result_t vote;
36767- struct pci_error_handlers *err_handler;
36768+ const struct pci_error_handlers *err_handler;
36769 struct aer_broadcast_data *result_data;
36770 result_data = (struct aer_broadcast_data *) data;
36771
36772@@ -273,7 +273,7 @@ static int report_error_detected(struct
36773 static int report_mmio_enabled(struct pci_dev *dev, void *data)
36774 {
36775 pci_ers_result_t vote;
36776- struct pci_error_handlers *err_handler;
36777+ const struct pci_error_handlers *err_handler;
36778 struct aer_broadcast_data *result_data;
36779 result_data = (struct aer_broadcast_data *) data;
36780
36781@@ -291,7 +291,7 @@ static int report_mmio_enabled(struct pc
36782 static int report_slot_reset(struct pci_dev *dev, void *data)
36783 {
36784 pci_ers_result_t vote;
36785- struct pci_error_handlers *err_handler;
36786+ const struct pci_error_handlers *err_handler;
36787 struct aer_broadcast_data *result_data;
36788 result_data = (struct aer_broadcast_data *) data;
36789
36790@@ -308,7 +308,7 @@ static int report_slot_reset(struct pci_
36791
36792 static int report_resume(struct pci_dev *dev, void *data)
36793 {
36794- struct pci_error_handlers *err_handler;
36795+ const struct pci_error_handlers *err_handler;
36796
36797 dev->error_state = pci_channel_io_normal;
36798
36799diff -urNp linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c
36800--- linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c 2011-05-19 00:06:34.000000000 -0400
36801+++ linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c 2011-05-22 19:36:32.000000000 -0400
36802@@ -64,7 +64,7 @@ struct aer_error {
36803 struct pci_bus_ops {
36804 struct list_head list;
36805 struct pci_bus *bus;
36806- struct pci_ops *ops;
36807+ const struct pci_ops *ops;
36808 };
36809
36810 static LIST_HEAD(einjected);
36811@@ -110,7 +110,7 @@ static struct aer_error *__find_aer_erro
36812 }
36813
36814 /* inject_lock must be held before calling */
36815-static struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36816+static const struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36817 {
36818 struct pci_bus_ops *bus_ops;
36819
36820@@ -187,7 +187,7 @@ static int pci_read_aer(struct pci_bus *
36821 u32 *sim;
36822 struct aer_error *err;
36823 unsigned long flags;
36824- struct pci_ops *ops;
36825+ const struct pci_ops *ops;
36826 int domain;
36827
36828 spin_lock_irqsave(&inject_lock, flags);
36829@@ -219,7 +219,7 @@ int pci_write_aer(struct pci_bus *bus, u
36830 struct aer_error *err;
36831 unsigned long flags;
36832 int rw1cs;
36833- struct pci_ops *ops;
36834+ const struct pci_ops *ops;
36835 int domain;
36836
36837 spin_lock_irqsave(&inject_lock, flags);
36838@@ -254,7 +254,7 @@ static struct pci_ops pci_ops_aer = {
36839
36840 static void pci_bus_ops_init(struct pci_bus_ops *bus_ops,
36841 struct pci_bus *bus,
36842- struct pci_ops *ops)
36843+ const struct pci_ops *ops)
36844 {
36845 INIT_LIST_HEAD(&bus_ops->list);
36846 bus_ops->bus = bus;
36847@@ -263,7 +263,7 @@ static void pci_bus_ops_init(struct pci_
36848
36849 static int pci_bus_set_aer_ops(struct pci_bus *bus)
36850 {
36851- struct pci_ops *ops;
36852+ const struct pci_ops *ops;
36853 struct pci_bus_ops *bus_ops;
36854 unsigned long flags;
36855
36856diff -urNp linux-2.6.39/drivers/pci/pcie/aspm.c linux-2.6.39/drivers/pci/pcie/aspm.c
36857--- linux-2.6.39/drivers/pci/pcie/aspm.c 2011-05-19 00:06:34.000000000 -0400
36858+++ linux-2.6.39/drivers/pci/pcie/aspm.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 36859@@ -27,9 +27,9 @@
36860 #define MODULE_PARAM_PREFIX "pcie_aspm."
36861
36862 /* Note: those are not register definitions */
36863-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
36864-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
36865-#define ASPM_STATE_L1 (4) /* L1 state */
36866+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
36867+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
36868+#define ASPM_STATE_L1 (4U) /* L1 state */
36869 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
36870 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
36871
66a7e928
MT		 36872diff -urNp linux-2.6.39/drivers/pci/pci.h linux-2.6.39/drivers/pci/pci.h
36873--- linux-2.6.39/drivers/pci/pci.h 2011-05-19 00:06:34.000000000 -0400
36874+++ linux-2.6.39/drivers/pci/pci.h 2011-05-22 19:36:32.000000000 -0400
36875@@ -65,7 +65,7 @@ struct pci_platform_pm_ops {
36876 int (*run_wake)(struct pci_dev *dev, bool enable);
36877 };
36878
36879-extern int pci_set_platform_pm(struct pci_platform_pm_ops *ops);
36880+extern int pci_set_platform_pm(const struct pci_platform_pm_ops *ops);
36881 extern void pci_update_current_state(struct pci_dev *dev, pci_power_t state);
36882 extern void pci_disable_enabled_device(struct pci_dev *dev);
36883 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
36884diff -urNp linux-2.6.39/drivers/pci/probe.c linux-2.6.39/drivers/pci/probe.c
36885--- linux-2.6.39/drivers/pci/probe.c 2011-05-19 00:06:34.000000000 -0400
36886+++ linux-2.6.39/drivers/pci/probe.c 2011-05-22 19:36:32.000000000 -0400
57199397 36887@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
df50ba0c
MT		 36888 return ret;
36889 }
36890
36891-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
36892+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
36893 struct device_attribute *attr,
36894 char *buf)
36895 {
36896 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
36897 }
36898
36899-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
36900+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
36901 struct device_attribute *attr,
36902 char *buf)
36903 {
bc901d79
MT		 36904@@ -165,7 +165,7 @@ int __pci_read_base(struct pci_dev *dev,
36905 u32 l, sz, mask;
36906 u16 orig_cmd;
36907
36908- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
36909+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
36910
36911 if (!dev->mmio_always_on) {
36912 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
66a7e928
MT		 36913@@ -1407,7 +1407,7 @@ unsigned int __devinit pci_scan_child_bu
36914 }
36915
36916 struct pci_bus * pci_create_bus(struct device *parent,
36917- int bus, struct pci_ops *ops, void *sysdata)
36918+ int bus, const struct pci_ops *ops, void *sysdata)
36919 {
36920 int error;
36921 struct pci_bus *b, *b2;
36922@@ -1483,7 +1483,7 @@ err_out:
36923 }
36924
36925 struct pci_bus * __devinit pci_scan_bus_parented(struct device *parent,
36926- int bus, struct pci_ops *ops, void *sysdata)
36927+ int bus, const struct pci_ops *ops, void *sysdata)
36928 {
36929 struct pci_bus *b;
36930
36931diff -urNp linux-2.6.39/drivers/pci/proc.c linux-2.6.39/drivers/pci/proc.c
36932--- linux-2.6.39/drivers/pci/proc.c 2011-05-19 00:06:34.000000000 -0400
36933+++ linux-2.6.39/drivers/pci/proc.c 2011-05-22 19:41:37.000000000 -0400
bc901d79 36934@@ -476,7 +476,16 @@ static const struct file_operations proc
58c5fc13
MT		 36935 static int __init pci_proc_init(void)
36936 {
36937 struct pci_dev *dev = NULL;
36938+
36939+#ifdef CONFIG_GRKERNSEC_PROC_ADD
36940+#ifdef CONFIG_GRKERNSEC_PROC_USER
36941+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
36942+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
36943+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
36944+#endif
36945+#else
36946 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
36947+#endif
36948 proc_create("devices", 0, proc_bus_pci_dir,
36949 &proc_bus_pci_dev_operations);
36950 proc_initialized = 1;
66a7e928
MT		 36951diff -urNp linux-2.6.39/drivers/pci/xen-pcifront.c linux-2.6.39/drivers/pci/xen-pcifront.c
36952--- linux-2.6.39/drivers/pci/xen-pcifront.c 2011-05-19 00:06:34.000000000 -0400
36953+++ linux-2.6.39/drivers/pci/xen-pcifront.c 2011-05-22 19:36:32.000000000 -0400
36954@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
36955 struct pcifront_sd *sd = bus->sysdata;
36956 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36957
36958+ pax_track_stack();
36959+
36960 if (verbose_request)
36961 dev_info(&pdev->xdev->dev,
36962 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
36963@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
36964 struct pcifront_sd *sd = bus->sysdata;
36965 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36966
36967+ pax_track_stack();
36968+
36969 if (verbose_request)
36970 dev_info(&pdev->xdev->dev,
36971 "write dev=%04x:%02x:%02x.%01x - "
36972@@ -236,7 +240,7 @@ static int pcifront_bus_write(struct pci
36973 return errno_to_pcibios_err(do_pci_op(pdev, &op));
36974 }
36975
36976-struct pci_ops pcifront_bus_ops = {
36977+const struct pci_ops pcifront_bus_ops = {
36978 .read = pcifront_bus_read,
36979 .write = pcifront_bus_write,
36980 };
36981@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
36982 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36983 struct msi_desc *entry;
36984
36985+ pax_track_stack();
36986+
36987 if (nvec > SH_INFO_MAX_VEC) {
36988 dev_err(&dev->dev, "too much vector for pci frontend: %x."
36989 " Increase SH_INFO_MAX_VEC.\n", nvec);
36990@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
36991 struct pcifront_sd *sd = dev->bus->sysdata;
36992 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36993
36994+ pax_track_stack();
36995+
36996 err = do_pci_op(pdev, &op);
36997
36998 /* What should do for error ? */
36999@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
37000 struct pcifront_sd *sd = dev->bus->sysdata;
37001 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37002
37003+ pax_track_stack();
37004+
37005 err = do_pci_op(pdev, &op);
37006 if (likely(!err)) {
37007 vector[0] = op.value;
37008@@ -368,7 +378,7 @@ static void pci_frontend_disable_msi(str
37009 printk(KERN_DEBUG "get fake response frombackend\n");
37010 }
37011
37012-static struct xen_pci_frontend_ops pci_frontend_ops = {
37013+static const struct xen_pci_frontend_ops pci_frontend_ops = {
37014 .enable_msi = pci_frontend_enable_msi,
37015 .disable_msi = pci_frontend_disable_msi,
37016 .enable_msix = pci_frontend_enable_msix,
37017diff -urNp linux-2.6.39/drivers/pcmcia/at91_cf.c linux-2.6.39/drivers/pcmcia/at91_cf.c
37018--- linux-2.6.39/drivers/pcmcia/at91_cf.c 2011-05-19 00:06:34.000000000 -0400
37019+++ linux-2.6.39/drivers/pcmcia/at91_cf.c 2011-05-22 19:36:32.000000000 -0400
37020@@ -203,7 +203,7 @@ at91_cf_set_mem_map(struct pcmcia_socket
37021 return 0;
37022 }
37023
37024-static struct pccard_operations at91_cf_ops = {
37025+static const struct pccard_operations at91_cf_ops = {
37026 .init = at91_cf_ss_init,
37027 .suspend = at91_cf_ss_suspend,
37028 .get_status = at91_cf_get_status,
37029diff -urNp linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c
37030--- linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37031+++ linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37032@@ -184,7 +184,7 @@ bfin_cf_set_mem_map(struct pcmcia_socket
37033 return 0;
37034 }
37035
37036-static struct pccard_operations bfin_cf_ops = {
37037+static const struct pccard_operations bfin_cf_ops = {
37038 .init = bfin_cf_ss_init,
37039 .suspend = bfin_cf_ss_suspend,
37040 .get_status = bfin_cf_get_status,
37041diff -urNp linux-2.6.39/drivers/pcmcia/db1xxx_ss.c linux-2.6.39/drivers/pcmcia/db1xxx_ss.c
37042--- linux-2.6.39/drivers/pcmcia/db1xxx_ss.c 2011-05-19 00:06:34.000000000 -0400
37043+++ linux-2.6.39/drivers/pcmcia/db1xxx_ss.c 2011-05-22 19:36:32.000000000 -0400
37044@@ -384,7 +384,7 @@ static int au1x00_pcmcia_set_mem_map(str
37045 return 0;
37046 }
37047
37048-static struct pccard_operations db1x_pcmcia_operations = {
37049+static const struct pccard_operations db1x_pcmcia_operations = {
37050 .init = db1x_pcmcia_sock_init,
37051 .suspend = db1x_pcmcia_sock_suspend,
37052 .get_status = db1x_pcmcia_get_status,
37053diff -urNp linux-2.6.39/drivers/pcmcia/electra_cf.c linux-2.6.39/drivers/pcmcia/electra_cf.c
37054--- linux-2.6.39/drivers/pcmcia/electra_cf.c 2011-05-19 00:06:34.000000000 -0400
37055+++ linux-2.6.39/drivers/pcmcia/electra_cf.c 2011-05-22 19:36:32.000000000 -0400
37056@@ -173,7 +173,7 @@ static int electra_cf_set_mem_map(struct
37057 return 0;
37058 }
37059
37060-static struct pccard_operations electra_cf_ops = {
37061+static const struct pccard_operations electra_cf_ops = {
37062 .init = electra_cf_ss_init,
37063 .get_status = electra_cf_get_status,
37064 .set_socket = electra_cf_set_socket,
37065diff -urNp linux-2.6.39/drivers/pcmcia/m32r_cfc.c linux-2.6.39/drivers/pcmcia/m32r_cfc.c
37066--- linux-2.6.39/drivers/pcmcia/m32r_cfc.c 2011-05-19 00:06:34.000000000 -0400
37067+++ linux-2.6.39/drivers/pcmcia/m32r_cfc.c 2011-05-22 19:36:32.000000000 -0400
37068@@ -674,7 +674,7 @@ static int pcc_init(struct pcmcia_socket
37069 return 0;
37070 }
37071
37072-static struct pccard_operations pcc_operations = {
37073+static const struct pccard_operations pcc_operations = {
37074 .init = pcc_init,
37075 .get_status = pcc_get_status,
37076 .set_socket = pcc_set_socket,
37077diff -urNp linux-2.6.39/drivers/pcmcia/m32r_pcc.c linux-2.6.39/drivers/pcmcia/m32r_pcc.c
37078--- linux-2.6.39/drivers/pcmcia/m32r_pcc.c 2011-05-19 00:06:34.000000000 -0400
37079+++ linux-2.6.39/drivers/pcmcia/m32r_pcc.c 2011-05-22 19:36:32.000000000 -0400
37080@@ -652,7 +652,7 @@ static int pcc_init(struct pcmcia_socket
37081 return 0;
37082 }
37083
37084-static struct pccard_operations pcc_operations = {
37085+static const struct pccard_operations pcc_operations = {
37086 .init = pcc_init,
37087 .get_status = pcc_get_status,
37088 .set_socket = pcc_set_socket,
37089diff -urNp linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c
37090--- linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37091+++ linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37092@@ -1139,7 +1139,7 @@ static int m8xx_sock_suspend(struct pcmc
37093 return m8xx_set_socket(sock, &dead_socket);
37094 }
37095
37096-static struct pccard_operations m8xx_services = {
37097+static const struct pccard_operations m8xx_services = {
37098 .init = m8xx_sock_init,
37099 .suspend = m8xx_sock_suspend,
37100 .get_status = m8xx_get_status,
37101diff -urNp linux-2.6.39/drivers/pcmcia/omap_cf.c linux-2.6.39/drivers/pcmcia/omap_cf.c
37102--- linux-2.6.39/drivers/pcmcia/omap_cf.c 2011-05-19 00:06:34.000000000 -0400
37103+++ linux-2.6.39/drivers/pcmcia/omap_cf.c 2011-05-22 19:36:32.000000000 -0400
37104@@ -185,7 +185,7 @@ omap_cf_set_mem_map(struct pcmcia_socket
37105 return 0;
37106 }
37107
37108-static struct pccard_operations omap_cf_ops = {
37109+static const struct pccard_operations omap_cf_ops = {
37110 .init = omap_cf_ss_init,
37111 .suspend = omap_cf_ss_suspend,
37112 .get_status = omap_cf_get_status,
37113diff -urNp linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c
37114--- linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c 2011-05-19 00:06:34.000000000 -0400
37115+++ linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c 2011-05-22 19:36:32.000000000 -0400
37116@@ -161,7 +161,7 @@ static int iodyn_find_io(struct pcmcia_s
37117 }
37118
37119
37120-struct pccard_resource_ops pccard_iodyn_ops = {
37121+const struct pccard_resource_ops pccard_iodyn_ops = {
37122 .validate_mem = NULL,
37123 .find_io = iodyn_find_io,
37124 .find_mem = NULL,
37125diff -urNp linux-2.6.39/drivers/pcmcia/rsrc_mgr.c linux-2.6.39/drivers/pcmcia/rsrc_mgr.c
37126--- linux-2.6.39/drivers/pcmcia/rsrc_mgr.c 2011-05-19 00:06:34.000000000 -0400
37127+++ linux-2.6.39/drivers/pcmcia/rsrc_mgr.c 2011-05-22 19:36:32.000000000 -0400
37128@@ -57,7 +57,7 @@ static int static_find_io(struct pcmcia_
37129 }
37130
37131
37132-struct pccard_resource_ops pccard_static_ops = {
37133+const struct pccard_resource_ops pccard_static_ops = {
37134 .validate_mem = NULL,
37135 .find_io = static_find_io,
37136 .find_mem = NULL,
37137diff -urNp linux-2.6.39/drivers/pcmcia/vrc4171_card.c linux-2.6.39/drivers/pcmcia/vrc4171_card.c
37138--- linux-2.6.39/drivers/pcmcia/vrc4171_card.c 2011-05-19 00:06:34.000000000 -0400
37139+++ linux-2.6.39/drivers/pcmcia/vrc4171_card.c 2011-05-22 19:36:32.000000000 -0400
37140@@ -479,7 +479,7 @@ static int pccard_set_mem_map(struct pcm
37141 return 0;
37142 }
37143
37144-static struct pccard_operations vrc4171_pccard_operations = {
37145+static const struct pccard_operations vrc4171_pccard_operations = {
37146 .init = pccard_init,
37147 .get_status = pccard_get_status,
37148 .set_socket = pccard_set_socket,
37149diff -urNp linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c
37150--- linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c 2011-05-19 00:06:34.000000000 -0400
37151+++ linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c 2011-05-22 19:36:32.000000000 -0400
37152@@ -384,7 +384,7 @@ static void cardu_proc_setup(unsigned in
37153 {
37154 }
37155
37156-static struct pccard_operations cardu_operations = {
37157+static const struct pccard_operations cardu_operations = {
37158 .init = cardu_init,
37159 .register_callback = cardu_register_callback,
37160 .inquire_socket = cardu_inquire_socket,
37161diff -urNp linux-2.6.39/drivers/pcmcia/xxs1500_ss.c linux-2.6.39/drivers/pcmcia/xxs1500_ss.c
37162--- linux-2.6.39/drivers/pcmcia/xxs1500_ss.c 2011-05-19 00:06:34.000000000 -0400
37163+++ linux-2.6.39/drivers/pcmcia/xxs1500_ss.c 2011-05-22 19:36:32.000000000 -0400
37164@@ -196,7 +196,7 @@ static int au1x00_pcmcia_set_mem_map(str
37165 return 0;
37166 }
37167
37168-static struct pccard_operations xxs1500_pcmcia_operations = {
37169+static const struct pccard_operations xxs1500_pcmcia_operations = {
37170 .init = xxs1500_pcmcia_sock_init,
37171 .suspend = xxs1500_pcmcia_sock_suspend,
37172 .get_status = xxs1500_pcmcia_get_status,
37173diff -urNp linux-2.6.39/drivers/platform/x86/acerhdf.c linux-2.6.39/drivers/platform/x86/acerhdf.c
37174--- linux-2.6.39/drivers/platform/x86/acerhdf.c 2011-05-19 00:06:34.000000000 -0400
37175+++ linux-2.6.39/drivers/platform/x86/acerhdf.c 2011-05-22 19:36:32.000000000 -0400
37176@@ -406,7 +406,7 @@ static int acerhdf_get_crit_temp(struct
37177 }
37178
37179 /* bind callback functions to thermalzone */
37180-static struct thermal_zone_device_ops acerhdf_dev_ops = {
37181+static const struct thermal_zone_device_ops acerhdf_dev_ops = {
37182 .bind = acerhdf_bind,
37183 .unbind = acerhdf_unbind,
37184 .get_temp = acerhdf_get_ec_temp,
37185@@ -481,7 +481,7 @@ err_out:
37186 }
37187
37188 /* bind fan callbacks to fan device */
37189-static struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37190+static const struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37191 .get_max_state = acerhdf_get_max_state,
37192 .get_cur_state = acerhdf_get_cur_state,
37193 .set_cur_state = acerhdf_set_cur_state,
37194diff -urNp linux-2.6.39/drivers/platform/x86/ideapad-laptop.c linux-2.6.39/drivers/platform/x86/ideapad-laptop.c
37195--- linux-2.6.39/drivers/platform/x86/ideapad-laptop.c 2011-05-19 00:06:34.000000000 -0400
37196+++ linux-2.6.39/drivers/platform/x86/ideapad-laptop.c 2011-05-22 19:36:32.000000000 -0400
37197@@ -207,7 +207,7 @@ static int ideapad_rfk_set(void *data, b
37198 return write_ec_cmd(ideapad_handle, opcode, !blocked);
37199 }
37200
37201-static struct rfkill_ops ideapad_rfk_ops = {
37202+static const struct rfkill_ops ideapad_rfk_ops = {
37203 .set_block = ideapad_rfk_set,
37204 };
37205
37206diff -urNp linux-2.6.39/drivers/platform/x86/intel_menlow.c linux-2.6.39/drivers/platform/x86/intel_menlow.c
37207--- linux-2.6.39/drivers/platform/x86/intel_menlow.c 2011-05-19 00:06:34.000000000 -0400
37208+++ linux-2.6.39/drivers/platform/x86/intel_menlow.c 2011-05-22 19:36:32.000000000 -0400
37209@@ -143,7 +143,7 @@ static int memory_set_cur_bandwidth(stru
37210 return 0;
37211 }
37212
37213-static struct thermal_cooling_device_ops memory_cooling_ops = {
37214+static const struct thermal_cooling_device_ops memory_cooling_ops = {
37215 .get_max_state = memory_get_max_bandwidth,
37216 .get_cur_state = memory_get_cur_bandwidth,
37217 .set_cur_state = memory_set_cur_bandwidth,
37218diff -urNp linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c
37219--- linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c 2011-05-19 00:06:34.000000000 -0400
37220+++ linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c 2011-05-22 19:36:32.000000000 -0400
37221@@ -458,7 +458,7 @@ static int read_curr_temp(struct thermal
37222 }
37223
37224 /* Can't be const */
37225-static struct thermal_zone_device_ops tzd_ops = {
37226+static const struct thermal_zone_device_ops tzd_ops = {
37227 .get_temp = read_curr_temp,
37228 };
37229
37230diff -urNp linux-2.6.39/drivers/platform/x86/samsung-laptop.c linux-2.6.39/drivers/platform/x86/samsung-laptop.c
37231--- linux-2.6.39/drivers/platform/x86/samsung-laptop.c 2011-05-19 00:06:34.000000000 -0400
37232+++ linux-2.6.39/drivers/platform/x86/samsung-laptop.c 2011-05-22 19:36:32.000000000 -0400
37233@@ -419,7 +419,7 @@ static int rfkill_set(void *data, bool b
37234 return 0;
37235 }
37236
37237-static struct rfkill_ops rfkill_ops = {
37238+static const struct rfkill_ops rfkill_ops = {
37239 .set_block = rfkill_set,
37240 };
37241
37242diff -urNp linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c
37243--- linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c 2011-05-19 00:06:34.000000000 -0400
37244+++ linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 37245@@ -59,7 +59,7 @@ do { \
ae4e228f 37246 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
58c5fc13
MT		 37247 } while(0)
37248
ae4e228f
MT		 37249-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
37250+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
37251 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
58c5fc13
MT		 37252
37253 /*
df50ba0c 37254@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
58c5fc13
MT		 37255
37256 cpu = get_cpu();
37257 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
37258+
ae4e228f 37259+ pax_open_kernel();
58c5fc13 37260 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
ae4e228f 37261+ pax_close_kernel();
58c5fc13 37262
58c5fc13
MT		 37263 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
37264 spin_lock_irqsave(&pnp_bios_lock, flags);
df50ba0c 37265@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
58c5fc13
MT		 37266 :"memory");
37267 spin_unlock_irqrestore(&pnp_bios_lock, flags);
37268
ae4e228f 37269+ pax_open_kernel();
58c5fc13 37270 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
ae4e228f 37271+ pax_close_kernel();
58c5fc13
MT		 37272+
37273 put_cpu();
37274
37275 /* If we get here and this is set then the PnP BIOS faulted on us. */
df50ba0c 37276@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
58c5fc13
MT		 37277 return status;
37278 }
37279
37280-void pnpbios_calls_init(union pnp_bios_install_struct *header)
37281+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
37282 {
37283 int i;
37284
df50ba0c 37285@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
58c5fc13
MT		 37286 pnp_bios_callpoint.offset = header->fields.pm16offset;
37287 pnp_bios_callpoint.segment = PNP_CS16;
37288
ae4e228f 37289+ pax_open_kernel();
58c5fc13 37290+
ae4e228f
MT		 37291 for_each_possible_cpu(i) {
37292 struct desc_struct *gdt = get_cpu_gdt_table(i);
37293 if (!gdt)
df50ba0c 37294@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
ae4e228f
MT		 37295 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
37296 (unsigned long)__va(header->fields.pm16dseg));
58c5fc13
MT		 37297 }
37298+
ae4e228f 37299+ pax_close_kernel();
58c5fc13 37300 }
66a7e928
MT		 37301diff -urNp linux-2.6.39/drivers/pnp/resource.c linux-2.6.39/drivers/pnp/resource.c
37302--- linux-2.6.39/drivers/pnp/resource.c 2011-05-19 00:06:34.000000000 -0400
37303+++ linux-2.6.39/drivers/pnp/resource.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 37304@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
58c5fc13
MT		 37305 return 1;
37306
37307 /* check if the resource is valid */
37308- if (*irq < 0 || *irq > 15)
37309+ if (*irq > 15)
37310 return 0;
37311
37312 /* check if the resource is reserved */
df50ba0c 37313@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
58c5fc13
MT		 37314 return 1;
37315
37316 /* check if the resource is valid */
37317- if (*dma < 0 || *dma == 4 || *dma > 7)
37318+ if (*dma == 4 || *dma > 7)
37319 return 0;
37320
37321 /* check if the resource is reserved */
66a7e928
MT		 37322diff -urNp linux-2.6.39/drivers/power/max8925_power.c linux-2.6.39/drivers/power/max8925_power.c
37323--- linux-2.6.39/drivers/power/max8925_power.c 2011-05-19 00:06:34.000000000 -0400
37324+++ linux-2.6.39/drivers/power/max8925_power.c 2011-05-22 19:36:32.000000000 -0400
37325@@ -426,7 +426,7 @@ static __devinit int max8925_power_probe
37326 {
37327 struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
37328 struct max8925_platform_data *max8925_pdata;
37329- struct max8925_power_pdata *pdata = NULL;
37330+ const struct max8925_power_pdata *pdata = NULL;
37331 struct max8925_power_info *info;
37332 int ret;
37333
37334diff -urNp linux-2.6.39/drivers/regulator/core.c linux-2.6.39/drivers/regulator/core.c
37335--- linux-2.6.39/drivers/regulator/core.c 2011-05-19 00:06:34.000000000 -0400
37336+++ linux-2.6.39/drivers/regulator/core.c 2011-05-22 19:36:32.000000000 -0400
37337@@ -2883,7 +2883,7 @@ core_initcall(regulator_init);
37338 static int __init regulator_init_complete(void)
37339 {
37340 struct regulator_dev *rdev;
37341- struct regulator_ops *ops;
37342+ const struct regulator_ops *ops;
37343 struct regulation_constraints *c;
37344 int enabled, ret;
37345
37346diff -urNp linux-2.6.39/drivers/rtc/rtc-at32ap700x.c linux-2.6.39/drivers/rtc/rtc-at32ap700x.c
37347--- linux-2.6.39/drivers/rtc/rtc-at32ap700x.c 2011-05-19 00:06:34.000000000 -0400
37348+++ linux-2.6.39/drivers/rtc/rtc-at32ap700x.c 2011-05-22 19:36:32.000000000 -0400
37349@@ -187,7 +187,7 @@ static irqreturn_t at32_rtc_interrupt(in
37350 return ret;
37351 }
37352
37353-static struct rtc_class_ops at32_rtc_ops = {
37354+static const struct rtc_class_ops at32_rtc_ops = {
37355 .read_time = at32_rtc_readtime,
37356 .set_time = at32_rtc_settime,
37357 .read_alarm = at32_rtc_readalarm,
37358diff -urNp linux-2.6.39/drivers/rtc/rtc-au1xxx.c linux-2.6.39/drivers/rtc/rtc-au1xxx.c
37359--- linux-2.6.39/drivers/rtc/rtc-au1xxx.c 2011-05-19 00:06:34.000000000 -0400
37360+++ linux-2.6.39/drivers/rtc/rtc-au1xxx.c 2011-05-22 19:36:32.000000000 -0400
37361@@ -57,7 +57,7 @@ static int au1xtoy_rtc_set_time(struct d
37362 return 0;
37363 }
37364
37365-static struct rtc_class_ops au1xtoy_rtc_ops = {
37366+static const struct rtc_class_ops au1xtoy_rtc_ops = {
37367 .read_time = au1xtoy_rtc_read_time,
37368 .set_time = au1xtoy_rtc_set_time,
37369 };
37370diff -urNp linux-2.6.39/drivers/rtc/rtc-bfin.c linux-2.6.39/drivers/rtc/rtc-bfin.c
37371--- linux-2.6.39/drivers/rtc/rtc-bfin.c 2011-05-19 00:06:34.000000000 -0400
37372+++ linux-2.6.39/drivers/rtc/rtc-bfin.c 2011-05-22 19:36:32.000000000 -0400
37373@@ -333,7 +333,7 @@ static int bfin_rtc_proc(struct device *
37374 #undef yesno
37375 }
37376
37377-static struct rtc_class_ops bfin_rtc_ops = {
37378+static const struct rtc_class_ops bfin_rtc_ops = {
37379 .read_time = bfin_rtc_read_time,
37380 .set_time = bfin_rtc_set_time,
37381 .read_alarm = bfin_rtc_read_alarm,
37382diff -urNp linux-2.6.39/drivers/rtc/rtc-coh901331.c linux-2.6.39/drivers/rtc/rtc-coh901331.c
37383--- linux-2.6.39/drivers/rtc/rtc-coh901331.c 2011-05-19 00:06:34.000000000 -0400
37384+++ linux-2.6.39/drivers/rtc/rtc-coh901331.c 2011-05-22 19:36:32.000000000 -0400
37385@@ -142,7 +142,7 @@ static int coh901331_alarm_irq_enable(st
37386 return 0;
37387 }
37388
37389-static struct rtc_class_ops coh901331_ops = {
37390+static const struct rtc_class_ops coh901331_ops = {
37391 .read_time = coh901331_read_time,
37392 .set_mmss = coh901331_set_mmss,
37393 .read_alarm = coh901331_read_alarm,
37394diff -urNp linux-2.6.39/drivers/rtc/rtc-davinci.c linux-2.6.39/drivers/rtc/rtc-davinci.c
37395--- linux-2.6.39/drivers/rtc/rtc-davinci.c 2011-05-19 00:06:34.000000000 -0400
37396+++ linux-2.6.39/drivers/rtc/rtc-davinci.c 2011-05-22 19:36:32.000000000 -0400
37397@@ -469,7 +469,7 @@ static int davinci_rtc_set_alarm(struct
37398 return 0;
37399 }
37400
37401-static struct rtc_class_ops davinci_rtc_ops = {
37402+static const struct rtc_class_ops davinci_rtc_ops = {
37403 .ioctl = davinci_rtc_ioctl,
37404 .read_time = davinci_rtc_read_time,
37405 .set_time = davinci_rtc_set_time,
37406diff -urNp linux-2.6.39/drivers/rtc/rtc-dev.c linux-2.6.39/drivers/rtc/rtc-dev.c
37407--- linux-2.6.39/drivers/rtc/rtc-dev.c 2011-05-19 00:06:34.000000000 -0400
37408+++ linux-2.6.39/drivers/rtc/rtc-dev.c 2011-05-22 19:41:37.000000000 -0400
bc901d79
MT		 37409@@ -14,6 +14,7 @@
37410 #include <linux/module.h>
37411 #include <linux/rtc.h>
37412 #include <linux/sched.h>
37413+#include <linux/grsecurity.h>
37414 #include "rtc-core.h"
37415
37416 static dev_t rtc_devt;
16454cff 37417@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
bc901d79
MT		 37418 if (copy_from_user(&tm, uarg, sizeof(tm)))
37419 return -EFAULT;
37420
37421+ gr_log_timechange();
37422+
37423 return rtc_set_time(rtc, &tm);
37424
37425 case RTC_PIE_ON:
66a7e928
MT		 37426diff -urNp linux-2.6.39/drivers/rtc/rtc-dm355evm.c linux-2.6.39/drivers/rtc/rtc-dm355evm.c
37427--- linux-2.6.39/drivers/rtc/rtc-dm355evm.c 2011-05-19 00:06:34.000000000 -0400
37428+++ linux-2.6.39/drivers/rtc/rtc-dm355evm.c 2011-05-22 19:36:32.000000000 -0400
37429@@ -115,7 +115,7 @@ static int dm355evm_rtc_set_time(struct
37430 return 0;
37431 }
37432
37433-static struct rtc_class_ops dm355evm_rtc_ops = {
37434+static const struct rtc_class_ops dm355evm_rtc_ops = {
37435 .read_time = dm355evm_rtc_read_time,
37436 .set_time = dm355evm_rtc_set_time,
37437 };
37438diff -urNp linux-2.6.39/drivers/rtc/rtc-ds1302.c linux-2.6.39/drivers/rtc/rtc-ds1302.c
37439--- linux-2.6.39/drivers/rtc/rtc-ds1302.c 2011-05-19 00:06:34.000000000 -0400
37440+++ linux-2.6.39/drivers/rtc/rtc-ds1302.c 2011-05-22 19:36:32.000000000 -0400
37441@@ -199,7 +199,7 @@ static int ds1302_rtc_ioctl(struct devic
37442 return -ENOIOCTLCMD;
37443 }
37444
37445-static struct rtc_class_ops ds1302_rtc_ops = {
37446+static const struct rtc_class_ops ds1302_rtc_ops = {
37447 .read_time = ds1302_rtc_read_time,
37448 .set_time = ds1302_rtc_set_time,
37449 .ioctl = ds1302_rtc_ioctl,
37450diff -urNp linux-2.6.39/drivers/rtc/rtc-imxdi.c linux-2.6.39/drivers/rtc/rtc-imxdi.c
37451--- linux-2.6.39/drivers/rtc/rtc-imxdi.c 2011-05-19 00:06:34.000000000 -0400
37452+++ linux-2.6.39/drivers/rtc/rtc-imxdi.c 2011-05-22 19:36:32.000000000 -0400
37453@@ -290,7 +290,7 @@ static int dryice_rtc_set_alarm(struct d
37454 return 0;
37455 }
37456
37457-static struct rtc_class_ops dryice_rtc_ops = {
37458+static const struct rtc_class_ops dryice_rtc_ops = {
37459 .read_time = dryice_rtc_read_time,
37460 .set_mmss = dryice_rtc_set_mmss,
37461 .alarm_irq_enable = dryice_rtc_alarm_irq_enable,
37462diff -urNp linux-2.6.39/drivers/rtc/rtc-jz4740.c linux-2.6.39/drivers/rtc/rtc-jz4740.c
37463--- linux-2.6.39/drivers/rtc/rtc-jz4740.c 2011-05-19 00:06:34.000000000 -0400
37464+++ linux-2.6.39/drivers/rtc/rtc-jz4740.c 2011-05-22 19:36:32.000000000 -0400
37465@@ -174,7 +174,7 @@ static int jz4740_rtc_alarm_irq_enable(s
37466 return jz4740_rtc_ctrl_set_bits(rtc, JZ_RTC_CTRL_AF_IRQ, enable);
37467 }
37468
37469-static struct rtc_class_ops jz4740_rtc_ops = {
37470+static const struct rtc_class_ops jz4740_rtc_ops = {
37471 .read_time = jz4740_rtc_read_time,
37472 .set_mmss = jz4740_rtc_set_mmss,
37473 .read_alarm = jz4740_rtc_read_alarm,
37474diff -urNp linux-2.6.39/drivers/rtc/rtc-m41t80.c linux-2.6.39/drivers/rtc/rtc-m41t80.c
37475--- linux-2.6.39/drivers/rtc/rtc-m41t80.c 2011-05-19 00:06:34.000000000 -0400
37476+++ linux-2.6.39/drivers/rtc/rtc-m41t80.c 2011-05-22 19:36:32.000000000 -0400
37477@@ -354,7 +354,7 @@ static int m41t80_rtc_read_alarm(struct
37478 return 0;
37479 }
37480
37481-static struct rtc_class_ops m41t80_rtc_ops = {
37482+static const struct rtc_class_ops m41t80_rtc_ops = {
37483 .read_time = m41t80_rtc_read_time,
37484 .set_time = m41t80_rtc_set_time,
37485 .read_alarm = m41t80_rtc_read_alarm,
37486diff -urNp linux-2.6.39/drivers/rtc/rtc-mxc.c linux-2.6.39/drivers/rtc/rtc-mxc.c
37487--- linux-2.6.39/drivers/rtc/rtc-mxc.c 2011-05-19 00:06:34.000000000 -0400
37488+++ linux-2.6.39/drivers/rtc/rtc-mxc.c 2011-05-22 19:36:32.000000000 -0400
37489@@ -355,7 +355,7 @@ static int mxc_rtc_set_alarm(struct devi
37490 }
37491
37492 /* RTC layer */
37493-static struct rtc_class_ops mxc_rtc_ops = {
37494+static const struct rtc_class_ops mxc_rtc_ops = {
37495 .release = mxc_rtc_release,
37496 .read_time = mxc_rtc_read_time,
37497 .set_mmss = mxc_rtc_set_mmss,
37498diff -urNp linux-2.6.39/drivers/rtc/rtc-nuc900.c linux-2.6.39/drivers/rtc/rtc-nuc900.c
37499--- linux-2.6.39/drivers/rtc/rtc-nuc900.c 2011-05-19 00:06:34.000000000 -0400
37500+++ linux-2.6.39/drivers/rtc/rtc-nuc900.c 2011-05-22 19:36:32.000000000 -0400
37501@@ -214,7 +214,7 @@ static int nuc900_rtc_set_alarm(struct d
37502 return 0;
37503 }
37504
37505-static struct rtc_class_ops nuc900_rtc_ops = {
37506+static const struct rtc_class_ops nuc900_rtc_ops = {
37507 .read_time = nuc900_rtc_read_time,
37508 .set_time = nuc900_rtc_set_time,
37509 .read_alarm = nuc900_rtc_read_alarm,
37510diff -urNp linux-2.6.39/drivers/rtc/rtc-omap.c linux-2.6.39/drivers/rtc/rtc-omap.c
37511--- linux-2.6.39/drivers/rtc/rtc-omap.c 2011-05-19 00:06:34.000000000 -0400
37512+++ linux-2.6.39/drivers/rtc/rtc-omap.c 2011-05-22 19:36:32.000000000 -0400
37513@@ -274,7 +274,7 @@ static int omap_rtc_set_alarm(struct dev
37514 return 0;
37515 }
37516
37517-static struct rtc_class_ops omap_rtc_ops = {
37518+static const struct rtc_class_ops omap_rtc_ops = {
37519 .read_time = omap_rtc_read_time,
37520 .set_time = omap_rtc_set_time,
37521 .read_alarm = omap_rtc_read_alarm,
37522diff -urNp linux-2.6.39/drivers/rtc/rtc-pcf50633.c linux-2.6.39/drivers/rtc/rtc-pcf50633.c
37523--- linux-2.6.39/drivers/rtc/rtc-pcf50633.c 2011-05-19 00:06:34.000000000 -0400
37524+++ linux-2.6.39/drivers/rtc/rtc-pcf50633.c 2011-05-22 19:36:32.000000000 -0400
37525@@ -238,7 +238,7 @@ static int pcf50633_rtc_set_alarm(struct
37526 return ret;
37527 }
37528
37529-static struct rtc_class_ops pcf50633_rtc_ops = {
37530+static const struct rtc_class_ops pcf50633_rtc_ops = {
37531 .read_time = pcf50633_rtc_read_time,
37532 .set_time = pcf50633_rtc_set_time,
37533 .read_alarm = pcf50633_rtc_read_alarm,
37534diff -urNp linux-2.6.39/drivers/rtc/rtc-pl031.c linux-2.6.39/drivers/rtc/rtc-pl031.c
37535--- linux-2.6.39/drivers/rtc/rtc-pl031.c 2011-05-19 00:06:34.000000000 -0400
37536+++ linux-2.6.39/drivers/rtc/rtc-pl031.c 2011-05-22 19:36:32.000000000 -0400
37537@@ -374,7 +374,7 @@ err_req:
37538 }
37539
37540 /* Operations for the original ARM version */
37541-static struct rtc_class_ops arm_pl031_ops = {
37542+static const struct rtc_class_ops arm_pl031_ops = {
37543 .read_time = pl031_read_time,
37544 .set_time = pl031_set_time,
37545 .read_alarm = pl031_read_alarm,
37546@@ -383,7 +383,7 @@ static struct rtc_class_ops arm_pl031_op
37547 };
37548
37549 /* The First ST derivative */
37550-static struct rtc_class_ops stv1_pl031_ops = {
37551+static const struct rtc_class_ops stv1_pl031_ops = {
37552 .read_time = pl031_read_time,
37553 .set_time = pl031_set_time,
37554 .read_alarm = pl031_read_alarm,
37555@@ -392,7 +392,7 @@ static struct rtc_class_ops stv1_pl031_o
37556 };
37557
37558 /* And the second ST derivative */
37559-static struct rtc_class_ops stv2_pl031_ops = {
37560+static const struct rtc_class_ops stv2_pl031_ops = {
37561 .read_time = pl031_stv2_read_time,
37562 .set_time = pl031_stv2_set_time,
37563 .read_alarm = pl031_stv2_read_alarm,
37564diff -urNp linux-2.6.39/drivers/rtc/rtc-rx8025.c linux-2.6.39/drivers/rtc/rtc-rx8025.c
37565--- linux-2.6.39/drivers/rtc/rtc-rx8025.c 2011-05-19 00:06:34.000000000 -0400
37566+++ linux-2.6.39/drivers/rtc/rtc-rx8025.c 2011-05-22 19:36:32.000000000 -0400
37567@@ -424,7 +424,7 @@ static int rx8025_alarm_irq_enable(struc
37568 return 0;
37569 }
37570
37571-static struct rtc_class_ops rx8025_rtc_ops = {
37572+static const struct rtc_class_ops rx8025_rtc_ops = {
37573 .read_time = rx8025_get_time,
37574 .set_time = rx8025_set_time,
37575 .read_alarm = rx8025_read_alarm,
37576diff -urNp linux-2.6.39/drivers/rtc/rtc-sh.c linux-2.6.39/drivers/rtc/rtc-sh.c
37577--- linux-2.6.39/drivers/rtc/rtc-sh.c 2011-05-19 00:06:34.000000000 -0400
37578+++ linux-2.6.39/drivers/rtc/rtc-sh.c 2011-05-22 19:36:32.000000000 -0400
37579@@ -576,7 +576,7 @@ static int sh_rtc_set_alarm(struct devic
37580 return 0;
37581 }
37582
37583-static struct rtc_class_ops sh_rtc_ops = {
37584+static const struct rtc_class_ops sh_rtc_ops = {
37585 .read_time = sh_rtc_read_time,
37586 .set_time = sh_rtc_set_time,
37587 .read_alarm = sh_rtc_read_alarm,
37588diff -urNp linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c
37589--- linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c 2011-05-19 00:06:34.000000000 -0400
37590+++ linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c 2011-05-22 19:36:32.000000000 -0400
37591@@ -133,7 +133,7 @@ static int stmp3xxx_rtc_set_alarm(struct
37592 return 0;
37593 }
37594
37595-static struct rtc_class_ops stmp3xxx_rtc_ops = {
37596+static const struct rtc_class_ops stmp3xxx_rtc_ops = {
37597 .alarm_irq_enable =
37598 stmp3xxx_alarm_irq_enable,
37599 .read_time = stmp3xxx_rtc_gettime,
37600diff -urNp linux-2.6.39/drivers/rtc/rtc-tegra.c linux-2.6.39/drivers/rtc/rtc-tegra.c
37601--- linux-2.6.39/drivers/rtc/rtc-tegra.c 2011-05-19 00:06:34.000000000 -0400
37602+++ linux-2.6.39/drivers/rtc/rtc-tegra.c 2011-05-22 19:36:32.000000000 -0400
37603@@ -294,7 +294,7 @@ static irqreturn_t tegra_rtc_irq_handler
37604 return IRQ_HANDLED;
37605 }
37606
37607-static struct rtc_class_ops tegra_rtc_ops = {
37608+static const struct rtc_class_ops tegra_rtc_ops = {
37609 .read_time = tegra_rtc_read_time,
37610 .set_time = tegra_rtc_set_time,
37611 .read_alarm = tegra_rtc_read_alarm,
37612diff -urNp linux-2.6.39/drivers/rtc/rtc-twl.c linux-2.6.39/drivers/rtc/rtc-twl.c
37613--- linux-2.6.39/drivers/rtc/rtc-twl.c 2011-05-19 00:06:34.000000000 -0400
37614+++ linux-2.6.39/drivers/rtc/rtc-twl.c 2011-05-22 19:36:32.000000000 -0400
37615@@ -415,7 +415,7 @@ out:
37616 return ret;
37617 }
37618
37619-static struct rtc_class_ops twl_rtc_ops = {
37620+static const struct rtc_class_ops twl_rtc_ops = {
37621 .read_time = twl_rtc_read_time,
37622 .set_time = twl_rtc_set_time,
37623 .read_alarm = twl_rtc_read_alarm,
37624diff -urNp linux-2.6.39/drivers/rtc/rtc-v3020.c linux-2.6.39/drivers/rtc/rtc-v3020.c
37625--- linux-2.6.39/drivers/rtc/rtc-v3020.c 2011-05-19 00:06:34.000000000 -0400
37626+++ linux-2.6.39/drivers/rtc/rtc-v3020.c 2011-05-22 19:36:32.000000000 -0400
37627@@ -62,7 +62,7 @@ struct v3020 {
37628 /* GPIO access */
37629 struct v3020_gpio *gpio;
37630
37631- struct v3020_chip_ops *ops;
37632+ const struct v3020_chip_ops *ops;
37633
37634 struct rtc_device *rtc;
37635 };
37636@@ -100,7 +100,7 @@ static unsigned char v3020_mmio_read_bit
37637 return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
37638 }
37639
37640-static struct v3020_chip_ops v3020_mmio_ops = {
37641+static const struct v3020_chip_ops v3020_mmio_ops = {
37642 .map_io = v3020_mmio_map,
37643 .unmap_io = v3020_mmio_unmap,
37644 .read_bit = v3020_mmio_read_bit,
37645@@ -177,7 +177,7 @@ static unsigned char v3020_gpio_read_bit
37646 return bit;
37647 }
37648
37649-static struct v3020_chip_ops v3020_gpio_ops = {
37650+static const struct v3020_chip_ops v3020_gpio_ops = {
37651 .map_io = v3020_gpio_map,
37652 .unmap_io = v3020_gpio_unmap,
37653 .read_bit = v3020_gpio_read_bit,
37654diff -urNp linux-2.6.39/drivers/s390/char/con3270.c linux-2.6.39/drivers/s390/char/con3270.c
37655--- linux-2.6.39/drivers/s390/char/con3270.c 2011-05-19 00:06:34.000000000 -0400
37656+++ linux-2.6.39/drivers/s390/char/con3270.c 2011-05-22 19:36:32.000000000 -0400
37657@@ -28,7 +28,7 @@
37658 #define CON3270_OUTPUT_BUFFER_SIZE 1024
37659 #define CON3270_STRING_PAGES 4
37660
37661-static struct raw3270_fn con3270_fn;
37662+static const struct raw3270_fn con3270_fn;
37663
37664 /*
37665 * Main 3270 console view data structure.
37666@@ -413,7 +413,7 @@ con3270_irq(struct con3270 *cp, struct r
37667 }
37668
37669 /* Console view to a 3270 device. */
37670-static struct raw3270_fn con3270_fn = {
37671+static const struct raw3270_fn con3270_fn = {
37672 .activate = con3270_activate,
37673 .deactivate = con3270_deactivate,
37674 .intv = (void *) con3270_irq
37675diff -urNp linux-2.6.39/drivers/s390/char/fs3270.c linux-2.6.39/drivers/s390/char/fs3270.c
37676--- linux-2.6.39/drivers/s390/char/fs3270.c 2011-05-19 00:06:34.000000000 -0400
37677+++ linux-2.6.39/drivers/s390/char/fs3270.c 2011-05-22 19:36:32.000000000 -0400
37678@@ -24,7 +24,7 @@
37679 #include "raw3270.h"
37680 #include "ctrlchar.h"
37681
37682-static struct raw3270_fn fs3270_fn;
37683+static const struct raw3270_fn fs3270_fn;
37684
37685 struct fs3270 {
37686 struct raw3270_view view;
37687@@ -413,7 +413,7 @@ fs3270_release(struct raw3270_view *view
37688 }
37689
37690 /* View to a 3270 device. Can be console, tty or fullscreen. */
37691-static struct raw3270_fn fs3270_fn = {
37692+static const struct raw3270_fn fs3270_fn = {
37693 .activate = fs3270_activate,
37694 .deactivate = fs3270_deactivate,
37695 .intv = (void *) fs3270_irq,
37696diff -urNp linux-2.6.39/drivers/s390/char/raw3270.c linux-2.6.39/drivers/s390/char/raw3270.c
37697--- linux-2.6.39/drivers/s390/char/raw3270.c 2011-05-19 00:06:34.000000000 -0400
37698+++ linux-2.6.39/drivers/s390/char/raw3270.c 2011-05-22 19:36:32.000000000 -0400
37699@@ -488,7 +488,7 @@ raw3270_init_irq(struct raw3270_view *vi
37700 return RAW3270_IO_DONE;
37701 }
37702
37703-static struct raw3270_fn raw3270_init_fn = {
37704+static const struct raw3270_fn raw3270_init_fn = {
37705 .intv = raw3270_init_irq
37706 };
37707
37708diff -urNp linux-2.6.39/drivers/s390/char/tty3270.c linux-2.6.39/drivers/s390/char/tty3270.c
37709--- linux-2.6.39/drivers/s390/char/tty3270.c 2011-05-19 00:06:34.000000000 -0400
37710+++ linux-2.6.39/drivers/s390/char/tty3270.c 2011-05-22 19:36:32.000000000 -0400
37711@@ -37,7 +37,7 @@
37712 struct tty_driver *tty3270_driver;
37713 static int tty3270_max_index;
37714
37715-static struct raw3270_fn tty3270_fn;
37716+static const struct raw3270_fn tty3270_fn;
37717
37718 struct tty3270_cell {
37719 unsigned char character;
37720@@ -834,7 +834,7 @@ tty3270_del_views(void)
37721 }
37722 }
37723
37724-static struct raw3270_fn tty3270_fn = {
37725+static const struct raw3270_fn tty3270_fn = {
37726 .activate = tty3270_activate,
37727 .deactivate = tty3270_deactivate,
37728 .intv = (void *) tty3270_irq,
37729diff -urNp linux-2.6.39/drivers/s390/cio/qdio_debug.c linux-2.6.39/drivers/s390/cio/qdio_debug.c
37730--- linux-2.6.39/drivers/s390/cio/qdio_debug.c 2011-05-19 00:06:34.000000000 -0400
37731+++ linux-2.6.39/drivers/s390/cio/qdio_debug.c 2011-05-22 19:36:32.000000000 -0400
16454cff 37732@@ -225,7 +225,7 @@ static int qperf_seq_open(struct inode *
ae4e228f 37733 filp->f_path.dentry->d_inode->i_private);
58c5fc13
MT		 37734 }
37735
ae4e228f
MT		 37736-static struct file_operations debugfs_perf_fops = {
37737+static const struct file_operations debugfs_perf_fops = {
58c5fc13 37738 .owner = THIS_MODULE,
ae4e228f 37739 .open = qperf_seq_open,
58c5fc13 37740 .read = seq_read,
66a7e928
MT		 37741diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c
37742--- linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-19 00:06:34.000000000 -0400
37743+++ linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-22 19:36:32.000000000 -0400
37744@@ -415,7 +415,7 @@ out_free:
37745 /**
37746 * The crypto operations for a CEX2A card.
37747 */
37748-static struct zcrypt_ops zcrypt_cex2a_ops = {
37749+static const struct zcrypt_ops zcrypt_cex2a_ops = {
37750 .rsa_modexpo = zcrypt_cex2a_modexpo,
37751 .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
37752 };
37753diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c
37754--- linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c 2011-05-19 00:06:34.000000000 -0400
37755+++ linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c 2011-05-22 19:36:32.000000000 -0400
37756@@ -347,7 +347,7 @@ out_free:
37757 /**
37758 * The crypto operations for a PCICA card.
37759 */
37760-static struct zcrypt_ops zcrypt_pcica_ops = {
37761+static const struct zcrypt_ops zcrypt_pcica_ops = {
37762 .rsa_modexpo = zcrypt_pcica_modexpo,
37763 .rsa_modexpo_crt = zcrypt_pcica_modexpo_crt,
37764 };
37765diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c
37766--- linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-19 00:06:34.000000000 -0400
37767+++ linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-22 19:36:32.000000000 -0400
37768@@ -553,7 +553,7 @@ out_free:
37769 /**
37770 * The crypto operations for a PCICC card.
37771 */
37772-static struct zcrypt_ops zcrypt_pcicc_ops = {
37773+static const struct zcrypt_ops zcrypt_pcicc_ops = {
37774 .rsa_modexpo = zcrypt_pcicc_modexpo,
37775 .rsa_modexpo_crt = zcrypt_pcicc_modexpo_crt,
37776 };
37777diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c
37778--- linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-19 00:06:34.000000000 -0400
37779+++ linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-22 19:36:32.000000000 -0400
37780@@ -851,13 +851,13 @@ static long zcrypt_pcixcc_rng(struct zcr
37781 /**
37782 * The crypto operations for a PCIXCC/CEX2C card.
37783 */
37784-static struct zcrypt_ops zcrypt_pcixcc_ops = {
37785+static const struct zcrypt_ops zcrypt_pcixcc_ops = {
37786 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37787 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37788 .send_cprb = zcrypt_pcixcc_send_cprb,
37789 };
37790
37791-static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37792+static const struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37793 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37794 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37795 .send_cprb = zcrypt_pcixcc_send_cprb,
37796diff -urNp linux-2.6.39/drivers/s390/kvm/kvm_virtio.c linux-2.6.39/drivers/s390/kvm/kvm_virtio.c
37797--- linux-2.6.39/drivers/s390/kvm/kvm_virtio.c 2011-05-19 00:06:34.000000000 -0400
37798+++ linux-2.6.39/drivers/s390/kvm/kvm_virtio.c 2011-05-22 19:36:32.000000000 -0400
37799@@ -266,7 +266,7 @@ error:
37800 /*
37801 * The config ops structure as defined by virtio config
37802 */
37803-static struct virtio_config_ops kvm_vq_configspace_ops = {
37804+static const struct virtio_config_ops kvm_vq_configspace_ops = {
37805 .get_features = kvm_get_features,
37806 .finalize_features = kvm_finalize_features,
37807 .get = kvm_get,
37808diff -urNp linux-2.6.39/drivers/s390/net/qeth_core.h linux-2.6.39/drivers/s390/net/qeth_core.h
37809--- linux-2.6.39/drivers/s390/net/qeth_core.h 2011-05-19 00:06:34.000000000 -0400
37810+++ linux-2.6.39/drivers/s390/net/qeth_core.h 2011-05-22 19:36:32.000000000 -0400
37811@@ -743,7 +743,7 @@ struct qeth_card {
37812 struct qeth_qdio_info qdio;
37813 struct qeth_perf_stats perf_stats;
37814 int read_or_write_problem;
37815- struct qeth_osn_info osn_info;
37816+ const struct qeth_osn_info osn_info;
37817 struct qeth_discipline discipline;
37818 atomic_t force_alloc_skb;
37819 struct service_level qeth_service_level;
37820diff -urNp linux-2.6.39/drivers/scsi/53c700.c linux-2.6.39/drivers/scsi/53c700.c
37821--- linux-2.6.39/drivers/scsi/53c700.c 2011-05-19 00:06:34.000000000 -0400
37822+++ linux-2.6.39/drivers/scsi/53c700.c 2011-05-22 19:36:32.000000000 -0400
37823@@ -2153,7 +2153,7 @@ EXPORT_SYMBOL(NCR_700_detect);
37824 EXPORT_SYMBOL(NCR_700_release);
37825 EXPORT_SYMBOL(NCR_700_intr);
37826
37827-static struct spi_function_template NCR_700_transport_functions = {
37828+static struct spi_function_template NCR_700_transport_functions = {
37829 .set_period = NCR_700_set_period,
37830 .show_period = 1,
37831 .set_offset = NCR_700_set_offset,
37832diff -urNp linux-2.6.39/drivers/scsi/aacraid/commctrl.c linux-2.6.39/drivers/scsi/aacraid/commctrl.c
37833--- linux-2.6.39/drivers/scsi/aacraid/commctrl.c 2011-05-19 00:06:34.000000000 -0400
37834+++ linux-2.6.39/drivers/scsi/aacraid/commctrl.c 2011-05-22 19:36:32.000000000 -0400
37835@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
37836 u32 actual_fibsize64, actual_fibsize = 0;
37837 int i;
37838
37839+ pax_track_stack();
37840
37841 if (dev->in_reset) {
37842 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
37843diff -urNp linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c
37844--- linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-19 00:06:34.000000000 -0400
37845+++ linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-22 19:41:37.000000000 -0400
317566c1
MT		 37846@@ -486,7 +486,7 @@ static ssize_t asd_show_update_bios(stru
37847 flash_error_table[i].reason);
37848 }
37849
37850-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
37851+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
37852 asd_show_update_bios, asd_store_update_bios);
37853
37854 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
66a7e928
MT		 37855diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_core.c linux-2.6.39/drivers/scsi/bfa/bfa_core.c
37856--- linux-2.6.39/drivers/scsi/bfa/bfa_core.c 2011-05-19 00:06:34.000000000 -0400
37857+++ linux-2.6.39/drivers/scsi/bfa/bfa_core.c 2011-05-22 19:36:32.000000000 -0400
37858@@ -24,7 +24,7 @@ BFA_TRC_FILE(HAL, CORE);
37859 /*
37860 * BFA module list terminated by NULL
37861 */
37862-static struct bfa_module_s *hal_mods[] = {
37863+static const struct bfa_module_s *hal_mods[] = {
37864 &hal_mod_sgpg,
37865 &hal_mod_fcport,
37866 &hal_mod_fcxp,
37867diff -urNp linux-2.6.39/drivers/scsi/bfa/bfad.c linux-2.6.39/drivers/scsi/bfa/bfad.c
37868--- linux-2.6.39/drivers/scsi/bfa/bfad.c 2011-05-19 00:06:34.000000000 -0400
37869+++ linux-2.6.39/drivers/scsi/bfa/bfad.c 2011-05-22 19:36:32.000000000 -0400
37870@@ -1027,6 +1027,8 @@ bfad_start_ops(struct bfad_s *bfad) {
37871 struct bfad_vport_s *vport, *vport_new;
37872 struct bfa_fcs_driver_info_s driver_info;
37873
37874+ pax_track_stack();
37875+
37876 /* Fill the driver_info info to fcs*/
37877 memset(&driver_info, 0, sizeof(driver_info));
37878 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
37879diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c
37880--- linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c 2011-05-19 00:06:34.000000000 -0400
37881+++ linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c 2011-05-22 19:36:32.000000000 -0400
37882@@ -70,7 +70,7 @@ bfa_fcs_attach(struct bfa_fcs_s *fcs, st
37883 bfa_boolean_t min_cfg)
37884 {
37885 int i;
37886- struct bfa_fcs_mod_s *mod;
37887+ const struct bfa_fcs_mod_s *mod;
37888
37889 fcs->bfa = bfa;
37890 fcs->bfad = bfad;
37891@@ -93,7 +93,7 @@ void
37892 bfa_fcs_init(struct bfa_fcs_s *fcs)
37893 {
37894 int i, npbc_vports;
37895- struct bfa_fcs_mod_s *mod;
37896+ const struct bfa_fcs_mod_s *mod;
37897 struct bfi_pbc_vport_s pbc_vports[BFI_PBC_MAX_VPORTS];
37898
37899 for (i = 0; i < sizeof(fcs_modules) / sizeof(fcs_modules[0]); i++) {
37900@@ -140,7 +140,7 @@ bfa_fcs_driver_info_init(struct bfa_fcs_
37901 void
37902 bfa_fcs_exit(struct bfa_fcs_s *fcs)
37903 {
37904- struct bfa_fcs_mod_s *mod;
37905+ const struct bfa_fcs_mod_s *mod;
37906 int nmods, i;
8308f9c9 37907
66a7e928
MT		 37908 bfa_wc_init(&fcs->wc, bfa_fcs_exit_comp, fcs);
37909diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c
37910--- linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-19 00:06:34.000000000 -0400
37911+++ linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-22 19:36:32.000000000 -0400
37912@@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
37913 u16 len, count;
37914 u16 templen;
8308f9c9 37915
66a7e928
MT		 37916+ pax_track_stack();
37917+
37918 /*
37919 * get hba attributes
37920 */
37921@@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
37922 u8 count = 0;
37923 u16 templen;
8308f9c9 37924
66a7e928
MT		 37925+ pax_track_stack();
37926+
37927 /*
37928 * get port attributes
8308f9c9 37929 */
66a7e928
MT		 37930diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c
37931--- linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-19 00:06:34.000000000 -0400
37932+++ linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-22 19:36:32.000000000 -0400
37933@@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
37934 struct fc_rpsc_speed_info_s speeds;
37935 struct bfa_port_attr_s pport_attr;
37936
37937+ pax_track_stack();
37938+
37939 bfa_trc(port->fcs, rx_fchs->s_id);
37940 bfa_trc(port->fcs, rx_fchs->d_id);
37941
37942diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_modules.h linux-2.6.39/drivers/scsi/bfa/bfa_modules.h
37943--- linux-2.6.39/drivers/scsi/bfa/bfa_modules.h 2011-05-19 00:06:34.000000000 -0400
37944+++ linux-2.6.39/drivers/scsi/bfa/bfa_modules.h 2011-05-22 19:36:32.000000000 -0400
37945@@ -68,8 +68,8 @@ enum {
37946 static void bfa_ ## __mod ## _stop(struct bfa_s *bfa); \
37947 static void bfa_ ## __mod ## _iocdisable(struct bfa_s *bfa); \
37948 \
37949- extern struct bfa_module_s hal_mod_ ## __mod; \
37950- struct bfa_module_s hal_mod_ ## __mod = { \
37951+ extern const struct bfa_module_s hal_mod_ ## __mod; \
37952+ const struct bfa_module_s hal_mod_ ## __mod = { \
37953 bfa_ ## __mod ## _meminfo, \
37954 bfa_ ## __mod ## _attach, \
37955 bfa_ ## __mod ## _detach, \
37956@@ -116,12 +116,12 @@ struct bfa_s {
37957 };
8308f9c9 37958
66a7e928
MT		 37959 extern bfa_boolean_t bfa_auto_recover;
37960-extern struct bfa_module_s hal_mod_sgpg;
37961-extern struct bfa_module_s hal_mod_fcport;
37962-extern struct bfa_module_s hal_mod_fcxp;
37963-extern struct bfa_module_s hal_mod_lps;
37964-extern struct bfa_module_s hal_mod_uf;
37965-extern struct bfa_module_s hal_mod_rport;
37966-extern struct bfa_module_s hal_mod_fcpim;
37967+extern const struct bfa_module_s hal_mod_sgpg;
37968+extern const struct bfa_module_s hal_mod_fcport;
37969+extern const struct bfa_module_s hal_mod_fcxp;
37970+extern const struct bfa_module_s hal_mod_lps;
37971+extern const struct bfa_module_s hal_mod_uf;
37972+extern const struct bfa_module_s hal_mod_rport;
37973+extern const struct bfa_module_s hal_mod_fcpim;
37974
37975 #endif /* __BFA_MODULES_H__ */
37976diff -urNp linux-2.6.39/drivers/scsi/BusLogic.c linux-2.6.39/drivers/scsi/BusLogic.c
37977--- linux-2.6.39/drivers/scsi/BusLogic.c 2011-05-19 00:06:34.000000000 -0400
37978+++ linux-2.6.39/drivers/scsi/BusLogic.c 2011-05-22 19:36:32.000000000 -0400
37979@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
37980 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
37981 *PrototypeHostAdapter)
37982 {
37983+ pax_track_stack();
37984+
37985 /*
37986 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
37987 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
37988diff -urNp linux-2.6.39/drivers/scsi/dpt_i2o.c linux-2.6.39/drivers/scsi/dpt_i2o.c
37989--- linux-2.6.39/drivers/scsi/dpt_i2o.c 2011-05-19 00:06:34.000000000 -0400
37990+++ linux-2.6.39/drivers/scsi/dpt_i2o.c 2011-05-22 19:36:32.000000000 -0400
37991@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
37992 dma_addr_t addr;
37993 ulong flags = 0;
bc901d79 37994
66a7e928 37995+ pax_track_stack();
bc901d79 37996+
66a7e928
MT		 37997 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
37998 // get user msg size in u32s
37999 if(get_user(size, &user_msg[0])){
38000@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
38001 s32 rcode;
38002 dma_addr_t addr;
38003
38004+ pax_track_stack();
38005+
38006 memset(msg, 0 , sizeof(msg));
38007 len = scsi_bufflen(cmd);
38008 direction = 0x00000000;
38009diff -urNp linux-2.6.39/drivers/scsi/eata.c linux-2.6.39/drivers/scsi/eata.c
38010--- linux-2.6.39/drivers/scsi/eata.c 2011-05-19 00:06:34.000000000 -0400
38011+++ linux-2.6.39/drivers/scsi/eata.c 2011-05-22 19:36:32.000000000 -0400
38012@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
38013 struct hostdata *ha;
38014 char name[16];
38015
38016+ pax_track_stack();
38017+
38018 sprintf(name, "%s%d", driver_name, j);
38019
38020 if (!request_region(port_base, REGION_SIZE, driver_name)) {
38021diff -urNp linux-2.6.39/drivers/scsi/esp_scsi.c linux-2.6.39/drivers/scsi/esp_scsi.c
38022--- linux-2.6.39/drivers/scsi/esp_scsi.c 2011-05-19 00:06:34.000000000 -0400
38023+++ linux-2.6.39/drivers/scsi/esp_scsi.c 2011-05-22 19:36:32.000000000 -0400
38024@@ -2680,7 +2680,7 @@ static void esp_set_width(struct scsi_ta
38025 tp->flags |= ESP_TGT_CHECK_NEGO;
38026 }
38027
38028-static struct spi_function_template esp_transport_ops = {
38029+static const struct spi_function_template esp_transport_ops = {
38030 .set_offset = esp_set_offset,
38031 .show_offset = 1,
38032 .set_period = esp_set_period,
38033diff -urNp linux-2.6.39/drivers/scsi/fcoe/fcoe.c linux-2.6.39/drivers/scsi/fcoe/fcoe.c
38034--- linux-2.6.39/drivers/scsi/fcoe/fcoe.c 2011-05-19 00:06:34.000000000 -0400
38035+++ linux-2.6.39/drivers/scsi/fcoe/fcoe.c 2011-05-22 19:36:32.000000000 -0400
38036@@ -138,7 +138,7 @@ static int fcoe_vport_disable(struct fc_
38037 static void fcoe_set_vport_symbolic_name(struct fc_vport *);
38038 static void fcoe_set_port_id(struct fc_lport *, u32, struct fc_frame *);
38039
38040-static struct libfc_function_template fcoe_libfc_fcn_templ = {
38041+static const struct libfc_function_template fcoe_libfc_fcn_templ = {
38042 .frame_send = fcoe_xmit,
38043 .ddp_setup = fcoe_ddp_setup,
38044 .ddp_done = fcoe_ddp_done,
38045diff -urNp linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c
38046--- linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-19 00:06:34.000000000 -0400
38047+++ linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-22 19:36:32.000000000 -0400
38048@@ -1912,7 +1912,7 @@ static void fcoe_ctlr_vn_rport_callback(
38049 mutex_unlock(&fip->ctlr_mutex);
38050 }
38051
38052-static struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38053+static const struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38054 .event_callback = fcoe_ctlr_vn_rport_callback,
38055 };
38056
38057@@ -2458,6 +2458,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
38058 } buf;
38059 int rc;
38060
38061+ pax_track_stack();
38062+
38063 fiph = (struct fip_header *)skb->data;
38064 sub = fiph->fip_subcode;
38065
38066diff -urNp linux-2.6.39/drivers/scsi/fnic/fnic_main.c linux-2.6.39/drivers/scsi/fnic/fnic_main.c
38067--- linux-2.6.39/drivers/scsi/fnic/fnic_main.c 2011-05-19 00:06:34.000000000 -0400
38068+++ linux-2.6.39/drivers/scsi/fnic/fnic_main.c 2011-05-22 19:36:32.000000000 -0400
38069@@ -69,7 +69,7 @@ module_param(fnic_log_level, int, S_IRUG
38070 MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
38071
38072
38073-static struct libfc_function_template fnic_transport_template = {
38074+static const struct libfc_function_template fnic_transport_template = {
38075 .frame_send = fnic_send,
38076 .lport_set_port_id = fnic_set_port_id,
38077 .fcp_abort_io = fnic_empty_scsi_cleanup,
38078diff -urNp linux-2.6.39/drivers/scsi/gdth.c linux-2.6.39/drivers/scsi/gdth.c
38079--- linux-2.6.39/drivers/scsi/gdth.c 2011-05-19 00:06:34.000000000 -0400
38080+++ linux-2.6.39/drivers/scsi/gdth.c 2011-05-22 19:36:32.000000000 -0400
38081@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
38082 unsigned long flags;
38083 gdth_ha_str *ha;
38084
38085+ pax_track_stack();
38086+
38087 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
38088 return -EFAULT;
38089 ha = gdth_find_ha(ldrv.ionode);
38090@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
38091 gdth_ha_str *ha;
38092 int rval;
38093
38094+ pax_track_stack();
38095+
38096 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
38097 res.number >= MAX_HDRIVES)
38098 return -EFAULT;
38099@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
38100 gdth_ha_str *ha;
38101 int rval;
38102
38103+ pax_track_stack();
38104+
38105 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
38106 return -EFAULT;
38107 ha = gdth_find_ha(gen.ionode);
38108@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
38109 int i;
38110 gdth_cmd_str gdtcmd;
38111 char cmnd[MAX_COMMAND_SIZE];
38112+
38113+ pax_track_stack();
38114+
38115 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
38116
38117 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
38118diff -urNp linux-2.6.39/drivers/scsi/gdth_proc.c linux-2.6.39/drivers/scsi/gdth_proc.c
38119--- linux-2.6.39/drivers/scsi/gdth_proc.c 2011-05-19 00:06:34.000000000 -0400
38120+++ linux-2.6.39/drivers/scsi/gdth_proc.c 2011-05-22 19:36:32.000000000 -0400
38121@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
38122 u64 paddr;
38123
38124 char cmnd[MAX_COMMAND_SIZE];
38125+
38126+ pax_track_stack();
38127+
38128 memset(cmnd, 0xff, 12);
38129 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
38130
38131@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
38132 gdth_hget_str *phg;
38133 char cmnd[MAX_COMMAND_SIZE];
38134
38135+ pax_track_stack();
38136+
38137 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
38138 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
38139 if (!gdtcmd || !estr)
38140diff -urNp linux-2.6.39/drivers/scsi/hosts.c linux-2.6.39/drivers/scsi/hosts.c
38141--- linux-2.6.39/drivers/scsi/hosts.c 2011-05-19 00:06:34.000000000 -0400
38142+++ linux-2.6.39/drivers/scsi/hosts.c 2011-05-22 19:36:32.000000000 -0400
38143@@ -42,7 +42,7 @@
38144 #include "scsi_logging.h"
38145
38146
38147-static atomic_t scsi_host_next_hn; /* host_no for next new host */
38148+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
38149
38150
38151 static void scsi_host_cls_release(struct device *dev)
38152@@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
38153 * subtract one because we increment first then return, but we need to
38154 * know what the next host number was before increment
38155 */
38156- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
38157+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
38158 shost->dma_channel = 0xff;
38159
38160 /* These three are default values which can be overridden */
38161diff -urNp linux-2.6.39/drivers/scsi/hpsa.h linux-2.6.39/drivers/scsi/hpsa.h
38162--- linux-2.6.39/drivers/scsi/hpsa.h 2011-05-19 00:06:34.000000000 -0400
38163+++ linux-2.6.39/drivers/scsi/hpsa.h 2011-05-22 19:36:32.000000000 -0400
38164@@ -347,7 +347,7 @@ static struct access_method SA5_access =
38165 SA5_completed,
38166 };
38167
38168-static struct access_method SA5_performant_access = {
38169+static const struct access_method SA5_performant_access = {
38170 SA5_submit_command,
38171 SA5_performant_intr_mask,
38172 SA5_fifo_full,
38173diff -urNp linux-2.6.39/drivers/scsi/hptiop.c linux-2.6.39/drivers/scsi/hptiop.c
38174--- linux-2.6.39/drivers/scsi/hptiop.c 2011-05-19 00:06:34.000000000 -0400
38175+++ linux-2.6.39/drivers/scsi/hptiop.c 2011-05-22 19:36:32.000000000 -0400
38176@@ -1226,7 +1226,7 @@ static void hptiop_remove(struct pci_dev
38177 scsi_host_put(host);
38178 }
38179
38180-static struct hptiop_adapter_ops hptiop_itl_ops = {
38181+static const struct hptiop_adapter_ops hptiop_itl_ops = {
38182 .iop_wait_ready = iop_wait_ready_itl,
38183 .internal_memalloc = NULL,
38184 .internal_memfree = NULL,
38185@@ -1241,7 +1241,7 @@ static struct hptiop_adapter_ops hptiop_
38186 .post_req = hptiop_post_req_itl,
38187 };
38188
38189-static struct hptiop_adapter_ops hptiop_mv_ops = {
38190+static const struct hptiop_adapter_ops hptiop_mv_ops = {
38191 .iop_wait_ready = iop_wait_ready_mv,
38192 .internal_memalloc = hptiop_internal_memalloc_mv,
38193 .internal_memfree = hptiop_internal_memfree_mv,
38194diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c
38195--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-19 00:06:34.000000000 -0400
38196+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-22 19:36:32.000000000 -0400
38197@@ -4881,7 +4881,7 @@ static struct vio_device_id ibmvfc_devic
38198 };
38199 MODULE_DEVICE_TABLE(vio, ibmvfc_device_table);
38200
38201-static struct dev_pm_ops ibmvfc_pm_ops = {
38202+static const struct dev_pm_ops ibmvfc_pm_ops = {
38203 .resume = ibmvfc_resume
38204 };
38205
38206diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c
38207--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-19 00:06:34.000000000 -0400
38208+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-22 19:36:32.000000000 -0400
38209@@ -104,7 +104,7 @@ static struct scsi_transport_template *i
38210
38211 #define IBMVSCSI_VERSION "1.5.9"
38212
38213-static struct ibmvscsi_ops *ibmvscsi_ops;
38214+static const struct ibmvscsi_ops *ibmvscsi_ops;
38215
38216 MODULE_DESCRIPTION("IBM Virtual SCSI");
38217 MODULE_AUTHOR("Dave Boutcher");
38218@@ -2059,7 +2059,7 @@ static struct vio_device_id ibmvscsi_dev
38219 };
38220 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
38221
38222-static struct dev_pm_ops ibmvscsi_pm_ops = {
38223+static const struct dev_pm_ops ibmvscsi_pm_ops = {
38224 .resume = ibmvscsi_resume
38225 };
38226
38227@@ -2075,7 +2075,7 @@ static struct vio_driver ibmvscsi_driver
38228 }
38229 };
38230
38231-static struct srp_function_template ibmvscsi_transport_functions = {
38232+static const struct srp_function_template ibmvscsi_transport_functions = {
38233 };
38234
38235 int __init ibmvscsi_module_init(void)
38236diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h
38237--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-19 00:06:34.000000000 -0400
38238+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-22 19:36:32.000000000 -0400
38239@@ -127,7 +127,7 @@ struct ibmvscsi_ops {
38240 int (*resume) (struct ibmvscsi_host_data *hostdata);
38241 };
38242
38243-extern struct ibmvscsi_ops iseriesvscsi_ops;
38244-extern struct ibmvscsi_ops rpavscsi_ops;
38245+extern const struct ibmvscsi_ops iseriesvscsi_ops;
38246+extern const struct ibmvscsi_ops rpavscsi_ops;
38247
38248 #endif /* IBMVSCSI_H */
38249diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c
38250--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-19 00:06:34.000000000 -0400
38251+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-22 19:36:32.000000000 -0400
38252@@ -951,7 +951,7 @@ static int get_system_info(void)
38253 return 0;
38254 }
38255
38256-static struct srp_function_template ibmvstgt_transport_functions = {
38257+static const struct srp_function_template ibmvstgt_transport_functions = {
38258 .tsk_mgmt_response = ibmvstgt_tsk_mgmt_response,
38259 .it_nexus_response = ibmvstgt_it_nexus_response,
38260 };
38261diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c
38262--- linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38263+++ linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38264@@ -163,7 +163,7 @@ static int iseriesvscsi_resume(struct ib
38265 return 0;
38266 }
38267
38268-struct ibmvscsi_ops iseriesvscsi_ops = {
38269+const struct ibmvscsi_ops iseriesvscsi_ops = {
38270 .init_crq_queue = iseriesvscsi_init_crq_queue,
38271 .release_crq_queue = iseriesvscsi_release_crq_queue,
38272 .reset_crq_queue = iseriesvscsi_reset_crq_queue,
38273diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c
38274--- linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38275+++ linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38276@@ -358,7 +358,7 @@ static int rpavscsi_resume(struct ibmvsc
38277 return 0;
38278 }
38279
38280-struct ibmvscsi_ops rpavscsi_ops = {
38281+const struct ibmvscsi_ops rpavscsi_ops = {
38282 .init_crq_queue = rpavscsi_init_crq_queue,
38283 .release_crq_queue = rpavscsi_release_crq_queue,
38284 .reset_crq_queue = rpavscsi_reset_crq_queue,
38285diff -urNp linux-2.6.39/drivers/scsi/ipr.c linux-2.6.39/drivers/scsi/ipr.c
38286--- linux-2.6.39/drivers/scsi/ipr.c 2011-05-19 00:06:34.000000000 -0400
38287+++ linux-2.6.39/drivers/scsi/ipr.c 2011-05-22 19:36:32.000000000 -0400
38288@@ -6210,7 +6210,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
ae4e228f 38289 return true;
58c5fc13
MT		 38290 }
38291
ae4e228f
MT		 38292-static struct ata_port_operations ipr_sata_ops = {
38293+static const struct ata_port_operations ipr_sata_ops = {
38294 .phy_reset = ipr_ata_phy_reset,
38295 .hardreset = ipr_sata_reset,
38296 .post_internal_cmd = ipr_ata_post_internal,
66a7e928
MT		 38297diff -urNp linux-2.6.39/drivers/scsi/libfc/fc_exch.c linux-2.6.39/drivers/scsi/libfc/fc_exch.c
38298--- linux-2.6.39/drivers/scsi/libfc/fc_exch.c 2011-05-19 00:06:34.000000000 -0400
38299+++ linux-2.6.39/drivers/scsi/libfc/fc_exch.c 2011-05-22 19:36:32.000000000 -0400
16454cff 38300@@ -105,12 +105,12 @@ struct fc_exch_mgr {
58c5fc13
MT		 38301 * all together if not used XXX
38302 */
38303 struct {
38304- atomic_t no_free_exch;
38305- atomic_t no_free_exch_xid;
38306- atomic_t xid_not_found;
38307- atomic_t xid_busy;
38308- atomic_t seq_not_found;
38309- atomic_t non_bls_resp;
38310+ atomic_unchecked_t no_free_exch;
38311+ atomic_unchecked_t no_free_exch_xid;
38312+ atomic_unchecked_t xid_not_found;
38313+ atomic_unchecked_t xid_busy;
38314+ atomic_unchecked_t seq_not_found;
38315+ atomic_unchecked_t non_bls_resp;
38316 } stats;
58c5fc13 38317 };
16454cff 38318
66a7e928 38319@@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
58c5fc13
MT		 38320 /* allocate memory for exchange */
38321 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
38322 if (!ep) {
38323- atomic_inc(&mp->stats.no_free_exch);
38324+ atomic_inc_unchecked(&mp->stats.no_free_exch);
38325 goto out;
38326 }
38327 memset(ep, 0, sizeof(*ep));
66a7e928 38328@@ -761,7 +761,7 @@ out:
58c5fc13
MT		 38329 return ep;
38330 err:
ae4e228f 38331 spin_unlock_bh(&pool->lock);
58c5fc13
MT		 38332- atomic_inc(&mp->stats.no_free_exch_xid);
38333+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
38334 mempool_free(ep, mp->ep_pool);
38335 return NULL;
38336 }
66a7e928 38337@@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
58c5fc13
MT		 38338 xid = ntohs(fh->fh_ox_id); /* we originated exch */
38339 ep = fc_exch_find(mp, xid);
38340 if (!ep) {
38341- atomic_inc(&mp->stats.xid_not_found);
38342+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38343 reject = FC_RJT_OX_ID;
38344 goto out;
38345 }
66a7e928 38346@@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
58c5fc13
MT		 38347 ep = fc_exch_find(mp, xid);
38348 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
38349 if (ep) {
38350- atomic_inc(&mp->stats.xid_busy);
38351+ atomic_inc_unchecked(&mp->stats.xid_busy);
38352 reject = FC_RJT_RX_ID;
38353 goto rel;
38354 }
66a7e928 38355@@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
58c5fc13
MT		 38356 }
38357 xid = ep->xid; /* get our XID */
38358 } else if (!ep) {
38359- atomic_inc(&mp->stats.xid_not_found);
38360+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38361 reject = FC_RJT_RX_ID; /* XID not found */
38362 goto out;
38363 }
66a7e928 38364@@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
58c5fc13
MT		 38365 } else {
38366 sp = &ep->seq;
38367 if (sp->id != fh->fh_seq_id) {
38368- atomic_inc(&mp->stats.seq_not_found);
38369+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38370 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
38371 goto rel;
38372 }
66a7e928 38373@@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
58c5fc13
MT		 38374
38375 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
38376 if (!ep) {
38377- atomic_inc(&mp->stats.xid_not_found);
38378+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38379 goto out;
38380 }
38381 if (ep->esb_stat & ESB_ST_COMPLETE) {
38382- atomic_inc(&mp->stats.xid_not_found);
38383+ atomic_inc_unchecked(&mp->stats.xid_not_found);
16454cff 38384 goto rel;
58c5fc13
MT		 38385 }
38386 if (ep->rxid == FC_XID_UNKNOWN)
38387 ep->rxid = ntohs(fh->fh_rx_id);
38388 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
38389- atomic_inc(&mp->stats.xid_not_found);
38390+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38391 goto rel;
38392 }
38393 if (ep->did != ntoh24(fh->fh_s_id) &&
38394 ep->did != FC_FID_FLOGI) {
38395- atomic_inc(&mp->stats.xid_not_found);
38396+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38397 goto rel;
38398 }
38399 sof = fr_sof(fp);
66a7e928 38400@@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
57199397
MT		 38401 sp->ssb_stat |= SSB_ST_RESP;
38402 sp->id = fh->fh_seq_id;
38403 } else if (sp->id != fh->fh_seq_id) {
38404- atomic_inc(&mp->stats.seq_not_found);
38405+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38406 goto rel;
58c5fc13 38407 }
57199397 38408
66a7e928 38409@@ -1479,9 +1479,9 @@ static void fc_exch_recv_resp(struct fc_
58c5fc13 38410 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
ae4e228f
MT		 38411
38412 if (!sp)
58c5fc13
MT		 38413- atomic_inc(&mp->stats.xid_not_found);
38414+ atomic_inc_unchecked(&mp->stats.xid_not_found);
ae4e228f 38415 else
58c5fc13
MT		 38416- atomic_inc(&mp->stats.non_bls_resp);
38417+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
ae4e228f 38418
58c5fc13 38419 fc_frame_free(fp);
ae4e228f 38420 }
66a7e928
MT		 38421diff -urNp linux-2.6.39/drivers/scsi/libfc/fc_lport.c linux-2.6.39/drivers/scsi/libfc/fc_lport.c
38422--- linux-2.6.39/drivers/scsi/libfc/fc_lport.c 2011-05-19 00:06:34.000000000 -0400
38423+++ linux-2.6.39/drivers/scsi/libfc/fc_lport.c 2011-05-22 19:36:32.000000000 -0400
38424@@ -1299,7 +1299,7 @@ static void fc_lport_enter_ns(struct fc_
38425 fc_lport_error(lport, fp);
38426 }
38427
38428-static struct fc_rport_operations fc_lport_rport_ops = {
38429+static const struct fc_rport_operations fc_lport_rport_ops = {
38430 .event_callback = fc_lport_rport_callback,
38431 };
38432
38433diff -urNp linux-2.6.39/drivers/scsi/libfc/fc_rport.c linux-2.6.39/drivers/scsi/libfc/fc_rport.c
38434--- linux-2.6.39/drivers/scsi/libfc/fc_rport.c 2011-05-19 00:06:34.000000000 -0400
38435+++ linux-2.6.39/drivers/scsi/libfc/fc_rport.c 2011-05-22 19:36:32.000000000 -0400
38436@@ -256,7 +256,7 @@ static void fc_rport_work(struct work_st
38437 struct fc_rport_libfc_priv *rpriv;
38438 enum fc_rport_event event;
38439 struct fc_lport *lport = rdata->local_port;
38440- struct fc_rport_operations *rport_ops;
38441+ const struct fc_rport_operations *rport_ops;
38442 struct fc_rport_identifiers ids;
38443 struct fc_rport *rport;
38444 struct fc4_prov *prov;
38445diff -urNp linux-2.6.39/drivers/scsi/libsas/sas_ata.c linux-2.6.39/drivers/scsi/libsas/sas_ata.c
38446--- linux-2.6.39/drivers/scsi/libsas/sas_ata.c 2011-05-19 00:06:34.000000000 -0400
38447+++ linux-2.6.39/drivers/scsi/libsas/sas_ata.c 2011-05-22 19:36:32.000000000 -0400
38448@@ -307,14 +307,14 @@ static void sas_ata_post_internal(struct
ae4e228f
MT		 38449 }
38450 }
38451
38452-static struct ata_port_operations sas_sata_ops = {
38453+static const struct ata_port_operations sas_sata_ops = {
66a7e928
MT		 38454 .prereset = ata_std_prereset,
38455 .softreset = NULL,
38456 .hardreset = sas_ata_hard_reset,
38457 .postreset = ata_std_postreset,
38458 .error_handler = ata_std_error_handler,
ae4e228f 38459 .post_internal_cmd = sas_ata_post_internal,
66a7e928
MT		 38460- .qc_defer = ata_std_qc_defer,
38461+ .qc_defer = ata_std_qc_defer,
38462 .qc_prep = ata_noop_qc_prep,
38463 .qc_issue = sas_ata_qc_issue,
38464 .qc_fill_rtf = sas_ata_qc_fill_rtf,
38465diff -urNp linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c
38466--- linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-19 00:06:34.000000000 -0400
38467+++ linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-22 19:36:32.000000000 -0400
38468@@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
38469
38470 #include <linux/debugfs.h>
8308f9c9
MT		 38471
38472-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38473+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38474 static unsigned long lpfc_debugfs_start_time = 0L;
38475
66a7e928
MT		 38476 /* iDiag */
38477@@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
8308f9c9
MT		 38478 lpfc_debugfs_enable = 0;
38479
38480 len = 0;
38481- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
38482+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
38483 (lpfc_debugfs_max_disc_trc - 1);
38484 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
38485 dtp = vport->disc_trc + i;
66a7e928 38486@@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
8308f9c9
MT		 38487 lpfc_debugfs_enable = 0;
38488
38489 len = 0;
38490- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
38491+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
38492 (lpfc_debugfs_max_slow_ring_trc - 1);
38493 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
38494 dtp = phba->slow_ring_trc + i;
66a7e928
MT		 38495@@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
38496 uint32_t *ptr;
38497 char buffer[1024];
38498
38499+ pax_track_stack();
38500+
38501 off = 0;
38502 spin_lock_irq(&phba->hbalock);
38503
38504@@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
8308f9c9
MT		 38505 !vport || !vport->disc_trc)
38506 return;
38507
38508- index = atomic_inc_return(&vport->disc_trc_cnt) &
38509+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
38510 (lpfc_debugfs_max_disc_trc - 1);
38511 dtp = vport->disc_trc + index;
38512 dtp->fmt = fmt;
38513 dtp->data1 = data1;
38514 dtp->data2 = data2;
38515 dtp->data3 = data3;
38516- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38517+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38518 dtp->jif = jiffies;
38519 #endif
38520 return;
66a7e928 38521@@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
8308f9c9
MT		 38522 !phba || !phba->slow_ring_trc)
38523 return;
38524
38525- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
38526+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
38527 (lpfc_debugfs_max_slow_ring_trc - 1);
38528 dtp = phba->slow_ring_trc + index;
38529 dtp->fmt = fmt;
38530 dtp->data1 = data1;
38531 dtp->data2 = data2;
38532 dtp->data3 = data3;
38533- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38534+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38535 dtp->jif = jiffies;
38536 #endif
38537 return;
66a7e928 38538@@ -2145,7 +2147,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
8308f9c9
MT		 38539 "slow_ring buffer\n");
38540 goto debug_failed;
38541 }
38542- atomic_set(&phba->slow_ring_trc_cnt, 0);
38543+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
38544 memset(phba->slow_ring_trc, 0,
38545 (sizeof(struct lpfc_debugfs_trc) *
38546 lpfc_debugfs_max_slow_ring_trc));
66a7e928 38547@@ -2191,7 +2193,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
8308f9c9
MT		 38548 "buffer\n");
38549 goto debug_failed;
38550 }
38551- atomic_set(&vport->disc_trc_cnt, 0);
38552+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
38553
38554 snprintf(name, sizeof(name), "discovery_trace");
38555 vport->debug_disc_trc =
66a7e928
MT		 38556diff -urNp linux-2.6.39/drivers/scsi/lpfc/lpfc.h linux-2.6.39/drivers/scsi/lpfc/lpfc.h
38557--- linux-2.6.39/drivers/scsi/lpfc/lpfc.h 2011-05-19 00:06:34.000000000 -0400
38558+++ linux-2.6.39/drivers/scsi/lpfc/lpfc.h 2011-05-22 19:36:32.000000000 -0400
38559@@ -419,7 +419,7 @@ struct lpfc_vport {
8308f9c9
MT		 38560 struct dentry *debug_nodelist;
38561 struct dentry *vport_debugfs_root;
38562 struct lpfc_debugfs_trc *disc_trc;
38563- atomic_t disc_trc_cnt;
38564+ atomic_unchecked_t disc_trc_cnt;
38565 #endif
38566 uint8_t stat_data_enabled;
38567 uint8_t stat_data_blocked;
66a7e928 38568@@ -785,8 +785,8 @@ struct lpfc_hba {
8308f9c9
MT		 38569 struct timer_list fabric_block_timer;
38570 unsigned long bit_flags;
38571 #define FABRIC_COMANDS_BLOCKED 0
38572- atomic_t num_rsrc_err;
38573- atomic_t num_cmd_success;
38574+ atomic_unchecked_t num_rsrc_err;
38575+ atomic_unchecked_t num_cmd_success;
38576 unsigned long last_rsrc_error_time;
38577 unsigned long last_ramp_down_time;
38578 unsigned long last_ramp_up_time;
66a7e928 38579@@ -800,7 +800,7 @@ struct lpfc_hba {
8308f9c9
MT		 38580 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
38581 struct dentry *debug_slow_ring_trc;
38582 struct lpfc_debugfs_trc *slow_ring_trc;
38583- atomic_t slow_ring_trc_cnt;
38584+ atomic_unchecked_t slow_ring_trc_cnt;
66a7e928
MT		 38585 /* iDiag debugfs sub-directory */
38586 struct dentry *idiag_root;
38587 struct dentry *idiag_pci_cfg;
38588diff -urNp linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c
38589--- linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-19 00:06:34.000000000 -0400
38590+++ linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 38591@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
38592 uint32_t evt_posted;
38593
38594 spin_lock_irqsave(&phba->hbalock, flags);
38595- atomic_inc(&phba->num_rsrc_err);
38596+ atomic_inc_unchecked(&phba->num_rsrc_err);
38597 phba->last_rsrc_error_time = jiffies;
38598
38599 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
38600@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
38601 unsigned long flags;
38602 struct lpfc_hba *phba = vport->phba;
38603 uint32_t evt_posted;
38604- atomic_inc(&phba->num_cmd_success);
38605+ atomic_inc_unchecked(&phba->num_cmd_success);
38606
38607 if (vport->cfg_lun_queue_depth <= queue_depth)
38608 return;
38609@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38610 unsigned long num_rsrc_err, num_cmd_success;
38611 int i;
38612
38613- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
38614- num_cmd_success = atomic_read(&phba->num_cmd_success);
38615+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
38616+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
38617
38618 vports = lpfc_create_vport_work_array(phba);
38619 if (vports != NULL)
38620@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38621 }
38622 }
38623 lpfc_destroy_vport_work_array(phba, vports);
38624- atomic_set(&phba->num_rsrc_err, 0);
38625- atomic_set(&phba->num_cmd_success, 0);
38626+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38627+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38628 }
38629
38630 /**
38631@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
38632 }
38633 }
38634 lpfc_destroy_vport_work_array(phba, vports);
38635- atomic_set(&phba->num_rsrc_err, 0);
38636- atomic_set(&phba->num_cmd_success, 0);
38637+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38638+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38639 }
38640
38641 /**
66a7e928
MT		 38642diff -urNp linux-2.6.39/drivers/scsi/mac_esp.c linux-2.6.39/drivers/scsi/mac_esp.c
38643--- linux-2.6.39/drivers/scsi/mac_esp.c 2011-05-19 00:06:34.000000000 -0400
38644+++ linux-2.6.39/drivers/scsi/mac_esp.c 2011-05-22 19:36:32.000000000 -0400
38645@@ -473,7 +473,7 @@ static irqreturn_t mac_scsi_esp_intr(int
38646 return IRQ_HANDLED;
38647 }
38648
38649-static struct esp_driver_ops mac_esp_ops = {
38650+static const struct esp_driver_ops mac_esp_ops = {
38651 .esp_write8 = mac_esp_write8,
38652 .esp_read8 = mac_esp_read8,
38653 .map_single = mac_esp_map_single,
38654diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c
38655--- linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-19 00:06:34.000000000 -0400
38656+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-22 19:36:32.000000000 -0400
38657@@ -3510,6 +3510,8 @@ megaraid_cmm_register(adapter_t *adapter
38658 int rval;
38659 int i;
38660
38661+ pax_track_stack();
38662+
38663 // Allocate memory for the base list of scb for management module.
38664 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
38665
38666diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c
38667--- linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-19 00:06:34.000000000 -0400
38668+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-22 19:36:32.000000000 -0400
38669@@ -366,7 +366,7 @@ megasas_check_reset_xscale(struct megasa
38670 return 0;
38671 }
38672
38673-static struct megasas_instance_template megasas_instance_template_xscale = {
38674+static const struct megasas_instance_template megasas_instance_template_xscale = {
38675
38676 .fire_cmd = megasas_fire_cmd_xscale,
38677 .enable_intr = megasas_enable_intr_xscale,
38678@@ -497,7 +497,7 @@ megasas_check_reset_ppc(struct megasas_i
38679 {
38680 return 0;
38681 }
38682-static struct megasas_instance_template megasas_instance_template_ppc = {
38683+static const struct megasas_instance_template megasas_instance_template_ppc = {
38684
38685 .fire_cmd = megasas_fire_cmd_ppc,
38686 .enable_intr = megasas_enable_intr_ppc,
38687@@ -623,7 +623,7 @@ megasas_check_reset_skinny(struct megasa
38688 return 0;
38689 }
38690
38691-static struct megasas_instance_template megasas_instance_template_skinny = {
38692+static const struct megasas_instance_template megasas_instance_template_skinny = {
38693
38694 .fire_cmd = megasas_fire_cmd_skinny,
38695 .enable_intr = megasas_enable_intr_skinny,
38696@@ -810,7 +810,7 @@ megasas_check_reset_gen2(struct megasas_
38697 return 0;
38698 }
38699
38700-static struct megasas_instance_template megasas_instance_template_gen2 = {
38701+static const struct megasas_instance_template megasas_instance_template_gen2 = {
38702
38703 .fire_cmd = megasas_fire_cmd_gen2,
38704 .enable_intr = megasas_enable_intr_gen2,
38705@@ -834,7 +834,7 @@ static struct megasas_instance_template
38706 /*
38707 * Template added for TB (Fusion)
38708 */
38709-extern struct megasas_instance_template megasas_instance_template_fusion;
38710+extern const struct megasas_instance_template megasas_instance_template_fusion;
38711
38712 /**
38713 * megasas_issue_polled - Issues a polling command
38714diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c
38715--- linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-19 00:06:34.000000000 -0400
38716+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-22 19:36:32.000000000 -0400
38717@@ -2236,7 +2236,7 @@ void megasas_fusion_ocr_wq(struct work_s
38718 megasas_reset_fusion(instance->host);
38719 }
38720
38721-struct megasas_instance_template megasas_instance_template_fusion = {
38722+const struct megasas_instance_template megasas_instance_template_fusion = {
38723 .fire_cmd = megasas_fire_cmd_fusion,
38724 .enable_intr = megasas_enable_intr_fusion,
38725 .disable_intr = megasas_disable_intr_fusion,
38726diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h
38727--- linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h 2011-05-19 00:06:34.000000000 -0400
38728+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h 2011-05-22 19:36:32.000000000 -0400
38729@@ -1330,7 +1330,7 @@ struct megasas_instance {
38730 atomic_t fw_outstanding;
38731 atomic_t fw_reset_no_pci_access;
38732
38733- struct megasas_instance_template *instancet;
38734+ const struct megasas_instance_template *instancet;
38735 struct tasklet_struct isr_tasklet;
38736 struct work_struct work_init;
38737
38738diff -urNp linux-2.6.39/drivers/scsi/ncr53c8xx.c linux-2.6.39/drivers/scsi/ncr53c8xx.c
38739--- linux-2.6.39/drivers/scsi/ncr53c8xx.c 2011-05-19 00:06:34.000000000 -0400
38740+++ linux-2.6.39/drivers/scsi/ncr53c8xx.c 2011-05-22 19:36:32.000000000 -0400
38741@@ -8606,7 +8606,7 @@ static void ncr53c8xx_get_signalling(str
38742 spi_signalling(shost) = type;
38743 }
38744
38745-static struct spi_function_template ncr53c8xx_transport_functions = {
38746+static struct spi_function_template ncr53c8xx_transport_functions = {
38747 .set_period = ncr53c8xx_set_period,
38748 .show_period = 1,
38749 .set_offset = ncr53c8xx_set_offset,
38750diff -urNp linux-2.6.39/drivers/scsi/osd/osd_initiator.c linux-2.6.39/drivers/scsi/osd/osd_initiator.c
38751--- linux-2.6.39/drivers/scsi/osd/osd_initiator.c 2011-05-19 00:06:34.000000000 -0400
38752+++ linux-2.6.39/drivers/scsi/osd/osd_initiator.c 2011-05-22 19:36:32.000000000 -0400
38753@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
38754 int nelem = ARRAY_SIZE(get_attrs), a = 0;
38755 int ret;
38756
38757+ pax_track_stack();
38758+
38759 or = osd_start_request(od, GFP_KERNEL);
38760 if (!or)
38761 return -ENOMEM;
38762diff -urNp linux-2.6.39/drivers/scsi/pmcraid.c linux-2.6.39/drivers/scsi/pmcraid.c
38763--- linux-2.6.39/drivers/scsi/pmcraid.c 2011-05-19 00:06:34.000000000 -0400
38764+++ linux-2.6.39/drivers/scsi/pmcraid.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 38765@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
38766 res->scsi_dev = scsi_dev;
38767 scsi_dev->hostdata = res;
38768 res->change_detected = 0;
38769- atomic_set(&res->read_failures, 0);
38770- atomic_set(&res->write_failures, 0);
38771+ atomic_set_unchecked(&res->read_failures, 0);
38772+ atomic_set_unchecked(&res->write_failures, 0);
38773 rc = 0;
38774 }
38775 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
38776@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
38777
38778 /* If this was a SCSI read/write command keep count of errors */
38779 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
38780- atomic_inc(&res->read_failures);
38781+ atomic_inc_unchecked(&res->read_failures);
38782 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
38783- atomic_inc(&res->write_failures);
38784+ atomic_inc_unchecked(&res->write_failures);
38785
38786 if (!RES_IS_GSCSI(res->cfg_entry) &&
38787 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
38788@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
38789 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38790 * hrrq_id assigned here in queuecommand
38791 */
38792- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38793+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38794 pinstance->num_hrrq;
38795 cmd->cmd_done = pmcraid_io_done;
38796
66a7e928 38797@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
8308f9c9
MT		 38798 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38799 * hrrq_id assigned here in queuecommand
38800 */
38801- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38802+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38803 pinstance->num_hrrq;
38804
38805 if (request_size) {
66a7e928 38806@@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(stru
8308f9c9
MT		 38807
38808 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
38809 /* add resources only after host is added into system */
38810- if (!atomic_read(&pinstance->expose_resources))
38811+ if (!atomic_read_unchecked(&pinstance->expose_resources))
38812 return;
38813
38814 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
66a7e928 38815@@ -5329,8 +5329,8 @@ static int __devinit pmcraid_init_instan
8308f9c9
MT		 38816 init_waitqueue_head(&pinstance->reset_wait_q);
38817
38818 atomic_set(&pinstance->outstanding_cmds, 0);
38819- atomic_set(&pinstance->last_message_id, 0);
38820- atomic_set(&pinstance->expose_resources, 0);
38821+ atomic_set_unchecked(&pinstance->last_message_id, 0);
38822+ atomic_set_unchecked(&pinstance->expose_resources, 0);
38823
38824 INIT_LIST_HEAD(&pinstance->free_res_q);
38825 INIT_LIST_HEAD(&pinstance->used_res_q);
66a7e928 38826@@ -6045,7 +6045,7 @@ static int __devinit pmcraid_probe(
8308f9c9
MT		 38827 /* Schedule worker thread to handle CCN and take care of adding and
38828 * removing devices to OS
38829 */
38830- atomic_set(&pinstance->expose_resources, 1);
38831+ atomic_set_unchecked(&pinstance->expose_resources, 1);
38832 schedule_work(&pinstance->worker_q);
38833 return rc;
38834
66a7e928
MT		 38835diff -urNp linux-2.6.39/drivers/scsi/pmcraid.h linux-2.6.39/drivers/scsi/pmcraid.h
38836--- linux-2.6.39/drivers/scsi/pmcraid.h 2011-05-19 00:06:34.000000000 -0400
38837+++ linux-2.6.39/drivers/scsi/pmcraid.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 38838@@ -750,7 +750,7 @@ struct pmcraid_instance {
38839 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
38840
38841 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
38842- atomic_t last_message_id;
38843+ atomic_unchecked_t last_message_id;
38844
38845 /* configuration table */
38846 struct pmcraid_config_table *cfg_table;
38847@@ -779,7 +779,7 @@ struct pmcraid_instance {
38848 atomic_t outstanding_cmds;
38849
38850 /* should add/delete resources to mid-layer now ?*/
38851- atomic_t expose_resources;
38852+ atomic_unchecked_t expose_resources;
38853
38854
38855
38856@@ -815,8 +815,8 @@ struct pmcraid_resource_entry {
38857 struct pmcraid_config_table_entry_ext cfg_entry_ext;
38858 };
38859 struct scsi_device *scsi_dev; /* Link scsi_device structure */
38860- atomic_t read_failures; /* count of failed READ commands */
38861- atomic_t write_failures; /* count of failed WRITE commands */
38862+ atomic_unchecked_t read_failures; /* count of failed READ commands */
38863+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
38864
38865 /* To indicate add/delete/modify during CCN */
38866 u8 change_detected;
66a7e928
MT		 38867diff -urNp linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c
38868--- linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c 2011-05-19 00:06:34.000000000 -0400
38869+++ linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c 2011-05-22 19:36:32.000000000 -0400
38870@@ -4097,7 +4097,7 @@ static struct pci_driver qla2xxx_pci_dri
57199397
MT		 38871 .err_handler = &qla2xxx_err_handler,
38872 };
38873
38874-static struct file_operations apidev_fops = {
38875+static const struct file_operations apidev_fops = {
38876 .owner = THIS_MODULE,
bc901d79 38877 .llseek = noop_llseek,
57199397 38878 };
66a7e928
MT		 38879diff -urNp linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h
38880--- linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h 2011-05-19 00:06:34.000000000 -0400
38881+++ linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 38882@@ -256,7 +256,7 @@ struct ddb_entry {
38883 atomic_t retry_relogin_timer; /* Min Time between relogins
38884 * (4000 only) */
38885 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
38886- atomic_t relogin_retry_count; /* Num of times relogin has been
38887+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
38888 * retried */
38889
38890 uint16_t port;
66a7e928
MT		 38891diff -urNp linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c
38892--- linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c 2011-05-19 00:06:34.000000000 -0400
38893+++ linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 38894@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
38895 ddb_entry->fw_ddb_index = fw_ddb_index;
38896 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
38897 atomic_set(&ddb_entry->relogin_timer, 0);
38898- atomic_set(&ddb_entry->relogin_retry_count, 0);
38899+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
38900 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
38901 list_add_tail(&ddb_entry->list, &ha->ddb_list);
38902 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
66a7e928
MT		 38903@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
38904 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
38905 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
8308f9c9
MT		 38906 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
38907- atomic_set(&ddb_entry->relogin_retry_count, 0);
38908+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
38909 atomic_set(&ddb_entry->relogin_timer, 0);
38910 clear_bit(DF_RELOGIN, &ddb_entry->flags);
66a7e928
MT		 38911 iscsi_unblock_session(ddb_entry->sess);
38912diff -urNp linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c
38913--- linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c 2011-05-19 00:06:34.000000000 -0400
38914+++ linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c 2011-05-22 19:36:32.000000000 -0400
38915@@ -802,13 +802,13 @@ static void qla4xxx_timer(struct scsi_ql
8308f9c9
MT		 38916 ddb_entry->fw_ddb_device_state ==
38917 DDB_DS_SESSION_FAILED) {
38918 /* Reset retry relogin timer */
38919- atomic_inc(&ddb_entry->relogin_retry_count);
38920+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
38921 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
38922 " timed out-retrying"
38923 " relogin (%d)\n",
38924 ha->host_no,
38925 ddb_entry->fw_ddb_index,
38926- atomic_read(&ddb_entry->
38927+ atomic_read_unchecked(&ddb_entry->
38928 relogin_retry_count))
38929 );
38930 start_dpc++;
66a7e928
MT		 38931diff -urNp linux-2.6.39/drivers/scsi/scsi.c linux-2.6.39/drivers/scsi/scsi.c
38932--- linux-2.6.39/drivers/scsi/scsi.c 2011-05-19 00:06:34.000000000 -0400
38933+++ linux-2.6.39/drivers/scsi/scsi.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 38934@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
38935 unsigned long timeout;
38936 int rtn = 0;
38937
38938- atomic_inc(&cmd->device->iorequest_cnt);
38939+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
38940
38941 /* check if the device is still usable */
38942 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
66a7e928
MT		 38943diff -urNp linux-2.6.39/drivers/scsi/scsi_debug.c linux-2.6.39/drivers/scsi/scsi_debug.c
38944--- linux-2.6.39/drivers/scsi/scsi_debug.c 2011-05-19 00:06:34.000000000 -0400
38945+++ linux-2.6.39/drivers/scsi/scsi_debug.c 2011-05-22 19:36:32.000000000 -0400
38946@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
38947 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
38948 unsigned char *cmd = (unsigned char *)scp->cmnd;
38949
38950+ pax_track_stack();
38951+
38952 if ((errsts = check_readiness(scp, 1, devip)))
38953 return errsts;
38954 memset(arr, 0, sizeof(arr));
38955@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
38956 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
38957 unsigned char *cmd = (unsigned char *)scp->cmnd;
38958
38959+ pax_track_stack();
38960+
38961 if ((errsts = check_readiness(scp, 1, devip)))
38962 return errsts;
38963 memset(arr, 0, sizeof(arr));
38964diff -urNp linux-2.6.39/drivers/scsi/scsi_lib.c linux-2.6.39/drivers/scsi/scsi_lib.c
38965--- linux-2.6.39/drivers/scsi/scsi_lib.c 2011-05-19 00:06:34.000000000 -0400
38966+++ linux-2.6.39/drivers/scsi/scsi_lib.c 2011-05-22 19:36:32.000000000 -0400
38967@@ -1410,7 +1410,7 @@ static void scsi_kill_request(struct req
8308f9c9
MT		 38968 shost = sdev->host;
38969 scsi_init_cmd_errh(cmd);
38970 cmd->result = DID_NO_CONNECT << 16;
38971- atomic_inc(&cmd->device->iorequest_cnt);
38972+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
38973
38974 /*
38975 * SCSI request completion path will do scsi_device_unbusy(),
66a7e928 38976@@ -1436,9 +1436,9 @@ static void scsi_softirq_done(struct req
8308f9c9
MT		 38977
38978 INIT_LIST_HEAD(&cmd->eh_entry);
38979
38980- atomic_inc(&cmd->device->iodone_cnt);
38981+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
38982 if (cmd->result)
38983- atomic_inc(&cmd->device->ioerr_cnt);
38984+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
38985
38986 disposition = scsi_decide_disposition(cmd);
38987 if (disposition != SUCCESS &&
66a7e928
MT		 38988diff -urNp linux-2.6.39/drivers/scsi/scsi_sysfs.c linux-2.6.39/drivers/scsi/scsi_sysfs.c
38989--- linux-2.6.39/drivers/scsi/scsi_sysfs.c 2011-05-19 00:06:34.000000000 -0400
38990+++ linux-2.6.39/drivers/scsi/scsi_sysfs.c 2011-05-22 19:36:32.000000000 -0400
38991@@ -621,7 +621,7 @@ show_iostat_##field(struct device *dev,
8308f9c9
MT		 38992 char *buf) \
38993 { \
38994 struct scsi_device *sdev = to_scsi_device(dev); \
38995- unsigned long long count = atomic_read(&sdev->field); \
38996+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
38997 return snprintf(buf, 20, "0x%llx\n", count); \
38998 } \
38999 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
66a7e928
MT		 39000diff -urNp linux-2.6.39/drivers/scsi/scsi_transport_fc.c linux-2.6.39/drivers/scsi/scsi_transport_fc.c
39001--- linux-2.6.39/drivers/scsi/scsi_transport_fc.c 2011-05-19 00:06:34.000000000 -0400
39002+++ linux-2.6.39/drivers/scsi/scsi_transport_fc.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39003@@ -485,7 +485,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
39004 * Netlink Infrastructure
39005 */
39006
39007-static atomic_t fc_event_seq;
39008+static atomic_unchecked_t fc_event_seq;
39009
39010 /**
39011 * fc_get_event_number - Obtain the next sequential FC event number
39012@@ -498,7 +498,7 @@ static atomic_t fc_event_seq;
39013 u32
39014 fc_get_event_number(void)
39015 {
39016- return atomic_add_return(1, &fc_event_seq);
39017+ return atomic_add_return_unchecked(1, &fc_event_seq);
39018 }
39019 EXPORT_SYMBOL(fc_get_event_number);
39020
39021@@ -646,7 +646,7 @@ static __init int fc_transport_init(void
39022 {
39023 int error;
39024
39025- atomic_set(&fc_event_seq, 0);
39026+ atomic_set_unchecked(&fc_event_seq, 0);
39027
39028 error = transport_class_register(&fc_host_class);
39029 if (error)
71d190be
MT		 39030@@ -836,7 +836,7 @@ static int fc_str_to_dev_loss(const char
39031 char *cp;
58c5fc13 39032
71d190be
MT		 39033 *val = simple_strtoul(buf, &cp, 0);
39034- if ((*cp && (*cp != '\n')) || (*val < 0))
39035+ if (*cp && (*cp != '\n'))
39036 return -EINVAL;
39037 /*
39038 * Check for overflow; dev_loss_tmo is u32
66a7e928
MT		 39039diff -urNp linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c
39040--- linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c 2011-05-19 00:06:34.000000000 -0400
39041+++ linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39042@@ -83,7 +83,7 @@ struct iscsi_internal {
39043 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
39044 };
39045
39046-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
39047+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
39048 static struct workqueue_struct *iscsi_eh_timer_workq;
39049
39050 /*
39051@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
39052 int err;
39053
39054 ihost = shost->shost_data;
39055- session->sid = atomic_add_return(1, &iscsi_session_nr);
39056+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
39057
39058 if (id == ISCSI_MAX_TARGET) {
39059 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
66a7e928 39060@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
8308f9c9
MT		 39061 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
39062 ISCSI_TRANSPORT_VERSION);
39063
39064- atomic_set(&iscsi_session_nr, 0);
39065+ atomic_set_unchecked(&iscsi_session_nr, 0);
39066
39067 err = class_register(&iscsi_transport_class);
39068 if (err)
66a7e928
MT		 39069diff -urNp linux-2.6.39/drivers/scsi/scsi_transport_srp.c linux-2.6.39/drivers/scsi/scsi_transport_srp.c
39070--- linux-2.6.39/drivers/scsi/scsi_transport_srp.c 2011-05-19 00:06:34.000000000 -0400
39071+++ linux-2.6.39/drivers/scsi/scsi_transport_srp.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39072@@ -33,7 +33,7 @@
39073 #include "scsi_transport_srp_internal.h"
39074
39075 struct srp_host_attrs {
39076- atomic_t next_port_id;
39077+ atomic_unchecked_t next_port_id;
39078 };
39079 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
39080
39081@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
39082 struct Scsi_Host *shost = dev_to_shost(dev);
39083 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
39084
39085- atomic_set(&srp_host->next_port_id, 0);
39086+ atomic_set_unchecked(&srp_host->next_port_id, 0);
39087 return 0;
39088 }
39089
39090@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
39091 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
39092 rport->roles = ids->roles;
39093
39094- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
39095+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
39096 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
39097
39098 transport_setup_device(&rport->dev);
66a7e928
MT		 39099diff -urNp linux-2.6.39/drivers/scsi/sg.c linux-2.6.39/drivers/scsi/sg.c
39100--- linux-2.6.39/drivers/scsi/sg.c 2011-05-19 00:06:34.000000000 -0400
39101+++ linux-2.6.39/drivers/scsi/sg.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 39102@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
ae4e228f 39103 const struct file_operations * fops;
58c5fc13
MT		 39104 };
39105
ae4e228f
MT		 39106-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
39107+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
39108 {"allow_dio", &adio_fops},
39109 {"debug", &debug_fops},
39110 {"def_reserved_size", &dressz_fops},
bc901d79 39111@@ -2325,7 +2325,7 @@ sg_proc_init(void)
ae4e228f
MT		 39112 {
39113 int k, mask;
39114 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
39115- struct sg_proc_leaf * leaf;
39116+ const struct sg_proc_leaf * leaf;
39117
39118 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
39119 if (!sg_proc_sgp)
66a7e928
MT		 39120diff -urNp linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c
39121--- linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-19 00:06:34.000000000 -0400
39122+++ linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-22 19:36:32.000000000 -0400
39123@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
39124 int do_iounmap = 0;
39125 int do_disable_device = 1;
39126
39127+ pax_track_stack();
39128+
39129 memset(&sym_dev, 0, sizeof(sym_dev));
39130 memset(&nvram, 0, sizeof(nvram));
39131 sym_dev.pdev = pdev;
39132diff -urNp linux-2.6.39/drivers/scsi/vmw_pvscsi.c linux-2.6.39/drivers/scsi/vmw_pvscsi.c
39133--- linux-2.6.39/drivers/scsi/vmw_pvscsi.c 2011-05-19 00:06:34.000000000 -0400
39134+++ linux-2.6.39/drivers/scsi/vmw_pvscsi.c 2011-05-22 19:36:32.000000000 -0400
39135@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
39136 dma_addr_t base;
39137 unsigned i;
39138
39139+ pax_track_stack();
39140+
39141 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
39142 cmd.reqRingNumPages = adapter->req_pages;
39143 cmd.cmpRingNumPages = adapter->cmp_pages;
39144diff -urNp linux-2.6.39/drivers/sh/clk/cpg.c linux-2.6.39/drivers/sh/clk/cpg.c
39145--- linux-2.6.39/drivers/sh/clk/cpg.c 2011-05-19 00:06:34.000000000 -0400
39146+++ linux-2.6.39/drivers/sh/clk/cpg.c 2011-05-22 19:36:32.000000000 -0400
39147@@ -26,7 +26,7 @@ static void sh_clk_mstp32_disable(struct
39148 clk->enable_reg);
39149 }
39150
39151-static struct clk_ops sh_clk_mstp32_clk_ops = {
39152+static const struct clk_ops sh_clk_mstp32_clk_ops = {
39153 .enable = sh_clk_mstp32_enable,
39154 .disable = sh_clk_mstp32_disable,
39155 .recalc = followparent_recalc,
39156@@ -150,7 +150,7 @@ static void sh_clk_div6_disable(struct c
39157 __raw_writel(value, clk->enable_reg);
39158 }
39159
39160-static struct clk_ops sh_clk_div6_clk_ops = {
39161+static const struct clk_ops sh_clk_div6_clk_ops = {
39162 .recalc = sh_clk_div6_recalc,
39163 .round_rate = sh_clk_div_round_rate,
39164 .set_rate = sh_clk_div6_set_rate,
39165@@ -158,7 +158,7 @@ static struct clk_ops sh_clk_div6_clk_op
39166 .disable = sh_clk_div6_disable,
39167 };
39168
39169-static struct clk_ops sh_clk_div6_reparent_clk_ops = {
39170+static const struct clk_ops sh_clk_div6_reparent_clk_ops = {
39171 .recalc = sh_clk_div6_recalc,
39172 .round_rate = sh_clk_div_round_rate,
39173 .set_rate = sh_clk_div6_set_rate,
39174@@ -282,13 +282,13 @@ static void sh_clk_div4_disable(struct c
39175 __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
39176 }
39177
39178-static struct clk_ops sh_clk_div4_clk_ops = {
39179+static const struct clk_ops sh_clk_div4_clk_ops = {
39180 .recalc = sh_clk_div4_recalc,
39181 .set_rate = sh_clk_div4_set_rate,
39182 .round_rate = sh_clk_div_round_rate,
39183 };
39184
39185-static struct clk_ops sh_clk_div4_enable_clk_ops = {
39186+static const struct clk_ops sh_clk_div4_enable_clk_ops = {
39187 .recalc = sh_clk_div4_recalc,
39188 .set_rate = sh_clk_div4_set_rate,
39189 .round_rate = sh_clk_div_round_rate,
39190@@ -296,7 +296,7 @@ static struct clk_ops sh_clk_div4_enable
39191 .disable = sh_clk_div4_disable,
39192 };
39193
39194-static struct clk_ops sh_clk_div4_reparent_clk_ops = {
39195+static const struct clk_ops sh_clk_div4_reparent_clk_ops = {
39196 .recalc = sh_clk_div4_recalc,
39197 .set_rate = sh_clk_div4_set_rate,
39198 .round_rate = sh_clk_div_round_rate,
39199diff -urNp linux-2.6.39/drivers/spi/dw_spi.h linux-2.6.39/drivers/spi/dw_spi.h
39200--- linux-2.6.39/drivers/spi/dw_spi.h 2011-05-19 00:06:34.000000000 -0400
39201+++ linux-2.6.39/drivers/spi/dw_spi.h 2011-05-22 19:36:32.000000000 -0400
39202@@ -151,7 +151,7 @@ struct dw_spi {
39203 int dma_chan_done;
39204 struct device *dma_dev;
39205 dma_addr_t dma_addr; /* phy address of the Data register */
39206- struct dw_spi_dma_ops *dma_ops;
39207+ const struct dw_spi_dma_ops *dma_ops;
39208 void *dma_priv; /* platform relate info */
39209 struct pci_dev *dmac;
39210
39211diff -urNp linux-2.6.39/drivers/spi/dw_spi_mid.c linux-2.6.39/drivers/spi/dw_spi_mid.c
39212--- linux-2.6.39/drivers/spi/dw_spi_mid.c 2011-05-19 00:06:34.000000000 -0400
39213+++ linux-2.6.39/drivers/spi/dw_spi_mid.c 2011-05-22 19:36:32.000000000 -0400
39214@@ -180,7 +180,7 @@ static int mid_spi_dma_transfer(struct d
39215 return 0;
39216 }
39217
39218-static struct dw_spi_dma_ops mid_dma_ops = {
39219+static const struct dw_spi_dma_ops mid_dma_ops = {
39220 .dma_init = mid_spi_dma_init,
39221 .dma_exit = mid_spi_dma_exit,
39222 .dma_transfer = mid_spi_dma_transfer,
39223diff -urNp linux-2.6.39/drivers/spi/spi.c linux-2.6.39/drivers/spi/spi.c
39224--- linux-2.6.39/drivers/spi/spi.c 2011-05-19 00:06:34.000000000 -0400
39225+++ linux-2.6.39/drivers/spi/spi.c 2011-05-22 19:36:32.000000000 -0400
39226@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
39227 EXPORT_SYMBOL_GPL(spi_bus_unlock);
39228
39229 /* portable code must never pass more than 32 bytes */
39230-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
39231+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
39232
39233 static u8 *buf;
39234
39235diff -urNp linux-2.6.39/drivers/ssb/driver_pcicore.c linux-2.6.39/drivers/ssb/driver_pcicore.c
39236--- linux-2.6.39/drivers/ssb/driver_pcicore.c 2011-05-19 00:06:34.000000000 -0400
39237+++ linux-2.6.39/drivers/ssb/driver_pcicore.c 2011-05-22 19:36:32.000000000 -0400
39238@@ -223,7 +223,7 @@ static int ssb_pcicore_write_config(stru
39239 return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
39240 }
39241
39242-static struct pci_ops ssb_pcicore_pciops = {
39243+static const struct pci_ops ssb_pcicore_pciops = {
39244 .read = ssb_pcicore_read_config,
39245 .write = ssb_pcicore_write_config,
39246 };
39247diff -urNp linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c
39248--- linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39249+++ linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39250@@ -1391,8 +1391,7 @@ u32 cipher_suites[] = {
39251 WLAN_CIPHER_SUITE_CCMP,
39252 };
39253
39254-static struct
39255-cfg80211_ops ar6k_cfg80211_ops = {
39256+static const struct cfg80211_ops ar6k_cfg80211_ops = {
39257 .change_virtual_intf = ar6k_cfg80211_change_iface,
39258 .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
39259 .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
39260diff -urNp linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
39261--- linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-19 00:06:34.000000000 -0400
39262+++ linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-22 19:36:32.000000000 -0400
39263@@ -857,14 +857,14 @@ static void dhd_op_if(dhd_if_t *ifp)
c52201e0
MT		 39264 free_netdev(ifp->net);
39265 }
39266 /* Allocate etherdev, including space for private structure */
39267- ifp->net = alloc_etherdev(sizeof(dhd));
39268+ ifp->net = alloc_etherdev(sizeof(*dhd));
39269 if (!ifp->net) {
39270 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39271 ret = -ENOMEM;
39272 }
39273 if (ret == 0) {
39274 strcpy(ifp->net->name, ifp->name);
39275- memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
39276+ memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
39277 err = dhd_net_attach(&dhd->pub, ifp->idx);
39278 if (err != 0) {
39279 DHD_ERROR(("%s: dhd_net_attach failed, "
66a7e928
MT		 39280@@ -1500,7 +1500,7 @@ static void dhd_ethtool_get_drvinfo(stru
39281 sprintf(info->bus_info, "%s", dev_name(&wl_cfg80211_get_sdio_func()->dev));
39282 }
39283
39284-struct ethtool_ops dhd_ethtool_ops = {
39285+const struct ethtool_ops dhd_ethtool_ops = {
39286 .get_drvinfo = dhd_ethtool_get_drvinfo
39287 };
39288
39289@@ -1923,7 +1923,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
c52201e0
MT		 39290 strcpy(nv_path, nvram_path);
39291
39292 /* Allocate etherdev, including space for private structure */
39293- net = alloc_etherdev(sizeof(dhd));
39294+ net = alloc_etherdev(sizeof(*dhd));
39295 if (!net) {
39296 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39297 goto fail;
66a7e928 39298@@ -1939,7 +1939,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
c52201e0
MT		 39299 /*
39300 * Save the dhd_info into the priv
39301 */
39302- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39303+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
c52201e0
MT		 39304
39305 /* Set network interface name if it was provided as module parameter */
66a7e928
MT		 39306 if (iface_name[0]) {
39307@@ -2056,7 +2056,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
c52201e0
MT		 39308 /*
39309 * Save the dhd_info into the priv
39310 */
39311- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39312+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39313
39314 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
39315 g_bus = bus;
66a7e928
MT		 39316@@ -2206,7 +2206,7 @@ dhd_iovar(dhd_pub_t *pub, int ifidx, cha
39317 return ret;
39318 }
39319
39320-static struct net_device_ops dhd_ops_pri = {
39321+static const struct net_device_ops dhd_ops_pri = {
39322 .ndo_open = dhd_open,
39323 .ndo_stop = dhd_stop,
39324 .ndo_get_stats = dhd_get_stats,
39325diff -urNp linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
39326--- linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39327+++ linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39328@@ -2109,7 +2109,7 @@ wl_cfg80211_flush_pmksa(struct wiphy *wi
39329
39330 }
39331
39332-static struct cfg80211_ops wl_cfg80211_ops = {
39333+static const struct cfg80211_ops wl_cfg80211_ops = {
39334 .change_virtual_intf = wl_cfg80211_change_iface,
39335 .scan = wl_cfg80211_scan,
39336 .set_wiphy_params = wl_cfg80211_set_wiphy_params,
39337diff -urNp linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c
39338--- linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-19 00:06:34.000000000 -0400
39339+++ linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-22 19:36:32.000000000 -0400
39340@@ -495,7 +495,7 @@ wl_iw_get_range(struct net_device *dev,
c52201e0
MT		 39341 list = (wl_u32_list_t *) channels;
39342
39343 dwrq->length = sizeof(struct iw_range);
39344- memset(range, 0, sizeof(range));
39345+ memset(range, 0, sizeof(*range));
39346
39347 range->min_nwid = range->max_nwid = 0;
39348
66a7e928
MT		 39349diff -urNp linux-2.6.39/drivers/staging/comedi/comedi_fops.c linux-2.6.39/drivers/staging/comedi/comedi_fops.c
39350--- linux-2.6.39/drivers/staging/comedi/comedi_fops.c 2011-05-19 00:06:34.000000000 -0400
39351+++ linux-2.6.39/drivers/staging/comedi/comedi_fops.c 2011-05-22 19:36:32.000000000 -0400
39352@@ -1445,7 +1445,7 @@ static void comedi_unmap(struct vm_area_
58c5fc13
MT		 39353 mutex_unlock(&dev->mutex);
39354 }
39355
39356-static struct vm_operations_struct comedi_vm_ops = {
39357+static const struct vm_operations_struct comedi_vm_ops = {
ae4e228f 39358 .close = comedi_unmap,
58c5fc13
MT		 39359 };
39360
66a7e928
MT		 39361diff -urNp linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c
39362--- linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c 2011-05-19 00:06:34.000000000 -0400
39363+++ linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c 2011-05-22 19:36:32.000000000 -0400
39364@@ -586,7 +586,7 @@ static struct page *snd_cx25821_page(str
39365 /*
39366 * operators
39367 */
39368-static struct snd_pcm_ops snd_cx25821_pcm_ops = {
39369+static const struct snd_pcm_ops snd_cx25821_pcm_ops = {
39370 .open = snd_cx25821_pcm_open,
39371 .close = snd_cx25821_close,
39372 .ioctl = snd_pcm_lib_ioctl,
39373diff -urNp linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c
39374--- linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c 2011-05-19 00:06:34.000000000 -0400
39375+++ linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c 2011-05-22 19:36:32.000000000 -0400
39376@@ -282,7 +282,7 @@ static u32 cx25821_functionality(struct
39377 I2C_FUNC_SMBUS_READ_WORD_DATA | I2C_FUNC_SMBUS_WRITE_WORD_DATA;
39378 }
39379
39380-static struct i2c_algorithm cx25821_i2c_algo_template = {
39381+static const struct i2c_algorithm cx25821_i2c_algo_template = {
39382 .master_xfer = i2c_xfer,
39383 .functionality = cx25821_functionality,
39384 #ifdef NEED_ALGO_CONTROL
39385diff -urNp linux-2.6.39/drivers/staging/et131x/et1310_tx.c linux-2.6.39/drivers/staging/et131x/et1310_tx.c
39386--- linux-2.6.39/drivers/staging/et131x/et1310_tx.c 2011-05-19 00:06:34.000000000 -0400
39387+++ linux-2.6.39/drivers/staging/et131x/et1310_tx.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39388@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
39389 struct net_device_stats *stats = &etdev->net_stats;
39390
39391 if (tcb->flags & fMP_DEST_BROAD)
39392- atomic_inc(&etdev->Stats.brdcstxmt);
39393+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
39394 else if (tcb->flags & fMP_DEST_MULTI)
39395- atomic_inc(&etdev->Stats.multixmt);
39396+ atomic_inc_unchecked(&etdev->Stats.multixmt);
39397 else
39398- atomic_inc(&etdev->Stats.unixmt);
39399+ atomic_inc_unchecked(&etdev->Stats.unixmt);
39400
39401 if (tcb->skb) {
39402 stats->tx_bytes += tcb->skb->len;
66a7e928
MT		 39403diff -urNp linux-2.6.39/drivers/staging/et131x/et131x_adapter.h linux-2.6.39/drivers/staging/et131x/et131x_adapter.h
39404--- linux-2.6.39/drivers/staging/et131x/et131x_adapter.h 2011-05-19 00:06:34.000000000 -0400
39405+++ linux-2.6.39/drivers/staging/et131x/et131x_adapter.h 2011-05-22 19:36:32.000000000 -0400
39406@@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
8308f9c9
MT		 39407 * operations
39408 */
39409 u32 unircv; /* # multicast packets received */
39410- atomic_t unixmt; /* # multicast packets for Tx */
39411+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
39412 u32 multircv; /* # multicast packets received */
39413- atomic_t multixmt; /* # multicast packets for Tx */
39414+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
39415 u32 brdcstrcv; /* # broadcast packets received */
39416- atomic_t brdcstxmt; /* # broadcast packets for Tx */
39417+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
39418 u32 norcvbuf; /* # Rx packets discarded */
39419 u32 noxmtbuf; /* # Tx packets discarded */
39420
66a7e928
MT		 39421diff -urNp linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
39422--- linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-19 00:06:34.000000000 -0400
39423+++ linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-22 19:36:32.000000000 -0400
16454cff 39424@@ -55,7 +55,7 @@ int numofmsgbuf = 0;
bc901d79
MT		 39425 //
39426 // Table of entry-point routines for char device
39427 //
39428-static struct file_operations ft1000fops =
39429+static const struct file_operations ft1000fops =
39430 {
16454cff
MT		 39431 .unlocked_ioctl = ft1000_ioctl,
39432 .poll = ft1000_poll_dev,
66a7e928
MT		 39433diff -urNp linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c
39434--- linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-19 00:06:34.000000000 -0400
39435+++ linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-22 19:36:32.000000000 -0400
39436@@ -221,7 +221,7 @@ module_param(rio_poll, int, 0);
39437 module_param(rio_debug, int, 0644);
39438 module_param(rio_irqmask, long, 0);
39439
39440-static struct real_driver rio_real_driver = {
39441+static const struct real_driver rio_real_driver = {
39442 rio_disable_tx_interrupts,
39443 rio_enable_tx_interrupts,
39444 rio_disable_rx_interrupts,
39445diff -urNp linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c
39446--- linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c 2011-05-19 00:06:34.000000000 -0400
39447+++ linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c 2011-05-22 19:36:32.000000000 -0400
39448@@ -144,7 +144,7 @@ static int a2232_open(struct tty_struct
39449 /*---------------------------------------------------------------------------
39450 * Interface from generic_serial.c back here
39451 *--------------------------------------------------------------------------*/
39452-static struct real_driver a2232_real_driver = {
39453+static const struct real_driver a2232_real_driver = {
39454 a2232_disable_tx_interrupts,
39455 a2232_enable_tx_interrupts,
39456 a2232_disable_rx_interrupts,
39457diff -urNp linux-2.6.39/drivers/staging/generic_serial/sx.c linux-2.6.39/drivers/staging/generic_serial/sx.c
39458--- linux-2.6.39/drivers/staging/generic_serial/sx.c 2011-05-19 00:06:34.000000000 -0400
39459+++ linux-2.6.39/drivers/staging/generic_serial/sx.c 2011-05-22 19:36:32.000000000 -0400
39460@@ -355,7 +355,7 @@ module_param(sx_irqmask, int, 0);
39461
39462 MODULE_LICENSE("GPL");
39463
39464-static struct real_driver sx_real_driver = {
39465+static const struct real_driver sx_real_driver = {
39466 sx_disable_tx_interrupts,
39467 sx_enable_tx_interrupts,
39468 sx_disable_rx_interrupts,
39469diff -urNp linux-2.6.39/drivers/staging/generic_serial/vme_scc.c linux-2.6.39/drivers/staging/generic_serial/vme_scc.c
39470--- linux-2.6.39/drivers/staging/generic_serial/vme_scc.c 2011-05-19 00:06:34.000000000 -0400
39471+++ linux-2.6.39/drivers/staging/generic_serial/vme_scc.c 2011-05-22 19:36:32.000000000 -0400
39472@@ -94,7 +94,7 @@ static struct scc_port scc_ports[2];
39473 * Interface from generic_serial.c back here
39474 *--------------------------------------------------------------------------*/
39475
39476-static struct real_driver scc_real_driver = {
39477+static const struct real_driver scc_real_driver = {
39478 scc_disable_tx_interrupts,
39479 scc_enable_tx_interrupts,
39480 scc_disable_rx_interrupts,
39481diff -urNp linux-2.6.39/drivers/staging/gma500/psb_fb.c linux-2.6.39/drivers/staging/gma500/psb_fb.c
39482--- linux-2.6.39/drivers/staging/gma500/psb_fb.c 2011-05-19 00:06:34.000000000 -0400
39483+++ linux-2.6.39/drivers/staging/gma500/psb_fb.c 2011-05-22 19:36:32.000000000 -0400
39484@@ -230,7 +230,7 @@ static void psbfb_vm_close(struct vm_are
39485 DRM_DEBUG("vm_close\n");
39486 }
39487
39488-static struct vm_operations_struct psbfb_vm_ops = {
39489+static const struct vm_operations_struct psbfb_vm_ops = {
39490 .fault = psbfb_vm_fault,
39491 .open = psbfb_vm_open,
39492 .close = psbfb_vm_close
39493diff -urNp linux-2.6.39/drivers/staging/go7007/go7007-i2c.c linux-2.6.39/drivers/staging/go7007/go7007-i2c.c
39494--- linux-2.6.39/drivers/staging/go7007/go7007-i2c.c 2011-05-19 00:06:34.000000000 -0400
39495+++ linux-2.6.39/drivers/staging/go7007/go7007-i2c.c 2011-05-22 19:36:32.000000000 -0400
39496@@ -198,7 +198,7 @@ static u32 go7007_functionality(struct i
39497 return I2C_FUNC_SMBUS_BYTE_DATA;
39498 }
39499
39500-static struct i2c_algorithm go7007_algo = {
39501+static const struct i2c_algorithm go7007_algo = {
39502 .smbus_xfer = go7007_smbus_xfer,
39503 .master_xfer = go7007_i2c_master_xfer,
39504 .functionality = go7007_functionality,
39505diff -urNp linux-2.6.39/drivers/staging/go7007/go7007-usb.c linux-2.6.39/drivers/staging/go7007/go7007-usb.c
39506--- linux-2.6.39/drivers/staging/go7007/go7007-usb.c 2011-05-19 00:06:34.000000000 -0400
39507+++ linux-2.6.39/drivers/staging/go7007/go7007-usb.c 2011-05-22 19:36:32.000000000 -0400
39508@@ -849,7 +849,7 @@ static int go7007_usb_send_firmware(stru
39509 &transferred, timeout);
39510 }
39511
39512-static struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39513+static const struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39514 .interface_reset = go7007_usb_interface_reset,
39515 .write_interrupt = go7007_usb_ezusb_write_interrupt,
39516 .read_interrupt = go7007_usb_read_interrupt,
39517@@ -858,7 +858,7 @@ static struct go7007_hpi_ops go7007_usb_
39518 .send_firmware = go7007_usb_send_firmware,
39519 };
39520
39521-static struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39522+static const struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39523 .interface_reset = go7007_usb_interface_reset,
39524 .write_interrupt = go7007_usb_onboard_write_interrupt,
39525 .read_interrupt = go7007_usb_read_interrupt,
39526@@ -950,7 +950,7 @@ static u32 go7007_usb_functionality(stru
39527 return (I2C_FUNC_SMBUS_EMUL) & ~I2C_FUNC_SMBUS_QUICK;
39528 }
39529
39530-static struct i2c_algorithm go7007_usb_algo = {
39531+static const struct i2c_algorithm go7007_usb_algo = {
39532 .master_xfer = go7007_usb_i2c_master_xfer,
39533 .functionality = go7007_usb_functionality,
39534 };
39535diff -urNp linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c
39536--- linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c 2011-05-19 00:06:34.000000000 -0400
39537+++ linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 39538@@ -1672,7 +1672,7 @@ static int go7007_vm_fault(struct vm_are
58c5fc13
MT		 39539 return 0;
39540 }
39541
39542-static struct vm_operations_struct go7007_vm_ops = {
39543+static const struct vm_operations_struct go7007_vm_ops = {
39544 .open = go7007_vm_open,
39545 .close = go7007_vm_close,
39546 .fault = go7007_vm_fault,
66a7e928
MT		 39547diff -urNp linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c
39548--- linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c 2011-05-19 00:06:34.000000000 -0400
39549+++ linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c 2011-05-22 19:36:32.000000000 -0400
39550@@ -421,7 +421,7 @@ static int saa7134_go7007_send_command(s
39551
39552 }
39553
39554-static struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39555+static const struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39556 .interface_reset = saa7134_go7007_interface_reset,
39557 .write_interrupt = saa7134_go7007_write_interrupt,
39558 .read_interrupt = saa7134_go7007_read_interrupt,
39559diff -urNp linux-2.6.39/drivers/staging/go7007/snd-go7007.c linux-2.6.39/drivers/staging/go7007/snd-go7007.c
39560--- linux-2.6.39/drivers/staging/go7007/snd-go7007.c 2011-05-19 00:06:34.000000000 -0400
39561+++ linux-2.6.39/drivers/staging/go7007/snd-go7007.c 2011-05-22 19:36:32.000000000 -0400
39562@@ -204,7 +204,7 @@ static struct page *go7007_snd_pcm_page(
39563 return vmalloc_to_page(substream->runtime->dma_area + offset);
39564 }
39565
39566-static struct snd_pcm_ops go7007_snd_capture_ops = {
39567+static const struct snd_pcm_ops go7007_snd_capture_ops = {
39568 .open = go7007_snd_capture_open,
39569 .close = go7007_snd_capture_close,
39570 .ioctl = snd_pcm_lib_ioctl,
39571@@ -227,7 +227,7 @@ static int go7007_snd_free(struct snd_de
39572 return 0;
39573 }
39574
39575-static struct snd_device_ops go7007_snd_device_ops = {
39576+static const struct snd_device_ops go7007_snd_device_ops = {
39577 .dev_free = go7007_snd_free,
39578 };
39579
39580diff -urNp linux-2.6.39/drivers/staging/hv/channel.c linux-2.6.39/drivers/staging/hv/channel.c
39581--- linux-2.6.39/drivers/staging/hv/channel.c 2011-05-19 00:06:34.000000000 -0400
39582+++ linux-2.6.39/drivers/staging/hv/channel.c 2011-05-22 19:36:32.000000000 -0400
39583@@ -509,8 +509,8 @@ int vmbus_establish_gpadl(struct vmbus_c
8308f9c9
MT		 39584 unsigned long flags;
39585 int ret = 0;
39586
66a7e928
MT		 39587- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
39588- atomic_inc(&vmbus_connection.next_gpadl_handle);
39589+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
39590+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
8308f9c9
MT		 39591
39592 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
39593 if (ret)
66a7e928
MT		 39594diff -urNp linux-2.6.39/drivers/staging/hv/hv.c linux-2.6.39/drivers/staging/hv/hv.c
39595--- linux-2.6.39/drivers/staging/hv/hv.c 2011-05-19 00:06:34.000000000 -0400
39596+++ linux-2.6.39/drivers/staging/hv/hv.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 39597@@ -163,7 +163,7 @@ static u64 do_hypercall(u64 control, voi
39598 u64 output_address = (output) ? virt_to_phys(output) : 0;
39599 u32 output_address_hi = output_address >> 32;
39600 u32 output_address_lo = output_address & 0xFFFFFFFF;
39601- volatile void *hypercall_page = hv_context.hypercall_page;
39602+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
df50ba0c
MT		 39603
39604 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
16454cff 39605 control, input, output);
66a7e928
MT		 39606diff -urNp linux-2.6.39/drivers/staging/hv/rndis_filter.c linux-2.6.39/drivers/staging/hv/rndis_filter.c
39607--- linux-2.6.39/drivers/staging/hv/rndis_filter.c 2011-05-19 00:06:34.000000000 -0400
39608+++ linux-2.6.39/drivers/staging/hv/rndis_filter.c 2011-05-22 19:36:32.000000000 -0400
39609@@ -49,7 +49,7 @@ struct rndis_device {
8308f9c9
MT		 39610
39611 enum rndis_device_state state;
39612 u32 link_stat;
39613- atomic_t new_req_id;
39614+ atomic_unchecked_t new_req_id;
39615
39616 spinlock_t request_lock;
39617 struct list_head req_list;
66a7e928 39618@@ -144,7 +144,7 @@ static struct rndis_request *get_rndis_r
8308f9c9
MT		 39619 * template
39620 */
39621 set = &rndis_msg->msg.set_req;
39622- set->req_id = atomic_inc_return(&dev->new_req_id);
39623+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39624
39625 /* Add to the request list */
39626 spin_lock_irqsave(&dev->request_lock, flags);
66a7e928 39627@@ -709,7 +709,7 @@ static void rndis_filter_halt_device(str
8308f9c9
MT		 39628
39629 /* Setup the rndis set */
39630 halt = &request->request_msg.msg.halt_req;
39631- halt->req_id = atomic_inc_return(&dev->new_req_id);
39632+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39633
39634 /* Ignore return since this msg is optional. */
39635 rndis_filter_send_request(dev, request);
66a7e928
MT		 39636diff -urNp linux-2.6.39/drivers/staging/hv/vmbus_drv.c linux-2.6.39/drivers/staging/hv/vmbus_drv.c
39637--- linux-2.6.39/drivers/staging/hv/vmbus_drv.c 2011-05-19 00:06:34.000000000 -0400
39638+++ linux-2.6.39/drivers/staging/hv/vmbus_drv.c 2011-05-22 19:36:32.000000000 -0400
39639@@ -661,14 +661,14 @@ int vmbus_child_device_register(struct h
39640 {
39641 int ret = 0;
39642
8308f9c9
MT		 39643- static atomic_t device_num = ATOMIC_INIT(0);
39644+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
39645
39646 DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
66a7e928 39647 child_device_obj);
8308f9c9
MT		 39648
39649 /* Set the device name. Otherwise, device_register() will fail. */
66a7e928 39650 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
8308f9c9
MT		 39651- atomic_inc_return(&device_num));
39652+ atomic_inc_return_unchecked(&device_num));
39653
39654 /* The new device belongs to this bus */
66a7e928
MT		 39655 child_device_obj->device.bus = &vmbus_drv.bus; /* device->dev.bus; */
39656diff -urNp linux-2.6.39/drivers/staging/hv/vmbus_private.h linux-2.6.39/drivers/staging/hv/vmbus_private.h
39657--- linux-2.6.39/drivers/staging/hv/vmbus_private.h 2011-05-19 00:06:34.000000000 -0400
39658+++ linux-2.6.39/drivers/staging/hv/vmbus_private.h 2011-05-22 19:36:32.000000000 -0400
39659@@ -58,7 +58,7 @@ enum vmbus_connect_state {
39660 struct vmbus_connection {
39661 enum vmbus_connect_state conn_state;
8308f9c9 39662
66a7e928
MT		 39663- atomic_t next_gpadl_handle;
39664+ atomic_unchecked_t next_gpadl_handle;
8308f9c9
MT		 39665
39666 /*
39667 * Represents channel interrupts. Each bit position represents a
66a7e928
MT		 39668diff -urNp linux-2.6.39/drivers/staging/iio/ring_generic.h linux-2.6.39/drivers/staging/iio/ring_generic.h
39669--- linux-2.6.39/drivers/staging/iio/ring_generic.h 2011-05-19 00:06:34.000000000 -0400
39670+++ linux-2.6.39/drivers/staging/iio/ring_generic.h 2011-05-22 19:36:32.000000000 -0400
39671@@ -134,7 +134,7 @@ struct iio_ring_buffer {
39672 struct iio_handler access_handler;
39673 struct iio_event_interface ev_int;
39674 struct iio_shared_ev_pointer shared_ev_pointer;
39675- struct iio_ring_access_funcs access;
39676+ const struct iio_ring_access_funcs access;
39677 int (*preenable)(struct iio_dev *);
39678 int (*postenable)(struct iio_dev *);
39679 int (*predisable)(struct iio_dev *);
39680diff -urNp linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c
39681--- linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-19 00:06:34.000000000 -0400
39682+++ linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-22 19:36:32.000000000 -0400
39683@@ -494,7 +494,7 @@ static int snd_intelmad_device_set(struc
39684 struct snd_intelmad *intelmaddata;
39685 struct snd_pmic_ops *scard_ops;
39686 int ret_val = 0, vendor, status;
39687- struct intel_sst_pcm_control *pcm_control;
39688+ const struct intel_sst_pcm_control *pcm_control;
39689
39690 pr_debug("snd_intelmad_device_set called\n");
39691
39692diff -urNp linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c
39693--- linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-19 00:06:34.000000000 -0400
39694+++ linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-22 19:36:32.000000000 -0400
39695@@ -470,7 +470,7 @@ int sst_device_control(int cmd, void *ar
39696 }
39697
39698
39699-struct intel_sst_pcm_control pcm_ops = {
39700+const struct intel_sst_pcm_control pcm_ops = {
39701 .open = sst_open_pcm_stream,
39702 .device_control = sst_device_control,
39703 .close = sst_close_pcm_stream,
39704diff -urNp linux-2.6.39/drivers/staging/line6/capture.c linux-2.6.39/drivers/staging/line6/capture.c
39705--- linux-2.6.39/drivers/staging/line6/capture.c 2011-05-19 00:06:34.000000000 -0400
39706+++ linux-2.6.39/drivers/staging/line6/capture.c 2011-05-22 19:36:32.000000000 -0400
39707@@ -378,7 +378,7 @@ snd_line6_capture_pointer(struct snd_pcm
39708 }
39709
39710 /* capture operators */
39711-struct snd_pcm_ops snd_line6_capture_ops = {
39712+const struct snd_pcm_ops snd_line6_capture_ops = {
39713 .open = snd_line6_capture_open,
39714 .close = snd_line6_capture_close,
39715 .ioctl = snd_pcm_lib_ioctl,
39716diff -urNp linux-2.6.39/drivers/staging/line6/capture.h linux-2.6.39/drivers/staging/line6/capture.h
39717--- linux-2.6.39/drivers/staging/line6/capture.h 2011-05-19 00:06:34.000000000 -0400
39718+++ linux-2.6.39/drivers/staging/line6/capture.h 2011-05-22 19:36:32.000000000 -0400
39719@@ -17,7 +17,7 @@
39720 #include "driver.h"
39721 #include "pcm.h"
39722
39723-extern struct snd_pcm_ops snd_line6_capture_ops;
39724+extern const struct snd_pcm_ops snd_line6_capture_ops;
39725
39726 extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
39727 int fsize);
39728diff -urNp linux-2.6.39/drivers/staging/line6/midi.c linux-2.6.39/drivers/staging/line6/midi.c
39729--- linux-2.6.39/drivers/staging/line6/midi.c 2011-05-19 00:06:34.000000000 -0400
39730+++ linux-2.6.39/drivers/staging/line6/midi.c 2011-05-22 19:36:32.000000000 -0400
39731@@ -239,14 +239,14 @@ static void line6_midi_input_trigger(str
39732 line6->line6midi->substream_receive = 0;
39733 }
39734
39735-static struct snd_rawmidi_ops line6_midi_output_ops = {
39736+static const struct snd_rawmidi_ops line6_midi_output_ops = {
39737 .open = line6_midi_output_open,
39738 .close = line6_midi_output_close,
39739 .trigger = line6_midi_output_trigger,
39740 .drain = line6_midi_output_drain,
39741 };
39742
39743-static struct snd_rawmidi_ops line6_midi_input_ops = {
39744+static const struct snd_rawmidi_ops line6_midi_input_ops = {
39745 .open = line6_midi_input_open,
39746 .close = line6_midi_input_close,
39747 .trigger = line6_midi_input_trigger,
39748@@ -373,7 +373,7 @@ static int snd_line6_midi_free(struct sn
39749 */
39750 int line6_init_midi(struct usb_line6 *line6)
39751 {
39752- static struct snd_device_ops midi_ops = {
39753+ static const struct snd_device_ops midi_ops = {
39754 .dev_free = snd_line6_midi_free,
39755 };
39756
39757diff -urNp linux-2.6.39/drivers/staging/line6/pcm.c linux-2.6.39/drivers/staging/line6/pcm.c
39758--- linux-2.6.39/drivers/staging/line6/pcm.c 2011-05-19 00:06:34.000000000 -0400
39759+++ linux-2.6.39/drivers/staging/line6/pcm.c 2011-05-22 19:36:32.000000000 -0400
39760@@ -384,7 +384,7 @@ void line6_pcm_disconnect(struct snd_lin
39761 int line6_init_pcm(struct usb_line6 *line6,
39762 struct line6_pcm_properties *properties)
39763 {
39764- static struct snd_device_ops pcm_ops = {
39765+ static const struct snd_device_ops pcm_ops = {
39766 .dev_free = snd_line6_pcm_free,
39767 };
39768
39769diff -urNp linux-2.6.39/drivers/staging/line6/playback.c linux-2.6.39/drivers/staging/line6/playback.c
39770--- linux-2.6.39/drivers/staging/line6/playback.c 2011-05-19 00:06:34.000000000 -0400
39771+++ linux-2.6.39/drivers/staging/line6/playback.c 2011-05-22 19:36:32.000000000 -0400
39772@@ -536,7 +536,7 @@ snd_line6_playback_pointer(struct snd_pc
39773 }
39774
39775 /* playback operators */
39776-struct snd_pcm_ops snd_line6_playback_ops = {
39777+const struct snd_pcm_ops snd_line6_playback_ops = {
39778 .open = snd_line6_playback_open,
39779 .close = snd_line6_playback_close,
39780 .ioctl = snd_pcm_lib_ioctl,
39781diff -urNp linux-2.6.39/drivers/staging/line6/playback.h linux-2.6.39/drivers/staging/line6/playback.h
39782--- linux-2.6.39/drivers/staging/line6/playback.h 2011-05-19 00:06:34.000000000 -0400
39783+++ linux-2.6.39/drivers/staging/line6/playback.h 2011-05-22 19:36:32.000000000 -0400
39784@@ -27,7 +27,7 @@
39785 */
39786 #define USE_CLEAR_BUFFER_WORKAROUND 1
39787
39788-extern struct snd_pcm_ops snd_line6_playback_ops;
39789+extern const struct snd_pcm_ops snd_line6_playback_ops;
39790
39791 extern int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm);
39792 extern int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm);
39793diff -urNp linux-2.6.39/drivers/staging/msm/staging-devices.c linux-2.6.39/drivers/staging/msm/staging-devices.c
39794--- linux-2.6.39/drivers/staging/msm/staging-devices.c 2011-05-19 00:06:34.000000000 -0400
39795+++ linux-2.6.39/drivers/staging/msm/staging-devices.c 2011-05-22 19:36:32.000000000 -0400
39796@@ -211,7 +211,7 @@ static int msm_fb_lcdc_gpio_config(int o
39797 }
39798
39799
39800-static struct lcdc_platform_data lcdc_pdata = {
39801+static const struct lcdc_platform_data lcdc_pdata = {
39802 .lcdc_gpio_config = msm_fb_lcdc_gpio_config,
39803 };
39804
39805diff -urNp linux-2.6.39/drivers/staging/octeon/ethernet.c linux-2.6.39/drivers/staging/octeon/ethernet.c
39806--- linux-2.6.39/drivers/staging/octeon/ethernet.c 2011-05-19 00:06:34.000000000 -0400
39807+++ linux-2.6.39/drivers/staging/octeon/ethernet.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39808@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
39809 * since the RX tasklet also increments it.
39810 */
39811 #ifdef CONFIG_64BIT
39812- atomic64_add(rx_status.dropped_packets,
39813- (atomic64_t *)&priv->stats.rx_dropped);
39814+ atomic64_add_unchecked(rx_status.dropped_packets,
39815+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39816 #else
39817- atomic_add(rx_status.dropped_packets,
39818- (atomic_t *)&priv->stats.rx_dropped);
39819+ atomic_add_unchecked(rx_status.dropped_packets,
39820+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
39821 #endif
39822 }
39823
66a7e928
MT		 39824diff -urNp linux-2.6.39/drivers/staging/octeon/ethernet-rx.c linux-2.6.39/drivers/staging/octeon/ethernet-rx.c
39825--- linux-2.6.39/drivers/staging/octeon/ethernet-rx.c 2011-05-19 00:06:34.000000000 -0400
39826+++ linux-2.6.39/drivers/staging/octeon/ethernet-rx.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39827@@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
39828 /* Increment RX stats for virtual ports */
39829 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
39830 #ifdef CONFIG_64BIT
39831- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
39832- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
39833+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
39834+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
39835 #else
39836- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
39837- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
39838+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
39839+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
39840 #endif
39841 }
39842 netif_receive_skb(skb);
39843@@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
39844 dev->name);
39845 */
39846 #ifdef CONFIG_64BIT
39847- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
39848+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39849 #else
39850- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
39851+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
39852 #endif
39853 dev_kfree_skb_irq(skb);
39854 }
66a7e928
MT		 39855diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c
39856--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-19 00:06:34.000000000 -0400
39857+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-22 19:36:32.000000000 -0400
39858@@ -43,7 +43,7 @@ module_param(noinit, int, 0444);
39859 static int useaa = 1;
39860 module_param(useaa, int, 0444);
39861
39862-static struct dcon_platform_data *pdata;
39863+static const struct dcon_platform_data *pdata;
39864
39865 /* I2C structures */
39866
39867diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h
39868--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-19 00:06:34.000000000 -0400
39869+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-22 19:36:32.000000000 -0400
39870@@ -92,11 +92,11 @@ struct dcon_platform_data {
39871 extern irqreturn_t dcon_interrupt(int irq, void *id);
39872
39873 #ifdef CONFIG_FB_OLPC_DCON_1
39874-extern struct dcon_platform_data dcon_pdata_xo_1;
39875+extern const struct dcon_platform_data dcon_pdata_xo_1;
39876 #endif
39877
39878 #ifdef CONFIG_FB_OLPC_DCON_1_5
39879-extern struct dcon_platform_data dcon_pdata_xo_1_5;
39880+extern const struct dcon_platform_data dcon_pdata_xo_1_5;
39881 #endif
39882
39883 #endif
39884diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c
39885--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-19 00:06:34.000000000 -0400
39886+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-22 19:36:32.000000000 -0400
39887@@ -185,7 +185,7 @@ static u8 dcon_read_status_xo_1_5(void)
39888 return status;
39889 }
39890
39891-struct dcon_platform_data dcon_pdata_xo_1_5 = {
39892+const struct dcon_platform_data dcon_pdata_xo_1_5 = {
39893 .init = dcon_init_xo_1_5,
39894 .bus_stabilize_wiggle = dcon_wiggle_xo_1_5,
39895 .set_dconload = dcon_set_dconload_xo_1_5,
39896diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
39897--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-19 00:06:34.000000000 -0400
39898+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-22 19:36:32.000000000 -0400
39899@@ -196,7 +196,7 @@ static u8 dcon_read_status_xo_1(void)
39900 return status;
39901 }
39902
39903-struct dcon_platform_data dcon_pdata_xo_1 = {
39904+const struct dcon_platform_data dcon_pdata_xo_1 = {
39905 .init = dcon_init_xo_1,
39906 .bus_stabilize_wiggle = dcon_wiggle_xo_1,
39907 .set_dconload = dcon_set_dconload_1,
39908diff -urNp linux-2.6.39/drivers/staging/phison/phison.c linux-2.6.39/drivers/staging/phison/phison.c
39909--- linux-2.6.39/drivers/staging/phison/phison.c 2011-05-19 00:06:34.000000000 -0400
39910+++ linux-2.6.39/drivers/staging/phison/phison.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 39911@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
39912 ATA_BMDMA_SHT(DRV_NAME),
39913 };
39914
39915-static struct ata_port_operations phison_ops = {
39916+static const struct ata_port_operations phison_ops = {
39917 .inherits = &ata_bmdma_port_ops,
39918 .prereset = phison_pre_reset,
39919 };
66a7e928
MT		 39920diff -urNp linux-2.6.39/drivers/staging/pohmelfs/inode.c linux-2.6.39/drivers/staging/pohmelfs/inode.c
39921--- linux-2.6.39/drivers/staging/pohmelfs/inode.c 2011-05-19 00:06:34.000000000 -0400
39922+++ linux-2.6.39/drivers/staging/pohmelfs/inode.c 2011-05-22 19:36:32.000000000 -0400
16454cff 39923@@ -1855,7 +1855,7 @@ static int pohmelfs_fill_super(struct su
ae4e228f
MT		 39924 mutex_init(&psb->mcache_lock);
39925 psb->mcache_root = RB_ROOT;
39926 psb->mcache_timeout = msecs_to_jiffies(5000);
39927- atomic_long_set(&psb->mcache_gen, 0);
39928+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
39929
39930 psb->trans_max_pages = 100;
39931
8308f9c9
MT		 39932@@ -1870,7 +1870,7 @@ static int pohmelfs_fill_super(struct su
39933 INIT_LIST_HEAD(&psb->crypto_ready_list);
39934 INIT_LIST_HEAD(&psb->crypto_active_list);
39935
39936- atomic_set(&psb->trans_gen, 1);
39937+ atomic_set_unchecked(&psb->trans_gen, 1);
39938 atomic_long_set(&psb->total_inodes, 0);
39939
39940 mutex_init(&psb->state_lock);
66a7e928
MT		 39941diff -urNp linux-2.6.39/drivers/staging/pohmelfs/mcache.c linux-2.6.39/drivers/staging/pohmelfs/mcache.c
39942--- linux-2.6.39/drivers/staging/pohmelfs/mcache.c 2011-05-19 00:06:34.000000000 -0400
39943+++ linux-2.6.39/drivers/staging/pohmelfs/mcache.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 39944@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
39945 m->data = data;
39946 m->start = start;
39947 m->size = size;
39948- m->gen = atomic_long_inc_return(&psb->mcache_gen);
39949+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
39950
39951 mutex_lock(&psb->mcache_lock);
39952 err = pohmelfs_mcache_insert(psb, m);
66a7e928
MT		 39953diff -urNp linux-2.6.39/drivers/staging/pohmelfs/netfs.h linux-2.6.39/drivers/staging/pohmelfs/netfs.h
39954--- linux-2.6.39/drivers/staging/pohmelfs/netfs.h 2011-05-19 00:06:34.000000000 -0400
39955+++ linux-2.6.39/drivers/staging/pohmelfs/netfs.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9 39956@@ -571,14 +571,14 @@ struct pohmelfs_config;
ae4e228f
MT		 39957 struct pohmelfs_sb {
39958 struct rb_root mcache_root;
39959 struct mutex mcache_lock;
39960- atomic_long_t mcache_gen;
39961+ atomic_long_unchecked_t mcache_gen;
39962 unsigned long mcache_timeout;
39963
39964 unsigned int idx;
8308f9c9
MT		 39965
39966 unsigned int trans_retries;
39967
39968- atomic_t trans_gen;
39969+ atomic_unchecked_t trans_gen;
39970
39971 unsigned int crypto_attached_size;
39972 unsigned int crypto_align_size;
66a7e928
MT		 39973diff -urNp linux-2.6.39/drivers/staging/pohmelfs/trans.c linux-2.6.39/drivers/staging/pohmelfs/trans.c
39974--- linux-2.6.39/drivers/staging/pohmelfs/trans.c 2011-05-19 00:06:34.000000000 -0400
39975+++ linux-2.6.39/drivers/staging/pohmelfs/trans.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 39976@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
39977 int err;
39978 struct netfs_cmd *cmd = t->iovec.iov_base;
39979
39980- t->gen = atomic_inc_return(&psb->trans_gen);
39981+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
39982
39983 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
39984 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
66a7e928
MT		 39985diff -urNp linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c
39986--- linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-19 00:06:34.000000000 -0400
39987+++ linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-22 19:36:32.000000000 -0400
39988@@ -87,7 +87,7 @@ static int c_show(struct seq_file *m, vo
39989 return 0;
39990 }
39991
39992-static struct seq_operations crypto_seq_ops = {
39993+static const struct seq_operations crypto_seq_ops = {
39994 .start = c_start,
39995 .next = c_next,
39996 .stop = c_stop,
58c5fc13
MT		 39997@@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
39998 return seq_open(file, &crypto_seq_ops);
39999 }
40000
40001-static struct file_operations proc_crypto_ops = {
40002+static const struct file_operations proc_crypto_ops = {
40003 .open = crypto_info_open,
40004 .read = seq_read,
40005 .llseek = seq_lseek,
66a7e928
MT		 40006diff -urNp linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h
40007--- linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h 2011-05-19 00:06:34.000000000 -0400
40008+++ linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h 2011-05-22 19:36:32.000000000 -0400
40009@@ -107,7 +107,7 @@ struct intf_hdl {
40010 void (*intf_hdl_unload)(u8 *priv);
40011 void (*intf_hdl_open)(u8 *priv);
40012 void (*intf_hdl_close)(u8 *priv);
40013- struct _io_ops io_ops;
40014+ const struct _io_ops io_ops;
40015 };
40016
40017 struct reg_protocol_rd {
40018diff -urNp linux-2.6.39/drivers/staging/solo6x10/g723.c linux-2.6.39/drivers/staging/solo6x10/g723.c
40019--- linux-2.6.39/drivers/staging/solo6x10/g723.c 2011-05-19 00:06:34.000000000 -0400
40020+++ linux-2.6.39/drivers/staging/solo6x10/g723.c 2011-05-22 19:36:32.000000000 -0400
40021@@ -237,7 +237,7 @@ static int snd_solo_pcm_copy(struct snd_
40022 return 0;
40023 }
40024
40025-static struct snd_pcm_ops snd_solo_pcm_ops = {
40026+static const struct snd_pcm_ops snd_solo_pcm_ops = {
40027 .open = snd_solo_pcm_open,
40028 .close = snd_solo_pcm_close,
40029 .ioctl = snd_pcm_lib_ioctl,
40030@@ -334,7 +334,7 @@ static int solo_snd_pcm_init(struct solo
40031
40032 int solo_g723_init(struct solo_dev *solo_dev)
40033 {
40034- static struct snd_device_ops ops = { NULL };
40035+ static const struct snd_device_ops ops = { NULL };
40036 struct snd_card *card;
40037 struct snd_kcontrol_new kctl;
40038 char name[32];
40039diff -urNp linux-2.6.39/drivers/staging/spectra/ffsport.c linux-2.6.39/drivers/staging/spectra/ffsport.c
40040--- linux-2.6.39/drivers/staging/spectra/ffsport.c 2011-05-19 00:06:34.000000000 -0400
40041+++ linux-2.6.39/drivers/staging/spectra/ffsport.c 2011-05-22 19:36:32.000000000 -0400
16454cff 40042@@ -604,7 +604,7 @@ int GLOB_SBD_unlocked_ioctl(struct block
6892158b
MT		 40043 return ret;
40044 }
ae4e228f 40045
6892158b
MT		 40046-static struct block_device_operations GLOB_SBD_ops = {
40047+static const struct block_device_operations GLOB_SBD_ops = {
ae4e228f 40048 .owner = THIS_MODULE,
6892158b
MT		 40049 .open = GLOB_SBD_open,
40050 .release = GLOB_SBD_release,
66a7e928
MT		 40051diff -urNp linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c
40052--- linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c 2011-05-19 00:06:34.000000000 -0400
40053+++ linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c 2011-05-22 19:36:32.000000000 -0400
40054@@ -380,7 +380,7 @@ static snd_pcm_uframes_t snd_tm6000_poin
40055 /*
40056 * operators
40057 */
40058-static struct snd_pcm_ops snd_tm6000_pcm_ops = {
40059+static const struct snd_pcm_ops snd_tm6000_pcm_ops = {
40060 .open = snd_tm6000_pcm_open,
40061 .close = snd_tm6000_close,
40062 .ioctl = snd_pcm_lib_ioctl,
40063diff -urNp linux-2.6.39/drivers/staging/tty/istallion.c linux-2.6.39/drivers/staging/tty/istallion.c
40064--- linux-2.6.39/drivers/staging/tty/istallion.c 2011-05-19 00:06:34.000000000 -0400
40065+++ linux-2.6.39/drivers/staging/tty/istallion.c 2011-05-22 20:49:07.000000000 -0400
40066@@ -186,7 +186,6 @@ static struct ktermios stli_deftermios
40067 * re-used for each stats call.
40068 */
40069 static comstats_t stli_comstats;
40070-static combrd_t stli_brdstats;
40071 static struct asystats stli_cdkstats;
40072
40073 /*****************************************************************************/
40074@@ -4003,6 +4002,7 @@ out:
40075
40076 static int stli_getbrdstats(combrd_t __user *bp)
40077 {
40078+ combrd_t stli_brdstats;
40079 struct stlibrd *brdp;
40080 unsigned int i;
40081
40082@@ -4226,6 +4226,8 @@ static int stli_getportstruct(struct stl
40083 struct stliport stli_dummyport;
40084 struct stliport *portp;
40085
40086+ pax_track_stack();
40087+
40088 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
40089 return -EFAULT;
40090 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
40091@@ -4248,6 +4250,8 @@ static int stli_getbrdstruct(struct stli
40092 struct stlibrd stli_dummybrd;
40093 struct stlibrd *brdp;
40094
40095+ pax_track_stack();
40096+
40097 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
40098 return -EFAULT;
40099 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
40100diff -urNp linux-2.6.39/drivers/staging/tty/stallion.c linux-2.6.39/drivers/staging/tty/stallion.c
40101--- linux-2.6.39/drivers/staging/tty/stallion.c 2011-05-19 00:06:34.000000000 -0400
40102+++ linux-2.6.39/drivers/staging/tty/stallion.c 2011-05-22 19:36:32.000000000 -0400
40103@@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
40104 struct stlport stl_dummyport;
40105 struct stlport *portp;
40106
40107+ pax_track_stack();
40108+
40109 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
40110 return -EFAULT;
40111 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
40112diff -urNp linux-2.6.39/drivers/staging/usbip/vhci.h linux-2.6.39/drivers/staging/usbip/vhci.h
40113--- linux-2.6.39/drivers/staging/usbip/vhci.h 2011-05-19 00:06:34.000000000 -0400
40114+++ linux-2.6.39/drivers/staging/usbip/vhci.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 40115@@ -92,7 +92,7 @@ struct vhci_hcd {
40116 unsigned resuming:1;
40117 unsigned long re_timeout;
40118
40119- atomic_t seqnum;
40120+ atomic_unchecked_t seqnum;
40121
40122 /*
40123 * NOTE:
66a7e928
MT		 40124diff -urNp linux-2.6.39/drivers/staging/usbip/vhci_hcd.c linux-2.6.39/drivers/staging/usbip/vhci_hcd.c
40125--- linux-2.6.39/drivers/staging/usbip/vhci_hcd.c 2011-05-19 00:06:34.000000000 -0400
40126+++ linux-2.6.39/drivers/staging/usbip/vhci_hcd.c 2011-05-22 19:36:32.000000000 -0400
40127@@ -536,7 +536,7 @@ static void vhci_tx_urb(struct urb *urb)
8308f9c9
MT		 40128 return;
40129 }
40130
40131- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
40132+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40133 if (priv->seqnum == 0xffff)
40134 usbip_uinfo("seqnum max\n");
40135
66a7e928 40136@@ -795,7 +795,7 @@ static int vhci_urb_dequeue(struct usb_h
8308f9c9
MT		 40137 return -ENOMEM;
40138 }
40139
40140- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
40141+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40142 if (unlink->seqnum == 0xffff)
40143 usbip_uinfo("seqnum max\n");
40144
66a7e928 40145@@ -992,7 +992,7 @@ static int vhci_start(struct usb_hcd *hc
8308f9c9
MT		 40146 vdev->rhport = rhport;
40147 }
40148
40149- atomic_set(&vhci->seqnum, 0);
40150+ atomic_set_unchecked(&vhci->seqnum, 0);
40151 spin_lock_init(&vhci->lock);
40152
40153
66a7e928
MT		 40154diff -urNp linux-2.6.39/drivers/staging/usbip/vhci_rx.c linux-2.6.39/drivers/staging/usbip/vhci_rx.c
40155--- linux-2.6.39/drivers/staging/usbip/vhci_rx.c 2011-05-19 00:06:34.000000000 -0400
40156+++ linux-2.6.39/drivers/staging/usbip/vhci_rx.c 2011-05-22 19:36:32.000000000 -0400
40157@@ -81,7 +81,7 @@ static void vhci_recv_ret_submit(struct
8308f9c9
MT		 40158 usbip_uerr("cannot find a urb of seqnum %u\n",
40159 pdu->base.seqnum);
40160 usbip_uinfo("max seqnum %d\n",
40161- atomic_read(&the_controller->seqnum));
40162+ atomic_read_unchecked(&the_controller->seqnum));
40163 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
40164 return;
40165 }
66a7e928
MT		 40166diff -urNp linux-2.6.39/drivers/staging/vme/devices/vme_user.c linux-2.6.39/drivers/staging/vme/devices/vme_user.c
40167--- linux-2.6.39/drivers/staging/vme/devices/vme_user.c 2011-05-19 00:06:34.000000000 -0400
40168+++ linux-2.6.39/drivers/staging/vme/devices/vme_user.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 40169@@ -138,7 +138,7 @@ static long vme_user_unlocked_ioctl(stru
40170 static int __devinit vme_user_probe(struct device *, int, int);
40171 static int __devexit vme_user_remove(struct device *, int, int);
ae4e228f
MT		 40172
40173-static struct file_operations vme_user_fops = {
40174+static const struct file_operations vme_user_fops = {
6892158b
MT		 40175 .open = vme_user_open,
40176 .release = vme_user_release,
40177 .read = vme_user_read,
66a7e928
MT		 40178diff -urNp linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
40179--- linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-19 00:06:34.000000000 -0400
40180+++ linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-22 19:36:32.000000000 -0400
bc901d79
MT		 40181@@ -426,7 +426,7 @@ int cyasblkdev_revalidate_disk(struct ge
40182
40183
40184 /*standard block device driver interface */
40185-static struct block_device_operations cyasblkdev_bdops = {
40186+static const struct block_device_operations cyasblkdev_bdops = {
40187 .open = cyasblkdev_blk_open,
40188 .release = cyasblkdev_blk_release,
40189 .ioctl = cyasblkdev_blk_ioctl,
66a7e928
MT		 40190diff -urNp linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c
40191--- linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-19 00:06:34.000000000 -0400
40192+++ linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-22 19:36:32.000000000 -0400
40193@@ -474,7 +474,7 @@ static void wl_get_drvinfo(struct net_de
40194 }
40195 } // wl_get_drvinfo
40196
40197-static struct ethtool_ops wl_ethtool_ops = {
40198+static const struct ethtool_ops wl_ethtool_ops = {
40199 .get_drvinfo = wl_get_drvinfo,
40200 .get_link = ethtool_op_get_link,
40201 };
40202diff -urNp linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c
40203--- linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-19 00:06:34.000000000 -0400
40204+++ linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-22 19:36:32.000000000 -0400
40205@@ -671,7 +671,7 @@ struct usbctlx_cmd_completor {
40206 hfa384x_cmdresult_t *result;
40207 };
40208
40209-static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
40210+static inline int usbctlx_cmd_completor_fn(const struct usbctlx_completor *head)
40211 {
40212 struct usbctlx_cmd_completor *complete;
40213
40214@@ -705,7 +705,7 @@ struct usbctlx_rrid_completor {
40215 unsigned int riddatalen;
40216 };
40217
40218-static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
40219+static int usbctlx_rrid_completor_fn(const struct usbctlx_completor *head)
40220 {
40221 struct usbctlx_rrid_completor *complete;
40222 hfa384x_rridresult_t rridresult;
40223@@ -768,7 +768,7 @@ struct usbctlx_rmem_completor {
40224 };
40225 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
40226
40227-static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
40228+static int usbctlx_rmem_completor_fn(const struct usbctlx_completor *head)
40229 {
40230 usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t *) head;
40231
40232diff -urNp linux-2.6.39/drivers/staging/zcache/tmem.c linux-2.6.39/drivers/staging/zcache/tmem.c
40233--- linux-2.6.39/drivers/staging/zcache/tmem.c 2011-05-19 00:06:34.000000000 -0400
40234+++ linux-2.6.39/drivers/staging/zcache/tmem.c 2011-05-22 19:36:32.000000000 -0400
40235@@ -39,7 +39,7 @@
40236 * A tmem host implementation must use this function to register callbacks
40237 * for memory allocation.
40238 */
40239-static struct tmem_hostops tmem_hostops;
40240+static const struct tmem_hostops tmem_hostops;
40241
40242 static void tmem_objnode_tree_init(void);
40243
40244@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
40245 * A tmem host implementation must use this function to register
40246 * callbacks for a page-accessible memory (PAM) implementation
40247 */
40248-static struct tmem_pamops tmem_pamops;
40249+static const struct tmem_pamops tmem_pamops;
40250
40251 void tmem_register_pamops(struct tmem_pamops *m)
40252 {
40253diff -urNp linux-2.6.39/drivers/staging/zcache/zcache.c linux-2.6.39/drivers/staging/zcache/zcache.c
40254--- linux-2.6.39/drivers/staging/zcache/zcache.c 2011-05-19 00:06:34.000000000 -0400
40255+++ linux-2.6.39/drivers/staging/zcache/zcache.c 2011-05-22 19:36:32.000000000 -0400
40256@@ -882,7 +882,7 @@ static void zcache_obj_free(struct tmem_
40257 kmem_cache_free(zcache_obj_cache, obj);
40258 }
40259
40260-static struct tmem_hostops zcache_hostops = {
40261+static const struct tmem_hostops zcache_hostops = {
40262 .obj_alloc = zcache_obj_alloc,
40263 .obj_free = zcache_obj_free,
40264 .objnode_alloc = zcache_objnode_alloc,
40265@@ -987,7 +987,7 @@ static void zcache_pampd_free(void *pamp
40266 }
40267 }
40268
40269-static struct tmem_pamops zcache_pamops = {
40270+static const struct tmem_pamops zcache_pamops = {
40271 .create = zcache_pampd_create,
40272 .get_data = zcache_pampd_get_data,
40273 .free = zcache_pampd_free,
40274diff -urNp linux-2.6.39/drivers/target/target_core_alua.c linux-2.6.39/drivers/target/target_core_alua.c
40275--- linux-2.6.39/drivers/target/target_core_alua.c 2011-05-19 00:06:34.000000000 -0400
40276+++ linux-2.6.39/drivers/target/target_core_alua.c 2011-05-22 19:36:32.000000000 -0400
40277@@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
40278 char path[ALUA_METADATA_PATH_LEN];
40279 int len;
40280
40281+ pax_track_stack();
40282+
40283 memset(path, 0, ALUA_METADATA_PATH_LEN);
40284
40285 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
40286@@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
40287 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
40288 int len;
40289
40290+ pax_track_stack();
40291+
40292 memset(path, 0, ALUA_METADATA_PATH_LEN);
40293 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
40294
40295diff -urNp linux-2.6.39/drivers/target/target_core_cdb.c linux-2.6.39/drivers/target/target_core_cdb.c
40296--- linux-2.6.39/drivers/target/target_core_cdb.c 2011-05-19 00:06:34.000000000 -0400
40297+++ linux-2.6.39/drivers/target/target_core_cdb.c 2011-05-22 19:36:32.000000000 -0400
40298@@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
40299 int length = 0;
40300 unsigned char buf[SE_MODE_PAGE_BUF];
40301
40302+ pax_track_stack();
40303+
40304 memset(buf, 0, SE_MODE_PAGE_BUF);
40305
40306 switch (cdb[2] & 0x3f) {
40307diff -urNp linux-2.6.39/drivers/target/target_core_configfs.c linux-2.6.39/drivers/target/target_core_configfs.c
40308--- linux-2.6.39/drivers/target/target_core_configfs.c 2011-05-19 00:06:34.000000000 -0400
40309+++ linux-2.6.39/drivers/target/target_core_configfs.c 2011-05-22 19:36:32.000000000 -0400
40310@@ -1280,6 +1280,8 @@ static ssize_t target_core_dev_pr_show_a
40311 ssize_t len = 0;
40312 int reg_count = 0, prf_isid;
40313
40314+ pax_track_stack();
40315+
40316 if (!(su_dev->se_dev_ptr))
40317 return -ENODEV;
40318
40319@@ -2682,7 +2684,7 @@ static void target_core_alua_drop_tg_pt_
40320 config_item_put(item);
40321 }
40322
40323-static struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40324+static const struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40325 .make_group = &target_core_alua_create_tg_pt_gp,
40326 .drop_item = &target_core_alua_drop_tg_pt_gp,
40327 };
40328@@ -2726,7 +2728,7 @@ static void target_core_stat_rmdir(
40329 return;
40330 }
40331
40332-static struct configfs_group_operations target_core_stat_group_ops = {
40333+static const struct configfs_group_operations target_core_stat_group_ops = {
40334 .make_group = &target_core_stat_mkdir,
40335 .drop_item = &target_core_stat_rmdir,
40336 };
40337@@ -2939,7 +2941,7 @@ static void target_core_drop_subdev(
40338 mutex_unlock(&hba->hba_access_mutex);
40339 }
40340
40341-static struct configfs_group_operations target_core_hba_group_ops = {
40342+static const struct configfs_group_operations target_core_hba_group_ops = {
40343 .make_group = target_core_make_subdev,
40344 .drop_item = target_core_drop_subdev,
40345 };
40346@@ -3117,7 +3119,7 @@ static void target_core_call_delhbafromt
40347 config_item_put(item);
40348 }
40349
40350-static struct configfs_group_operations target_core_group_ops = {
40351+static const struct configfs_group_operations target_core_group_ops = {
40352 .make_group = target_core_call_addhbatotarget,
40353 .drop_item = target_core_call_delhbafromtarget,
40354 };
40355diff -urNp linux-2.6.39/drivers/target/target_core_fabric_configfs.c linux-2.6.39/drivers/target/target_core_fabric_configfs.c
40356--- linux-2.6.39/drivers/target/target_core_fabric_configfs.c 2011-05-19 00:06:34.000000000 -0400
40357+++ linux-2.6.39/drivers/target/target_core_fabric_configfs.c 2011-05-22 19:36:32.000000000 -0400
40358@@ -1174,7 +1174,7 @@ static void target_fabric_drop_wwn(
40359 config_item_put(item);
40360 }
40361
40362-static struct configfs_group_operations target_fabric_wwn_group_ops = {
40363+static const struct configfs_group_operations target_fabric_wwn_group_ops = {
40364 .make_group = target_fabric_make_wwn,
40365 .drop_item = target_fabric_drop_wwn,
40366 };
40367diff -urNp linux-2.6.39/drivers/target/target_core_pr.c linux-2.6.39/drivers/target/target_core_pr.c
40368--- linux-2.6.39/drivers/target/target_core_pr.c 2011-05-19 00:06:34.000000000 -0400
40369+++ linux-2.6.39/drivers/target/target_core_pr.c 2011-05-22 19:36:32.000000000 -0400
40370@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
40371 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
40372 u16 tpgt;
40373
40374+ pax_track_stack();
40375+
40376 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
40377 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
40378 /*
40379@@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
40380 ssize_t len = 0;
40381 int reg_count = 0;
40382
40383+ pax_track_stack();
40384+
40385 memset(buf, 0, pr_aptpl_buf_len);
40386 /*
40387 * Called to clear metadata once APTPL has been deactivated.
40388@@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
40389 char path[512];
40390 int ret;
40391
40392+ pax_track_stack();
40393+
40394 memset(iov, 0, sizeof(struct iovec));
40395 memset(path, 0, 512);
40396
40397diff -urNp linux-2.6.39/drivers/target/target_core_tmr.c linux-2.6.39/drivers/target/target_core_tmr.c
40398--- linux-2.6.39/drivers/target/target_core_tmr.c 2011-05-19 00:06:34.000000000 -0400
40399+++ linux-2.6.39/drivers/target/target_core_tmr.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 40400@@ -262,7 +262,7 @@ int core_tmr_lun_reset(
40401 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
40402 T_TASK(cmd)->t_task_cdbs,
40403 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40404- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40405+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40406 atomic_read(&T_TASK(cmd)->t_transport_active),
40407 atomic_read(&T_TASK(cmd)->t_transport_stop),
40408 atomic_read(&T_TASK(cmd)->t_transport_sent));
40409@@ -304,7 +304,7 @@ int core_tmr_lun_reset(
40410 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
40411 " task: %p, t_fe_count: %d dev: %p\n", task,
40412 fe_count, dev);
40413- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40414+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40415 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
40416 flags);
40417 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40418@@ -314,7 +314,7 @@ int core_tmr_lun_reset(
40419 }
40420 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
40421 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
40422- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40423+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40424 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
40425 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40426
66a7e928
MT		 40427diff -urNp linux-2.6.39/drivers/target/target_core_transport.c linux-2.6.39/drivers/target/target_core_transport.c
40428--- linux-2.6.39/drivers/target/target_core_transport.c 2011-05-19 00:06:34.000000000 -0400
40429+++ linux-2.6.39/drivers/target/target_core_transport.c 2011-05-22 19:36:32.000000000 -0400
40430@@ -1675,7 +1675,7 @@ struct se_device *transport_add_device_t
8308f9c9
MT		 40431
40432 dev->queue_depth = dev_limits->queue_depth;
40433 atomic_set(&dev->depth_left, dev->queue_depth);
40434- atomic_set(&dev->dev_ordered_id, 0);
40435+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
40436
40437 se_dev_set_default_attribs(dev, dev_limits);
40438
66a7e928 40439@@ -1876,7 +1876,7 @@ static int transport_check_alloc_task_at
8308f9c9
MT		 40440 * Used to determine when ORDERED commands should go from
40441 * Dormant to Active status.
40442 */
40443- cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
40444+ cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
40445 smp_mb__after_atomic_inc();
40446 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
40447 cmd->se_ordered_id, cmd->sam_task_attr,
66a7e928 40448@@ -2156,7 +2156,7 @@ static void transport_generic_request_fa
8308f9c9
MT		 40449 " t_transport_active: %d t_transport_stop: %d"
40450 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
40451 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40452- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40453+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40454 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
40455 atomic_read(&T_TASK(cmd)->t_transport_active),
40456 atomic_read(&T_TASK(cmd)->t_transport_stop),
66a7e928 40457@@ -2660,9 +2660,9 @@ check_depth:
8308f9c9
MT		 40458 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
40459 atomic_set(&task->task_active, 1);
40460 atomic_set(&task->task_sent, 1);
40461- atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
40462+ atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
40463
40464- if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
40465+ if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
40466 T_TASK(cmd)->t_task_cdbs)
40467 atomic_set(&cmd->transport_sent, 1);
40468
66a7e928 40469@@ -5549,7 +5549,7 @@ static void transport_generic_wait_for_t
8308f9c9
MT		 40470 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
40471 }
40472 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
40473- atomic_read(&T_TASK(cmd)->t_transport_aborted))
40474+ atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
40475 goto remove;
40476
40477 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
66a7e928 40478@@ -5778,7 +5778,7 @@ int transport_check_aborted_status(struc
8308f9c9
MT		 40479 {
40480 int ret = 0;
40481
40482- if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
40483+ if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
40484 if (!(send_status) ||
40485 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
40486 return 1;
66a7e928 40487@@ -5806,7 +5806,7 @@ void transport_send_task_abort(struct se
8308f9c9
MT		 40488 */
40489 if (cmd->data_direction == DMA_TO_DEVICE) {
40490 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
40491- atomic_inc(&T_TASK(cmd)->t_transport_aborted);
40492+ atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
40493 smp_mb__after_atomic_inc();
40494 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
40495 transport_new_cmd_failure(cmd);
66a7e928 40496@@ -5930,7 +5930,7 @@ static void transport_processing_shutdow
8308f9c9
MT		 40497 CMD_TFO(cmd)->get_task_tag(cmd),
40498 T_TASK(cmd)->t_task_cdbs,
40499 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40500- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40501+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40502 atomic_read(&T_TASK(cmd)->t_transport_active),
40503 atomic_read(&T_TASK(cmd)->t_transport_stop),
40504 atomic_read(&T_TASK(cmd)->t_transport_sent));
66a7e928
MT		 40505diff -urNp linux-2.6.39/drivers/telephony/ixj.c linux-2.6.39/drivers/telephony/ixj.c
40506--- linux-2.6.39/drivers/telephony/ixj.c 2011-05-19 00:06:34.000000000 -0400
40507+++ linux-2.6.39/drivers/telephony/ixj.c 2011-05-22 19:36:32.000000000 -0400
40508@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
40509 bool mContinue;
40510 char *pIn, *pOut;
40511
40512+ pax_track_stack();
40513+
40514 if (!SCI_Prepare(j))
40515 return 0;
40516
40517diff -urNp linux-2.6.39/drivers/tty/hvc/hvc_console.h linux-2.6.39/drivers/tty/hvc/hvc_console.h
40518--- linux-2.6.39/drivers/tty/hvc/hvc_console.h 2011-05-19 00:06:34.000000000 -0400
40519+++ linux-2.6.39/drivers/tty/hvc/hvc_console.h 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 40520@@ -82,6 +82,7 @@ extern int hvc_instantiate(uint32_t vter
40521 /* register a vterm for hvc tty operation (module_init or hotplug add) */
40522 extern struct hvc_struct * hvc_alloc(uint32_t vtermno, int data,
40523 const struct hv_ops *ops, int outbuf_size);
40524+
40525 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
40526 extern int hvc_remove(struct hvc_struct *hp);
40527
66a7e928
MT		 40528diff -urNp linux-2.6.39/drivers/tty/hvc/hvc_iucv.c linux-2.6.39/drivers/tty/hvc/hvc_iucv.c
40529--- linux-2.6.39/drivers/tty/hvc/hvc_iucv.c 2011-05-19 00:06:34.000000000 -0400
40530+++ linux-2.6.39/drivers/tty/hvc/hvc_iucv.c 2011-05-22 19:36:32.000000000 -0400
40531@@ -1203,7 +1203,7 @@ static int param_get_vmidfilter(char *bu
40532
40533 #define param_check_vmidfilter(name, p) __param_check(name, p, void)
40534
40535-static struct kernel_param_ops param_ops_vmidfilter = {
40536+static const struct kernel_param_ops param_ops_vmidfilter = {
40537 .set = param_set_vmidfilter,
40538 .get = param_get_vmidfilter,
40539 };
40540diff -urNp linux-2.6.39/drivers/tty/hvc/hvcs.c linux-2.6.39/drivers/tty/hvc/hvcs.c
40541--- linux-2.6.39/drivers/tty/hvc/hvcs.c 2011-05-19 00:06:34.000000000 -0400
40542+++ linux-2.6.39/drivers/tty/hvc/hvcs.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 40543@@ -83,6 +83,7 @@
40544 #include <asm/hvcserver.h>
40545 #include <asm/uaccess.h>
40546 #include <asm/vio.h>
40547+#include <asm/local.h>
40548
40549 /*
40550 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
40551@@ -270,7 +271,7 @@ struct hvcs_struct {
40552 unsigned int index;
40553
40554 struct tty_struct *tty;
40555- int open_count;
40556+ local_t open_count;
40557
40558 /*
40559 * Used to tell the driver kernel_thread what operations need to take
66a7e928 40560@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
16454cff
MT		 40561
40562 spin_lock_irqsave(&hvcsd->lock, flags);
40563
40564- if (hvcsd->open_count > 0) {
40565+ if (local_read(&hvcsd->open_count) > 0) {
40566 spin_unlock_irqrestore(&hvcsd->lock, flags);
40567 printk(KERN_INFO "HVCS: vterm state unchanged. "
40568 "The hvcs device node is still in use.\n");
66a7e928 40569@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
16454cff
MT		 40570 if ((retval = hvcs_partner_connect(hvcsd)))
40571 goto error_release;
40572
40573- hvcsd->open_count = 1;
40574+ local_set(&hvcsd->open_count, 1);
40575 hvcsd->tty = tty;
40576 tty->driver_data = hvcsd;
40577
66a7e928 40578@@ -1179,7 +1180,7 @@ fast_open:
16454cff
MT		 40579
40580 spin_lock_irqsave(&hvcsd->lock, flags);
40581 kref_get(&hvcsd->kref);
40582- hvcsd->open_count++;
40583+ local_inc(&hvcsd->open_count);
40584 hvcsd->todo_mask |= HVCS_SCHED_READ;
40585 spin_unlock_irqrestore(&hvcsd->lock, flags);
40586
66a7e928 40587@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
16454cff
MT		 40588 hvcsd = tty->driver_data;
40589
40590 spin_lock_irqsave(&hvcsd->lock, flags);
40591- if (--hvcsd->open_count == 0) {
40592+ if (local_dec_and_test(&hvcsd->open_count)) {
40593
40594 vio_disable_interrupts(hvcsd->vdev);
40595
66a7e928 40596@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
16454cff
MT		 40597 free_irq(irq, hvcsd);
40598 kref_put(&hvcsd->kref, destroy_hvcs_struct);
40599 return;
40600- } else if (hvcsd->open_count < 0) {
40601+ } else if (local_read(&hvcsd->open_count) < 0) {
40602 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
40603 " is missmanaged.\n",
40604- hvcsd->vdev->unit_address, hvcsd->open_count);
40605+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
40606 }
40607
40608 spin_unlock_irqrestore(&hvcsd->lock, flags);
66a7e928 40609@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
16454cff
MT		 40610
40611 spin_lock_irqsave(&hvcsd->lock, flags);
40612 /* Preserve this so that we know how many kref refs to put */
40613- temp_open_count = hvcsd->open_count;
40614+ temp_open_count = local_read(&hvcsd->open_count);
40615
40616 /*
40617 * Don't kref put inside the spinlock because the destruction
66a7e928 40618@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
16454cff
MT		 40619 hvcsd->tty->driver_data = NULL;
40620 hvcsd->tty = NULL;
40621
40622- hvcsd->open_count = 0;
40623+ local_set(&hvcsd->open_count, 0);
40624
40625 /* This will drop any buffered data on the floor which is OK in a hangup
40626 * scenario. */
66a7e928 40627@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
16454cff
MT		 40628 * the middle of a write operation? This is a crummy place to do this
40629 * but we want to keep it all in the spinlock.
40630 */
40631- if (hvcsd->open_count <= 0) {
40632+ if (local_read(&hvcsd->open_count) <= 0) {
40633 spin_unlock_irqrestore(&hvcsd->lock, flags);
40634 return -ENODEV;
40635 }
66a7e928 40636@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
16454cff
MT		 40637 {
40638 struct hvcs_struct *hvcsd = tty->driver_data;
40639
40640- if (!hvcsd || hvcsd->open_count <= 0)
40641+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
40642 return 0;
40643
40644 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
66a7e928
MT		 40645diff -urNp linux-2.6.39/drivers/tty/hvc/hvc_xen.c linux-2.6.39/drivers/tty/hvc/hvc_xen.c
40646--- linux-2.6.39/drivers/tty/hvc/hvc_xen.c 2011-05-19 00:06:34.000000000 -0400
40647+++ linux-2.6.39/drivers/tty/hvc/hvc_xen.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 40648@@ -123,7 +123,7 @@ static int domU_read_console(uint32_t vt
40649 return recv;
40650 }
40651
40652-static struct hv_ops domU_hvc_ops = {
40653+static const struct hv_ops domU_hvc_ops = {
40654 .get_chars = domU_read_console,
40655 .put_chars = domU_write_console,
40656 .notifier_add = notifier_add_irq,
40657@@ -149,7 +149,7 @@ static int dom0_write_console(uint32_t v
40658 return len;
40659 }
40660
40661-static struct hv_ops dom0_hvc_ops = {
40662+static const struct hv_ops dom0_hvc_ops = {
40663 .get_chars = dom0_read_console,
40664 .put_chars = dom0_write_console,
40665 .notifier_add = notifier_add_irq,
40666@@ -160,7 +160,7 @@ static struct hv_ops dom0_hvc_ops = {
40667 static int __init xen_hvc_init(void)
40668 {
40669 struct hvc_struct *hp;
40670- struct hv_ops *ops;
40671+ const struct hv_ops *ops;
40672
40673 if (!xen_pv_domain())
40674 return -ENODEV;
66a7e928 40675@@ -205,7 +205,7 @@ static void __exit xen_hvc_fini(void)
16454cff
MT		 40676
40677 static int xen_cons_init(void)
40678 {
40679- struct hv_ops *ops;
40680+ const struct hv_ops *ops;
40681
40682 if (!xen_pv_domain())
40683 return 0;
66a7e928
MT		 40684diff -urNp linux-2.6.39/drivers/tty/ipwireless/tty.c linux-2.6.39/drivers/tty/ipwireless/tty.c
40685--- linux-2.6.39/drivers/tty/ipwireless/tty.c 2011-05-19 00:06:34.000000000 -0400
40686+++ linux-2.6.39/drivers/tty/ipwireless/tty.c 2011-05-22 19:36:32.000000000 -0400
40687@@ -29,6 +29,7 @@
40688 #include <linux/tty_driver.h>
40689 #include <linux/tty_flip.h>
40690 #include <linux/uaccess.h>
40691+#include <asm/local.h>
40692
40693 #include "tty.h"
40694 #include "network.h"
40695@@ -51,7 +52,7 @@ struct ipw_tty {
40696 int tty_type;
40697 struct ipw_network *network;
40698 struct tty_struct *linux_tty;
40699- int open_count;
40700+ local_t open_count;
40701 unsigned int control_lines;
40702 struct mutex ipw_tty_mutex;
40703 int tx_bytes_queued;
40704@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
40705 mutex_unlock(&tty->ipw_tty_mutex);
40706 return -ENODEV;
40707 }
40708- if (tty->open_count == 0)
40709+ if (local_read(&tty->open_count) == 0)
40710 tty->tx_bytes_queued = 0;
40711
40712- tty->open_count++;
40713+ local_inc(&tty->open_count);
40714
40715 tty->linux_tty = linux_tty;
40716 linux_tty->driver_data = tty;
40717@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
40718
40719 static void do_ipw_close(struct ipw_tty *tty)
40720 {
40721- tty->open_count--;
40722-
40723- if (tty->open_count == 0) {
40724+ if (local_dec_return(&tty->open_count) == 0) {
40725 struct tty_struct *linux_tty = tty->linux_tty;
40726
40727 if (linux_tty != NULL) {
40728@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
40729 return;
40730
40731 mutex_lock(&tty->ipw_tty_mutex);
40732- if (tty->open_count == 0) {
40733+ if (local_read(&tty->open_count) == 0) {
40734 mutex_unlock(&tty->ipw_tty_mutex);
40735 return;
40736 }
40737@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
40738 return;
40739 }
40740
40741- if (!tty->open_count) {
40742+ if (!local_read(&tty->open_count)) {
40743 mutex_unlock(&tty->ipw_tty_mutex);
40744 return;
40745 }
40746@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
40747 return -ENODEV;
40748
40749 mutex_lock(&tty->ipw_tty_mutex);
40750- if (!tty->open_count) {
40751+ if (!local_read(&tty->open_count)) {
40752 mutex_unlock(&tty->ipw_tty_mutex);
40753 return -EINVAL;
40754 }
40755@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
40756 if (!tty)
40757 return -ENODEV;
40758
40759- if (!tty->open_count)
40760+ if (!local_read(&tty->open_count))
40761 return -EINVAL;
40762
40763 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
40764@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
40765 if (!tty)
40766 return 0;
40767
40768- if (!tty->open_count)
40769+ if (!local_read(&tty->open_count))
40770 return 0;
40771
40772 return tty->tx_bytes_queued;
40773@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
40774 if (!tty)
40775 return -ENODEV;
40776
40777- if (!tty->open_count)
40778+ if (!local_read(&tty->open_count))
40779 return -EINVAL;
40780
40781 return get_control_lines(tty);
40782@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
40783 if (!tty)
40784 return -ENODEV;
40785
40786- if (!tty->open_count)
40787+ if (!local_read(&tty->open_count))
40788 return -EINVAL;
40789
40790 return set_control_lines(tty, set, clear);
40791@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
40792 if (!tty)
40793 return -ENODEV;
40794
40795- if (!tty->open_count)
40796+ if (!local_read(&tty->open_count))
40797 return -EINVAL;
40798
40799 /* FIXME: Exactly how is the tty object locked here .. */
40800@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
40801 against a parallel ioctl etc */
40802 mutex_lock(&ttyj->ipw_tty_mutex);
40803 }
40804- while (ttyj->open_count)
40805+ while (local_read(&ttyj->open_count))
40806 do_ipw_close(ttyj);
40807 ipwireless_disassociate_network_ttys(network,
40808 ttyj->channel_idx);
40809diff -urNp linux-2.6.39/drivers/tty/mxser.c linux-2.6.39/drivers/tty/mxser.c
40810--- linux-2.6.39/drivers/tty/mxser.c 2011-05-19 00:06:34.000000000 -0400
40811+++ linux-2.6.39/drivers/tty/mxser.c 2011-05-22 19:36:32.000000000 -0400
40812@@ -2340,7 +2340,7 @@ static const struct tty_operations mxser
40813 .get_icount = mxser_get_icount,
40814 };
40815
40816-struct tty_port_operations mxser_port_ops = {
40817+const struct tty_port_operations mxser_port_ops = {
40818 .carrier_raised = mxser_carrier_raised,
40819 .dtr_rts = mxser_dtr_rts,
40820 .activate = mxser_activate,
40821diff -urNp linux-2.6.39/drivers/tty/n_gsm.c linux-2.6.39/drivers/tty/n_gsm.c
40822--- linux-2.6.39/drivers/tty/n_gsm.c 2011-05-19 00:06:34.000000000 -0400
40823+++ linux-2.6.39/drivers/tty/n_gsm.c 2011-05-22 19:36:32.000000000 -0400
40824@@ -1588,7 +1588,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
bc901d79
MT		 40825 return NULL;
40826 spin_lock_init(&dlci->lock);
40827 dlci->fifo = &dlci->_fifo;
40828- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
40829+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
40830 kfree(dlci);
40831 return NULL;
40832 }
66a7e928
MT		 40833diff -urNp linux-2.6.39/drivers/tty/n_tty.c linux-2.6.39/drivers/tty/n_tty.c
40834--- linux-2.6.39/drivers/tty/n_tty.c 2011-05-19 00:06:34.000000000 -0400
40835+++ linux-2.6.39/drivers/tty/n_tty.c 2011-05-22 19:36:32.000000000 -0400
40836@@ -2122,6 +2122,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
bc901d79
MT		 40837 {
40838 *ops = tty_ldisc_N_TTY;
40839 ops->owner = NULL;
40840- ops->refcount = ops->flags = 0;
40841+ atomic_set(&ops->refcount, 0);
40842+ ops->flags = 0;
40843 }
40844 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
66a7e928
MT		 40845diff -urNp linux-2.6.39/drivers/tty/pty.c linux-2.6.39/drivers/tty/pty.c
40846--- linux-2.6.39/drivers/tty/pty.c 2011-05-19 00:06:34.000000000 -0400
40847+++ linux-2.6.39/drivers/tty/pty.c 2011-05-22 19:36:32.000000000 -0400
40848@@ -699,7 +699,18 @@ out:
bc901d79
MT		 40849 return retval;
40850 }
40851
40852-static struct file_operations ptmx_fops;
40853+static const struct file_operations ptmx_fops = {
40854+ .llseek = no_llseek,
40855+ .read = tty_read,
40856+ .write = tty_write,
40857+ .poll = tty_poll,
40858+ .unlocked_ioctl = tty_ioctl,
40859+ .compat_ioctl = tty_compat_ioctl,
40860+ .open = ptmx_open,
40861+ .release = tty_release,
40862+ .fasync = tty_fasync,
40863+};
40864+
40865
40866 static void __init unix98_pty_init(void)
40867 {
66a7e928 40868@@ -752,10 +763,6 @@ static void __init unix98_pty_init(void)
bc901d79
MT		 40869
40870 register_sysctl_table(pty_root_table);
40871
40872- /* Now create the /dev/ptmx special device */
40873- tty_default_fops(&ptmx_fops);
40874- ptmx_fops.open = ptmx_open;
40875-
40876 cdev_init(&ptmx_cdev, &ptmx_fops);
40877 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
40878 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
66a7e928
MT		 40879diff -urNp linux-2.6.39/drivers/tty/rocket.c linux-2.6.39/drivers/tty/rocket.c
40880--- linux-2.6.39/drivers/tty/rocket.c 2011-05-19 00:06:34.000000000 -0400
40881+++ linux-2.6.39/drivers/tty/rocket.c 2011-05-22 19:36:32.000000000 -0400
40882@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
40883 struct rocket_ports tmp;
40884 int board;
40885
40886+ pax_track_stack();
40887+
40888 if (!retports)
40889 return -EFAULT;
40890 memset(&tmp, 0, sizeof (tmp));
40891diff -urNp linux-2.6.39/drivers/tty/serial/21285.c linux-2.6.39/drivers/tty/serial/21285.c
40892--- linux-2.6.39/drivers/tty/serial/21285.c 2011-05-19 00:06:34.000000000 -0400
40893+++ linux-2.6.39/drivers/tty/serial/21285.c 2011-05-22 19:36:32.000000000 -0400
40894@@ -340,7 +340,7 @@ static int serial21285_verify_port(struc
40895 return ret;
40896 }
40897
40898-static struct uart_ops serial21285_ops = {
40899+static const struct uart_ops serial21285_ops = {
40900 .tx_empty = serial21285_tx_empty,
40901 .get_mctrl = serial21285_get_mctrl,
40902 .set_mctrl = serial21285_set_mctrl,
40903diff -urNp linux-2.6.39/drivers/tty/serial/8250.c linux-2.6.39/drivers/tty/serial/8250.c
40904--- linux-2.6.39/drivers/tty/serial/8250.c 2011-05-19 00:06:34.000000000 -0400
40905+++ linux-2.6.39/drivers/tty/serial/8250.c 2011-05-22 19:36:32.000000000 -0400
40906@@ -2708,7 +2708,7 @@ serial8250_type(struct uart_port *port)
40907 return uart_config[type].name;
40908 }
40909
40910-static struct uart_ops serial8250_pops = {
40911+static const struct uart_ops serial8250_pops = {
40912 .tx_empty = serial8250_tx_empty,
40913 .set_mctrl = serial8250_set_mctrl,
40914 .get_mctrl = serial8250_get_mctrl,
40915diff -urNp linux-2.6.39/drivers/tty/serial/altera_jtaguart.c linux-2.6.39/drivers/tty/serial/altera_jtaguart.c
40916--- linux-2.6.39/drivers/tty/serial/altera_jtaguart.c 2011-05-19 00:06:34.000000000 -0400
40917+++ linux-2.6.39/drivers/tty/serial/altera_jtaguart.c 2011-05-22 19:36:32.000000000 -0400
40918@@ -281,7 +281,7 @@ static int altera_jtaguart_verify_port(s
40919 /*
40920 * Define the basic serial functions we support.
40921 */
40922-static struct uart_ops altera_jtaguart_ops = {
40923+static const struct uart_ops altera_jtaguart_ops = {
40924 .tx_empty = altera_jtaguart_tx_empty,
40925 .get_mctrl = altera_jtaguart_get_mctrl,
40926 .set_mctrl = altera_jtaguart_set_mctrl,
40927diff -urNp linux-2.6.39/drivers/tty/serial/altera_uart.c linux-2.6.39/drivers/tty/serial/altera_uart.c
40928--- linux-2.6.39/drivers/tty/serial/altera_uart.c 2011-05-19 00:06:34.000000000 -0400
40929+++ linux-2.6.39/drivers/tty/serial/altera_uart.c 2011-05-22 19:36:32.000000000 -0400
40930@@ -380,7 +380,7 @@ static int altera_uart_verify_port(struc
40931 /*
40932 * Define the basic serial functions we support.
40933 */
40934-static struct uart_ops altera_uart_ops = {
40935+static const struct uart_ops altera_uart_ops = {
40936 .tx_empty = altera_uart_tx_empty,
40937 .get_mctrl = altera_uart_get_mctrl,
40938 .set_mctrl = altera_uart_set_mctrl,
40939diff -urNp linux-2.6.39/drivers/tty/serial/amba-pl010.c linux-2.6.39/drivers/tty/serial/amba-pl010.c
40940--- linux-2.6.39/drivers/tty/serial/amba-pl010.c 2011-05-19 00:06:34.000000000 -0400
40941+++ linux-2.6.39/drivers/tty/serial/amba-pl010.c 2011-05-22 19:36:32.000000000 -0400
40942@@ -529,7 +529,7 @@ static int pl010_verify_port(struct uart
40943 return ret;
40944 }
40945
40946-static struct uart_ops amba_pl010_pops = {
40947+static const struct uart_ops amba_pl010_pops = {
40948 .tx_empty = pl010_tx_empty,
40949 .set_mctrl = pl010_set_mctrl,
40950 .get_mctrl = pl010_get_mctrl,
40951diff -urNp linux-2.6.39/drivers/tty/serial/amba-pl011.c linux-2.6.39/drivers/tty/serial/amba-pl011.c
40952--- linux-2.6.39/drivers/tty/serial/amba-pl011.c 2011-05-19 00:06:34.000000000 -0400
40953+++ linux-2.6.39/drivers/tty/serial/amba-pl011.c 2011-05-22 19:36:32.000000000 -0400
40954@@ -1581,7 +1581,7 @@ static int pl010_verify_port(struct uart
40955 return ret;
40956 }
40957
40958-static struct uart_ops amba_pl011_pops = {
40959+static const struct uart_ops amba_pl011_pops = {
40960 .tx_empty = pl01x_tx_empty,
40961 .set_mctrl = pl011_set_mctrl,
40962 .get_mctrl = pl01x_get_mctrl,
40963diff -urNp linux-2.6.39/drivers/tty/serial/apbuart.c linux-2.6.39/drivers/tty/serial/apbuart.c
40964--- linux-2.6.39/drivers/tty/serial/apbuart.c 2011-05-19 00:06:34.000000000 -0400
40965+++ linux-2.6.39/drivers/tty/serial/apbuart.c 2011-05-22 19:36:32.000000000 -0400
40966@@ -328,7 +328,7 @@ static int apbuart_verify_port(struct ua
40967 return ret;
40968 }
40969
40970-static struct uart_ops grlib_apbuart_ops = {
40971+static const struct uart_ops grlib_apbuart_ops = {
40972 .tx_empty = apbuart_tx_empty,
40973 .set_mctrl = apbuart_set_mctrl,
40974 .get_mctrl = apbuart_get_mctrl,
40975diff -urNp linux-2.6.39/drivers/tty/serial/atmel_serial.c linux-2.6.39/drivers/tty/serial/atmel_serial.c
40976--- linux-2.6.39/drivers/tty/serial/atmel_serial.c 2011-05-19 00:06:34.000000000 -0400
40977+++ linux-2.6.39/drivers/tty/serial/atmel_serial.c 2011-05-22 19:36:32.000000000 -0400
40978@@ -1382,7 +1382,7 @@ atmel_ioctl(struct uart_port *port, unsi
40979
40980
40981
40982-static struct uart_ops atmel_pops = {
40983+static const struct uart_ops atmel_pops = {
40984 .tx_empty = atmel_tx_empty,
40985 .set_mctrl = atmel_set_mctrl,
40986 .get_mctrl = atmel_get_mctrl,
40987diff -urNp linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c
40988--- linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c 2011-05-19 00:06:34.000000000 -0400
40989+++ linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c 2011-05-22 19:36:32.000000000 -0400
40990@@ -636,7 +636,7 @@ static int bcm_uart_verify_port(struct u
40991 }
40992
40993 /* serial core callbacks */
40994-static struct uart_ops bcm_uart_ops = {
40995+static const struct uart_ops bcm_uart_ops = {
40996 .tx_empty = bcm_uart_tx_empty,
40997 .get_mctrl = bcm_uart_get_mctrl,
40998 .set_mctrl = bcm_uart_set_mctrl,
40999diff -urNp linux-2.6.39/drivers/tty/serial/bfin_5xx.c linux-2.6.39/drivers/tty/serial/bfin_5xx.c
41000--- linux-2.6.39/drivers/tty/serial/bfin_5xx.c 2011-05-19 00:06:34.000000000 -0400
41001+++ linux-2.6.39/drivers/tty/serial/bfin_5xx.c 2011-05-22 19:36:32.000000000 -0400
41002@@ -1036,7 +1036,7 @@ static int bfin_kgdboc_port_startup(stru
41003 }
41004 #endif
41005
41006-static struct uart_ops bfin_serial_pops = {
41007+static const struct uart_ops bfin_serial_pops = {
41008 .tx_empty = bfin_serial_tx_empty,
41009 .set_mctrl = bfin_serial_set_mctrl,
41010 .get_mctrl = bfin_serial_get_mctrl,
41011diff -urNp linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c
41012--- linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c 2011-05-19 00:06:34.000000000 -0400
41013+++ linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c 2011-05-22 19:36:32.000000000 -0400
41014@@ -571,7 +571,7 @@ static void sport_set_termios(struct uar
41015 spin_unlock_irqrestore(&up->port.lock, flags);
41016 }
41017
41018-struct uart_ops sport_uart_ops = {
41019+const struct uart_ops sport_uart_ops = {
41020 .tx_empty = sport_tx_empty,
41021 .set_mctrl = sport_set_mctrl,
41022 .get_mctrl = sport_get_mctrl,
41023diff -urNp linux-2.6.39/drivers/tty/serial/clps711x.c linux-2.6.39/drivers/tty/serial/clps711x.c
41024--- linux-2.6.39/drivers/tty/serial/clps711x.c 2011-05-19 00:06:34.000000000 -0400
41025+++ linux-2.6.39/drivers/tty/serial/clps711x.c 2011-05-22 19:36:32.000000000 -0400
41026@@ -380,7 +380,7 @@ static int clps711xuart_request_port(str
41027 return 0;
41028 }
41029
41030-static struct uart_ops clps711x_pops = {
41031+static const struct uart_ops clps711x_pops = {
41032 .tx_empty = clps711xuart_tx_empty,
41033 .set_mctrl = clps711xuart_set_mctrl_null,
41034 .get_mctrl = clps711xuart_get_mctrl,
41035diff -urNp linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c
41036--- linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-19 00:06:34.000000000 -0400
41037+++ linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-22 19:36:32.000000000 -0400
41038@@ -1099,7 +1099,7 @@ static void cpm_put_poll_char(struct uar
41039 }
41040 #endif /* CONFIG_CONSOLE_POLL */
41041
41042-static struct uart_ops cpm_uart_pops = {
41043+static const struct uart_ops cpm_uart_pops = {
41044 .tx_empty = cpm_uart_tx_empty,
41045 .set_mctrl = cpm_uart_set_mctrl,
41046 .get_mctrl = cpm_uart_get_mctrl,
41047diff -urNp linux-2.6.39/drivers/tty/serial/dz.c linux-2.6.39/drivers/tty/serial/dz.c
41048--- linux-2.6.39/drivers/tty/serial/dz.c 2011-05-19 00:06:34.000000000 -0400
41049+++ linux-2.6.39/drivers/tty/serial/dz.c 2011-05-22 19:36:32.000000000 -0400
41050@@ -746,7 +746,7 @@ static int dz_verify_port(struct uart_po
41051 return ret;
41052 }
41053
41054-static struct uart_ops dz_ops = {
41055+static const struct uart_ops dz_ops = {
41056 .tx_empty = dz_tx_empty,
41057 .get_mctrl = dz_get_mctrl,
41058 .set_mctrl = dz_set_mctrl,
41059diff -urNp linux-2.6.39/drivers/tty/serial/imx.c linux-2.6.39/drivers/tty/serial/imx.c
41060--- linux-2.6.39/drivers/tty/serial/imx.c 2011-05-19 00:06:34.000000000 -0400
41061+++ linux-2.6.39/drivers/tty/serial/imx.c 2011-05-22 19:36:32.000000000 -0400
41062@@ -1018,7 +1018,7 @@ imx_verify_port(struct uart_port *port,
41063 return ret;
41064 }
41065
41066-static struct uart_ops imx_pops = {
41067+static const struct uart_ops imx_pops = {
41068 .tx_empty = imx_tx_empty,
41069 .set_mctrl = imx_set_mctrl,
41070 .get_mctrl = imx_get_mctrl,
41071diff -urNp linux-2.6.39/drivers/tty/serial/ioc3_serial.c linux-2.6.39/drivers/tty/serial/ioc3_serial.c
41072--- linux-2.6.39/drivers/tty/serial/ioc3_serial.c 2011-05-19 00:06:34.000000000 -0400
41073+++ linux-2.6.39/drivers/tty/serial/ioc3_serial.c 2011-05-22 19:36:32.000000000 -0400
41074@@ -1874,7 +1874,7 @@ static int ic3_request_port(struct uart_
41075 }
41076
41077 /* Associate the uart functions above - given to serial core */
41078-static struct uart_ops ioc3_ops = {
41079+static const struct uart_ops ioc3_ops = {
41080 .tx_empty = ic3_tx_empty,
41081 .set_mctrl = ic3_set_mctrl,
41082 .get_mctrl = ic3_get_mctrl,
41083diff -urNp linux-2.6.39/drivers/tty/serial/ioc4_serial.c linux-2.6.39/drivers/tty/serial/ioc4_serial.c
41084--- linux-2.6.39/drivers/tty/serial/ioc4_serial.c 2011-05-19 00:06:34.000000000 -0400
41085+++ linux-2.6.39/drivers/tty/serial/ioc4_serial.c 2011-05-22 19:36:32.000000000 -0400
41086@@ -2593,7 +2593,7 @@ static int ic4_request_port(struct uart_
41087
41088 /* Associate the uart functions above - given to serial core */
41089
41090-static struct uart_ops ioc4_ops = {
41091+static const struct uart_ops ioc4_ops = {
41092 .tx_empty = ic4_tx_empty,
41093 .set_mctrl = ic4_set_mctrl,
41094 .get_mctrl = ic4_get_mctrl,
41095diff -urNp linux-2.6.39/drivers/tty/serial/ip22zilog.c linux-2.6.39/drivers/tty/serial/ip22zilog.c
41096--- linux-2.6.39/drivers/tty/serial/ip22zilog.c 2011-05-19 00:06:34.000000000 -0400
41097+++ linux-2.6.39/drivers/tty/serial/ip22zilog.c 2011-05-22 19:36:32.000000000 -0400
41098@@ -928,7 +928,7 @@ static int ip22zilog_verify_port(struct
41099 return -EINVAL;
41100 }
41101
41102-static struct uart_ops ip22zilog_pops = {
41103+static const struct uart_ops ip22zilog_pops = {
41104 .tx_empty = ip22zilog_tx_empty,
41105 .set_mctrl = ip22zilog_set_mctrl,
41106 .get_mctrl = ip22zilog_get_mctrl,
41107diff -urNp linux-2.6.39/drivers/tty/serial/kgdboc.c linux-2.6.39/drivers/tty/serial/kgdboc.c
41108--- linux-2.6.39/drivers/tty/serial/kgdboc.c 2011-05-19 00:06:34.000000000 -0400
41109+++ linux-2.6.39/drivers/tty/serial/kgdboc.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 41110@@ -22,7 +22,7 @@
41111
41112 #define MAX_CONFIG_LEN 40
41113
41114-static struct kgdb_io kgdboc_io_ops;
41115+static struct kgdb_io kgdboc_io_ops; /* cannot be const, see configure_kgdboc() */
41116
41117 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
41118 static int configured = -1;
41119@@ -293,7 +293,7 @@ static void kgdboc_post_exp_handler(void
41120 kgdboc_restore_input();
41121 }
41122
41123-static struct kgdb_io kgdboc_io_ops = {
41124+static struct kgdb_io kgdboc_io_ops = { /* cannot be const, see configure_kgdboc() */
41125 .name = "kgdboc",
41126 .read_char = kgdboc_get_char,
41127 .write_char = kgdboc_put_char,
66a7e928
MT		 41128diff -urNp linux-2.6.39/drivers/tty/serial/m32r_sio.c linux-2.6.39/drivers/tty/serial/m32r_sio.c
41129--- linux-2.6.39/drivers/tty/serial/m32r_sio.c 2011-05-19 00:06:34.000000000 -0400
41130+++ linux-2.6.39/drivers/tty/serial/m32r_sio.c 2011-05-22 19:36:32.000000000 -0400
41131@@ -939,7 +939,7 @@ m32r_sio_type(struct uart_port *port)
41132 return uart_config[type].name;
41133 }
41134
41135-static struct uart_ops m32r_sio_pops = {
41136+static const struct uart_ops m32r_sio_pops = {
41137 .tx_empty = m32r_sio_tx_empty,
41138 .set_mctrl = m32r_sio_set_mctrl,
41139 .get_mctrl = m32r_sio_get_mctrl,
41140diff -urNp linux-2.6.39/drivers/tty/serial/max3100.c linux-2.6.39/drivers/tty/serial/max3100.c
41141--- linux-2.6.39/drivers/tty/serial/max3100.c 2011-05-19 00:06:34.000000000 -0400
41142+++ linux-2.6.39/drivers/tty/serial/max3100.c 2011-05-22 19:36:32.000000000 -0400
41143@@ -710,7 +710,7 @@ static void max3100_break_ctl(struct uar
41144 dev_dbg(&s->spi->dev, "%s\n", __func__);
41145 }
41146
41147-static struct uart_ops max3100_ops = {
41148+static const struct uart_ops max3100_ops = {
41149 .tx_empty = max3100_tx_empty,
41150 .set_mctrl = max3100_set_mctrl,
41151 .get_mctrl = max3100_get_mctrl,
41152diff -urNp linux-2.6.39/drivers/tty/serial/max3107.c linux-2.6.39/drivers/tty/serial/max3107.c
41153--- linux-2.6.39/drivers/tty/serial/max3107.c 2011-05-19 00:06:34.000000000 -0400
41154+++ linux-2.6.39/drivers/tty/serial/max3107.c 2011-05-22 19:36:32.000000000 -0400
41155@@ -910,7 +910,7 @@ static void max3107_break_ctl(struct uar
41156
41157
41158 /* Port functions */
41159-static struct uart_ops max3107_ops = {
41160+static const struct uart_ops max3107_ops = {
41161 .tx_empty = max3107_tx_empty,
41162 .set_mctrl = max3107_set_mctrl,
41163 .get_mctrl = max3107_get_mctrl,
41164diff -urNp linux-2.6.39/drivers/tty/serial/mfd.c linux-2.6.39/drivers/tty/serial/mfd.c
41165--- linux-2.6.39/drivers/tty/serial/mfd.c 2011-05-19 00:06:34.000000000 -0400
41166+++ linux-2.6.39/drivers/tty/serial/mfd.c 2011-05-22 19:36:32.000000000 -0400
41167@@ -1178,7 +1178,7 @@ static struct console serial_hsu_console
41168 };
41169 #endif
41170
41171-struct uart_ops serial_hsu_pops = {
41172+const struct uart_ops serial_hsu_pops = {
41173 .tx_empty = serial_hsu_tx_empty,
41174 .set_mctrl = serial_hsu_set_mctrl,
41175 .get_mctrl = serial_hsu_get_mctrl,
41176diff -urNp linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c
41177--- linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41178+++ linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41179@@ -283,7 +283,7 @@ static irqreturn_t mpc52xx_psc_handle_ir
41180 return mpc5xxx_uart_process_int(port);
41181 }
41182
41183-static struct psc_ops mpc52xx_psc_ops = {
41184+static const struct psc_ops mpc52xx_psc_ops = {
41185 .fifo_init = mpc52xx_psc_fifo_init,
41186 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41187 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41188@@ -304,7 +304,7 @@ static struct psc_ops mpc52xx_psc_ops =
41189 .handle_irq = mpc52xx_psc_handle_irq,
41190 };
41191
41192-static struct psc_ops mpc5200b_psc_ops = {
41193+static const struct psc_ops mpc5200b_psc_ops = {
41194 .fifo_init = mpc52xx_psc_fifo_init,
41195 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41196 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41197@@ -571,7 +571,7 @@ static void mpc512x_psc_get_irq(struct u
41198 port->irq = psc_fifoc_irq;
41199 }
41200
41201-static struct psc_ops mpc512x_psc_ops = {
41202+static const struct psc_ops mpc512x_psc_ops = {
41203 .fifo_init = mpc512x_psc_fifo_init,
41204 .raw_rx_rdy = mpc512x_psc_raw_rx_rdy,
41205 .raw_tx_rdy = mpc512x_psc_raw_tx_rdy,
41206@@ -596,7 +596,7 @@ static struct psc_ops mpc512x_psc_ops =
41207 };
41208 #endif
41209
41210-static struct psc_ops *psc_ops;
41211+static const struct psc_ops *psc_ops;
41212
41213 /* ======================================================================== */
41214 /* UART operations */
41215@@ -905,7 +905,7 @@ mpc52xx_uart_verify_port(struct uart_por
41216 }
41217
41218
41219-static struct uart_ops mpc52xx_uart_ops = {
41220+static const struct uart_ops mpc52xx_uart_ops = {
41221 .tx_empty = mpc52xx_uart_tx_empty,
41222 .set_mctrl = mpc52xx_uart_set_mctrl,
41223 .get_mctrl = mpc52xx_uart_get_mctrl,
41224diff -urNp linux-2.6.39/drivers/tty/serial/mpsc.c linux-2.6.39/drivers/tty/serial/mpsc.c
41225--- linux-2.6.39/drivers/tty/serial/mpsc.c 2011-05-19 00:06:34.000000000 -0400
41226+++ linux-2.6.39/drivers/tty/serial/mpsc.c 2011-05-22 19:36:32.000000000 -0400
41227@@ -1663,7 +1663,7 @@ static void mpsc_put_poll_char(struct ua
41228 }
41229 #endif
41230
41231-static struct uart_ops mpsc_pops = {
41232+static const struct uart_ops mpsc_pops = {
41233 .tx_empty = mpsc_tx_empty,
41234 .set_mctrl = mpsc_set_mctrl,
41235 .get_mctrl = mpsc_get_mctrl,
41236diff -urNp linux-2.6.39/drivers/tty/serial/mrst_max3110.c linux-2.6.39/drivers/tty/serial/mrst_max3110.c
41237--- linux-2.6.39/drivers/tty/serial/mrst_max3110.c 2011-05-19 00:06:34.000000000 -0400
41238+++ linux-2.6.39/drivers/tty/serial/mrst_max3110.c 2011-05-22 19:36:32.000000000 -0400
41239@@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
41240 int loop = 1, num, total = 0;
41241 u8 recv_buf[512], *pbuf;
41242
41243+ pax_track_stack();
41244+
41245 pbuf = recv_buf;
41246 do {
41247 num = max3110_read_multi(max, pbuf);
41248@@ -726,7 +728,7 @@ static void serial_m3110_enable_ms(struc
41249 {
41250 }
41251
41252-struct uart_ops serial_m3110_ops = {
41253+const struct uart_ops serial_m3110_ops = {
41254 .tx_empty = serial_m3110_tx_empty,
41255 .set_mctrl = serial_m3110_set_mctrl,
41256 .get_mctrl = serial_m3110_get_mctrl,
41257diff -urNp linux-2.6.39/drivers/tty/serial/msm_serial.c linux-2.6.39/drivers/tty/serial/msm_serial.c
41258--- linux-2.6.39/drivers/tty/serial/msm_serial.c 2011-05-19 00:06:34.000000000 -0400
41259+++ linux-2.6.39/drivers/tty/serial/msm_serial.c 2011-05-22 19:36:32.000000000 -0400
41260@@ -702,7 +702,7 @@ static void msm_power(struct uart_port *
41261 }
41262 }
41263
41264-static struct uart_ops msm_uart_pops = {
41265+static const struct uart_ops msm_uart_pops = {
41266 .tx_empty = msm_tx_empty,
41267 .set_mctrl = msm_set_mctrl,
41268 .get_mctrl = msm_get_mctrl,
41269diff -urNp linux-2.6.39/drivers/tty/serial/msm_serial_hs.c linux-2.6.39/drivers/tty/serial/msm_serial_hs.c
41270--- linux-2.6.39/drivers/tty/serial/msm_serial_hs.c 2011-05-19 00:06:34.000000000 -0400
41271+++ linux-2.6.39/drivers/tty/serial/msm_serial_hs.c 2011-05-22 19:36:32.000000000 -0400
41272@@ -360,7 +360,7 @@ struct msm_hs_port {
41273 static struct msm_hs_port q_uart_port[UARTDM_NR];
41274 static struct platform_driver msm_serial_hs_platform_driver;
41275 static struct uart_driver msm_hs_driver;
41276-static struct uart_ops msm_hs_ops;
41277+static const struct uart_ops msm_hs_ops;
41278 static struct workqueue_struct *msm_hs_workqueue;
41279
41280 #define UARTDM_TO_MSM(uart_port) \
41281@@ -1856,7 +1856,7 @@ static struct uart_driver msm_hs_driver
41282 .cons = 0,
41283 };
41284
41285-static struct uart_ops msm_hs_ops = {
41286+static const struct uart_ops msm_hs_ops = {
41287 .tx_empty = msm_hs_tx_empty,
41288 .set_mctrl = msm_hs_set_mctrl_locked,
41289 .get_mctrl = msm_hs_get_mctrl_locked,
41290diff -urNp linux-2.6.39/drivers/tty/serial/mux.c linux-2.6.39/drivers/tty/serial/mux.c
41291--- linux-2.6.39/drivers/tty/serial/mux.c 2011-05-19 00:06:34.000000000 -0400
41292+++ linux-2.6.39/drivers/tty/serial/mux.c 2011-05-22 19:36:32.000000000 -0400
41293@@ -442,7 +442,7 @@ static struct console mux_console = {
41294 #define MUX_CONSOLE NULL
41295 #endif
41296
41297-static struct uart_ops mux_pops = {
41298+static const struct uart_ops mux_pops = {
41299 .tx_empty = mux_tx_empty,
41300 .set_mctrl = mux_set_mctrl,
41301 .get_mctrl = mux_get_mctrl,
41302diff -urNp linux-2.6.39/drivers/tty/serial/mxs-auart.c linux-2.6.39/drivers/tty/serial/mxs-auart.c
41303--- linux-2.6.39/drivers/tty/serial/mxs-auart.c 2011-05-19 00:06:34.000000000 -0400
41304+++ linux-2.6.39/drivers/tty/serial/mxs-auart.c 2011-05-22 19:36:32.000000000 -0400
41305@@ -499,7 +499,7 @@ static void mxs_auart_enable_ms(struct u
41306 /* just empty */
41307 }
41308
41309-static struct uart_ops mxs_auart_ops = {
41310+static const struct uart_ops mxs_auart_ops = {
41311 .tx_empty = mxs_auart_tx_empty,
41312 .start_tx = mxs_auart_start_tx,
41313 .stop_tx = mxs_auart_stop_tx,
41314diff -urNp linux-2.6.39/drivers/tty/serial/netx-serial.c linux-2.6.39/drivers/tty/serial/netx-serial.c
41315--- linux-2.6.39/drivers/tty/serial/netx-serial.c 2011-05-19 00:06:34.000000000 -0400
41316+++ linux-2.6.39/drivers/tty/serial/netx-serial.c 2011-05-22 19:36:32.000000000 -0400
41317@@ -464,7 +464,7 @@ netx_verify_port(struct uart_port *port,
41318 return ret;
41319 }
41320
41321-static struct uart_ops netx_pops = {
41322+static const struct uart_ops netx_pops = {
41323 .tx_empty = netx_tx_empty,
41324 .set_mctrl = netx_set_mctrl,
41325 .get_mctrl = netx_get_mctrl,
41326diff -urNp linux-2.6.39/drivers/tty/serial/nwpserial.c linux-2.6.39/drivers/tty/serial/nwpserial.c
41327--- linux-2.6.39/drivers/tty/serial/nwpserial.c 2011-05-19 00:06:34.000000000 -0400
41328+++ linux-2.6.39/drivers/tty/serial/nwpserial.c 2011-05-22 19:36:32.000000000 -0400
41329@@ -303,7 +303,7 @@ static unsigned int nwpserial_tx_empty(s
41330 return ret & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
41331 }
41332
41333-static struct uart_ops nwpserial_pops = {
41334+static const struct uart_ops nwpserial_pops = {
41335 .tx_empty = nwpserial_tx_empty,
41336 .set_mctrl = nwpserial_set_mctrl,
41337 .get_mctrl = nwpserial_get_mctrl,
41338diff -urNp linux-2.6.39/drivers/tty/serial/omap-serial.c linux-2.6.39/drivers/tty/serial/omap-serial.c
41339--- linux-2.6.39/drivers/tty/serial/omap-serial.c 2011-05-19 00:06:34.000000000 -0400
41340+++ linux-2.6.39/drivers/tty/serial/omap-serial.c 2011-05-22 19:36:32.000000000 -0400
41341@@ -1029,7 +1029,7 @@ static inline void serial_omap_add_conso
41342
41343 #endif
41344
41345-static struct uart_ops serial_omap_pops = {
41346+static const struct uart_ops serial_omap_pops = {
41347 .tx_empty = serial_omap_tx_empty,
41348 .set_mctrl = serial_omap_set_mctrl,
41349 .get_mctrl = serial_omap_get_mctrl,
41350diff -urNp linux-2.6.39/drivers/tty/serial/pch_uart.c linux-2.6.39/drivers/tty/serial/pch_uart.c
41351--- linux-2.6.39/drivers/tty/serial/pch_uart.c 2011-05-19 00:06:34.000000000 -0400
41352+++ linux-2.6.39/drivers/tty/serial/pch_uart.c 2011-05-22 19:36:32.000000000 -0400
41353@@ -1351,7 +1351,7 @@ static int pch_uart_verify_port(struct u
41354 return 0;
41355 }
41356
41357-static struct uart_ops pch_uart_ops = {
41358+static const struct uart_ops pch_uart_ops = {
41359 .tx_empty = pch_uart_tx_empty,
41360 .set_mctrl = pch_uart_set_mctrl,
41361 .get_mctrl = pch_uart_get_mctrl,
41362diff -urNp linux-2.6.39/drivers/tty/serial/pmac_zilog.c linux-2.6.39/drivers/tty/serial/pmac_zilog.c
41363--- linux-2.6.39/drivers/tty/serial/pmac_zilog.c 2011-05-19 00:06:34.000000000 -0400
41364+++ linux-2.6.39/drivers/tty/serial/pmac_zilog.c 2011-05-22 19:36:32.000000000 -0400
41365@@ -1427,7 +1427,7 @@ static void pmz_poll_put_char(struct uar
41366
41367 #endif /* CONFIG_CONSOLE_POLL */
41368
41369-static struct uart_ops pmz_pops = {
41370+static const struct uart_ops pmz_pops = {
41371 .tx_empty = pmz_tx_empty,
41372 .set_mctrl = pmz_set_mctrl,
41373 .get_mctrl = pmz_get_mctrl,
41374diff -urNp linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c
41375--- linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c 2011-05-19 00:06:34.000000000 -0400
41376+++ linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c 2011-05-22 19:36:32.000000000 -0400
41377@@ -614,7 +614,7 @@ pnx8xxx_verify_port(struct uart_port *po
41378 return ret;
41379 }
41380
41381-static struct uart_ops pnx8xxx_pops = {
41382+static const struct uart_ops pnx8xxx_pops = {
41383 .tx_empty = pnx8xxx_tx_empty,
41384 .set_mctrl = pnx8xxx_set_mctrl,
41385 .get_mctrl = pnx8xxx_get_mctrl,
41386diff -urNp linux-2.6.39/drivers/tty/serial/pxa.c linux-2.6.39/drivers/tty/serial/pxa.c
41387--- linux-2.6.39/drivers/tty/serial/pxa.c 2011-05-19 00:06:34.000000000 -0400
41388+++ linux-2.6.39/drivers/tty/serial/pxa.c 2011-05-22 19:36:32.000000000 -0400
41389@@ -706,7 +706,7 @@ static struct console serial_pxa_console
41390 #define PXA_CONSOLE NULL
41391 #endif
41392
41393-struct uart_ops serial_pxa_pops = {
41394+const struct uart_ops serial_pxa_pops = {
41395 .tx_empty = serial_pxa_tx_empty,
41396 .set_mctrl = serial_pxa_set_mctrl,
41397 .get_mctrl = serial_pxa_get_mctrl,
41398diff -urNp linux-2.6.39/drivers/tty/serial/sa1100.c linux-2.6.39/drivers/tty/serial/sa1100.c
41399--- linux-2.6.39/drivers/tty/serial/sa1100.c 2011-05-19 00:06:34.000000000 -0400
41400+++ linux-2.6.39/drivers/tty/serial/sa1100.c 2011-05-22 19:36:32.000000000 -0400
41401@@ -577,7 +577,7 @@ sa1100_verify_port(struct uart_port *por
41402 return ret;
41403 }
41404
41405-static struct uart_ops sa1100_pops = {
41406+static const struct uart_ops sa1100_pops = {
41407 .tx_empty = sa1100_tx_empty,
41408 .set_mctrl = sa1100_set_mctrl,
41409 .get_mctrl = sa1100_get_mctrl,
41410diff -urNp linux-2.6.39/drivers/tty/serial/samsung.c linux-2.6.39/drivers/tty/serial/samsung.c
41411--- linux-2.6.39/drivers/tty/serial/samsung.c 2011-05-19 00:06:34.000000000 -0400
41412+++ linux-2.6.39/drivers/tty/serial/samsung.c 2011-05-22 19:36:32.000000000 -0400
41413@@ -860,7 +860,7 @@ static struct console s3c24xx_serial_con
41414 #define S3C24XX_SERIAL_CONSOLE NULL
41415 #endif
41416
41417-static struct uart_ops s3c24xx_serial_ops = {
41418+static const struct uart_ops s3c24xx_serial_ops = {
41419 .pm = s3c24xx_serial_pm,
41420 .tx_empty = s3c24xx_serial_tx_empty,
41421 .get_mctrl = s3c24xx_serial_get_mctrl,
41422diff -urNp linux-2.6.39/drivers/tty/serial/sc26xx.c linux-2.6.39/drivers/tty/serial/sc26xx.c
41423--- linux-2.6.39/drivers/tty/serial/sc26xx.c 2011-05-19 00:06:34.000000000 -0400
41424+++ linux-2.6.39/drivers/tty/serial/sc26xx.c 2011-05-22 19:36:32.000000000 -0400
41425@@ -515,7 +515,7 @@ static int sc26xx_verify_port(struct uar
41426 return -EINVAL;
41427 }
41428
41429-static struct uart_ops sc26xx_ops = {
41430+static const struct uart_ops sc26xx_ops = {
41431 .tx_empty = sc26xx_tx_empty,
41432 .set_mctrl = sc26xx_set_mctrl,
41433 .get_mctrl = sc26xx_get_mctrl,
41434diff -urNp linux-2.6.39/drivers/tty/serial/serial_ks8695.c linux-2.6.39/drivers/tty/serial/serial_ks8695.c
41435--- linux-2.6.39/drivers/tty/serial/serial_ks8695.c 2011-05-19 00:06:34.000000000 -0400
41436+++ linux-2.6.39/drivers/tty/serial/serial_ks8695.c 2011-05-22 19:36:32.000000000 -0400
41437@@ -528,7 +528,7 @@ static int ks8695uart_verify_port(struct
41438 return ret;
41439 }
41440
41441-static struct uart_ops ks8695uart_pops = {
41442+static const struct uart_ops ks8695uart_pops = {
41443 .tx_empty = ks8695uart_tx_empty,
41444 .set_mctrl = ks8695uart_set_mctrl,
41445 .get_mctrl = ks8695uart_get_mctrl,
41446diff -urNp linux-2.6.39/drivers/tty/serial/serial_txx9.c linux-2.6.39/drivers/tty/serial/serial_txx9.c
41447--- linux-2.6.39/drivers/tty/serial/serial_txx9.c 2011-05-19 00:06:34.000000000 -0400
41448+++ linux-2.6.39/drivers/tty/serial/serial_txx9.c 2011-05-22 19:36:32.000000000 -0400
41449@@ -857,7 +857,7 @@ serial_txx9_type(struct uart_port *port)
41450 return "txx9";
41451 }
41452
41453-static struct uart_ops serial_txx9_pops = {
41454+static const struct uart_ops serial_txx9_pops = {
41455 .tx_empty = serial_txx9_tx_empty,
41456 .set_mctrl = serial_txx9_set_mctrl,
41457 .get_mctrl = serial_txx9_get_mctrl,
41458diff -urNp linux-2.6.39/drivers/tty/serial/sn_console.c linux-2.6.39/drivers/tty/serial/sn_console.c
41459--- linux-2.6.39/drivers/tty/serial/sn_console.c 2011-05-19 00:06:34.000000000 -0400
41460+++ linux-2.6.39/drivers/tty/serial/sn_console.c 2011-05-22 19:36:32.000000000 -0400
41461@@ -388,7 +388,7 @@ static void snp_config_port(struct uart_
41462
41463 /* Associate the uart functions above - given to serial core */
41464
41465-static struct uart_ops sn_console_ops = {
41466+static const struct uart_ops sn_console_ops = {
41467 .tx_empty = snp_tx_empty,
41468 .set_mctrl = snp_set_mctrl,
41469 .get_mctrl = snp_get_mctrl,
41470diff -urNp linux-2.6.39/drivers/tty/serial/sunhv.c linux-2.6.39/drivers/tty/serial/sunhv.c
41471--- linux-2.6.39/drivers/tty/serial/sunhv.c 2011-05-19 00:06:34.000000000 -0400
41472+++ linux-2.6.39/drivers/tty/serial/sunhv.c 2011-05-22 19:36:32.000000000 -0400
41473@@ -168,12 +168,12 @@ struct sunhv_ops {
41474 int (*receive_chars)(struct uart_port *port, struct tty_struct *tty);
41475 };
41476
41477-static struct sunhv_ops bychar_ops = {
41478+static const struct sunhv_ops bychar_ops = {
41479 .transmit_chars = transmit_chars_putchar,
41480 .receive_chars = receive_chars_getchar,
41481 };
41482
41483-static struct sunhv_ops bywrite_ops = {
41484+static const struct sunhv_ops bywrite_ops = {
41485 .transmit_chars = transmit_chars_write,
41486 .receive_chars = receive_chars_read,
41487 };
41488@@ -370,7 +370,7 @@ static int sunhv_verify_port(struct uart
41489 return -EINVAL;
41490 }
41491
41492-static struct uart_ops sunhv_pops = {
41493+static const struct uart_ops sunhv_pops = {
41494 .tx_empty = sunhv_tx_empty,
41495 .set_mctrl = sunhv_set_mctrl,
41496 .get_mctrl = sunhv_get_mctrl,
41497diff -urNp linux-2.6.39/drivers/tty/serial/sunsab.c linux-2.6.39/drivers/tty/serial/sunsab.c
41498--- linux-2.6.39/drivers/tty/serial/sunsab.c 2011-05-19 00:06:34.000000000 -0400
41499+++ linux-2.6.39/drivers/tty/serial/sunsab.c 2011-05-22 19:36:32.000000000 -0400
41500@@ -804,7 +804,7 @@ static int sunsab_verify_port(struct uar
41501 return -EINVAL;
41502 }
41503
41504-static struct uart_ops sunsab_pops = {
41505+static const struct uart_ops sunsab_pops = {
41506 .tx_empty = sunsab_tx_empty,
41507 .set_mctrl = sunsab_set_mctrl,
41508 .get_mctrl = sunsab_get_mctrl,
41509diff -urNp linux-2.6.39/drivers/tty/serial/sunsu.c linux-2.6.39/drivers/tty/serial/sunsu.c
41510--- linux-2.6.39/drivers/tty/serial/sunsu.c 2011-05-19 00:06:34.000000000 -0400
41511+++ linux-2.6.39/drivers/tty/serial/sunsu.c 2011-05-22 19:36:32.000000000 -0400
41512@@ -946,7 +946,7 @@ sunsu_type(struct uart_port *port)
41513 return uart_config[type].name;
41514 }
41515
41516-static struct uart_ops sunsu_pops = {
41517+static const struct uart_ops sunsu_pops = {
41518 .tx_empty = sunsu_tx_empty,
41519 .set_mctrl = sunsu_set_mctrl,
41520 .get_mctrl = sunsu_get_mctrl,
41521diff -urNp linux-2.6.39/drivers/tty/serial/sunzilog.c linux-2.6.39/drivers/tty/serial/sunzilog.c
41522--- linux-2.6.39/drivers/tty/serial/sunzilog.c 2011-05-19 00:06:34.000000000 -0400
41523+++ linux-2.6.39/drivers/tty/serial/sunzilog.c 2011-05-22 19:36:32.000000000 -0400
41524@@ -1042,7 +1042,7 @@ static void sunzilog_put_poll_char(struc
41525 }
41526 #endif /* CONFIG_CONSOLE_POLL */
41527
41528-static struct uart_ops sunzilog_pops = {
41529+static const struct uart_ops sunzilog_pops = {
41530 .tx_empty = sunzilog_tx_empty,
41531 .set_mctrl = sunzilog_set_mctrl,
41532 .get_mctrl = sunzilog_get_mctrl,
41533diff -urNp linux-2.6.39/drivers/tty/serial/timbuart.c linux-2.6.39/drivers/tty/serial/timbuart.c
41534--- linux-2.6.39/drivers/tty/serial/timbuart.c 2011-05-19 00:06:34.000000000 -0400
41535+++ linux-2.6.39/drivers/tty/serial/timbuart.c 2011-05-22 19:36:32.000000000 -0400
41536@@ -394,7 +394,7 @@ static int timbuart_verify_port(struct u
41537 return -EINVAL;
41538 }
41539
41540-static struct uart_ops timbuart_ops = {
41541+static const struct uart_ops timbuart_ops = {
41542 .tx_empty = timbuart_tx_empty,
41543 .set_mctrl = timbuart_set_mctrl,
41544 .get_mctrl = timbuart_get_mctrl,
41545diff -urNp linux-2.6.39/drivers/tty/serial/uartlite.c linux-2.6.39/drivers/tty/serial/uartlite.c
41546--- linux-2.6.39/drivers/tty/serial/uartlite.c 2011-05-19 00:06:34.000000000 -0400
41547+++ linux-2.6.39/drivers/tty/serial/uartlite.c 2011-05-22 19:36:32.000000000 -0400
41548@@ -331,7 +331,7 @@ static void ulite_put_poll_char(struct u
41549 }
41550 #endif
41551
41552-static struct uart_ops ulite_ops = {
41553+static const struct uart_ops ulite_ops = {
41554 .tx_empty = ulite_tx_empty,
41555 .set_mctrl = ulite_set_mctrl,
41556 .get_mctrl = ulite_get_mctrl,
41557diff -urNp linux-2.6.39/drivers/tty/serial/ucc_uart.c linux-2.6.39/drivers/tty/serial/ucc_uart.c
41558--- linux-2.6.39/drivers/tty/serial/ucc_uart.c 2011-05-19 00:06:34.000000000 -0400
41559+++ linux-2.6.39/drivers/tty/serial/ucc_uart.c 2011-05-22 19:36:32.000000000 -0400
41560@@ -1088,7 +1088,7 @@ static int qe_uart_verify_port(struct ua
41561 *
41562 * Details on these functions can be found in Documentation/serial/driver
41563 */
41564-static struct uart_ops qe_uart_pops = {
41565+static const struct uart_ops qe_uart_pops = {
41566 .tx_empty = qe_uart_tx_empty,
41567 .set_mctrl = qe_uart_set_mctrl,
41568 .get_mctrl = qe_uart_get_mctrl,
41569diff -urNp linux-2.6.39/drivers/tty/serial/vr41xx_siu.c linux-2.6.39/drivers/tty/serial/vr41xx_siu.c
41570--- linux-2.6.39/drivers/tty/serial/vr41xx_siu.c 2011-05-19 00:06:34.000000000 -0400
41571+++ linux-2.6.39/drivers/tty/serial/vr41xx_siu.c 2011-05-22 19:36:32.000000000 -0400
41572@@ -683,7 +683,7 @@ static int siu_verify_port(struct uart_p
41573 return 0;
41574 }
41575
41576-static struct uart_ops siu_uart_ops = {
41577+static const struct uart_ops siu_uart_ops = {
41578 .tx_empty = siu_tx_empty,
41579 .set_mctrl = siu_set_mctrl,
41580 .get_mctrl = siu_get_mctrl,
41581diff -urNp linux-2.6.39/drivers/tty/serial/vt8500_serial.c linux-2.6.39/drivers/tty/serial/vt8500_serial.c
41582--- linux-2.6.39/drivers/tty/serial/vt8500_serial.c 2011-05-19 00:06:34.000000000 -0400
41583+++ linux-2.6.39/drivers/tty/serial/vt8500_serial.c 2011-05-22 19:36:32.000000000 -0400
41584@@ -519,7 +519,7 @@ static struct console vt8500_console = {
41585 #define VT8500_CONSOLE NULL
41586 #endif
41587
41588-static struct uart_ops vt8500_uart_pops = {
41589+static const struct uart_ops vt8500_uart_pops = {
41590 .tx_empty = vt8500_tx_empty,
41591 .set_mctrl = vt8500_set_mctrl,
41592 .get_mctrl = vt8500_get_mctrl,
41593diff -urNp linux-2.6.39/drivers/tty/serial/zs.c linux-2.6.39/drivers/tty/serial/zs.c
41594--- linux-2.6.39/drivers/tty/serial/zs.c 2011-05-19 00:06:34.000000000 -0400
41595+++ linux-2.6.39/drivers/tty/serial/zs.c 2011-05-22 19:36:32.000000000 -0400
41596@@ -1044,7 +1044,7 @@ static int zs_verify_port(struct uart_po
41597 }
41598
41599
41600-static struct uart_ops zs_ops = {
41601+static const struct uart_ops zs_ops = {
41602 .tx_empty = zs_tx_empty,
41603 .set_mctrl = zs_set_mctrl,
41604 .get_mctrl = zs_get_mctrl,
41605diff -urNp linux-2.6.39/drivers/tty/tty_io.c linux-2.6.39/drivers/tty/tty_io.c
41606--- linux-2.6.39/drivers/tty/tty_io.c 2011-05-19 00:06:34.000000000 -0400
41607+++ linux-2.6.39/drivers/tty/tty_io.c 2011-05-22 19:36:32.000000000 -0400
41608@@ -139,21 +139,11 @@ EXPORT_SYMBOL(tty_mutex);
bc901d79
MT		 41609 /* Spinlock to protect the tty->tty_files list */
41610 DEFINE_SPINLOCK(tty_files_lock);
41611
41612-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
41613-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
41614 ssize_t redirected_tty_write(struct file *, const char __user *,
41615 size_t, loff_t *);
41616-static unsigned int tty_poll(struct file *, poll_table *);
41617 static int tty_open(struct inode *, struct file *);
41618 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
41619-#ifdef CONFIG_COMPAT
41620-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41621- unsigned long arg);
41622-#else
41623-#define tty_compat_ioctl NULL
41624-#endif
41625 static int __tty_fasync(int fd, struct file *filp, int on);
41626-static int tty_fasync(int fd, struct file *filp, int on);
41627 static void release_tty(struct tty_struct *tty, int idx);
41628 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41629 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
66a7e928 41630@@ -937,7 +927,7 @@ EXPORT_SYMBOL(start_tty);
bc901d79
MT		 41631 * read calls may be outstanding in parallel.
41632 */
41633
41634-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41635+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41636 loff_t *ppos)
41637 {
41638 int i;
66a7e928 41639@@ -963,6 +953,8 @@ static ssize_t tty_read(struct file *fil
bc901d79
MT		 41640 return i;
41641 }
41642
41643+EXPORT_SYMBOL(tty_read);
41644+
41645 void tty_write_unlock(struct tty_struct *tty)
41646 {
41647 mutex_unlock(&tty->atomic_write_lock);
66a7e928 41648@@ -1112,7 +1104,7 @@ void tty_write_message(struct tty_struct
bc901d79
MT		 41649 * write method will not be invoked in parallel for each device.
41650 */
41651
41652-static ssize_t tty_write(struct file *file, const char __user *buf,
41653+ssize_t tty_write(struct file *file, const char __user *buf,
41654 size_t count, loff_t *ppos)
41655 {
41656 struct inode *inode = file->f_path.dentry->d_inode;
66a7e928 41657@@ -1138,6 +1130,8 @@ static ssize_t tty_write(struct file *fi
bc901d79
MT		 41658 return ret;
41659 }
41660
41661+EXPORT_SYMBOL(tty_write);
41662+
41663 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
41664 size_t count, loff_t *ppos)
41665 {
66a7e928 41666@@ -1777,6 +1771,8 @@ int tty_release(struct inode *inode, str
bc901d79
MT		 41667 return 0;
41668 }
41669
41670+EXPORT_SYMBOL(tty_release);
41671+
41672 /**
41673 * tty_open - open a tty device
41674 * @inode: inode of device file
66a7e928 41675@@ -1968,7 +1964,7 @@ got_driver:
bc901d79
MT		 41676 * may be re-entered freely by other callers.
41677 */
41678
41679-static unsigned int tty_poll(struct file *filp, poll_table *wait)
41680+unsigned int tty_poll(struct file *filp, poll_table *wait)
41681 {
41682 struct tty_struct *tty = file_tty(filp);
41683 struct tty_ldisc *ld;
66a7e928 41684@@ -1984,6 +1980,8 @@ static unsigned int tty_poll(struct file
bc901d79
MT		 41685 return ret;
41686 }
41687
41688+EXPORT_SYMBOL(tty_poll);
41689+
41690 static int __tty_fasync(int fd, struct file *filp, int on)
41691 {
41692 struct tty_struct *tty = file_tty(filp);
66a7e928 41693@@ -2025,7 +2023,7 @@ out:
bc901d79
MT		 41694 return retval;
41695 }
41696
41697-static int tty_fasync(int fd, struct file *filp, int on)
41698+int tty_fasync(int fd, struct file *filp, int on)
41699 {
41700 int retval;
41701 tty_lock();
66a7e928 41702@@ -2034,6 +2032,8 @@ static int tty_fasync(int fd, struct fil
bc901d79
MT		 41703 return retval;
41704 }
41705
41706+EXPORT_SYMBOL(tty_fasync);
41707+
41708 /**
41709 * tiocsti - fake input character
41710 * @tty: tty to fake input into
66a7e928 41711@@ -2695,8 +2695,10 @@ long tty_ioctl(struct file *file, unsign
bc901d79
MT		 41712 return retval;
41713 }
41714
41715+EXPORT_SYMBOL(tty_ioctl);
41716+
41717 #ifdef CONFIG_COMPAT
41718-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41719+long tty_compat_ioctl(struct file *file, unsigned int cmd,
41720 unsigned long arg)
41721 {
41722 struct inode *inode = file->f_dentry->d_inode;
66a7e928 41723@@ -2720,6 +2722,9 @@ static long tty_compat_ioctl(struct file
bc901d79
MT		 41724
41725 return retval;
41726 }
41727+
41728+EXPORT_SYMBOL(tty_compat_ioctl);
41729+
41730 #endif
41731
41732 /*
66a7e928 41733@@ -3198,11 +3203,6 @@ struct tty_struct *get_current_tty(void)
bc901d79
MT		 41734 }
41735 EXPORT_SYMBOL_GPL(get_current_tty);
41736
41737-void tty_default_fops(struct file_operations *fops)
41738-{
41739- *fops = tty_fops;
41740-}
41741-
41742 /*
41743 * Initialize the console device. This is called *early*, so
41744 * we can't necessarily depend on lots of kernel help here.
66a7e928
MT		 41745diff -urNp linux-2.6.39/drivers/tty/tty_ldisc.c linux-2.6.39/drivers/tty/tty_ldisc.c
41746--- linux-2.6.39/drivers/tty/tty_ldisc.c 2011-05-19 00:06:34.000000000 -0400
41747+++ linux-2.6.39/drivers/tty/tty_ldisc.c 2011-05-22 19:36:32.000000000 -0400
41748@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
bc901d79
MT		 41749 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
41750 struct tty_ldisc_ops *ldo = ld->ops;
41751
41752- ldo->refcount--;
41753+ atomic_dec(&ldo->refcount);
41754 module_put(ldo->owner);
41755 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41756
66a7e928 41757@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
bc901d79
MT		 41758 spin_lock_irqsave(&tty_ldisc_lock, flags);
41759 tty_ldiscs[disc] = new_ldisc;
41760 new_ldisc->num = disc;
41761- new_ldisc->refcount = 0;
41762+ atomic_set(&new_ldisc->refcount, 0);
41763 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41764
41765 return ret;
66a7e928 41766@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
bc901d79
MT		 41767 return -EINVAL;
41768
41769 spin_lock_irqsave(&tty_ldisc_lock, flags);
41770- if (tty_ldiscs[disc]->refcount)
41771+ if (atomic_read(&tty_ldiscs[disc]->refcount))
41772 ret = -EBUSY;
41773 else
41774 tty_ldiscs[disc] = NULL;
66a7e928 41775@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
bc901d79
MT		 41776 if (ldops) {
41777 ret = ERR_PTR(-EAGAIN);
41778 if (try_module_get(ldops->owner)) {
41779- ldops->refcount++;
41780+ atomic_inc(&ldops->refcount);
41781 ret = ldops;
41782 }
41783 }
66a7e928 41784@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
bc901d79
MT		 41785 unsigned long flags;
41786
41787 spin_lock_irqsave(&tty_ldisc_lock, flags);
41788- ldops->refcount--;
41789+ atomic_dec(&ldops->refcount);
41790 module_put(ldops->owner);
41791 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41792 }
66a7e928
MT		 41793diff -urNp linux-2.6.39/drivers/tty/vt/keyboard.c linux-2.6.39/drivers/tty/vt/keyboard.c
41794--- linux-2.6.39/drivers/tty/vt/keyboard.c 2011-05-19 00:06:34.000000000 -0400
41795+++ linux-2.6.39/drivers/tty/vt/keyboard.c 2011-05-22 20:32:43.000000000 -0400
41796@@ -658,6 +658,16 @@ static void k_spec(struct vc_data *vc, u
41797 kbd->kbdmode == VC_OFF) &&
bc901d79
MT		 41798 value != KVAL(K_SAK))
41799 return; /* SAK is allowed even in raw mode */
41800+
41801+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
41802+ {
41803+ void *func = fn_handler[value];
41804+ if (func == fn_show_state || func == fn_show_ptregs ||
41805+ func == fn_show_mem)
41806+ return;
41807+ }
41808+#endif
41809+
41810 fn_handler[value](vc);
41811 }
41812
66a7e928
MT		 41813diff -urNp linux-2.6.39/drivers/tty/vt/vt.c linux-2.6.39/drivers/tty/vt/vt.c
41814--- linux-2.6.39/drivers/tty/vt/vt.c 2011-05-19 00:06:34.000000000 -0400
41815+++ linux-2.6.39/drivers/tty/vt/vt.c 2011-05-22 19:36:32.000000000 -0400
41816@@ -261,7 +261,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
16454cff
MT		 41817
41818 static void notify_write(struct vc_data *vc, unsigned int unicode)
41819 {
41820- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
41821+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
41822 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
41823 }
41824
66a7e928
MT		 41825diff -urNp linux-2.6.39/drivers/tty/vt/vt_ioctl.c linux-2.6.39/drivers/tty/vt/vt_ioctl.c
41826--- linux-2.6.39/drivers/tty/vt/vt_ioctl.c 2011-05-19 00:06:34.000000000 -0400
41827+++ linux-2.6.39/drivers/tty/vt/vt_ioctl.c 2011-05-22 19:41:37.000000000 -0400
41828@@ -209,9 +209,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
bc901d79
MT		 41829 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
41830 return -EFAULT;
41831
41832- if (!capable(CAP_SYS_TTY_CONFIG))
41833- perm = 0;
41834-
41835 switch (cmd) {
41836 case KDGKBENT:
41837 key_map = key_maps[s];
66a7e928 41838@@ -223,6 +220,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
bc901d79
MT		 41839 val = (i ? K_HOLE : K_NOSUCHMAP);
41840 return put_user(val, &user_kbe->kb_value);
41841 case KDSKBENT:
41842+ if (!capable(CAP_SYS_TTY_CONFIG))
41843+ perm = 0;
41844+
41845 if (!perm)
41846 return -EPERM;
41847 if (!i && v == K_NOSUCHMAP) {
66a7e928 41848@@ -324,9 +324,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
bc901d79
MT		 41849 int i, j, k;
41850 int ret;
41851
41852- if (!capable(CAP_SYS_TTY_CONFIG))
41853- perm = 0;
41854-
41855 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
41856 if (!kbs) {
41857 ret = -ENOMEM;
66a7e928 41858@@ -360,6 +357,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
bc901d79
MT		 41859 kfree(kbs);
41860 return ((p && *p) ? -EOVERFLOW : 0);
41861 case KDSKBSENT:
41862+ if (!capable(CAP_SYS_TTY_CONFIG))
41863+ perm = 0;
41864+
41865 if (!perm) {
41866 ret = -EPERM;
41867 goto reterr;
66a7e928
MT		 41868diff -urNp linux-2.6.39/drivers/uio/uio.c linux-2.6.39/drivers/uio/uio.c
41869--- linux-2.6.39/drivers/uio/uio.c 2011-05-19 00:06:34.000000000 -0400
41870+++ linux-2.6.39/drivers/uio/uio.c 2011-05-22 19:36:32.000000000 -0400
c52201e0
MT		 41871@@ -25,6 +25,7 @@
41872 #include <linux/kobject.h>
41873 #include <linux/cdev.h>
41874 #include <linux/uio_driver.h>
41875+#include <asm/local.h>
41876
41877 #define UIO_MAX_DEVICES (1U << MINORBITS)
41878
8308f9c9
MT		 41879@@ -32,10 +33,10 @@ struct uio_device {
41880 struct module *owner;
41881 struct device *dev;
41882 int minor;
41883- atomic_t event;
41884+ atomic_unchecked_t event;
c52201e0
MT		 41885 struct fasync_struct *async_queue;
41886 wait_queue_head_t wait;
41887- int vma_count;
41888+ local_t vma_count;
41889 struct uio_info *info;
41890 struct kobject *map_dir;
41891 struct kobject *portio_dir;
8308f9c9
MT		 41892@@ -242,7 +243,7 @@ static ssize_t show_event(struct device
41893 struct device_attribute *attr, char *buf)
41894 {
41895 struct uio_device *idev = dev_get_drvdata(dev);
41896- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
41897+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
41898 }
41899
41900 static struct device_attribute uio_class_attributes[] = {
41901@@ -402,7 +403,7 @@ void uio_event_notify(struct uio_info *i
41902 {
41903 struct uio_device *idev = info->uio_dev;
41904
41905- atomic_inc(&idev->event);
41906+ atomic_inc_unchecked(&idev->event);
41907 wake_up_interruptible(&idev->wait);
41908 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
41909 }
41910@@ -455,7 +456,7 @@ static int uio_open(struct inode *inode,
41911 }
41912
41913 listener->dev = idev;
41914- listener->event_count = atomic_read(&idev->event);
41915+ listener->event_count = atomic_read_unchecked(&idev->event);
41916 filep->private_data = listener;
41917
41918 if (idev->info->open) {
41919@@ -506,7 +507,7 @@ static unsigned int uio_poll(struct file
41920 return -EIO;
41921
41922 poll_wait(filep, &idev->wait, wait);
41923- if (listener->event_count != atomic_read(&idev->event))
41924+ if (listener->event_count != atomic_read_unchecked(&idev->event))
41925 return POLLIN | POLLRDNORM;
41926 return 0;
41927 }
41928@@ -531,7 +532,7 @@ static ssize_t uio_read(struct file *fil
41929 do {
41930 set_current_state(TASK_INTERRUPTIBLE);
41931
41932- event_count = atomic_read(&idev->event);
41933+ event_count = atomic_read_unchecked(&idev->event);
41934 if (event_count != listener->event_count) {
41935 if (copy_to_user(buf, &event_count, count))
41936 retval = -EFAULT;
c52201e0
MT		 41937@@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
41938 static void uio_vma_open(struct vm_area_struct *vma)
41939 {
41940 struct uio_device *idev = vma->vm_private_data;
41941- idev->vma_count++;
41942+ local_inc(&idev->vma_count);
41943 }
41944
41945 static void uio_vma_close(struct vm_area_struct *vma)
41946 {
41947 struct uio_device *idev = vma->vm_private_data;
41948- idev->vma_count--;
41949+ local_dec(&idev->vma_count);
41950 }
41951
41952 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
8308f9c9
MT		 41953@@ -819,7 +820,7 @@ int __uio_register_device(struct module
41954 idev->owner = owner;
41955 idev->info = info;
41956 init_waitqueue_head(&idev->wait);
41957- atomic_set(&idev->event, 0);
41958+ atomic_set_unchecked(&idev->event, 0);
41959
41960 ret = uio_get_minor(idev);
41961 if (ret)
66a7e928
MT		 41962diff -urNp linux-2.6.39/drivers/usb/atm/cxacru.c linux-2.6.39/drivers/usb/atm/cxacru.c
41963--- linux-2.6.39/drivers/usb/atm/cxacru.c 2011-05-19 00:06:34.000000000 -0400
41964+++ linux-2.6.39/drivers/usb/atm/cxacru.c 2011-05-22 19:36:32.000000000 -0400
6892158b
MT		 41965@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
41966 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
41967 if (ret < 2)
41968 return -EINVAL;
41969- if (index < 0 || index > 0x7f)
41970+ if (index > 0x7f)
41971 return -EINVAL;
41972 pos += tmp;
41973
66a7e928
MT		 41974diff -urNp linux-2.6.39/drivers/usb/atm/usbatm.c linux-2.6.39/drivers/usb/atm/usbatm.c
41975--- linux-2.6.39/drivers/usb/atm/usbatm.c 2011-05-19 00:06:34.000000000 -0400
41976+++ linux-2.6.39/drivers/usb/atm/usbatm.c 2011-05-22 19:36:32.000000000 -0400
6892158b 41977@@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
58c5fc13
MT		 41978 if (printk_ratelimit())
41979 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
41980 __func__, vpi, vci);
41981- atomic_inc(&vcc->stats->rx_err);
41982+ atomic_inc_unchecked(&vcc->stats->rx_err);
41983 return;
41984 }
41985
6892158b 41986@@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
58c5fc13
MT		 41987 if (length > ATM_MAX_AAL5_PDU) {
41988 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
41989 __func__, length, vcc);
41990- atomic_inc(&vcc->stats->rx_err);
41991+ atomic_inc_unchecked(&vcc->stats->rx_err);
41992 goto out;
41993 }
41994
6892158b 41995@@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
58c5fc13
MT		 41996 if (sarb->len < pdu_length) {
41997 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
41998 __func__, pdu_length, sarb->len, vcc);
41999- atomic_inc(&vcc->stats->rx_err);
42000+ atomic_inc_unchecked(&vcc->stats->rx_err);
42001 goto out;
42002 }
42003
42004 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
42005 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
42006 __func__, vcc);
42007- atomic_inc(&vcc->stats->rx_err);
42008+ atomic_inc_unchecked(&vcc->stats->rx_err);
42009 goto out;
42010 }
42011
6892158b 42012@@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
58c5fc13
MT		 42013 if (printk_ratelimit())
42014 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
42015 __func__, length);
42016- atomic_inc(&vcc->stats->rx_drop);
42017+ atomic_inc_unchecked(&vcc->stats->rx_drop);
42018 goto out;
42019 }
42020
6892158b 42021@@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
58c5fc13
MT		 42022
42023 vcc->push(vcc, skb);
42024
42025- atomic_inc(&vcc->stats->rx);
42026+ atomic_inc_unchecked(&vcc->stats->rx);
42027 out:
42028 skb_trim(sarb, 0);
42029 }
6892158b 42030@@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
58c5fc13
MT		 42031 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
42032
42033 usbatm_pop(vcc, skb);
42034- atomic_inc(&vcc->stats->tx);
42035+ atomic_inc_unchecked(&vcc->stats->tx);
42036
42037 skb = skb_dequeue(&instance->sndqueue);
42038 }
6892158b 42039@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
58c5fc13
MT		 42040 if (!left--)
42041 return sprintf(page,
42042 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
42043- atomic_read(&atm_dev->stats.aal5.tx),
42044- atomic_read(&atm_dev->stats.aal5.tx_err),
42045- atomic_read(&atm_dev->stats.aal5.rx),
42046- atomic_read(&atm_dev->stats.aal5.rx_err),
42047- atomic_read(&atm_dev->stats.aal5.rx_drop));
42048+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
42049+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
42050+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
42051+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
42052+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
42053
42054 if (!left--) {
42055 if (instance->disconnected)
66a7e928
MT		 42056diff -urNp linux-2.6.39/drivers/usb/core/devices.c linux-2.6.39/drivers/usb/core/devices.c
42057--- linux-2.6.39/drivers/usb/core/devices.c 2011-05-19 00:06:34.000000000 -0400
42058+++ linux-2.6.39/drivers/usb/core/devices.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 42059@@ -126,7 +126,7 @@ static const char *format_endpt =
42060 * time it gets called.
42061 */
42062 static struct device_connect_event {
42063- atomic_t count;
42064+ atomic_unchecked_t count;
42065 wait_queue_head_t wait;
42066 } device_event = {
42067 .count = ATOMIC_INIT(1),
42068@@ -164,7 +164,7 @@ static const struct class_info clas_info
42069
42070 void usbfs_conn_disc_event(void)
42071 {
42072- atomic_add(2, &device_event.count);
42073+ atomic_add_unchecked(2, &device_event.count);
42074 wake_up(&device_event.wait);
42075 }
42076
42077@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
42078
42079 poll_wait(file, &device_event.wait, wait);
42080
42081- event_count = atomic_read(&device_event.count);
42082+ event_count = atomic_read_unchecked(&device_event.count);
42083 if (file->f_version != event_count) {
42084 file->f_version = event_count;
42085 return POLLIN | POLLRDNORM;
66a7e928
MT		 42086diff -urNp linux-2.6.39/drivers/usb/core/hcd.c linux-2.6.39/drivers/usb/core/hcd.c
42087--- linux-2.6.39/drivers/usb/core/hcd.c 2011-05-19 00:06:34.000000000 -0400
42088+++ linux-2.6.39/drivers/usb/core/hcd.c 2011-05-22 19:36:32.000000000 -0400
42089@@ -2577,7 +2577,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
ae4e228f
MT		 42090
42091 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
42092
42093-struct usb_mon_operations *mon_ops;
42094+const struct usb_mon_operations *mon_ops;
42095
42096 /*
42097 * The registration is unlocked.
66a7e928 42098@@ -2587,7 +2587,7 @@ struct usb_mon_operations *mon_ops;
ae4e228f
MT		 42099 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
42100 */
42101
42102-int usb_mon_register (struct usb_mon_operations *ops)
42103+int usb_mon_register (const struct usb_mon_operations *ops)
42104 {
42105
42106 if (mon_ops)
66a7e928
MT		 42107diff -urNp linux-2.6.39/drivers/usb/core/message.c linux-2.6.39/drivers/usb/core/message.c
42108--- linux-2.6.39/drivers/usb/core/message.c 2011-05-19 00:06:34.000000000 -0400
42109+++ linux-2.6.39/drivers/usb/core/message.c 2011-05-22 19:36:32.000000000 -0400
57199397 42110@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
ae4e228f 42111 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
58c5fc13
MT		 42112 if (buf) {
42113 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
42114- if (len > 0) {
ae4e228f 42115- smallbuf = kmalloc(++len, GFP_NOIO);
58c5fc13 42116+ if (len++ > 0) {
ae4e228f 42117+ smallbuf = kmalloc(len, GFP_NOIO);
58c5fc13
MT		 42118 if (!smallbuf)
42119 return buf;
42120 memcpy(smallbuf, buf, len);
66a7e928
MT		 42121diff -urNp linux-2.6.39/drivers/usb/early/ehci-dbgp.c linux-2.6.39/drivers/usb/early/ehci-dbgp.c
42122--- linux-2.6.39/drivers/usb/early/ehci-dbgp.c 2011-05-19 00:06:34.000000000 -0400
42123+++ linux-2.6.39/drivers/usb/early/ehci-dbgp.c 2011-05-22 19:36:32.000000000 -0400
16454cff 42124@@ -96,7 +96,7 @@ static inline u32 dbgp_len_update(u32 x,
6892158b
MT		 42125 }
42126
42127 #ifdef CONFIG_KGDB
16454cff
MT		 42128-static struct kgdb_io kgdbdbgp_io_ops;
42129+static struct kgdb_io kgdbdbgp_io_ops; /* cannot be const, see kgdbdbgp_parse_config */
6892158b
MT		 42130 #define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
42131 #else
16454cff
MT		 42132 #define dbgp_kgdb_mode (0)
42133@@ -1026,7 +1026,7 @@ static void kgdbdbgp_write_char(u8 chr)
57199397
MT		 42134 early_dbgp_write(NULL, &chr, 1);
42135 }
42136
16454cff
MT		 42137-static struct kgdb_io kgdbdbgp_io_ops = {
42138+static struct kgdb_io kgdbdbgp_io_ops = { /* cannot be const, see kgdbdbgp_parse_config() */
57199397
MT		 42139 .name = "kgdbdbgp",
42140 .read_char = kgdbdbgp_read_char,
16454cff 42141 .write_char = kgdbdbgp_write_char,
66a7e928
MT		 42142diff -urNp linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c
42143--- linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c 2011-05-19 00:06:34.000000000 -0400
42144+++ linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c 2011-05-22 19:36:32.000000000 -0400
42145@@ -1859,7 +1859,7 @@ out:
42146 return status;
42147 }
42148
42149-static struct usb_ep_ops qe_ep_ops = {
42150+static const struct usb_ep_ops qe_ep_ops = {
42151 .enable = qe_ep_enable,
42152 .disable = qe_ep_disable,
42153
42154@@ -1928,7 +1928,7 @@ static int qe_pullup(struct usb_gadget *
42155 }
42156
42157 /* defined in usb_gadget.h */
42158-static struct usb_gadget_ops qe_gadget_ops = {
42159+static const struct usb_gadget_ops qe_gadget_ops = {
42160 .get_frame = qe_get_frame,
42161 .wakeup = qe_wakeup,
42162 /* .set_selfpowered = qe_set_selfpowered,*/ /* always selfpowered */
42163diff -urNp linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c
42164--- linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42165+++ linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42166@@ -1003,7 +1003,7 @@ static void fsl_ep_fifo_flush(struct usb
42167 } while (fsl_readl(&dr_regs->endptstatus) & bits);
42168 }
42169
42170-static struct usb_ep_ops fsl_ep_ops = {
42171+static const struct usb_ep_ops fsl_ep_ops = {
42172 .enable = fsl_ep_enable,
42173 .disable = fsl_ep_disable,
42174
42175@@ -1114,7 +1114,7 @@ static int fsl_pullup(struct usb_gadget
42176 }
42177
42178 /* defined in gadget.h */
42179-static struct usb_gadget_ops fsl_gadget_ops = {
42180+static const struct usb_gadget_ops fsl_gadget_ops = {
42181 .get_frame = fsl_get_frame,
42182 .wakeup = fsl_wakeup,
42183 /* .set_selfpowered = fsl_set_selfpowered, */ /* Always selfpowered */
42184diff -urNp linux-2.6.39/drivers/usb/gadget/fusb300_udc.c linux-2.6.39/drivers/usb/gadget/fusb300_udc.c
42185--- linux-2.6.39/drivers/usb/gadget/fusb300_udc.c 2011-05-19 00:06:34.000000000 -0400
42186+++ linux-2.6.39/drivers/usb/gadget/fusb300_udc.c 2011-05-22 19:36:32.000000000 -0400
42187@@ -527,7 +527,7 @@ static void fusb300_fifo_flush(struct us
42188 {
42189 }
42190
42191-static struct usb_ep_ops fusb300_ep_ops = {
42192+static const struct usb_ep_ops fusb300_ep_ops = {
42193 .enable = fusb300_enable,
42194 .disable = fusb300_disable,
42195
42196@@ -1570,7 +1570,7 @@ static int fusb300_udc_pullup(struct usb
42197 return 0;
42198 }
42199
42200-static struct usb_gadget_ops fusb300_gadget_ops = {
42201+static const struct usb_gadget_ops fusb300_gadget_ops = {
42202 .pullup = fusb300_udc_pullup,
42203 };
42204
42205diff -urNp linux-2.6.39/drivers/usb/gadget/goku_udc.c linux-2.6.39/drivers/usb/gadget/goku_udc.c
42206--- linux-2.6.39/drivers/usb/gadget/goku_udc.c 2011-05-19 00:06:34.000000000 -0400
42207+++ linux-2.6.39/drivers/usb/gadget/goku_udc.c 2011-05-22 19:36:32.000000000 -0400
42208@@ -973,7 +973,7 @@ static void goku_fifo_flush(struct usb_e
42209 command(regs, COMMAND_FIFO_CLEAR, ep->num);
42210 }
42211
42212-static struct usb_ep_ops goku_ep_ops = {
42213+static const struct usb_ep_ops goku_ep_ops = {
42214 .enable = goku_ep_enable,
42215 .disable = goku_ep_disable,
42216
42217diff -urNp linux-2.6.39/drivers/usb/gadget/imx_udc.c linux-2.6.39/drivers/usb/gadget/imx_udc.c
42218--- linux-2.6.39/drivers/usb/gadget/imx_udc.c 2011-05-19 00:06:34.000000000 -0400
42219+++ linux-2.6.39/drivers/usb/gadget/imx_udc.c 2011-05-22 19:36:32.000000000 -0400
42220@@ -937,7 +937,7 @@ static void imx_ep_fifo_flush(struct usb
42221 local_irq_restore(flags);
42222 }
42223
42224-static struct usb_ep_ops imx_ep_ops = {
42225+static const struct usb_ep_ops imx_ep_ops = {
42226 .enable = imx_ep_enable,
42227 .disable = imx_ep_disable,
42228
42229diff -urNp linux-2.6.39/drivers/usb/gadget/m66592-udc.c linux-2.6.39/drivers/usb/gadget/m66592-udc.c
42230--- linux-2.6.39/drivers/usb/gadget/m66592-udc.c 2011-05-19 00:06:34.000000000 -0400
42231+++ linux-2.6.39/drivers/usb/gadget/m66592-udc.c 2011-05-22 19:36:32.000000000 -0400
42232@@ -1437,7 +1437,7 @@ static void m66592_fifo_flush(struct usb
42233 spin_unlock_irqrestore(&ep->m66592->lock, flags);
42234 }
42235
42236-static struct usb_ep_ops m66592_ep_ops = {
42237+static const struct usb_ep_ops m66592_ep_ops = {
42238 .enable = m66592_enable,
42239 .disable = m66592_disable,
42240
42241@@ -1542,7 +1542,7 @@ static int m66592_get_frame(struct usb_g
42242 return m66592_read(m66592, M66592_FRMNUM) & 0x03FF;
42243 }
42244
42245-static struct usb_gadget_ops m66592_gadget_ops = {
42246+static const struct usb_gadget_ops m66592_gadget_ops = {
42247 .get_frame = m66592_get_frame,
42248 };
42249
42250diff -urNp linux-2.6.39/drivers/usb/gadget/mv_udc_core.c linux-2.6.39/drivers/usb/gadget/mv_udc_core.c
42251--- linux-2.6.39/drivers/usb/gadget/mv_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42252+++ linux-2.6.39/drivers/usb/gadget/mv_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42253@@ -972,7 +972,7 @@ static int mv_ep_set_wedge(struct usb_ep
42254 return mv_ep_set_halt_wedge(_ep, 1, 1);
42255 }
42256
42257-static struct usb_ep_ops mv_ep_ops = {
42258+static const struct usb_ep_ops mv_ep_ops = {
42259 .enable = mv_ep_enable,
42260 .disable = mv_ep_disable,
42261
42262diff -urNp linux-2.6.39/drivers/usb/gadget/omap_udc.c linux-2.6.39/drivers/usb/gadget/omap_udc.c
42263--- linux-2.6.39/drivers/usb/gadget/omap_udc.c 2011-05-19 00:06:34.000000000 -0400
42264+++ linux-2.6.39/drivers/usb/gadget/omap_udc.c 2011-05-22 19:36:32.000000000 -0400
42265@@ -1177,7 +1177,7 @@ done:
42266 return status;
42267 }
42268
42269-static struct usb_ep_ops omap_ep_ops = {
42270+static const struct usb_ep_ops omap_ep_ops = {
42271 .enable = omap_ep_enable,
42272 .disable = omap_ep_disable,
42273
42274@@ -1374,7 +1374,7 @@ static int omap_pullup(struct usb_gadget
42275 return 0;
42276 }
42277
42278-static struct usb_gadget_ops omap_gadget_ops = {
42279+static const struct usb_gadget_ops omap_gadget_ops = {
42280 .get_frame = omap_get_frame,
42281 .wakeup = omap_wakeup,
42282 .set_selfpowered = omap_set_selfpowered,
42283diff -urNp linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c
42284--- linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c 2011-05-19 00:06:34.000000000 -0400
42285+++ linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c 2011-05-22 19:36:32.000000000 -0400
42286@@ -896,7 +896,7 @@ static void pxa25x_ep_fifo_flush(struct
42287 }
42288
42289
42290-static struct usb_ep_ops pxa25x_ep_ops = {
42291+static const struct usb_ep_ops pxa25x_ep_ops = {
42292 .enable = pxa25x_ep_enable,
42293 .disable = pxa25x_ep_disable,
42294
42295diff -urNp linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c
42296--- linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c 2011-05-19 00:06:34.000000000 -0400
42297+++ linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c 2011-05-22 19:36:32.000000000 -0400
42298@@ -1491,7 +1491,7 @@ static int pxa_ep_disable(struct usb_ep
42299 return 0;
42300 }
42301
42302-static struct usb_ep_ops pxa_ep_ops = {
42303+static const struct usb_ep_ops pxa_ep_ops = {
42304 .enable = pxa_ep_enable,
42305 .disable = pxa_ep_disable,
42306
42307diff -urNp linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c
42308--- linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c 2011-05-19 00:06:34.000000000 -0400
42309+++ linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c 2011-05-22 19:36:32.000000000 -0400
42310@@ -1392,7 +1392,7 @@ static void r8a66597_fifo_flush(struct u
42311 spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
42312 }
42313
42314-static struct usb_ep_ops r8a66597_ep_ops = {
42315+static const struct usb_ep_ops r8a66597_ep_ops = {
42316 .enable = r8a66597_enable,
42317 .disable = r8a66597_disable,
42318
42319@@ -1497,7 +1497,7 @@ static int r8a66597_get_frame(struct usb
42320 return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
42321 }
42322
42323-static struct usb_gadget_ops r8a66597_gadget_ops = {
42324+static const struct usb_gadget_ops r8a66597_gadget_ops = {
42325 .get_frame = r8a66597_get_frame,
42326 };
42327
42328diff -urNp linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c
42329--- linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c 2011-05-19 00:06:34.000000000 -0400
42330+++ linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c 2011-05-22 19:36:32.000000000 -0400
42331@@ -2461,7 +2461,7 @@ static int s3c_hsotg_ep_sethalt(struct u
42332 return 0;
42333 }
42334
42335-static struct usb_ep_ops s3c_hsotg_ep_ops = {
42336+static const struct usb_ep_ops s3c_hsotg_ep_ops = {
42337 .enable = s3c_hsotg_ep_enable,
42338 .disable = s3c_hsotg_ep_disable,
42339 .alloc_request = s3c_hsotg_ep_alloc_request,
42340@@ -2725,7 +2725,7 @@ static int s3c_hsotg_gadget_getframe(str
42341 return s3c_hsotg_read_frameno(to_hsotg(gadget));
42342 }
42343
42344-static struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42345+static const struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42346 .get_frame = s3c_hsotg_gadget_getframe,
42347 };
42348
42349diff -urNp linux-2.6.39/drivers/usb/gadget/uvc_queue.c linux-2.6.39/drivers/usb/gadget/uvc_queue.c
42350--- linux-2.6.39/drivers/usb/gadget/uvc_queue.c 2011-05-19 00:06:34.000000000 -0400
42351+++ linux-2.6.39/drivers/usb/gadget/uvc_queue.c 2011-05-22 19:36:32.000000000 -0400
42352@@ -400,7 +400,7 @@ static void uvc_vm_close(struct vm_area_
42353 buffer->vma_use_count--;
42354 }
42355
42356-static struct vm_operations_struct uvc_vm_ops = {
42357+static const struct vm_operations_struct uvc_vm_ops = {
42358 .open = uvc_vm_open,
42359 .close = uvc_vm_close,
42360 };
42361diff -urNp linux-2.6.39/drivers/usb/host/ehci-fsl.c linux-2.6.39/drivers/usb/host/ehci-fsl.c
42362--- linux-2.6.39/drivers/usb/host/ehci-fsl.c 2011-05-19 00:06:34.000000000 -0400
42363+++ linux-2.6.39/drivers/usb/host/ehci-fsl.c 2011-05-22 19:36:32.000000000 -0400
42364@@ -380,7 +380,7 @@ static int ehci_fsl_drv_restore(struct d
42365 return 0;
42366 }
42367
42368-static struct dev_pm_ops ehci_fsl_pm_ops = {
42369+static const struct dev_pm_ops ehci_fsl_pm_ops = {
42370 .suspend = ehci_fsl_drv_suspend,
42371 .resume = ehci_fsl_drv_resume,
42372 .restore = ehci_fsl_drv_restore,
42373diff -urNp linux-2.6.39/drivers/usb/host/xhci-mem.c linux-2.6.39/drivers/usb/host/xhci-mem.c
42374--- linux-2.6.39/drivers/usb/host/xhci-mem.c 2011-05-19 00:06:34.000000000 -0400
42375+++ linux-2.6.39/drivers/usb/host/xhci-mem.c 2011-05-22 19:36:32.000000000 -0400
42376@@ -1671,6 +1671,8 @@ static int xhci_check_trb_in_td_math(str
42377 unsigned int num_tests;
42378 int i, ret;
42379
42380+ pax_track_stack();
42381+
42382 num_tests = ARRAY_SIZE(simple_test_vector);
42383 for (i = 0; i < num_tests; i++) {
42384 ret = xhci_test_trb_in_td(xhci,
42385diff -urNp linux-2.6.39/drivers/usb/mon/mon_main.c linux-2.6.39/drivers/usb/mon/mon_main.c
42386--- linux-2.6.39/drivers/usb/mon/mon_main.c 2011-05-19 00:06:34.000000000 -0400
42387+++ linux-2.6.39/drivers/usb/mon/mon_main.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 42388@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
ae4e228f
MT		 42389 /*
42390 * Ops
42391 */
42392-static struct usb_mon_operations mon_ops_0 = {
42393+static const struct usb_mon_operations mon_ops_0 = {
42394 .urb_submit = mon_submit,
42395 .urb_submit_error = mon_submit_error,
42396 .urb_complete = mon_complete,
66a7e928
MT		 42397diff -urNp linux-2.6.39/drivers/usb/musb/cppi_dma.h linux-2.6.39/drivers/usb/musb/cppi_dma.h
42398--- linux-2.6.39/drivers/usb/musb/cppi_dma.h 2011-05-19 00:06:34.000000000 -0400
42399+++ linux-2.6.39/drivers/usb/musb/cppi_dma.h 2011-05-22 19:36:32.000000000 -0400
42400@@ -113,7 +113,7 @@ struct cppi_channel {
42401
42402 /* CPPI DMA controller object */
42403 struct cppi {
42404- struct dma_controller controller;
42405+ const struct dma_controller controller;
42406 struct musb *musb;
42407 void __iomem *mregs; /* Mentor regs */
42408 void __iomem *tibase; /* TI/CPPI regs */
42409diff -urNp linux-2.6.39/drivers/usb/otg/msm_otg.c linux-2.6.39/drivers/usb/otg/msm_otg.c
42410--- linux-2.6.39/drivers/usb/otg/msm_otg.c 2011-05-19 00:06:34.000000000 -0400
42411+++ linux-2.6.39/drivers/usb/otg/msm_otg.c 2011-05-22 19:36:32.000000000 -0400
42412@@ -95,7 +95,7 @@ static int ulpi_write(struct otg_transce
42413 return 0;
42414 }
42415
42416-static struct otg_io_access_ops msm_otg_io_ops = {
42417+static const struct otg_io_access_ops msm_otg_io_ops = {
42418 .read = ulpi_read,
42419 .write = ulpi_write,
42420 };
42421diff -urNp linux-2.6.39/drivers/usb/otg/ulpi_viewport.c linux-2.6.39/drivers/usb/otg/ulpi_viewport.c
42422--- linux-2.6.39/drivers/usb/otg/ulpi_viewport.c 2011-05-19 00:06:34.000000000 -0400
42423+++ linux-2.6.39/drivers/usb/otg/ulpi_viewport.c 2011-05-22 19:36:32.000000000 -0400
42424@@ -74,7 +74,7 @@ static int ulpi_viewport_write(struct ot
42425 return ulpi_viewport_wait(view, ULPI_VIEW_RUN);
42426 }
42427
42428-struct otg_io_access_ops ulpi_viewport_access_ops = {
42429+const struct otg_io_access_ops ulpi_viewport_access_ops = {
42430 .read = ulpi_viewport_read,
42431 .write = ulpi_viewport_write,
42432 };
42433diff -urNp linux-2.6.39/drivers/usb/serial/ftdi_sio.c linux-2.6.39/drivers/usb/serial/ftdi_sio.c
42434--- linux-2.6.39/drivers/usb/serial/ftdi_sio.c 2011-05-19 00:06:34.000000000 -0400
42435+++ linux-2.6.39/drivers/usb/serial/ftdi_sio.c 2011-05-22 19:36:32.000000000 -0400
42436@@ -104,27 +104,27 @@ static int ftdi_stmclite_probe(struct
42437 static void ftdi_USB_UIRT_setup(struct ftdi_private *priv);
42438 static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
42439
42440-static struct ftdi_sio_quirk ftdi_jtag_quirk = {
42441+static const struct ftdi_sio_quirk ftdi_jtag_quirk = {
42442 .probe = ftdi_jtag_probe,
42443 };
42444
42445-static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42446+static const struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42447 .probe = ftdi_mtxorb_hack_setup,
42448 };
42449
42450-static struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42451+static const struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42452 .probe = ftdi_NDI_device_setup,
42453 };
42454
42455-static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42456+static const struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42457 .port_probe = ftdi_USB_UIRT_setup,
42458 };
42459
42460-static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42461+static const struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42462 .port_probe = ftdi_HE_TIRA1_setup,
42463 };
42464
42465-static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42466+static const struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42467 .probe = ftdi_stmclite_probe,
42468 };
42469
42470diff -urNp linux-2.6.39/drivers/usb/wusbcore/wa-hc.h linux-2.6.39/drivers/usb/wusbcore/wa-hc.h
42471--- linux-2.6.39/drivers/usb/wusbcore/wa-hc.h 2011-05-19 00:06:34.000000000 -0400
42472+++ linux-2.6.39/drivers/usb/wusbcore/wa-hc.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 42473@@ -192,7 +192,7 @@ struct wahc {
42474 struct list_head xfer_delayed_list;
42475 spinlock_t xfer_list_lock;
42476 struct work_struct xfer_work;
42477- atomic_t xfer_id_count;
42478+ atomic_unchecked_t xfer_id_count;
42479 };
42480
42481
42482@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
42483 INIT_LIST_HEAD(&wa->xfer_delayed_list);
42484 spin_lock_init(&wa->xfer_list_lock);
42485 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
42486- atomic_set(&wa->xfer_id_count, 1);
42487+ atomic_set_unchecked(&wa->xfer_id_count, 1);
42488 }
42489
42490 /**
66a7e928
MT		 42491diff -urNp linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c
42492--- linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c 2011-05-19 00:06:34.000000000 -0400
42493+++ linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 42494@@ -294,7 +294,7 @@ out:
42495 */
42496 static void wa_xfer_id_init(struct wa_xfer *xfer)
42497 {
42498- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
42499+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
42500 }
42501
42502 /*
66a7e928
MT		 42503diff -urNp linux-2.6.39/drivers/vhost/vhost.c linux-2.6.39/drivers/vhost/vhost.c
42504--- linux-2.6.39/drivers/vhost/vhost.c 2011-05-19 00:06:34.000000000 -0400
42505+++ linux-2.6.39/drivers/vhost/vhost.c 2011-05-22 19:36:32.000000000 -0400
42506@@ -580,7 +580,7 @@ static int init_used(struct vhost_virtqu
57199397
MT		 42507 return get_user(vq->last_used_idx, &used->idx);
42508 }
42509
42510-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
42511+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
42512 {
42513 struct file *eventfp, *filep = NULL,
42514 *pollstart = NULL, *pollstop = NULL;
66a7e928
MT		 42515diff -urNp linux-2.6.39/drivers/video/backlight/corgi_lcd.c linux-2.6.39/drivers/video/backlight/corgi_lcd.c
42516--- linux-2.6.39/drivers/video/backlight/corgi_lcd.c 2011-05-19 00:06:34.000000000 -0400
42517+++ linux-2.6.39/drivers/video/backlight/corgi_lcd.c 2011-05-22 19:36:32.000000000 -0400
42518@@ -383,7 +383,7 @@ static int corgi_lcd_get_power(struct lc
42519 return lcd->power;
42520 }
42521
42522-static struct lcd_ops corgi_lcd_ops = {
42523+static const struct lcd_ops corgi_lcd_ops = {
42524 .get_power = corgi_lcd_get_power,
42525 .set_power = corgi_lcd_set_power,
42526 .set_mode = corgi_lcd_set_mode,
42527diff -urNp linux-2.6.39/drivers/video/backlight/cr_bllcd.c linux-2.6.39/drivers/video/backlight/cr_bllcd.c
42528--- linux-2.6.39/drivers/video/backlight/cr_bllcd.c 2011-05-19 00:06:34.000000000 -0400
42529+++ linux-2.6.39/drivers/video/backlight/cr_bllcd.c 2011-05-22 19:36:32.000000000 -0400
42530@@ -165,7 +165,7 @@ static int cr_lcd_set_power(struct lcd_d
42531 return 0;
42532 }
42533
42534-static struct lcd_ops cr_lcd_ops = {
42535+static const struct lcd_ops cr_lcd_ops = {
42536 .set_power = cr_lcd_set_power,
42537 };
42538
42539diff -urNp linux-2.6.39/drivers/video/backlight/ili9320.c linux-2.6.39/drivers/video/backlight/ili9320.c
42540--- linux-2.6.39/drivers/video/backlight/ili9320.c 2011-05-19 00:06:34.000000000 -0400
42541+++ linux-2.6.39/drivers/video/backlight/ili9320.c 2011-05-22 19:36:32.000000000 -0400
42542@@ -166,7 +166,7 @@ static int ili9320_get_power(struct lcd_
42543 return lcd->power;
42544 }
42545
42546-static struct lcd_ops ili9320_ops = {
42547+static const struct lcd_ops ili9320_ops = {
42548 .get_power = ili9320_get_power,
42549 .set_power = ili9320_set_power,
42550 };
42551diff -urNp linux-2.6.39/drivers/video/backlight/jornada720_lcd.c linux-2.6.39/drivers/video/backlight/jornada720_lcd.c
42552--- linux-2.6.39/drivers/video/backlight/jornada720_lcd.c 2011-05-19 00:06:34.000000000 -0400
42553+++ linux-2.6.39/drivers/video/backlight/jornada720_lcd.c 2011-05-22 19:36:32.000000000 -0400
42554@@ -87,7 +87,7 @@ static int jornada_lcd_set_power(struct
42555 return 0;
42556 }
42557
42558-static struct lcd_ops jornada_lcd_props = {
42559+static const struct lcd_ops jornada_lcd_props = {
42560 .get_contrast = jornada_lcd_get_contrast,
42561 .set_contrast = jornada_lcd_set_contrast,
42562 .get_power = jornada_lcd_get_power,
42563diff -urNp linux-2.6.39/drivers/video/backlight/l4f00242t03.c linux-2.6.39/drivers/video/backlight/l4f00242t03.c
42564--- linux-2.6.39/drivers/video/backlight/l4f00242t03.c 2011-05-19 00:06:34.000000000 -0400
42565+++ linux-2.6.39/drivers/video/backlight/l4f00242t03.c 2011-05-22 19:36:32.000000000 -0400
42566@@ -149,7 +149,7 @@ static int l4f00242t03_lcd_power_set(str
42567 return 0;
42568 }
42569
42570-static struct lcd_ops l4f_ops = {
42571+static const struct lcd_ops l4f_ops = {
42572 .set_power = l4f00242t03_lcd_power_set,
42573 .get_power = l4f00242t03_lcd_power_get,
42574 };
42575diff -urNp linux-2.6.39/drivers/video/backlight/lcd.c linux-2.6.39/drivers/video/backlight/lcd.c
42576--- linux-2.6.39/drivers/video/backlight/lcd.c 2011-05-19 00:06:34.000000000 -0400
42577+++ linux-2.6.39/drivers/video/backlight/lcd.c 2011-05-22 19:36:32.000000000 -0400
42578@@ -192,7 +192,7 @@ static struct device_attribute lcd_devic
42579 * or a pointer to the newly allocated device.
42580 */
42581 struct lcd_device *lcd_device_register(const char *name, struct device *parent,
42582- void *devdata, struct lcd_ops *ops)
42583+ void *devdata, const struct lcd_ops *ops)
42584 {
42585 struct lcd_device *new_ld;
42586 int rc;
42587diff -urNp linux-2.6.39/drivers/video/backlight/ld9040.c linux-2.6.39/drivers/video/backlight/ld9040.c
42588--- linux-2.6.39/drivers/video/backlight/ld9040.c 2011-05-19 00:06:34.000000000 -0400
42589+++ linux-2.6.39/drivers/video/backlight/ld9040.c 2011-05-22 19:36:32.000000000 -0400
42590@@ -651,7 +651,7 @@ static int ld9040_set_brightness(struct
42591 return ret;
42592 }
42593
42594-static struct lcd_ops ld9040_lcd_ops = {
42595+static const struct lcd_ops ld9040_lcd_ops = {
42596 .set_power = ld9040_set_power,
42597 .get_power = ld9040_get_power,
42598 };
42599diff -urNp linux-2.6.39/drivers/video/backlight/lms283gf05.c linux-2.6.39/drivers/video/backlight/lms283gf05.c
42600--- linux-2.6.39/drivers/video/backlight/lms283gf05.c 2011-05-19 00:06:34.000000000 -0400
42601+++ linux-2.6.39/drivers/video/backlight/lms283gf05.c 2011-05-22 19:36:32.000000000 -0400
42602@@ -144,7 +144,7 @@ static int lms283gf05_power_set(struct l
42603 return 0;
42604 }
42605
42606-static struct lcd_ops lms_ops = {
42607+static const struct lcd_ops lms_ops = {
42608 .set_power = lms283gf05_power_set,
42609 .get_power = NULL,
42610 };
42611diff -urNp linux-2.6.39/drivers/video/backlight/ltv350qv.c linux-2.6.39/drivers/video/backlight/ltv350qv.c
42612--- linux-2.6.39/drivers/video/backlight/ltv350qv.c 2011-05-19 00:06:34.000000000 -0400
42613+++ linux-2.6.39/drivers/video/backlight/ltv350qv.c 2011-05-22 19:36:32.000000000 -0400
42614@@ -221,7 +221,7 @@ static int ltv350qv_get_power(struct lcd
42615 return lcd->power;
42616 }
42617
42618-static struct lcd_ops ltv_ops = {
42619+static const struct lcd_ops ltv_ops = {
42620 .get_power = ltv350qv_get_power,
42621 .set_power = ltv350qv_set_power,
42622 };
42623diff -urNp linux-2.6.39/drivers/video/backlight/platform_lcd.c linux-2.6.39/drivers/video/backlight/platform_lcd.c
42624--- linux-2.6.39/drivers/video/backlight/platform_lcd.c 2011-05-19 00:06:34.000000000 -0400
42625+++ linux-2.6.39/drivers/video/backlight/platform_lcd.c 2011-05-22 19:36:32.000000000 -0400
42626@@ -66,7 +66,7 @@ static int platform_lcd_match(struct lcd
42627 return plcd->us->parent == info->device;
42628 }
42629
42630-static struct lcd_ops platform_lcd_ops = {
42631+static const struct lcd_ops platform_lcd_ops = {
42632 .get_power = platform_lcd_get_power,
42633 .set_power = platform_lcd_set_power,
42634 .check_fb = platform_lcd_match,
42635diff -urNp linux-2.6.39/drivers/video/backlight/s6e63m0.c linux-2.6.39/drivers/video/backlight/s6e63m0.c
42636--- linux-2.6.39/drivers/video/backlight/s6e63m0.c 2011-05-19 00:06:34.000000000 -0400
42637+++ linux-2.6.39/drivers/video/backlight/s6e63m0.c 2011-05-22 19:36:32.000000000 -0400
42638@@ -644,7 +644,7 @@ static int s6e63m0_set_brightness(struct
42639 return ret;
42640 }
42641
42642-static struct lcd_ops s6e63m0_lcd_ops = {
42643+static const struct lcd_ops s6e63m0_lcd_ops = {
42644 .set_power = s6e63m0_set_power,
42645 .get_power = s6e63m0_get_power,
42646 };
42647diff -urNp linux-2.6.39/drivers/video/backlight/tdo24m.c linux-2.6.39/drivers/video/backlight/tdo24m.c
42648--- linux-2.6.39/drivers/video/backlight/tdo24m.c 2011-05-19 00:06:34.000000000 -0400
42649+++ linux-2.6.39/drivers/video/backlight/tdo24m.c 2011-05-22 19:36:32.000000000 -0400
42650@@ -322,7 +322,7 @@ static int tdo24m_set_mode(struct lcd_de
42651 return lcd->adj_mode(lcd, mode);
42652 }
42653
42654-static struct lcd_ops tdo24m_ops = {
42655+static const struct lcd_ops tdo24m_ops = {
42656 .get_power = tdo24m_get_power,
42657 .set_power = tdo24m_set_power,
42658 .set_mode = tdo24m_set_mode,
42659diff -urNp linux-2.6.39/drivers/video/backlight/tosa_lcd.c linux-2.6.39/drivers/video/backlight/tosa_lcd.c
42660--- linux-2.6.39/drivers/video/backlight/tosa_lcd.c 2011-05-19 00:06:34.000000000 -0400
42661+++ linux-2.6.39/drivers/video/backlight/tosa_lcd.c 2011-05-22 19:36:32.000000000 -0400
42662@@ -163,7 +163,7 @@ static int tosa_lcd_set_mode(struct lcd_
42663 return 0;
42664 }
42665
42666-static struct lcd_ops tosa_lcd_ops = {
42667+static const struct lcd_ops tosa_lcd_ops = {
42668 .set_power = tosa_lcd_set_power,
42669 .get_power = tosa_lcd_get_power,
42670 .set_mode = tosa_lcd_set_mode,
42671diff -urNp linux-2.6.39/drivers/video/bf537-lq035.c linux-2.6.39/drivers/video/bf537-lq035.c
42672--- linux-2.6.39/drivers/video/bf537-lq035.c 2011-05-19 00:06:34.000000000 -0400
42673+++ linux-2.6.39/drivers/video/bf537-lq035.c 2011-05-22 19:36:32.000000000 -0400
42674@@ -682,7 +682,7 @@ static int bfin_lcd_check_fb(struct lcd_
42675 return 0;
42676 }
42677
42678-static struct lcd_ops bfin_lcd_ops = {
42679+static const struct lcd_ops bfin_lcd_ops = {
42680 .get_power = bfin_lcd_get_power,
42681 .set_power = bfin_lcd_set_power,
42682 .get_contrast = bfin_lcd_get_contrast,
42683diff -urNp linux-2.6.39/drivers/video/bf54x-lq043fb.c linux-2.6.39/drivers/video/bf54x-lq043fb.c
42684--- linux-2.6.39/drivers/video/bf54x-lq043fb.c 2011-05-19 00:06:34.000000000 -0400
42685+++ linux-2.6.39/drivers/video/bf54x-lq043fb.c 2011-05-22 19:36:32.000000000 -0400
42686@@ -467,7 +467,7 @@ static int bfin_lcd_check_fb(struct lcd_
42687 return 0;
42688 }
42689
42690-static struct lcd_ops bfin_lcd_ops = {
42691+static const struct lcd_ops bfin_lcd_ops = {
42692 .get_power = bfin_lcd_get_power,
42693 .set_power = bfin_lcd_set_power,
42694 .get_contrast = bfin_lcd_get_contrast,
42695diff -urNp linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c
42696--- linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c 2011-05-19 00:06:34.000000000 -0400
42697+++ linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c 2011-05-22 19:36:32.000000000 -0400
42698@@ -387,7 +387,7 @@ static int bfin_lcd_check_fb(struct lcd_
42699 return 0;
42700 }
42701
42702-static struct lcd_ops bfin_lcd_ops = {
42703+static const struct lcd_ops bfin_lcd_ops = {
42704 .get_power = bfin_lcd_get_power,
42705 .set_power = bfin_lcd_set_power,
42706 .get_contrast = bfin_lcd_get_contrast,
42707diff -urNp linux-2.6.39/drivers/video/fbcmap.c linux-2.6.39/drivers/video/fbcmap.c
42708--- linux-2.6.39/drivers/video/fbcmap.c 2011-05-19 00:06:34.000000000 -0400
42709+++ linux-2.6.39/drivers/video/fbcmap.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 42710@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
df50ba0c
MT		 42711 rc = -ENODEV;
42712 goto out;
42713 }
42714- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
42715- !info->fbops->fb_setcmap)) {
42716+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
42717 rc = -EINVAL;
42718 goto out1;
42719 }
66a7e928
MT		 42720diff -urNp linux-2.6.39/drivers/video/fbmem.c linux-2.6.39/drivers/video/fbmem.c
42721--- linux-2.6.39/drivers/video/fbmem.c 2011-05-19 00:06:34.000000000 -0400
42722+++ linux-2.6.39/drivers/video/fbmem.c 2011-05-22 19:36:32.000000000 -0400
42723@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
58c5fc13
MT		 42724 image->dx += image->width + 8;
42725 }
42726 } else if (rotate == FB_ROTATE_UD) {
42727- for (x = 0; x < num && image->dx >= 0; x++) {
42728+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
42729 info->fbops->fb_imageblit(info, image);
42730 image->dx -= image->width + 8;
42731 }
66a7e928 42732@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
58c5fc13
MT		 42733 image->dy += image->height + 8;
42734 }
42735 } else if (rotate == FB_ROTATE_CCW) {
42736- for (x = 0; x < num && image->dy >= 0; x++) {
42737+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
42738 info->fbops->fb_imageblit(info, image);
42739 image->dy -= image->height + 8;
42740 }
66a7e928
MT		 42741@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
42742 int flags = info->flags;
42743 int ret = 0;
42744
42745+ pax_track_stack();
42746+
42747 if (var->activate & FB_ACTIVATE_INV_MODE) {
42748 struct fb_videomode mode1, mode2;
42749
42750@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
42751 void __user *argp = (void __user *)arg;
42752 long ret = 0;
42753
42754+ pax_track_stack();
42755+
42756 switch (cmd) {
42757 case FBIOGET_VSCREENINFO:
42758 if (!lock_fb_info(info))
42759@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
58c5fc13
MT		 42760 return -EFAULT;
42761 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
42762 return -EINVAL;
42763- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
42764+ if (con2fb.framebuffer >= FB_MAX)
42765 return -EINVAL;
42766 if (!registered_fb[con2fb.framebuffer])
42767 request_module("fb%d", con2fb.framebuffer);
66a7e928
MT		 42768diff -urNp linux-2.6.39/drivers/video/geode/display_gx1.c linux-2.6.39/drivers/video/geode/display_gx1.c
42769--- linux-2.6.39/drivers/video/geode/display_gx1.c 2011-05-19 00:06:34.000000000 -0400
42770+++ linux-2.6.39/drivers/video/geode/display_gx1.c 2011-05-22 19:36:32.000000000 -0400
42771@@ -208,7 +208,7 @@ static void gx1_set_hw_palette_reg(struc
42772 writel(val, par->dc_regs + DC_PAL_DATA);
42773 }
42774
42775-struct geode_dc_ops gx1_dc_ops = {
42776+const struct geode_dc_ops gx1_dc_ops = {
42777 .set_mode = gx1_set_mode,
42778 .set_palette_reg = gx1_set_hw_palette_reg,
42779 };
42780diff -urNp linux-2.6.39/drivers/video/geode/display_gx1.h linux-2.6.39/drivers/video/geode/display_gx1.h
42781--- linux-2.6.39/drivers/video/geode/display_gx1.h 2011-05-19 00:06:34.000000000 -0400
42782+++ linux-2.6.39/drivers/video/geode/display_gx1.h 2011-05-22 19:36:32.000000000 -0400
42783@@ -18,7 +18,7 @@
42784 unsigned gx1_gx_base(void);
42785 int gx1_frame_buffer_size(void);
42786
42787-extern struct geode_dc_ops gx1_dc_ops;
42788+extern const struct geode_dc_ops gx1_dc_ops;
42789
42790 /* GX1 configuration I/O registers */
42791
42792diff -urNp linux-2.6.39/drivers/video/geode/geodefb.h linux-2.6.39/drivers/video/geode/geodefb.h
42793--- linux-2.6.39/drivers/video/geode/geodefb.h 2011-05-19 00:06:34.000000000 -0400
42794+++ linux-2.6.39/drivers/video/geode/geodefb.h 2011-05-22 19:36:32.000000000 -0400
42795@@ -31,8 +31,8 @@ struct geodefb_par {
42796 int panel_y;
42797 void __iomem *dc_regs;
42798 void __iomem *vid_regs;
42799- struct geode_dc_ops *dc_ops;
42800- struct geode_vid_ops *vid_ops;
42801+ const struct geode_dc_ops *dc_ops;
42802+ const struct geode_vid_ops *vid_ops;
42803 };
42804
42805 #endif /* !__GEODEFB_H__ */
42806diff -urNp linux-2.6.39/drivers/video/geode/video_cs5530.c linux-2.6.39/drivers/video/geode/video_cs5530.c
42807--- linux-2.6.39/drivers/video/geode/video_cs5530.c 2011-05-19 00:06:34.000000000 -0400
42808+++ linux-2.6.39/drivers/video/geode/video_cs5530.c 2011-05-22 19:36:32.000000000 -0400
42809@@ -186,7 +186,7 @@ static int cs5530_blank_display(struct f
42810 return 0;
42811 }
42812
42813-struct geode_vid_ops cs5530_vid_ops = {
42814+const struct geode_vid_ops cs5530_vid_ops = {
42815 .set_dclk = cs5530_set_dclk_frequency,
42816 .configure_display = cs5530_configure_display,
42817 .blank_display = cs5530_blank_display,
42818diff -urNp linux-2.6.39/drivers/video/geode/video_cs5530.h linux-2.6.39/drivers/video/geode/video_cs5530.h
42819--- linux-2.6.39/drivers/video/geode/video_cs5530.h 2011-05-19 00:06:34.000000000 -0400
42820+++ linux-2.6.39/drivers/video/geode/video_cs5530.h 2011-05-22 19:36:32.000000000 -0400
42821@@ -15,7 +15,7 @@
42822 #ifndef __VIDEO_CS5530_H__
42823 #define __VIDEO_CS5530_H__
42824
42825-extern struct geode_vid_ops cs5530_vid_ops;
42826+extern const struct geode_vid_ops cs5530_vid_ops;
42827
42828 /* CS5530 Video device registers */
42829
42830diff -urNp linux-2.6.39/drivers/video/i810/i810_accel.c linux-2.6.39/drivers/video/i810/i810_accel.c
42831--- linux-2.6.39/drivers/video/i810/i810_accel.c 2011-05-19 00:06:34.000000000 -0400
42832+++ linux-2.6.39/drivers/video/i810/i810_accel.c 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 42833@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
42834 }
42835 }
42836 printk("ringbuffer lockup!!!\n");
42837+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
42838 i810_report_error(mmio);
42839 par->dev_flags |= LOCKUP;
42840 info->pixmap.scan_align = 1;
66a7e928
MT		 42841diff -urNp linux-2.6.39/drivers/video/matrox/matroxfb_base.c linux-2.6.39/drivers/video/matrox/matroxfb_base.c
42842--- linux-2.6.39/drivers/video/matrox/matroxfb_base.c 2011-05-19 00:06:34.000000000 -0400
42843+++ linux-2.6.39/drivers/video/matrox/matroxfb_base.c 2011-05-22 19:36:32.000000000 -0400
42844@@ -1232,7 +1232,7 @@ static struct fb_ops matroxfb_ops = {
42845 #define RSText 0x7
42846 #define RSText8 0x8
42847 /* 9-F */
42848-static struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42849+static const struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42850 { { 0, 8, 0}, { 0, 8, 0}, { 0, 8, 0}, { 0, 0, 0}, 8 },
42851 { { 10, 5, 0}, { 5, 5, 0}, { 0, 5, 0}, { 15, 1, 0}, 16 },
42852 { { 11, 5, 0}, { 5, 6, 0}, { 0, 5, 0}, { 0, 0, 0}, 16 },
42853diff -urNp linux-2.6.39/drivers/video/omap/lcd_ams_delta.c linux-2.6.39/drivers/video/omap/lcd_ams_delta.c
42854--- linux-2.6.39/drivers/video/omap/lcd_ams_delta.c 2011-05-19 00:06:34.000000000 -0400
42855+++ linux-2.6.39/drivers/video/omap/lcd_ams_delta.c 2011-05-22 19:36:32.000000000 -0400
42856@@ -87,7 +87,7 @@ static int ams_delta_lcd_get_contrast(st
42857 return ams_delta_lcd & AMS_DELTA_MAX_CONTRAST;
42858 }
42859
42860-static struct lcd_ops ams_delta_lcd_ops = {
42861+static const struct lcd_ops ams_delta_lcd_ops = {
42862 .get_power = ams_delta_lcd_get_power,
42863 .set_power = ams_delta_lcd_set_power,
42864 .get_contrast = ams_delta_lcd_get_contrast,
42865diff -urNp linux-2.6.39/drivers/video/pxa3xx-gcu.c linux-2.6.39/drivers/video/pxa3xx-gcu.c
42866--- linux-2.6.39/drivers/video/pxa3xx-gcu.c 2011-05-19 00:06:34.000000000 -0400
42867+++ linux-2.6.39/drivers/video/pxa3xx-gcu.c 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 42868@@ -103,7 +103,7 @@ struct pxa3xx_gcu_priv {
42869 dma_addr_t shared_phys;
42870 struct resource *resource_mem;
42871 struct miscdevice misc_dev;
42872- struct file_operations misc_fops;
42873+ const struct file_operations misc_fops;
42874 wait_queue_head_t wait_idle;
42875 wait_queue_head_t wait_free;
42876 spinlock_t spinlock;
66a7e928
MT		 42877diff -urNp linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c
42878--- linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c 2011-05-19 00:06:34.000000000 -0400
42879+++ linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c 2011-05-22 19:36:32.000000000 -0400
42880@@ -245,7 +245,7 @@ static unsigned long lcdc_sys_read_data(
42881 return lcdc_read(ch->lcdc, _LDDRDR) & 0x3ffff;
42882 }
42883
42884-struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42885+const struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42886 lcdc_sys_write_index,
42887 lcdc_sys_write_data,
42888 lcdc_sys_read_data,
42889diff -urNp linux-2.6.39/drivers/video/udlfb.c linux-2.6.39/drivers/video/udlfb.c
42890--- linux-2.6.39/drivers/video/udlfb.c 2011-05-19 00:06:34.000000000 -0400
42891+++ linux-2.6.39/drivers/video/udlfb.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 42892@@ -584,11 +584,11 @@ int dlfb_handle_damage(struct dlfb_data
42893 dlfb_urb_completion(urb);
42894
42895 error:
42896- atomic_add(bytes_sent, &dev->bytes_sent);
42897- atomic_add(bytes_identical, &dev->bytes_identical);
42898- atomic_add(width*height*2, &dev->bytes_rendered);
42899+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
42900+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
42901+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
42902 end_cycles = get_cycles();
42903- atomic_add(((unsigned int) ((end_cycles - start_cycles)
42904+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
42905 >> 10)), /* Kcycles */
42906 &dev->cpu_kcycles_used);
42907
42908@@ -709,11 +709,11 @@ static void dlfb_dpy_deferred_io(struct
42909 dlfb_urb_completion(urb);
42910
42911 error:
42912- atomic_add(bytes_sent, &dev->bytes_sent);
42913- atomic_add(bytes_identical, &dev->bytes_identical);
42914- atomic_add(bytes_rendered, &dev->bytes_rendered);
42915+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
42916+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
42917+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
42918 end_cycles = get_cycles();
42919- atomic_add(((unsigned int) ((end_cycles - start_cycles)
42920+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
42921 >> 10)), /* Kcycles */
42922 &dev->cpu_kcycles_used);
42923 }
42924@@ -1301,7 +1301,7 @@ static ssize_t metrics_bytes_rendered_sh
42925 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42926 struct dlfb_data *dev = fb_info->par;
42927 return snprintf(buf, PAGE_SIZE, "%u\n",
42928- atomic_read(&dev->bytes_rendered));
42929+ atomic_read_unchecked(&dev->bytes_rendered));
42930 }
42931
42932 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
42933@@ -1309,7 +1309,7 @@ static ssize_t metrics_bytes_identical_s
42934 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42935 struct dlfb_data *dev = fb_info->par;
42936 return snprintf(buf, PAGE_SIZE, "%u\n",
42937- atomic_read(&dev->bytes_identical));
42938+ atomic_read_unchecked(&dev->bytes_identical));
42939 }
42940
42941 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
42942@@ -1317,7 +1317,7 @@ static ssize_t metrics_bytes_sent_show(s
42943 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42944 struct dlfb_data *dev = fb_info->par;
42945 return snprintf(buf, PAGE_SIZE, "%u\n",
42946- atomic_read(&dev->bytes_sent));
42947+ atomic_read_unchecked(&dev->bytes_sent));
42948 }
42949
42950 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
42951@@ -1325,7 +1325,7 @@ static ssize_t metrics_cpu_kcycles_used_
42952 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42953 struct dlfb_data *dev = fb_info->par;
42954 return snprintf(buf, PAGE_SIZE, "%u\n",
42955- atomic_read(&dev->cpu_kcycles_used));
42956+ atomic_read_unchecked(&dev->cpu_kcycles_used));
42957 }
42958
42959 static ssize_t edid_show(
42960@@ -1382,10 +1382,10 @@ static ssize_t metrics_reset_store(struc
42961 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42962 struct dlfb_data *dev = fb_info->par;
42963
42964- atomic_set(&dev->bytes_rendered, 0);
42965- atomic_set(&dev->bytes_identical, 0);
42966- atomic_set(&dev->bytes_sent, 0);
42967- atomic_set(&dev->cpu_kcycles_used, 0);
42968+ atomic_set_unchecked(&dev->bytes_rendered, 0);
42969+ atomic_set_unchecked(&dev->bytes_identical, 0);
42970+ atomic_set_unchecked(&dev->bytes_sent, 0);
42971+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
42972
42973 return count;
42974 }
66a7e928
MT		 42975diff -urNp linux-2.6.39/drivers/video/uvesafb.c linux-2.6.39/drivers/video/uvesafb.c
42976--- linux-2.6.39/drivers/video/uvesafb.c 2011-05-19 00:06:34.000000000 -0400
42977+++ linux-2.6.39/drivers/video/uvesafb.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 42978@@ -19,6 +19,7 @@
58c5fc13
MT		 42979 #include <linux/io.h>
42980 #include <linux/mutex.h>
df50ba0c 42981 #include <linux/slab.h>
58c5fc13
MT		 42982+#include <linux/moduleloader.h>
42983 #include <video/edid.h>
42984 #include <video/uvesafb.h>
42985 #ifdef CONFIG_X86
df50ba0c 42986@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
58c5fc13
MT		 42987 NULL,
42988 };
42989
42990- return call_usermodehelper(v86d_path, argv, envp, 1);
42991+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
42992 }
42993
42994 /*
df50ba0c 42995@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
58c5fc13
MT		 42996 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
42997 par->pmi_setpal = par->ypan = 0;
42998 } else {
42999+
43000+#ifdef CONFIG_PAX_KERNEXEC
43001+#ifdef CONFIG_MODULES
58c5fc13
MT		 43002+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
43003+#endif
43004+ if (!par->pmi_code) {
43005+ par->pmi_setpal = par->ypan = 0;
43006+ return 0;
43007+ }
43008+#endif
43009+
43010 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
43011 + task->t.regs.edi);
43012+
43013+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
ae4e228f 43014+ pax_open_kernel();
58c5fc13 43015+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
ae4e228f 43016+ pax_close_kernel();
58c5fc13
MT		 43017+
43018+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
43019+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
43020+#else
43021 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
43022 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
43023+#endif
43024+
43025 printk(KERN_INFO "uvesafb: protected mode interface info at "
43026 "%04x:%04x\n",
43027 (u16)task->t.regs.es, (u16)task->t.regs.edi);
66a7e928 43028@@ -1821,6 +1844,11 @@ out:
58c5fc13
MT		 43029 if (par->vbe_modes)
43030 kfree(par->vbe_modes);
43031
43032+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43033+ if (par->pmi_code)
43034+ module_free_exec(NULL, par->pmi_code);
43035+#endif
43036+
43037 framebuffer_release(info);
43038 return err;
43039 }
66a7e928 43040@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
58c5fc13
MT		 43041 kfree(par->vbe_state_orig);
43042 if (par->vbe_state_saved)
43043 kfree(par->vbe_state_saved);
43044+
43045+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43046+ if (par->pmi_code)
43047+ module_free_exec(NULL, par->pmi_code);
43048+#endif
43049+
43050 }
43051
43052 framebuffer_release(info);
66a7e928
MT		 43053@@ -2013,7 +2047,7 @@ static int param_set_scroll(const char *
43054
43055 return 0;
43056 }
43057-static struct kernel_param_ops param_ops_scroll = {
43058+static const struct kernel_param_ops param_ops_scroll = {
43059 .set = param_set_scroll,
43060 };
43061 #define param_check_scroll(name, p) __param_check(name, p, void)
43062diff -urNp linux-2.6.39/drivers/video/vesafb.c linux-2.6.39/drivers/video/vesafb.c
43063--- linux-2.6.39/drivers/video/vesafb.c 2011-05-19 00:06:34.000000000 -0400
43064+++ linux-2.6.39/drivers/video/vesafb.c 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 43065@@ -9,6 +9,7 @@
43066 */
43067
43068 #include <linux/module.h>
43069+#include <linux/moduleloader.h>
43070 #include <linux/kernel.h>
43071 #include <linux/errno.h>
43072 #include <linux/string.h>
df50ba0c 43073@@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
58c5fc13
MT		 43074 static int vram_total __initdata; /* Set total amount of memory */
43075 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
43076 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
43077-static void (*pmi_start)(void) __read_mostly;
43078-static void (*pmi_pal) (void) __read_mostly;
43079+static void (*pmi_start)(void) __read_only;
43080+static void (*pmi_pal) (void) __read_only;
43081 static int depth __read_mostly;
43082 static int vga_compat __read_mostly;
43083 /* --------------------------------------------------------------------- */
df50ba0c 43084@@ -232,6 +233,7 @@ static int __init vesafb_probe(struct pl
58c5fc13
MT		 43085 unsigned int size_vmode;
43086 unsigned int size_remap;
43087 unsigned int size_total;
43088+ void *pmi_code = NULL;
43089
43090 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
43091 return -ENODEV;
df50ba0c 43092@@ -274,10 +276,6 @@ static int __init vesafb_probe(struct pl
58c5fc13
MT		 43093 size_remap = size_total;
43094 vesafb_fix.smem_len = size_remap;
43095
43096-#ifndef __i386__
43097- screen_info.vesapm_seg = 0;
43098-#endif
43099-
43100 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
43101 printk(KERN_WARNING
43102 "vesafb: cannot reserve video memory at 0x%lx\n",
66a7e928 43103@@ -306,9 +304,21 @@ static int __init vesafb_probe(struct pl
58c5fc13
MT		 43104 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
43105 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
43106
43107+#ifdef __i386__
43108+
43109+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43110+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
43111+ if (!pmi_code)
43112+#elif !defined(CONFIG_PAX_KERNEXEC)
43113+ if (0)
43114+#endif
43115+
43116+#endif
43117+ screen_info.vesapm_seg = 0;
43118+
43119 if (screen_info.vesapm_seg) {
43120- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
43121- screen_info.vesapm_seg,screen_info.vesapm_off);
43122+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
43123+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
43124 }
43125
43126 if (screen_info.vesapm_seg < 0xc000)
66a7e928 43127@@ -316,9 +326,25 @@ static int __init vesafb_probe(struct pl
58c5fc13
MT		 43128
43129 if (ypan || pmi_setpal) {
43130 unsigned short *pmi_base;
43131- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43132- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
43133- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
43134+
58c5fc13
MT		 43135+ pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43136+
43137+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
ae4e228f 43138+ pax_open_kernel();
58c5fc13
MT		 43139+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
43140+#else
43141+ pmi_code = pmi_base;
43142+#endif
43143+
43144+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
43145+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
43146+
43147+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43148+ pmi_start = ktva_ktla(pmi_start);
43149+ pmi_pal = ktva_ktla(pmi_pal);
ae4e228f 43150+ pax_close_kernel();
58c5fc13
MT		 43151+#endif
43152+
43153 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
43154 if (pmi_base[3]) {
43155 printk(KERN_INFO "vesafb: pmi: ports = ");
66a7e928 43156@@ -487,6 +513,11 @@ static int __init vesafb_probe(struct pl
58c5fc13
MT		 43157 info->node, info->fix.id);
43158 return 0;
43159 err:
43160+
43161+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43162+ module_free_exec(NULL, pmi_code);
43163+#endif
43164+
43165 if (info->screen_base)
43166 iounmap(info->screen_base);
43167 framebuffer_release(info);
66a7e928
MT		 43168diff -urNp linux-2.6.39/drivers/virtio/virtio_balloon.c linux-2.6.39/drivers/virtio/virtio_balloon.c
43169--- linux-2.6.39/drivers/virtio/virtio_balloon.c 2011-05-19 00:06:34.000000000 -0400
43170+++ linux-2.6.39/drivers/virtio/virtio_balloon.c 2011-05-22 19:36:32.000000000 -0400
43171@@ -176,6 +176,8 @@ static void update_balloon_stats(struct
43172 struct sysinfo i;
43173 int idx = 0;
43174
43175+ pax_track_stack();
43176+
43177 all_vm_events(events);
43178 si_meminfo(&i);
43179
43180diff -urNp linux-2.6.39/drivers/xen/gntalloc.c linux-2.6.39/drivers/xen/gntalloc.c
43181--- linux-2.6.39/drivers/xen/gntalloc.c 2011-05-19 00:06:34.000000000 -0400
43182+++ linux-2.6.39/drivers/xen/gntalloc.c 2011-05-22 19:36:32.000000000 -0400
43183@@ -440,7 +440,7 @@ static void gntalloc_vma_close(struct vm
43184 spin_unlock(&gref_lock);
43185 }
43186
43187-static struct vm_operations_struct gntalloc_vmops = {
43188+static const struct vm_operations_struct gntalloc_vmops = {
43189 .close = gntalloc_vma_close,
43190 };
43191
43192diff -urNp linux-2.6.39/drivers/xen/gntdev.c linux-2.6.39/drivers/xen/gntdev.c
43193--- linux-2.6.39/drivers/xen/gntdev.c 2011-05-19 00:06:34.000000000 -0400
43194+++ linux-2.6.39/drivers/xen/gntdev.c 2011-05-22 19:36:32.000000000 -0400
43195@@ -340,7 +340,7 @@ static void gntdev_vma_close(struct vm_a
43196 gntdev_put_map(map);
43197 }
43198
43199-static struct vm_operations_struct gntdev_vmops = {
43200+static const struct vm_operations_struct gntdev_vmops = {
43201 .close = gntdev_vma_close,
43202 };
43203
43204@@ -404,7 +404,7 @@ static void mn_release(struct mmu_notifi
43205 spin_unlock(&priv->lock);
43206 }
43207
43208-struct mmu_notifier_ops gntdev_mmu_ops = {
43209+const struct mmu_notifier_ops gntdev_mmu_ops = {
43210 .release = mn_release,
43211 .invalidate_page = mn_invl_page,
43212 .invalidate_range_start = mn_invl_range_start,
43213diff -urNp linux-2.6.39/drivers/xen/xenfs/privcmd.c linux-2.6.39/drivers/xen/xenfs/privcmd.c
43214--- linux-2.6.39/drivers/xen/xenfs/privcmd.c 2011-05-19 00:06:34.000000000 -0400
43215+++ linux-2.6.39/drivers/xen/xenfs/privcmd.c 2011-05-22 19:36:32.000000000 -0400
43216@@ -268,7 +268,7 @@ static int mmap_return_errors(void *data
43217 return put_user(*mfnp, st->user++);
43218 }
43219
43220-static struct vm_operations_struct privcmd_vm_ops;
43221+static const struct vm_operations_struct privcmd_vm_ops;
43222
43223 static long privcmd_ioctl_mmap_batch(void __user *udata)
43224 {
43225@@ -369,7 +369,7 @@ static int privcmd_fault(struct vm_area_
43226 return VM_FAULT_SIGBUS;
43227 }
43228
43229-static struct vm_operations_struct privcmd_vm_ops = {
43230+static const struct vm_operations_struct privcmd_vm_ops = {
43231 .fault = privcmd_fault
43232 };
43233
43234diff -urNp linux-2.6.39/fs/9p/vfs_inode.c linux-2.6.39/fs/9p/vfs_inode.c
43235--- linux-2.6.39/fs/9p/vfs_inode.c 2011-05-19 00:06:34.000000000 -0400
43236+++ linux-2.6.39/fs/9p/vfs_inode.c 2011-05-22 19:36:32.000000000 -0400
43237@@ -1210,7 +1210,7 @@ static void *v9fs_vfs_follow_link(struct
16454cff 43238 void
58c5fc13
MT		 43239 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43240 {
43241- char *s = nd_get_link(nd);
43242+ const char *s = nd_get_link(nd);
43243
43244 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
43245 IS_ERR(s) ? "<error>" : s);
66a7e928
MT		 43246diff -urNp linux-2.6.39/fs/aio.c linux-2.6.39/fs/aio.c
43247--- linux-2.6.39/fs/aio.c 2011-05-19 00:06:34.000000000 -0400
43248+++ linux-2.6.39/fs/aio.c 2011-05-22 19:36:32.000000000 -0400
43249@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
58c5fc13
MT		 43250 size += sizeof(struct io_event) * nr_events;
43251 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
43252
43253- if (nr_pages < 0)
43254+ if (nr_pages <= 0)
43255 return -EINVAL;
43256
43257 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
66a7e928
MT		 43258@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
43259 struct aio_timeout to;
43260 int retry = 0;
43261
43262+ pax_track_stack();
43263+
43264 /* needed to zero any padding within an entry (there shouldn't be
43265 * any, but C is fun!
43266 */
43267diff -urNp linux-2.6.39/fs/attr.c linux-2.6.39/fs/attr.c
43268--- linux-2.6.39/fs/attr.c 2011-05-19 00:06:34.000000000 -0400
43269+++ linux-2.6.39/fs/attr.c 2011-05-22 19:41:37.000000000 -0400
6892158b 43270@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
ae4e228f
MT		 43271 unsigned long limit;
43272
df50ba0c 43273 limit = rlimit(RLIMIT_FSIZE);
ae4e228f
MT		 43274+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
43275 if (limit != RLIM_INFINITY && offset > limit)
43276 goto out_sig;
43277 if (offset > inode->i_sb->s_maxbytes)
66a7e928
MT		 43278diff -urNp linux-2.6.39/fs/befs/linuxvfs.c linux-2.6.39/fs/befs/linuxvfs.c
43279--- linux-2.6.39/fs/befs/linuxvfs.c 2011-05-19 00:06:34.000000000 -0400
43280+++ linux-2.6.39/fs/befs/linuxvfs.c 2011-05-22 19:36:32.000000000 -0400
43281@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
58c5fc13
MT		 43282 {
43283 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
43284 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
43285- char *link = nd_get_link(nd);
43286+ const char *link = nd_get_link(nd);
43287 if (!IS_ERR(link))
43288 kfree(link);
43289 }
66a7e928
MT		 43290diff -urNp linux-2.6.39/fs/binfmt_aout.c linux-2.6.39/fs/binfmt_aout.c
43291--- linux-2.6.39/fs/binfmt_aout.c 2011-05-19 00:06:34.000000000 -0400
43292+++ linux-2.6.39/fs/binfmt_aout.c 2011-05-22 19:41:37.000000000 -0400
58c5fc13
MT		 43293@@ -16,6 +16,7 @@
43294 #include <linux/string.h>
43295 #include <linux/fs.h>
43296 #include <linux/file.h>
43297+#include <linux/security.h>
43298 #include <linux/stat.h>
43299 #include <linux/fcntl.h>
43300 #include <linux/ptrace.h>
6892158b
MT		 43301@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
43302 #endif
43303 # define START_STACK(u) ((void __user *)u.start_stack)
43304
43305+ memset(&dump, 0, sizeof(dump));
43306+
43307 fs = get_fs();
43308 set_fs(KERNEL_DS);
43309 has_dumped = 1;
43310@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
58c5fc13
MT		 43311
43312 /* If the size of the dump file exceeds the rlimit, then see what would happen
43313 if we wrote the stack, but not the data area. */
43314+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
ae4e228f 43315 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
58c5fc13
MT		 43316 dump.u_dsize = 0;
43317
43318 /* Make sure we have enough room to write the stack and data areas. */
43319+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
ae4e228f 43320 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
58c5fc13
MT		 43321 dump.u_ssize = 0;
43322
6892158b 43323@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
df50ba0c 43324 rlim = rlimit(RLIMIT_DATA);
58c5fc13
MT		 43325 if (rlim >= RLIM_INFINITY)
43326 rlim = ~0;
43327+
43328+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
43329 if (ex.a_data + ex.a_bss > rlim)
43330 return -ENOMEM;
43331
6892158b 43332@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
58c5fc13
MT		 43333 install_exec_creds(bprm);
43334 current->flags &= ~PF_FORKNOEXEC;
43335
43336+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43337+ current->mm->pax_flags = 0UL;
43338+#endif
43339+
43340+#ifdef CONFIG_PAX_PAGEEXEC
43341+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
43342+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
43343+
43344+#ifdef CONFIG_PAX_EMUTRAMP
43345+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
43346+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
43347+#endif
43348+
43349+#ifdef CONFIG_PAX_MPROTECT
43350+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
43351+ current->mm->pax_flags |= MF_PAX_MPROTECT;
43352+#endif
43353+
43354+ }
43355+#endif
43356+
43357 if (N_MAGIC(ex) == OMAGIC) {
43358 unsigned long text_addr, map_size;
43359 loff_t pos;
6892158b 43360@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
58c5fc13
MT		 43361
43362 down_write(&current->mm->mmap_sem);
43363 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
43364- PROT_READ | PROT_WRITE | PROT_EXEC,
43365+ PROT_READ | PROT_WRITE,
43366 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
43367 fd_offset + ex.a_text);
43368 up_write(&current->mm->mmap_sem);
66a7e928
MT		 43369diff -urNp linux-2.6.39/fs/binfmt_elf.c linux-2.6.39/fs/binfmt_elf.c
43370--- linux-2.6.39/fs/binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
43371+++ linux-2.6.39/fs/binfmt_elf.c 2011-05-22 19:41:37.000000000 -0400
df50ba0c 43372@@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
58c5fc13
MT		 43373 #define elf_core_dump NULL
43374 #endif
43375
43376+#ifdef CONFIG_PAX_MPROTECT
43377+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
43378+#endif
43379+
43380 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
43381 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
43382 #else
df50ba0c 43383@@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
16454cff
MT		 43384 .load_binary = load_elf_binary,
43385 .load_shlib = load_elf_library,
43386 .core_dump = elf_core_dump,
58c5fc13
MT		 43387+
43388+#ifdef CONFIG_PAX_MPROTECT
43389+ .handle_mprotect= elf_handle_mprotect,
43390+#endif
43391+
16454cff 43392 .min_coredump = ELF_EXEC_PAGESIZE,
58c5fc13 43393 };
16454cff
MT		 43394
43395@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
58c5fc13
MT		 43396
43397 static int set_brk(unsigned long start, unsigned long end)
43398 {
43399+ unsigned long e = end;
43400+
43401 start = ELF_PAGEALIGN(start);
43402 end = ELF_PAGEALIGN(end);
43403 if (end > start) {
16454cff 43404@@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
58c5fc13
MT		 43405 if (BAD_ADDR(addr))
43406 return addr;
43407 }
43408- current->mm->start_brk = current->mm->brk = end;
43409+ current->mm->start_brk = current->mm->brk = e;
43410 return 0;
43411 }
43412
66a7e928 43413@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
58c5fc13
MT		 43414 elf_addr_t __user *u_rand_bytes;
43415 const char *k_platform = ELF_PLATFORM;
43416 const char *k_base_platform = ELF_BASE_PLATFORM;
43417- unsigned char k_rand_bytes[16];
43418+ u32 k_rand_bytes[4];
43419 int items;
43420 elf_addr_t *elf_info;
43421 int ei_index = 0;
71d190be
MT		 43422 const struct cred *cred = current_cred();
43423 struct vm_area_struct *vma;
43424+ unsigned long saved_auxv[AT_VECTOR_SIZE];
66a7e928
MT		 43425+
43426+ pax_track_stack();
71d190be
MT		 43427
43428 /*
43429 * In some cases (e.g. Hyper-Threading), we want to avoid L1
66a7e928 43430@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
58c5fc13
MT		 43431 * Generate 16 random bytes for userspace PRNG seeding.
43432 */
43433 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
df50ba0c
MT		 43434- u_rand_bytes = (elf_addr_t __user *)
43435- STACK_ALLOC(p, sizeof(k_rand_bytes));
58c5fc13
MT		 43436+ srandom32(k_rand_bytes[0] ^ random32());
43437+ srandom32(k_rand_bytes[1] ^ random32());
43438+ srandom32(k_rand_bytes[2] ^ random32());
43439+ srandom32(k_rand_bytes[3] ^ random32());
df50ba0c
MT		 43440+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
43441+ u_rand_bytes = (elf_addr_t __user *) p;
58c5fc13 43442 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
df50ba0c
MT		 43443 return -EFAULT;
43444
66a7e928 43445@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
71d190be
MT		 43446 return -EFAULT;
43447 current->mm->env_end = p;
43448
43449+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
43450+
43451 /* Put the elf_info on the stack in the right place. */
43452 sp = (elf_addr_t __user *)envp + 1;
43453- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
43454+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
43455 return -EFAULT;
43456 return 0;
43457 }
66a7e928 43458@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
58c5fc13
MT		 43459 {
43460 struct elf_phdr *elf_phdata;
43461 struct elf_phdr *eppnt;
43462- unsigned long load_addr = 0;
43463+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
43464 int load_addr_set = 0;
43465 unsigned long last_bss = 0, elf_bss = 0;
43466- unsigned long error = ~0UL;
43467+ unsigned long error = -EINVAL;
43468 unsigned long total_size;
43469 int retval, i, size;
43470
66a7e928 43471@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
58c5fc13
MT		 43472 goto out_close;
43473 }
43474
43475+#ifdef CONFIG_PAX_SEGMEXEC
43476+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
43477+ pax_task_size = SEGMEXEC_TASK_SIZE;
43478+#endif
43479+
43480 eppnt = elf_phdata;
43481 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
43482 if (eppnt->p_type == PT_LOAD) {
66a7e928 43483@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
58c5fc13
MT		 43484 k = load_addr + eppnt->p_vaddr;
43485 if (BAD_ADDR(k) ||
43486 eppnt->p_filesz > eppnt->p_memsz ||
43487- eppnt->p_memsz > TASK_SIZE ||
43488- TASK_SIZE - eppnt->p_memsz < k) {
43489+ eppnt->p_memsz > pax_task_size ||
43490+ pax_task_size - eppnt->p_memsz < k) {
43491 error = -ENOMEM;
43492 goto out_close;
43493 }
66a7e928 43494@@ -528,6 +553,193 @@ out:
58c5fc13
MT		 43495 return error;
43496 }
43497
43498+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
43499+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
43500+{
43501+ unsigned long pax_flags = 0UL;
43502+
43503+#ifdef CONFIG_PAX_PAGEEXEC
43504+ if (elf_phdata->p_flags & PF_PAGEEXEC)
43505+ pax_flags |= MF_PAX_PAGEEXEC;
43506+#endif
43507+
43508+#ifdef CONFIG_PAX_SEGMEXEC
43509+ if (elf_phdata->p_flags & PF_SEGMEXEC)
43510+ pax_flags |= MF_PAX_SEGMEXEC;
43511+#endif
43512+
43513+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43514+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
ae4e228f 43515+ if ((__supported_pte_mask & _PAGE_NX))
58c5fc13
MT		 43516+ pax_flags &= ~MF_PAX_SEGMEXEC;
43517+ else
43518+ pax_flags &= ~MF_PAX_PAGEEXEC;
43519+ }
43520+#endif
43521+
43522+#ifdef CONFIG_PAX_EMUTRAMP
43523+ if (elf_phdata->p_flags & PF_EMUTRAMP)
43524+ pax_flags |= MF_PAX_EMUTRAMP;
43525+#endif
43526+
43527+#ifdef CONFIG_PAX_MPROTECT
43528+ if (elf_phdata->p_flags & PF_MPROTECT)
43529+ pax_flags |= MF_PAX_MPROTECT;
43530+#endif
43531+
43532+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43533+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
43534+ pax_flags |= MF_PAX_RANDMMAP;
43535+#endif
43536+
43537+ return pax_flags;
43538+}
43539+#endif
43540+
43541+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43542+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
43543+{
43544+ unsigned long pax_flags = 0UL;
43545+
43546+#ifdef CONFIG_PAX_PAGEEXEC
43547+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
43548+ pax_flags |= MF_PAX_PAGEEXEC;
43549+#endif
43550+
43551+#ifdef CONFIG_PAX_SEGMEXEC
43552+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
43553+ pax_flags |= MF_PAX_SEGMEXEC;
43554+#endif
43555+
43556+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43557+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
ae4e228f 43558+ if ((__supported_pte_mask & _PAGE_NX))
58c5fc13
MT		 43559+ pax_flags &= ~MF_PAX_SEGMEXEC;
43560+ else
43561+ pax_flags &= ~MF_PAX_PAGEEXEC;
43562+ }
43563+#endif
43564+
43565+#ifdef CONFIG_PAX_EMUTRAMP
43566+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
43567+ pax_flags |= MF_PAX_EMUTRAMP;
43568+#endif
43569+
43570+#ifdef CONFIG_PAX_MPROTECT
43571+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
43572+ pax_flags |= MF_PAX_MPROTECT;
43573+#endif
43574+
43575+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43576+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
43577+ pax_flags |= MF_PAX_RANDMMAP;
43578+#endif
43579+
43580+ return pax_flags;
43581+}
43582+#endif
43583+
43584+#ifdef CONFIG_PAX_EI_PAX
43585+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
43586+{
43587+ unsigned long pax_flags = 0UL;
43588+
43589+#ifdef CONFIG_PAX_PAGEEXEC
43590+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
43591+ pax_flags |= MF_PAX_PAGEEXEC;
43592+#endif
43593+
43594+#ifdef CONFIG_PAX_SEGMEXEC
43595+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
43596+ pax_flags |= MF_PAX_SEGMEXEC;
43597+#endif
43598+
43599+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43600+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
ae4e228f 43601+ if ((__supported_pte_mask & _PAGE_NX))
58c5fc13
MT		 43602+ pax_flags &= ~MF_PAX_SEGMEXEC;
43603+ else
43604+ pax_flags &= ~MF_PAX_PAGEEXEC;
43605+ }
43606+#endif
43607+
43608+#ifdef CONFIG_PAX_EMUTRAMP
43609+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
43610+ pax_flags |= MF_PAX_EMUTRAMP;
43611+#endif
43612+
43613+#ifdef CONFIG_PAX_MPROTECT
43614+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
43615+ pax_flags |= MF_PAX_MPROTECT;
43616+#endif
43617+
43618+#ifdef CONFIG_PAX_ASLR
43619+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
43620+ pax_flags |= MF_PAX_RANDMMAP;
43621+#endif
43622+
43623+ return pax_flags;
43624+}
43625+#endif
43626+
43627+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43628+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
43629+{
43630+ unsigned long pax_flags = 0UL;
43631+
43632+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43633+ unsigned long i;
71d190be 43634+ int found_flags = 0;
58c5fc13
MT		 43635+#endif
43636+
43637+#ifdef CONFIG_PAX_EI_PAX
43638+ pax_flags = pax_parse_ei_pax(elf_ex);
43639+#endif
43640+
43641+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43642+ for (i = 0UL; i < elf_ex->e_phnum; i++)
43643+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
43644+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
43645+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
43646+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
43647+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
43648+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
43649+ return -EINVAL;
43650+
43651+#ifdef CONFIG_PAX_SOFTMODE
43652+ if (pax_softmode)
43653+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
43654+ else
43655+#endif
43656+
43657+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
71d190be 43658+ found_flags = 1;
58c5fc13
MT		 43659+ break;
43660+ }
43661+#endif
43662+
71d190be
MT		 43663+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
43664+ if (found_flags == 0) {
43665+ struct elf_phdr phdr;
43666+ memset(&phdr, 0, sizeof(phdr));
43667+ phdr.p_flags = PF_NOEMUTRAMP;
43668+#ifdef CONFIG_PAX_SOFTMODE
43669+ if (pax_softmode)
43670+ pax_flags = pax_parse_softmode(&phdr);
43671+ else
43672+#endif
43673+ pax_flags = pax_parse_hardmode(&phdr);
43674+ }
43675+#endif
43676+
58c5fc13
MT		 43677+ if (0 > pax_check_flags(&pax_flags))
43678+ return -EINVAL;
43679+
43680+ current->mm->pax_flags = pax_flags;
43681+ return 0;
43682+}
43683+#endif
43684+
43685 /*
43686 * These are the functions used to load ELF style executables and shared
43687 * libraries. There is no binary dependent code anywhere else.
66a7e928 43688@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
58c5fc13
MT		 43689 {
43690 unsigned int random_variable = 0;
43691
43692+#ifdef CONFIG_PAX_RANDUSTACK
43693+ if (randomize_va_space)
43694+ return stack_top - current->mm->delta_stack;
43695+#endif
43696+
43697 if ((current->flags & PF_RANDOMIZE) &&
43698 !(current->personality & ADDR_NO_RANDOMIZE)) {
43699 random_variable = get_random_int() & STACK_RND_MASK;
66a7e928 43700@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
58c5fc13
MT		 43701 unsigned long load_addr = 0, load_bias = 0;
43702 int load_addr_set = 0;
43703 char * elf_interpreter = NULL;
43704- unsigned long error;
43705+ unsigned long error = 0;
43706 struct elf_phdr *elf_ppnt, *elf_phdata;
43707 unsigned long elf_bss, elf_brk;
43708 int retval, i;
66a7e928 43709@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
58c5fc13 43710 unsigned long start_code, end_code, start_data, end_data;
66a7e928 43711 unsigned long reloc_func_desc __maybe_unused = 0;
58c5fc13
MT		 43712 int executable_stack = EXSTACK_DEFAULT;
43713- unsigned long def_flags = 0;
43714 struct {
43715 struct elfhdr elf_ex;
43716 struct elfhdr interp_elf_ex;
43717 } *loc;
43718+ unsigned long pax_task_size = TASK_SIZE;
43719
43720 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
43721 if (!loc) {
66a7e928 43722@@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
58c5fc13
MT		 43723
43724 /* OK, This is the point of no return */
43725 current->flags &= ~PF_FORKNOEXEC;
43726- current->mm->def_flags = def_flags;
43727+
43728+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43729+ current->mm->pax_flags = 0UL;
43730+#endif
43731+
43732+#ifdef CONFIG_PAX_DLRESOLVE
43733+ current->mm->call_dl_resolve = 0UL;
43734+#endif
43735+
43736+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
43737+ current->mm->call_syscall = 0UL;
43738+#endif
43739+
43740+#ifdef CONFIG_PAX_ASLR
43741+ current->mm->delta_mmap = 0UL;
43742+ current->mm->delta_stack = 0UL;
43743+#endif
43744+
43745+ current->mm->def_flags = 0;
43746+
43747+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43748+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
43749+ send_sig(SIGKILL, current, 0);
43750+ goto out_free_dentry;
43751+ }
43752+#endif
43753+
43754+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
43755+ pax_set_initial_flags(bprm);
43756+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
43757+ if (pax_set_initial_flags_func)
43758+ (pax_set_initial_flags_func)(bprm);
43759+#endif
43760+
43761+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
ae4e228f 43762+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
58c5fc13
MT		 43763+ current->mm->context.user_cs_limit = PAGE_SIZE;
43764+ current->mm->def_flags |= VM_PAGEEXEC;
43765+ }
43766+#endif
43767+
43768+#ifdef CONFIG_PAX_SEGMEXEC
43769+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
43770+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
43771+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
43772+ pax_task_size = SEGMEXEC_TASK_SIZE;
66a7e928 43773+ current->mm->def_flags |= VM_NOHUGEPAGE;
58c5fc13
MT		 43774+ }
43775+#endif
43776+
43777+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
43778+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43779+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
43780+ put_cpu();
43781+ }
43782+#endif
ae4e228f
MT		 43783
43784 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
43785 may depend on the personality. */
43786 SET_PERSONALITY(loc->elf_ex);
58c5fc13
MT		 43787+
43788+#ifdef CONFIG_PAX_ASLR
43789+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43790+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
43791+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
43792+ }
43793+#endif
58c5fc13
MT		 43794+
43795+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43796+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43797+ executable_stack = EXSTACK_DISABLE_X;
43798+ current->personality &= ~READ_IMPLIES_EXEC;
43799+ } else
43800+#endif
43801+
43802 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
43803 current->personality |= READ_IMPLIES_EXEC;
43804
66a7e928 43805@@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
58c5fc13
MT		 43806 #else
43807 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
43808 #endif
43809+
43810+#ifdef CONFIG_PAX_RANDMMAP
43811+ /* PaX: randomize base address at the default exe base if requested */
43812+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
43813+#ifdef CONFIG_SPARC64
43814+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
43815+#else
43816+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
43817+#endif
43818+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
43819+ elf_flags |= MAP_FIXED;
43820+ }
43821+#endif
43822+
43823 }
43824
43825 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
66a7e928 43826@@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
58c5fc13
MT		 43827 * allowed task size. Note that p_filesz must always be
43828 * <= p_memsz so it is only necessary to check p_memsz.
43829 */
43830- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43831- elf_ppnt->p_memsz > TASK_SIZE ||
43832- TASK_SIZE - elf_ppnt->p_memsz < k) {
43833+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43834+ elf_ppnt->p_memsz > pax_task_size ||
43835+ pax_task_size - elf_ppnt->p_memsz < k) {
43836 /* set_brk can never work. Avoid overflows. */
43837 send_sig(SIGKILL, current, 0);
43838 retval = -EINVAL;
66a7e928 43839@@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
58c5fc13
MT		 43840 start_data += load_bias;
43841 end_data += load_bias;
43842
43843+#ifdef CONFIG_PAX_RANDMMAP
43844+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
43845+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
43846+#endif
43847+
43848 /* Calling set_brk effectively mmaps the pages that we need
43849 * for the bss and break sections. We must do this before
43850 * mapping in the interpreter, to make sure it doesn't wind
66a7e928 43851@@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
58c5fc13
MT		 43852 goto out_free_dentry;
43853 }
43854 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
43855- send_sig(SIGSEGV, current, 0);
43856- retval = -EFAULT; /* Nobody gets to see this, but.. */
43857- goto out_free_dentry;
43858+ /*
43859+ * This bss-zeroing can fail if the ELF
43860+ * file specifies odd protections. So
43861+ * we don't check the return value
43862+ */
43863 }
43864
43865 if (elf_interpreter) {
66a7e928 43866@@ -1090,7 +1398,7 @@ out:
58c5fc13
MT		 43867 * Decide what to dump of a segment, part, all or none.
43868 */
43869 static unsigned long vma_dump_size(struct vm_area_struct *vma,
43870- unsigned long mm_flags)
43871+ unsigned long mm_flags, long signr)
43872 {
43873 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
43874
66a7e928 43875@@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
58c5fc13
MT		 43876 if (vma->vm_file == NULL)
43877 return 0;
43878
43879- if (FILTER(MAPPED_PRIVATE))
43880+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
43881 goto whole;
43882
43883 /*
66a7e928 43884@@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
ae4e228f
MT		 43885 {
43886 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
43887 int i = 0;
43888- do
43889+ do {
43890 i += 2;
43891- while (auxv[i - 2] != AT_NULL);
43892+ } while (auxv[i - 2] != AT_NULL);
43893 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
43894 }
43895
66a7e928 43896@@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
df50ba0c
MT		 43897 }
43898
43899 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
43900- unsigned long mm_flags)
43901+ struct coredump_params *cprm)
43902 {
43903 struct vm_area_struct *vma;
43904 size_t size = 0;
43905
43906 for (vma = first_vma(current, gate_vma); vma != NULL;
43907 vma = next_vma(vma, gate_vma))
43908- size += vma_dump_size(vma, mm_flags);
43909+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43910 return size;
43911 }
43912
66a7e928 43913@@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
df50ba0c
MT		 43914
43915 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
43916
43917- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
43918+ offset += elf_core_vma_data_size(gate_vma, cprm);
43919 offset += elf_core_extra_data_size();
43920 e_shoff = offset;
43921
66a7e928 43922@@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
df50ba0c
MT		 43923 offset = dataoff;
43924
43925 size += sizeof(*elf);
43926+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43927 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
43928 goto end_coredump;
43929
43930 size += sizeof(*phdr4note);
43931+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43932 if (size > cprm->limit
43933 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
43934 goto end_coredump;
66a7e928 43935@@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
58c5fc13
MT		 43936 phdr.p_offset = offset;
43937 phdr.p_vaddr = vma->vm_start;
43938 phdr.p_paddr = 0;
df50ba0c
MT		 43939- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
43940+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
58c5fc13
MT		 43941 phdr.p_memsz = vma->vm_end - vma->vm_start;
43942 offset += phdr.p_filesz;
43943 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
66a7e928 43944@@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
df50ba0c
MT		 43945 phdr.p_align = ELF_EXEC_PAGESIZE;
43946
43947 size += sizeof(phdr);
43948+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43949 if (size > cprm->limit
43950 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
43951 goto end_coredump;
66a7e928 43952@@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
58c5fc13
MT		 43953 unsigned long addr;
43954 unsigned long end;
43955
df50ba0c
MT		 43956- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
43957+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
58c5fc13
MT		 43958
43959 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
43960 struct page *page;
66a7e928 43961@@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
ae4e228f
MT		 43962 page = get_dump_page(addr);
43963 if (page) {
43964 void *kaddr = kmap(page);
43965+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
43966 stop = ((size += PAGE_SIZE) > cprm->limit) ||
43967 !dump_write(cprm->file, kaddr,
43968 PAGE_SIZE);
66a7e928 43969@@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
df50ba0c
MT		 43970
43971 if (e_phnum == PN_XNUM) {
43972 size += sizeof(*shdr4extnum);
43973+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43974 if (size > cprm->limit
43975 || !dump_write(cprm->file, shdr4extnum,
43976 sizeof(*shdr4extnum)))
66a7e928 43977@@ -2067,6 +2380,97 @@ out:
ae4e228f
MT		 43978
43979 #endif /* CONFIG_ELF_CORE */
58c5fc13
MT		 43980
43981+#ifdef CONFIG_PAX_MPROTECT
43982+/* PaX: non-PIC ELF libraries need relocations on their executable segments
43983+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
43984+ * we'll remove VM_MAYWRITE for good on RELRO segments.
43985+ *
43986+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
43987+ * basis because we want to allow the common case and not the special ones.
43988+ */
43989+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
43990+{
43991+ struct elfhdr elf_h;
43992+ struct elf_phdr elf_p;
43993+ unsigned long i;
43994+ unsigned long oldflags;
43995+ bool is_textrel_rw, is_textrel_rx, is_relro;
43996+
43997+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
43998+ return;
43999+
44000+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
44001+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
44002+
57199397 44003+#ifdef CONFIG_PAX_ELFRELOCS
58c5fc13
MT		 44004+ /* possible TEXTREL */
44005+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
44006+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
57199397
MT		 44007+#else
44008+ is_textrel_rw = false;
44009+ is_textrel_rx = false;
58c5fc13
MT		 44010+#endif
44011+
44012+ /* possible RELRO */
44013+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
44014+
44015+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
44016+ return;
44017+
44018+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
44019+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
44020+
44021+#ifdef CONFIG_PAX_ETEXECRELOCS
44022+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44023+#else
44024+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
44025+#endif
44026+
44027+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44028+ !elf_check_arch(&elf_h) ||
44029+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
44030+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
44031+ return;
44032+
44033+ for (i = 0UL; i < elf_h.e_phnum; i++) {
44034+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
44035+ return;
44036+ switch (elf_p.p_type) {
44037+ case PT_DYNAMIC:
44038+ if (!is_textrel_rw && !is_textrel_rx)
44039+ continue;
44040+ i = 0UL;
44041+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
44042+ elf_dyn dyn;
44043+
44044+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
44045+ return;
44046+ if (dyn.d_tag == DT_NULL)
44047+ return;
44048+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
44049+ gr_log_textrel(vma);
44050+ if (is_textrel_rw)
44051+ vma->vm_flags |= VM_MAYWRITE;
44052+ else
44053+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
44054+ vma->vm_flags &= ~VM_MAYWRITE;
44055+ return;
44056+ }
44057+ i++;
44058+ }
44059+ return;
44060+
44061+ case PT_GNU_RELRO:
44062+ if (!is_relro)
44063+ continue;
44064+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
44065+ vma->vm_flags &= ~VM_MAYWRITE;
44066+ return;
44067+ }
44068+ }
44069+}
44070+#endif
44071+
44072 static int __init init_elf_binfmt(void)
44073 {
44074 return register_binfmt(&elf_format);
66a7e928
MT		 44075diff -urNp linux-2.6.39/fs/binfmt_flat.c linux-2.6.39/fs/binfmt_flat.c
44076--- linux-2.6.39/fs/binfmt_flat.c 2011-05-19 00:06:34.000000000 -0400
44077+++ linux-2.6.39/fs/binfmt_flat.c 2011-05-22 19:36:32.000000000 -0400
57199397 44078@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
58c5fc13
MT		 44079 realdatastart = (unsigned long) -ENOMEM;
44080 printk("Unable to allocate RAM for process data, errno %d\n",
44081 (int)-realdatastart);
44082+ down_write(&current->mm->mmap_sem);
44083 do_munmap(current->mm, textpos, text_len);
44084+ up_write(&current->mm->mmap_sem);
44085 ret = realdatastart;
44086 goto err;
44087 }
57199397 44088@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
58c5fc13 44089 }
ae4e228f 44090 if (IS_ERR_VALUE(result)) {
58c5fc13
MT		 44091 printk("Unable to read data+bss, errno %d\n", (int)-result);
44092+ down_write(&current->mm->mmap_sem);
44093 do_munmap(current->mm, textpos, text_len);
57199397 44094 do_munmap(current->mm, realdatastart, len);
58c5fc13
MT		 44095+ up_write(&current->mm->mmap_sem);
44096 ret = result;
44097 goto err;
44098 }
57199397 44099@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
58c5fc13 44100 }
ae4e228f 44101 if (IS_ERR_VALUE(result)) {
58c5fc13
MT		 44102 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
44103+ down_write(&current->mm->mmap_sem);
44104 do_munmap(current->mm, textpos, text_len + data_len + extra +
44105 MAX_SHARED_LIBS * sizeof(unsigned long));
44106+ up_write(&current->mm->mmap_sem);
44107 ret = result;
44108 goto err;
44109 }
66a7e928
MT		 44110diff -urNp linux-2.6.39/fs/bio.c linux-2.6.39/fs/bio.c
44111--- linux-2.6.39/fs/bio.c 2011-05-19 00:06:34.000000000 -0400
44112+++ linux-2.6.39/fs/bio.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 44113@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
ae4e228f
MT		 44114 const int read = bio_data_dir(bio) == READ;
44115 struct bio_map_data *bmd = bio->bi_private;
44116 int i;
44117- char *p = bmd->sgvecs[0].iov_base;
44118+ char *p = (__force char *)bmd->sgvecs[0].iov_base;
44119
44120 __bio_for_each_segment(bvec, bio, i, 0) {
44121 char *addr = page_address(bvec->bv_page);
66a7e928
MT		 44122diff -urNp linux-2.6.39/fs/block_dev.c linux-2.6.39/fs/block_dev.c
44123--- linux-2.6.39/fs/block_dev.c 2011-05-19 00:06:34.000000000 -0400
44124+++ linux-2.6.39/fs/block_dev.c 2011-05-22 19:36:32.000000000 -0400
44125@@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
df50ba0c 44126 else if (bdev->bd_contains == bdev)
57199397
MT		 44127 return true; /* is a whole device which isn't held */
44128
16454cff
MT		 44129- else if (whole->bd_holder == bd_may_claim)
44130+ else if (whole->bd_holder == (void *)bd_may_claim)
57199397
MT		 44131 return true; /* is a partition of a device that is being partitioned */
44132 else if (whole->bd_holder != NULL)
44133 return false; /* is a partition of a held device */
66a7e928
MT		 44134diff -urNp linux-2.6.39/fs/btrfs/compression.c linux-2.6.39/fs/btrfs/compression.c
44135--- linux-2.6.39/fs/btrfs/compression.c 2011-05-19 00:06:34.000000000 -0400
44136+++ linux-2.6.39/fs/btrfs/compression.c 2011-05-22 19:36:32.000000000 -0400
44137@@ -719,7 +719,7 @@ static int comp_num_workspace[BTRFS_COMP
44138 static atomic_t comp_alloc_workspace[BTRFS_COMPRESS_TYPES];
44139 static wait_queue_head_t comp_workspace_wait[BTRFS_COMPRESS_TYPES];
44140
44141-struct btrfs_compress_op *btrfs_compress_op[] = {
44142+const struct btrfs_compress_op *btrfs_compress_op[] = {
44143 &btrfs_zlib_compress,
44144 &btrfs_lzo_compress,
44145 };
44146diff -urNp linux-2.6.39/fs/btrfs/compression.h linux-2.6.39/fs/btrfs/compression.h
44147--- linux-2.6.39/fs/btrfs/compression.h 2011-05-19 00:06:34.000000000 -0400
44148+++ linux-2.6.39/fs/btrfs/compression.h 2011-05-22 19:36:32.000000000 -0400
44149@@ -77,7 +77,7 @@ struct btrfs_compress_op {
44150 size_t srclen, size_t destlen);
44151 };
44152
44153-extern struct btrfs_compress_op btrfs_zlib_compress;
44154-extern struct btrfs_compress_op btrfs_lzo_compress;
44155+extern const struct btrfs_compress_op btrfs_zlib_compress;
44156+extern const struct btrfs_compress_op btrfs_lzo_compress;
44157
44158 #endif
44159diff -urNp linux-2.6.39/fs/btrfs/ctree.c linux-2.6.39/fs/btrfs/ctree.c
44160--- linux-2.6.39/fs/btrfs/ctree.c 2011-05-19 00:06:34.000000000 -0400
44161+++ linux-2.6.39/fs/btrfs/ctree.c 2011-05-22 19:36:32.000000000 -0400
44162@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
6892158b
MT		 44163 free_extent_buffer(buf);
44164 add_root_to_dirty_list(root);
44165 } else {
44166- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
44167- parent_start = parent->start;
44168- else
44169+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
44170+ if (parent)
44171+ parent_start = parent->start;
44172+ else
44173+ parent_start = 0;
44174+ } else
44175 parent_start = 0;
44176
44177 WARN_ON(trans->transid != btrfs_header_generation(parent));
66a7e928 44178@@ -3647,7 +3650,6 @@ setup_items_for_insert(struct btrfs_tran
ae4e228f
MT		 44179
44180 ret = 0;
44181 if (slot == 0) {
44182- struct btrfs_disk_key disk_key;
44183 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
44184 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
44185 }
66a7e928
MT		 44186diff -urNp linux-2.6.39/fs/btrfs/disk-io.c linux-2.6.39/fs/btrfs/disk-io.c
44187--- linux-2.6.39/fs/btrfs/disk-io.c 2011-05-19 00:06:34.000000000 -0400
44188+++ linux-2.6.39/fs/btrfs/disk-io.c 2011-05-22 19:36:32.000000000 -0400
44189@@ -42,7 +42,7 @@
ae4e228f
MT		 44190 #include "tree-log.h"
44191 #include "free-space-cache.h"
44192
44193-static struct extent_io_ops btree_extent_io_ops;
44194+static const struct extent_io_ops btree_extent_io_ops;
44195 static void end_workqueue_fn(struct btrfs_work *work);
44196 static void free_fs_root(struct btrfs_root *root);
16454cff 44197 static void btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
66a7e928 44198@@ -3070,7 +3070,7 @@ static int btrfs_cleanup_transaction(str
58c5fc13
MT		 44199 return 0;
44200 }
44201
ae4e228f
MT		 44202-static struct extent_io_ops btree_extent_io_ops = {
44203+static const struct extent_io_ops btree_extent_io_ops = {
44204 .write_cache_pages_lock_hook = btree_lock_page_hook,
44205 .readpage_end_io_hook = btree_readpage_end_io_hook,
44206 .submit_bio_hook = btree_submit_bio_hook,
66a7e928
MT		 44207diff -urNp linux-2.6.39/fs/btrfs/extent_io.h linux-2.6.39/fs/btrfs/extent_io.h
44208--- linux-2.6.39/fs/btrfs/extent_io.h 2011-05-19 00:06:34.000000000 -0400
44209+++ linux-2.6.39/fs/btrfs/extent_io.h 2011-05-22 19:36:32.000000000 -0400
44210@@ -56,36 +56,36 @@ typedef int (extent_submit_bio_hook_t)(s
ae4e228f 44211 struct bio *bio, int mirror_num,
57199397 44212 unsigned long bio_flags, u64 bio_offset);
ae4e228f
MT		 44213 struct extent_io_ops {
44214- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
44215+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
44216 u64 start, u64 end, int *page_started,
44217 unsigned long *nr_written);
44218- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
44219- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
44220+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
44221+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
44222 extent_submit_bio_hook_t *submit_bio_hook;
44223- int (*merge_bio_hook)(struct page *page, unsigned long offset,
44224+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
44225 size_t size, struct bio *bio,
44226 unsigned long bio_flags);
44227- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
44228- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
44229+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
44230+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
44231 u64 start, u64 end,
44232 struct extent_state *state);
44233- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
44234+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
44235 u64 start, u64 end,
44236 struct extent_state *state);
44237- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44238+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44239 struct extent_state *state);
44240- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44241+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44242 struct extent_state *state, int uptodate);
57199397
MT		 44243- int (*set_bit_hook)(struct inode *inode, struct extent_state *state,
44244+ int (* const set_bit_hook)(struct inode *inode, struct extent_state *state,
44245 int *bits);
ae4e228f
MT		 44246- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
44247+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
57199397 44248 int *bits);
ae4e228f
MT		 44249- int (*merge_extent_hook)(struct inode *inode,
44250+ int (* const merge_extent_hook)(struct inode *inode,
44251 struct extent_state *new,
44252 struct extent_state *other);
44253- int (*split_extent_hook)(struct inode *inode,
44254+ int (* const split_extent_hook)(struct inode *inode,
44255 struct extent_state *orig, u64 split);
44256- int (*write_cache_pages_lock_hook)(struct page *page);
44257+ int (* const write_cache_pages_lock_hook)(struct page *page);
44258 };
44259
44260 struct extent_io_tree {
66a7e928 44261@@ -95,7 +95,7 @@ struct extent_io_tree {
ae4e228f
MT		 44262 u64 dirty_bytes;
44263 spinlock_t lock;
44264 spinlock_t buffer_lock;
44265- struct extent_io_ops *ops;
44266+ const struct extent_io_ops *ops;
44267 };
44268
44269 struct extent_state {
66a7e928
MT		 44270diff -urNp linux-2.6.39/fs/btrfs/free-space-cache.c linux-2.6.39/fs/btrfs/free-space-cache.c
44271--- linux-2.6.39/fs/btrfs/free-space-cache.c 2011-05-19 00:06:34.000000000 -0400
44272+++ linux-2.6.39/fs/btrfs/free-space-cache.c 2011-05-22 19:36:32.000000000 -0400
44273@@ -1910,8 +1910,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
ae4e228f 44274 while(1) {
66a7e928
MT		 44275 if (entry->bytes < bytes ||
44276 (!entry->bitmap && entry->offset < min_start)) {
ae4e228f
MT		 44277- struct rb_node *node;
44278-
44279 node = rb_next(&entry->offset_index);
44280 if (!node)
44281 break;
66a7e928
MT		 44282@@ -1925,7 +1923,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44283 cluster, entry, bytes,
44284 min_start);
44285 if (ret == 0) {
44286- struct rb_node *node;
44287 node = rb_next(&entry->offset_index);
44288 if (!node)
44289 break;
44290diff -urNp linux-2.6.39/fs/btrfs/inode.c linux-2.6.39/fs/btrfs/inode.c
44291--- linux-2.6.39/fs/btrfs/inode.c 2011-05-19 00:06:34.000000000 -0400
44292+++ linux-2.6.39/fs/btrfs/inode.c 2011-05-22 20:42:42.000000000 -0400
44293@@ -65,7 +65,7 @@ static const struct inode_operations btr
ae4e228f
MT		 44294 static const struct address_space_operations btrfs_aops;
44295 static const struct address_space_operations btrfs_symlink_aops;
44296 static const struct file_operations btrfs_dir_file_operations;
44297-static struct extent_io_ops btrfs_extent_io_ops;
44298+static const struct extent_io_ops btrfs_extent_io_ops;
58c5fc13
MT		 44299
44300 static struct kmem_cache *btrfs_inode_cachep;
ae4e228f 44301 struct kmem_cache *btrfs_trans_handle_cachep;
66a7e928 44302@@ -6947,7 +6947,7 @@ fail:
16454cff
MT		 44303 return -ENOMEM;
44304 }
44305
44306-static int btrfs_getattr(struct vfsmount *mnt,
44307+int btrfs_getattr(struct vfsmount *mnt,
44308 struct dentry *dentry, struct kstat *stat)
44309 {
44310 struct inode *inode = dentry->d_inode;
66a7e928 44311@@ -6959,6 +6959,14 @@ static int btrfs_getattr(struct vfsmount
16454cff
MT		 44312 return 0;
44313 }
44314
44315+EXPORT_SYMBOL(btrfs_getattr);
44316+
44317+dev_t get_btrfs_dev_from_inode(struct inode *inode)
44318+{
44319+ return BTRFS_I(inode)->root->anon_super.s_dev;
44320+}
44321+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
44322+
66a7e928
MT		 44323 /*
44324 * If a file is moved, it will inherit the cow and compression flags of the new
44325 * directory.
44326@@ -7488,7 +7496,7 @@ static const struct file_operations btrf
ae4e228f
MT		 44327 .fsync = btrfs_sync_file,
44328 };
58c5fc13 44329
ae4e228f
MT		 44330-static struct extent_io_ops btrfs_extent_io_ops = {
44331+static const struct extent_io_ops btrfs_extent_io_ops = {
44332 .fill_delalloc = run_delalloc_range,
44333 .submit_bio_hook = btrfs_submit_bio_hook,
44334 .merge_bio_hook = btrfs_merge_bio_hook,
66a7e928
MT		 44335diff -urNp linux-2.6.39/fs/btrfs/ioctl.c linux-2.6.39/fs/btrfs/ioctl.c
44336--- linux-2.6.39/fs/btrfs/ioctl.c 2011-05-19 00:06:34.000000000 -0400
44337+++ linux-2.6.39/fs/btrfs/ioctl.c 2011-05-22 19:41:37.000000000 -0400
44338@@ -2361,9 +2361,12 @@ long btrfs_ioctl_space_info(struct btrfs
c52201e0
MT		 44339 for (i = 0; i < num_types; i++) {
44340 struct btrfs_space_info *tmp;
44341
44342+ /* Don't copy in more than we allocated */
317566c1
MT		 44343 if (!slot_count)
44344 break;
44345
c52201e0
MT		 44346+ slot_count--;
44347+
44348 info = NULL;
44349 rcu_read_lock();
44350 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
66a7e928 44351@@ -2385,10 +2388,7 @@ long btrfs_ioctl_space_info(struct btrfs
317566c1
MT		 44352 memcpy(dest, &space, sizeof(space));
44353 dest++;
44354 space_args.total_spaces++;
44355- slot_count--;
44356 }
44357- if (!slot_count)
44358- break;
44359 }
44360 up_read(&info->groups_sem);
44361 }
66a7e928
MT		 44362diff -urNp linux-2.6.39/fs/btrfs/lzo.c linux-2.6.39/fs/btrfs/lzo.c
44363--- linux-2.6.39/fs/btrfs/lzo.c 2011-05-19 00:06:34.000000000 -0400
44364+++ linux-2.6.39/fs/btrfs/lzo.c 2011-05-22 19:36:32.000000000 -0400
44365@@ -418,7 +418,7 @@ out:
44366 return ret;
44367 }
44368
44369-struct btrfs_compress_op btrfs_lzo_compress = {
44370+const struct btrfs_compress_op btrfs_lzo_compress = {
44371 .alloc_workspace = lzo_alloc_workspace,
44372 .free_workspace = lzo_free_workspace,
44373 .compress_pages = lzo_compress_pages,
44374diff -urNp linux-2.6.39/fs/btrfs/relocation.c linux-2.6.39/fs/btrfs/relocation.c
44375--- linux-2.6.39/fs/btrfs/relocation.c 2011-05-19 00:06:34.000000000 -0400
44376+++ linux-2.6.39/fs/btrfs/relocation.c 2011-05-22 19:36:32.000000000 -0400
16454cff 44377@@ -1239,7 +1239,7 @@ static int __update_reloc_root(struct bt
6892158b
MT		 44378 }
44379 spin_unlock(&rc->reloc_root_tree.lock);
44380
44381- BUG_ON((struct btrfs_root *)node->data != root);
44382+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
44383
44384 if (!del) {
44385 spin_lock(&rc->reloc_root_tree.lock);
66a7e928
MT		 44386diff -urNp linux-2.6.39/fs/btrfs/zlib.c linux-2.6.39/fs/btrfs/zlib.c
44387--- linux-2.6.39/fs/btrfs/zlib.c 2011-05-19 00:06:34.000000000 -0400
44388+++ linux-2.6.39/fs/btrfs/zlib.c 2011-05-22 19:36:32.000000000 -0400
44389@@ -390,7 +390,7 @@ next:
44390 return ret;
44391 }
44392
44393-struct btrfs_compress_op btrfs_zlib_compress = {
44394+const struct btrfs_compress_op btrfs_zlib_compress = {
44395 .alloc_workspace = zlib_alloc_workspace,
44396 .free_workspace = zlib_free_workspace,
44397 .compress_pages = zlib_compress_pages,
44398diff -urNp linux-2.6.39/fs/cachefiles/bind.c linux-2.6.39/fs/cachefiles/bind.c
44399--- linux-2.6.39/fs/cachefiles/bind.c 2011-05-19 00:06:34.000000000 -0400
44400+++ linux-2.6.39/fs/cachefiles/bind.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c
MT		 44401@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
44402 args);
44403
44404 /* start by checking things over */
44405- ASSERT(cache->fstop_percent >= 0 &&
44406- cache->fstop_percent < cache->fcull_percent &&
44407+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
44408 cache->fcull_percent < cache->frun_percent &&
44409 cache->frun_percent < 100);
44410
44411- ASSERT(cache->bstop_percent >= 0 &&
44412- cache->bstop_percent < cache->bcull_percent &&
44413+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
44414 cache->bcull_percent < cache->brun_percent &&
44415 cache->brun_percent < 100);
44416
66a7e928
MT		 44417diff -urNp linux-2.6.39/fs/cachefiles/daemon.c linux-2.6.39/fs/cachefiles/daemon.c
44418--- linux-2.6.39/fs/cachefiles/daemon.c 2011-05-19 00:06:34.000000000 -0400
44419+++ linux-2.6.39/fs/cachefiles/daemon.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 44420@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
ae4e228f
MT		 44421 if (n > buflen)
44422 return -EMSGSIZE;
44423
44424- if (copy_to_user(_buffer, buffer, n) != 0)
44425+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
44426 return -EFAULT;
58c5fc13 44427
ae4e228f 44428 return n;
bc901d79 44429@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
df50ba0c
MT		 44430 if (test_bit(CACHEFILES_DEAD, &cache->flags))
44431 return -EIO;
44432
44433- if (datalen < 0 || datalen > PAGE_SIZE - 1)
44434+ if (datalen > PAGE_SIZE - 1)
44435 return -EOPNOTSUPP;
44436
44437 /* drag the command string into the kernel so we can parse it */
bc901d79 44438@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
df50ba0c
MT		 44439 if (args[0] != '%' || args[1] != '\0')
44440 return -EINVAL;
44441
44442- if (fstop < 0 || fstop >= cache->fcull_percent)
44443+ if (fstop >= cache->fcull_percent)
44444 return cachefiles_daemon_range_error(cache, args);
44445
44446 cache->fstop_percent = fstop;
bc901d79 44447@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
df50ba0c
MT		 44448 if (args[0] != '%' || args[1] != '\0')
44449 return -EINVAL;
44450
44451- if (bstop < 0 || bstop >= cache->bcull_percent)
44452+ if (bstop >= cache->bcull_percent)
44453 return cachefiles_daemon_range_error(cache, args);
44454
44455 cache->bstop_percent = bstop;
66a7e928
MT		 44456diff -urNp linux-2.6.39/fs/cachefiles/internal.h linux-2.6.39/fs/cachefiles/internal.h
44457--- linux-2.6.39/fs/cachefiles/internal.h 2011-05-19 00:06:34.000000000 -0400
44458+++ linux-2.6.39/fs/cachefiles/internal.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 44459@@ -57,7 +57,7 @@ struct cachefiles_cache {
44460 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
44461 struct rb_root active_nodes; /* active nodes (can't be culled) */
44462 rwlock_t active_lock; /* lock for active_nodes */
44463- atomic_t gravecounter; /* graveyard uniquifier */
44464+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
44465 unsigned frun_percent; /* when to stop culling (% files) */
44466 unsigned fcull_percent; /* when to start culling (% files) */
44467 unsigned fstop_percent; /* when to stop allocating (% files) */
44468@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
44469 * proc.c
44470 */
44471 #ifdef CONFIG_CACHEFILES_HISTOGRAM
44472-extern atomic_t cachefiles_lookup_histogram[HZ];
44473-extern atomic_t cachefiles_mkdir_histogram[HZ];
44474-extern atomic_t cachefiles_create_histogram[HZ];
44475+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44476+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44477+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
44478
44479 extern int __init cachefiles_proc_init(void);
44480 extern void cachefiles_proc_cleanup(void);
44481 static inline
44482-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
44483+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
44484 {
44485 unsigned long jif = jiffies - start_jif;
44486 if (jif >= HZ)
44487 jif = HZ - 1;
44488- atomic_inc(&histogram[jif]);
44489+ atomic_inc_unchecked(&histogram[jif]);
44490 }
44491
44492 #else
66a7e928
MT		 44493diff -urNp linux-2.6.39/fs/cachefiles/namei.c linux-2.6.39/fs/cachefiles/namei.c
44494--- linux-2.6.39/fs/cachefiles/namei.c 2011-05-19 00:06:34.000000000 -0400
44495+++ linux-2.6.39/fs/cachefiles/namei.c 2011-05-22 19:36:32.000000000 -0400
44496@@ -318,7 +318,7 @@ try_again:
8308f9c9
MT		 44497 /* first step is to make up a grave dentry in the graveyard */
44498 sprintf(nbuffer, "%08x%08x",
44499 (uint32_t) get_seconds(),
44500- (uint32_t) atomic_inc_return(&cache->gravecounter));
44501+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
44502
44503 /* do the multiway lock magic */
44504 trap = lock_rename(cache->graveyard, dir);
66a7e928
MT		 44505diff -urNp linux-2.6.39/fs/cachefiles/proc.c linux-2.6.39/fs/cachefiles/proc.c
44506--- linux-2.6.39/fs/cachefiles/proc.c 2011-05-19 00:06:34.000000000 -0400
44507+++ linux-2.6.39/fs/cachefiles/proc.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 44508@@ -14,9 +14,9 @@
44509 #include <linux/seq_file.h>
44510 #include "internal.h"
44511
44512-atomic_t cachefiles_lookup_histogram[HZ];
44513-atomic_t cachefiles_mkdir_histogram[HZ];
44514-atomic_t cachefiles_create_histogram[HZ];
44515+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44516+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44517+atomic_unchecked_t cachefiles_create_histogram[HZ];
44518
44519 /*
44520 * display the latency histogram
44521@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
44522 return 0;
44523 default:
44524 index = (unsigned long) v - 3;
44525- x = atomic_read(&cachefiles_lookup_histogram[index]);
44526- y = atomic_read(&cachefiles_mkdir_histogram[index]);
44527- z = atomic_read(&cachefiles_create_histogram[index]);
44528+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
44529+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
44530+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
44531 if (x == 0 && y == 0 && z == 0)
44532 return 0;
44533
66a7e928
MT		 44534diff -urNp linux-2.6.39/fs/cachefiles/rdwr.c linux-2.6.39/fs/cachefiles/rdwr.c
44535--- linux-2.6.39/fs/cachefiles/rdwr.c 2011-05-19 00:06:34.000000000 -0400
44536+++ linux-2.6.39/fs/cachefiles/rdwr.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 44537@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
ae4e228f
MT		 44538 old_fs = get_fs();
44539 set_fs(KERNEL_DS);
44540 ret = file->f_op->write(
44541- file, (const void __user *) data, len, &pos);
44542+ file, (__force const void __user *) data, len, &pos);
44543 set_fs(old_fs);
44544 kunmap(page);
44545 if (ret != len)
66a7e928
MT		 44546diff -urNp linux-2.6.39/fs/ceph/addr.c linux-2.6.39/fs/ceph/addr.c
44547--- linux-2.6.39/fs/ceph/addr.c 2011-05-19 00:06:34.000000000 -0400
44548+++ linux-2.6.39/fs/ceph/addr.c 2011-05-22 19:36:32.000000000 -0400
44549@@ -1164,7 +1164,7 @@ out:
44550 return ret;
44551 }
44552
44553-static struct vm_operations_struct ceph_vmops = {
44554+static const struct vm_operations_struct ceph_vmops = {
44555 .fault = filemap_fault,
44556 .page_mkwrite = ceph_page_mkwrite,
44557 };
44558diff -urNp linux-2.6.39/fs/ceph/dir.c linux-2.6.39/fs/ceph/dir.c
44559--- linux-2.6.39/fs/ceph/dir.c 2011-05-19 00:06:34.000000000 -0400
44560+++ linux-2.6.39/fs/ceph/dir.c 2011-05-22 19:36:32.000000000 -0400
16454cff 44561@@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
bc901d79
MT		 44562 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
44563 struct ceph_mds_client *mdsc = fsc->mdsc;
6892158b
MT		 44564 unsigned frag = fpos_frag(filp->f_pos);
44565- int off = fpos_off(filp->f_pos);
44566+ unsigned int off = fpos_off(filp->f_pos);
44567 int err;
44568 u32 ftype;
44569 struct ceph_mds_reply_info_parsed *rinfo;
66a7e928 44570@@ -360,7 +360,7 @@ more:
6892158b
MT		 44571 rinfo = &fi->last_readdir->r_reply_info;
44572 dout("readdir frag %x num %d off %d chunkoff %d\n", frag,
44573 rinfo->dir_nr, off, fi->offset);
44574- while (off - fi->offset >= 0 && off - fi->offset < rinfo->dir_nr) {
44575+ while (off >= fi->offset && off - fi->offset < rinfo->dir_nr) {
44576 u64 pos = ceph_make_fpos(frag, off);
44577 struct ceph_mds_reply_inode *in =
44578 rinfo->dir_in[off - fi->offset].in;
66a7e928
MT		 44579diff -urNp linux-2.6.39/fs/cifs/cifs_debug.c linux-2.6.39/fs/cifs/cifs_debug.c
44580--- linux-2.6.39/fs/cifs/cifs_debug.c 2011-05-19 00:06:34.000000000 -0400
44581+++ linux-2.6.39/fs/cifs/cifs_debug.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 44582@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
44583 tcon = list_entry(tmp3,
44584 struct cifsTconInfo,
44585 tcon_list);
44586- atomic_set(&tcon->num_smbs_sent, 0);
44587- atomic_set(&tcon->num_writes, 0);
44588- atomic_set(&tcon->num_reads, 0);
44589- atomic_set(&tcon->num_oplock_brks, 0);
44590- atomic_set(&tcon->num_opens, 0);
44591- atomic_set(&tcon->num_posixopens, 0);
44592- atomic_set(&tcon->num_posixmkdirs, 0);
44593- atomic_set(&tcon->num_closes, 0);
44594- atomic_set(&tcon->num_deletes, 0);
44595- atomic_set(&tcon->num_mkdirs, 0);
44596- atomic_set(&tcon->num_rmdirs, 0);
44597- atomic_set(&tcon->num_renames, 0);
44598- atomic_set(&tcon->num_t2renames, 0);
44599- atomic_set(&tcon->num_ffirst, 0);
44600- atomic_set(&tcon->num_fnext, 0);
44601- atomic_set(&tcon->num_fclose, 0);
44602- atomic_set(&tcon->num_hardlinks, 0);
44603- atomic_set(&tcon->num_symlinks, 0);
44604- atomic_set(&tcon->num_locks, 0);
44605+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
44606+ atomic_set_unchecked(&tcon->num_writes, 0);
44607+ atomic_set_unchecked(&tcon->num_reads, 0);
44608+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
44609+ atomic_set_unchecked(&tcon->num_opens, 0);
44610+ atomic_set_unchecked(&tcon->num_posixopens, 0);
44611+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
44612+ atomic_set_unchecked(&tcon->num_closes, 0);
44613+ atomic_set_unchecked(&tcon->num_deletes, 0);
44614+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
44615+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
44616+ atomic_set_unchecked(&tcon->num_renames, 0);
44617+ atomic_set_unchecked(&tcon->num_t2renames, 0);
44618+ atomic_set_unchecked(&tcon->num_ffirst, 0);
44619+ atomic_set_unchecked(&tcon->num_fnext, 0);
44620+ atomic_set_unchecked(&tcon->num_fclose, 0);
44621+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
44622+ atomic_set_unchecked(&tcon->num_symlinks, 0);
44623+ atomic_set_unchecked(&tcon->num_locks, 0);
44624 }
44625 }
44626 }
44627@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
44628 if (tcon->need_reconnect)
44629 seq_puts(m, "\tDISCONNECTED ");
44630 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
44631- atomic_read(&tcon->num_smbs_sent),
44632- atomic_read(&tcon->num_oplock_brks));
44633+ atomic_read_unchecked(&tcon->num_smbs_sent),
44634+ atomic_read_unchecked(&tcon->num_oplock_brks));
44635 seq_printf(m, "\nReads: %d Bytes: %lld",
44636- atomic_read(&tcon->num_reads),
44637+ atomic_read_unchecked(&tcon->num_reads),
44638 (long long)(tcon->bytes_read));
44639 seq_printf(m, "\nWrites: %d Bytes: %lld",
44640- atomic_read(&tcon->num_writes),
44641+ atomic_read_unchecked(&tcon->num_writes),
44642 (long long)(tcon->bytes_written));
44643 seq_printf(m, "\nFlushes: %d",
44644- atomic_read(&tcon->num_flushes));
44645+ atomic_read_unchecked(&tcon->num_flushes));
44646 seq_printf(m, "\nLocks: %d HardLinks: %d "
44647 "Symlinks: %d",
44648- atomic_read(&tcon->num_locks),
44649- atomic_read(&tcon->num_hardlinks),
44650- atomic_read(&tcon->num_symlinks));
44651+ atomic_read_unchecked(&tcon->num_locks),
44652+ atomic_read_unchecked(&tcon->num_hardlinks),
44653+ atomic_read_unchecked(&tcon->num_symlinks));
44654 seq_printf(m, "\nOpens: %d Closes: %d "
44655 "Deletes: %d",
44656- atomic_read(&tcon->num_opens),
44657- atomic_read(&tcon->num_closes),
44658- atomic_read(&tcon->num_deletes));
44659+ atomic_read_unchecked(&tcon->num_opens),
44660+ atomic_read_unchecked(&tcon->num_closes),
44661+ atomic_read_unchecked(&tcon->num_deletes));
44662 seq_printf(m, "\nPosix Opens: %d "
44663 "Posix Mkdirs: %d",
44664- atomic_read(&tcon->num_posixopens),
44665- atomic_read(&tcon->num_posixmkdirs));
44666+ atomic_read_unchecked(&tcon->num_posixopens),
44667+ atomic_read_unchecked(&tcon->num_posixmkdirs));
44668 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
44669- atomic_read(&tcon->num_mkdirs),
44670- atomic_read(&tcon->num_rmdirs));
44671+ atomic_read_unchecked(&tcon->num_mkdirs),
44672+ atomic_read_unchecked(&tcon->num_rmdirs));
44673 seq_printf(m, "\nRenames: %d T2 Renames %d",
44674- atomic_read(&tcon->num_renames),
44675- atomic_read(&tcon->num_t2renames));
44676+ atomic_read_unchecked(&tcon->num_renames),
44677+ atomic_read_unchecked(&tcon->num_t2renames));
44678 seq_printf(m, "\nFindFirst: %d FNext %d "
44679 "FClose %d",
44680- atomic_read(&tcon->num_ffirst),
44681- atomic_read(&tcon->num_fnext),
44682- atomic_read(&tcon->num_fclose));
44683+ atomic_read_unchecked(&tcon->num_ffirst),
44684+ atomic_read_unchecked(&tcon->num_fnext),
44685+ atomic_read_unchecked(&tcon->num_fclose));
44686 }
44687 }
44688 }
66a7e928
MT		 44689diff -urNp linux-2.6.39/fs/cifs/cifsglob.h linux-2.6.39/fs/cifs/cifsglob.h
44690--- linux-2.6.39/fs/cifs/cifsglob.h 2011-05-19 00:06:34.000000000 -0400
44691+++ linux-2.6.39/fs/cifs/cifsglob.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 44692@@ -305,28 +305,28 @@ struct cifsTconInfo {
44693 __u16 Flags; /* optional support bits */
44694 enum statusEnum tidStatus;
44695 #ifdef CONFIG_CIFS_STATS
44696- atomic_t num_smbs_sent;
44697- atomic_t num_writes;
44698- atomic_t num_reads;
44699- atomic_t num_flushes;
44700- atomic_t num_oplock_brks;
44701- atomic_t num_opens;
44702- atomic_t num_closes;
44703- atomic_t num_deletes;
44704- atomic_t num_mkdirs;
44705- atomic_t num_posixopens;
44706- atomic_t num_posixmkdirs;
44707- atomic_t num_rmdirs;
44708- atomic_t num_renames;
44709- atomic_t num_t2renames;
44710- atomic_t num_ffirst;
44711- atomic_t num_fnext;
44712- atomic_t num_fclose;
44713- atomic_t num_hardlinks;
44714- atomic_t num_symlinks;
44715- atomic_t num_locks;
44716- atomic_t num_acl_get;
44717- atomic_t num_acl_set;
44718+ atomic_unchecked_t num_smbs_sent;
44719+ atomic_unchecked_t num_writes;
44720+ atomic_unchecked_t num_reads;
44721+ atomic_unchecked_t num_flushes;
44722+ atomic_unchecked_t num_oplock_brks;
44723+ atomic_unchecked_t num_opens;
44724+ atomic_unchecked_t num_closes;
44725+ atomic_unchecked_t num_deletes;
44726+ atomic_unchecked_t num_mkdirs;
44727+ atomic_unchecked_t num_posixopens;
44728+ atomic_unchecked_t num_posixmkdirs;
44729+ atomic_unchecked_t num_rmdirs;
44730+ atomic_unchecked_t num_renames;
44731+ atomic_unchecked_t num_t2renames;
44732+ atomic_unchecked_t num_ffirst;
44733+ atomic_unchecked_t num_fnext;
44734+ atomic_unchecked_t num_fclose;
44735+ atomic_unchecked_t num_hardlinks;
44736+ atomic_unchecked_t num_symlinks;
44737+ atomic_unchecked_t num_locks;
44738+ atomic_unchecked_t num_acl_get;
44739+ atomic_unchecked_t num_acl_set;
44740 #ifdef CONFIG_CIFS_STATS2
44741 unsigned long long time_writes;
44742 unsigned long long time_reads;
44743@@ -509,7 +509,7 @@ static inline char CIFS_DIR_SEP(const st
44744 }
44745
44746 #ifdef CONFIG_CIFS_STATS
44747-#define cifs_stats_inc atomic_inc
44748+#define cifs_stats_inc atomic_inc_unchecked
44749
44750 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
44751 unsigned int bytes)
66a7e928
MT		 44752diff -urNp linux-2.6.39/fs/cifs/link.c linux-2.6.39/fs/cifs/link.c
44753--- linux-2.6.39/fs/cifs/link.c 2011-05-19 00:06:34.000000000 -0400
44754+++ linux-2.6.39/fs/cifs/link.c 2011-05-22 19:36:32.000000000 -0400
16454cff 44755@@ -577,7 +577,7 @@ symlink_exit:
58c5fc13
MT		 44756
44757 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
44758 {
44759- char *p = nd_get_link(nd);
44760+ const char *p = nd_get_link(nd);
44761 if (!IS_ERR(p))
44762 kfree(p);
44763 }
66a7e928
MT		 44764diff -urNp linux-2.6.39/fs/coda/cache.c linux-2.6.39/fs/coda/cache.c
44765--- linux-2.6.39/fs/coda/cache.c 2011-05-19 00:06:34.000000000 -0400
44766+++ linux-2.6.39/fs/coda/cache.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 44767@@ -24,7 +24,7 @@
44768 #include "coda_linux.h"
44769 #include "coda_cache.h"
44770
44771-static atomic_t permission_epoch = ATOMIC_INIT(0);
44772+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
44773
44774 /* replace or extend an acl cache hit */
44775 void coda_cache_enter(struct inode *inode, int mask)
44776@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
44777 struct coda_inode_info *cii = ITOC(inode);
44778
44779 spin_lock(&cii->c_lock);
44780- cii->c_cached_epoch = atomic_read(&permission_epoch);
44781+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
44782 if (cii->c_uid != current_fsuid()) {
44783 cii->c_uid = current_fsuid();
44784 cii->c_cached_perm = mask;
44785@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
44786 {
44787 struct coda_inode_info *cii = ITOC(inode);
44788 spin_lock(&cii->c_lock);
44789- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
44790+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
44791 spin_unlock(&cii->c_lock);
44792 }
44793
44794 /* remove all acl caches */
44795 void coda_cache_clear_all(struct super_block *sb)
44796 {
44797- atomic_inc(&permission_epoch);
44798+ atomic_inc_unchecked(&permission_epoch);
44799 }
44800
44801
44802@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
44803 spin_lock(&cii->c_lock);
44804 hit = (mask & cii->c_cached_perm) == mask &&
44805 cii->c_uid == current_fsuid() &&
44806- cii->c_cached_epoch == atomic_read(&permission_epoch);
44807+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
44808 spin_unlock(&cii->c_lock);
44809
44810 return hit;
66a7e928
MT		 44811diff -urNp linux-2.6.39/fs/compat_binfmt_elf.c linux-2.6.39/fs/compat_binfmt_elf.c
44812--- linux-2.6.39/fs/compat_binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
44813+++ linux-2.6.39/fs/compat_binfmt_elf.c 2011-05-22 19:36:32.000000000 -0400
57199397
MT		 44814@@ -30,11 +30,13 @@
44815 #undef elf_phdr
44816 #undef elf_shdr
44817 #undef elf_note
44818+#undef elf_dyn
44819 #undef elf_addr_t
44820 #define elfhdr elf32_hdr
44821 #define elf_phdr elf32_phdr
44822 #define elf_shdr elf32_shdr
44823 #define elf_note elf32_note
44824+#define elf_dyn Elf32_Dyn
44825 #define elf_addr_t Elf32_Addr
44826
44827 /*
66a7e928
MT		 44828diff -urNp linux-2.6.39/fs/compat.c linux-2.6.39/fs/compat.c
44829--- linux-2.6.39/fs/compat.c 2011-05-19 00:06:34.000000000 -0400
44830+++ linux-2.6.39/fs/compat.c 2011-05-22 19:41:37.000000000 -0400
44831@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
6892158b
MT		 44832 goto out;
44833
44834 ret = -EINVAL;
44835- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
44836+ if (nr_segs > UIO_MAXIOV)
44837 goto out;
44838 if (nr_segs > fast_segs) {
44839 ret = -ENOMEM;
66a7e928 44840@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
58c5fc13 44841
bc901d79
MT		 44842 struct compat_readdir_callback {
44843 struct compat_old_linux_dirent __user *dirent;
44844+ struct file * file;
44845 int result;
44846 };
44847
66a7e928 44848@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
bc901d79
MT		 44849 buf->result = -EOVERFLOW;
44850 return -EOVERFLOW;
44851 }
44852+
44853+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44854+ return 0;
44855+
44856 buf->result++;
44857 dirent = buf->dirent;
44858 if (!access_ok(VERIFY_WRITE, dirent,
66a7e928 44859@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
bc901d79
MT		 44860
44861 buf.result = 0;
44862 buf.dirent = dirent;
44863+ buf.file = file;
44864
44865 error = vfs_readdir(file, compat_fillonedir, &buf);
44866 if (buf.result)
66a7e928 44867@@ -917,6 +923,7 @@ struct compat_linux_dirent {
bc901d79
MT		 44868 struct compat_getdents_callback {
44869 struct compat_linux_dirent __user *current_dir;
44870 struct compat_linux_dirent __user *previous;
44871+ struct file * file;
44872 int count;
44873 int error;
44874 };
66a7e928 44875@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
bc901d79
MT		 44876 buf->error = -EOVERFLOW;
44877 return -EOVERFLOW;
44878 }
44879+
44880+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44881+ return 0;
44882+
44883 dirent = buf->previous;
44884 if (dirent) {
44885 if (__put_user(offset, &dirent->d_off))
66a7e928 44886@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
bc901d79
MT		 44887 buf.previous = NULL;
44888 buf.count = count;
44889 buf.error = 0;
44890+ buf.file = file;
44891
44892 error = vfs_readdir(file, compat_filldir, &buf);
44893 if (error >= 0)
66a7e928 44894@@ -1006,6 +1018,7 @@ out:
bc901d79
MT		 44895 struct compat_getdents_callback64 {
44896 struct linux_dirent64 __user *current_dir;
44897 struct linux_dirent64 __user *previous;
44898+ struct file * file;
44899 int count;
44900 int error;
44901 };
66a7e928 44902@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
bc901d79
MT		 44903 buf->error = -EINVAL; /* only used if we fail.. */
44904 if (reclen > buf->count)
44905 return -EINVAL;
44906+
44907+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44908+ return 0;
44909+
44910 dirent = buf->previous;
44911
44912 if (dirent) {
66a7e928 44913@@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un
bc901d79
MT		 44914 buf.previous = NULL;
44915 buf.count = count;
44916 buf.error = 0;
44917+ buf.file = file;
44918
44919 error = vfs_readdir(file, compat_filldir64, &buf);
44920 if (error >= 0)
66a7e928 44921@@ -1436,6 +1454,11 @@ int compat_do_execve(char * filename,
58c5fc13
MT		 44922 compat_uptr_t __user *envp,
44923 struct pt_regs * regs)
44924 {
44925+#ifdef CONFIG_GRKERNSEC
44926+ struct file *old_exec_file;
44927+ struct acl_subject_label *old_acl;
44928+ struct rlimit old_rlim[RLIM_NLIMITS];
44929+#endif
44930 struct linux_binprm *bprm;
44931 struct file *file;
44932 struct files_struct *displaced;
66a7e928 44933@@ -1472,6 +1495,19 @@ int compat_do_execve(char * filename,
58c5fc13
MT		 44934 bprm->filename = filename;
44935 bprm->interp = filename;
44936
71d190be
MT		 44937+ if (gr_process_user_ban()) {
44938+ retval = -EPERM;
44939+ goto out_file;
44940+ }
44941+
58c5fc13
MT		 44942+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
44943+ retval = -EAGAIN;
44944+ if (gr_handle_nproc())
44945+ goto out_file;
44946+ retval = -EACCES;
44947+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
44948+ goto out_file;
44949+
44950 retval = bprm_mm_init(bprm);
44951 if (retval)
44952 goto out_file;
66a7e928 44953@@ -1501,9 +1537,40 @@ int compat_do_execve(char * filename,
58c5fc13
MT		 44954 if (retval < 0)
44955 goto out;
44956
44957+ if (!gr_tpe_allow(file)) {
44958+ retval = -EACCES;
44959+ goto out;
44960+ }
44961+
44962+ if (gr_check_crash_exec(file)) {
44963+ retval = -EACCES;
44964+ goto out;
44965+ }
44966+
44967+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
44968+
bc901d79 44969+ gr_handle_exec_args_compat(bprm, argv);
58c5fc13
MT		 44970+
44971+#ifdef CONFIG_GRKERNSEC
44972+ old_acl = current->acl;
44973+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
44974+ old_exec_file = current->exec_file;
44975+ get_file(file);
44976+ current->exec_file = file;
44977+#endif
44978+
44979+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
44980+ bprm->unsafe & LSM_UNSAFE_SHARE);
44981+ if (retval < 0)
44982+ goto out_fail;
44983+
44984 retval = search_binary_handler(bprm, regs);
44985 if (retval < 0)
44986- goto out;
44987+ goto out_fail;
44988+#ifdef CONFIG_GRKERNSEC
44989+ if (old_exec_file)
44990+ fput(old_exec_file);
44991+#endif
44992
df50ba0c
MT		 44993 /* execve succeeded */
44994 current->fs->in_exec = 0;
66a7e928 44995@@ -1514,6 +1581,14 @@ int compat_do_execve(char * filename,
58c5fc13
MT		 44996 put_files_struct(displaced);
44997 return retval;
44998
44999+out_fail:
45000+#ifdef CONFIG_GRKERNSEC
45001+ current->acl = old_acl;
45002+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45003+ fput(current->exec_file);
45004+ current->exec_file = old_exec_file;
45005+#endif
45006+
45007 out:
bc901d79
MT		 45008 if (bprm->mm) {
45009 acct_arg_size(bprm, 0);
66a7e928
MT		 45010@@ -1681,6 +1756,8 @@ int compat_core_sys_select(int n, compat
45011 struct fdtable *fdt;
45012 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
45013
45014+ pax_track_stack();
45015+
45016 if (n < 0)
45017 goto out_nofds;
45018
45019diff -urNp linux-2.6.39/fs/compat_ioctl.c linux-2.6.39/fs/compat_ioctl.c
45020--- linux-2.6.39/fs/compat_ioctl.c 2011-05-19 00:06:34.000000000 -0400
45021+++ linux-2.6.39/fs/compat_ioctl.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 45022@@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
6892158b
MT		 45023
45024 err = get_user(palp, &up->palette);
45025 err |= get_user(length, &up->length);
45026+ if (err)
45027+ return -EFAULT;
45028
45029 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
45030 err = put_user(compat_ptr(palp), &up_native->palette);
16454cff 45031@@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
bc901d79
MT		 45032 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
45033 {
45034 unsigned int a, b;
45035- a = *(unsigned int *)p;
45036- b = *(unsigned int *)q;
45037+ a = *(const unsigned int *)p;
45038+ b = *(const unsigned int *)q;
45039 if (a > b)
45040 return 1;
45041 if (a < b)
66a7e928
MT		 45042diff -urNp linux-2.6.39/fs/configfs/dir.c linux-2.6.39/fs/configfs/dir.c
45043--- linux-2.6.39/fs/configfs/dir.c 2011-05-19 00:06:34.000000000 -0400
45044+++ linux-2.6.39/fs/configfs/dir.c 2011-05-22 19:36:32.000000000 -0400
45045@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
45046 }
45047 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
45048 struct configfs_dirent *next;
45049- const char * name;
45050+ const unsigned char * name;
45051+ char d_name[sizeof(next->s_dentry->d_iname)];
45052 int len;
45053 struct inode *inode = NULL;
45054
45055@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
45056 continue;
45057
45058 name = configfs_get_name(next);
45059- len = strlen(name);
45060+ if (next->s_dentry && name == next->s_dentry->d_iname) {
45061+ len = next->s_dentry->d_name.len;
45062+ memcpy(d_name, name, len);
45063+ name = d_name;
45064+ } else
45065+ len = strlen(name);
45066
45067 /*
45068 * We'll have a dentry and an inode for
45069diff -urNp linux-2.6.39/fs/configfs/file.c linux-2.6.39/fs/configfs/file.c
45070--- linux-2.6.39/fs/configfs/file.c 2011-05-19 00:06:34.000000000 -0400
45071+++ linux-2.6.39/fs/configfs/file.c 2011-05-22 19:36:32.000000000 -0400
45072@@ -215,7 +215,7 @@ static int check_perm(struct inode * ino
45073 struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent);
45074 struct configfs_attribute * attr = to_attr(file->f_path.dentry);
45075 struct configfs_buffer * buffer;
45076- struct configfs_item_operations * ops = NULL;
45077+ struct configfs_item_operations *ops = NULL;
45078 int error = 0;
45079
45080 if (!item || !attr)
45081diff -urNp linux-2.6.39/fs/configfs/item.c linux-2.6.39/fs/configfs/item.c
45082--- linux-2.6.39/fs/configfs/item.c 2011-05-19 00:06:34.000000000 -0400
45083+++ linux-2.6.39/fs/configfs/item.c 2011-05-22 19:36:32.000000000 -0400
45084@@ -123,7 +123,7 @@ void config_item_init_type_name(struct c
45085 EXPORT_SYMBOL(config_item_init_type_name);
45086
45087 void config_group_init_type_name(struct config_group *group, const char *name,
45088- struct config_item_type *type)
45089+ struct config_item_type *type)
45090 {
45091 config_item_set_name(&group->cg_item, name);
45092 group->cg_item.ci_type = type;
45093diff -urNp linux-2.6.39/fs/dcache.c linux-2.6.39/fs/dcache.c
45094--- linux-2.6.39/fs/dcache.c 2011-05-19 00:06:34.000000000 -0400
45095+++ linux-2.6.39/fs/dcache.c 2011-05-22 19:36:32.000000000 -0400
45096@@ -3069,7 +3069,7 @@ void __init vfs_caches_init(unsigned lon
71d190be
MT		 45097 mempages -= reserve;
45098
45099 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
45100- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
45101+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
45102
45103 dcache_init();
45104 inode_init();
66a7e928
MT		 45105diff -urNp linux-2.6.39/fs/dlm/lockspace.c linux-2.6.39/fs/dlm/lockspace.c
45106--- linux-2.6.39/fs/dlm/lockspace.c 2011-05-19 00:06:34.000000000 -0400
45107+++ linux-2.6.39/fs/dlm/lockspace.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c
MT		 45108@@ -200,7 +200,7 @@ static int dlm_uevent(struct kset *kset,
45109 return 0;
58c5fc13
MT		 45110 }
45111
df50ba0c
MT		 45112-static struct kset_uevent_ops dlm_uevent_ops = {
45113+static const struct kset_uevent_ops dlm_uevent_ops = {
45114 .uevent = dlm_uevent,
ae4e228f 45115 };
df50ba0c 45116
66a7e928
MT		 45117diff -urNp linux-2.6.39/fs/ecryptfs/inode.c linux-2.6.39/fs/ecryptfs/inode.c
45118--- linux-2.6.39/fs/ecryptfs/inode.c 2011-05-19 00:06:34.000000000 -0400
45119+++ linux-2.6.39/fs/ecryptfs/inode.c 2011-05-22 19:36:32.000000000 -0400
45120@@ -621,7 +621,7 @@ static int ecryptfs_readlink_lower(struc
ae4e228f
MT		 45121 old_fs = get_fs();
45122 set_fs(get_ds());
45123 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
45124- (char __user *)lower_buf,
45125+ (__force char __user *)lower_buf,
45126 lower_bufsiz);
45127 set_fs(old_fs);
df50ba0c 45128 if (rc < 0)
66a7e928 45129@@ -667,7 +667,7 @@ static void *ecryptfs_follow_link(struct
ae4e228f
MT		 45130 }
45131 old_fs = get_fs();
45132 set_fs(get_ds());
45133- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
45134+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
45135 set_fs(old_fs);
45136 if (rc < 0) {
45137 kfree(buf);
66a7e928 45138@@ -682,7 +682,7 @@ out:
ae4e228f
MT		 45139 static void
45140 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
45141 {
45142- char *buf = nd_get_link(nd);
45143+ const char *buf = nd_get_link(nd);
45144 if (!IS_ERR(buf)) {
45145 /* Free the char* */
45146 kfree(buf);
66a7e928
MT		 45147diff -urNp linux-2.6.39/fs/ecryptfs/miscdev.c linux-2.6.39/fs/ecryptfs/miscdev.c
45148--- linux-2.6.39/fs/ecryptfs/miscdev.c 2011-05-19 00:06:34.000000000 -0400
45149+++ linux-2.6.39/fs/ecryptfs/miscdev.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 45150@@ -328,7 +328,7 @@ check_list:
ae4e228f
MT		 45151 goto out_unlock_msg_ctx;
45152 i = 5;
45153 if (msg_ctx->msg) {
45154- if (copy_to_user(&buf[i], packet_length, packet_length_size))
45155+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
45156 goto out_unlock_msg_ctx;
45157 i += packet_length_size;
45158 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
66a7e928
MT		 45159diff -urNp linux-2.6.39/fs/exec.c linux-2.6.39/fs/exec.c
45160--- linux-2.6.39/fs/exec.c 2011-05-19 00:06:34.000000000 -0400
45161+++ linux-2.6.39/fs/exec.c 2011-05-22 20:44:52.000000000 -0400
bc901d79 45162@@ -55,12 +55,24 @@
58c5fc13 45163 #include <linux/fs_struct.h>
ae4e228f 45164 #include <linux/pipe_fs_i.h>
bc901d79 45165 #include <linux/oom.h>
58c5fc13
MT		 45166+#include <linux/random.h>
45167+#include <linux/seq_file.h>
45168+
45169+#ifdef CONFIG_PAX_REFCOUNT
45170+#include <linux/kallsyms.h>
45171+#include <linux/kdebug.h>
45172+#endif
45173
45174 #include <asm/uaccess.h>
45175 #include <asm/mmu_context.h>
45176 #include <asm/tlb.h>
45177 #include "internal.h"
45178
45179+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
45180+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
45181+EXPORT_SYMBOL(pax_set_initial_flags_func);
45182+#endif
45183+
45184 int core_uses_pid;
45185 char core_pattern[CORENAME_MAX_SIZE] = "core";
ae4e228f 45186 unsigned int core_pipe_limit;
8308f9c9
MT		 45187@@ -70,7 +82,7 @@ struct core_name {
45188 char *corename;
45189 int used, size;
45190 };
45191-static atomic_t call_count = ATOMIC_INIT(1);
45192+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
45193
45194 /* The maximal length of core_pattern is also specified in sysctl.c */
45195
66a7e928
MT		 45196@@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
45197 char *tmp = getname(library);
45198 int error = PTR_ERR(tmp);
45199 static const struct open_flags uselib_flags = {
45200- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45201+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45202 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
45203 .intent = LOOKUP_OPEN
45204 };
45205@@ -190,18 +202,10 @@ struct page *get_arg_page(struct linux_b
58c5fc13
MT		 45206 int write)
45207 {
45208 struct page *page;
45209- int ret;
45210
45211-#ifdef CONFIG_STACK_GROWSUP
45212- if (write) {
45213- ret = expand_stack_downwards(bprm->vma, pos);
45214- if (ret < 0)
45215- return NULL;
45216- }
45217-#endif
45218- ret = get_user_pages(current, bprm->mm, pos,
45219- 1, write, 1, &page, NULL);
45220- if (ret <= 0)
45221+ if (0 > expand_stack_downwards(bprm->vma, pos))
45222+ return NULL;
45223+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
45224 return NULL;
45225
45226 if (write) {
66a7e928 45227@@ -276,6 +280,11 @@ static int __bprm_mm_init(struct linux_b
58c5fc13
MT		 45228 vma->vm_end = STACK_TOP_MAX;
45229 vma->vm_start = vma->vm_end - PAGE_SIZE;
57199397 45230 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
58c5fc13
MT		 45231+
45232+#ifdef CONFIG_PAX_SEGMEXEC
45233+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
45234+#endif
45235+
45236 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
df50ba0c 45237 INIT_LIST_HEAD(&vma->anon_vma_chain);
bc901d79 45238
66a7e928 45239@@ -290,6 +299,12 @@ static int __bprm_mm_init(struct linux_b
58c5fc13
MT		 45240 mm->stack_vm = mm->total_vm = 1;
45241 up_write(&mm->mmap_sem);
45242 bprm->p = vma->vm_end - sizeof(void *);
45243+
45244+#ifdef CONFIG_PAX_RANDUSTACK
45245+ if (randomize_va_space)
45246+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
45247+#endif
45248+
45249 return 0;
45250 err:
45251 up_write(&mm->mmap_sem);
66a7e928 45252@@ -525,7 +540,7 @@ int copy_strings_kernel(int argc, const
ae4e228f
MT		 45253 int r;
45254 mm_segment_t oldfs = get_fs();
45255 set_fs(KERNEL_DS);
6892158b
MT		 45256- r = copy_strings(argc, (const char __user *const __user *)argv, bprm);
45257+ r = copy_strings(argc, (__force const char __user *const __user *)argv, bprm);
ae4e228f
MT		 45258 set_fs(oldfs);
45259 return r;
45260 }
66a7e928 45261@@ -555,7 +570,8 @@ static int shift_arg_pages(struct vm_are
58c5fc13
MT		 45262 unsigned long new_end = old_end - shift;
45263 struct mmu_gather *tlb;
45264
45265- BUG_ON(new_start > new_end);
45266+ if (new_start >= new_end || new_start < mmap_min_addr)
bc901d79 45267+ return -ENOMEM;
58c5fc13
MT		 45268
45269 /*
45270 * ensure there are no vmas between where we want to go
66a7e928 45271@@ -564,6 +580,10 @@ static int shift_arg_pages(struct vm_are
58c5fc13
MT		 45272 if (vma != find_vma(mm, new_start))
45273 return -EFAULT;
45274
45275+#ifdef CONFIG_PAX_SEGMEXEC
45276+ BUG_ON(pax_find_mirror_vma(vma));
45277+#endif
45278+
45279 /*
45280 * cover the whole range: [new_start, old_end)
45281 */
66a7e928 45282@@ -644,10 +664,6 @@ int setup_arg_pages(struct linux_binprm
bc901d79
MT		 45283 stack_top = arch_align_stack(stack_top);
45284 stack_top = PAGE_ALIGN(stack_top);
45285
45286- if (unlikely(stack_top < mmap_min_addr) ||
45287- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
45288- return -ENOMEM;
45289-
45290 stack_shift = vma->vm_end - stack_top;
45291
45292 bprm->p -= stack_shift;
66a7e928 45293@@ -659,8 +675,28 @@ int setup_arg_pages(struct linux_binprm
58c5fc13
MT		 45294 bprm->exec -= stack_shift;
45295
45296 down_write(&mm->mmap_sem);
45297+
45298+ /* Move stack pages down in memory. */
45299+ if (stack_shift) {
45300+ ret = shift_arg_pages(vma, stack_shift);
45301+ if (ret)
45302+ goto out_unlock;
45303+ }
45304+
45305 vm_flags = VM_STACK_FLAGS;
45306
58c5fc13
MT		 45307+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45308+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
45309+ vm_flags &= ~VM_EXEC;
45310+
45311+#ifdef CONFIG_PAX_MPROTECT
45312+ if (mm->pax_flags & MF_PAX_MPROTECT)
45313+ vm_flags &= ~VM_MAYEXEC;
45314+#endif
45315+
45316+ }
45317+#endif
45318+
ae4e228f
MT		 45319 /*
45320 * Adjust stack execute permissions; explicitly enable for
45321 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
66a7e928 45322@@ -679,13 +715,6 @@ int setup_arg_pages(struct linux_binprm
58c5fc13
MT		 45323 goto out_unlock;
45324 BUG_ON(prev != vma);
45325
45326- /* Move stack pages down in memory. */
45327- if (stack_shift) {
45328- ret = shift_arg_pages(vma, stack_shift);
ae4e228f
MT		 45329- if (ret)
45330- goto out_unlock;
58c5fc13
MT		 45331- }
45332-
57199397
MT		 45333 /* mprotect_fixup is overkill to remove the temporary stack flags */
45334 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
45335
66a7e928
MT		 45336@@ -725,7 +754,7 @@ struct file *open_exec(const char *name)
45337 struct file *file;
58c5fc13 45338 int err;
66a7e928
MT		 45339 static const struct open_flags open_exec_flags = {
45340- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45341+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45342 .acc_mode = MAY_EXEC | MAY_OPEN,
45343 .intent = LOOKUP_OPEN
45344 };
45345@@ -766,7 +795,7 @@ int kernel_read(struct file *file, loff_
ae4e228f
MT		 45346 old_fs = get_fs();
45347 set_fs(get_ds());
45348 /* The cast to a user pointer is valid due to the set_fs() */
45349- result = vfs_read(file, (void __user *)addr, count, &pos);
45350+ result = vfs_read(file, (__force void __user *)addr, count, &pos);
45351 set_fs(old_fs);
45352 return result;
45353 }
66a7e928 45354@@ -1188,7 +1217,7 @@ int check_unsafe_exec(struct linux_binpr
58c5fc13
MT		 45355 }
45356 rcu_read_unlock();
45357
45358- if (p->fs->users > n_fs) {
45359+ if (atomic_read(&p->fs->users) > n_fs) {
45360 bprm->unsafe |= LSM_UNSAFE_SHARE;
45361 } else {
45362 res = -EAGAIN;
66a7e928 45363@@ -1384,6 +1413,11 @@ int do_execve(const char * filename,
6892158b 45364 const char __user *const __user *envp,
58c5fc13
MT		 45365 struct pt_regs * regs)
45366 {
45367+#ifdef CONFIG_GRKERNSEC
45368+ struct file *old_exec_file;
45369+ struct acl_subject_label *old_acl;
45370+ struct rlimit old_rlim[RLIM_NLIMITS];
45371+#endif
45372 struct linux_binprm *bprm;
45373 struct file *file;
45374 struct files_struct *displaced;
66a7e928 45375@@ -1420,6 +1454,23 @@ int do_execve(const char * filename,
58c5fc13
MT		 45376 bprm->filename = filename;
45377 bprm->interp = filename;
45378
71d190be
MT		 45379+ if (gr_process_user_ban()) {
45380+ retval = -EPERM;
45381+ goto out_file;
45382+ }
45383+
58c5fc13
MT		 45384+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45385+
45386+ if (gr_handle_nproc()) {
45387+ retval = -EAGAIN;
45388+ goto out_file;
45389+ }
45390+
45391+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
45392+ retval = -EACCES;
45393+ goto out_file;
45394+ }
45395+
45396 retval = bprm_mm_init(bprm);
45397 if (retval)
45398 goto out_file;
66a7e928 45399@@ -1449,9 +1500,40 @@ int do_execve(const char * filename,
58c5fc13
MT		 45400 if (retval < 0)
45401 goto out;
45402
45403+ if (!gr_tpe_allow(file)) {
45404+ retval = -EACCES;
45405+ goto out;
45406+ }
45407+
45408+ if (gr_check_crash_exec(file)) {
45409+ retval = -EACCES;
45410+ goto out;
45411+ }
45412+
45413+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45414+
45415+ gr_handle_exec_args(bprm, argv);
45416+
45417+#ifdef CONFIG_GRKERNSEC
45418+ old_acl = current->acl;
45419+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45420+ old_exec_file = current->exec_file;
45421+ get_file(file);
45422+ current->exec_file = file;
45423+#endif
45424+
45425+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
bc901d79 45426+ bprm->unsafe & LSM_UNSAFE_SHARE);
58c5fc13
MT		 45427+ if (retval < 0)
45428+ goto out_fail;
45429+
58c5fc13
MT		 45430 retval = search_binary_handler(bprm,regs);
45431 if (retval < 0)
45432- goto out;
45433+ goto out_fail;
45434+#ifdef CONFIG_GRKERNSEC
45435+ if (old_exec_file)
45436+ fput(old_exec_file);
45437+#endif
45438
df50ba0c
MT		 45439 /* execve succeeded */
45440 current->fs->in_exec = 0;
66a7e928 45441@@ -1462,6 +1544,14 @@ int do_execve(const char * filename,
58c5fc13
MT		 45442 put_files_struct(displaced);
45443 return retval;
45444
45445+out_fail:
45446+#ifdef CONFIG_GRKERNSEC
45447+ current->acl = old_acl;
45448+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45449+ fput(current->exec_file);
45450+ current->exec_file = old_exec_file;
45451+#endif
45452+
45453 out:
bc901d79
MT		 45454 if (bprm->mm) {
45455 acct_arg_size(bprm, 0);
66a7e928 45456@@ -1507,7 +1597,7 @@ static int expand_corename(struct core_n
8308f9c9
MT		 45457 {
45458 char *old_corename = cn->corename;
45459
45460- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
45461+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
45462 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
45463
45464 if (!cn->corename) {
66a7e928 45465@@ -1560,7 +1650,7 @@ static int format_corename(struct core_n
8308f9c9
MT		 45466 int pid_in_pattern = 0;
45467 int err = 0;
45468
45469- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
45470+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
45471 cn->corename = kmalloc(cn->size, GFP_KERNEL);
45472 cn->used = 0;
45473
66a7e928 45474@@ -1648,6 +1738,208 @@ out:
58c5fc13
MT		 45475 return ispipe;
45476 }
45477
45478+int pax_check_flags(unsigned long *flags)
45479+{
45480+ int retval = 0;
45481+
45482+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
45483+ if (*flags & MF_PAX_SEGMEXEC)
45484+ {
45485+ *flags &= ~MF_PAX_SEGMEXEC;
45486+ retval = -EINVAL;
45487+ }
45488+#endif
45489+
45490+ if ((*flags & MF_PAX_PAGEEXEC)
45491+
45492+#ifdef CONFIG_PAX_PAGEEXEC
45493+ && (*flags & MF_PAX_SEGMEXEC)
45494+#endif
45495+
45496+ )
45497+ {
45498+ *flags &= ~MF_PAX_PAGEEXEC;
45499+ retval = -EINVAL;
45500+ }
45501+
45502+ if ((*flags & MF_PAX_MPROTECT)
45503+
45504+#ifdef CONFIG_PAX_MPROTECT
45505+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45506+#endif
45507+
45508+ )
45509+ {
45510+ *flags &= ~MF_PAX_MPROTECT;
45511+ retval = -EINVAL;
45512+ }
45513+
45514+ if ((*flags & MF_PAX_EMUTRAMP)
45515+
45516+#ifdef CONFIG_PAX_EMUTRAMP
45517+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45518+#endif
45519+
45520+ )
45521+ {
45522+ *flags &= ~MF_PAX_EMUTRAMP;
45523+ retval = -EINVAL;
45524+ }
45525+
45526+ return retval;
45527+}
45528+
45529+EXPORT_SYMBOL(pax_check_flags);
45530+
45531+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45532+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
45533+{
45534+ struct task_struct *tsk = current;
45535+ struct mm_struct *mm = current->mm;
45536+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
45537+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
45538+ char *path_exec = NULL;
45539+ char *path_fault = NULL;
45540+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
45541+
45542+ if (buffer_exec && buffer_fault) {
45543+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
45544+
45545+ down_read(&mm->mmap_sem);
45546+ vma = mm->mmap;
45547+ while (vma && (!vma_exec || !vma_fault)) {
45548+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
45549+ vma_exec = vma;
45550+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
45551+ vma_fault = vma;
45552+ vma = vma->vm_next;
45553+ }
45554+ if (vma_exec) {
45555+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
45556+ if (IS_ERR(path_exec))
45557+ path_exec = "<path too long>";
45558+ else {
45559+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
45560+ if (path_exec) {
45561+ *path_exec = 0;
45562+ path_exec = buffer_exec;
45563+ } else
45564+ path_exec = "<path too long>";
45565+ }
45566+ }
45567+ if (vma_fault) {
45568+ start = vma_fault->vm_start;
45569+ end = vma_fault->vm_end;
45570+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
45571+ if (vma_fault->vm_file) {
45572+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
45573+ if (IS_ERR(path_fault))
45574+ path_fault = "<path too long>";
45575+ else {
45576+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
45577+ if (path_fault) {
45578+ *path_fault = 0;
45579+ path_fault = buffer_fault;
45580+ } else
45581+ path_fault = "<path too long>";
45582+ }
45583+ } else
45584+ path_fault = "<anonymous mapping>";
45585+ }
45586+ up_read(&mm->mmap_sem);
45587+ }
45588+ if (tsk->signal->curr_ip)
ae4e228f 45589+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
58c5fc13
MT		 45590+ else
45591+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
45592+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
45593+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
45594+ task_uid(tsk), task_euid(tsk), pc, sp);
45595+ free_page((unsigned long)buffer_exec);
45596+ free_page((unsigned long)buffer_fault);
45597+ pax_report_insns(pc, sp);
45598+ do_coredump(SIGKILL, SIGKILL, regs);
45599+}
45600+#endif
45601+
45602+#ifdef CONFIG_PAX_REFCOUNT
45603+void pax_report_refcount_overflow(struct pt_regs *regs)
45604+{
45605+ if (current->signal->curr_ip)
ae4e228f
MT		 45606+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45607+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
58c5fc13
MT		 45608+ else
45609+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45610+ current->comm, task_pid_nr(current), current_uid(), current_euid());
45611+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
45612+ show_regs(regs);
ae4e228f 45613+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
58c5fc13
MT		 45614+}
45615+#endif
45616+
45617+#ifdef CONFIG_PAX_USERCOPY
6892158b
MT		 45618+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
45619+int object_is_on_stack(const void *obj, unsigned long len)
45620+{
45621+ const void * const stack = task_stack_page(current);
45622+ const void * const stackend = stack + THREAD_SIZE;
45623+
57199397 45624+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
6892158b
MT		 45625+ const void *frame = NULL;
45626+ const void *oldframe;
57199397
MT		 45627+#endif
45628+
6892158b
MT		 45629+ if (obj + len < obj)
45630+ return -1;
57199397 45631+
6892158b
MT		 45632+ if (obj + len <= stack || stackend <= obj)
45633+ return 0;
57199397 45634+
6892158b 45635+ if (obj < stack || stackend < obj + len)
57199397
MT		 45636+ return -1;
45637+
57199397 45638+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
6892158b
MT		 45639+ oldframe = __builtin_frame_address(1);
45640+ if (oldframe)
45641+ frame = __builtin_frame_address(2);
45642+ /*
45643+ low ----------------------------------------------> high
45644+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
45645+ ^----------------^
45646+ allow copies only within here
45647+ */
45648+ while (stack <= frame && frame < stackend) {
45649+ /* if obj + len extends past the last frame, this
45650+ check won't pass and the next frame will be 0,
45651+ causing us to bail out and correctly report
45652+ the copy as invalid
57199397 45653+ */
6892158b
MT		 45654+ if (obj + len <= frame)
45655+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
45656+ oldframe = frame;
45657+ frame = *(const void * const *)frame;
57199397 45658+ }
57199397 45659+ return -1;
6892158b
MT		 45660+#else
45661+ return 1;
45662+#endif
57199397
MT		 45663+}
45664+
45665+
71d190be 45666+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
58c5fc13 45667+{
ae4e228f 45668+ if (current->signal->curr_ip)
71d190be
MT		 45669+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45670+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
ae4e228f 45671+ else
71d190be
MT		 45672+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45673+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
58c5fc13 45674+ dump_stack();
71d190be 45675+ gr_handle_kernel_exploit();
58c5fc13
MT		 45676+ do_group_exit(SIGKILL);
45677+}
45678+#endif
45679+
df50ba0c 45680 static int zap_process(struct task_struct *start, int exit_code)
58c5fc13
MT		 45681 {
45682 struct task_struct *t;
66a7e928 45683@@ -1858,17 +2150,17 @@ static void wait_for_dump_helpers(struct
ae4e228f
MT		 45684 pipe = file->f_path.dentry->d_inode->i_pipe;
45685
45686 pipe_lock(pipe);
45687- pipe->readers++;
45688- pipe->writers--;
45689+ atomic_inc(&pipe->readers);
45690+ atomic_dec(&pipe->writers);
45691
45692- while ((pipe->readers > 1) && (!signal_pending(current))) {
45693+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
45694 wake_up_interruptible_sync(&pipe->wait);
45695 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45696 pipe_wait(pipe);
45697 }
45698
45699- pipe->readers--;
45700- pipe->writers++;
45701+ atomic_dec(&pipe->readers);
45702+ atomic_inc(&pipe->writers);
45703 pipe_unlock(pipe);
45704
45705 }
66a7e928 45706@@ -1929,7 +2221,7 @@ void do_coredump(long signr, int exit_co
8308f9c9
MT		 45707 int retval = 0;
45708 int flag = 0;
45709 int ispipe;
45710- static atomic_t core_dump_count = ATOMIC_INIT(0);
45711+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
45712 struct coredump_params cprm = {
45713 .signr = signr,
45714 .regs = regs,
66a7e928 45715@@ -1944,6 +2236,9 @@ void do_coredump(long signr, int exit_co
71d190be
MT		 45716
45717 audit_core_dumps(signr);
45718
45719+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
45720+ gr_handle_brute_attach(current, cprm.mm_flags);
45721+
45722 binfmt = mm->binfmt;
45723 if (!binfmt || !binfmt->core_dump)
45724 goto fail;
66a7e928 45725@@ -1984,6 +2279,8 @@ void do_coredump(long signr, int exit_co
bc901d79
MT		 45726 goto fail_corename;
45727 }
58c5fc13 45728
58c5fc13
MT		 45729+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
45730+
6892158b 45731 if (ispipe) {
bc901d79
MT		 45732 int dump_count;
45733 char **helper_argv;
66a7e928 45734@@ -2011,7 +2308,7 @@ void do_coredump(long signr, int exit_co
8308f9c9
MT		 45735 }
45736 cprm.limit = RLIM_INFINITY;
45737
45738- dump_count = atomic_inc_return(&core_dump_count);
45739+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
45740 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
45741 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
45742 task_tgid_vnr(current), current->comm);
66a7e928 45743@@ -2081,7 +2378,7 @@ close_fail:
8308f9c9
MT		 45744 filp_close(cprm.file, NULL);
45745 fail_dropcount:
45746 if (ispipe)
45747- atomic_dec(&core_dump_count);
45748+ atomic_dec_unchecked(&core_dump_count);
45749 fail_unlock:
45750 kfree(cn.corename);
45751 fail_corename:
66a7e928
MT		 45752diff -urNp linux-2.6.39/fs/ext2/balloc.c linux-2.6.39/fs/ext2/balloc.c
45753--- linux-2.6.39/fs/ext2/balloc.c 2011-05-19 00:06:34.000000000 -0400
45754+++ linux-2.6.39/fs/ext2/balloc.c 2011-05-22 19:41:37.000000000 -0400
bc901d79 45755@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
58c5fc13
MT		 45756
45757 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45758 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45759- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45760+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45761 sbi->s_resuid != current_fsuid() &&
45762 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45763 return 0;
66a7e928
MT		 45764diff -urNp linux-2.6.39/fs/ext3/balloc.c linux-2.6.39/fs/ext3/balloc.c
45765--- linux-2.6.39/fs/ext3/balloc.c 2011-05-19 00:06:34.000000000 -0400
45766+++ linux-2.6.39/fs/ext3/balloc.c 2011-05-22 19:41:37.000000000 -0400
16454cff 45767@@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
58c5fc13
MT		 45768
45769 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45770 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45771- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45772+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45773 sbi->s_resuid != current_fsuid() &&
45774 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45775 return 0;
66a7e928
MT		 45776diff -urNp linux-2.6.39/fs/ext4/balloc.c linux-2.6.39/fs/ext4/balloc.c
45777--- linux-2.6.39/fs/ext4/balloc.c 2011-05-19 00:06:34.000000000 -0400
45778+++ linux-2.6.39/fs/ext4/balloc.c 2011-05-22 19:41:37.000000000 -0400
45779@@ -522,7 +522,7 @@ static int ext4_has_free_blocks(struct e
58c5fc13
MT		 45780 /* Hm, nope. Are (enough) root reserved blocks available? */
45781 if (sbi->s_resuid == current_fsuid() ||
45782 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
45783- capable(CAP_SYS_RESOURCE)) {
45784+ capable_nolog(CAP_SYS_RESOURCE)) {
45785 if (free_blocks >= (nblocks + dirty_blocks))
45786 return 1;
45787 }
66a7e928
MT		 45788diff -urNp linux-2.6.39/fs/ext4/ext4.h linux-2.6.39/fs/ext4/ext4.h
45789--- linux-2.6.39/fs/ext4/ext4.h 2011-05-19 00:06:34.000000000 -0400
45790+++ linux-2.6.39/fs/ext4/ext4.h 2011-05-22 19:36:32.000000000 -0400
16454cff 45791@@ -1166,19 +1166,19 @@ struct ext4_sb_info {
bc901d79
MT		 45792 unsigned long s_mb_last_start;
45793
45794 /* stats for buddy allocator */
45795- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
45796- atomic_t s_bal_success; /* we found long enough chunks */
45797- atomic_t s_bal_allocated; /* in blocks */
45798- atomic_t s_bal_ex_scanned; /* total extents scanned */
45799- atomic_t s_bal_goals; /* goal hits */
45800- atomic_t s_bal_breaks; /* too long searches */
45801- atomic_t s_bal_2orders; /* 2^order hits */
45802+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
45803+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
45804+ atomic_unchecked_t s_bal_allocated; /* in blocks */
45805+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
45806+ atomic_unchecked_t s_bal_goals; /* goal hits */
45807+ atomic_unchecked_t s_bal_breaks; /* too long searches */
45808+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
45809 spinlock_t s_bal_lock;
45810 unsigned long s_mb_buddies_generated;
45811 unsigned long long s_mb_generation_time;
45812- atomic_t s_mb_lost_chunks;
45813- atomic_t s_mb_preallocated;
45814- atomic_t s_mb_discarded;
45815+ atomic_unchecked_t s_mb_lost_chunks;
45816+ atomic_unchecked_t s_mb_preallocated;
45817+ atomic_unchecked_t s_mb_discarded;
45818 atomic_t s_lock_busy;
45819
45820 /* locality groups */
66a7e928
MT		 45821diff -urNp linux-2.6.39/fs/ext4/mballoc.c linux-2.6.39/fs/ext4/mballoc.c
45822--- linux-2.6.39/fs/ext4/mballoc.c 2011-05-19 00:06:34.000000000 -0400
45823+++ linux-2.6.39/fs/ext4/mballoc.c 2011-05-22 19:36:32.000000000 -0400
45824@@ -1851,7 +1851,7 @@ void ext4_mb_simple_scan_group(struct ex
bc901d79
MT		 45825 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
45826
45827 if (EXT4_SB(sb)->s_mb_stats)
45828- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
45829+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
45830
45831 break;
45832 }
66a7e928 45833@@ -2145,7 +2145,7 @@ repeat:
bc901d79
MT		 45834 ac->ac_status = AC_STATUS_CONTINUE;
45835 ac->ac_flags |= EXT4_MB_HINT_FIRST;
45836 cr = 3;
45837- atomic_inc(&sbi->s_mb_lost_chunks);
45838+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
45839 goto repeat;
45840 }
45841 }
66a7e928
MT		 45842@@ -2188,6 +2188,8 @@ static int ext4_mb_seq_groups_show(struc
45843 ext4_grpblk_t counters[16];
45844 } sg;
45845
45846+ pax_track_stack();
45847+
45848 group--;
45849 if (group == 0)
45850 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
45851@@ -2611,25 +2613,25 @@ int ext4_mb_release(struct super_block *
bc901d79
MT		 45852 if (sbi->s_mb_stats) {
45853 printk(KERN_INFO
45854 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
45855- atomic_read(&sbi->s_bal_allocated),
45856- atomic_read(&sbi->s_bal_reqs),
45857- atomic_read(&sbi->s_bal_success));
45858+ atomic_read_unchecked(&sbi->s_bal_allocated),
45859+ atomic_read_unchecked(&sbi->s_bal_reqs),
45860+ atomic_read_unchecked(&sbi->s_bal_success));
45861 printk(KERN_INFO
45862 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
45863 "%u 2^N hits, %u breaks, %u lost\n",
45864- atomic_read(&sbi->s_bal_ex_scanned),
45865- atomic_read(&sbi->s_bal_goals),
45866- atomic_read(&sbi->s_bal_2orders),
45867- atomic_read(&sbi->s_bal_breaks),
45868- atomic_read(&sbi->s_mb_lost_chunks));
45869+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
45870+ atomic_read_unchecked(&sbi->s_bal_goals),
45871+ atomic_read_unchecked(&sbi->s_bal_2orders),
45872+ atomic_read_unchecked(&sbi->s_bal_breaks),
45873+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
45874 printk(KERN_INFO
45875 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
45876 sbi->s_mb_buddies_generated++,
45877 sbi->s_mb_generation_time);
45878 printk(KERN_INFO
45879 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
45880- atomic_read(&sbi->s_mb_preallocated),
45881- atomic_read(&sbi->s_mb_discarded));
45882+ atomic_read_unchecked(&sbi->s_mb_preallocated),
45883+ atomic_read_unchecked(&sbi->s_mb_discarded));
45884 }
45885
45886 free_percpu(sbi->s_locality_groups);
66a7e928 45887@@ -3105,16 +3107,16 @@ static void ext4_mb_collect_stats(struct
bc901d79
MT		 45888 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
45889
45890 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
45891- atomic_inc(&sbi->s_bal_reqs);
45892- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45893+ atomic_inc_unchecked(&sbi->s_bal_reqs);
45894+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45895 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
45896- atomic_inc(&sbi->s_bal_success);
45897- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
45898+ atomic_inc_unchecked(&sbi->s_bal_success);
45899+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
45900 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
45901 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
45902- atomic_inc(&sbi->s_bal_goals);
45903+ atomic_inc_unchecked(&sbi->s_bal_goals);
45904 if (ac->ac_found > sbi->s_mb_max_to_scan)
45905- atomic_inc(&sbi->s_bal_breaks);
45906+ atomic_inc_unchecked(&sbi->s_bal_breaks);
45907 }
45908
45909 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
66a7e928 45910@@ -3512,7 +3514,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
bc901d79
MT		 45911 trace_ext4_mb_new_inode_pa(ac, pa);
45912
45913 ext4_mb_use_inode_pa(ac, pa);
45914- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45915+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45916
45917 ei = EXT4_I(ac->ac_inode);
45918 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
66a7e928 45919@@ -3572,7 +3574,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
bc901d79
MT		 45920 trace_ext4_mb_new_group_pa(ac, pa);
45921
45922 ext4_mb_use_group_pa(ac, pa);
45923- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45924+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45925
45926 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45927 lg = ac->ac_lg;
66a7e928 45928@@ -3659,7 +3661,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
bc901d79
MT		 45929 * from the bitmap and continue.
45930 */
45931 }
45932- atomic_add(free, &sbi->s_mb_discarded);
45933+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
45934
45935 return err;
45936 }
66a7e928 45937@@ -3677,7 +3679,7 @@ ext4_mb_release_group_pa(struct ext4_bud
bc901d79
MT		 45938 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
45939 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
45940 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
45941- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45942+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45943 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
45944
45945 return 0;
66a7e928
MT		 45946diff -urNp linux-2.6.39/fs/fcntl.c linux-2.6.39/fs/fcntl.c
45947--- linux-2.6.39/fs/fcntl.c 2011-05-19 00:06:34.000000000 -0400
45948+++ linux-2.6.39/fs/fcntl.c 2011-05-22 20:45:50.000000000 -0400
57199397
MT		 45949@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
45950 if (err)
45951 return err;
45952
45953+ if (gr_handle_chroot_fowner(pid, type))
45954+ return -ENOENT;
45955+ if (gr_check_protected_task_fowner(pid, type))
45956+ return -EACCES;
45957+
45958 f_modown(filp, pid, type, force);
45959 return 0;
45960 }
45961@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
58c5fc13
MT		 45962 switch (cmd) {
45963 case F_DUPFD:
45964 case F_DUPFD_CLOEXEC:
45965+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
df50ba0c 45966 if (arg >= rlimit(RLIMIT_NOFILE))
58c5fc13
MT		 45967 break;
45968 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
66a7e928 45969@@ -835,14 +841,14 @@ static int __init fcntl_init(void)
bc901d79
MT		 45970 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
45971 * is defined as O_NONBLOCK on some platforms and not on others.
45972 */
66a7e928
MT		 45973- BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
45974+ BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
bc901d79
MT		 45975 O_RDONLY | O_WRONLY | O_RDWR |
45976 O_CREAT | O_EXCL | O_NOCTTY |
45977 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
45978 __O_SYNC | O_DSYNC | FASYNC |
45979 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
45980 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
66a7e928
MT		 45981- __FMODE_EXEC | O_PATH
45982+ __FMODE_EXEC | O_PATH | FMODE_GREXEC
bc901d79
MT		 45983 ));
45984
45985 fasync_cache = kmem_cache_create("fasync_cache",
66a7e928
MT		 45986diff -urNp linux-2.6.39/fs/fifo.c linux-2.6.39/fs/fifo.c
45987--- linux-2.6.39/fs/fifo.c 2011-05-19 00:06:34.000000000 -0400
45988+++ linux-2.6.39/fs/fifo.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 45989@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
ae4e228f
MT		 45990 */
45991 filp->f_op = &read_pipefifo_fops;
45992 pipe->r_counter++;
45993- if (pipe->readers++ == 0)
45994+ if (atomic_inc_return(&pipe->readers) == 1)
45995 wake_up_partner(inode);
45996
45997- if (!pipe->writers) {
45998+ if (!atomic_read(&pipe->writers)) {
45999 if ((filp->f_flags & O_NONBLOCK)) {
46000 /* suppress POLLHUP until we have
46001 * seen a writer */
66a7e928 46002@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
ae4e228f
MT		 46003 * errno=ENXIO when there is no process reading the FIFO.
46004 */
46005 ret = -ENXIO;
46006- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
46007+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
46008 goto err;
46009
46010 filp->f_op = &write_pipefifo_fops;
46011 pipe->w_counter++;
46012- if (!pipe->writers++)
46013+ if (atomic_inc_return(&pipe->writers) == 1)
46014 wake_up_partner(inode);
46015
46016- if (!pipe->readers) {
46017+ if (!atomic_read(&pipe->readers)) {
46018 wait_for_partner(inode, &pipe->r_counter);
46019 if (signal_pending(current))
46020 goto err_wr;
66a7e928 46021@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
ae4e228f
MT		 46022 */
46023 filp->f_op = &rdwr_pipefifo_fops;
46024
46025- pipe->readers++;
46026- pipe->writers++;
46027+ atomic_inc(&pipe->readers);
46028+ atomic_inc(&pipe->writers);
46029 pipe->r_counter++;
46030 pipe->w_counter++;
46031- if (pipe->readers == 1 || pipe->writers == 1)
46032+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
46033 wake_up_partner(inode);
46034 break;
46035
66a7e928 46036@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
ae4e228f
MT		 46037 return 0;
46038
46039 err_rd:
46040- if (!--pipe->readers)
46041+ if (atomic_dec_and_test(&pipe->readers))
46042 wake_up_interruptible(&pipe->wait);
46043 ret = -ERESTARTSYS;
46044 goto err;
46045
46046 err_wr:
46047- if (!--pipe->writers)
46048+ if (atomic_dec_and_test(&pipe->writers))
46049 wake_up_interruptible(&pipe->wait);
46050 ret = -ERESTARTSYS;
46051 goto err;
46052
46053 err:
46054- if (!pipe->readers && !pipe->writers)
46055+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
46056 free_pipe_info(inode);
46057
46058 err_nocleanup:
66a7e928
MT		 46059diff -urNp linux-2.6.39/fs/file.c linux-2.6.39/fs/file.c
46060--- linux-2.6.39/fs/file.c 2011-05-19 00:06:34.000000000 -0400
46061+++ linux-2.6.39/fs/file.c 2011-05-22 19:41:37.000000000 -0400
46062@@ -15,6 +15,7 @@
58c5fc13
MT		 46063 #include <linux/slab.h>
46064 #include <linux/vmalloc.h>
46065 #include <linux/file.h>
46066+#include <linux/security.h>
46067 #include <linux/fdtable.h>
46068 #include <linux/bitops.h>
46069 #include <linux/interrupt.h>
66a7e928 46070@@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
58c5fc13
MT		 46071 * N.B. For clone tasks sharing a files structure, this test
46072 * will limit the total number of files that can be opened.
46073 */
58c5fc13 46074+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
df50ba0c 46075 if (nr >= rlimit(RLIMIT_NOFILE))
58c5fc13
MT		 46076 return -EMFILE;
46077
66a7e928
MT		 46078diff -urNp linux-2.6.39/fs/filesystems.c linux-2.6.39/fs/filesystems.c
46079--- linux-2.6.39/fs/filesystems.c 2011-05-19 00:06:34.000000000 -0400
46080+++ linux-2.6.39/fs/filesystems.c 2011-05-22 19:41:37.000000000 -0400
46081@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
71d190be
MT		 46082 int len = dot ? dot - name : strlen(name);
46083
46084 fs = __get_fs_type(name, len);
46085+
46086+#ifdef CONFIG_GRKERNSEC_MODHARDEN
46087+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
46088+#else
46089 if (!fs && (request_module("%.*s", len, name) == 0))
46090+#endif
46091 fs = __get_fs_type(name, len);
46092
46093 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
66a7e928
MT		 46094diff -urNp linux-2.6.39/fs/fscache/cookie.c linux-2.6.39/fs/fscache/cookie.c
46095--- linux-2.6.39/fs/fscache/cookie.c 2011-05-19 00:06:34.000000000 -0400
46096+++ linux-2.6.39/fs/fscache/cookie.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 46097@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
46098 parent ? (char *) parent->def->name : "<no-parent>",
46099 def->name, netfs_data);
46100
46101- fscache_stat(&fscache_n_acquires);
46102+ fscache_stat_unchecked(&fscache_n_acquires);
46103
46104 /* if there's no parent cookie, then we don't create one here either */
46105 if (!parent) {
46106- fscache_stat(&fscache_n_acquires_null);
46107+ fscache_stat_unchecked(&fscache_n_acquires_null);
46108 _leave(" [no parent]");
46109 return NULL;
46110 }
46111@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
46112 /* allocate and initialise a cookie */
46113 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
46114 if (!cookie) {
46115- fscache_stat(&fscache_n_acquires_oom);
46116+ fscache_stat_unchecked(&fscache_n_acquires_oom);
46117 _leave(" [ENOMEM]");
46118 return NULL;
46119 }
46120@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
46121
46122 switch (cookie->def->type) {
46123 case FSCACHE_COOKIE_TYPE_INDEX:
46124- fscache_stat(&fscache_n_cookie_index);
46125+ fscache_stat_unchecked(&fscache_n_cookie_index);
46126 break;
46127 case FSCACHE_COOKIE_TYPE_DATAFILE:
46128- fscache_stat(&fscache_n_cookie_data);
46129+ fscache_stat_unchecked(&fscache_n_cookie_data);
46130 break;
46131 default:
46132- fscache_stat(&fscache_n_cookie_special);
46133+ fscache_stat_unchecked(&fscache_n_cookie_special);
46134 break;
46135 }
46136
46137@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
46138 if (fscache_acquire_non_index_cookie(cookie) < 0) {
46139 atomic_dec(&parent->n_children);
46140 __fscache_cookie_put(cookie);
46141- fscache_stat(&fscache_n_acquires_nobufs);
46142+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
46143 _leave(" = NULL");
46144 return NULL;
46145 }
46146 }
46147
46148- fscache_stat(&fscache_n_acquires_ok);
46149+ fscache_stat_unchecked(&fscache_n_acquires_ok);
46150 _leave(" = %p", cookie);
46151 return cookie;
46152 }
46153@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
46154 cache = fscache_select_cache_for_object(cookie->parent);
46155 if (!cache) {
46156 up_read(&fscache_addremove_sem);
46157- fscache_stat(&fscache_n_acquires_no_cache);
46158+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
46159 _leave(" = -ENOMEDIUM [no cache]");
46160 return -ENOMEDIUM;
46161 }
46162@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
46163 object = cache->ops->alloc_object(cache, cookie);
46164 fscache_stat_d(&fscache_n_cop_alloc_object);
46165 if (IS_ERR(object)) {
46166- fscache_stat(&fscache_n_object_no_alloc);
46167+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
46168 ret = PTR_ERR(object);
46169 goto error;
46170 }
46171
46172- fscache_stat(&fscache_n_object_alloc);
46173+ fscache_stat_unchecked(&fscache_n_object_alloc);
46174
46175 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
46176
46177@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
46178 struct fscache_object *object;
46179 struct hlist_node *_p;
46180
46181- fscache_stat(&fscache_n_updates);
46182+ fscache_stat_unchecked(&fscache_n_updates);
46183
46184 if (!cookie) {
46185- fscache_stat(&fscache_n_updates_null);
46186+ fscache_stat_unchecked(&fscache_n_updates_null);
46187 _leave(" [no cookie]");
46188 return;
46189 }
46190@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
46191 struct fscache_object *object;
46192 unsigned long event;
46193
46194- fscache_stat(&fscache_n_relinquishes);
46195+ fscache_stat_unchecked(&fscache_n_relinquishes);
46196 if (retire)
46197- fscache_stat(&fscache_n_relinquishes_retire);
46198+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
46199
46200 if (!cookie) {
46201- fscache_stat(&fscache_n_relinquishes_null);
46202+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
46203 _leave(" [no cookie]");
46204 return;
46205 }
46206@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
46207
46208 /* wait for the cookie to finish being instantiated (or to fail) */
46209 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
46210- fscache_stat(&fscache_n_relinquishes_waitcrt);
46211+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
46212 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
46213 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
46214 }
66a7e928
MT		 46215diff -urNp linux-2.6.39/fs/fscache/internal.h linux-2.6.39/fs/fscache/internal.h
46216--- linux-2.6.39/fs/fscache/internal.h 2011-05-19 00:06:34.000000000 -0400
46217+++ linux-2.6.39/fs/fscache/internal.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 46218@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
46219 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
46220 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
46221
46222-extern atomic_t fscache_n_op_pend;
46223-extern atomic_t fscache_n_op_run;
46224-extern atomic_t fscache_n_op_enqueue;
46225-extern atomic_t fscache_n_op_deferred_release;
46226-extern atomic_t fscache_n_op_release;
46227-extern atomic_t fscache_n_op_gc;
46228-extern atomic_t fscache_n_op_cancelled;
46229-extern atomic_t fscache_n_op_rejected;
46230-
46231-extern atomic_t fscache_n_attr_changed;
46232-extern atomic_t fscache_n_attr_changed_ok;
46233-extern atomic_t fscache_n_attr_changed_nobufs;
46234-extern atomic_t fscache_n_attr_changed_nomem;
46235-extern atomic_t fscache_n_attr_changed_calls;
46236-
46237-extern atomic_t fscache_n_allocs;
46238-extern atomic_t fscache_n_allocs_ok;
46239-extern atomic_t fscache_n_allocs_wait;
46240-extern atomic_t fscache_n_allocs_nobufs;
46241-extern atomic_t fscache_n_allocs_intr;
46242-extern atomic_t fscache_n_allocs_object_dead;
46243-extern atomic_t fscache_n_alloc_ops;
46244-extern atomic_t fscache_n_alloc_op_waits;
46245-
46246-extern atomic_t fscache_n_retrievals;
46247-extern atomic_t fscache_n_retrievals_ok;
46248-extern atomic_t fscache_n_retrievals_wait;
46249-extern atomic_t fscache_n_retrievals_nodata;
46250-extern atomic_t fscache_n_retrievals_nobufs;
46251-extern atomic_t fscache_n_retrievals_intr;
46252-extern atomic_t fscache_n_retrievals_nomem;
46253-extern atomic_t fscache_n_retrievals_object_dead;
46254-extern atomic_t fscache_n_retrieval_ops;
46255-extern atomic_t fscache_n_retrieval_op_waits;
46256-
46257-extern atomic_t fscache_n_stores;
46258-extern atomic_t fscache_n_stores_ok;
46259-extern atomic_t fscache_n_stores_again;
46260-extern atomic_t fscache_n_stores_nobufs;
46261-extern atomic_t fscache_n_stores_oom;
46262-extern atomic_t fscache_n_store_ops;
46263-extern atomic_t fscache_n_store_calls;
46264-extern atomic_t fscache_n_store_pages;
46265-extern atomic_t fscache_n_store_radix_deletes;
46266-extern atomic_t fscache_n_store_pages_over_limit;
46267-
46268-extern atomic_t fscache_n_store_vmscan_not_storing;
46269-extern atomic_t fscache_n_store_vmscan_gone;
46270-extern atomic_t fscache_n_store_vmscan_busy;
46271-extern atomic_t fscache_n_store_vmscan_cancelled;
46272-
46273-extern atomic_t fscache_n_marks;
46274-extern atomic_t fscache_n_uncaches;
46275-
46276-extern atomic_t fscache_n_acquires;
46277-extern atomic_t fscache_n_acquires_null;
46278-extern atomic_t fscache_n_acquires_no_cache;
46279-extern atomic_t fscache_n_acquires_ok;
46280-extern atomic_t fscache_n_acquires_nobufs;
46281-extern atomic_t fscache_n_acquires_oom;
46282-
46283-extern atomic_t fscache_n_updates;
46284-extern atomic_t fscache_n_updates_null;
46285-extern atomic_t fscache_n_updates_run;
46286-
46287-extern atomic_t fscache_n_relinquishes;
46288-extern atomic_t fscache_n_relinquishes_null;
46289-extern atomic_t fscache_n_relinquishes_waitcrt;
46290-extern atomic_t fscache_n_relinquishes_retire;
46291-
46292-extern atomic_t fscache_n_cookie_index;
46293-extern atomic_t fscache_n_cookie_data;
46294-extern atomic_t fscache_n_cookie_special;
46295-
46296-extern atomic_t fscache_n_object_alloc;
46297-extern atomic_t fscache_n_object_no_alloc;
46298-extern atomic_t fscache_n_object_lookups;
46299-extern atomic_t fscache_n_object_lookups_negative;
46300-extern atomic_t fscache_n_object_lookups_positive;
46301-extern atomic_t fscache_n_object_lookups_timed_out;
46302-extern atomic_t fscache_n_object_created;
46303-extern atomic_t fscache_n_object_avail;
46304-extern atomic_t fscache_n_object_dead;
46305-
46306-extern atomic_t fscache_n_checkaux_none;
46307-extern atomic_t fscache_n_checkaux_okay;
46308-extern atomic_t fscache_n_checkaux_update;
46309-extern atomic_t fscache_n_checkaux_obsolete;
46310+extern atomic_unchecked_t fscache_n_op_pend;
46311+extern atomic_unchecked_t fscache_n_op_run;
46312+extern atomic_unchecked_t fscache_n_op_enqueue;
46313+extern atomic_unchecked_t fscache_n_op_deferred_release;
46314+extern atomic_unchecked_t fscache_n_op_release;
46315+extern atomic_unchecked_t fscache_n_op_gc;
46316+extern atomic_unchecked_t fscache_n_op_cancelled;
46317+extern atomic_unchecked_t fscache_n_op_rejected;
46318+
46319+extern atomic_unchecked_t fscache_n_attr_changed;
46320+extern atomic_unchecked_t fscache_n_attr_changed_ok;
46321+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
46322+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
46323+extern atomic_unchecked_t fscache_n_attr_changed_calls;
46324+
46325+extern atomic_unchecked_t fscache_n_allocs;
46326+extern atomic_unchecked_t fscache_n_allocs_ok;
46327+extern atomic_unchecked_t fscache_n_allocs_wait;
46328+extern atomic_unchecked_t fscache_n_allocs_nobufs;
46329+extern atomic_unchecked_t fscache_n_allocs_intr;
46330+extern atomic_unchecked_t fscache_n_allocs_object_dead;
46331+extern atomic_unchecked_t fscache_n_alloc_ops;
46332+extern atomic_unchecked_t fscache_n_alloc_op_waits;
46333+
46334+extern atomic_unchecked_t fscache_n_retrievals;
46335+extern atomic_unchecked_t fscache_n_retrievals_ok;
46336+extern atomic_unchecked_t fscache_n_retrievals_wait;
46337+extern atomic_unchecked_t fscache_n_retrievals_nodata;
46338+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
46339+extern atomic_unchecked_t fscache_n_retrievals_intr;
46340+extern atomic_unchecked_t fscache_n_retrievals_nomem;
46341+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
46342+extern atomic_unchecked_t fscache_n_retrieval_ops;
46343+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
46344+
46345+extern atomic_unchecked_t fscache_n_stores;
46346+extern atomic_unchecked_t fscache_n_stores_ok;
46347+extern atomic_unchecked_t fscache_n_stores_again;
46348+extern atomic_unchecked_t fscache_n_stores_nobufs;
46349+extern atomic_unchecked_t fscache_n_stores_oom;
46350+extern atomic_unchecked_t fscache_n_store_ops;
46351+extern atomic_unchecked_t fscache_n_store_calls;
46352+extern atomic_unchecked_t fscache_n_store_pages;
46353+extern atomic_unchecked_t fscache_n_store_radix_deletes;
46354+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
46355+
46356+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46357+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
46358+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
46359+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46360+
46361+extern atomic_unchecked_t fscache_n_marks;
46362+extern atomic_unchecked_t fscache_n_uncaches;
46363+
46364+extern atomic_unchecked_t fscache_n_acquires;
46365+extern atomic_unchecked_t fscache_n_acquires_null;
46366+extern atomic_unchecked_t fscache_n_acquires_no_cache;
46367+extern atomic_unchecked_t fscache_n_acquires_ok;
46368+extern atomic_unchecked_t fscache_n_acquires_nobufs;
46369+extern atomic_unchecked_t fscache_n_acquires_oom;
46370+
46371+extern atomic_unchecked_t fscache_n_updates;
46372+extern atomic_unchecked_t fscache_n_updates_null;
46373+extern atomic_unchecked_t fscache_n_updates_run;
46374+
46375+extern atomic_unchecked_t fscache_n_relinquishes;
46376+extern atomic_unchecked_t fscache_n_relinquishes_null;
46377+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46378+extern atomic_unchecked_t fscache_n_relinquishes_retire;
46379+
46380+extern atomic_unchecked_t fscache_n_cookie_index;
46381+extern atomic_unchecked_t fscache_n_cookie_data;
46382+extern atomic_unchecked_t fscache_n_cookie_special;
46383+
46384+extern atomic_unchecked_t fscache_n_object_alloc;
46385+extern atomic_unchecked_t fscache_n_object_no_alloc;
46386+extern atomic_unchecked_t fscache_n_object_lookups;
46387+extern atomic_unchecked_t fscache_n_object_lookups_negative;
46388+extern atomic_unchecked_t fscache_n_object_lookups_positive;
46389+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
46390+extern atomic_unchecked_t fscache_n_object_created;
46391+extern atomic_unchecked_t fscache_n_object_avail;
46392+extern atomic_unchecked_t fscache_n_object_dead;
46393+
46394+extern atomic_unchecked_t fscache_n_checkaux_none;
46395+extern atomic_unchecked_t fscache_n_checkaux_okay;
46396+extern atomic_unchecked_t fscache_n_checkaux_update;
46397+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
46398
46399 extern atomic_t fscache_n_cop_alloc_object;
46400 extern atomic_t fscache_n_cop_lookup_object;
46401@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
46402 atomic_inc(stat);
46403 }
46404
46405+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
46406+{
46407+ atomic_inc_unchecked(stat);
46408+}
46409+
46410 static inline void fscache_stat_d(atomic_t *stat)
46411 {
46412 atomic_dec(stat);
66a7e928
MT		 46413@@ -267,6 +272,7 @@ extern const struct file_operations fsca
46414
46415 #define __fscache_stat(stat) (NULL)
46416 #define fscache_stat(stat) do {} while (0)
46417+#define fscache_stat_unchecked(stat) do {} while (0)
46418 #define fscache_stat_d(stat) do {} while (0)
46419 #endif
46420
46421diff -urNp linux-2.6.39/fs/fscache/object.c linux-2.6.39/fs/fscache/object.c
46422--- linux-2.6.39/fs/fscache/object.c 2011-05-19 00:06:34.000000000 -0400
46423+++ linux-2.6.39/fs/fscache/object.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 46424@@ -128,7 +128,7 @@ static void fscache_object_state_machine
46425 /* update the object metadata on disk */
46426 case FSCACHE_OBJECT_UPDATING:
46427 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
46428- fscache_stat(&fscache_n_updates_run);
46429+ fscache_stat_unchecked(&fscache_n_updates_run);
46430 fscache_stat(&fscache_n_cop_update_object);
46431 object->cache->ops->update_object(object);
46432 fscache_stat_d(&fscache_n_cop_update_object);
46433@@ -217,7 +217,7 @@ static void fscache_object_state_machine
46434 spin_lock(&object->lock);
46435 object->state = FSCACHE_OBJECT_DEAD;
46436 spin_unlock(&object->lock);
46437- fscache_stat(&fscache_n_object_dead);
46438+ fscache_stat_unchecked(&fscache_n_object_dead);
46439 goto terminal_transit;
46440
46441 /* handle the parent cache of this object being withdrawn from
46442@@ -232,7 +232,7 @@ static void fscache_object_state_machine
46443 spin_lock(&object->lock);
46444 object->state = FSCACHE_OBJECT_DEAD;
46445 spin_unlock(&object->lock);
46446- fscache_stat(&fscache_n_object_dead);
46447+ fscache_stat_unchecked(&fscache_n_object_dead);
46448 goto terminal_transit;
46449
46450 /* complain about the object being woken up once it is
46451@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
46452 parent->cookie->def->name, cookie->def->name,
46453 object->cache->tag->name);
46454
46455- fscache_stat(&fscache_n_object_lookups);
46456+ fscache_stat_unchecked(&fscache_n_object_lookups);
46457 fscache_stat(&fscache_n_cop_lookup_object);
46458 ret = object->cache->ops->lookup_object(object);
46459 fscache_stat_d(&fscache_n_cop_lookup_object);
46460@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
46461 if (ret == -ETIMEDOUT) {
46462 /* probably stuck behind another object, so move this one to
46463 * the back of the queue */
46464- fscache_stat(&fscache_n_object_lookups_timed_out);
46465+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
46466 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46467 }
46468
46469@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
46470
46471 spin_lock(&object->lock);
46472 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46473- fscache_stat(&fscache_n_object_lookups_negative);
46474+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
46475
46476 /* transit here to allow write requests to begin stacking up
46477 * and read requests to begin returning ENODATA */
46478@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
46479 * result, in which case there may be data available */
46480 spin_lock(&object->lock);
46481 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46482- fscache_stat(&fscache_n_object_lookups_positive);
46483+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
46484
46485 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
46486
46487@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
46488 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46489 } else {
46490 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
46491- fscache_stat(&fscache_n_object_created);
46492+ fscache_stat_unchecked(&fscache_n_object_created);
46493
46494 object->state = FSCACHE_OBJECT_AVAILABLE;
46495 spin_unlock(&object->lock);
46496@@ -602,7 +602,7 @@ static void fscache_object_available(str
46497 fscache_enqueue_dependents(object);
46498
46499 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
46500- fscache_stat(&fscache_n_object_avail);
46501+ fscache_stat_unchecked(&fscache_n_object_avail);
46502
46503 _leave("");
46504 }
46505@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
46506 enum fscache_checkaux result;
46507
46508 if (!object->cookie->def->check_aux) {
46509- fscache_stat(&fscache_n_checkaux_none);
46510+ fscache_stat_unchecked(&fscache_n_checkaux_none);
46511 return FSCACHE_CHECKAUX_OKAY;
46512 }
46513
46514@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
46515 switch (result) {
46516 /* entry okay as is */
46517 case FSCACHE_CHECKAUX_OKAY:
46518- fscache_stat(&fscache_n_checkaux_okay);
46519+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
46520 break;
46521
46522 /* entry requires update */
46523 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
46524- fscache_stat(&fscache_n_checkaux_update);
46525+ fscache_stat_unchecked(&fscache_n_checkaux_update);
46526 break;
46527
46528 /* entry requires deletion */
46529 case FSCACHE_CHECKAUX_OBSOLETE:
46530- fscache_stat(&fscache_n_checkaux_obsolete);
46531+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
46532 break;
46533
46534 default:
66a7e928
MT		 46535diff -urNp linux-2.6.39/fs/fscache/operation.c linux-2.6.39/fs/fscache/operation.c
46536--- linux-2.6.39/fs/fscache/operation.c 2011-05-19 00:06:34.000000000 -0400
46537+++ linux-2.6.39/fs/fscache/operation.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 46538@@ -17,7 +17,7 @@
46539 #include <linux/slab.h>
46540 #include "internal.h"
46541
46542-atomic_t fscache_op_debug_id;
46543+atomic_unchecked_t fscache_op_debug_id;
46544 EXPORT_SYMBOL(fscache_op_debug_id);
46545
46546 /**
46547@@ -40,7 +40,7 @@ void fscache_enqueue_operation(struct fs
46548 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
46549 ASSERTCMP(atomic_read(&op->usage), >, 0);
46550
46551- fscache_stat(&fscache_n_op_enqueue);
46552+ fscache_stat_unchecked(&fscache_n_op_enqueue);
46553 switch (op->flags & FSCACHE_OP_TYPE) {
46554 case FSCACHE_OP_ASYNC:
46555 _debug("queue async");
46556@@ -73,7 +73,7 @@ static void fscache_run_op(struct fscach
46557 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
46558 if (op->processor)
46559 fscache_enqueue_operation(op);
46560- fscache_stat(&fscache_n_op_run);
46561+ fscache_stat_unchecked(&fscache_n_op_run);
46562 }
46563
46564 /*
46565@@ -104,11 +104,11 @@ int fscache_submit_exclusive_op(struct f
46566 if (object->n_ops > 1) {
46567 atomic_inc(&op->usage);
46568 list_add_tail(&op->pend_link, &object->pending_ops);
46569- fscache_stat(&fscache_n_op_pend);
46570+ fscache_stat_unchecked(&fscache_n_op_pend);
46571 } else if (!list_empty(&object->pending_ops)) {
46572 atomic_inc(&op->usage);
46573 list_add_tail(&op->pend_link, &object->pending_ops);
46574- fscache_stat(&fscache_n_op_pend);
46575+ fscache_stat_unchecked(&fscache_n_op_pend);
46576 fscache_start_operations(object);
46577 } else {
46578 ASSERTCMP(object->n_in_progress, ==, 0);
46579@@ -124,7 +124,7 @@ int fscache_submit_exclusive_op(struct f
46580 object->n_exclusive++; /* reads and writes must wait */
46581 atomic_inc(&op->usage);
46582 list_add_tail(&op->pend_link, &object->pending_ops);
46583- fscache_stat(&fscache_n_op_pend);
46584+ fscache_stat_unchecked(&fscache_n_op_pend);
46585 ret = 0;
46586 } else {
46587 /* not allowed to submit ops in any other state */
46588@@ -211,11 +211,11 @@ int fscache_submit_op(struct fscache_obj
46589 if (object->n_exclusive > 0) {
46590 atomic_inc(&op->usage);
46591 list_add_tail(&op->pend_link, &object->pending_ops);
46592- fscache_stat(&fscache_n_op_pend);
46593+ fscache_stat_unchecked(&fscache_n_op_pend);
46594 } else if (!list_empty(&object->pending_ops)) {
46595 atomic_inc(&op->usage);
46596 list_add_tail(&op->pend_link, &object->pending_ops);
46597- fscache_stat(&fscache_n_op_pend);
46598+ fscache_stat_unchecked(&fscache_n_op_pend);
46599 fscache_start_operations(object);
46600 } else {
46601 ASSERTCMP(object->n_exclusive, ==, 0);
46602@@ -227,12 +227,12 @@ int fscache_submit_op(struct fscache_obj
46603 object->n_ops++;
46604 atomic_inc(&op->usage);
46605 list_add_tail(&op->pend_link, &object->pending_ops);
46606- fscache_stat(&fscache_n_op_pend);
46607+ fscache_stat_unchecked(&fscache_n_op_pend);
46608 ret = 0;
46609 } else if (object->state == FSCACHE_OBJECT_DYING ||
46610 object->state == FSCACHE_OBJECT_LC_DYING ||
46611 object->state == FSCACHE_OBJECT_WITHDRAWING) {
46612- fscache_stat(&fscache_n_op_rejected);
46613+ fscache_stat_unchecked(&fscache_n_op_rejected);
46614 ret = -ENOBUFS;
46615 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
46616 fscache_report_unexpected_submission(object, op, ostate);
46617@@ -302,7 +302,7 @@ int fscache_cancel_op(struct fscache_ope
46618
46619 ret = -EBUSY;
46620 if (!list_empty(&op->pend_link)) {
46621- fscache_stat(&fscache_n_op_cancelled);
46622+ fscache_stat_unchecked(&fscache_n_op_cancelled);
46623 list_del_init(&op->pend_link);
46624 object->n_ops--;
46625 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
46626@@ -341,7 +341,7 @@ void fscache_put_operation(struct fscach
46627 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
46628 BUG();
46629
46630- fscache_stat(&fscache_n_op_release);
46631+ fscache_stat_unchecked(&fscache_n_op_release);
46632
46633 if (op->release) {
46634 op->release(op);
46635@@ -358,7 +358,7 @@ void fscache_put_operation(struct fscach
46636 * lock, and defer it otherwise */
46637 if (!spin_trylock(&object->lock)) {
46638 _debug("defer put");
46639- fscache_stat(&fscache_n_op_deferred_release);
46640+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
46641
46642 cache = object->cache;
46643 spin_lock(&cache->op_gc_list_lock);
46644@@ -420,7 +420,7 @@ void fscache_operation_gc(struct work_st
46645
46646 _debug("GC DEFERRED REL OBJ%x OP%x",
46647 object->debug_id, op->debug_id);
46648- fscache_stat(&fscache_n_op_gc);
46649+ fscache_stat_unchecked(&fscache_n_op_gc);
46650
46651 ASSERTCMP(atomic_read(&op->usage), ==, 0);
46652
66a7e928
MT		 46653diff -urNp linux-2.6.39/fs/fscache/page.c linux-2.6.39/fs/fscache/page.c
46654--- linux-2.6.39/fs/fscache/page.c 2011-05-19 00:06:34.000000000 -0400
46655+++ linux-2.6.39/fs/fscache/page.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 46656@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
46657 val = radix_tree_lookup(&cookie->stores, page->index);
46658 if (!val) {
46659 rcu_read_unlock();
46660- fscache_stat(&fscache_n_store_vmscan_not_storing);
46661+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
46662 __fscache_uncache_page(cookie, page);
46663 return true;
46664 }
46665@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
46666 spin_unlock(&cookie->stores_lock);
46667
46668 if (xpage) {
46669- fscache_stat(&fscache_n_store_vmscan_cancelled);
46670- fscache_stat(&fscache_n_store_radix_deletes);
46671+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
46672+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46673 ASSERTCMP(xpage, ==, page);
46674 } else {
46675- fscache_stat(&fscache_n_store_vmscan_gone);
46676+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
46677 }
46678
46679 wake_up_bit(&cookie->flags, 0);
46680@@ -107,7 +107,7 @@ page_busy:
46681 /* we might want to wait here, but that could deadlock the allocator as
46682 * the work threads writing to the cache may all end up sleeping
46683 * on memory allocation */
46684- fscache_stat(&fscache_n_store_vmscan_busy);
46685+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
46686 return false;
46687 }
46688 EXPORT_SYMBOL(__fscache_maybe_release_page);
46689@@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
46690 FSCACHE_COOKIE_STORING_TAG);
46691 if (!radix_tree_tag_get(&cookie->stores, page->index,
46692 FSCACHE_COOKIE_PENDING_TAG)) {
46693- fscache_stat(&fscache_n_store_radix_deletes);
46694+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46695 xpage = radix_tree_delete(&cookie->stores, page->index);
46696 }
46697 spin_unlock(&cookie->stores_lock);
46698@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
46699
46700 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
46701
46702- fscache_stat(&fscache_n_attr_changed_calls);
46703+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
46704
46705 if (fscache_object_is_active(object)) {
46706 fscache_set_op_state(op, "CallFS");
46707@@ -179,11 +179,11 @@ int __fscache_attr_changed(struct fscach
46708
46709 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46710
46711- fscache_stat(&fscache_n_attr_changed);
46712+ fscache_stat_unchecked(&fscache_n_attr_changed);
46713
46714 op = kzalloc(sizeof(*op), GFP_KERNEL);
46715 if (!op) {
46716- fscache_stat(&fscache_n_attr_changed_nomem);
46717+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
46718 _leave(" = -ENOMEM");
46719 return -ENOMEM;
46720 }
46721@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
46722 if (fscache_submit_exclusive_op(object, op) < 0)
46723 goto nobufs;
46724 spin_unlock(&cookie->lock);
46725- fscache_stat(&fscache_n_attr_changed_ok);
46726+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
46727 fscache_put_operation(op);
46728 _leave(" = 0");
46729 return 0;
46730@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
46731 nobufs:
46732 spin_unlock(&cookie->lock);
46733 kfree(op);
46734- fscache_stat(&fscache_n_attr_changed_nobufs);
46735+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
46736 _leave(" = %d", -ENOBUFS);
46737 return -ENOBUFS;
46738 }
46739@@ -246,7 +246,7 @@ static struct fscache_retrieval *fscache
46740 /* allocate a retrieval operation and attempt to submit it */
46741 op = kzalloc(sizeof(*op), GFP_NOIO);
46742 if (!op) {
46743- fscache_stat(&fscache_n_retrievals_nomem);
46744+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46745 return NULL;
46746 }
46747
46748@@ -275,13 +275,13 @@ static int fscache_wait_for_deferred_loo
46749 return 0;
46750 }
46751
46752- fscache_stat(&fscache_n_retrievals_wait);
46753+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
46754
46755 jif = jiffies;
46756 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
46757 fscache_wait_bit_interruptible,
46758 TASK_INTERRUPTIBLE) != 0) {
46759- fscache_stat(&fscache_n_retrievals_intr);
46760+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46761 _leave(" = -ERESTARTSYS");
46762 return -ERESTARTSYS;
46763 }
46764@@ -299,8 +299,8 @@ static int fscache_wait_for_deferred_loo
46765 */
46766 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46767 struct fscache_retrieval *op,
46768- atomic_t *stat_op_waits,
46769- atomic_t *stat_object_dead)
46770+ atomic_unchecked_t *stat_op_waits,
46771+ atomic_unchecked_t *stat_object_dead)
46772 {
46773 int ret;
46774
46775@@ -308,7 +308,7 @@ static int fscache_wait_for_retrieval_ac
46776 goto check_if_dead;
46777
46778 _debug(">>> WT");
46779- fscache_stat(stat_op_waits);
46780+ fscache_stat_unchecked(stat_op_waits);
46781 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
46782 fscache_wait_bit_interruptible,
46783 TASK_INTERRUPTIBLE) < 0) {
46784@@ -325,7 +325,7 @@ static int fscache_wait_for_retrieval_ac
46785
46786 check_if_dead:
46787 if (unlikely(fscache_object_is_dead(object))) {
46788- fscache_stat(stat_object_dead);
46789+ fscache_stat_unchecked(stat_object_dead);
46790 return -ENOBUFS;
46791 }
46792 return 0;
46793@@ -352,7 +352,7 @@ int __fscache_read_or_alloc_page(struct
46794
46795 _enter("%p,%p,,,", cookie, page);
46796
46797- fscache_stat(&fscache_n_retrievals);
46798+ fscache_stat_unchecked(&fscache_n_retrievals);
46799
46800 if (hlist_empty(&cookie->backing_objects))
46801 goto nobufs;
46802@@ -386,7 +386,7 @@ int __fscache_read_or_alloc_page(struct
46803 goto nobufs_unlock;
46804 spin_unlock(&cookie->lock);
46805
46806- fscache_stat(&fscache_n_retrieval_ops);
46807+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
46808
46809 /* pin the netfs read context in case we need to do the actual netfs
46810 * read because we've encountered a cache read failure */
46811@@ -416,15 +416,15 @@ int __fscache_read_or_alloc_page(struct
46812
46813 error:
46814 if (ret == -ENOMEM)
46815- fscache_stat(&fscache_n_retrievals_nomem);
46816+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46817 else if (ret == -ERESTARTSYS)
46818- fscache_stat(&fscache_n_retrievals_intr);
46819+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46820 else if (ret == -ENODATA)
46821- fscache_stat(&fscache_n_retrievals_nodata);
46822+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46823 else if (ret < 0)
46824- fscache_stat(&fscache_n_retrievals_nobufs);
46825+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46826 else
46827- fscache_stat(&fscache_n_retrievals_ok);
46828+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
46829
46830 fscache_put_retrieval(op);
46831 _leave(" = %d", ret);
46832@@ -434,7 +434,7 @@ nobufs_unlock:
46833 spin_unlock(&cookie->lock);
46834 kfree(op);
46835 nobufs:
46836- fscache_stat(&fscache_n_retrievals_nobufs);
46837+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46838 _leave(" = -ENOBUFS");
46839 return -ENOBUFS;
46840 }
46841@@ -472,7 +472,7 @@ int __fscache_read_or_alloc_pages(struct
46842
46843 _enter("%p,,%d,,,", cookie, *nr_pages);
46844
46845- fscache_stat(&fscache_n_retrievals);
46846+ fscache_stat_unchecked(&fscache_n_retrievals);
46847
46848 if (hlist_empty(&cookie->backing_objects))
46849 goto nobufs;
46850@@ -503,7 +503,7 @@ int __fscache_read_or_alloc_pages(struct
46851 goto nobufs_unlock;
46852 spin_unlock(&cookie->lock);
46853
46854- fscache_stat(&fscache_n_retrieval_ops);
46855+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
46856
46857 /* pin the netfs read context in case we need to do the actual netfs
46858 * read because we've encountered a cache read failure */
46859@@ -533,15 +533,15 @@ int __fscache_read_or_alloc_pages(struct
46860
46861 error:
46862 if (ret == -ENOMEM)
46863- fscache_stat(&fscache_n_retrievals_nomem);
46864+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46865 else if (ret == -ERESTARTSYS)
46866- fscache_stat(&fscache_n_retrievals_intr);
46867+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46868 else if (ret == -ENODATA)
46869- fscache_stat(&fscache_n_retrievals_nodata);
46870+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46871 else if (ret < 0)
46872- fscache_stat(&fscache_n_retrievals_nobufs);
46873+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46874 else
46875- fscache_stat(&fscache_n_retrievals_ok);
46876+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
46877
46878 fscache_put_retrieval(op);
46879 _leave(" = %d", ret);
46880@@ -551,7 +551,7 @@ nobufs_unlock:
46881 spin_unlock(&cookie->lock);
46882 kfree(op);
46883 nobufs:
46884- fscache_stat(&fscache_n_retrievals_nobufs);
46885+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46886 _leave(" = -ENOBUFS");
46887 return -ENOBUFS;
46888 }
46889@@ -575,7 +575,7 @@ int __fscache_alloc_page(struct fscache_
46890
46891 _enter("%p,%p,,,", cookie, page);
46892
46893- fscache_stat(&fscache_n_allocs);
46894+ fscache_stat_unchecked(&fscache_n_allocs);
46895
46896 if (hlist_empty(&cookie->backing_objects))
46897 goto nobufs;
46898@@ -602,7 +602,7 @@ int __fscache_alloc_page(struct fscache_
46899 goto nobufs_unlock;
46900 spin_unlock(&cookie->lock);
46901
46902- fscache_stat(&fscache_n_alloc_ops);
46903+ fscache_stat_unchecked(&fscache_n_alloc_ops);
46904
46905 ret = fscache_wait_for_retrieval_activation(
46906 object, op,
46907@@ -618,11 +618,11 @@ int __fscache_alloc_page(struct fscache_
46908
46909 error:
46910 if (ret == -ERESTARTSYS)
46911- fscache_stat(&fscache_n_allocs_intr);
46912+ fscache_stat_unchecked(&fscache_n_allocs_intr);
46913 else if (ret < 0)
46914- fscache_stat(&fscache_n_allocs_nobufs);
46915+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46916 else
46917- fscache_stat(&fscache_n_allocs_ok);
46918+ fscache_stat_unchecked(&fscache_n_allocs_ok);
46919
46920 fscache_put_retrieval(op);
46921 _leave(" = %d", ret);
46922@@ -632,7 +632,7 @@ nobufs_unlock:
46923 spin_unlock(&cookie->lock);
46924 kfree(op);
46925 nobufs:
46926- fscache_stat(&fscache_n_allocs_nobufs);
46927+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46928 _leave(" = -ENOBUFS");
46929 return -ENOBUFS;
46930 }
46931@@ -675,7 +675,7 @@ static void fscache_write_op(struct fsca
46932
46933 spin_lock(&cookie->stores_lock);
46934
46935- fscache_stat(&fscache_n_store_calls);
46936+ fscache_stat_unchecked(&fscache_n_store_calls);
46937
46938 /* find a page to store */
46939 page = NULL;
46940@@ -686,7 +686,7 @@ static void fscache_write_op(struct fsca
46941 page = results[0];
46942 _debug("gang %d [%lx]", n, page->index);
46943 if (page->index > op->store_limit) {
46944- fscache_stat(&fscache_n_store_pages_over_limit);
46945+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
46946 goto superseded;
46947 }
46948
46949@@ -699,7 +699,7 @@ static void fscache_write_op(struct fsca
46950 spin_unlock(&object->lock);
46951
46952 fscache_set_op_state(&op->op, "Store");
46953- fscache_stat(&fscache_n_store_pages);
46954+ fscache_stat_unchecked(&fscache_n_store_pages);
46955 fscache_stat(&fscache_n_cop_write_page);
46956 ret = object->cache->ops->write_page(op, page);
46957 fscache_stat_d(&fscache_n_cop_write_page);
46958@@ -769,7 +769,7 @@ int __fscache_write_page(struct fscache_
46959 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46960 ASSERT(PageFsCache(page));
46961
46962- fscache_stat(&fscache_n_stores);
46963+ fscache_stat_unchecked(&fscache_n_stores);
46964
46965 op = kzalloc(sizeof(*op), GFP_NOIO);
46966 if (!op)
46967@@ -821,7 +821,7 @@ int __fscache_write_page(struct fscache_
46968 spin_unlock(&cookie->stores_lock);
46969 spin_unlock(&object->lock);
46970
46971- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
46972+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
46973 op->store_limit = object->store_limit;
46974
46975 if (fscache_submit_op(object, &op->op) < 0)
46976@@ -829,8 +829,8 @@ int __fscache_write_page(struct fscache_
46977
46978 spin_unlock(&cookie->lock);
46979 radix_tree_preload_end();
46980- fscache_stat(&fscache_n_store_ops);
46981- fscache_stat(&fscache_n_stores_ok);
46982+ fscache_stat_unchecked(&fscache_n_store_ops);
46983+ fscache_stat_unchecked(&fscache_n_stores_ok);
46984
46985 /* the work queue now carries its own ref on the object */
46986 fscache_put_operation(&op->op);
46987@@ -838,14 +838,14 @@ int __fscache_write_page(struct fscache_
46988 return 0;
46989
46990 already_queued:
46991- fscache_stat(&fscache_n_stores_again);
46992+ fscache_stat_unchecked(&fscache_n_stores_again);
46993 already_pending:
46994 spin_unlock(&cookie->stores_lock);
46995 spin_unlock(&object->lock);
46996 spin_unlock(&cookie->lock);
46997 radix_tree_preload_end();
46998 kfree(op);
46999- fscache_stat(&fscache_n_stores_ok);
47000+ fscache_stat_unchecked(&fscache_n_stores_ok);
47001 _leave(" = 0");
47002 return 0;
47003
47004@@ -864,14 +864,14 @@ nobufs:
47005 spin_unlock(&cookie->lock);
47006 radix_tree_preload_end();
47007 kfree(op);
47008- fscache_stat(&fscache_n_stores_nobufs);
47009+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
47010 _leave(" = -ENOBUFS");
47011 return -ENOBUFS;
47012
47013 nomem_free:
47014 kfree(op);
47015 nomem:
47016- fscache_stat(&fscache_n_stores_oom);
47017+ fscache_stat_unchecked(&fscache_n_stores_oom);
47018 _leave(" = -ENOMEM");
47019 return -ENOMEM;
47020 }
47021@@ -889,7 +889,7 @@ void __fscache_uncache_page(struct fscac
47022 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47023 ASSERTCMP(page, !=, NULL);
47024
47025- fscache_stat(&fscache_n_uncaches);
47026+ fscache_stat_unchecked(&fscache_n_uncaches);
47027
47028 /* cache withdrawal may beat us to it */
47029 if (!PageFsCache(page))
47030@@ -942,7 +942,7 @@ void fscache_mark_pages_cached(struct fs
47031 unsigned long loop;
47032
47033 #ifdef CONFIG_FSCACHE_STATS
47034- atomic_add(pagevec->nr, &fscache_n_marks);
47035+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
47036 #endif
47037
47038 for (loop = 0; loop < pagevec->nr; loop++) {
66a7e928
MT		 47039diff -urNp linux-2.6.39/fs/fscache/stats.c linux-2.6.39/fs/fscache/stats.c
47040--- linux-2.6.39/fs/fscache/stats.c 2011-05-19 00:06:34.000000000 -0400
47041+++ linux-2.6.39/fs/fscache/stats.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 47042@@ -18,95 +18,95 @@
47043 /*
47044 * operation counters
47045 */
47046-atomic_t fscache_n_op_pend;
47047-atomic_t fscache_n_op_run;
47048-atomic_t fscache_n_op_enqueue;
47049-atomic_t fscache_n_op_requeue;
47050-atomic_t fscache_n_op_deferred_release;
47051-atomic_t fscache_n_op_release;
47052-atomic_t fscache_n_op_gc;
47053-atomic_t fscache_n_op_cancelled;
47054-atomic_t fscache_n_op_rejected;
47055-
47056-atomic_t fscache_n_attr_changed;
47057-atomic_t fscache_n_attr_changed_ok;
47058-atomic_t fscache_n_attr_changed_nobufs;
47059-atomic_t fscache_n_attr_changed_nomem;
47060-atomic_t fscache_n_attr_changed_calls;
47061-
47062-atomic_t fscache_n_allocs;
47063-atomic_t fscache_n_allocs_ok;
47064-atomic_t fscache_n_allocs_wait;
47065-atomic_t fscache_n_allocs_nobufs;
47066-atomic_t fscache_n_allocs_intr;
47067-atomic_t fscache_n_allocs_object_dead;
47068-atomic_t fscache_n_alloc_ops;
47069-atomic_t fscache_n_alloc_op_waits;
47070-
47071-atomic_t fscache_n_retrievals;
47072-atomic_t fscache_n_retrievals_ok;
47073-atomic_t fscache_n_retrievals_wait;
47074-atomic_t fscache_n_retrievals_nodata;
47075-atomic_t fscache_n_retrievals_nobufs;
47076-atomic_t fscache_n_retrievals_intr;
47077-atomic_t fscache_n_retrievals_nomem;
47078-atomic_t fscache_n_retrievals_object_dead;
47079-atomic_t fscache_n_retrieval_ops;
47080-atomic_t fscache_n_retrieval_op_waits;
47081-
47082-atomic_t fscache_n_stores;
47083-atomic_t fscache_n_stores_ok;
47084-atomic_t fscache_n_stores_again;
47085-atomic_t fscache_n_stores_nobufs;
47086-atomic_t fscache_n_stores_oom;
47087-atomic_t fscache_n_store_ops;
47088-atomic_t fscache_n_store_calls;
47089-atomic_t fscache_n_store_pages;
47090-atomic_t fscache_n_store_radix_deletes;
47091-atomic_t fscache_n_store_pages_over_limit;
47092-
47093-atomic_t fscache_n_store_vmscan_not_storing;
47094-atomic_t fscache_n_store_vmscan_gone;
47095-atomic_t fscache_n_store_vmscan_busy;
47096-atomic_t fscache_n_store_vmscan_cancelled;
47097-
47098-atomic_t fscache_n_marks;
47099-atomic_t fscache_n_uncaches;
47100-
47101-atomic_t fscache_n_acquires;
47102-atomic_t fscache_n_acquires_null;
47103-atomic_t fscache_n_acquires_no_cache;
47104-atomic_t fscache_n_acquires_ok;
47105-atomic_t fscache_n_acquires_nobufs;
47106-atomic_t fscache_n_acquires_oom;
47107-
47108-atomic_t fscache_n_updates;
47109-atomic_t fscache_n_updates_null;
47110-atomic_t fscache_n_updates_run;
47111-
47112-atomic_t fscache_n_relinquishes;
47113-atomic_t fscache_n_relinquishes_null;
47114-atomic_t fscache_n_relinquishes_waitcrt;
47115-atomic_t fscache_n_relinquishes_retire;
47116-
47117-atomic_t fscache_n_cookie_index;
47118-atomic_t fscache_n_cookie_data;
47119-atomic_t fscache_n_cookie_special;
47120-
47121-atomic_t fscache_n_object_alloc;
47122-atomic_t fscache_n_object_no_alloc;
47123-atomic_t fscache_n_object_lookups;
47124-atomic_t fscache_n_object_lookups_negative;
47125-atomic_t fscache_n_object_lookups_positive;
47126-atomic_t fscache_n_object_lookups_timed_out;
47127-atomic_t fscache_n_object_created;
47128-atomic_t fscache_n_object_avail;
47129-atomic_t fscache_n_object_dead;
47130-
47131-atomic_t fscache_n_checkaux_none;
47132-atomic_t fscache_n_checkaux_okay;
47133-atomic_t fscache_n_checkaux_update;
47134-atomic_t fscache_n_checkaux_obsolete;
47135+atomic_unchecked_t fscache_n_op_pend;
47136+atomic_unchecked_t fscache_n_op_run;
47137+atomic_unchecked_t fscache_n_op_enqueue;
47138+atomic_unchecked_t fscache_n_op_requeue;
47139+atomic_unchecked_t fscache_n_op_deferred_release;
47140+atomic_unchecked_t fscache_n_op_release;
47141+atomic_unchecked_t fscache_n_op_gc;
47142+atomic_unchecked_t fscache_n_op_cancelled;
47143+atomic_unchecked_t fscache_n_op_rejected;
47144+
47145+atomic_unchecked_t fscache_n_attr_changed;
47146+atomic_unchecked_t fscache_n_attr_changed_ok;
47147+atomic_unchecked_t fscache_n_attr_changed_nobufs;
47148+atomic_unchecked_t fscache_n_attr_changed_nomem;
47149+atomic_unchecked_t fscache_n_attr_changed_calls;
47150+
47151+atomic_unchecked_t fscache_n_allocs;
47152+atomic_unchecked_t fscache_n_allocs_ok;
47153+atomic_unchecked_t fscache_n_allocs_wait;
47154+atomic_unchecked_t fscache_n_allocs_nobufs;
47155+atomic_unchecked_t fscache_n_allocs_intr;
47156+atomic_unchecked_t fscache_n_allocs_object_dead;
47157+atomic_unchecked_t fscache_n_alloc_ops;
47158+atomic_unchecked_t fscache_n_alloc_op_waits;
47159+
47160+atomic_unchecked_t fscache_n_retrievals;
47161+atomic_unchecked_t fscache_n_retrievals_ok;
47162+atomic_unchecked_t fscache_n_retrievals_wait;
47163+atomic_unchecked_t fscache_n_retrievals_nodata;
47164+atomic_unchecked_t fscache_n_retrievals_nobufs;
47165+atomic_unchecked_t fscache_n_retrievals_intr;
47166+atomic_unchecked_t fscache_n_retrievals_nomem;
47167+atomic_unchecked_t fscache_n_retrievals_object_dead;
47168+atomic_unchecked_t fscache_n_retrieval_ops;
47169+atomic_unchecked_t fscache_n_retrieval_op_waits;
47170+
47171+atomic_unchecked_t fscache_n_stores;
47172+atomic_unchecked_t fscache_n_stores_ok;
47173+atomic_unchecked_t fscache_n_stores_again;
47174+atomic_unchecked_t fscache_n_stores_nobufs;
47175+atomic_unchecked_t fscache_n_stores_oom;
47176+atomic_unchecked_t fscache_n_store_ops;
47177+atomic_unchecked_t fscache_n_store_calls;
47178+atomic_unchecked_t fscache_n_store_pages;
47179+atomic_unchecked_t fscache_n_store_radix_deletes;
47180+atomic_unchecked_t fscache_n_store_pages_over_limit;
47181+
47182+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
47183+atomic_unchecked_t fscache_n_store_vmscan_gone;
47184+atomic_unchecked_t fscache_n_store_vmscan_busy;
47185+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
47186+
47187+atomic_unchecked_t fscache_n_marks;
47188+atomic_unchecked_t fscache_n_uncaches;
47189+
47190+atomic_unchecked_t fscache_n_acquires;
47191+atomic_unchecked_t fscache_n_acquires_null;
47192+atomic_unchecked_t fscache_n_acquires_no_cache;
47193+atomic_unchecked_t fscache_n_acquires_ok;
47194+atomic_unchecked_t fscache_n_acquires_nobufs;
47195+atomic_unchecked_t fscache_n_acquires_oom;
47196+
47197+atomic_unchecked_t fscache_n_updates;
47198+atomic_unchecked_t fscache_n_updates_null;
47199+atomic_unchecked_t fscache_n_updates_run;
47200+
47201+atomic_unchecked_t fscache_n_relinquishes;
47202+atomic_unchecked_t fscache_n_relinquishes_null;
47203+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
47204+atomic_unchecked_t fscache_n_relinquishes_retire;
47205+
47206+atomic_unchecked_t fscache_n_cookie_index;
47207+atomic_unchecked_t fscache_n_cookie_data;
47208+atomic_unchecked_t fscache_n_cookie_special;
47209+
47210+atomic_unchecked_t fscache_n_object_alloc;
47211+atomic_unchecked_t fscache_n_object_no_alloc;
47212+atomic_unchecked_t fscache_n_object_lookups;
47213+atomic_unchecked_t fscache_n_object_lookups_negative;
47214+atomic_unchecked_t fscache_n_object_lookups_positive;
47215+atomic_unchecked_t fscache_n_object_lookups_timed_out;
47216+atomic_unchecked_t fscache_n_object_created;
47217+atomic_unchecked_t fscache_n_object_avail;
47218+atomic_unchecked_t fscache_n_object_dead;
47219+
47220+atomic_unchecked_t fscache_n_checkaux_none;
47221+atomic_unchecked_t fscache_n_checkaux_okay;
47222+atomic_unchecked_t fscache_n_checkaux_update;
47223+atomic_unchecked_t fscache_n_checkaux_obsolete;
47224
47225 atomic_t fscache_n_cop_alloc_object;
47226 atomic_t fscache_n_cop_lookup_object;
47227@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
47228 seq_puts(m, "FS-Cache statistics\n");
47229
47230 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
47231- atomic_read(&fscache_n_cookie_index),
47232- atomic_read(&fscache_n_cookie_data),
47233- atomic_read(&fscache_n_cookie_special));
47234+ atomic_read_unchecked(&fscache_n_cookie_index),
47235+ atomic_read_unchecked(&fscache_n_cookie_data),
47236+ atomic_read_unchecked(&fscache_n_cookie_special));
47237
47238 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
47239- atomic_read(&fscache_n_object_alloc),
47240- atomic_read(&fscache_n_object_no_alloc),
47241- atomic_read(&fscache_n_object_avail),
47242- atomic_read(&fscache_n_object_dead));
47243+ atomic_read_unchecked(&fscache_n_object_alloc),
47244+ atomic_read_unchecked(&fscache_n_object_no_alloc),
47245+ atomic_read_unchecked(&fscache_n_object_avail),
47246+ atomic_read_unchecked(&fscache_n_object_dead));
47247 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
47248- atomic_read(&fscache_n_checkaux_none),
47249- atomic_read(&fscache_n_checkaux_okay),
47250- atomic_read(&fscache_n_checkaux_update),
47251- atomic_read(&fscache_n_checkaux_obsolete));
47252+ atomic_read_unchecked(&fscache_n_checkaux_none),
47253+ atomic_read_unchecked(&fscache_n_checkaux_okay),
47254+ atomic_read_unchecked(&fscache_n_checkaux_update),
47255+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
47256
47257 seq_printf(m, "Pages : mrk=%u unc=%u\n",
47258- atomic_read(&fscache_n_marks),
47259- atomic_read(&fscache_n_uncaches));
47260+ atomic_read_unchecked(&fscache_n_marks),
47261+ atomic_read_unchecked(&fscache_n_uncaches));
47262
47263 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
47264 " oom=%u\n",
47265- atomic_read(&fscache_n_acquires),
47266- atomic_read(&fscache_n_acquires_null),
47267- atomic_read(&fscache_n_acquires_no_cache),
47268- atomic_read(&fscache_n_acquires_ok),
47269- atomic_read(&fscache_n_acquires_nobufs),
47270- atomic_read(&fscache_n_acquires_oom));
47271+ atomic_read_unchecked(&fscache_n_acquires),
47272+ atomic_read_unchecked(&fscache_n_acquires_null),
47273+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
47274+ atomic_read_unchecked(&fscache_n_acquires_ok),
47275+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
47276+ atomic_read_unchecked(&fscache_n_acquires_oom));
47277
47278 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
47279- atomic_read(&fscache_n_object_lookups),
47280- atomic_read(&fscache_n_object_lookups_negative),
47281- atomic_read(&fscache_n_object_lookups_positive),
47282- atomic_read(&fscache_n_object_created),
47283- atomic_read(&fscache_n_object_lookups_timed_out));
47284+ atomic_read_unchecked(&fscache_n_object_lookups),
47285+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
47286+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
47287+ atomic_read_unchecked(&fscache_n_object_created),
47288+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
47289
47290 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
47291- atomic_read(&fscache_n_updates),
47292- atomic_read(&fscache_n_updates_null),
47293- atomic_read(&fscache_n_updates_run));
47294+ atomic_read_unchecked(&fscache_n_updates),
47295+ atomic_read_unchecked(&fscache_n_updates_null),
47296+ atomic_read_unchecked(&fscache_n_updates_run));
47297
47298 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
47299- atomic_read(&fscache_n_relinquishes),
47300- atomic_read(&fscache_n_relinquishes_null),
47301- atomic_read(&fscache_n_relinquishes_waitcrt),
47302- atomic_read(&fscache_n_relinquishes_retire));
47303+ atomic_read_unchecked(&fscache_n_relinquishes),
47304+ atomic_read_unchecked(&fscache_n_relinquishes_null),
47305+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
47306+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
47307
47308 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
47309- atomic_read(&fscache_n_attr_changed),
47310- atomic_read(&fscache_n_attr_changed_ok),
47311- atomic_read(&fscache_n_attr_changed_nobufs),
47312- atomic_read(&fscache_n_attr_changed_nomem),
47313- atomic_read(&fscache_n_attr_changed_calls));
47314+ atomic_read_unchecked(&fscache_n_attr_changed),
47315+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
47316+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
47317+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
47318+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
47319
47320 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
47321- atomic_read(&fscache_n_allocs),
47322- atomic_read(&fscache_n_allocs_ok),
47323- atomic_read(&fscache_n_allocs_wait),
47324- atomic_read(&fscache_n_allocs_nobufs),
47325- atomic_read(&fscache_n_allocs_intr));
47326+ atomic_read_unchecked(&fscache_n_allocs),
47327+ atomic_read_unchecked(&fscache_n_allocs_ok),
47328+ atomic_read_unchecked(&fscache_n_allocs_wait),
47329+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
47330+ atomic_read_unchecked(&fscache_n_allocs_intr));
47331 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
47332- atomic_read(&fscache_n_alloc_ops),
47333- atomic_read(&fscache_n_alloc_op_waits),
47334- atomic_read(&fscache_n_allocs_object_dead));
47335+ atomic_read_unchecked(&fscache_n_alloc_ops),
47336+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
47337+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
47338
47339 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
47340 " int=%u oom=%u\n",
47341- atomic_read(&fscache_n_retrievals),
47342- atomic_read(&fscache_n_retrievals_ok),
47343- atomic_read(&fscache_n_retrievals_wait),
47344- atomic_read(&fscache_n_retrievals_nodata),
47345- atomic_read(&fscache_n_retrievals_nobufs),
47346- atomic_read(&fscache_n_retrievals_intr),
47347- atomic_read(&fscache_n_retrievals_nomem));
47348+ atomic_read_unchecked(&fscache_n_retrievals),
47349+ atomic_read_unchecked(&fscache_n_retrievals_ok),
47350+ atomic_read_unchecked(&fscache_n_retrievals_wait),
47351+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
47352+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
47353+ atomic_read_unchecked(&fscache_n_retrievals_intr),
47354+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
47355 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
47356- atomic_read(&fscache_n_retrieval_ops),
47357- atomic_read(&fscache_n_retrieval_op_waits),
47358- atomic_read(&fscache_n_retrievals_object_dead));
47359+ atomic_read_unchecked(&fscache_n_retrieval_ops),
47360+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
47361+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
47362
47363 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
47364- atomic_read(&fscache_n_stores),
47365- atomic_read(&fscache_n_stores_ok),
47366- atomic_read(&fscache_n_stores_again),
47367- atomic_read(&fscache_n_stores_nobufs),
47368- atomic_read(&fscache_n_stores_oom));
47369+ atomic_read_unchecked(&fscache_n_stores),
47370+ atomic_read_unchecked(&fscache_n_stores_ok),
47371+ atomic_read_unchecked(&fscache_n_stores_again),
47372+ atomic_read_unchecked(&fscache_n_stores_nobufs),
47373+ atomic_read_unchecked(&fscache_n_stores_oom));
47374 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
47375- atomic_read(&fscache_n_store_ops),
47376- atomic_read(&fscache_n_store_calls),
47377- atomic_read(&fscache_n_store_pages),
47378- atomic_read(&fscache_n_store_radix_deletes),
47379- atomic_read(&fscache_n_store_pages_over_limit));
47380+ atomic_read_unchecked(&fscache_n_store_ops),
47381+ atomic_read_unchecked(&fscache_n_store_calls),
47382+ atomic_read_unchecked(&fscache_n_store_pages),
47383+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
47384+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
47385
47386 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
47387- atomic_read(&fscache_n_store_vmscan_not_storing),
47388- atomic_read(&fscache_n_store_vmscan_gone),
47389- atomic_read(&fscache_n_store_vmscan_busy),
47390- atomic_read(&fscache_n_store_vmscan_cancelled));
47391+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
47392+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
47393+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
47394+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
47395
47396 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
47397- atomic_read(&fscache_n_op_pend),
47398- atomic_read(&fscache_n_op_run),
47399- atomic_read(&fscache_n_op_enqueue),
47400- atomic_read(&fscache_n_op_cancelled),
47401- atomic_read(&fscache_n_op_rejected));
47402+ atomic_read_unchecked(&fscache_n_op_pend),
47403+ atomic_read_unchecked(&fscache_n_op_run),
47404+ atomic_read_unchecked(&fscache_n_op_enqueue),
47405+ atomic_read_unchecked(&fscache_n_op_cancelled),
47406+ atomic_read_unchecked(&fscache_n_op_rejected));
47407 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
47408- atomic_read(&fscache_n_op_deferred_release),
47409- atomic_read(&fscache_n_op_release),
47410- atomic_read(&fscache_n_op_gc));
47411+ atomic_read_unchecked(&fscache_n_op_deferred_release),
47412+ atomic_read_unchecked(&fscache_n_op_release),
47413+ atomic_read_unchecked(&fscache_n_op_gc));
47414
47415 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
47416 atomic_read(&fscache_n_cop_alloc_object),
66a7e928
MT		 47417diff -urNp linux-2.6.39/fs/fs_struct.c linux-2.6.39/fs/fs_struct.c
47418--- linux-2.6.39/fs/fs_struct.c 2011-05-19 00:06:34.000000000 -0400
47419+++ linux-2.6.39/fs/fs_struct.c 2011-05-22 19:41:37.000000000 -0400
df50ba0c
MT		 47420@@ -4,6 +4,7 @@
47421 #include <linux/path.h>
47422 #include <linux/slab.h>
47423 #include <linux/fs_struct.h>
47424+#include <linux/grsecurity.h>
16454cff 47425 #include "internal.h"
ae4e228f 47426
16454cff
MT		 47427 static inline void path_get_longterm(struct path *path)
47428@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
df50ba0c
MT		 47429 old_root = fs->root;
47430 fs->root = *path;
16454cff 47431 path_get_longterm(path);
df50ba0c 47432+ gr_set_chroot_entries(current, path);
16454cff 47433 write_seqcount_end(&fs->seq);
6892158b 47434 spin_unlock(&fs->lock);
df50ba0c 47435 if (old_root.dentry)
16454cff 47436@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
df50ba0c 47437 && fs->root.mnt == old_root->mnt) {
16454cff 47438 path_get_longterm(new_root);
df50ba0c
MT		 47439 fs->root = *new_root;
47440+ gr_set_chroot_entries(p, new_root);
47441 count++;
ae4e228f 47442 }
df50ba0c 47443 if (fs->pwd.dentry == old_root->dentry
16454cff 47444@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
6892158b 47445 spin_lock(&fs->lock);
16454cff 47446 write_seqcount_begin(&fs->seq);
58c5fc13
MT		 47447 tsk->fs = NULL;
47448- kill = !--fs->users;
df50ba0c 47449+ gr_clear_chroot_entries(tsk);
58c5fc13 47450+ kill = !atomic_dec_return(&fs->users);
16454cff 47451 write_seqcount_end(&fs->seq);
6892158b 47452 spin_unlock(&fs->lock);
58c5fc13 47453 task_unlock(tsk);
16454cff 47454@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
58c5fc13
MT		 47455 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
47456 /* We don't need to lock fs - think why ;-) */
47457 if (fs) {
47458- fs->users = 1;
47459+ atomic_set(&fs->users, 1);
47460 fs->in_exec = 0;
6892158b 47461 spin_lock_init(&fs->lock);
16454cff
MT		 47462 seqcount_init(&fs->seq);
47463@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
47464 spin_lock(&old->lock);
47465 fs->root = old->root;
47466 path_get_longterm(&fs->root);
47467+ /* instead of calling gr_set_chroot_entries here,
47468+ we call it from every caller of this function
47469+ */
47470 fs->pwd = old->pwd;
47471 path_get_longterm(&fs->pwd);
47472 spin_unlock(&old->lock);
47473@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
58c5fc13
MT		 47474
47475 task_lock(current);
6892158b 47476 spin_lock(&fs->lock);
58c5fc13
MT		 47477- kill = !--fs->users;
47478+ kill = !atomic_dec_return(&fs->users);
47479 current->fs = new_fs;
df50ba0c 47480+ gr_set_chroot_entries(current, &new_fs->root);
6892158b 47481 spin_unlock(&fs->lock);
58c5fc13 47482 task_unlock(current);
ae4e228f 47483
16454cff 47484@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
58c5fc13
MT		 47485
47486 /* to be mentioned only in INIT_TASK */
47487 struct fs_struct init_fs = {
47488- .users = 1,
47489+ .users = ATOMIC_INIT(1),
6892158b 47490 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
16454cff 47491 .seq = SEQCNT_ZERO,
58c5fc13 47492 .umask = 0022,
16454cff 47493@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
58c5fc13
MT		 47494 task_lock(current);
47495
6892158b 47496 spin_lock(&init_fs.lock);
58c5fc13
MT		 47497- init_fs.users++;
47498+ atomic_inc(&init_fs.users);
6892158b 47499 spin_unlock(&init_fs.lock);
58c5fc13 47500
6892158b 47501 spin_lock(&fs->lock);
58c5fc13
MT		 47502 current->fs = &init_fs;
47503- kill = !--fs->users;
df50ba0c 47504+ gr_set_chroot_entries(current, &current->fs->root);
58c5fc13 47505+ kill = !atomic_dec_return(&fs->users);
6892158b 47506 spin_unlock(&fs->lock);
58c5fc13
MT		 47507
47508 task_unlock(current);
66a7e928
MT		 47509diff -urNp linux-2.6.39/fs/fuse/cuse.c linux-2.6.39/fs/fuse/cuse.c
47510--- linux-2.6.39/fs/fuse/cuse.c 2011-05-19 00:06:34.000000000 -0400
47511+++ linux-2.6.39/fs/fuse/cuse.c 2011-05-22 19:36:32.000000000 -0400
47512@@ -538,8 +538,18 @@ static int cuse_channel_release(struct i
ae4e228f
MT		 47513 return rc;
47514 }
47515
47516-static struct file_operations cuse_channel_fops; /* initialized during init */
47517-
47518+static const struct file_operations cuse_channel_fops = { /* initialized during init */
47519+ .owner = THIS_MODULE,
47520+ .llseek = no_llseek,
47521+ .read = do_sync_read,
47522+ .aio_read = fuse_dev_read,
47523+ .write = do_sync_write,
47524+ .aio_write = fuse_dev_write,
47525+ .poll = fuse_dev_poll,
47526+ .open = cuse_channel_open,
47527+ .release = cuse_channel_release,
47528+ .fasync = fuse_dev_fasync,
47529+};
47530
47531 /**************************************************************************
47532 * Misc stuff and module initializatiion
66a7e928 47533@@ -585,12 +595,6 @@ static int __init cuse_init(void)
ae4e228f
MT		 47534 for (i = 0; i < CUSE_CONNTBL_LEN; i++)
47535 INIT_LIST_HEAD(&cuse_conntbl[i]);
47536
47537- /* inherit and extend fuse_dev_operations */
47538- cuse_channel_fops = fuse_dev_operations;
47539- cuse_channel_fops.owner = THIS_MODULE;
47540- cuse_channel_fops.open = cuse_channel_open;
47541- cuse_channel_fops.release = cuse_channel_release;
47542-
47543 cuse_class = class_create(THIS_MODULE, "cuse");
47544 if (IS_ERR(cuse_class))
47545 return PTR_ERR(cuse_class);
66a7e928
MT		 47546diff -urNp linux-2.6.39/fs/fuse/dev.c linux-2.6.39/fs/fuse/dev.c
47547--- linux-2.6.39/fs/fuse/dev.c 2011-05-19 00:06:34.000000000 -0400
47548+++ linux-2.6.39/fs/fuse/dev.c 2011-05-22 19:36:32.000000000 -0400
47549@@ -1181,7 +1181,7 @@ static ssize_t fuse_dev_do_read(struct f
57199397
MT		 47550 return err;
47551 }
47552
ae4e228f
MT		 47553-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47554+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47555 unsigned long nr_segs, loff_t pos)
47556 {
57199397 47557 struct fuse_copy_state cs;
66a7e928 47558@@ -1195,6 +1195,8 @@ static ssize_t fuse_dev_read(struct kioc
57199397 47559 return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
ae4e228f
MT		 47560 }
47561
47562+EXPORT_SYMBOL_GPL(fuse_dev_read);
47563+
57199397
MT		 47564 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
47565 struct pipe_buffer *buf)
ae4e228f 47566 {
66a7e928 47567@@ -1238,7 +1240,7 @@ static ssize_t fuse_dev_splice_read(stru
57199397
MT		 47568 ret = 0;
47569 pipe_lock(pipe);
47570
47571- if (!pipe->readers) {
47572+ if (!atomic_read(&pipe->readers)) {
47573 send_sig(SIGPIPE, current, 0);
47574 if (!ret)
47575 ret = -EPIPE;
66a7e928 47576@@ -1731,7 +1733,7 @@ static ssize_t fuse_dev_do_write(struct
57199397
MT		 47577 return err;
47578 }
47579
ae4e228f
MT		 47580-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47581+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
57199397 47582 unsigned long nr_segs, loff_t pos)
ae4e228f 47583 {
57199397 47584 struct fuse_copy_state cs;
66a7e928 47585@@ -1744,6 +1746,8 @@ static ssize_t fuse_dev_write(struct kio
57199397 47586 return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
ae4e228f
MT		 47587 }
47588
ae4e228f
MT		 47589+EXPORT_SYMBOL_GPL(fuse_dev_write);
47590+
57199397
MT		 47591 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
47592 struct file *out, loff_t *ppos,
47593 size_t len, unsigned int flags)
66a7e928 47594@@ -1822,7 +1826,7 @@ out:
57199397
MT		 47595 return ret;
47596 }
47597
47598-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
ae4e228f
MT		 47599+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47600 {
47601 unsigned mask = POLLOUT | POLLWRNORM;
47602 struct fuse_conn *fc = fuse_get_conn(file);
66a7e928 47603@@ -1841,6 +1845,8 @@ static unsigned fuse_dev_poll(struct fil
ae4e228f
MT		 47604 return mask;
47605 }
47606
47607+EXPORT_SYMBOL_GPL(fuse_dev_poll);
47608+
47609 /*
47610 * Abort all requests on the given list (pending or processing)
47611 *
66a7e928 47612@@ -1977,7 +1983,7 @@ int fuse_dev_release(struct inode *inode
ae4e228f
MT		 47613 }
47614 EXPORT_SYMBOL_GPL(fuse_dev_release);
47615
47616-static int fuse_dev_fasync(int fd, struct file *file, int on)
47617+int fuse_dev_fasync(int fd, struct file *file, int on)
47618 {
47619 struct fuse_conn *fc = fuse_get_conn(file);
47620 if (!fc)
66a7e928 47621@@ -1987,6 +1993,8 @@ static int fuse_dev_fasync(int fd, struc
ae4e228f
MT		 47622 return fasync_helper(fd, file, on, &fc->fasync);
47623 }
47624
47625+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
47626+
47627 const struct file_operations fuse_dev_operations = {
47628 .owner = THIS_MODULE,
47629 .llseek = no_llseek,
66a7e928
MT		 47630diff -urNp linux-2.6.39/fs/fuse/dir.c linux-2.6.39/fs/fuse/dir.c
47631--- linux-2.6.39/fs/fuse/dir.c 2011-05-19 00:06:34.000000000 -0400
47632+++ linux-2.6.39/fs/fuse/dir.c 2011-05-22 19:36:32.000000000 -0400
47633@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *de
58c5fc13
MT		 47634 return link;
47635 }
47636
47637-static void free_link(char *link)
47638+static void free_link(const char *link)
47639 {
47640 if (!IS_ERR(link))
47641 free_page((unsigned long) link);
66a7e928
MT		 47642diff -urNp linux-2.6.39/fs/fuse/fuse_i.h linux-2.6.39/fs/fuse/fuse_i.h
47643--- linux-2.6.39/fs/fuse/fuse_i.h 2011-05-19 00:06:34.000000000 -0400
47644+++ linux-2.6.39/fs/fuse/fuse_i.h 2011-05-22 19:36:32.000000000 -0400
47645@@ -540,6 +540,16 @@ extern const struct file_operations fuse
ae4e228f
MT		 47646
47647 extern const struct dentry_operations fuse_dentry_operations;
47648
47649+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47650+ unsigned long nr_segs, loff_t pos);
47651+
47652+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47653+ unsigned long nr_segs, loff_t pos);
47654+
47655+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
47656+
47657+extern int fuse_dev_fasync(int fd, struct file *file, int on);
47658+
47659 /**
47660 * Inode to nodeid comparison.
47661 */
66a7e928
MT		 47662diff -urNp linux-2.6.39/fs/gfs2/ops_inode.c linux-2.6.39/fs/gfs2/ops_inode.c
47663--- linux-2.6.39/fs/gfs2/ops_inode.c 2011-05-19 00:06:34.000000000 -0400
47664+++ linux-2.6.39/fs/gfs2/ops_inode.c 2011-05-22 19:36:32.000000000 -0400
47665@@ -740,6 +740,8 @@ static int gfs2_rename(struct inode *odi
47666 unsigned int x;
47667 int error;
47668
47669+ pax_track_stack();
47670+
47671 if (ndentry->d_inode) {
47672 nip = GFS2_I(ndentry->d_inode);
47673 if (ip == nip)
47674@@ -1019,7 +1021,7 @@ out:
47675
47676 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
47677 {
47678- char *s = nd_get_link(nd);
47679+ const char *s = nd_get_link(nd);
47680 if (!IS_ERR(s))
47681 kfree(s);
47682 }
47683diff -urNp linux-2.6.39/fs/hfsplus/catalog.c linux-2.6.39/fs/hfsplus/catalog.c
47684--- linux-2.6.39/fs/hfsplus/catalog.c 2011-05-19 00:06:34.000000000 -0400
47685+++ linux-2.6.39/fs/hfsplus/catalog.c 2011-05-22 19:36:32.000000000 -0400
47686@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
47687 int err;
47688 u16 type;
47689
47690+ pax_track_stack();
47691+
47692 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
47693 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
47694 if (err)
47695@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
47696 int entry_size;
47697 int err;
47698
47699+ pax_track_stack();
47700+
47701 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
47702 str->name, cnid, inode->i_nlink);
47703 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
47704@@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
47705 int entry_size, type;
47706 int err = 0;
47707
47708+ pax_track_stack();
47709+
47710 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
47711 cnid, src_dir->i_ino, src_name->name,
47712 dst_dir->i_ino, dst_name->name);
47713diff -urNp linux-2.6.39/fs/hfsplus/dir.c linux-2.6.39/fs/hfsplus/dir.c
47714--- linux-2.6.39/fs/hfsplus/dir.c 2011-05-19 00:06:34.000000000 -0400
47715+++ linux-2.6.39/fs/hfsplus/dir.c 2011-05-22 19:36:32.000000000 -0400
47716@@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
47717 struct hfsplus_readdir_data *rd;
47718 u16 type;
47719
47720+ pax_track_stack();
47721+
47722 if (filp->f_pos >= inode->i_size)
47723 return 0;
47724
47725diff -urNp linux-2.6.39/fs/hfsplus/inode.c linux-2.6.39/fs/hfsplus/inode.c
47726--- linux-2.6.39/fs/hfsplus/inode.c 2011-05-19 00:06:34.000000000 -0400
47727+++ linux-2.6.39/fs/hfsplus/inode.c 2011-05-22 19:36:32.000000000 -0400
47728@@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
47729 int res = 0;
47730 u16 type;
47731
47732+ pax_track_stack();
47733+
47734 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
47735
47736 HFSPLUS_I(inode)->linkid = 0;
47737@@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
47738 struct hfs_find_data fd;
47739 hfsplus_cat_entry entry;
47740
47741+ pax_track_stack();
47742+
47743 if (HFSPLUS_IS_RSRC(inode))
47744 main_inode = HFSPLUS_I(inode)->rsrc_inode;
47745
47746diff -urNp linux-2.6.39/fs/hfsplus/ioctl.c linux-2.6.39/fs/hfsplus/ioctl.c
47747--- linux-2.6.39/fs/hfsplus/ioctl.c 2011-05-19 00:06:34.000000000 -0400
47748+++ linux-2.6.39/fs/hfsplus/ioctl.c 2011-05-22 19:36:32.000000000 -0400
47749@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
47750 struct hfsplus_cat_file *file;
47751 int res;
47752
47753+ pax_track_stack();
47754+
47755 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47756 return -EOPNOTSUPP;
47757
47758@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
47759 struct hfsplus_cat_file *file;
47760 ssize_t res = 0;
47761
47762+ pax_track_stack();
47763+
47764 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47765 return -EOPNOTSUPP;
47766
47767diff -urNp linux-2.6.39/fs/hfsplus/super.c linux-2.6.39/fs/hfsplus/super.c
47768--- linux-2.6.39/fs/hfsplus/super.c 2011-05-19 00:06:34.000000000 -0400
47769+++ linux-2.6.39/fs/hfsplus/super.c 2011-05-22 19:36:32.000000000 -0400
47770@@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
47771 struct nls_table *nls = NULL;
47772 int err;
47773
47774+ pax_track_stack();
47775+
47776 err = -EINVAL;
47777 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
47778 if (!sbi)
47779diff -urNp linux-2.6.39/fs/hugetlbfs/inode.c linux-2.6.39/fs/hugetlbfs/inode.c
47780--- linux-2.6.39/fs/hugetlbfs/inode.c 2011-05-19 00:06:34.000000000 -0400
47781+++ linux-2.6.39/fs/hugetlbfs/inode.c 2011-05-22 19:41:37.000000000 -0400
47782@@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
df50ba0c
MT		 47783 .kill_sb = kill_litter_super,
47784 };
47785
47786-static struct vfsmount *hugetlbfs_vfsmount;
47787+struct vfsmount *hugetlbfs_vfsmount;
47788
47789 static int can_do_hugetlb_shm(void)
47790 {
66a7e928
MT		 47791diff -urNp linux-2.6.39/fs/inode.c linux-2.6.39/fs/inode.c
47792--- linux-2.6.39/fs/inode.c 2011-05-19 00:06:34.000000000 -0400
47793+++ linux-2.6.39/fs/inode.c 2011-05-22 19:36:32.000000000 -0400
47794@@ -862,8 +862,8 @@ unsigned int get_next_ino(void)
58c5fc13 47795
71d190be
MT		 47796 #ifdef CONFIG_SMP
47797 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
47798- static atomic_t shared_last_ino;
47799- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
47800+ static atomic_unchecked_t shared_last_ino;
47801+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
58c5fc13 47802
71d190be
MT		 47803 res = next - LAST_INO_BATCH;
47804 }
66a7e928
MT		 47805diff -urNp linux-2.6.39/fs/jbd/checkpoint.c linux-2.6.39/fs/jbd/checkpoint.c
47806--- linux-2.6.39/fs/jbd/checkpoint.c 2011-05-19 00:06:34.000000000 -0400
47807+++ linux-2.6.39/fs/jbd/checkpoint.c 2011-05-22 19:36:32.000000000 -0400
47808@@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
47809 tid_t this_tid;
47810 int result;
47811
47812+ pax_track_stack();
47813+
47814 jbd_debug(1, "Start checkpoint\n");
47815
47816 /*
47817diff -urNp linux-2.6.39/fs/jffs2/compr_rtime.c linux-2.6.39/fs/jffs2/compr_rtime.c
47818--- linux-2.6.39/fs/jffs2/compr_rtime.c 2011-05-19 00:06:34.000000000 -0400
47819+++ linux-2.6.39/fs/jffs2/compr_rtime.c 2011-05-22 19:36:32.000000000 -0400
47820@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
47821 int outpos = 0;
47822 int pos=0;
47823
47824+ pax_track_stack();
47825+
47826 memset(positions,0,sizeof(positions));
47827
47828 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
47829@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
47830 int outpos = 0;
47831 int pos=0;
47832
47833+ pax_track_stack();
47834+
47835 memset(positions,0,sizeof(positions));
47836
47837 while (outpos<destlen) {
47838diff -urNp linux-2.6.39/fs/jffs2/compr_rubin.c linux-2.6.39/fs/jffs2/compr_rubin.c
47839--- linux-2.6.39/fs/jffs2/compr_rubin.c 2011-05-19 00:06:34.000000000 -0400
47840+++ linux-2.6.39/fs/jffs2/compr_rubin.c 2011-05-22 19:36:32.000000000 -0400
47841@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
47842 int ret;
47843 uint32_t mysrclen, mydstlen;
47844
47845+ pax_track_stack();
47846+
47847 mysrclen = *sourcelen;
47848 mydstlen = *dstlen - 8;
47849
47850diff -urNp linux-2.6.39/fs/jffs2/erase.c linux-2.6.39/fs/jffs2/erase.c
47851--- linux-2.6.39/fs/jffs2/erase.c 2011-05-19 00:06:34.000000000 -0400
47852+++ linux-2.6.39/fs/jffs2/erase.c 2011-05-22 19:36:32.000000000 -0400
6892158b 47853@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
58c5fc13
MT		 47854 struct jffs2_unknown_node marker = {
47855 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
47856 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47857- .totlen = cpu_to_je32(c->cleanmarker_size)
47858+ .totlen = cpu_to_je32(c->cleanmarker_size),
47859+ .hdr_crc = cpu_to_je32(0)
47860 };
47861
47862 jffs2_prealloc_raw_node_refs(c, jeb, 1);
66a7e928
MT		 47863diff -urNp linux-2.6.39/fs/jffs2/wbuf.c linux-2.6.39/fs/jffs2/wbuf.c
47864--- linux-2.6.39/fs/jffs2/wbuf.c 2011-05-19 00:06:34.000000000 -0400
47865+++ linux-2.6.39/fs/jffs2/wbuf.c 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 47866@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
47867 {
47868 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
47869 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47870- .totlen = constant_cpu_to_je32(8)
47871+ .totlen = constant_cpu_to_je32(8),
47872+ .hdr_crc = constant_cpu_to_je32(0)
47873 };
47874
47875 /*
66a7e928
MT		 47876diff -urNp linux-2.6.39/fs/jffs2/xattr.c linux-2.6.39/fs/jffs2/xattr.c
47877--- linux-2.6.39/fs/jffs2/xattr.c 2011-05-19 00:06:34.000000000 -0400
47878+++ linux-2.6.39/fs/jffs2/xattr.c 2011-05-22 19:36:32.000000000 -0400
47879@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
47880
47881 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
47882
47883+ pax_track_stack();
47884+
47885 /* Phase.1 : Merge same xref */
47886 for (i=0; i < XREF_TMPHASH_SIZE; i++)
47887 xref_tmphash[i] = NULL;
47888diff -urNp linux-2.6.39/fs/Kconfig.binfmt linux-2.6.39/fs/Kconfig.binfmt
47889--- linux-2.6.39/fs/Kconfig.binfmt 2011-05-19 00:06:34.000000000 -0400
47890+++ linux-2.6.39/fs/Kconfig.binfmt 2011-05-22 19:36:32.000000000 -0400
6892158b
MT		 47891@@ -86,7 +86,7 @@ config HAVE_AOUT
47892
47893 config BINFMT_AOUT
47894 tristate "Kernel support for a.out and ECOFF binaries"
47895- depends on HAVE_AOUT
47896+ depends on HAVE_AOUT && BROKEN
47897 ---help---
47898 A.out (Assembler.OUTput) is a set of formats for libraries and
47899 executables used in the earliest versions of UNIX. Linux used
66a7e928
MT		 47900diff -urNp linux-2.6.39/fs/libfs.c linux-2.6.39/fs/libfs.c
47901--- linux-2.6.39/fs/libfs.c 2011-05-19 00:06:34.000000000 -0400
47902+++ linux-2.6.39/fs/libfs.c 2011-05-22 19:36:32.000000000 -0400
47903@@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
47904
47905 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
47906 struct dentry *next;
47907+ char d_name[sizeof(next->d_iname)];
47908+ const unsigned char *name;
47909+
47910 next = list_entry(p, struct dentry, d_u.d_child);
47911 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
47912 if (!simple_positive(next)) {
47913@@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
71d190be
MT		 47914
47915 spin_unlock(&next->d_lock);
47916 spin_unlock(&dentry->d_lock);
47917- if (filldir(dirent, next->d_name.name,
66a7e928
MT		 47918+ name = next->d_name.name;
47919+ if (name == next->d_iname) {
47920+ memcpy(d_name, name, next->d_name.len);
71d190be 47921+ name = d_name;
66a7e928 47922+ }
71d190be
MT		 47923+ if (filldir(dirent, name,
47924 next->d_name.len, filp->f_pos,
47925 next->d_inode->i_ino,
47926 dt_type(next->d_inode)) < 0)
66a7e928
MT		 47927diff -urNp linux-2.6.39/fs/lockd/clntproc.c linux-2.6.39/fs/lockd/clntproc.c
47928--- linux-2.6.39/fs/lockd/clntproc.c 2011-05-19 00:06:34.000000000 -0400
47929+++ linux-2.6.39/fs/lockd/clntproc.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 47930@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
47931 /*
47932 * Cookie counter for NLM requests
47933 */
47934-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
47935+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
47936
47937 void nlmclnt_next_cookie(struct nlm_cookie *c)
47938 {
47939- u32 cookie = atomic_inc_return(&nlm_cookie);
47940+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
47941
47942 memcpy(c->data, &cookie, 4);
47943 c->len=4;
66a7e928
MT		 47944@@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
47945 struct nlm_rqst reqst, *req;
47946 int status;
47947
47948+ pax_track_stack();
47949+
47950 req = &reqst;
47951 memset(req, 0, sizeof(*req));
47952 locks_init_lock(&req->a_args.lock.fl);
47953diff -urNp linux-2.6.39/fs/lockd/svc.c linux-2.6.39/fs/lockd/svc.c
47954--- linux-2.6.39/fs/lockd/svc.c 2011-05-19 00:06:34.000000000 -0400
47955+++ linux-2.6.39/fs/lockd/svc.c 2011-05-22 19:36:32.000000000 -0400
bc901d79 47956@@ -41,7 +41,7 @@
ae4e228f
MT		 47957
47958 static struct svc_program nlmsvc_program;
47959
47960-struct nlmsvc_binding * nlmsvc_ops;
47961+const struct nlmsvc_binding * nlmsvc_ops;
47962 EXPORT_SYMBOL_GPL(nlmsvc_ops);
47963
47964 static DEFINE_MUTEX(nlmsvc_mutex);
66a7e928
MT		 47965diff -urNp linux-2.6.39/fs/locks.c linux-2.6.39/fs/locks.c
47966--- linux-2.6.39/fs/locks.c 2011-05-19 00:06:34.000000000 -0400
47967+++ linux-2.6.39/fs/locks.c 2011-05-22 19:36:32.000000000 -0400
47968@@ -2033,16 +2033,16 @@ void locks_remove_flock(struct file *fil
58c5fc13
MT		 47969 return;
47970
47971 if (filp->f_op && filp->f_op->flock) {
47972- struct file_lock fl = {
47973+ struct file_lock flock = {
47974 .fl_pid = current->tgid,
47975 .fl_file = filp,
47976 .fl_flags = FL_FLOCK,
47977 .fl_type = F_UNLCK,
47978 .fl_end = OFFSET_MAX,
47979 };
47980- filp->f_op->flock(filp, F_SETLKW, &fl);
47981- if (fl.fl_ops && fl.fl_ops->fl_release_private)
47982- fl.fl_ops->fl_release_private(&fl);
47983+ filp->f_op->flock(filp, F_SETLKW, &flock);
47984+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
47985+ flock.fl_ops->fl_release_private(&flock);
47986 }
47987
bc901d79 47988 lock_flocks();
66a7e928
MT		 47989diff -urNp linux-2.6.39/fs/logfs/super.c linux-2.6.39/fs/logfs/super.c
47990--- linux-2.6.39/fs/logfs/super.c 2011-05-19 00:06:34.000000000 -0400
47991+++ linux-2.6.39/fs/logfs/super.c 2011-05-22 19:36:32.000000000 -0400
47992@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
47993 struct logfs_disk_super _ds1, *ds1 = &_ds1;
47994 int err, valid0, valid1;
47995
47996+ pax_track_stack();
47997+
47998 /* read first superblock */
47999 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
48000 if (err)
48001diff -urNp linux-2.6.39/fs/namei.c linux-2.6.39/fs/namei.c
48002--- linux-2.6.39/fs/namei.c 2011-05-19 00:06:34.000000000 -0400
48003+++ linux-2.6.39/fs/namei.c 2011-05-23 18:21:41.000000000 -0400
48004@@ -237,20 +237,30 @@ int generic_permission(struct inode *ino
bc901d79
MT		 48005 return ret;
48006
48007 /*
48008- * Read/write DACs are always overridable.
48009- * Executable DACs are overridable if at least one exec bit is set.
66a7e928 48010+ * Searching includes executable on directories, else just read.
bc901d79 48011 */
66a7e928
MT		 48012- if (!(mask & MAY_EXEC) || execute_ok(inode))
48013- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48014+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48015+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
48016+#ifdef CONFIG_GRKERNSEC
48017+ if (flags & IPERM_FLAG_RCU)
48018+ return -ECHILD;
48019+#endif
48020+ if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
bc901d79 48021 return 0;
66a7e928 48022+ }
bc901d79 48023
66a7e928
MT		 48024 /*
48025- * Searching includes executable on directories, else just read.
bc901d79
MT		 48026+ * Read/write DACs are always overridable.
48027+ * Executable DACs are overridable if at least one exec bit is set.
66a7e928
MT		 48028 */
48029- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48030- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
48031- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48032+ if (!(mask & MAY_EXEC) || execute_ok(inode)) {
48033+#ifdef CONFIG_GRKERNSEC
48034+ if (flags & IPERM_FLAG_RCU)
48035+ return -ECHILD;
48036+#endif
48037+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48038 return 0;
48039+ }
48040
bc901d79
MT		 48041 return -EACCES;
48042 }
66a7e928
MT		 48043@@ -626,6 +636,9 @@ static inline int handle_reval_path(stru
48044 struct dentry *dentry = nd->path.dentry;
48045 int status;
48046
48047+ if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
48048+ return -ENOENT;
48049+
48050 if (likely(!(nd->flags & LOOKUP_JUMPED)))
48051 return 0;
bc901d79 48052
66a7e928 48053@@ -671,9 +684,16 @@ static inline int exec_permission(struct
16454cff
MT		 48054 if (ret == -ECHILD)
48055 return ret;
bc901d79 48056
66a7e928
MT		 48057- if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
48058- ns_capable(ns, CAP_DAC_READ_SEARCH))
48059+ if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
bc901d79 48060 goto ok;
66a7e928
MT		 48061+ else {
48062+#ifdef CONFIG_GRKERNSEC
48063+ if (flags & IPERM_FLAG_RCU)
48064+ return -ECHILD;
48065+#endif
48066+ if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
48067+ goto ok;
48068+ }
bc901d79
MT		 48069
48070 return ret;
66a7e928
MT		 48071 ok:
48072@@ -781,11 +801,19 @@ follow_link(struct path *link, struct na
48073 return error;
48074 }
48075
48076+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
48077+ dentry->d_inode, dentry, nd->path.mnt)) {
48078+ error = -EACCES;
48079+ *p = ERR_PTR(error); /* no ->put_link(), please */
48080+ path_put(&nd->path);
48081+ return error;
48082+ }
48083+
48084 nd->last_type = LAST_BIND;
df50ba0c
MT		 48085 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
48086 error = PTR_ERR(*p);
48087 if (!IS_ERR(*p)) {
58c5fc13
MT		 48088- char *s = nd_get_link(nd);
48089+ const char *s = nd_get_link(nd);
48090 error = 0;
48091 if (s)
48092 error = __vfs_follow_link(nd, s);
66a7e928
MT		 48093@@ -1697,6 +1725,9 @@ static int do_path_lookup(int dfd, const
48094 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
16454cff
MT		 48095
48096 if (likely(!retval)) {
48097+ if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
48098+ return -ENOENT;
48099+
48100 if (unlikely(!audit_dummy_context())) {
48101 if (nd->path.dentry && nd->inode)
48102 audit_inode(name, nd->path.dentry);
66a7e928 48103@@ -2007,6 +2038,30 @@ int vfs_create(struct inode *dir, struct
bc901d79
MT		 48104 return error;
48105 }
48106
48107+/*
48108+ * Note that while the flag value (low two bits) for sys_open means:
48109+ * 00 - read-only
48110+ * 01 - write-only
48111+ * 10 - read-write
48112+ * 11 - special
48113+ * it is changed into
48114+ * 00 - no permissions needed
48115+ * 01 - read-permission
48116+ * 10 - write-permission
48117+ * 11 - read-write
48118+ * for the internal routines (ie open_namei()/follow_link() etc)
48119+ * This is more logical, and also allows the 00 "no perm needed"
48120+ * to be used for symlinks (where the permissions are checked
48121+ * later).
48122+ *
48123+*/
48124+static inline int open_to_namei_flags(int flag)
48125+{
48126+ if ((flag+1) & O_ACCMODE)
48127+ flag++;
48128+ return flag;
48129+}
48130+
66a7e928 48131 static int may_open(struct path *path, int acc_mode, int flag)
bc901d79
MT		 48132 {
48133 struct dentry *dentry = path->dentry;
66a7e928 48134@@ -2059,7 +2114,27 @@ static int may_open(struct path *path, i
bc901d79
MT		 48135 /*
48136 * Ensure there are no outstanding leases on the file.
48137 */
48138- return break_lease(inode, flag);
48139+ error = break_lease(inode, flag);
16454cff 48140+
bc901d79
MT		 48141+ if (error)
48142+ return error;
48143+
48144+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
48145+ error = -EPERM;
48146+ goto exit;
48147+ }
48148+
48149+ if (gr_handle_rawio(inode)) {
48150+ error = -EPERM;
48151+ goto exit;
48152+ }
48153+
48154+ if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
48155+ error = -EACCES;
48156+ goto exit;
48157+ }
48158+exit:
48159+ return error;
48160 }
48161
16454cff 48162 static int handle_truncate(struct file *filp)
66a7e928 48163@@ -2085,30 +2160,6 @@ static int handle_truncate(struct file *
bc901d79
MT		 48164 }
48165
66a7e928 48166 /*
bc901d79
MT		 48167- * Note that while the flag value (low two bits) for sys_open means:
48168- * 00 - read-only
48169- * 01 - write-only
48170- * 10 - read-write
48171- * 11 - special
48172- * it is changed into
48173- * 00 - no permissions needed
48174- * 01 - read-permission
48175- * 10 - write-permission
48176- * 11 - read-write
48177- * for the internal routines (ie open_namei()/follow_link() etc)
48178- * This is more logical, and also allows the 00 "no perm needed"
48179- * to be used for symlinks (where the permissions are checked
48180- * later).
48181- *
48182-*/
48183-static inline int open_to_namei_flags(int flag)
48184-{
48185- if ((flag+1) & O_ACCMODE)
48186- flag++;
48187- return flag;
48188-}
48189-
66a7e928
MT		 48190-/*
48191 * Handle the last step of open()
48192 */
48193 static struct file *do_last(struct nameidata *nd, struct path *path,
48194@@ -2117,6 +2168,7 @@ static struct file *do_last(struct namei
df50ba0c 48195 struct dentry *dir = nd->path.dentry;
66a7e928
MT		 48196 struct dentry *dentry;
48197 int open_flag = op->open_flag;
df50ba0c 48198+ int flag = open_to_namei_flags(open_flag);
66a7e928
MT		 48199 int will_truncate = open_flag & O_TRUNC;
48200 int want_write = 0;
48201 int acc_mode = op->acc_mode;
48202@@ -2212,6 +2264,12 @@ static struct file *do_last(struct namei
48203 /* Negative dentry, just create the file */
48204 if (!dentry->d_inode) {
48205 int mode = op->mode;
48206+
48207+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
48208+ error = -EACCES;
48209+ goto exit_mutex_unlock;
48210+ }
48211+
48212 if (!IS_POSIXACL(dir->d_inode))
48213 mode &= ~current_umask();
48214 /*
48215@@ -2235,6 +2293,8 @@ static struct file *do_last(struct namei
48216 error = vfs_create(dir->d_inode, dentry, mode, nd);
48217 if (error)
48218 goto exit_mutex_unlock;
48219+ else
48220+ gr_handle_create(path->dentry, path->mnt);
48221 mutex_unlock(&dir->d_inode->i_mutex);
48222 dput(nd->path.dentry);
48223 nd->path.dentry = dentry;
48224@@ -2244,6 +2304,14 @@ static struct file *do_last(struct namei
58c5fc13
MT		 48225 /*
48226 * It already exists.
48227 */
48228+
bc901d79
MT		 48229+ /* only check if O_CREAT is specified, all other checks need to go
48230+ into may_open */
48231+ if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
58c5fc13
MT		 48232+ error = -EACCES;
48233+ goto exit_mutex_unlock;
48234+ }
48235+
48236 mutex_unlock(&dir->d_inode->i_mutex);
df50ba0c 48237 audit_inode(pathname, path->dentry);
58c5fc13 48238
66a7e928 48239@@ -2530,6 +2598,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
58c5fc13
MT		 48240 error = may_mknod(mode);
48241 if (error)
48242 goto out_dput;
48243+
48244+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
48245+ error = -EPERM;
48246+ goto out_dput;
48247+ }
48248+
48249+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
48250+ error = -EACCES;
48251+ goto out_dput;
48252+ }
48253+
48254 error = mnt_want_write(nd.path.mnt);
48255 if (error)
48256 goto out_dput;
66a7e928 48257@@ -2550,6 +2629,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
58c5fc13
MT		 48258 }
48259 out_drop_write:
48260 mnt_drop_write(nd.path.mnt);
48261+
48262+ if (!error)
48263+ gr_handle_create(dentry, nd.path.mnt);
48264 out_dput:
48265 dput(dentry);
48266 out_unlock:
66a7e928 48267@@ -2602,6 +2684,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
58c5fc13
MT		 48268 if (IS_ERR(dentry))
48269 goto out_unlock;
48270
48271+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
48272+ error = -EACCES;
48273+ goto out_dput;
48274+ }
48275+
48276 if (!IS_POSIXACL(nd.path.dentry->d_inode))
48277 mode &= ~current_umask();
48278 error = mnt_want_write(nd.path.mnt);
66a7e928 48279@@ -2613,6 +2700,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
58c5fc13
MT		 48280 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
48281 out_drop_write:
48282 mnt_drop_write(nd.path.mnt);
48283+
48284+ if (!error)
48285+ gr_handle_create(dentry, nd.path.mnt);
48286+
48287 out_dput:
48288 dput(dentry);
48289 out_unlock:
66a7e928 48290@@ -2692,6 +2783,8 @@ static long do_rmdir(int dfd, const char
58c5fc13
MT		 48291 char * name;
48292 struct dentry *dentry;
48293 struct nameidata nd;
48294+ ino_t saved_ino = 0;
48295+ dev_t saved_dev = 0;
48296
48297 error = user_path_parent(dfd, pathname, &nd, &name);
48298 if (error)
66a7e928 48299@@ -2716,6 +2809,19 @@ static long do_rmdir(int dfd, const char
58c5fc13
MT		 48300 error = PTR_ERR(dentry);
48301 if (IS_ERR(dentry))
48302 goto exit2;
48303+
48304+ if (dentry->d_inode != NULL) {
48305+ if (dentry->d_inode->i_nlink <= 1) {
48306+ saved_ino = dentry->d_inode->i_ino;
16454cff 48307+ saved_dev = gr_get_dev_from_dentry(dentry);
58c5fc13
MT		 48308+ }
48309+
48310+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
48311+ error = -EACCES;
48312+ goto exit3;
48313+ }
48314+ }
48315+
48316 error = mnt_want_write(nd.path.mnt);
48317 if (error)
48318 goto exit3;
66a7e928 48319@@ -2723,6 +2829,8 @@ static long do_rmdir(int dfd, const char
58c5fc13
MT		 48320 if (error)
48321 goto exit4;
48322 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
48323+ if (!error && (saved_dev || saved_ino))
48324+ gr_handle_delete(saved_ino, saved_dev);
48325 exit4:
48326 mnt_drop_write(nd.path.mnt);
48327 exit3:
66a7e928 48328@@ -2785,6 +2893,8 @@ static long do_unlinkat(int dfd, const c
58c5fc13
MT		 48329 struct dentry *dentry;
48330 struct nameidata nd;
48331 struct inode *inode = NULL;
48332+ ino_t saved_ino = 0;
48333+ dev_t saved_dev = 0;
48334
48335 error = user_path_parent(dfd, pathname, &nd, &name);
48336 if (error)
66a7e928 48337@@ -2804,8 +2914,17 @@ static long do_unlinkat(int dfd, const c
58c5fc13
MT		 48338 if (nd.last.name[nd.last.len])
48339 goto slashes;
48340 inode = dentry->d_inode;
48341- if (inode)
48342+ if (inode) {
bc901d79 48343 ihold(inode);
58c5fc13
MT		 48344+ if (inode->i_nlink <= 1) {
48345+ saved_ino = inode->i_ino;
16454cff 48346+ saved_dev = gr_get_dev_from_dentry(dentry);
58c5fc13 48347+ }
58c5fc13
MT		 48348+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
48349+ error = -EACCES;
48350+ goto exit2;
48351+ }
48352+ }
48353 error = mnt_want_write(nd.path.mnt);
48354 if (error)
48355 goto exit2;
66a7e928 48356@@ -2813,6 +2932,8 @@ static long do_unlinkat(int dfd, const c
58c5fc13
MT		 48357 if (error)
48358 goto exit3;
48359 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
48360+ if (!error && (saved_ino || saved_dev))
48361+ gr_handle_delete(saved_ino, saved_dev);
48362 exit3:
48363 mnt_drop_write(nd.path.mnt);
48364 exit2:
66a7e928 48365@@ -2890,6 +3011,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
58c5fc13
MT		 48366 if (IS_ERR(dentry))
48367 goto out_unlock;
48368
48369+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
48370+ error = -EACCES;
48371+ goto out_dput;
48372+ }
48373+
48374 error = mnt_want_write(nd.path.mnt);
48375 if (error)
48376 goto out_dput;
66a7e928 48377@@ -2897,6 +3023,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
58c5fc13
MT		 48378 if (error)
48379 goto out_drop_write;
48380 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
48381+ if (!error)
48382+ gr_handle_create(dentry, nd.path.mnt);
48383 out_drop_write:
48384 mnt_drop_write(nd.path.mnt);
48385 out_dput:
66a7e928 48386@@ -3005,6 +3133,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
58c5fc13
MT		 48387 error = PTR_ERR(new_dentry);
48388 if (IS_ERR(new_dentry))
48389 goto out_unlock;
48390+
48391+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
48392+ old_path.dentry->d_inode,
48393+ old_path.dentry->d_inode->i_mode, to)) {
48394+ error = -EACCES;
48395+ goto out_dput;
48396+ }
48397+
48398+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
48399+ old_path.dentry, old_path.mnt, to)) {
48400+ error = -EACCES;
48401+ goto out_dput;
48402+ }
48403+
48404 error = mnt_want_write(nd.path.mnt);
48405 if (error)
48406 goto out_dput;
66a7e928 48407@@ -3012,6 +3154,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
58c5fc13
MT		 48408 if (error)
48409 goto out_drop_write;
48410 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
48411+ if (!error)
48412+ gr_handle_create(new_dentry, nd.path.mnt);
48413 out_drop_write:
48414 mnt_drop_write(nd.path.mnt);
48415 out_dput:
66a7e928
MT		 48416@@ -3189,6 +3333,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48417 char *to;
48418 int error;
48419
48420+ pax_track_stack();
48421+
48422 error = user_path_parent(olddfd, oldname, &oldnd, &from);
48423 if (error)
48424 goto exit;
48425@@ -3245,6 +3391,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
58c5fc13
MT		 48426 if (new_dentry == trap)
48427 goto exit5;
48428
48429+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
48430+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
48431+ to);
48432+ if (error)
48433+ goto exit5;
48434+
48435 error = mnt_want_write(oldnd.path.mnt);
48436 if (error)
48437 goto exit5;
66a7e928 48438@@ -3254,6 +3406,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
58c5fc13
MT		 48439 goto exit6;
48440 error = vfs_rename(old_dir->d_inode, old_dentry,
48441 new_dir->d_inode, new_dentry);
48442+ if (!error)
48443+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
48444+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
48445 exit6:
48446 mnt_drop_write(oldnd.path.mnt);
48447 exit5:
66a7e928 48448@@ -3279,6 +3434,8 @@ SYSCALL_DEFINE2(rename, const char __use
71d190be
MT		 48449
48450 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
48451 {
48452+ char tmpbuf[64];
48453+ const char *newlink;
48454 int len;
48455
48456 len = PTR_ERR(link);
66a7e928 48457@@ -3288,7 +3445,14 @@ int vfs_readlink(struct dentry *dentry,
71d190be
MT		 48458 len = strlen(link);
48459 if (len > (unsigned) buflen)
48460 len = buflen;
48461- if (copy_to_user(buffer, link, len))
48462+
48463+ if (len < sizeof(tmpbuf)) {
48464+ memcpy(tmpbuf, link, len);
48465+ newlink = tmpbuf;
48466+ } else
48467+ newlink = link;
48468+
48469+ if (copy_to_user(buffer, newlink, len))
48470 len = -EFAULT;
48471 out:
48472 return len;
66a7e928
MT		 48473diff -urNp linux-2.6.39/fs/namespace.c linux-2.6.39/fs/namespace.c
48474--- linux-2.6.39/fs/namespace.c 2011-05-19 00:06:34.000000000 -0400
48475+++ linux-2.6.39/fs/namespace.c 2011-05-22 20:43:58.000000000 -0400
48476@@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn
58c5fc13
MT		 48477 if (!(sb->s_flags & MS_RDONLY))
48478 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
48479 up_write(&sb->s_umount);
48480+
48481+ gr_log_remount(mnt->mnt_devname, retval);
48482+
48483 return retval;
48484 }
48485
66a7e928 48486@@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn
6892158b 48487 br_write_unlock(vfsmount_lock);
58c5fc13
MT		 48488 up_write(&namespace_sem);
48489 release_mounts(&umount_list);
48490+
48491+ gr_log_unmount(mnt->mnt_devname, retval);
48492+
48493 return retval;
48494 }
48495
66a7e928 48496@@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_
ae4e228f
MT		 48497 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
48498 MS_STRICTATIME);
58c5fc13 48499
ae4e228f
MT		 48500+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
48501+ retval = -EPERM;
48502+ goto dput_out;
48503+ }
48504+
58c5fc13
MT		 48505+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
48506+ retval = -EPERM;
48507+ goto dput_out;
48508+ }
48509+
48510 if (flags & MS_REMOUNT)
48511 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
48512 data_page);
66a7e928 48513@@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_
58c5fc13
MT		 48514 dev_name, data_page);
48515 dput_out:
48516 path_put(&path);
48517+
48518+ gr_log_mount(dev_name, dir_name, retval);
48519+
48520 return retval;
48521 }
48522
66a7e928
MT		 48523@@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
48524 if (error)
48525 goto out2;
58c5fc13
MT		 48526
48527+ if (gr_handle_chroot_pivot()) {
48528+ error = -EPERM;
66a7e928 48529+ goto out2;
58c5fc13
MT		 48530+ }
48531+
6892158b 48532 get_fs_root(current->fs, &root);
66a7e928
MT		 48533 error = lock_mount(&old);
48534 if (error)
48535diff -urNp linux-2.6.39/fs/ncpfs/dir.c linux-2.6.39/fs/ncpfs/dir.c
48536--- linux-2.6.39/fs/ncpfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48537+++ linux-2.6.39/fs/ncpfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48538@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
48539 int res, val = 0, len;
48540 __u8 __name[NCP_MAXPATHLEN + 1];
48541
48542+ pax_track_stack();
48543+
48544 if (dentry == dentry->d_sb->s_root)
48545 return 1;
48546
48547@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
48548 int error, res, len;
48549 __u8 __name[NCP_MAXPATHLEN + 1];
48550
48551+ pax_track_stack();
48552+
48553 error = -EIO;
48554 if (!ncp_conn_valid(server))
48555 goto finished;
48556@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
48557 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
48558 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
48559
48560+ pax_track_stack();
48561+
48562 ncp_age_dentry(server, dentry);
48563 len = sizeof(__name);
48564 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
48565@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
48566 int error, len;
48567 __u8 __name[NCP_MAXPATHLEN + 1];
48568
48569+ pax_track_stack();
48570+
48571 DPRINTK("ncp_mkdir: making %s/%s\n",
48572 dentry->d_parent->d_name.name, dentry->d_name.name);
48573
48574@@ -1135,6 +1143,8 @@ static int ncp_rename(struct inode *old_
48575 int old_len, new_len;
48576 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
48577
48578+ pax_track_stack();
48579+
48580 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
48581 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
48582 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
48583diff -urNp linux-2.6.39/fs/ncpfs/inode.c linux-2.6.39/fs/ncpfs/inode.c
48584--- linux-2.6.39/fs/ncpfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48585+++ linux-2.6.39/fs/ncpfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48586@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
48587 #endif
48588 struct ncp_entry_info finfo;
48589
48590+ pax_track_stack();
48591+
48592 data.wdog_pid = NULL;
48593 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
48594 if (!server)
48595diff -urNp linux-2.6.39/fs/nfs/inode.c linux-2.6.39/fs/nfs/inode.c
48596--- linux-2.6.39/fs/nfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48597+++ linux-2.6.39/fs/nfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48598@@ -999,16 +999,16 @@ static int nfs_size_need_update(const st
ae4e228f
MT		 48599 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
48600 }
48601
48602-static atomic_long_t nfs_attr_generation_counter;
48603+static atomic_long_unchecked_t nfs_attr_generation_counter;
48604
48605 static unsigned long nfs_read_attr_generation_counter(void)
48606 {
48607- return atomic_long_read(&nfs_attr_generation_counter);
48608+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
48609 }
48610
48611 unsigned long nfs_inc_attr_generation_counter(void)
48612 {
48613- return atomic_long_inc_return(&nfs_attr_generation_counter);
48614+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
48615 }
48616
48617 void nfs_fattr_init(struct nfs_fattr *fattr)
66a7e928
MT		 48618diff -urNp linux-2.6.39/fs/nfs/nfs4proc.c linux-2.6.39/fs/nfs/nfs4proc.c
48619--- linux-2.6.39/fs/nfs/nfs4proc.c 2011-05-19 00:06:34.000000000 -0400
48620+++ linux-2.6.39/fs/nfs/nfs4proc.c 2011-05-22 19:36:32.000000000 -0400
48621@@ -5840,14 +5840,14 @@ struct nfs4_state_recovery_ops nfs41_nog
48622 };
48623 #endif /* CONFIG_NFS_V4_1 */
48624
48625-struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48626+const struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48627 .sched_state_renewal = nfs4_proc_async_renew,
48628 .get_state_renewal_cred_locked = nfs4_get_renew_cred_locked,
48629 .renew_lease = nfs4_proc_renew,
48630 };
48631
48632 #if defined(CONFIG_NFS_V4_1)
48633-struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48634+const struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48635 .sched_state_renewal = nfs41_proc_async_sequence,
48636 .get_state_renewal_cred_locked = nfs4_get_machine_cred_locked,
48637 .renew_lease = nfs4_proc_sequence,
48638diff -urNp linux-2.6.39/fs/nfsd/lockd.c linux-2.6.39/fs/nfsd/lockd.c
48639--- linux-2.6.39/fs/nfsd/lockd.c 2011-05-19 00:06:34.000000000 -0400
48640+++ linux-2.6.39/fs/nfsd/lockd.c 2011-05-22 19:36:32.000000000 -0400
71d190be 48641@@ -60,7 +60,7 @@ nlm_fclose(struct file *filp)
ae4e228f 48642 fput(filp);
58c5fc13
MT		 48643 }
48644
ae4e228f
MT		 48645-static struct nlmsvc_binding nfsd_nlm_ops = {
48646+static const struct nlmsvc_binding nfsd_nlm_ops = {
48647 .fopen = nlm_fopen, /* open file for locking */
48648 .fclose = nlm_fclose, /* close file */
58c5fc13 48649 };
66a7e928
MT		 48650diff -urNp linux-2.6.39/fs/nfsd/nfs4state.c linux-2.6.39/fs/nfsd/nfs4state.c
48651--- linux-2.6.39/fs/nfsd/nfs4state.c 2011-05-19 00:06:34.000000000 -0400
48652+++ linux-2.6.39/fs/nfsd/nfs4state.c 2011-05-22 19:36:32.000000000 -0400
48653@@ -3784,6 +3784,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
48654 unsigned int strhashval;
48655 int err;
48656
48657+ pax_track_stack();
48658+
48659 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
48660 (long long) lock->lk_offset,
48661 (long long) lock->lk_length);
48662diff -urNp linux-2.6.39/fs/nfsd/nfs4xdr.c linux-2.6.39/fs/nfsd/nfs4xdr.c
48663--- linux-2.6.39/fs/nfsd/nfs4xdr.c 2011-05-19 00:06:34.000000000 -0400
48664+++ linux-2.6.39/fs/nfsd/nfs4xdr.c 2011-05-22 19:36:32.000000000 -0400
48665@@ -1793,6 +1793,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
48666 .dentry = dentry,
48667 };
48668
48669+ pax_track_stack();
48670+
48671 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
48672 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
48673 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
48674diff -urNp linux-2.6.39/fs/nfsd/nfsctl.c linux-2.6.39/fs/nfsd/nfsctl.c
48675--- linux-2.6.39/fs/nfsd/nfsctl.c 2011-05-19 00:06:34.000000000 -0400
48676+++ linux-2.6.39/fs/nfsd/nfsctl.c 2011-05-22 19:36:32.000000000 -0400
48677@@ -182,7 +182,7 @@ static int export_features_open(struct i
ae4e228f 48678 return single_open(file, export_features_show, NULL);
58c5fc13
MT		 48679 }
48680
ae4e228f
MT		 48681-static struct file_operations export_features_operations = {
48682+static const struct file_operations export_features_operations = {
48683 .open = export_features_open,
48684 .read = seq_read,
48685 .llseek = seq_lseek,
66a7e928
MT		 48686diff -urNp linux-2.6.39/fs/nfsd/vfs.c linux-2.6.39/fs/nfsd/vfs.c
48687--- linux-2.6.39/fs/nfsd/vfs.c 2011-05-19 00:06:34.000000000 -0400
48688+++ linux-2.6.39/fs/nfsd/vfs.c 2011-05-22 19:36:32.000000000 -0400
16454cff 48689@@ -898,7 +898,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
ae4e228f
MT		 48690 } else {
48691 oldfs = get_fs();
48692 set_fs(KERNEL_DS);
48693- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
48694+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
48695 set_fs(oldfs);
48696 }
48697
16454cff 48698@@ -1002,7 +1002,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
ae4e228f
MT		 48699
48700 /* Write the data. */
48701 oldfs = get_fs(); set_fs(KERNEL_DS);
48702- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
48703+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
48704 set_fs(oldfs);
48705 if (host_err < 0)
48706 goto out_nfserr;
66a7e928 48707@@ -1525,7 +1525,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
ae4e228f 48708 */
58c5fc13 48709
ae4e228f
MT		 48710 oldfs = get_fs(); set_fs(KERNEL_DS);
48711- host_err = inode->i_op->readlink(dentry, buf, *lenp);
48712+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
48713 set_fs(oldfs);
58c5fc13 48714
ae4e228f 48715 if (host_err < 0)
66a7e928
MT		 48716diff -urNp linux-2.6.39/fs/nilfs2/segment.c linux-2.6.39/fs/nilfs2/segment.c
48717--- linux-2.6.39/fs/nilfs2/segment.c 2011-05-19 00:06:34.000000000 -0400
48718+++ linux-2.6.39/fs/nilfs2/segment.c 2011-05-22 19:36:32.000000000 -0400
48719@@ -555,7 +555,7 @@ static void nilfs_write_file_node_binfo(
48720 *vblocknr = binfo->bi_v.bi_vblocknr;
48721 }
48722
48723-static struct nilfs_sc_operations nilfs_sc_file_ops = {
48724+static const struct nilfs_sc_operations nilfs_sc_file_ops = {
48725 .collect_data = nilfs_collect_file_data,
48726 .collect_node = nilfs_collect_file_node,
48727 .collect_bmap = nilfs_collect_file_bmap,
48728@@ -604,7 +604,7 @@ static void nilfs_write_dat_node_binfo(s
48729 *binfo_dat = binfo->bi_dat;
48730 }
48731
48732-static struct nilfs_sc_operations nilfs_sc_dat_ops = {
48733+static const struct nilfs_sc_operations nilfs_sc_dat_ops = {
48734 .collect_data = nilfs_collect_dat_data,
48735 .collect_node = nilfs_collect_file_node,
48736 .collect_bmap = nilfs_collect_dat_bmap,
48737@@ -612,7 +612,7 @@ static struct nilfs_sc_operations nilfs_
48738 .write_node_binfo = nilfs_write_dat_node_binfo,
48739 };
48740
48741-static struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48742+static const struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48743 .collect_data = nilfs_collect_file_data,
48744 .collect_node = NULL,
48745 .collect_bmap = NULL,
48746@@ -971,7 +971,7 @@ static size_t nilfs_segctor_buffer_rest(
48747
48748 static int nilfs_segctor_scan_file(struct nilfs_sc_info *sci,
48749 struct inode *inode,
48750- struct nilfs_sc_operations *sc_ops)
48751+ const struct nilfs_sc_operations *sc_ops)
48752 {
48753 LIST_HEAD(data_buffers);
48754 LIST_HEAD(node_buffers);
48755@@ -1475,7 +1475,7 @@ nilfs_segctor_update_payload_blocknr(str
48756 sector_t blocknr;
48757 unsigned long nfinfo = segbuf->sb_sum.nfinfo;
48758 unsigned long nblocks = 0, ndatablk = 0;
48759- struct nilfs_sc_operations *sc_op = NULL;
48760+ const struct nilfs_sc_operations *sc_op = NULL;
48761 struct nilfs_segsum_pointer ssp;
48762 struct nilfs_finfo *finfo = NULL;
48763 union nilfs_binfo binfo;
48764diff -urNp linux-2.6.39/fs/notify/dnotify/dnotify.c linux-2.6.39/fs/notify/dnotify/dnotify.c
48765--- linux-2.6.39/fs/notify/dnotify/dnotify.c 2011-05-19 00:06:34.000000000 -0400
48766+++ linux-2.6.39/fs/notify/dnotify/dnotify.c 2011-05-22 19:36:32.000000000 -0400
71d190be
MT		 48767@@ -151,7 +151,7 @@ static void dnotify_free_mark(struct fsn
48768 kmem_cache_free(dnotify_mark_cache, dn_mark);
48769 }
48770
48771-static struct fsnotify_ops dnotify_fsnotify_ops = {
48772+static const struct fsnotify_ops dnotify_fsnotify_ops = {
48773 .handle_event = dnotify_handle_event,
48774 .should_send_event = dnotify_should_send_event,
48775 .free_group_priv = NULL,
66a7e928
MT		 48776diff -urNp linux-2.6.39/fs/notify/notification.c linux-2.6.39/fs/notify/notification.c
48777--- linux-2.6.39/fs/notify/notification.c 2011-05-19 00:06:34.000000000 -0400
48778+++ linux-2.6.39/fs/notify/notification.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 48779@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
48780 * get set to 0 so it will never get 'freed'
48781 */
48782 static struct fsnotify_event *q_overflow_event;
48783-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48784+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48785
48786 /**
48787 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
48788@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
48789 */
48790 u32 fsnotify_get_cookie(void)
48791 {
48792- return atomic_inc_return(&fsnotify_sync_cookie);
48793+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
48794 }
48795 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
48796
66a7e928
MT		 48797diff -urNp linux-2.6.39/fs/ntfs/dir.c linux-2.6.39/fs/ntfs/dir.c
48798--- linux-2.6.39/fs/ntfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48799+++ linux-2.6.39/fs/ntfs/dir.c 2011-05-22 19:36:32.000000000 -0400
6892158b
MT		 48800@@ -1329,7 +1329,7 @@ find_next_index_buffer:
48801 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
48802 ~(s64)(ndir->itype.index.block_size - 1)));
48803 /* Bounds checks. */
48804- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48805+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48806 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
48807 "inode 0x%lx or driver bug.", vdir->i_ino);
48808 goto err_out;
66a7e928
MT		 48809diff -urNp linux-2.6.39/fs/ntfs/file.c linux-2.6.39/fs/ntfs/file.c
48810--- linux-2.6.39/fs/ntfs/file.c 2011-05-19 00:06:34.000000000 -0400
48811+++ linux-2.6.39/fs/ntfs/file.c 2011-05-22 19:36:32.000000000 -0400
16454cff 48812@@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
58c5fc13
MT		 48813 #endif /* NTFS_RW */
48814 };
48815
48816-const struct file_operations ntfs_empty_file_ops = {};
ae4e228f 48817+const struct file_operations ntfs_empty_file_ops __read_only;
58c5fc13
MT		 48818
48819-const struct inode_operations ntfs_empty_inode_ops = {};
ae4e228f 48820+const struct inode_operations ntfs_empty_inode_ops __read_only;
66a7e928
MT		 48821diff -urNp linux-2.6.39/fs/ocfs2/cluster/heartbeat.c linux-2.6.39/fs/ocfs2/cluster/heartbeat.c
48822--- linux-2.6.39/fs/ocfs2/cluster/heartbeat.c 2011-05-19 00:06:34.000000000 -0400
48823+++ linux-2.6.39/fs/ocfs2/cluster/heartbeat.c 2011-05-22 19:36:32.000000000 -0400
48824@@ -2261,7 +2261,7 @@ static struct configfs_item_operations o
48825 .store_attribute = o2hb_heartbeat_group_store,
48826 };
48827
48828-static struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48829+static const struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48830 .make_item = o2hb_heartbeat_group_make_item,
48831 .drop_item = o2hb_heartbeat_group_drop_item,
48832 };
48833diff -urNp linux-2.6.39/fs/ocfs2/cluster/nodemanager.c linux-2.6.39/fs/ocfs2/cluster/nodemanager.c
48834--- linux-2.6.39/fs/ocfs2/cluster/nodemanager.c 2011-05-19 00:06:34.000000000 -0400
48835+++ linux-2.6.39/fs/ocfs2/cluster/nodemanager.c 2011-05-22 19:36:32.000000000 -0400
48836@@ -752,7 +752,7 @@ static void o2nm_node_group_drop_item(st
48837 config_item_put(item);
48838 }
48839
48840-static struct configfs_group_operations o2nm_node_group_group_ops = {
48841+static const struct configfs_group_operations o2nm_node_group_group_ops = {
48842 .make_item = o2nm_node_group_make_item,
48843 .drop_item = o2nm_node_group_drop_item,
48844 };
48845@@ -869,7 +869,7 @@ static void o2nm_cluster_group_drop_item
48846 config_item_put(item);
48847 }
48848
48849-static struct configfs_group_operations o2nm_cluster_group_group_ops = {
48850+static const struct configfs_group_operations o2nm_cluster_group_group_ops = {
48851 .make_group = o2nm_cluster_group_make_group,
48852 .drop_item = o2nm_cluster_group_drop_item,
48853 };
48854diff -urNp linux-2.6.39/fs/ocfs2/localalloc.c linux-2.6.39/fs/ocfs2/localalloc.c
48855--- linux-2.6.39/fs/ocfs2/localalloc.c 2011-05-19 00:06:34.000000000 -0400
48856+++ linux-2.6.39/fs/ocfs2/localalloc.c 2011-05-22 19:36:32.000000000 -0400
48857@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
58c5fc13
MT		 48858 goto bail;
48859 }
48860
48861- atomic_inc(&osb->alloc_stats.moves);
48862+ atomic_inc_unchecked(&osb->alloc_stats.moves);
48863
58c5fc13 48864 bail:
57199397 48865 if (handle)
66a7e928
MT		 48866diff -urNp linux-2.6.39/fs/ocfs2/namei.c linux-2.6.39/fs/ocfs2/namei.c
48867--- linux-2.6.39/fs/ocfs2/namei.c 2011-05-19 00:06:34.000000000 -0400
48868+++ linux-2.6.39/fs/ocfs2/namei.c 2011-05-22 19:36:32.000000000 -0400
48869@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
48870 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
48871 struct ocfs2_dir_lookup_result target_insert = { NULL, };
48872
48873+ pax_track_stack();
48874+
48875 /* At some point it might be nice to break this function up a
48876 * bit. */
48877
48878diff -urNp linux-2.6.39/fs/ocfs2/ocfs2.h linux-2.6.39/fs/ocfs2/ocfs2.h
48879--- linux-2.6.39/fs/ocfs2/ocfs2.h 2011-05-19 00:06:34.000000000 -0400
48880+++ linux-2.6.39/fs/ocfs2/ocfs2.h 2011-05-22 19:36:32.000000000 -0400
48881@@ -235,11 +235,11 @@ enum ocfs2_vol_state
58c5fc13
MT		 48882
48883 struct ocfs2_alloc_stats
48884 {
48885- atomic_t moves;
48886- atomic_t local_data;
48887- atomic_t bitmap_data;
48888- atomic_t bg_allocs;
48889- atomic_t bg_extends;
48890+ atomic_unchecked_t moves;
48891+ atomic_unchecked_t local_data;
48892+ atomic_unchecked_t bitmap_data;
48893+ atomic_unchecked_t bg_allocs;
48894+ atomic_unchecked_t bg_extends;
48895 };
48896
48897 enum ocfs2_local_alloc_state
66a7e928
MT		 48898diff -urNp linux-2.6.39/fs/ocfs2/stackglue.h linux-2.6.39/fs/ocfs2/stackglue.h
48899--- linux-2.6.39/fs/ocfs2/stackglue.h 2011-05-19 00:06:34.000000000 -0400
48900+++ linux-2.6.39/fs/ocfs2/stackglue.h 2011-05-22 19:36:32.000000000 -0400
48901@@ -221,13 +221,13 @@ struct ocfs2_stack_operations {
48902 };
48903
48904 /*
48905- * Each stack plugin must describe itself by registering a
48906+ * Each stack plugin must describe itself by registerin const g a
48907 * ocfs2_stack_plugin structure. This is only seen by stackglue and the
48908 * stack driver.
48909 */
48910 struct ocfs2_stack_plugin {
48911 char *sp_name;
48912- struct ocfs2_stack_operations *sp_ops;
48913+ const struct ocfs2_stack_operations *sp_ops;
48914 struct module *sp_owner;
48915
48916 /* These are managed by the stackglue code. */
48917diff -urNp linux-2.6.39/fs/ocfs2/stack_o2cb.c linux-2.6.39/fs/ocfs2/stack_o2cb.c
48918--- linux-2.6.39/fs/ocfs2/stack_o2cb.c 2011-05-19 00:06:34.000000000 -0400
48919+++ linux-2.6.39/fs/ocfs2/stack_o2cb.c 2011-05-22 19:36:32.000000000 -0400
48920@@ -358,7 +358,7 @@ static int o2cb_cluster_this_node(unsign
48921 return 0;
48922 }
48923
48924-static struct ocfs2_stack_operations o2cb_stack_ops = {
48925+static const struct ocfs2_stack_operations o2cb_stack_ops = {
48926 .connect = o2cb_cluster_connect,
48927 .disconnect = o2cb_cluster_disconnect,
48928 .this_node = o2cb_cluster_this_node,
48929@@ -369,7 +369,6 @@ static struct ocfs2_stack_operations o2c
48930 .lock_lvb = o2cb_dlm_lvb,
48931 .dump_lksb = o2cb_dump_lksb,
48932 };
48933-
48934 static struct ocfs2_stack_plugin o2cb_stack = {
48935 .sp_name = "o2cb",
48936 .sp_ops = &o2cb_stack_ops,
48937diff -urNp linux-2.6.39/fs/ocfs2/stack_user.c linux-2.6.39/fs/ocfs2/stack_user.c
48938--- linux-2.6.39/fs/ocfs2/stack_user.c 2011-05-19 00:06:34.000000000 -0400
48939+++ linux-2.6.39/fs/ocfs2/stack_user.c 2011-05-22 19:36:32.000000000 -0400
48940@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_m
48941 long major, minor;
48942 char *ptr = NULL;
48943 struct ocfs2_control_private *p = file->private_data;
48944- struct ocfs2_protocol_version *max =
48945+ const struct ocfs2_protocol_version *max =
48946 &ocfs2_user_plugin.sp_max_proto;
48947
48948 if (ocfs2_control_get_handshake_state(file) !=
48949@@ -861,7 +861,7 @@ static int user_cluster_this_node(unsign
48950 return 0;
48951 }
48952
48953-static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
48954+static const struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
48955 .connect = user_cluster_connect,
48956 .disconnect = user_cluster_disconnect,
48957 .this_node = user_cluster_this_node,
48958diff -urNp linux-2.6.39/fs/ocfs2/suballoc.c linux-2.6.39/fs/ocfs2/suballoc.c
48959--- linux-2.6.39/fs/ocfs2/suballoc.c 2011-05-19 00:06:34.000000000 -0400
48960+++ linux-2.6.39/fs/ocfs2/suballoc.c 2011-05-22 19:36:32.000000000 -0400
48961@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
58c5fc13
MT		 48962 mlog_errno(status);
48963 goto bail;
48964 }
48965- atomic_inc(&osb->alloc_stats.bg_extends);
48966+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
48967
48968 /* You should never ask for this much metadata */
48969 BUG_ON(bits_wanted >
66a7e928 48970@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
58c5fc13
MT		 48971 mlog_errno(status);
48972 goto bail;
48973 }
57199397
MT		 48974- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48975+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
58c5fc13 48976
57199397
MT		 48977 *suballoc_loc = res.sr_bg_blkno;
48978 *suballoc_bit_start = res.sr_bit_offset;
66a7e928
MT		 48979@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
48980 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
48981 res->sr_bits);
48982
48983- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48984+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48985
48986 BUG_ON(res->sr_bits != 1);
48987
48988@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
58c5fc13
MT		 48989 mlog_errno(status);
48990 goto bail;
48991 }
57199397
MT		 48992- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48993+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
58c5fc13 48994
57199397 48995 BUG_ON(res.sr_bits != 1);
58c5fc13 48996
66a7e928 48997@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
58c5fc13
MT		 48998 cluster_start,
48999 num_clusters);
49000 if (!status)
49001- atomic_inc(&osb->alloc_stats.local_data);
49002+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
49003 } else {
49004 if (min_clusters > (osb->bitmap_cpg - 1)) {
49005 /* The only paths asking for contiguousness
66a7e928 49006@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
58c5fc13 49007 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
57199397
MT		 49008 res.sr_bg_blkno,
49009 res.sr_bit_offset);
58c5fc13
MT		 49010- atomic_inc(&osb->alloc_stats.bitmap_data);
49011+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
57199397 49012 *num_clusters = res.sr_bits;
58c5fc13
MT		 49013 }
49014 }
66a7e928
MT		 49015diff -urNp linux-2.6.39/fs/ocfs2/super.c linux-2.6.39/fs/ocfs2/super.c
49016--- linux-2.6.39/fs/ocfs2/super.c 2011-05-19 00:06:34.000000000 -0400
49017+++ linux-2.6.39/fs/ocfs2/super.c 2011-05-22 19:36:32.000000000 -0400
49018@@ -299,11 +299,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
58c5fc13
MT		 49019 "%10s => GlobalAllocs: %d LocalAllocs: %d "
49020 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
49021 "Stats",
49022- atomic_read(&osb->alloc_stats.bitmap_data),
49023- atomic_read(&osb->alloc_stats.local_data),
49024- atomic_read(&osb->alloc_stats.bg_allocs),
49025- atomic_read(&osb->alloc_stats.moves),
49026- atomic_read(&osb->alloc_stats.bg_extends));
49027+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
49028+ atomic_read_unchecked(&osb->alloc_stats.local_data),
49029+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
49030+ atomic_read_unchecked(&osb->alloc_stats.moves),
49031+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
49032
49033 out += snprintf(buf + out, len - out,
49034 "%10s => State: %u Descriptor: %llu Size: %u bits "
66a7e928 49035@@ -2111,11 +2111,11 @@ static int ocfs2_initialize_super(struct
58c5fc13 49036 spin_lock_init(&osb->osb_xattr_lock);
df50ba0c 49037 ocfs2_init_steal_slots(osb);
58c5fc13
MT		 49038
49039- atomic_set(&osb->alloc_stats.moves, 0);
49040- atomic_set(&osb->alloc_stats.local_data, 0);
49041- atomic_set(&osb->alloc_stats.bitmap_data, 0);
49042- atomic_set(&osb->alloc_stats.bg_allocs, 0);
49043- atomic_set(&osb->alloc_stats.bg_extends, 0);
49044+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
49045+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
49046+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
49047+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
49048+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
49049
49050 /* Copy the blockcheck stats from the superblock probe */
49051 osb->osb_ecc_stats = *stats;
66a7e928
MT		 49052diff -urNp linux-2.6.39/fs/ocfs2/symlink.c linux-2.6.39/fs/ocfs2/symlink.c
49053--- linux-2.6.39/fs/ocfs2/symlink.c 2011-05-19 00:06:34.000000000 -0400
49054+++ linux-2.6.39/fs/ocfs2/symlink.c 2011-05-22 19:36:32.000000000 -0400
49055@@ -142,7 +142,7 @@ bail:
58c5fc13 49056
ae4e228f
MT		 49057 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49058 {
49059- char *link = nd_get_link(nd);
49060+ const char *link = nd_get_link(nd);
49061 if (!IS_ERR(link))
49062 kfree(link);
58c5fc13 49063 }
66a7e928
MT		 49064diff -urNp linux-2.6.39/fs/open.c linux-2.6.39/fs/open.c
49065--- linux-2.6.39/fs/open.c 2011-05-19 00:06:34.000000000 -0400
49066+++ linux-2.6.39/fs/open.c 2011-05-22 20:46:51.000000000 -0400
bc901d79
MT		 49067@@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
49068 error = locks_verify_truncate(inode, NULL, length);
49069 if (!error)
49070 error = security_path_truncate(&path);
58c5fc13 49071+
bc901d79
MT		 49072+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
49073+ error = -EACCES;
49074+
49075 if (!error)
49076 error = do_truncate(path.dentry, length, 0, NULL);
49077
16454cff 49078@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
58c5fc13
MT		 49079 if (__mnt_is_readonly(path.mnt))
49080 res = -EROFS;
49081
49082+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
49083+ res = -EACCES;
49084+
49085 out_path_release:
49086 path_put(&path);
49087 out:
16454cff 49088@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
58c5fc13
MT		 49089 if (error)
49090 goto dput_and_out;
49091
49092+ gr_log_chdir(path.dentry, path.mnt);
49093+
49094 set_fs_pwd(current->fs, &path);
49095
49096 dput_and_out:
16454cff 49097@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
58c5fc13
MT		 49098 goto out_putf;
49099
6892158b 49100 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
58c5fc13
MT		 49101+
49102+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
49103+ error = -EPERM;
49104+
49105+ if (!error)
49106+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
49107+
49108 if (!error)
49109 set_fs_pwd(current->fs, &file->f_path);
49110 out_putf:
16454cff 49111@@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use
ae4e228f 49112 if (error)
58c5fc13
MT		 49113 goto dput_and_out;
49114
49115+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
49116+ goto dput_and_out;
49117+
49118+ if (gr_handle_chroot_caps(&path)) {
49119+ error = -ENOMEM;
49120+ goto dput_and_out;
49121+ }
49122+
49123 set_fs_root(current->fs, &path);
49124+
49125+ gr_handle_chroot_chdir(&path);
49126+
49127 error = 0;
49128 dput_and_out:
49129 path_put(&path);
16454cff 49130@@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
58c5fc13
MT		 49131 err = mnt_want_write_file(file);
49132 if (err)
49133 goto out_putf;
49134+
6892158b
MT		 49135 mutex_lock(&inode->i_mutex);
49136+
49137+ if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
58c5fc13 49138+ err = -EACCES;
6892158b 49139+ goto out_unlock;
58c5fc13
MT		 49140+ }
49141+
ae4e228f
MT		 49142 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
49143 if (err)
6892158b
MT		 49144 goto out_unlock;
49145 if (mode == (mode_t) -1)
49146 mode = inode->i_mode;
49147+
49148+ if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
49149+ err = -EACCES;
49150+ goto out_unlock;
49151+ }
49152+
49153 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49154 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
58c5fc13 49155 err = notify_change(dentry, &newattrs);
16454cff 49156@@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
58c5fc13
MT		 49157 error = mnt_want_write(path.mnt);
49158 if (error)
49159 goto dput_and_out;
6892158b
MT		 49160+
49161 mutex_lock(&inode->i_mutex);
58c5fc13
MT		 49162+
49163+ if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
49164+ error = -EACCES;
6892158b 49165+ goto out_unlock;
58c5fc13
MT		 49166+ }
49167+
ae4e228f
MT		 49168 error = security_path_chmod(path.dentry, path.mnt, mode);
49169 if (error)
49170 goto out_unlock;
58c5fc13
MT		 49171 if (mode == (mode_t) -1)
49172 mode = inode->i_mode;
49173+
49174+ if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
49175+ error = -EACCES;
ae4e228f 49176+ goto out_unlock;
58c5fc13
MT		 49177+ }
49178+
49179 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49180 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49181 error = notify_change(path.dentry, &newattrs);
16454cff 49182@@ -528,6 +581,9 @@ static int chown_common(struct path *pat
58c5fc13
MT		 49183 int error;
49184 struct iattr newattrs;
49185
ae4e228f 49186+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
58c5fc13
MT		 49187+ return -EACCES;
49188+
49189 newattrs.ia_valid = ATTR_CTIME;
49190 if (user != (uid_t) -1) {
49191 newattrs.ia_valid |= ATTR_UID;
66a7e928 49192@@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u
bc901d79
MT		 49193 if (!IS_ERR(tmp)) {
49194 fd = get_unused_fd_flags(flags);
49195 if (fd >= 0) {
66a7e928 49196- struct file *f = do_filp_open(dfd, tmp, &op, lookup);
bc901d79
MT		 49197+ struct file *f;
49198+ /* don't allow to be set by userland */
49199+ flags &= ~FMODE_GREXEC;
66a7e928 49200+ f = do_filp_open(dfd, tmp, &op, lookup);
bc901d79
MT		 49201 if (IS_ERR(f)) {
49202 put_unused_fd(fd);
49203 fd = PTR_ERR(f);
66a7e928
MT		 49204diff -urNp linux-2.6.39/fs/partitions/ldm.c linux-2.6.39/fs/partitions/ldm.c
49205--- linux-2.6.39/fs/partitions/ldm.c 2011-05-19 00:06:34.000000000 -0400
49206+++ linux-2.6.39/fs/partitions/ldm.c 2011-05-22 19:41:37.000000000 -0400
49207@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
49208 ldm_error ("A VBLK claims to have %d parts.", num);
71d190be
MT		 49209 return false;
49210 }
71d190be 49211+
66a7e928
MT		 49212 if (rec >= num) {
49213 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
49214 return false;
49215@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
317566c1 49216 goto found;
c52201e0 49217 }
317566c1
MT		 49218
49219- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
49220+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
49221 if (!f) {
49222 ldm_crit ("Out of memory.");
49223 return false;
66a7e928
MT		 49224diff -urNp linux-2.6.39/fs/pipe.c linux-2.6.39/fs/pipe.c
49225--- linux-2.6.39/fs/pipe.c 2011-05-19 00:06:34.000000000 -0400
49226+++ linux-2.6.39/fs/pipe.c 2011-05-22 19:41:37.000000000 -0400
57199397 49227@@ -420,9 +420,9 @@ redo:
ae4e228f
MT		 49228 }
49229 if (bufs) /* More to do? */
49230 continue;
49231- if (!pipe->writers)
49232+ if (!atomic_read(&pipe->writers))
49233 break;
49234- if (!pipe->waiting_writers) {
49235+ if (!atomic_read(&pipe->waiting_writers)) {
49236 /* syscall merging: Usually we must not sleep
49237 * if O_NONBLOCK is set, or if we got some data.
49238 * But if a writer sleeps in kernel space, then
57199397 49239@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
ae4e228f
MT		 49240 mutex_lock(&inode->i_mutex);
49241 pipe = inode->i_pipe;
49242
49243- if (!pipe->readers) {
49244+ if (!atomic_read(&pipe->readers)) {
49245 send_sig(SIGPIPE, current, 0);
49246 ret = -EPIPE;
49247 goto out;
57199397 49248@@ -530,7 +530,7 @@ redo1:
ae4e228f
MT		 49249 for (;;) {
49250 int bufs;
49251
49252- if (!pipe->readers) {
49253+ if (!atomic_read(&pipe->readers)) {
49254 send_sig(SIGPIPE, current, 0);
49255 if (!ret)
49256 ret = -EPIPE;
57199397 49257@@ -616,9 +616,9 @@ redo2:
ae4e228f
MT		 49258 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
49259 do_wakeup = 0;
49260 }
49261- pipe->waiting_writers++;
49262+ atomic_inc(&pipe->waiting_writers);
49263 pipe_wait(pipe);
49264- pipe->waiting_writers--;
49265+ atomic_dec(&pipe->waiting_writers);
49266 }
49267 out:
49268 mutex_unlock(&inode->i_mutex);
57199397 49269@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
ae4e228f
MT		 49270 mask = 0;
49271 if (filp->f_mode & FMODE_READ) {
49272 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
49273- if (!pipe->writers && filp->f_version != pipe->w_counter)
49274+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
49275 mask |= POLLHUP;
49276 }
49277
57199397 49278@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
ae4e228f
MT		 49279 * Most Unices do not set POLLERR for FIFOs but on Linux they
49280 * behave exactly like pipes for poll().
49281 */
49282- if (!pipe->readers)
49283+ if (!atomic_read(&pipe->readers))
49284 mask |= POLLERR;
49285 }
49286
57199397 49287@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
ae4e228f
MT		 49288
49289 mutex_lock(&inode->i_mutex);
49290 pipe = inode->i_pipe;
49291- pipe->readers -= decr;
49292- pipe->writers -= decw;
49293+ atomic_sub(decr, &pipe->readers);
49294+ atomic_sub(decw, &pipe->writers);
49295
49296- if (!pipe->readers && !pipe->writers) {
49297+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
49298 free_pipe_info(inode);
49299 } else {
16454cff 49300 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
57199397 49301@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
ae4e228f
MT		 49302
49303 if (inode->i_pipe) {
49304 ret = 0;
49305- inode->i_pipe->readers++;
49306+ atomic_inc(&inode->i_pipe->readers);
49307 }
49308
49309 mutex_unlock(&inode->i_mutex);
57199397 49310@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
ae4e228f
MT		 49311
49312 if (inode->i_pipe) {
49313 ret = 0;
49314- inode->i_pipe->writers++;
49315+ atomic_inc(&inode->i_pipe->writers);
49316 }
49317
49318 mutex_unlock(&inode->i_mutex);
57199397 49319@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
ae4e228f
MT		 49320 if (inode->i_pipe) {
49321 ret = 0;
49322 if (filp->f_mode & FMODE_READ)
49323- inode->i_pipe->readers++;
49324+ atomic_inc(&inode->i_pipe->readers);
49325 if (filp->f_mode & FMODE_WRITE)
49326- inode->i_pipe->writers++;
49327+ atomic_inc(&inode->i_pipe->writers);
49328 }
49329
49330 mutex_unlock(&inode->i_mutex);
57199397 49331@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
58c5fc13
MT		 49332 inode->i_pipe = NULL;
49333 }
49334
49335-static struct vfsmount *pipe_mnt __read_mostly;
49336+struct vfsmount *pipe_mnt __read_mostly;
ae4e228f
MT		 49337
49338 /*
49339 * pipefs_dname() is called from d_path().
bc901d79 49340@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
ae4e228f
MT		 49341 goto fail_iput;
49342 inode->i_pipe = pipe;
49343
49344- pipe->readers = pipe->writers = 1;
49345+ atomic_set(&pipe->readers, 1);
49346+ atomic_set(&pipe->writers, 1);
49347 inode->i_fop = &rdwr_pipefifo_fops;
49348
58c5fc13 49349 /*
66a7e928
MT		 49350diff -urNp linux-2.6.39/fs/proc/array.c linux-2.6.39/fs/proc/array.c
49351--- linux-2.6.39/fs/proc/array.c 2011-05-19 00:06:34.000000000 -0400
49352+++ linux-2.6.39/fs/proc/array.c 2011-05-22 19:41:37.000000000 -0400
6892158b
MT		 49353@@ -60,6 +60,7 @@
49354 #include <linux/tty.h>
49355 #include <linux/string.h>
49356 #include <linux/mman.h>
49357+#include <linux/grsecurity.h>
49358 #include <linux/proc_fs.h>
49359 #include <linux/ioport.h>
49360 #include <linux/uaccess.h>
49361@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
16454cff 49362 seq_putc(m, '\n');
57199397
MT		 49363 }
49364
49365+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49366+static inline void task_pax(struct seq_file *m, struct task_struct *p)
49367+{
49368+ if (p->mm)
49369+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
49370+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
49371+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
49372+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
49373+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
49374+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
49375+ else
49376+ seq_printf(m, "PaX:\t-----\n");
49377+}
49378+#endif
49379+
49380 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49381 struct pid *pid, struct task_struct *task)
49382 {
317566c1 49383@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
c52201e0
MT		 49384 task_cpus_allowed(m, task);
49385 cpuset_task_status_allowed(m, task);
57199397
MT		 49386 task_context_switch_counts(m, task);
49387+
49388+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49389+ task_pax(m, task);
49390+#endif
6892158b
MT		 49391+
49392+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
49393+ task_grsec_rbac(m, task);
49394+#endif
57199397
MT		 49395+
49396 return 0;
49397 }
49398
49399+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49400+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49401+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49402+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49403+#endif
49404+
49405 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
49406 struct pid *pid, struct task_struct *task, int whole)
49407 {
66a7e928
MT		 49408@@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
49409 cputime_t cutime, cstime, utime, stime;
49410 cputime_t cgtime, gtime;
49411 unsigned long rsslim = 0;
49412- char tcomm[sizeof(task->comm)];
49413+ char tcomm[sizeof(task->comm)] = { 0 };
49414 unsigned long flags;
49415
49416+ pax_track_stack();
49417+
49418 state = *get_task_state(task);
49419 vsize = eip = esp = 0;
49420 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
49421@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
57199397
MT		 49422 gtime = task->gtime;
49423 }
49424
49425+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49426+ if (PAX_RAND_FLAGS(mm)) {
49427+ eip = 0;
49428+ esp = 0;
49429+ wchan = 0;
49430+ }
49431+#endif
49432+#ifdef CONFIG_GRKERNSEC_HIDESYM
49433+ wchan = 0;
49434+ eip =0;
49435+ esp =0;
49436+#endif
49437+
49438 /* scale priority and nice values from timeslices to -20..20 */
49439 /* to make it look like a "normal" Unix priority/nice value */
49440 priority = task_prio(task);
66a7e928 49441@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
57199397
MT		 49442 vsize,
49443 mm ? get_mm_rss(mm) : 0,
49444 rsslim,
49445+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
ea610fa8
AF		 49446+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
49447+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
57199397
MT		 49448+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
49449+#else
ea610fa8
AF		 49450 mm ? (permitted ? mm->start_code : 1) : 0,
49451 mm ? (permitted ? mm->end_code : 1) : 0,
57199397
MT		 49452 (permitted && mm) ? mm->start_stack : 0,
49453+#endif
49454 esp,
49455 eip,
49456 /* The signal information here is obsolete.
66a7e928 49457@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
57199397
MT		 49458
49459 return 0;
49460 }
49461+
49462+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49463+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
49464+{
71d190be
MT		 49465+ u32 curr_ip = 0;
49466+ unsigned long flags;
49467+
49468+ if (lock_task_sighand(task, &flags)) {
49469+ curr_ip = task->signal->curr_ip;
49470+ unlock_task_sighand(task, &flags);
49471+ }
49472+
49473+ return sprintf(buffer, "%pI4\n", &curr_ip);
57199397
MT		 49474+}
49475+#endif
66a7e928
MT		 49476diff -urNp linux-2.6.39/fs/proc/base.c linux-2.6.39/fs/proc/base.c
49477--- linux-2.6.39/fs/proc/base.c 2011-05-19 00:06:34.000000000 -0400
49478+++ linux-2.6.39/fs/proc/base.c 2011-05-22 21:50:17.000000000 -0400
6892158b 49479@@ -104,6 +104,22 @@ struct pid_entry {
57199397
MT		 49480 union proc_op op;
49481 };
49482
49483+struct getdents_callback {
49484+ struct linux_dirent __user * current_dir;
49485+ struct linux_dirent __user * previous;
49486+ struct file * file;
49487+ int count;
49488+ int error;
49489+};
49490+
49491+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
49492+ loff_t offset, u64 ino, unsigned int d_type)
49493+{
49494+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
49495+ buf->error = -EINVAL;
49496+ return 0;
49497+}
49498+
49499 #define NOD(NAME, MODE, IOP, FOP, OP) { \
49500 .name = (NAME), \
49501 .len = sizeof(NAME) - 1, \
66a7e928 49502@@ -206,6 +222,9 @@ static struct mm_struct *__check_mem_per
57199397 49503 if (task == current)
66a7e928 49504 return mm;
57199397
MT		 49505
49506+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
66a7e928 49507+ return ERR_PTR(-EPERM);
57199397
MT		 49508+
49509 /*
49510 * If current is actively ptrace'ing, and would also be
49511 * permitted to freshly attach with ptrace now, permit it.
66a7e928 49512@@ -279,6 +298,9 @@ static int proc_pid_cmdline(struct task_
57199397
MT		 49513 if (!mm->arg_end)
49514 goto out_mm; /* Shh! No looking before we're done */
49515
49516+ if (gr_acl_handle_procpidmem(task))
49517+ goto out_mm;
49518+
49519 len = mm->arg_end - mm->arg_start;
49520
49521 if (len > PAGE_SIZE)
66a7e928 49522@@ -306,12 +328,28 @@ out:
57199397
MT		 49523 return res;
49524 }
49525
49526+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49527+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49528+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49529+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49530+#endif
49531+
49532 static int proc_pid_auxv(struct task_struct *task, char *buffer)
49533 {
66a7e928
MT		 49534 struct mm_struct *mm = mm_for_maps(task);
49535 int res = PTR_ERR(mm);
49536 if (mm && !IS_ERR(mm)) {
57199397
MT		 49537 unsigned int nwords = 0;
49538+
49539+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
6892158b
MT		 49540+ /* allow if we're currently ptracing this task */
49541+ if (PAX_RAND_FLAGS(mm) &&
49542+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
57199397
MT		 49543+ mmput(mm);
49544+ return res;
49545+ }
49546+#endif
49547+
49548 do {
49549 nwords += 2;
49550 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
66a7e928 49551@@ -325,7 +363,7 @@ static int proc_pid_auxv(struct task_str
6892158b
MT		 49552 }
49553
49554
49555-#ifdef CONFIG_KALLSYMS
49556+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49557 /*
49558 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
49559 * Returns the resolved symbol. If that fails, simply return the address.
66a7e928
MT		 49560@@ -364,7 +402,7 @@ static void unlock_trace(struct task_str
49561 mutex_unlock(&task->signal->cred_guard_mutex);
57199397 49562 }
57199397
MT		 49563
49564-#ifdef CONFIG_STACKTRACE
49565+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49566
49567 #define MAX_STACK_TRACE_DEPTH 64
49568
66a7e928 49569@@ -555,7 +593,7 @@ static int proc_pid_limits(struct task_s
57199397
MT		 49570 return count;
49571 }
49572
49573-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49574+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49575 static int proc_pid_syscall(struct task_struct *task, char *buffer)
49576 {
49577 long nr;
66a7e928 49578@@ -584,7 +622,7 @@ static int proc_pid_syscall(struct task_
16454cff
MT		 49579 /************************************************************************/
49580
49581 /* permission checks */
49582-static int proc_fd_access_allowed(struct inode *inode)
49583+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
49584 {
49585 struct task_struct *task;
49586 int allowed = 0;
66a7e928 49587@@ -594,7 +632,10 @@ static int proc_fd_access_allowed(struct
16454cff
MT		 49588 */
49589 task = get_proc_task(inode);
49590 if (task) {
49591- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49592+ if (log)
49593+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
49594+ else
49595+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49596 put_task_struct(task);
49597 }
49598 return allowed;
66a7e928 49599@@ -973,6 +1014,9 @@ static ssize_t environ_read(struct file
57199397
MT		 49600 if (!task)
49601 goto out_no_task;
49602
49603+ if (gr_acl_handle_procpidmem(task))
49604+ goto out;
49605+
66a7e928
MT		 49606 ret = -ENOMEM;
49607 page = (char *)__get_free_page(GFP_TEMPORARY);
49608 if (!page)
49609@@ -1660,7 +1704,7 @@ static void *proc_pid_follow_link(struct
16454cff
MT		 49610 path_put(&nd->path);
49611
49612 /* Are we allowed to snoop on the tasks file descriptors? */
49613- if (!proc_fd_access_allowed(inode))
49614+ if (!proc_fd_access_allowed(inode,0))
49615 goto out;
49616
49617 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
66a7e928 49618@@ -1699,8 +1743,18 @@ static int proc_pid_readlink(struct dent
16454cff
MT		 49619 struct path path;
49620
49621 /* Are we allowed to snoop on the tasks file descriptors? */
49622- if (!proc_fd_access_allowed(inode))
49623- goto out;
49624+ /* logging this is needed for learning on chromium to work properly,
49625+ but we don't want to flood the logs from 'ps' which does a readlink
49626+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
49627+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
49628+ */
49629+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
49630+ if (!proc_fd_access_allowed(inode,0))
49631+ goto out;
49632+ } else {
49633+ if (!proc_fd_access_allowed(inode,1))
49634+ goto out;
49635+ }
49636
49637 error = PROC_I(inode)->op.proc_get_link(inode, &path);
49638 if (error)
66a7e928 49639@@ -1766,7 +1820,11 @@ static struct inode *proc_pid_make_inode
57199397
MT		 49640 rcu_read_lock();
49641 cred = __task_cred(task);
49642 inode->i_uid = cred->euid;
49643+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49644+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49645+#else
49646 inode->i_gid = cred->egid;
49647+#endif
49648 rcu_read_unlock();
49649 }
49650 security_task_to_inode(task, inode);
66a7e928 49651@@ -1784,6 +1842,9 @@ static int pid_getattr(struct vfsmount *
57199397
MT		 49652 struct inode *inode = dentry->d_inode;
49653 struct task_struct *task;
49654 const struct cred *cred;
49655+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49656+ const struct cred *tmpcred = current_cred();
49657+#endif
49658
49659 generic_fillattr(inode, stat);
49660
66a7e928 49661@@ -1791,12 +1852,34 @@ static int pid_getattr(struct vfsmount *
57199397
MT		 49662 stat->uid = 0;
49663 stat->gid = 0;
49664 task = pid_task(proc_pid(inode), PIDTYPE_PID);
49665+
49666+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
49667+ rcu_read_unlock();
49668+ return -ENOENT;
49669+ }
49670+
49671 if (task) {
49672+ cred = __task_cred(task);
49673+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49674+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
49675+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49676+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49677+#endif
49678+ )
49679+#endif
49680 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49681+#ifdef CONFIG_GRKERNSEC_PROC_USER
49682+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49683+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49684+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49685+#endif
49686 task_dumpable(task)) {
49687- cred = __task_cred(task);
49688 stat->uid = cred->euid;
49689+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49690+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
49691+#else
49692 stat->gid = cred->egid;
49693+#endif
49694 }
49695 }
49696 rcu_read_unlock();
66a7e928 49697@@ -1834,11 +1917,20 @@ static int pid_revalidate(struct dentry
57199397
MT		 49698
49699 if (task) {
49700 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49701+#ifdef CONFIG_GRKERNSEC_PROC_USER
49702+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49703+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49704+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49705+#endif
49706 task_dumpable(task)) {
49707 rcu_read_lock();
49708 cred = __task_cred(task);
49709 inode->i_uid = cred->euid;
49710+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49711+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49712+#else
49713 inode->i_gid = cred->egid;
49714+#endif
49715 rcu_read_unlock();
49716 } else {
49717 inode->i_uid = 0;
66a7e928 49718@@ -1959,7 +2051,8 @@ static int proc_fd_info(struct inode *in
57199397
MT		 49719 int fd = proc_fd(inode);
49720
49721 if (task) {
49722- files = get_files_struct(task);
49723+ if (!gr_acl_handle_procpidmem(task))
49724+ files = get_files_struct(task);
49725 put_task_struct(task);
49726 }
49727 if (files) {
66a7e928 49728@@ -2219,15 +2312,25 @@ static const struct file_operations proc
16454cff
MT		 49729 */
49730 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
57199397 49731 {
57199397 49732+ struct task_struct *task;
16454cff 49733 int rv;
57199397 49734
16454cff
MT		 49735 if (flags & IPERM_FLAG_RCU)
49736 return -ECHILD;
49737 rv = generic_permission(inode, mask, flags, NULL);
57199397
MT		 49738- if (rv == 0)
49739- return 0;
49740+
49741 if (task_pid(current) == proc_pid(inode))
49742 rv = 0;
49743+
49744+ task = get_proc_task(inode);
49745+ if (task == NULL)
49746+ return rv;
49747+
49748+ if (gr_acl_handle_procpidmem(task))
49749+ rv = -EACCES;
49750+
49751+ put_task_struct(task);
49752+
49753 return rv;
49754 }
49755
66a7e928 49756@@ -2337,6 +2440,9 @@ static struct dentry *proc_pident_lookup
57199397
MT		 49757 if (!task)
49758 goto out_no_task;
49759
49760+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49761+ goto out;
49762+
49763 /*
49764 * Yes, it does not scale. And it should not. Don't add
49765 * new entries into /proc/<tgid>/ without very good reasons.
66a7e928 49766@@ -2381,6 +2487,9 @@ static int proc_pident_readdir(struct fi
57199397
MT		 49767 if (!task)
49768 goto out_no_task;
49769
49770+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49771+ goto out;
49772+
49773 ret = 0;
49774 i = filp->f_pos;
49775 switch (i) {
66a7e928 49776@@ -2651,7 +2760,7 @@ static void *proc_self_follow_link(struc
57199397
MT		 49777 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
49778 void *cookie)
49779 {
49780- char *s = nd_get_link(nd);
49781+ const char *s = nd_get_link(nd);
49782 if (!IS_ERR(s))
49783 __putname(s);
49784 }
66a7e928 49785@@ -2835,7 +2944,7 @@ static const struct pid_entry tgid_base_
16454cff 49786 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
57199397
MT		 49787 #endif
49788 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49789-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49790+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
66a7e928 49791 INF("syscall", S_IRUGO, proc_pid_syscall),
57199397
MT		 49792 #endif
49793 INF("cmdline", S_IRUGO, proc_pid_cmdline),
66a7e928 49794@@ -2860,10 +2969,10 @@ static const struct pid_entry tgid_base_
6892158b
MT		 49795 #ifdef CONFIG_SECURITY
49796 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49797 #endif
49798-#ifdef CONFIG_KALLSYMS
49799+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
57199397
MT		 49800 INF("wchan", S_IRUGO, proc_pid_wchan),
49801 #endif
49802-#ifdef CONFIG_STACKTRACE
49803+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
66a7e928 49804 ONE("stack", S_IRUGO, proc_pid_stack),
57199397
MT		 49805 #endif
49806 #ifdef CONFIG_SCHEDSTATS
66a7e928 49807@@ -2894,6 +3003,9 @@ static const struct pid_entry tgid_base_
57199397
MT		 49808 #ifdef CONFIG_TASK_IO_ACCOUNTING
49809 INF("io", S_IRUGO, proc_tgid_io_accounting),
49810 #endif
49811+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49812+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
49813+#endif
49814 };
49815
49816 static int proc_tgid_base_readdir(struct file * filp,
66a7e928 49817@@ -3019,7 +3131,14 @@ static struct dentry *proc_pid_instantia
57199397
MT		 49818 if (!inode)
49819 goto out;
49820
49821+#ifdef CONFIG_GRKERNSEC_PROC_USER
49822+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
49823+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49824+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49825+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
49826+#else
49827 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
49828+#endif
49829 inode->i_op = &proc_tgid_base_inode_operations;
49830 inode->i_fop = &proc_tgid_base_operations;
49831 inode->i_flags|=S_IMMUTABLE;
66a7e928 49832@@ -3061,7 +3180,11 @@ struct dentry *proc_pid_lookup(struct in
57199397
MT		 49833 if (!task)
49834 goto out;
49835
49836+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49837+ goto out_put_task;
49838+
49839 result = proc_pid_instantiate(dir, dentry, task, NULL);
49840+out_put_task:
49841 put_task_struct(task);
49842 out:
49843 return result;
66a7e928 49844@@ -3126,6 +3249,11 @@ int proc_pid_readdir(struct file * filp,
57199397 49845 {
71d190be
MT		 49846 unsigned int nr;
49847 struct task_struct *reaper;
57199397
MT		 49848+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49849+ const struct cred *tmpcred = current_cred();
49850+ const struct cred *itercred;
49851+#endif
49852+ filldir_t __filldir = filldir;
49853 struct tgid_iter iter;
49854 struct pid_namespace *ns;
49855
66a7e928 49856@@ -3149,8 +3277,27 @@ int proc_pid_readdir(struct file * filp,
57199397
MT		 49857 for (iter = next_tgid(ns, iter);
49858 iter.task;
49859 iter.tgid += 1, iter = next_tgid(ns, iter)) {
49860+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49861+ rcu_read_lock();
49862+ itercred = __task_cred(iter.task);
49863+#endif
49864+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
49865+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49866+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
49867+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49868+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49869+#endif
49870+ )
49871+#endif
49872+ )
49873+ __filldir = &gr_fake_filldir;
49874+ else
49875+ __filldir = filldir;
49876+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49877+ rcu_read_unlock();
49878+#endif
49879 filp->f_pos = iter.tgid + TGID_OFFSET;
49880- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
49881+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
49882 put_task_struct(iter.task);
49883 goto out;
49884 }
66a7e928 49885@@ -3177,7 +3324,7 @@ static const struct pid_entry tid_base_s
57199397
MT		 49886 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
49887 #endif
49888 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49889-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49890+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
66a7e928 49891 INF("syscall", S_IRUGO, proc_pid_syscall),
57199397
MT		 49892 #endif
49893 INF("cmdline", S_IRUGO, proc_pid_cmdline),
66a7e928 49894@@ -3201,10 +3348,10 @@ static const struct pid_entry tid_base_s
6892158b
MT		 49895 #ifdef CONFIG_SECURITY
49896 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49897 #endif
49898-#ifdef CONFIG_KALLSYMS
49899+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
57199397
MT		 49900 INF("wchan", S_IRUGO, proc_pid_wchan),
49901 #endif
49902-#ifdef CONFIG_STACKTRACE
49903+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
66a7e928 49904 ONE("stack", S_IRUGO, proc_pid_stack),
57199397
MT		 49905 #endif
49906 #ifdef CONFIG_SCHEDSTATS
66a7e928
MT		 49907diff -urNp linux-2.6.39/fs/proc/cmdline.c linux-2.6.39/fs/proc/cmdline.c
49908--- linux-2.6.39/fs/proc/cmdline.c 2011-05-19 00:06:34.000000000 -0400
49909+++ linux-2.6.39/fs/proc/cmdline.c 2011-05-22 19:41:37.000000000 -0400
57199397
MT		 49910@@ -23,7 +23,11 @@ static const struct file_operations cmdl
49911
49912 static int __init proc_cmdline_init(void)
49913 {
49914+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49915+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
49916+#else
49917 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
49918+#endif
49919 return 0;
49920 }
49921 module_init(proc_cmdline_init);
66a7e928
MT		 49922diff -urNp linux-2.6.39/fs/proc/devices.c linux-2.6.39/fs/proc/devices.c
49923--- linux-2.6.39/fs/proc/devices.c 2011-05-19 00:06:34.000000000 -0400
49924+++ linux-2.6.39/fs/proc/devices.c 2011-05-22 19:41:37.000000000 -0400
57199397
MT		 49925@@ -64,7 +64,11 @@ static const struct file_operations proc
49926
49927 static int __init proc_devices_init(void)
49928 {
49929+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49930+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
49931+#else
49932 proc_create("devices", 0, NULL, &proc_devinfo_operations);
49933+#endif
49934 return 0;
49935 }
49936 module_init(proc_devices_init);
66a7e928
MT		 49937diff -urNp linux-2.6.39/fs/proc/inode.c linux-2.6.39/fs/proc/inode.c
49938--- linux-2.6.39/fs/proc/inode.c 2011-05-19 00:06:34.000000000 -0400
49939+++ linux-2.6.39/fs/proc/inode.c 2011-05-22 19:41:37.000000000 -0400
49940@@ -433,7 +433,11 @@ struct inode *proc_get_inode(struct supe
57199397
MT		 49941 if (de->mode) {
49942 inode->i_mode = de->mode;
49943 inode->i_uid = de->uid;
49944+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49945+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49946+#else
49947 inode->i_gid = de->gid;
49948+#endif
49949 }
49950 if (de->size)
49951 inode->i_size = de->size;
66a7e928
MT		 49952diff -urNp linux-2.6.39/fs/proc/internal.h linux-2.6.39/fs/proc/internal.h
49953--- linux-2.6.39/fs/proc/internal.h 2011-05-19 00:06:34.000000000 -0400
49954+++ linux-2.6.39/fs/proc/internal.h 2011-05-22 19:41:37.000000000 -0400
57199397
MT		 49955@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
49956 struct pid *pid, struct task_struct *task);
49957 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
49958 struct pid *pid, struct task_struct *task);
49959+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49960+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
49961+#endif
49962 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
49963
49964 extern const struct file_operations proc_maps_operations;
66a7e928
MT		 49965diff -urNp linux-2.6.39/fs/proc/Kconfig linux-2.6.39/fs/proc/Kconfig
49966--- linux-2.6.39/fs/proc/Kconfig 2011-05-19 00:06:34.000000000 -0400
49967+++ linux-2.6.39/fs/proc/Kconfig 2011-05-22 19:41:37.000000000 -0400
efbe55a5
MT		 49968@@ -30,12 +30,12 @@ config PROC_FS
49969
49970 config PROC_KCORE
49971 bool "/proc/kcore support" if !ARM
49972- depends on PROC_FS && MMU
49973+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
49974
49975 config PROC_VMCORE
bc901d79
MT		 49976 bool "/proc/vmcore support"
49977- depends on PROC_FS && CRASH_DUMP
efbe55a5 49978- default y
bc901d79 49979+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
efbe55a5
MT		 49980+ default n
49981 help
49982 Exports the dump image of crashed kernel in ELF format.
49983
49984@@ -59,8 +59,8 @@ config PROC_SYSCTL
49985 limited in memory.
49986
49987 config PROC_PAGE_MONITOR
49988- default y
49989- depends on PROC_FS && MMU
49990+ default n
49991+ depends on PROC_FS && MMU && !GRKERNSEC
16454cff 49992 bool "Enable /proc page monitoring" if EXPERT
efbe55a5
MT		 49993 help
49994 Various /proc files exist to monitor process memory utilization:
66a7e928
MT		 49995diff -urNp linux-2.6.39/fs/proc/kcore.c linux-2.6.39/fs/proc/kcore.c
49996--- linux-2.6.39/fs/proc/kcore.c 2011-05-19 00:06:34.000000000 -0400
49997+++ linux-2.6.39/fs/proc/kcore.c 2011-05-22 19:41:37.000000000 -0400
49998@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
49999 off_t offset = 0;
50000 struct kcore_list *m;
50001
50002+ pax_track_stack();
50003+
50004 /* setup ELF header */
50005 elf = (struct elfhdr *) bufp;
50006 bufp += sizeof(struct elfhdr);
50007@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
57199397
MT		 50008 * the addresses in the elf_phdr on our list.
50009 */
50010 start = kc_offset_to_vaddr(*fpos - elf_buflen);
50011- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
50012+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
50013+ if (tsz > buflen)
50014 tsz = buflen;
50015-
58c5fc13 50016+
57199397
MT		 50017 while (buflen) {
50018 struct kcore_list *m;
58c5fc13 50019
66a7e928 50020@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
57199397 50021 kfree(elf_buf);
58c5fc13 50022 } else {
57199397
MT		 50023 if (kern_addr_valid(start)) {
50024- unsigned long n;
50025+ char *elf_buf;
bc901d79 50026+ mm_segment_t oldfs;
57199397
MT		 50027
50028- n = copy_to_user(buffer, (char *)start, tsz);
50029- /*
50030- * We cannot distingush between fault on source
50031- * and fault on destination. When this happens
50032- * we clear too and hope it will trigger the
50033- * EFAULT again.
50034- */
50035- if (n) {
50036- if (clear_user(buffer + tsz - n,
50037- n))
50038+ elf_buf = kmalloc(tsz, GFP_KERNEL);
50039+ if (!elf_buf)
50040+ return -ENOMEM;
bc901d79
MT		 50041+ oldfs = get_fs();
50042+ set_fs(KERNEL_DS);
57199397 50043+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
bc901d79 50044+ set_fs(oldfs);
57199397
MT		 50045+ if (copy_to_user(buffer, elf_buf, tsz)) {
50046+ kfree(elf_buf);
50047 return -EFAULT;
50048+ }
50049 }
bc901d79 50050+ set_fs(oldfs);
57199397
MT		 50051+ kfree(elf_buf);
50052 } else {
50053 if (clear_user(buffer, tsz))
50054 return -EFAULT;
66a7e928 50055@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
58c5fc13 50056
ae4e228f 50057 static int open_kcore(struct inode *inode, struct file *filp)
58c5fc13 50058 {
ae4e228f
MT		 50059+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
50060+ return -EPERM;
58c5fc13 50061+#endif
ae4e228f
MT		 50062 if (!capable(CAP_SYS_RAWIO))
50063 return -EPERM;
50064 if (kcore_need_update)
66a7e928
MT		 50065diff -urNp linux-2.6.39/fs/proc/meminfo.c linux-2.6.39/fs/proc/meminfo.c
50066--- linux-2.6.39/fs/proc/meminfo.c 2011-05-19 00:06:34.000000000 -0400
50067+++ linux-2.6.39/fs/proc/meminfo.c 2011-05-22 19:36:32.000000000 -0400
50068@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
50069 unsigned long pages[NR_LRU_LISTS];
50070 int lru;
50071
50072+ pax_track_stack();
50073+
50074 /*
50075 * display in kilobytes.
50076 */
50077@@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
ae4e228f
MT		 50078 vmi.used >> 10,
50079 vmi.largest_chunk >> 10
50080 #ifdef CONFIG_MEMORY_FAILURE
50081- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
50082+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
50083 #endif
16454cff
MT		 50084 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
50085 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
66a7e928
MT		 50086diff -urNp linux-2.6.39/fs/proc/nommu.c linux-2.6.39/fs/proc/nommu.c
50087--- linux-2.6.39/fs/proc/nommu.c 2011-05-19 00:06:34.000000000 -0400
50088+++ linux-2.6.39/fs/proc/nommu.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 50089@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
58c5fc13
MT		 50090 if (len < 1)
50091 len = 1;
50092 seq_printf(m, "%*c", len, ' ');
50093- seq_path(m, &file->f_path, "");
50094+ seq_path(m, &file->f_path, "\n\\");
50095 }
50096
50097 seq_putc(m, '\n');
66a7e928
MT		 50098diff -urNp linux-2.6.39/fs/proc/proc_net.c linux-2.6.39/fs/proc/proc_net.c
50099--- linux-2.6.39/fs/proc/proc_net.c 2011-05-19 00:06:34.000000000 -0400
50100+++ linux-2.6.39/fs/proc/proc_net.c 2011-05-22 19:41:37.000000000 -0400
df50ba0c 50101@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
58c5fc13
MT		 50102 struct task_struct *task;
50103 struct nsproxy *ns;
50104 struct net *net = NULL;
50105+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50106+ const struct cred *cred = current_cred();
50107+#endif
50108+
50109+#ifdef CONFIG_GRKERNSEC_PROC_USER
50110+ if (cred->fsuid)
50111+ return net;
50112+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50113+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
50114+ return net;
50115+#endif
50116
50117 rcu_read_lock();
50118 task = pid_task(proc_pid(dir), PIDTYPE_PID);
66a7e928
MT		 50119diff -urNp linux-2.6.39/fs/proc/proc_sysctl.c linux-2.6.39/fs/proc/proc_sysctl.c
50120--- linux-2.6.39/fs/proc/proc_sysctl.c 2011-05-19 00:06:34.000000000 -0400
50121+++ linux-2.6.39/fs/proc/proc_sysctl.c 2011-05-22 19:41:37.000000000 -0400
16454cff
MT		 50122@@ -8,6 +8,8 @@
50123 #include <linux/namei.h>
58c5fc13
MT		 50124 #include "internal.h"
50125
50126+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
50127+
50128 static const struct dentry_operations proc_sys_dentry_operations;
50129 static const struct file_operations proc_sys_file_operations;
50130 static const struct inode_operations proc_sys_inode_operations;
66a7e928 50131@@ -111,6 +113,9 @@ static struct dentry *proc_sys_lookup(st
58c5fc13
MT		 50132 if (!p)
50133 goto out;
50134
50135+ if (gr_handle_sysctl(p, MAY_EXEC))
50136+ goto out;
50137+
50138 err = ERR_PTR(-ENOMEM);
50139 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
50140 if (h)
66a7e928 50141@@ -230,6 +235,9 @@ static int scan(struct ctl_table_header
58c5fc13
MT		 50142 if (*pos < file->f_pos)
50143 continue;
50144
50145+ if (gr_handle_sysctl(table, 0))
50146+ continue;
50147+
50148 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
50149 if (res)
50150 return res;
66a7e928 50151@@ -358,6 +366,9 @@ static int proc_sys_getattr(struct vfsmo
58c5fc13
MT		 50152 if (IS_ERR(head))
50153 return PTR_ERR(head);
50154
50155+ if (table && gr_handle_sysctl(table, MAY_EXEC))
50156+ return -ENOENT;
50157+
50158 generic_fillattr(inode, stat);
50159 if (table)
50160 stat->mode = (stat->mode & S_IFMT) | table->mode;
66a7e928
MT		 50161diff -urNp linux-2.6.39/fs/proc/root.c linux-2.6.39/fs/proc/root.c
50162--- linux-2.6.39/fs/proc/root.c 2011-05-19 00:06:34.000000000 -0400
50163+++ linux-2.6.39/fs/proc/root.c 2011-05-22 19:41:37.000000000 -0400
50164@@ -122,7 +122,15 @@ void __init proc_root_init(void)
58c5fc13
MT		 50165 #ifdef CONFIG_PROC_DEVICETREE
50166 proc_device_tree_init();
50167 #endif
50168+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50169+#ifdef CONFIG_GRKERNSEC_PROC_USER
50170+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
50171+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50172+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
50173+#endif
50174+#else
50175 proc_mkdir("bus", NULL);
50176+#endif
50177 proc_sys_init();
50178 }
50179
66a7e928
MT		 50180diff -urNp linux-2.6.39/fs/proc/task_mmu.c linux-2.6.39/fs/proc/task_mmu.c
50181--- linux-2.6.39/fs/proc/task_mmu.c 2011-05-19 00:06:34.000000000 -0400
50182+++ linux-2.6.39/fs/proc/task_mmu.c 2011-05-22 22:43:29.000000000 -0400
50183@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
58c5fc13
MT		 50184 "VmExe:\t%8lu kB\n"
50185 "VmLib:\t%8lu kB\n"
df50ba0c
MT		 50186 "VmPTE:\t%8lu kB\n"
50187- "VmSwap:\t%8lu kB\n",
58c5fc13 50188- hiwater_vm << (PAGE_SHIFT-10),
df50ba0c 50189+ "VmSwap:\t%8lu kB\n"
58c5fc13
MT		 50190+
50191+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50192+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
50193+#endif
50194+
50195+ ,hiwater_vm << (PAGE_SHIFT-10),
50196 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
50197 mm->locked_vm << (PAGE_SHIFT-10),
50198 hiwater_rss << (PAGE_SHIFT-10),
66a7e928 50199@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
58c5fc13
MT		 50200 data << (PAGE_SHIFT-10),
50201 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
df50ba0c
MT		 50202 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
50203- swap << (PAGE_SHIFT-10));
50204+ swap << (PAGE_SHIFT-10)
58c5fc13
MT		 50205+
50206+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50207+ , mm->context.user_cs_base, mm->context.user_cs_limit
50208+#endif
50209+
50210+ );
50211 }
50212
50213 unsigned long task_vsize(struct mm_struct *mm)
66a7e928 50214@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
58c5fc13
MT		 50215 return ret;
50216 }
50217
50218+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50219+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50220+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
50221+ _mm->pax_flags & MF_PAX_SEGMEXEC))
50222+#endif
50223+
50224 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
50225 {
50226 struct mm_struct *mm = vma->vm_mm;
66a7e928 50227@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
57199397 50228 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
58c5fc13
MT		 50229 }
50230
57199397 50231- /* We don't show the stack guard page in /proc/maps */
58c5fc13 50232+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66a7e928
MT		 50233+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
50234+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
58c5fc13 50235+#else
66a7e928
MT		 50236 start = vma->vm_start;
50237- if (stack_guard_page_start(vma, start))
50238- start += PAGE_SIZE;
50239 end = vma->vm_end;
50240- if (stack_guard_page_end(vma, end))
50241- end -= PAGE_SIZE;
58c5fc13 50242+#endif
66a7e928
MT		 50243
50244 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
50245 start,
50246@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
58c5fc13
MT		 50247 flags & VM_WRITE ? 'w' : '-',
50248 flags & VM_EXEC ? 'x' : '-',
50249 flags & VM_MAYSHARE ? 's' : 'p',
50250+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50251+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
50252+#else
50253 pgoff,
50254+#endif
50255 MAJOR(dev), MINOR(dev), ino, &len);
50256
50257 /*
66a7e928 50258@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
58c5fc13
MT		 50259 */
50260 if (file) {
50261 pad_len_spaces(m, len);
50262- seq_path(m, &file->f_path, "\n");
50263+ seq_path(m, &file->f_path, "\n\\");
50264 } else {
50265 const char *name = arch_vma_name(vma);
50266 if (!name) {
66a7e928
MT		 50267@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
50268 if (vma->vm_start <= mm->brk &&
50269 vma->vm_end >= mm->start_brk) {
58c5fc13
MT		 50270 name = "[heap]";
50271- } else if (vma->vm_start <= mm->start_stack &&
50272- vma->vm_end >= mm->start_stack) {
50273+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
50274+ (vma->vm_start <= mm->start_stack &&
50275+ vma->vm_end >= mm->start_stack)) {
50276 name = "[stack]";
df50ba0c
MT		 50277 }
50278 } else {
66a7e928 50279@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
58c5fc13
MT		 50280 };
50281
50282 memset(&mss, 0, sizeof mss);
50283- mss.vma = vma;
df50ba0c 50284- /* mmap_sem is held in m_start */
58c5fc13
MT		 50285- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50286- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
df50ba0c 50287-
58c5fc13
MT		 50288+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50289+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
50290+#endif
50291+ mss.vma = vma;
df50ba0c 50292+ /* mmap_sem is held in m_start */
58c5fc13
MT		 50293+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50294+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50295+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50296+ }
50297+#endif
58c5fc13
MT		 50298 show_map_vma(m, vma);
50299
df50ba0c 50300 seq_printf(m,
66a7e928 50301@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
58c5fc13 50302 "KernelPageSize: %8lu kB\n"
16454cff
MT		 50303 "MMUPageSize: %8lu kB\n"
50304 "Locked: %8lu kB\n",
58c5fc13
MT		 50305+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50306+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
50307+#else
50308 (vma->vm_end - vma->vm_start) >> 10,
50309+#endif
50310 mss.resident >> 10,
50311 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
50312 mss.shared_clean >> 10,
66a7e928
MT		 50313diff -urNp linux-2.6.39/fs/proc/task_nommu.c linux-2.6.39/fs/proc/task_nommu.c
50314--- linux-2.6.39/fs/proc/task_nommu.c 2011-05-19 00:06:34.000000000 -0400
50315+++ linux-2.6.39/fs/proc/task_nommu.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 50316@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
58c5fc13
MT		 50317 else
50318 bytes += kobjsize(mm);
50319
50320- if (current->fs && current->fs->users > 1)
50321+ if (current->fs && atomic_read(&current->fs->users) > 1)
50322 sbytes += kobjsize(current->fs);
50323 else
50324 bytes += kobjsize(current->fs);
16454cff 50325@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
57199397
MT		 50326
50327 if (file) {
50328 pad_len_spaces(m, len);
58c5fc13
MT		 50329- seq_path(m, &file->f_path, "");
50330+ seq_path(m, &file->f_path, "\n\\");
57199397
MT		 50331 } else if (mm) {
50332 if (vma->vm_start <= mm->start_stack &&
50333 vma->vm_end >= mm->start_stack) {
66a7e928
MT		 50334diff -urNp linux-2.6.39/fs/quota/netlink.c linux-2.6.39/fs/quota/netlink.c
50335--- linux-2.6.39/fs/quota/netlink.c 2011-05-19 00:06:34.000000000 -0400
50336+++ linux-2.6.39/fs/quota/netlink.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 50337@@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
50338 void quota_send_warning(short type, unsigned int id, dev_t dev,
50339 const char warntype)
50340 {
50341- static atomic_t seq;
50342+ static atomic_unchecked_t seq;
50343 struct sk_buff *skb;
50344 void *msg_head;
50345 int ret;
50346@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
50347 "VFS: Not enough memory to send quota warning.\n");
50348 return;
50349 }
50350- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
50351+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
50352 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
50353 if (!msg_head) {
50354 printk(KERN_ERR
66a7e928
MT		 50355diff -urNp linux-2.6.39/fs/readdir.c linux-2.6.39/fs/readdir.c
50356--- linux-2.6.39/fs/readdir.c 2011-05-19 00:06:34.000000000 -0400
50357+++ linux-2.6.39/fs/readdir.c 2011-05-22 19:41:42.000000000 -0400
6892158b 50358@@ -17,6 +17,7 @@
58c5fc13
MT		 50359 #include <linux/security.h>
50360 #include <linux/syscalls.h>
50361 #include <linux/unistd.h>
50362+#include <linux/namei.h>
50363
50364 #include <asm/uaccess.h>
50365
50366@@ -67,6 +68,7 @@ struct old_linux_dirent {
50367
50368 struct readdir_callback {
50369 struct old_linux_dirent __user * dirent;
50370+ struct file * file;
50371 int result;
50372 };
50373
50374@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
50375 buf->result = -EOVERFLOW;
50376 return -EOVERFLOW;
50377 }
50378+
50379+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50380+ return 0;
50381+
50382 buf->result++;
50383 dirent = buf->dirent;
50384 if (!access_ok(VERIFY_WRITE, dirent,
50385@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
50386
50387 buf.result = 0;
50388 buf.dirent = dirent;
50389+ buf.file = file;
50390
50391 error = vfs_readdir(file, fillonedir, &buf);
50392 if (buf.result)
50393@@ -142,6 +149,7 @@ struct linux_dirent {
50394 struct getdents_callback {
50395 struct linux_dirent __user * current_dir;
50396 struct linux_dirent __user * previous;
50397+ struct file * file;
50398 int count;
50399 int error;
50400 };
6892158b 50401@@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
58c5fc13
MT		 50402 buf->error = -EOVERFLOW;
50403 return -EOVERFLOW;
50404 }
50405+
50406+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50407+ return 0;
50408+
50409 dirent = buf->previous;
50410 if (dirent) {
50411 if (__put_user(offset, &dirent->d_off))
6892158b 50412@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
58c5fc13
MT		 50413 buf.previous = NULL;
50414 buf.count = count;
50415 buf.error = 0;
50416+ buf.file = file;
50417
50418 error = vfs_readdir(file, filldir, &buf);
50419 if (error >= 0)
6892158b 50420@@ -229,6 +242,7 @@ out:
58c5fc13
MT		 50421 struct getdents_callback64 {
50422 struct linux_dirent64 __user * current_dir;
50423 struct linux_dirent64 __user * previous;
50424+ struct file *file;
50425 int count;
50426 int error;
50427 };
6892158b 50428@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
58c5fc13
MT		 50429 buf->error = -EINVAL; /* only used if we fail.. */
50430 if (reclen > buf->count)
50431 return -EINVAL;
50432+
50433+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50434+ return 0;
50435+
50436 dirent = buf->previous;
50437 if (dirent) {
50438 if (__put_user(offset, &dirent->d_off))
6892158b 50439@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
58c5fc13
MT		 50440
50441 buf.current_dir = dirent;
50442 buf.previous = NULL;
50443+ buf.file = file;
50444 buf.count = count;
50445 buf.error = 0;
50446
66a7e928
MT		 50447diff -urNp linux-2.6.39/fs/reiserfs/dir.c linux-2.6.39/fs/reiserfs/dir.c
50448--- linux-2.6.39/fs/reiserfs/dir.c 2011-05-19 00:06:34.000000000 -0400
50449+++ linux-2.6.39/fs/reiserfs/dir.c 2011-05-22 19:36:32.000000000 -0400
50450@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
50451 struct reiserfs_dir_entry de;
50452 int ret = 0;
50453
50454+ pax_track_stack();
50455+
50456 reiserfs_write_lock(inode->i_sb);
50457
50458 reiserfs_check_lock_depth(inode->i_sb, "readdir");
50459diff -urNp linux-2.6.39/fs/reiserfs/do_balan.c linux-2.6.39/fs/reiserfs/do_balan.c
50460--- linux-2.6.39/fs/reiserfs/do_balan.c 2011-05-19 00:06:34.000000000 -0400
50461+++ linux-2.6.39/fs/reiserfs/do_balan.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f 50462@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
58c5fc13
MT		 50463 return;
50464 }
50465
50466- atomic_inc(&(fs_generation(tb->tb_sb)));
50467+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
50468 do_balance_starts(tb);
50469
50470 /* balance leaf returns 0 except if combining L R and S into
66a7e928
MT		 50471diff -urNp linux-2.6.39/fs/reiserfs/item_ops.c linux-2.6.39/fs/reiserfs/item_ops.c
50472--- linux-2.6.39/fs/reiserfs/item_ops.c 2011-05-19 00:06:34.000000000 -0400
50473+++ linux-2.6.39/fs/reiserfs/item_ops.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 50474@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
50475 vi->vi_index, vi->vi_type, vi->vi_ih);
50476 }
50477
50478-static struct item_operations stat_data_ops = {
50479+static const struct item_operations stat_data_ops = {
50480 .bytes_number = sd_bytes_number,
50481 .decrement_key = sd_decrement_key,
50482 .is_left_mergeable = sd_is_left_mergeable,
50483@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
50484 vi->vi_index, vi->vi_type, vi->vi_ih);
50485 }
50486
50487-static struct item_operations direct_ops = {
50488+static const struct item_operations direct_ops = {
50489 .bytes_number = direct_bytes_number,
50490 .decrement_key = direct_decrement_key,
50491 .is_left_mergeable = direct_is_left_mergeable,
50492@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
50493 vi->vi_index, vi->vi_type, vi->vi_ih);
50494 }
50495
50496-static struct item_operations indirect_ops = {
50497+static const struct item_operations indirect_ops = {
50498 .bytes_number = indirect_bytes_number,
50499 .decrement_key = indirect_decrement_key,
50500 .is_left_mergeable = indirect_is_left_mergeable,
50501@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
50502 printk("\n");
50503 }
50504
50505-static struct item_operations direntry_ops = {
50506+static const struct item_operations direntry_ops = {
50507 .bytes_number = direntry_bytes_number,
50508 .decrement_key = direntry_decrement_key,
50509 .is_left_mergeable = direntry_is_left_mergeable,
50510@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
50511 "Invalid item type observed, run fsck ASAP");
50512 }
50513
50514-static struct item_operations errcatch_ops = {
50515+static const struct item_operations errcatch_ops = {
50516 errcatch_bytes_number,
50517 errcatch_decrement_key,
50518 errcatch_is_left_mergeable,
50519@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
50520 #error Item types must use disk-format assigned values.
50521 #endif
50522
50523-struct item_operations *item_ops[TYPE_ANY + 1] = {
50524+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
50525 &stat_data_ops,
50526 &indirect_ops,
50527 &direct_ops,
66a7e928
MT		 50528diff -urNp linux-2.6.39/fs/reiserfs/journal.c linux-2.6.39/fs/reiserfs/journal.c
50529--- linux-2.6.39/fs/reiserfs/journal.c 2011-05-19 00:06:34.000000000 -0400
50530+++ linux-2.6.39/fs/reiserfs/journal.c 2011-05-22 19:36:32.000000000 -0400
50531@@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
50532 struct buffer_head *bh;
50533 int i, j;
50534
50535+ pax_track_stack();
50536+
50537 bh = __getblk(dev, block, bufsize);
50538 if (buffer_uptodate(bh))
50539 return (bh);
50540diff -urNp linux-2.6.39/fs/reiserfs/namei.c linux-2.6.39/fs/reiserfs/namei.c
50541--- linux-2.6.39/fs/reiserfs/namei.c 2011-05-19 00:06:34.000000000 -0400
50542+++ linux-2.6.39/fs/reiserfs/namei.c 2011-05-22 19:36:32.000000000 -0400
50543@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
50544 unsigned long savelink = 1;
50545 struct timespec ctime;
50546
50547+ pax_track_stack();
50548+
50549 /* three balancings: (1) old name removal, (2) new name insertion
50550 and (3) maybe "save" link insertion
50551 stat data updates: (1) old directory,
50552diff -urNp linux-2.6.39/fs/reiserfs/procfs.c linux-2.6.39/fs/reiserfs/procfs.c
50553--- linux-2.6.39/fs/reiserfs/procfs.c 2011-05-19 00:06:34.000000000 -0400
50554+++ linux-2.6.39/fs/reiserfs/procfs.c 2011-05-22 19:36:32.000000000 -0400
ae4e228f 50555@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
58c5fc13
MT		 50556 "SMALL_TAILS " : "NO_TAILS ",
50557 replay_only(sb) ? "REPLAY_ONLY " : "",
50558 convert_reiserfs(sb) ? "CONV " : "",
50559- atomic_read(&r->s_generation_counter),
50560+ atomic_read_unchecked(&r->s_generation_counter),
50561 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
50562 SF(s_do_balance), SF(s_unneeded_left_neighbor),
50563 SF(s_good_search_by_key_reada), SF(s_bmaps),
66a7e928
MT		 50564@@ -299,6 +299,8 @@ static int show_journal(struct seq_file
50565 struct journal_params *jp = &rs->s_v1.s_journal;
50566 char b[BDEVNAME_SIZE];
50567
50568+ pax_track_stack();
50569+
50570 seq_printf(m, /* on-disk fields */
50571 "jp_journal_1st_block: \t%i\n"
50572 "jp_journal_dev: \t%s[%x]\n"
50573diff -urNp linux-2.6.39/fs/reiserfs/stree.c linux-2.6.39/fs/reiserfs/stree.c
50574--- linux-2.6.39/fs/reiserfs/stree.c 2011-05-19 00:06:34.000000000 -0400
50575+++ linux-2.6.39/fs/reiserfs/stree.c 2011-05-22 19:36:32.000000000 -0400
50576@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
50577 int iter = 0;
50578 #endif
50579
50580+ pax_track_stack();
50581+
50582 BUG_ON(!th->t_trans_id);
50583
50584 init_tb_struct(th, &s_del_balance, sb, path,
50585@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
50586 int retval;
50587 int quota_cut_bytes = 0;
50588
50589+ pax_track_stack();
50590+
50591 BUG_ON(!th->t_trans_id);
50592
50593 le_key2cpu_key(&cpu_key, key);
50594@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
50595 int quota_cut_bytes;
50596 loff_t tail_pos = 0;
50597
50598+ pax_track_stack();
50599+
50600 BUG_ON(!th->t_trans_id);
50601
50602 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
50603@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
50604 int retval;
50605 int fs_gen;
50606
50607+ pax_track_stack();
50608+
50609 BUG_ON(!th->t_trans_id);
50610
50611 fs_gen = get_generation(inode->i_sb);
50612@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
50613 int fs_gen = 0;
50614 int quota_bytes = 0;
50615
50616+ pax_track_stack();
50617+
50618 BUG_ON(!th->t_trans_id);
50619
50620 if (inode) { /* Do we count quotas for item? */
50621diff -urNp linux-2.6.39/fs/reiserfs/super.c linux-2.6.39/fs/reiserfs/super.c
50622--- linux-2.6.39/fs/reiserfs/super.c 2011-05-19 00:06:34.000000000 -0400
50623+++ linux-2.6.39/fs/reiserfs/super.c 2011-05-22 19:36:32.000000000 -0400
50624@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
50625 {.option_name = NULL}
50626 };
50627
50628+ pax_track_stack();
50629+
50630 *blocks = 0;
50631 if (!options || !*options)
50632 /* use default configuration: create tails, journaling on, no
50633diff -urNp linux-2.6.39/fs/select.c linux-2.6.39/fs/select.c
50634--- linux-2.6.39/fs/select.c 2011-05-19 00:06:34.000000000 -0400
50635+++ linux-2.6.39/fs/select.c 2011-05-22 19:41:42.000000000 -0400
ae4e228f 50636@@ -20,6 +20,7 @@
58c5fc13
MT		 50637 #include <linux/module.h>
50638 #include <linux/slab.h>
50639 #include <linux/poll.h>
50640+#include <linux/security.h>
50641 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
50642 #include <linux/file.h>
50643 #include <linux/fdtable.h>
66a7e928
MT		 50644@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
50645 int retval, i, timed_out = 0;
50646 unsigned long slack = 0;
50647
50648+ pax_track_stack();
50649+
50650 rcu_read_lock();
50651 retval = max_select_fd(n, fds);
50652 rcu_read_unlock();
50653@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
50654 /* Allocate small arguments on the stack to save memory and be faster */
50655 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
50656
50657+ pax_track_stack();
50658+
50659 ret = -EINVAL;
50660 if (n < 0)
50661 goto out_nofds;
50662@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
58c5fc13
MT		 50663 struct poll_list *walk = head;
50664 unsigned long todo = nfds;
50665
66a7e928
MT		 50666+ pax_track_stack();
50667+
58c5fc13 50668+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
df50ba0c 50669 if (nfds > rlimit(RLIMIT_NOFILE))
58c5fc13
MT		 50670 return -EINVAL;
50671
66a7e928
MT		 50672diff -urNp linux-2.6.39/fs/seq_file.c linux-2.6.39/fs/seq_file.c
50673--- linux-2.6.39/fs/seq_file.c 2011-05-19 00:06:34.000000000 -0400
50674+++ linux-2.6.39/fs/seq_file.c 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 50675@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
50676 return 0;
50677 }
50678 if (!m->buf) {
50679- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50680+ m->size = PAGE_SIZE;
ae4e228f 50681+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
58c5fc13
MT		 50682 if (!m->buf)
50683 return -ENOMEM;
50684 }
50685@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
50686 Eoverflow:
50687 m->op->stop(m, p);
50688 kfree(m->buf);
50689- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50690+ m->size <<= 1;
50691+ m->buf = kmalloc(m->size, GFP_KERNEL);
50692 return !m->buf ? -ENOMEM : -EAGAIN;
50693 }
50694
50695@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
50696 m->version = file->f_version;
50697 /* grab buffer if we didn't have one */
50698 if (!m->buf) {
50699- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50700+ m->size = PAGE_SIZE;
ae4e228f 50701+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
58c5fc13
MT		 50702 if (!m->buf)
50703 goto Enomem;
50704 }
50705@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
50706 goto Fill;
50707 m->op->stop(m, p);
50708 kfree(m->buf);
50709- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50710+ m->size <<= 1;
50711+ m->buf = kmalloc(m->size, GFP_KERNEL);
50712 if (!m->buf)
50713 goto Enomem;
50714 m->count = 0;
66a7e928
MT		 50715diff -urNp linux-2.6.39/fs/splice.c linux-2.6.39/fs/splice.c
50716--- linux-2.6.39/fs/splice.c 2011-05-19 00:06:34.000000000 -0400
50717+++ linux-2.6.39/fs/splice.c 2011-05-22 19:36:32.000000000 -0400
df50ba0c 50718@@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode
ae4e228f
MT		 50719 pipe_lock(pipe);
50720
50721 for (;;) {
50722- if (!pipe->readers) {
50723+ if (!atomic_read(&pipe->readers)) {
50724 send_sig(SIGPIPE, current, 0);
50725 if (!ret)
50726 ret = -EPIPE;
df50ba0c 50727@@ -240,9 +240,9 @@ ssize_t splice_to_pipe(struct pipe_inode
ae4e228f
MT		 50728 do_wakeup = 0;
50729 }
50730
50731- pipe->waiting_writers++;
50732+ atomic_inc(&pipe->waiting_writers);
50733 pipe_wait(pipe);
50734- pipe->waiting_writers--;
50735+ atomic_dec(&pipe->waiting_writers);
50736 }
50737
50738 pipe_unlock(pipe);
66a7e928
MT		 50739@@ -316,6 +316,8 @@ __generic_file_splice_read(struct file *
50740 .spd_release = spd_release_page,
50741 };
50742
50743+ pax_track_stack();
50744+
50745 if (splice_grow_spd(pipe, &spd))
50746 return -ENOMEM;
50747
50748@@ -556,7 +558,7 @@ static ssize_t kernel_readv(struct file
ae4e228f
MT		 50749 old_fs = get_fs();
50750 set_fs(get_ds());
50751 /* The cast to a user pointer is valid due to the set_fs() */
50752- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
50753+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
50754 set_fs(old_fs);
50755
50756 return res;
66a7e928 50757@@ -571,7 +573,7 @@ static ssize_t kernel_write(struct file
ae4e228f
MT		 50758 old_fs = get_fs();
50759 set_fs(get_ds());
50760 /* The cast to a user pointer is valid due to the set_fs() */
50761- res = vfs_write(file, (const char __user *)buf, count, &pos);
50762+ res = vfs_write(file, (__force const char __user *)buf, count, &pos);
50763 set_fs(old_fs);
50764
50765 return res;
66a7e928
MT		 50766@@ -599,6 +601,8 @@ ssize_t default_file_splice_read(struct
50767 .spd_release = spd_release_page,
50768 };
50769
50770+ pax_track_stack();
50771+
50772 if (splice_grow_spd(pipe, &spd))
50773 return -ENOMEM;
50774
50775@@ -622,7 +626,7 @@ ssize_t default_file_splice_read(struct
ae4e228f
MT		 50776 goto err;
50777
50778 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
50779- vec[i].iov_base = (void __user *) page_address(page);
50780+ vec[i].iov_base = (__force void __user *) page_address(page);
50781 vec[i].iov_len = this_len;
57199397 50782 spd.pages[i] = page;
ae4e228f 50783 spd.nr_pages++;
66a7e928 50784@@ -842,10 +846,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
ae4e228f
MT		 50785 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
50786 {
50787 while (!pipe->nrbufs) {
50788- if (!pipe->writers)
50789+ if (!atomic_read(&pipe->writers))
50790 return 0;
50791
50792- if (!pipe->waiting_writers && sd->num_spliced)
50793+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
50794 return 0;
50795
50796 if (sd->flags & SPLICE_F_NONBLOCK)
66a7e928 50797@@ -1178,7 +1182,7 @@ ssize_t splice_direct_to_actor(struct fi
ae4e228f
MT		 50798 * out of the pipe right after the splice_to_pipe(). So set
50799 * PIPE_READERS appropriately.
50800 */
50801- pipe->readers = 1;
50802+ atomic_set(&pipe->readers, 1);
50803
50804 current->splice_pipe = pipe;
50805 }
66a7e928
MT		 50806@@ -1615,6 +1619,8 @@ static long vmsplice_to_pipe(struct file
50807 };
50808 long ret;
50809
50810+ pax_track_stack();
50811+
50812 pipe = get_pipe_info(file);
50813 if (!pipe)
50814 return -EBADF;
50815@@ -1730,9 +1736,9 @@ static int ipipe_prep(struct pipe_inode_
ae4e228f
MT		 50816 ret = -ERESTARTSYS;
50817 break;
50818 }
50819- if (!pipe->writers)
50820+ if (!atomic_read(&pipe->writers))
50821 break;
50822- if (!pipe->waiting_writers) {
50823+ if (!atomic_read(&pipe->waiting_writers)) {
50824 if (flags & SPLICE_F_NONBLOCK) {
50825 ret = -EAGAIN;
50826 break;
66a7e928 50827@@ -1764,7 +1770,7 @@ static int opipe_prep(struct pipe_inode_
ae4e228f
MT		 50828 pipe_lock(pipe);
50829
57199397 50830 while (pipe->nrbufs >= pipe->buffers) {
ae4e228f
MT		 50831- if (!pipe->readers) {
50832+ if (!atomic_read(&pipe->readers)) {
50833 send_sig(SIGPIPE, current, 0);
50834 ret = -EPIPE;
50835 break;
66a7e928 50836@@ -1777,9 +1783,9 @@ static int opipe_prep(struct pipe_inode_
ae4e228f
MT		 50837 ret = -ERESTARTSYS;
50838 break;
50839 }
50840- pipe->waiting_writers++;
50841+ atomic_inc(&pipe->waiting_writers);
50842 pipe_wait(pipe);
50843- pipe->waiting_writers--;
50844+ atomic_dec(&pipe->waiting_writers);
50845 }
58c5fc13 50846
ae4e228f 50847 pipe_unlock(pipe);
66a7e928 50848@@ -1815,14 +1821,14 @@ retry:
ae4e228f
MT		 50849 pipe_double_lock(ipipe, opipe);
50850
50851 do {
50852- if (!opipe->readers) {
50853+ if (!atomic_read(&opipe->readers)) {
50854 send_sig(SIGPIPE, current, 0);
50855 if (!ret)
50856 ret = -EPIPE;
50857 break;
50858 }
50859
50860- if (!ipipe->nrbufs && !ipipe->writers)
50861+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
50862 break;
50863
50864 /*
66a7e928 50865@@ -1922,7 +1928,7 @@ static int link_pipe(struct pipe_inode_i
ae4e228f
MT		 50866 pipe_double_lock(ipipe, opipe);
50867
50868 do {
50869- if (!opipe->readers) {
50870+ if (!atomic_read(&opipe->readers)) {
50871 send_sig(SIGPIPE, current, 0);
50872 if (!ret)
50873 ret = -EPIPE;
66a7e928 50874@@ -1967,7 +1973,7 @@ static int link_pipe(struct pipe_inode_i
ae4e228f
MT		 50875 * return EAGAIN if we have the potential of some data in the
50876 * future, otherwise just return 0
50877 */
50878- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
50879+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
50880 ret = -EAGAIN;
50881
50882 pipe_unlock(ipipe);
66a7e928
MT		 50883diff -urNp linux-2.6.39/fs/sysfs/file.c linux-2.6.39/fs/sysfs/file.c
50884--- linux-2.6.39/fs/sysfs/file.c 2011-05-19 00:06:34.000000000 -0400
50885+++ linux-2.6.39/fs/sysfs/file.c 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 50886@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
50887
50888 struct sysfs_open_dirent {
50889 atomic_t refcnt;
50890- atomic_t event;
50891+ atomic_unchecked_t event;
50892 wait_queue_head_t poll;
50893 struct list_head buffers; /* goes through sysfs_buffer.list */
50894 };
50895@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
50896 if (!sysfs_get_active(attr_sd))
50897 return -ENODEV;
50898
50899- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
50900+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
50901 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
50902
50903 sysfs_put_active(attr_sd);
50904@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
50905 return -ENOMEM;
50906
50907 atomic_set(&new_od->refcnt, 0);
50908- atomic_set(&new_od->event, 1);
50909+ atomic_set_unchecked(&new_od->event, 1);
50910 init_waitqueue_head(&new_od->poll);
50911 INIT_LIST_HEAD(&new_od->buffers);
50912 goto retry;
50913@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
50914
50915 sysfs_put_active(attr_sd);
50916
50917- if (buffer->event != atomic_read(&od->event))
50918+ if (buffer->event != atomic_read_unchecked(&od->event))
50919 goto trigger;
50920
50921 return DEFAULT_POLLMASK;
50922@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
50923
50924 od = sd->s_attr.open;
50925 if (od) {
50926- atomic_inc(&od->event);
50927+ atomic_inc_unchecked(&od->event);
50928 wake_up_interruptible(&od->poll);
50929 }
50930
66a7e928
MT		 50931diff -urNp linux-2.6.39/fs/sysfs/mount.c linux-2.6.39/fs/sysfs/mount.c
50932--- linux-2.6.39/fs/sysfs/mount.c 2011-05-19 00:06:34.000000000 -0400
50933+++ linux-2.6.39/fs/sysfs/mount.c 2011-05-22 19:41:42.000000000 -0400
16454cff
MT		 50934@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
50935 .s_name = "",
50936 .s_count = ATOMIC_INIT(1),
50937 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
50938+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
50939+ .s_mode = S_IFDIR | S_IRWXU,
50940+#else
50941 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
50942+#endif
50943 .s_ino = 1,
50944 };
50945
66a7e928
MT		 50946diff -urNp linux-2.6.39/fs/sysfs/symlink.c linux-2.6.39/fs/sysfs/symlink.c
50947--- linux-2.6.39/fs/sysfs/symlink.c 2011-05-19 00:06:34.000000000 -0400
50948+++ linux-2.6.39/fs/sysfs/symlink.c 2011-05-22 19:36:32.000000000 -0400
57199397 50949@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
58c5fc13
MT		 50950
50951 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
50952 {
50953- char *page = nd_get_link(nd);
50954+ const char *page = nd_get_link(nd);
50955 if (!IS_ERR(page))
50956 free_page((unsigned long)page);
50957 }
66a7e928
MT		 50958diff -urNp linux-2.6.39/fs/udf/inode.c linux-2.6.39/fs/udf/inode.c
50959--- linux-2.6.39/fs/udf/inode.c 2011-05-19 00:06:34.000000000 -0400
50960+++ linux-2.6.39/fs/udf/inode.c 2011-05-22 19:36:32.000000000 -0400
50961@@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
50962 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
50963 int lastblock = 0;
50964
50965+ pax_track_stack();
50966+
50967 prev_epos.offset = udf_file_entry_alloc_offset(inode);
50968 prev_epos.block = iinfo->i_location;
50969 prev_epos.bh = NULL;
50970diff -urNp linux-2.6.39/fs/udf/misc.c linux-2.6.39/fs/udf/misc.c
50971--- linux-2.6.39/fs/udf/misc.c 2011-05-19 00:06:34.000000000 -0400
50972+++ linux-2.6.39/fs/udf/misc.c 2011-05-22 19:36:32.000000000 -0400
bc901d79
MT		 50973@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
50974
50975 u8 udf_tag_checksum(const struct tag *t)
50976 {
50977- u8 *data = (u8 *)t;
50978+ const u8 *data = (const u8 *)t;
50979 u8 checksum = 0;
50980 int i;
50981 for (i = 0; i < sizeof(struct tag); ++i)
66a7e928
MT		 50982diff -urNp linux-2.6.39/fs/utimes.c linux-2.6.39/fs/utimes.c
50983--- linux-2.6.39/fs/utimes.c 2011-05-19 00:06:34.000000000 -0400
50984+++ linux-2.6.39/fs/utimes.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 50985@@ -1,6 +1,7 @@
50986 #include <linux/compiler.h>
50987 #include <linux/file.h>
50988 #include <linux/fs.h>
50989+#include <linux/security.h>
50990 #include <linux/linkage.h>
50991 #include <linux/mount.h>
50992 #include <linux/namei.h>
50993@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
50994 goto mnt_drop_write_and_out;
50995 }
50996 }
50997+
50998+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
50999+ error = -EACCES;
51000+ goto mnt_drop_write_and_out;
51001+ }
51002+
51003 mutex_lock(&inode->i_mutex);
51004 error = notify_change(path->dentry, &newattrs);
51005 mutex_unlock(&inode->i_mutex);
66a7e928
MT		 51006diff -urNp linux-2.6.39/fs/xattr_acl.c linux-2.6.39/fs/xattr_acl.c
51007--- linux-2.6.39/fs/xattr_acl.c 2011-05-19 00:06:34.000000000 -0400
51008+++ linux-2.6.39/fs/xattr_acl.c 2011-05-22 19:36:32.000000000 -0400
bc901d79
MT		 51009@@ -17,8 +17,8 @@
51010 struct posix_acl *
51011 posix_acl_from_xattr(const void *value, size_t size)
51012 {
51013- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
51014- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
51015+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
51016+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
51017 int count;
51018 struct posix_acl *acl;
51019 struct posix_acl_entry *acl_e;
66a7e928
MT		 51020diff -urNp linux-2.6.39/fs/xattr.c linux-2.6.39/fs/xattr.c
51021--- linux-2.6.39/fs/xattr.c 2011-05-19 00:06:34.000000000 -0400
51022+++ linux-2.6.39/fs/xattr.c 2011-05-22 19:41:42.000000000 -0400
bc901d79
MT		 51023@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
51024 * Extended attribute SET operations
51025 */
51026 static long
51027-setxattr(struct dentry *d, const char __user *name, const void __user *value,
51028+setxattr(struct path *path, const char __user *name, const void __user *value,
51029 size_t size, int flags)
51030 {
51031 int error;
51032@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
51033 return PTR_ERR(kvalue);
51034 }
51035
51036- error = vfs_setxattr(d, kname, kvalue, size, flags);
51037+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
51038+ error = -EACCES;
51039+ goto out;
51040+ }
51041+
51042+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
51043+out:
51044 kfree(kvalue);
51045 return error;
51046 }
51047@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
51048 return error;
51049 error = mnt_want_write(path.mnt);
51050 if (!error) {
51051- error = setxattr(path.dentry, name, value, size, flags);
51052+ error = setxattr(&path, name, value, size, flags);
51053 mnt_drop_write(path.mnt);
51054 }
51055 path_put(&path);
51056@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
51057 return error;
51058 error = mnt_want_write(path.mnt);
51059 if (!error) {
51060- error = setxattr(path.dentry, name, value, size, flags);
51061+ error = setxattr(&path, name, value, size, flags);
51062 mnt_drop_write(path.mnt);
51063 }
51064 path_put(&path);
51065@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
51066 const void __user *,value, size_t, size, int, flags)
51067 {
51068 struct file *f;
51069- struct dentry *dentry;
51070 int error = -EBADF;
51071
51072 f = fget(fd);
51073 if (!f)
51074 return error;
51075- dentry = f->f_path.dentry;
51076- audit_inode(NULL, dentry);
51077+ audit_inode(NULL, f->f_path.dentry);
51078 error = mnt_want_write_file(f);
51079 if (!error) {
51080- error = setxattr(dentry, name, value, size, flags);
51081+ error = setxattr(&f->f_path, name, value, size, flags);
51082 mnt_drop_write(f->f_path.mnt);
51083 }
51084 fput(f);
66a7e928
MT		 51085diff -urNp linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c
51086--- linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-19 00:06:34.000000000 -0400
51087+++ linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-22 19:41:42.000000000 -0400
16454cff
MT		 51088@@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
51089 xfs_fsop_geom_t fsgeo;
51090 int error;
51091
51092+ memset(&fsgeo, 0, sizeof(fsgeo));
51093 error = xfs_fs_geometry(mp, &fsgeo, 3);
51094 if (error)
51095 return -error;
66a7e928
MT		 51096diff -urNp linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c
51097--- linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-19 00:06:34.000000000 -0400
51098+++ linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-22 19:36:32.000000000 -0400
16454cff 51099@@ -128,7 +128,7 @@ xfs_find_handle(
ae4e228f 51100 }
58c5fc13 51101
ae4e228f
MT		 51102 error = -EFAULT;
51103- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
bc901d79 51104+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
ae4e228f
MT		 51105 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
51106 goto out_put;
58c5fc13 51107
66a7e928
MT		 51108diff -urNp linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c
51109--- linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c 2011-05-19 00:06:34.000000000 -0400
51110+++ linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c 2011-05-22 19:36:32.000000000 -0400
51111@@ -437,7 +437,7 @@ xfs_vn_put_link(
58c5fc13
MT		 51112 struct nameidata *nd,
51113 void *p)
51114 {
51115- char *s = nd_get_link(nd);
51116+ const char *s = nd_get_link(nd);
51117
51118 if (!IS_ERR(s))
51119 kfree(s);
66a7e928
MT		 51120diff -urNp linux-2.6.39/fs/xfs/xfs_bmap.c linux-2.6.39/fs/xfs/xfs_bmap.c
51121--- linux-2.6.39/fs/xfs/xfs_bmap.c 2011-05-19 00:06:34.000000000 -0400
51122+++ linux-2.6.39/fs/xfs/xfs_bmap.c 2011-05-22 19:36:32.000000000 -0400
6892158b 51123@@ -287,7 +287,7 @@ xfs_bmap_validate_ret(
58c5fc13
MT		 51124 int nmap,
51125 int ret_nmap);
51126 #else
51127-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
51128+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
51129 #endif /* DEBUG */
51130
ae4e228f 51131 STATIC int
66a7e928
MT		 51132diff -urNp linux-2.6.39/fs/xfs/xfs_dir2.c linux-2.6.39/fs/xfs/xfs_dir2.c
51133--- linux-2.6.39/fs/xfs/xfs_dir2.c 2011-05-19 00:06:34.000000000 -0400
51134+++ linux-2.6.39/fs/xfs/xfs_dir2.c 2011-05-22 19:36:32.000000000 -0400
51135@@ -85,7 +85,7 @@ xfs_ascii_ci_compname(
51136 return result;
51137 }
51138
51139-static struct xfs_nameops xfs_ascii_ci_nameops = {
51140+static const struct xfs_nameops xfs_ascii_ci_nameops = {
51141 .hashname = xfs_ascii_ci_hashname,
51142 .compname = xfs_ascii_ci_compname,
51143 };
51144diff -urNp linux-2.6.39/fs/xfs/xfs_dir2_sf.c linux-2.6.39/fs/xfs/xfs_dir2_sf.c
51145--- linux-2.6.39/fs/xfs/xfs_dir2_sf.c 2011-05-19 00:06:34.000000000 -0400
51146+++ linux-2.6.39/fs/xfs/xfs_dir2_sf.c 2011-05-22 19:36:32.000000000 -0400
71d190be
MT		 51147@@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
51148 }
51149
51150 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
51151- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51152+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
51153+ char name[sfep->namelen];
51154+ memcpy(name, sfep->name, sfep->namelen);
51155+ if (filldir(dirent, name, sfep->namelen,
51156+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
51157+ *offset = off & 0x7fffffff;
51158+ return 0;
51159+ }
51160+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51161 off & 0x7fffffff, ino, DT_UNKNOWN)) {
51162 *offset = off & 0x7fffffff;
51163 return 0;
66a7e928
MT		 51164diff -urNp linux-2.6.39/grsecurity/gracl_alloc.c linux-2.6.39/grsecurity/gracl_alloc.c
51165--- linux-2.6.39/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
51166+++ linux-2.6.39/grsecurity/gracl_alloc.c 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 51167@@ -0,0 +1,105 @@
51168+#include <linux/kernel.h>
51169+#include <linux/mm.h>
51170+#include <linux/slab.h>
51171+#include <linux/vmalloc.h>
51172+#include <linux/gracl.h>
51173+#include <linux/grsecurity.h>
58c5fc13 51174+
57199397
MT		 51175+static unsigned long alloc_stack_next = 1;
51176+static unsigned long alloc_stack_size = 1;
51177+static void **alloc_stack;
58c5fc13 51178+
57199397
MT		 51179+static __inline__ int
51180+alloc_pop(void)
51181+{
51182+ if (alloc_stack_next == 1)
51183+ return 0;
58c5fc13 51184+
57199397 51185+ kfree(alloc_stack[alloc_stack_next - 2]);
58c5fc13 51186+
57199397 51187+ alloc_stack_next--;
58c5fc13 51188+
57199397
MT		 51189+ return 1;
51190+}
58c5fc13 51191+
57199397
MT		 51192+static __inline__ int
51193+alloc_push(void *buf)
51194+{
51195+ if (alloc_stack_next >= alloc_stack_size)
51196+ return 1;
58c5fc13 51197+
57199397 51198+ alloc_stack[alloc_stack_next - 1] = buf;
58c5fc13 51199+
57199397 51200+ alloc_stack_next++;
58c5fc13 51201+
57199397
MT		 51202+ return 0;
51203+}
58c5fc13 51204+
57199397
MT		 51205+void *
51206+acl_alloc(unsigned long len)
51207+{
51208+ void *ret = NULL;
58c5fc13 51209+
57199397
MT		 51210+ if (!len || len > PAGE_SIZE)
51211+ goto out;
58c5fc13 51212+
57199397 51213+ ret = kmalloc(len, GFP_KERNEL);
58c5fc13 51214+
57199397
MT		 51215+ if (ret) {
51216+ if (alloc_push(ret)) {
51217+ kfree(ret);
51218+ ret = NULL;
51219+ }
51220+ }
58c5fc13 51221+
57199397
MT		 51222+out:
51223+ return ret;
51224+}
58c5fc13 51225+
57199397
MT		 51226+void *
51227+acl_alloc_num(unsigned long num, unsigned long len)
51228+{
51229+ if (!len || (num > (PAGE_SIZE / len)))
51230+ return NULL;
58c5fc13 51231+
57199397
MT		 51232+ return acl_alloc(num * len);
51233+}
58c5fc13 51234+
57199397
MT		 51235+void
51236+acl_free_all(void)
51237+{
51238+ if (gr_acl_is_enabled() || !alloc_stack)
51239+ return;
58c5fc13 51240+
57199397 51241+ while (alloc_pop()) ;
58c5fc13 51242+
57199397
MT		 51243+ if (alloc_stack) {
51244+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
51245+ kfree(alloc_stack);
51246+ else
51247+ vfree(alloc_stack);
51248+ }
58c5fc13 51249+
57199397
MT		 51250+ alloc_stack = NULL;
51251+ alloc_stack_size = 1;
51252+ alloc_stack_next = 1;
58c5fc13 51253+
57199397
MT		 51254+ return;
51255+}
58c5fc13 51256+
57199397
MT		 51257+int
51258+acl_alloc_stack_init(unsigned long size)
51259+{
51260+ if ((size * sizeof (void *)) <= PAGE_SIZE)
51261+ alloc_stack =
51262+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
51263+ else
51264+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
58c5fc13 51265+
57199397 51266+ alloc_stack_size = size;
58c5fc13 51267+
57199397
MT		 51268+ if (!alloc_stack)
51269+ return 0;
51270+ else
51271+ return 1;
51272+}
66a7e928
MT		 51273diff -urNp linux-2.6.39/grsecurity/gracl.c linux-2.6.39/grsecurity/gracl.c
51274--- linux-2.6.39/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
51275+++ linux-2.6.39/grsecurity/gracl.c 2011-05-22 22:47:25.000000000 -0400
51276@@ -0,0 +1,4097 @@
57199397
MT		 51277+#include <linux/kernel.h>
51278+#include <linux/module.h>
51279+#include <linux/sched.h>
51280+#include <linux/mm.h>
51281+#include <linux/file.h>
51282+#include <linux/fs.h>
51283+#include <linux/namei.h>
51284+#include <linux/mount.h>
51285+#include <linux/tty.h>
51286+#include <linux/proc_fs.h>
bc901d79 51287+#include <linux/lglock.h>
57199397
MT		 51288+#include <linux/slab.h>
51289+#include <linux/vmalloc.h>
51290+#include <linux/types.h>
51291+#include <linux/sysctl.h>
51292+#include <linux/netdevice.h>
51293+#include <linux/ptrace.h>
51294+#include <linux/gracl.h>
51295+#include <linux/gralloc.h>
51296+#include <linux/grsecurity.h>
51297+#include <linux/grinternal.h>
51298+#include <linux/pid_namespace.h>
51299+#include <linux/fdtable.h>
51300+#include <linux/percpu.h>
58c5fc13 51301+
57199397
MT		 51302+#include <asm/uaccess.h>
51303+#include <asm/errno.h>
51304+#include <asm/mman.h>
58c5fc13 51305+
57199397
MT		 51306+static struct acl_role_db acl_role_set;
51307+static struct name_db name_set;
51308+static struct inodev_db inodev_set;
58c5fc13 51309+
57199397
MT		 51310+/* for keeping track of userspace pointers used for subjects, so we
51311+ can share references in the kernel as well
51312+*/
58c5fc13 51313+
6892158b 51314+static struct path real_root;
58c5fc13 51315+
57199397 51316+static struct acl_subj_map_db subj_map_set;
ae4e228f 51317+
57199397 51318+static struct acl_role_label *default_role;
58c5fc13 51319+
57199397 51320+static struct acl_role_label *role_list;
58c5fc13 51321+
57199397 51322+static u16 acl_sp_role_value;
58c5fc13 51323+
57199397 51324+extern char *gr_shared_page[4];
bc901d79 51325+static DEFINE_MUTEX(gr_dev_mutex);
57199397 51326+DEFINE_RWLOCK(gr_inode_lock);
58c5fc13 51327+
57199397 51328+struct gr_arg *gr_usermode;
58c5fc13 51329+
57199397 51330+static unsigned int gr_status __read_only = GR_STATUS_INIT;
58c5fc13 51331+
57199397
MT		 51332+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51333+extern void gr_clear_learn_entries(void);
58c5fc13 51334+
57199397
MT		 51335+#ifdef CONFIG_GRKERNSEC_RESLOG
51336+extern void gr_log_resource(const struct task_struct *task,
51337+ const int res, const unsigned long wanted, const int gt);
51338+#endif
58c5fc13 51339+
57199397
MT		 51340+unsigned char *gr_system_salt;
51341+unsigned char *gr_system_sum;
58c5fc13 51342+
57199397
MT		 51343+static struct sprole_pw **acl_special_roles = NULL;
51344+static __u16 num_sprole_pws = 0;
58c5fc13 51345+
57199397 51346+static struct acl_role_label *kernel_role = NULL;
df50ba0c 51347+
57199397
MT		 51348+static unsigned int gr_auth_attempts = 0;
51349+static unsigned long gr_auth_expires = 0UL;
58c5fc13 51350+
57199397
MT		 51351+extern struct vfsmount *sock_mnt;
51352+extern struct vfsmount *pipe_mnt;
51353+extern struct vfsmount *shm_mnt;
51354+#ifdef CONFIG_HUGETLBFS
51355+extern struct vfsmount *hugetlbfs_vfsmount;
51356+#endif
58c5fc13 51357+
57199397 51358+static struct acl_object_label *fakefs_obj;
df50ba0c 51359+
57199397
MT		 51360+extern int gr_init_uidset(void);
51361+extern void gr_free_uidset(void);
51362+extern void gr_remove_uid(uid_t uid);
51363+extern int gr_find_uid(uid_t uid);
58c5fc13 51364+
bc901d79 51365+DECLARE_BRLOCK(vfsmount_lock);
58c5fc13 51366+
57199397
MT		 51367+__inline__ int
51368+gr_acl_is_enabled(void)
51369+{
51370+ return (gr_status & GR_READY);
51371+}
58c5fc13 51372+
16454cff
MT		 51373+#ifdef CONFIG_BTRFS_FS
51374+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51375+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51376+#endif
51377+
51378+static inline dev_t __get_dev(const struct dentry *dentry)
51379+{
51380+#ifdef CONFIG_BTRFS_FS
51381+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51382+ return get_btrfs_dev_from_inode(dentry->d_inode);
51383+ else
51384+#endif
51385+ return dentry->d_inode->i_sb->s_dev;
51386+}
51387+
51388+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51389+{
51390+ return __get_dev(dentry);
51391+}
51392+
6892158b 51393+static char gr_task_roletype_to_char(struct task_struct *task)
57199397 51394+{
6892158b 51395+ switch (task->role->roletype &
57199397
MT		 51396+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51397+ GR_ROLE_SPECIAL)) {
51398+ case GR_ROLE_DEFAULT:
51399+ return 'D';
51400+ case GR_ROLE_USER:
51401+ return 'U';
51402+ case GR_ROLE_GROUP:
51403+ return 'G';
51404+ case GR_ROLE_SPECIAL:
51405+ return 'S';
51406+ }
58c5fc13 51407+
57199397
MT		 51408+ return 'X';
51409+}
58c5fc13 51410+
6892158b
MT		 51411+char gr_roletype_to_char(void)
51412+{
51413+ return gr_task_roletype_to_char(current);
51414+}
51415+
57199397
MT		 51416+__inline__ int
51417+gr_acl_tpe_check(void)
51418+{
51419+ if (unlikely(!(gr_status & GR_READY)))
51420+ return 0;
51421+ if (current->role->roletype & GR_ROLE_TPE)
51422+ return 1;
51423+ else
51424+ return 0;
51425+}
58c5fc13 51426+
57199397
MT		 51427+int
51428+gr_handle_rawio(const struct inode *inode)
51429+{
51430+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51431+ if (inode && S_ISBLK(inode->i_mode) &&
51432+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51433+ !capable(CAP_SYS_RAWIO))
51434+ return 1;
51435+#endif
51436+ return 0;
51437+}
58c5fc13 51438+
57199397
MT		 51439+static int
51440+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51441+{
51442+ if (likely(lena != lenb))
51443+ return 0;
58c5fc13 51444+
57199397
MT		 51445+ return !memcmp(a, b, lena);
51446+}
58c5fc13 51447+
bc901d79
MT		 51448+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51449+{
51450+ *buflen -= namelen;
51451+ if (*buflen < 0)
51452+ return -ENAMETOOLONG;
51453+ *buffer -= namelen;
51454+ memcpy(*buffer, str, namelen);
51455+ return 0;
51456+}
51457+
51458+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51459+{
51460+ return prepend(buffer, buflen, name->name, name->len);
51461+}
51462+
51463+static int prepend_path(const struct path *path, struct path *root,
51464+ char **buffer, int *buflen)
51465+{
51466+ struct dentry *dentry = path->dentry;
51467+ struct vfsmount *vfsmnt = path->mnt;
51468+ bool slash = false;
51469+ int error = 0;
51470+
51471+ while (dentry != root->dentry || vfsmnt != root->mnt) {
51472+ struct dentry * parent;
51473+
51474+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51475+ /* Global root? */
51476+ if (vfsmnt->mnt_parent == vfsmnt) {
51477+ goto out;
51478+ }
51479+ dentry = vfsmnt->mnt_mountpoint;
51480+ vfsmnt = vfsmnt->mnt_parent;
51481+ continue;
51482+ }
51483+ parent = dentry->d_parent;
51484+ prefetch(parent);
16454cff 51485+ spin_lock(&dentry->d_lock);
bc901d79 51486+ error = prepend_name(buffer, buflen, &dentry->d_name);
16454cff 51487+ spin_unlock(&dentry->d_lock);
bc901d79
MT		 51488+ if (!error)
51489+ error = prepend(buffer, buflen, "/", 1);
51490+ if (error)
51491+ break;
51492+
51493+ slash = true;
51494+ dentry = parent;
51495+ }
51496+
51497+out:
51498+ if (!error && !slash)
51499+ error = prepend(buffer, buflen, "/", 1);
51500+
51501+ return error;
51502+}
51503+
16454cff 51504+/* this must be called with vfsmount_lock and rename_lock held */
bc901d79
MT		 51505+
51506+static char *__our_d_path(const struct path *path, struct path *root,
51507+ char *buf, int buflen)
51508+{
51509+ char *res = buf + buflen;
51510+ int error;
51511+
51512+ prepend(&res, &buflen, "\0", 1);
51513+ error = prepend_path(path, root, &res, &buflen);
51514+ if (error)
51515+ return ERR_PTR(error);
51516+
51517+ return res;
51518+}
51519+
57199397 51520+static char *
6892158b 51521+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
57199397
MT		 51522+{
51523+ char *retval;
58c5fc13 51524+
bc901d79 51525+ retval = __our_d_path(path, root, buf, buflen);
57199397
MT		 51526+ if (unlikely(IS_ERR(retval)))
51527+ retval = strcpy(buf, "<path too long>");
51528+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51529+ retval[1] = '\0';
58c5fc13 51530+
57199397
MT		 51531+ return retval;
51532+}
58c5fc13 51533+
57199397
MT		 51534+static char *
51535+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51536+ char *buf, int buflen)
51537+{
6892158b 51538+ struct path path;
57199397 51539+ char *res;
58c5fc13 51540+
6892158b
MT		 51541+ path.dentry = (struct dentry *)dentry;
51542+ path.mnt = (struct vfsmount *)vfsmnt;
51543+
51544+ /* we can use real_root.dentry, real_root.mnt, because this is only called
57199397 51545+ by the RBAC system */
6892158b 51546+ res = gen_full_path(&path, &real_root, buf, buflen);
58c5fc13 51547+
57199397
MT		 51548+ return res;
51549+}
58c5fc13 51550+
57199397
MT		 51551+static char *
51552+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51553+ char *buf, int buflen)
51554+{
51555+ char *res;
6892158b
MT		 51556+ struct path path;
51557+ struct path root;
57199397 51558+ struct task_struct *reaper = &init_task;
58c5fc13 51559+
6892158b
MT		 51560+ path.dentry = (struct dentry *)dentry;
51561+ path.mnt = (struct vfsmount *)vfsmnt;
51562+
51563+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
ea610fa8 51564+ get_fs_root(reaper->fs, &root);
58c5fc13 51565+
16454cff 51566+ write_seqlock(&rename_lock);
bc901d79 51567+ br_read_lock(vfsmount_lock);
6892158b 51568+ res = gen_full_path(&path, &root, buf, buflen);
bc901d79 51569+ br_read_unlock(vfsmount_lock);
16454cff 51570+ write_sequnlock(&rename_lock);
58c5fc13 51571+
6892158b 51572+ path_put(&root);
57199397
MT		 51573+ return res;
51574+}
58c5fc13 51575+
57199397
MT		 51576+static char *
51577+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51578+{
51579+ char *ret;
16454cff 51580+ write_seqlock(&rename_lock);
bc901d79 51581+ br_read_lock(vfsmount_lock);
57199397
MT		 51582+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51583+ PAGE_SIZE);
bc901d79 51584+ br_read_unlock(vfsmount_lock);
16454cff 51585+ write_sequnlock(&rename_lock);
57199397
MT		 51586+ return ret;
51587+}
58c5fc13 51588+
57199397
MT		 51589+char *
51590+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51591+{
51592+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51593+ PAGE_SIZE);
51594+}
58c5fc13 51595+
57199397
MT		 51596+char *
51597+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51598+{
51599+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51600+ PAGE_SIZE);
51601+}
58c5fc13 51602+
57199397
MT		 51603+char *
51604+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51605+{
51606+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51607+ PAGE_SIZE);
51608+}
58c5fc13 51609+
57199397
MT		 51610+char *
51611+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51612+{
51613+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51614+ PAGE_SIZE);
51615+}
58c5fc13 51616+
57199397
MT		 51617+char *
51618+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51619+{
51620+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51621+ PAGE_SIZE);
51622+}
58c5fc13 51623+
57199397
MT		 51624+__inline__ __u32
51625+to_gr_audit(const __u32 reqmode)
51626+{
51627+ /* masks off auditable permission flags, then shifts them to create
51628+ auditing flags, and adds the special case of append auditing if
51629+ we're requesting write */
51630+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51631+}
58c5fc13 51632+
57199397
MT		 51633+struct acl_subject_label *
51634+lookup_subject_map(const struct acl_subject_label *userp)
51635+{
51636+ unsigned int index = shash(userp, subj_map_set.s_size);
51637+ struct subject_map *match;
58c5fc13 51638+
57199397 51639+ match = subj_map_set.s_hash[index];
58c5fc13 51640+
57199397
MT		 51641+ while (match && match->user != userp)
51642+ match = match->next;
58c5fc13 51643+
57199397
MT		 51644+ if (match != NULL)
51645+ return match->kernel;
51646+ else
51647+ return NULL;
51648+}
58c5fc13 51649+
57199397
MT		 51650+static void
51651+insert_subj_map_entry(struct subject_map *subjmap)
51652+{
51653+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51654+ struct subject_map **curr;
58c5fc13 51655+
57199397 51656+ subjmap->prev = NULL;
58c5fc13 51657+
57199397
MT		 51658+ curr = &subj_map_set.s_hash[index];
51659+ if (*curr != NULL)
51660+ (*curr)->prev = subjmap;
58c5fc13 51661+
57199397
MT		 51662+ subjmap->next = *curr;
51663+ *curr = subjmap;
58c5fc13 51664+
57199397
MT		 51665+ return;
51666+}
58c5fc13 51667+
57199397
MT		 51668+static struct acl_role_label *
51669+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51670+ const gid_t gid)
51671+{
51672+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51673+ struct acl_role_label *match;
51674+ struct role_allowed_ip *ipp;
51675+ unsigned int x;
bc901d79
MT		 51676+ u32 curr_ip = task->signal->curr_ip;
51677+
51678+ task->signal->saved_ip = curr_ip;
58c5fc13 51679+
57199397 51680+ match = acl_role_set.r_hash[index];
58c5fc13 51681+
57199397
MT		 51682+ while (match) {
51683+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51684+ for (x = 0; x < match->domain_child_num; x++) {
51685+ if (match->domain_children[x] == uid)
51686+ goto found;
51687+ }
51688+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51689+ break;
51690+ match = match->next;
51691+ }
51692+found:
51693+ if (match == NULL) {
51694+ try_group:
51695+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51696+ match = acl_role_set.r_hash[index];
58c5fc13 51697+
57199397
MT		 51698+ while (match) {
51699+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51700+ for (x = 0; x < match->domain_child_num; x++) {
51701+ if (match->domain_children[x] == gid)
51702+ goto found2;
51703+ }
51704+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51705+ break;
51706+ match = match->next;
51707+ }
51708+found2:
51709+ if (match == NULL)
51710+ match = default_role;
51711+ if (match->allowed_ips == NULL)
51712+ return match;
51713+ else {
51714+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51715+ if (likely
bc901d79 51716+ ((ntohl(curr_ip) & ipp->netmask) ==
57199397
MT		 51717+ (ntohl(ipp->addr) & ipp->netmask)))
51718+ return match;
51719+ }
51720+ match = default_role;
51721+ }
51722+ } else if (match->allowed_ips == NULL) {
51723+ return match;
51724+ } else {
51725+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51726+ if (likely
bc901d79 51727+ ((ntohl(curr_ip) & ipp->netmask) ==
57199397
MT		 51728+ (ntohl(ipp->addr) & ipp->netmask)))
51729+ return match;
51730+ }
51731+ goto try_group;
51732+ }
58c5fc13 51733+
57199397
MT		 51734+ return match;
51735+}
58c5fc13 51736+
57199397
MT		 51737+struct acl_subject_label *
51738+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51739+ const struct acl_role_label *role)
51740+{
51741+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51742+ struct acl_subject_label *match;
58c5fc13 51743+
57199397 51744+ match = role->subj_hash[index];
58c5fc13 51745+
57199397
MT		 51746+ while (match && (match->inode != ino || match->device != dev ||
51747+ (match->mode & GR_DELETED))) {
51748+ match = match->next;
51749+ }
58c5fc13 51750+
57199397
MT		 51751+ if (match && !(match->mode & GR_DELETED))
51752+ return match;
51753+ else
51754+ return NULL;
51755+}
58c5fc13 51756+
57199397
MT		 51757+struct acl_subject_label *
51758+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51759+ const struct acl_role_label *role)
51760+{
51761+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51762+ struct acl_subject_label *match;
58c5fc13 51763+
57199397 51764+ match = role->subj_hash[index];
58c5fc13 51765+
57199397
MT		 51766+ while (match && (match->inode != ino || match->device != dev ||
51767+ !(match->mode & GR_DELETED))) {
51768+ match = match->next;
51769+ }
58c5fc13 51770+
57199397
MT		 51771+ if (match && (match->mode & GR_DELETED))
51772+ return match;
51773+ else
51774+ return NULL;
51775+}
58c5fc13 51776+
57199397
MT		 51777+static struct acl_object_label *
51778+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51779+ const struct acl_subject_label *subj)
51780+{
51781+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51782+ struct acl_object_label *match;
58c5fc13 51783+
57199397 51784+ match = subj->obj_hash[index];
58c5fc13 51785+
57199397
MT		 51786+ while (match && (match->inode != ino || match->device != dev ||
51787+ (match->mode & GR_DELETED))) {
51788+ match = match->next;
51789+ }
58c5fc13 51790+
57199397
MT		 51791+ if (match && !(match->mode & GR_DELETED))
51792+ return match;
51793+ else
51794+ return NULL;
51795+}
58c5fc13 51796+
57199397
MT		 51797+static struct acl_object_label *
51798+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51799+ const struct acl_subject_label *subj)
51800+{
51801+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51802+ struct acl_object_label *match;
58c5fc13 51803+
57199397 51804+ match = subj->obj_hash[index];
58c5fc13 51805+
57199397
MT		 51806+ while (match && (match->inode != ino || match->device != dev ||
51807+ !(match->mode & GR_DELETED))) {
51808+ match = match->next;
51809+ }
58c5fc13 51810+
57199397
MT		 51811+ if (match && (match->mode & GR_DELETED))
51812+ return match;
58c5fc13 51813+
57199397 51814+ match = subj->obj_hash[index];
58c5fc13 51815+
57199397
MT		 51816+ while (match && (match->inode != ino || match->device != dev ||
51817+ (match->mode & GR_DELETED))) {
51818+ match = match->next;
51819+ }
58c5fc13 51820+
57199397
MT		 51821+ if (match && !(match->mode & GR_DELETED))
51822+ return match;
51823+ else
51824+ return NULL;
51825+}
58c5fc13 51826+
57199397
MT		 51827+static struct name_entry *
51828+lookup_name_entry(const char *name)
51829+{
51830+ unsigned int len = strlen(name);
51831+ unsigned int key = full_name_hash(name, len);
51832+ unsigned int index = key % name_set.n_size;
51833+ struct name_entry *match;
58c5fc13 51834+
57199397 51835+ match = name_set.n_hash[index];
58c5fc13 51836+
57199397
MT		 51837+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51838+ match = match->next;
58c5fc13 51839+
57199397
MT		 51840+ return match;
51841+}
58c5fc13 51842+
57199397
MT		 51843+static struct name_entry *
51844+lookup_name_entry_create(const char *name)
51845+{
51846+ unsigned int len = strlen(name);
51847+ unsigned int key = full_name_hash(name, len);
51848+ unsigned int index = key % name_set.n_size;
51849+ struct name_entry *match;
58c5fc13 51850+
57199397 51851+ match = name_set.n_hash[index];
58c5fc13 51852+
57199397
MT		 51853+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51854+ !match->deleted))
51855+ match = match->next;
58c5fc13 51856+
57199397
MT		 51857+ if (match && match->deleted)
51858+ return match;
58c5fc13 51859+
57199397 51860+ match = name_set.n_hash[index];
58c5fc13 51861+
57199397
MT		 51862+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51863+ match->deleted))
51864+ match = match->next;
58c5fc13 51865+
57199397
MT		 51866+ if (match && !match->deleted)
51867+ return match;
51868+ else
51869+ return NULL;
51870+}
58c5fc13 51871+
57199397
MT		 51872+static struct inodev_entry *
51873+lookup_inodev_entry(const ino_t ino, const dev_t dev)
51874+{
51875+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
51876+ struct inodev_entry *match;
58c5fc13 51877+
57199397 51878+ match = inodev_set.i_hash[index];
58c5fc13 51879+
57199397
MT		 51880+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51881+ match = match->next;
58c5fc13 51882+
57199397 51883+ return match;
58c5fc13
MT		 51884+}
51885+
57199397
MT		 51886+static void
51887+insert_inodev_entry(struct inodev_entry *entry)
58c5fc13 51888+{
57199397
MT		 51889+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51890+ inodev_set.i_size);
51891+ struct inodev_entry **curr;
58c5fc13 51892+
57199397 51893+ entry->prev = NULL;
58c5fc13 51894+
57199397
MT		 51895+ curr = &inodev_set.i_hash[index];
51896+ if (*curr != NULL)
51897+ (*curr)->prev = entry;
51898+
51899+ entry->next = *curr;
51900+ *curr = entry;
ae4e228f 51901+
57199397 51902+ return;
58c5fc13 51903+}
efbe55a5 51904+
57199397
MT		 51905+static void
51906+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
efbe55a5
MT		 51907+{
51908+ unsigned int index =
51909+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51910+ struct acl_role_label **curr;
51911+ struct acl_role_label *tmp;
51912+
51913+ curr = &acl_role_set.r_hash[index];
51914+
51915+ /* if role was already inserted due to domains and already has
51916+ a role in the same bucket as it attached, then we need to
51917+ combine these two buckets
51918+ */
51919+ if (role->next) {
51920+ tmp = role->next;
51921+ while (tmp->next)
51922+ tmp = tmp->next;
51923+ tmp->next = *curr;
51924+ } else
51925+ role->next = *curr;
51926+ *curr = role;
51927+
51928+ return;
51929+}
51930+
51931+static void
51932+insert_acl_role_label(struct acl_role_label *role)
51933+{
51934+ int i;
51935+
51936+ if (role_list == NULL) {
51937+ role_list = role;
51938+ role->prev = NULL;
51939+ } else {
51940+ role->prev = role_list;
51941+ role_list = role;
51942+ }
51943+
51944+ /* used for hash chains */
51945+ role->next = NULL;
51946+
51947+ if (role->roletype & GR_ROLE_DOMAIN) {
51948+ for (i = 0; i < role->domain_child_num; i++)
51949+ __insert_acl_role_label(role, role->domain_children[i]);
51950+ } else
51951+ __insert_acl_role_label(role, role->uidgid);
51952+}
51953+
51954+static int
51955+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
51956+{
51957+ struct name_entry **curr, *nentry;
51958+ struct inodev_entry *ientry;
51959+ unsigned int len = strlen(name);
51960+ unsigned int key = full_name_hash(name, len);
51961+ unsigned int index = key % name_set.n_size;
51962+
51963+ curr = &name_set.n_hash[index];
51964+
51965+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
51966+ curr = &((*curr)->next);
51967+
51968+ if (*curr != NULL)
51969+ return 1;
51970+
51971+ nentry = acl_alloc(sizeof (struct name_entry));
51972+ if (nentry == NULL)
51973+ return 0;
51974+ ientry = acl_alloc(sizeof (struct inodev_entry));
51975+ if (ientry == NULL)
51976+ return 0;
51977+ ientry->nentry = nentry;
51978+
51979+ nentry->key = key;
51980+ nentry->name = name;
51981+ nentry->inode = inode;
51982+ nentry->device = device;
51983+ nentry->len = len;
51984+ nentry->deleted = deleted;
51985+
51986+ nentry->prev = NULL;
51987+ curr = &name_set.n_hash[index];
51988+ if (*curr != NULL)
51989+ (*curr)->prev = nentry;
51990+ nentry->next = *curr;
51991+ *curr = nentry;
51992+
51993+ /* insert us into the table searchable by inode/dev */
51994+ insert_inodev_entry(ientry);
51995+
51996+ return 1;
51997+}
51998+
51999+static void
52000+insert_acl_obj_label(struct acl_object_label *obj,
52001+ struct acl_subject_label *subj)
52002+{
52003+ unsigned int index =
52004+ fhash(obj->inode, obj->device, subj->obj_hash_size);
52005+ struct acl_object_label **curr;
52006+
52007+
52008+ obj->prev = NULL;
52009+
52010+ curr = &subj->obj_hash[index];
52011+ if (*curr != NULL)
52012+ (*curr)->prev = obj;
52013+
52014+ obj->next = *curr;
52015+ *curr = obj;
52016+
52017+ return;
52018+}
52019+
52020+static void
52021+insert_acl_subj_label(struct acl_subject_label *obj,
52022+ struct acl_role_label *role)
52023+{
52024+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52025+ struct acl_subject_label **curr;
52026+
52027+ obj->prev = NULL;
52028+
52029+ curr = &role->subj_hash[index];
52030+ if (*curr != NULL)
52031+ (*curr)->prev = obj;
52032+
52033+ obj->next = *curr;
52034+ *curr = obj;
52035+
52036+ return;
52037+}
52038+
52039+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52040+
52041+static void *
52042+create_table(__u32 * len, int elementsize)
52043+{
52044+ unsigned int table_sizes[] = {
52045+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52046+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52047+ 4194301, 8388593, 16777213, 33554393, 67108859
52048+ };
52049+ void *newtable = NULL;
52050+ unsigned int pwr = 0;
52051+
52052+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52053+ table_sizes[pwr] <= *len)
52054+ pwr++;
52055+
52056+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52057+ return newtable;
52058+
52059+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52060+ newtable =
52061+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52062+ else
52063+ newtable = vmalloc(table_sizes[pwr] * elementsize);
52064+
52065+ *len = table_sizes[pwr];
52066+
52067+ return newtable;
52068+}
52069+
52070+static int
52071+init_variables(const struct gr_arg *arg)
52072+{
52073+ struct task_struct *reaper = &init_task;
52074+ unsigned int stacksize;
58c5fc13
MT		 52075+
52076+ subj_map_set.s_size = arg->role_db.num_subjects;
52077+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52078+ name_set.n_size = arg->role_db.num_objects;
52079+ inodev_set.i_size = arg->role_db.num_objects;
52080+
52081+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
52082+ !name_set.n_size || !inodev_set.i_size)
52083+ return 1;
52084+
52085+ if (!gr_init_uidset())
52086+ return 1;
52087+
52088+ /* set up the stack that holds allocation info */
52089+
52090+ stacksize = arg->role_db.num_pointers + 5;
52091+
52092+ if (!acl_alloc_stack_init(stacksize))
52093+ return 1;
52094+
52095+ /* grab reference for the real root dentry and vfsmount */
ea610fa8 52096+ get_fs_root(reaper->fs, &real_root);
58c5fc13 52097+
16454cff
MT		 52098+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52099+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52100+#endif
52101+
58c5fc13
MT		 52102+ fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
52103+ if (fakefs_obj == NULL)
52104+ return 1;
52105+ fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52106+
52107+ subj_map_set.s_hash =
52108+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52109+ acl_role_set.r_hash =
52110+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52111+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52112+ inodev_set.i_hash =
52113+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52114+
52115+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52116+ !name_set.n_hash || !inodev_set.i_hash)
52117+ return 1;
52118+
52119+ memset(subj_map_set.s_hash, 0,
52120+ sizeof(struct subject_map *) * subj_map_set.s_size);
52121+ memset(acl_role_set.r_hash, 0,
52122+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
52123+ memset(name_set.n_hash, 0,
52124+ sizeof (struct name_entry *) * name_set.n_size);
52125+ memset(inodev_set.i_hash, 0,
52126+ sizeof (struct inodev_entry *) * inodev_set.i_size);
52127+
52128+ return 0;
52129+}
52130+
52131+/* free information not needed after startup
52132+ currently contains user->kernel pointer mappings for subjects
52133+*/
52134+
52135+static void
52136+free_init_variables(void)
52137+{
52138+ __u32 i;
52139+
52140+ if (subj_map_set.s_hash) {
52141+ for (i = 0; i < subj_map_set.s_size; i++) {
52142+ if (subj_map_set.s_hash[i]) {
52143+ kfree(subj_map_set.s_hash[i]);
52144+ subj_map_set.s_hash[i] = NULL;
52145+ }
52146+ }
52147+
52148+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52149+ PAGE_SIZE)
52150+ kfree(subj_map_set.s_hash);
52151+ else
52152+ vfree(subj_map_set.s_hash);
52153+ }
52154+
52155+ return;
52156+}
52157+
52158+static void
52159+free_variables(void)
52160+{
52161+ struct acl_subject_label *s;
52162+ struct acl_role_label *r;
52163+ struct task_struct *task, *task2;
ae4e228f 52164+ unsigned int x;
58c5fc13
MT		 52165+
52166+ gr_clear_learn_entries();
52167+
52168+ read_lock(&tasklist_lock);
52169+ do_each_thread(task2, task) {
52170+ task->acl_sp_role = 0;
52171+ task->acl_role_id = 0;
52172+ task->acl = NULL;
52173+ task->role = NULL;
52174+ } while_each_thread(task2, task);
52175+ read_unlock(&tasklist_lock);
52176+
52177+ /* release the reference to the real root dentry and vfsmount */
6892158b 52178+ path_put(&real_root);
58c5fc13
MT		 52179+
52180+ /* free all object hash tables */
52181+
ae4e228f 52182+ FOR_EACH_ROLE_START(r)
58c5fc13 52183+ if (r->subj_hash == NULL)
ae4e228f 52184+ goto next_role;
58c5fc13
MT		 52185+ FOR_EACH_SUBJECT_START(r, s, x)
52186+ if (s->obj_hash == NULL)
52187+ break;
52188+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52189+ kfree(s->obj_hash);
52190+ else
52191+ vfree(s->obj_hash);
52192+ FOR_EACH_SUBJECT_END(s, x)
52193+ FOR_EACH_NESTED_SUBJECT_START(r, s)
52194+ if (s->obj_hash == NULL)
52195+ break;
52196+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52197+ kfree(s->obj_hash);
52198+ else
52199+ vfree(s->obj_hash);
52200+ FOR_EACH_NESTED_SUBJECT_END(s)
52201+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52202+ kfree(r->subj_hash);
52203+ else
52204+ vfree(r->subj_hash);
52205+ r->subj_hash = NULL;
ae4e228f
MT		 52206+next_role:
52207+ FOR_EACH_ROLE_END(r)
58c5fc13
MT		 52208+
52209+ acl_free_all();
52210+
52211+ if (acl_role_set.r_hash) {
52212+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52213+ PAGE_SIZE)
52214+ kfree(acl_role_set.r_hash);
52215+ else
52216+ vfree(acl_role_set.r_hash);
52217+ }
52218+ if (name_set.n_hash) {
52219+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
52220+ PAGE_SIZE)
52221+ kfree(name_set.n_hash);
52222+ else
52223+ vfree(name_set.n_hash);
52224+ }
52225+
52226+ if (inodev_set.i_hash) {
52227+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52228+ PAGE_SIZE)
52229+ kfree(inodev_set.i_hash);
52230+ else
52231+ vfree(inodev_set.i_hash);
52232+ }
52233+
52234+ gr_free_uidset();
52235+
52236+ memset(&name_set, 0, sizeof (struct name_db));
52237+ memset(&inodev_set, 0, sizeof (struct inodev_db));
52238+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52239+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52240+
52241+ default_role = NULL;
ae4e228f 52242+ role_list = NULL;
58c5fc13
MT		 52243+
52244+ return;
52245+}
52246+
52247+static __u32
52248+count_user_objs(struct acl_object_label *userp)
52249+{
52250+ struct acl_object_label o_tmp;
52251+ __u32 num = 0;
52252+
52253+ while (userp) {
52254+ if (copy_from_user(&o_tmp, userp,
52255+ sizeof (struct acl_object_label)))
52256+ break;
52257+
52258+ userp = o_tmp.prev;
52259+ num++;
52260+ }
52261+
52262+ return num;
52263+}
52264+
52265+static struct acl_subject_label *
52266+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52267+
52268+static int
52269+copy_user_glob(struct acl_object_label *obj)
52270+{
52271+ struct acl_object_label *g_tmp, **guser;
52272+ unsigned int len;
52273+ char *tmp;
52274+
52275+ if (obj->globbed == NULL)
52276+ return 0;
52277+
52278+ guser = &obj->globbed;
52279+ while (*guser) {
52280+ g_tmp = (struct acl_object_label *)
52281+ acl_alloc(sizeof (struct acl_object_label));
52282+ if (g_tmp == NULL)
52283+ return -ENOMEM;
52284+
52285+ if (copy_from_user(g_tmp, *guser,
52286+ sizeof (struct acl_object_label)))
52287+ return -EFAULT;
52288+
52289+ len = strnlen_user(g_tmp->filename, PATH_MAX);
52290+
52291+ if (!len || len >= PATH_MAX)
52292+ return -EINVAL;
52293+
52294+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52295+ return -ENOMEM;
52296+
52297+ if (copy_from_user(tmp, g_tmp->filename, len))
52298+ return -EFAULT;
52299+ tmp[len-1] = '\0';
52300+ g_tmp->filename = tmp;
52301+
52302+ *guser = g_tmp;
52303+ guser = &(g_tmp->next);
52304+ }
52305+
52306+ return 0;
52307+}
52308+
52309+static int
52310+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52311+ struct acl_role_label *role)
52312+{
52313+ struct acl_object_label *o_tmp;
52314+ unsigned int len;
52315+ int ret;
52316+ char *tmp;
52317+
52318+ while (userp) {
52319+ if ((o_tmp = (struct acl_object_label *)
52320+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
52321+ return -ENOMEM;
52322+
52323+ if (copy_from_user(o_tmp, userp,
52324+ sizeof (struct acl_object_label)))
52325+ return -EFAULT;
52326+
52327+ userp = o_tmp->prev;
52328+
52329+ len = strnlen_user(o_tmp->filename, PATH_MAX);
52330+
52331+ if (!len || len >= PATH_MAX)
52332+ return -EINVAL;
52333+
52334+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52335+ return -ENOMEM;
52336+
52337+ if (copy_from_user(tmp, o_tmp->filename, len))
52338+ return -EFAULT;
52339+ tmp[len-1] = '\0';
52340+ o_tmp->filename = tmp;
52341+
52342+ insert_acl_obj_label(o_tmp, subj);
52343+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52344+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52345+ return -ENOMEM;
52346+
52347+ ret = copy_user_glob(o_tmp);
52348+ if (ret)
52349+ return ret;
52350+
52351+ if (o_tmp->nested) {
52352+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52353+ if (IS_ERR(o_tmp->nested))
52354+ return PTR_ERR(o_tmp->nested);
52355+
52356+ /* insert into nested subject list */
52357+ o_tmp->nested->next = role->hash->first;
52358+ role->hash->first = o_tmp->nested;
52359+ }
52360+ }
52361+
52362+ return 0;
52363+}
52364+
52365+static __u32
52366+count_user_subjs(struct acl_subject_label *userp)
52367+{
52368+ struct acl_subject_label s_tmp;
52369+ __u32 num = 0;
52370+
52371+ while (userp) {
52372+ if (copy_from_user(&s_tmp, userp,
52373+ sizeof (struct acl_subject_label)))
52374+ break;
52375+
52376+ userp = s_tmp.prev;
52377+ /* do not count nested subjects against this count, since
52378+ they are not included in the hash table, but are
52379+ attached to objects. We have already counted
52380+ the subjects in userspace for the allocation
52381+ stack
52382+ */
52383+ if (!(s_tmp.mode & GR_NESTED))
52384+ num++;
52385+ }
52386+
52387+ return num;
52388+}
52389+
52390+static int
52391+copy_user_allowedips(struct acl_role_label *rolep)
52392+{
52393+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52394+
52395+ ruserip = rolep->allowed_ips;
52396+
52397+ while (ruserip) {
52398+ rlast = rtmp;
52399+
52400+ if ((rtmp = (struct role_allowed_ip *)
52401+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52402+ return -ENOMEM;
52403+
52404+ if (copy_from_user(rtmp, ruserip,
52405+ sizeof (struct role_allowed_ip)))
52406+ return -EFAULT;
52407+
52408+ ruserip = rtmp->prev;
52409+
52410+ if (!rlast) {
52411+ rtmp->prev = NULL;
52412+ rolep->allowed_ips = rtmp;
52413+ } else {
52414+ rlast->next = rtmp;
52415+ rtmp->prev = rlast;
52416+ }
52417+
52418+ if (!ruserip)
52419+ rtmp->next = NULL;
52420+ }
52421+
52422+ return 0;
52423+}
52424+
52425+static int
52426+copy_user_transitions(struct acl_role_label *rolep)
52427+{
52428+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
52429+
52430+ unsigned int len;
52431+ char *tmp;
52432+
52433+ rusertp = rolep->transitions;
52434+
52435+ while (rusertp) {
52436+ rlast = rtmp;
52437+
52438+ if ((rtmp = (struct role_transition *)
52439+ acl_alloc(sizeof (struct role_transition))) == NULL)
52440+ return -ENOMEM;
52441+
52442+ if (copy_from_user(rtmp, rusertp,
52443+ sizeof (struct role_transition)))
52444+ return -EFAULT;
52445+
52446+ rusertp = rtmp->prev;
52447+
52448+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52449+
52450+ if (!len || len >= GR_SPROLE_LEN)
52451+ return -EINVAL;
52452+
52453+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52454+ return -ENOMEM;
52455+
52456+ if (copy_from_user(tmp, rtmp->rolename, len))
52457+ return -EFAULT;
52458+ tmp[len-1] = '\0';
52459+ rtmp->rolename = tmp;
52460+
52461+ if (!rlast) {
52462+ rtmp->prev = NULL;
52463+ rolep->transitions = rtmp;
52464+ } else {
52465+ rlast->next = rtmp;
52466+ rtmp->prev = rlast;
52467+ }
52468+
52469+ if (!rusertp)
52470+ rtmp->next = NULL;
52471+ }
52472+
52473+ return 0;
52474+}
52475+
52476+static struct acl_subject_label *
52477+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52478+{
52479+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52480+ unsigned int len;
52481+ char *tmp;
52482+ __u32 num_objs;
52483+ struct acl_ip_label **i_tmp, *i_utmp2;
52484+ struct gr_hash_struct ghash;
52485+ struct subject_map *subjmap;
52486+ unsigned int i_num;
52487+ int err;
52488+
52489+ s_tmp = lookup_subject_map(userp);
52490+
52491+ /* we've already copied this subject into the kernel, just return
52492+ the reference to it, and don't copy it over again
52493+ */
52494+ if (s_tmp)
52495+ return(s_tmp);
52496+
52497+ if ((s_tmp = (struct acl_subject_label *)
52498+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52499+ return ERR_PTR(-ENOMEM);
52500+
52501+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52502+ if (subjmap == NULL)
52503+ return ERR_PTR(-ENOMEM);
52504+
52505+ subjmap->user = userp;
52506+ subjmap->kernel = s_tmp;
52507+ insert_subj_map_entry(subjmap);
52508+
52509+ if (copy_from_user(s_tmp, userp,
52510+ sizeof (struct acl_subject_label)))
52511+ return ERR_PTR(-EFAULT);
52512+
52513+ len = strnlen_user(s_tmp->filename, PATH_MAX);
52514+
52515+ if (!len || len >= PATH_MAX)
52516+ return ERR_PTR(-EINVAL);
52517+
52518+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52519+ return ERR_PTR(-ENOMEM);
52520+
52521+ if (copy_from_user(tmp, s_tmp->filename, len))
52522+ return ERR_PTR(-EFAULT);
52523+ tmp[len-1] = '\0';
52524+ s_tmp->filename = tmp;
52525+
52526+ if (!strcmp(s_tmp->filename, "/"))
52527+ role->root_label = s_tmp;
52528+
52529+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52530+ return ERR_PTR(-EFAULT);
52531+
52532+ /* copy user and group transition tables */
52533+
52534+ if (s_tmp->user_trans_num) {
52535+ uid_t *uidlist;
52536+
52537+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52538+ if (uidlist == NULL)
52539+ return ERR_PTR(-ENOMEM);
52540+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52541+ return ERR_PTR(-EFAULT);
52542+
52543+ s_tmp->user_transitions = uidlist;
52544+ }
52545+
52546+ if (s_tmp->group_trans_num) {
52547+ gid_t *gidlist;
52548+
52549+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52550+ if (gidlist == NULL)
52551+ return ERR_PTR(-ENOMEM);
52552+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52553+ return ERR_PTR(-EFAULT);
52554+
52555+ s_tmp->group_transitions = gidlist;
52556+ }
52557+
52558+ /* set up object hash table */
52559+ num_objs = count_user_objs(ghash.first);
52560+
52561+ s_tmp->obj_hash_size = num_objs;
52562+ s_tmp->obj_hash =
52563+ (struct acl_object_label **)
52564+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52565+
52566+ if (!s_tmp->obj_hash)
52567+ return ERR_PTR(-ENOMEM);
52568+
52569+ memset(s_tmp->obj_hash, 0,
52570+ s_tmp->obj_hash_size *
52571+ sizeof (struct acl_object_label *));
52572+
52573+ /* add in objects */
52574+ err = copy_user_objs(ghash.first, s_tmp, role);
52575+
52576+ if (err)
52577+ return ERR_PTR(err);
52578+
52579+ /* set pointer for parent subject */
52580+ if (s_tmp->parent_subject) {
52581+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52582+
52583+ if (IS_ERR(s_tmp2))
52584+ return s_tmp2;
52585+
52586+ s_tmp->parent_subject = s_tmp2;
52587+ }
52588+
52589+ /* add in ip acls */
52590+
52591+ if (!s_tmp->ip_num) {
52592+ s_tmp->ips = NULL;
52593+ goto insert;
52594+ }
52595+
52596+ i_tmp =
52597+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52598+ sizeof (struct acl_ip_label *));
52599+
52600+ if (!i_tmp)
52601+ return ERR_PTR(-ENOMEM);
52602+
52603+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52604+ *(i_tmp + i_num) =
52605+ (struct acl_ip_label *)
52606+ acl_alloc(sizeof (struct acl_ip_label));
52607+ if (!*(i_tmp + i_num))
52608+ return ERR_PTR(-ENOMEM);
52609+
52610+ if (copy_from_user
52611+ (&i_utmp2, s_tmp->ips + i_num,
52612+ sizeof (struct acl_ip_label *)))
52613+ return ERR_PTR(-EFAULT);
52614+
52615+ if (copy_from_user
52616+ (*(i_tmp + i_num), i_utmp2,
52617+ sizeof (struct acl_ip_label)))
52618+ return ERR_PTR(-EFAULT);
52619+
52620+ if ((*(i_tmp + i_num))->iface == NULL)
52621+ continue;
52622+
52623+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52624+ if (!len || len >= IFNAMSIZ)
52625+ return ERR_PTR(-EINVAL);
52626+ tmp = acl_alloc(len);
52627+ if (tmp == NULL)
52628+ return ERR_PTR(-ENOMEM);
52629+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52630+ return ERR_PTR(-EFAULT);
52631+ (*(i_tmp + i_num))->iface = tmp;
52632+ }
52633+
52634+ s_tmp->ips = i_tmp;
52635+
52636+insert:
52637+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52638+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52639+ return ERR_PTR(-ENOMEM);
52640+
52641+ return s_tmp;
52642+}
52643+
52644+static int
52645+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52646+{
52647+ struct acl_subject_label s_pre;
52648+ struct acl_subject_label * ret;
52649+ int err;
52650+
52651+ while (userp) {
52652+ if (copy_from_user(&s_pre, userp,
52653+ sizeof (struct acl_subject_label)))
52654+ return -EFAULT;
52655+
52656+ /* do not add nested subjects here, add
52657+ while parsing objects
52658+ */
52659+
52660+ if (s_pre.mode & GR_NESTED) {
52661+ userp = s_pre.prev;
52662+ continue;
52663+ }
52664+
52665+ ret = do_copy_user_subj(userp, role);
52666+
52667+ err = PTR_ERR(ret);
52668+ if (IS_ERR(ret))
52669+ return err;
52670+
52671+ insert_acl_subj_label(ret, role);
52672+
52673+ userp = s_pre.prev;
52674+ }
52675+
52676+ return 0;
52677+}
52678+
52679+static int
52680+copy_user_acl(struct gr_arg *arg)
52681+{
52682+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52683+ struct sprole_pw *sptmp;
52684+ struct gr_hash_struct *ghash;
52685+ uid_t *domainlist;
52686+ unsigned int r_num;
52687+ unsigned int len;
52688+ char *tmp;
52689+ int err = 0;
52690+ __u16 i;
52691+ __u32 num_subjs;
52692+
52693+ /* we need a default and kernel role */
52694+ if (arg->role_db.num_roles < 2)
52695+ return -EINVAL;
52696+
52697+ /* copy special role authentication info from userspace */
52698+
52699+ num_sprole_pws = arg->num_sprole_pws;
52700+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52701+
52702+ if (!acl_special_roles) {
52703+ err = -ENOMEM;
52704+ goto cleanup;
52705+ }
52706+
52707+ for (i = 0; i < num_sprole_pws; i++) {
52708+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52709+ if (!sptmp) {
52710+ err = -ENOMEM;
52711+ goto cleanup;
52712+ }
52713+ if (copy_from_user(sptmp, arg->sprole_pws + i,
52714+ sizeof (struct sprole_pw))) {
52715+ err = -EFAULT;
52716+ goto cleanup;
52717+ }
52718+
52719+ len =
52720+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52721+
52722+ if (!len || len >= GR_SPROLE_LEN) {
52723+ err = -EINVAL;
52724+ goto cleanup;
52725+ }
52726+
52727+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52728+ err = -ENOMEM;
52729+ goto cleanup;
52730+ }
52731+
52732+ if (copy_from_user(tmp, sptmp->rolename, len)) {
52733+ err = -EFAULT;
52734+ goto cleanup;
52735+ }
52736+ tmp[len-1] = '\0';
16454cff 52737+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
58c5fc13
MT		 52738+ printk(KERN_ALERT "Copying special role %s\n", tmp);
52739+#endif
52740+ sptmp->rolename = tmp;
52741+ acl_special_roles[i] = sptmp;
52742+ }
52743+
52744+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52745+
52746+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52747+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
52748+
52749+ if (!r_tmp) {
52750+ err = -ENOMEM;
52751+ goto cleanup;
52752+ }
52753+
52754+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
52755+ sizeof (struct acl_role_label *))) {
52756+ err = -EFAULT;
52757+ goto cleanup;
52758+ }
52759+
52760+ if (copy_from_user(r_tmp, r_utmp2,
52761+ sizeof (struct acl_role_label))) {
52762+ err = -EFAULT;
52763+ goto cleanup;
52764+ }
52765+
52766+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52767+
52768+ if (!len || len >= PATH_MAX) {
52769+ err = -EINVAL;
52770+ goto cleanup;
52771+ }
52772+
52773+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52774+ err = -ENOMEM;
52775+ goto cleanup;
52776+ }
52777+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
52778+ err = -EFAULT;
52779+ goto cleanup;
52780+ }
52781+ tmp[len-1] = '\0';
52782+ r_tmp->rolename = tmp;
52783+
52784+ if (!strcmp(r_tmp->rolename, "default")
52785+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52786+ default_role = r_tmp;
52787+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52788+ kernel_role = r_tmp;
52789+ }
52790+
52791+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52792+ err = -ENOMEM;
52793+ goto cleanup;
52794+ }
52795+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52796+ err = -EFAULT;
52797+ goto cleanup;
52798+ }
52799+
52800+ r_tmp->hash = ghash;
52801+
52802+ num_subjs = count_user_subjs(r_tmp->hash->first);
52803+
52804+ r_tmp->subj_hash_size = num_subjs;
52805+ r_tmp->subj_hash =
52806+ (struct acl_subject_label **)
52807+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52808+
52809+ if (!r_tmp->subj_hash) {
52810+ err = -ENOMEM;
52811+ goto cleanup;
52812+ }
52813+
52814+ err = copy_user_allowedips(r_tmp);
52815+ if (err)
52816+ goto cleanup;
52817+
52818+ /* copy domain info */
52819+ if (r_tmp->domain_children != NULL) {
52820+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52821+ if (domainlist == NULL) {
52822+ err = -ENOMEM;
52823+ goto cleanup;
52824+ }
52825+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52826+ err = -EFAULT;
52827+ goto cleanup;
52828+ }
52829+ r_tmp->domain_children = domainlist;
52830+ }
52831+
52832+ err = copy_user_transitions(r_tmp);
52833+ if (err)
52834+ goto cleanup;
52835+
52836+ memset(r_tmp->subj_hash, 0,
52837+ r_tmp->subj_hash_size *
52838+ sizeof (struct acl_subject_label *));
52839+
52840+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52841+
52842+ if (err)
52843+ goto cleanup;
52844+
52845+ /* set nested subject list to null */
52846+ r_tmp->hash->first = NULL;
52847+
52848+ insert_acl_role_label(r_tmp);
52849+ }
52850+
52851+ goto return_err;
52852+ cleanup:
52853+ free_variables();
52854+ return_err:
52855+ return err;
52856+
52857+}
52858+
52859+static int
52860+gracl_init(struct gr_arg *args)
52861+{
52862+ int error = 0;
52863+
52864+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52865+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52866+
52867+ if (init_variables(args)) {
52868+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52869+ error = -ENOMEM;
52870+ free_variables();
52871+ goto out;
52872+ }
52873+
52874+ error = copy_user_acl(args);
52875+ free_init_variables();
52876+ if (error) {
52877+ free_variables();
52878+ goto out;
52879+ }
52880+
52881+ if ((error = gr_set_acls(0))) {
52882+ free_variables();
52883+ goto out;
52884+ }
52885+
ae4e228f 52886+ pax_open_kernel();
58c5fc13 52887+ gr_status |= GR_READY;
ae4e228f 52888+ pax_close_kernel();
58c5fc13
MT		 52889+
52890+ out:
52891+ return error;
52892+}
52893+
52894+/* derived from glibc fnmatch() 0: match, 1: no match*/
52895+
52896+static int
52897+glob_match(const char *p, const char *n)
52898+{
52899+ char c;
52900+
52901+ while ((c = *p++) != '\0') {
52902+ switch (c) {
52903+ case '?':
52904+ if (*n == '\0')
52905+ return 1;
52906+ else if (*n == '/')
52907+ return 1;
52908+ break;
52909+ case '\\':
52910+ if (*n != c)
52911+ return 1;
52912+ break;
52913+ case '*':
52914+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
52915+ if (*n == '/')
52916+ return 1;
52917+ else if (c == '?') {
52918+ if (*n == '\0')
52919+ return 1;
52920+ else
52921+ ++n;
52922+ }
52923+ }
52924+ if (c == '\0') {
52925+ return 0;
52926+ } else {
52927+ const char *endp;
52928+
52929+ if ((endp = strchr(n, '/')) == NULL)
52930+ endp = n + strlen(n);
52931+
52932+ if (c == '[') {
52933+ for (--p; n < endp; ++n)
52934+ if (!glob_match(p, n))
52935+ return 0;
52936+ } else if (c == '/') {
52937+ while (*n != '\0' && *n != '/')
52938+ ++n;
52939+ if (*n == '/' && !glob_match(p, n + 1))
52940+ return 0;
52941+ } else {
52942+ for (--p; n < endp; ++n)
52943+ if (*n == c && !glob_match(p, n))
52944+ return 0;
52945+ }
52946+
52947+ return 1;
52948+ }
52949+ case '[':
52950+ {
52951+ int not;
52952+ char cold;
52953+
52954+ if (*n == '\0' || *n == '/')
52955+ return 1;
52956+
52957+ not = (*p == '!' || *p == '^');
52958+ if (not)
52959+ ++p;
52960+
52961+ c = *p++;
52962+ for (;;) {
52963+ unsigned char fn = (unsigned char)*n;
52964+
52965+ if (c == '\0')
52966+ return 1;
52967+ else {
52968+ if (c == fn)
52969+ goto matched;
52970+ cold = c;
52971+ c = *p++;
52972+
52973+ if (c == '-' && *p != ']') {
52974+ unsigned char cend = *p++;
52975+
52976+ if (cend == '\0')
52977+ return 1;
52978+
52979+ if (cold <= fn && fn <= cend)
52980+ goto matched;
52981+
52982+ c = *p++;
52983+ }
52984+ }
52985+
52986+ if (c == ']')
52987+ break;
52988+ }
52989+ if (!not)
52990+ return 1;
52991+ break;
52992+ matched:
52993+ while (c != ']') {
52994+ if (c == '\0')
52995+ return 1;
52996+
52997+ c = *p++;
52998+ }
52999+ if (not)
53000+ return 1;
53001+ }
53002+ break;
53003+ default:
53004+ if (c != *n)
53005+ return 1;
53006+ }
53007+
53008+ ++n;
53009+ }
53010+
53011+ if (*n == '\0')
53012+ return 0;
53013+
53014+ if (*n == '/')
53015+ return 0;
53016+
53017+ return 1;
53018+}
53019+
53020+static struct acl_object_label *
53021+chk_glob_label(struct acl_object_label *globbed,
53022+ struct dentry *dentry, struct vfsmount *mnt, char **path)
53023+{
53024+ struct acl_object_label *tmp;
53025+
53026+ if (*path == NULL)
53027+ *path = gr_to_filename_nolock(dentry, mnt);
53028+
53029+ tmp = globbed;
53030+
53031+ while (tmp) {
53032+ if (!glob_match(tmp->filename, *path))
53033+ return tmp;
53034+ tmp = tmp->next;
53035+ }
53036+
53037+ return NULL;
53038+}
53039+
53040+static struct acl_object_label *
53041+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53042+ const ino_t curr_ino, const dev_t curr_dev,
53043+ const struct acl_subject_label *subj, char **path, const int checkglob)
53044+{
53045+ struct acl_subject_label *tmpsubj;
53046+ struct acl_object_label *retval;
53047+ struct acl_object_label *retval2;
53048+
53049+ tmpsubj = (struct acl_subject_label *) subj;
53050+ read_lock(&gr_inode_lock);
53051+ do {
53052+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53053+ if (retval) {
53054+ if (checkglob && retval->globbed) {
53055+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
53056+ (struct vfsmount *)orig_mnt, path);
53057+ if (retval2)
53058+ retval = retval2;
53059+ }
53060+ break;
53061+ }
53062+ } while ((tmpsubj = tmpsubj->parent_subject));
53063+ read_unlock(&gr_inode_lock);
53064+
53065+ return retval;
53066+}
53067+
53068+static __inline__ struct acl_object_label *
53069+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
16454cff 53070+ struct dentry *curr_dentry,
58c5fc13
MT		 53071+ const struct acl_subject_label *subj, char **path, const int checkglob)
53072+{
bc901d79 53073+ int newglob = checkglob;
16454cff
MT		 53074+ ino_t inode;
53075+ dev_t device;
bc901d79
MT		 53076+
53077+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53078+ as we don't want a / * rule to match instead of the / object
53079+ don't do this for create lookups that call this function though, since they're looking up
53080+ on the parent and thus need globbing checks on all paths
53081+ */
53082+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53083+ newglob = GR_NO_GLOB;
53084+
16454cff
MT		 53085+ spin_lock(&curr_dentry->d_lock);
53086+ inode = curr_dentry->d_inode->i_ino;
53087+ device = __get_dev(curr_dentry);
53088+ spin_unlock(&curr_dentry->d_lock);
53089+
53090+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
58c5fc13
MT		 53091+}
53092+
53093+static struct acl_object_label *
53094+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53095+ const struct acl_subject_label *subj, char *path, const int checkglob)
53096+{
53097+ struct dentry *dentry = (struct dentry *) l_dentry;
53098+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53099+ struct acl_object_label *retval;
16454cff 53100+ struct dentry *parent;
58c5fc13 53101+
16454cff 53102+ write_seqlock(&rename_lock);
bc901d79 53103+ br_read_lock(vfsmount_lock);
58c5fc13 53104+
71d190be 53105+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt || mnt == sock_mnt ||
df50ba0c 53106+#ifdef CONFIG_HUGETLBFS
71d190be 53107+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
df50ba0c 53108+#endif
58c5fc13
MT		 53109+ /* ignore Eric Biederman */
53110+ IS_PRIVATE(l_dentry->d_inode))) {
53111+ retval = fakefs_obj;
53112+ goto out;
53113+ }
53114+
53115+ for (;;) {
6892158b 53116+ if (dentry == real_root.dentry && mnt == real_root.mnt)
58c5fc13
MT		 53117+ break;
53118+
53119+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53120+ if (mnt->mnt_parent == mnt)
53121+ break;
53122+
53123+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53124+ if (retval != NULL)
53125+ goto out;
53126+
53127+ dentry = mnt->mnt_mountpoint;
53128+ mnt = mnt->mnt_parent;
53129+ continue;
53130+ }
53131+
16454cff 53132+ parent = dentry->d_parent;
58c5fc13
MT		 53133+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53134+ if (retval != NULL)
53135+ goto out;
53136+
16454cff 53137+ dentry = parent;
58c5fc13
MT		 53138+ }
53139+
53140+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53141+
16454cff 53142+ /* real_root is pinned so we don't have to hold a reference */
58c5fc13 53143+ if (retval == NULL)
6892158b 53144+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
58c5fc13 53145+out:
bc901d79 53146+ br_read_unlock(vfsmount_lock);
16454cff 53147+ write_sequnlock(&rename_lock);
bc901d79
MT		 53148+
53149+ BUG_ON(retval == NULL);
53150+
58c5fc13
MT		 53151+ return retval;
53152+}
53153+
53154+static __inline__ struct acl_object_label *
53155+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53156+ const struct acl_subject_label *subj)
53157+{
53158+ char *path = NULL;
bc901d79 53159+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
58c5fc13
MT		 53160+}
53161+
53162+static __inline__ struct acl_object_label *
53163+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53164+ const struct acl_subject_label *subj)
53165+{
53166+ char *path = NULL;
bc901d79 53167+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
58c5fc13
MT		 53168+}
53169+
53170+static __inline__ struct acl_object_label *
53171+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53172+ const struct acl_subject_label *subj, char *path)
53173+{
bc901d79 53174+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
58c5fc13
MT		 53175+}
53176+
53177+static struct acl_subject_label *
53178+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53179+ const struct acl_role_label *role)
53180+{
53181+ struct dentry *dentry = (struct dentry *) l_dentry;
53182+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53183+ struct acl_subject_label *retval;
16454cff 53184+ struct dentry *parent;
58c5fc13 53185+
16454cff 53186+ write_seqlock(&rename_lock);
bc901d79 53187+ br_read_lock(vfsmount_lock);
58c5fc13
MT		 53188+
53189+ for (;;) {
6892158b 53190+ if (dentry == real_root.dentry && mnt == real_root.mnt)
58c5fc13
MT		 53191+ break;
53192+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53193+ if (mnt->mnt_parent == mnt)
53194+ break;
53195+
16454cff 53196+ spin_lock(&dentry->d_lock);
58c5fc13
MT		 53197+ read_lock(&gr_inode_lock);
53198+ retval =
53199+ lookup_acl_subj_label(dentry->d_inode->i_ino,
16454cff 53200+ __get_dev(dentry), role);
58c5fc13 53201+ read_unlock(&gr_inode_lock);
16454cff 53202+ spin_unlock(&dentry->d_lock);
58c5fc13
MT		 53203+ if (retval != NULL)
53204+ goto out;
53205+
53206+ dentry = mnt->mnt_mountpoint;
53207+ mnt = mnt->mnt_parent;
53208+ continue;
53209+ }
53210+
16454cff 53211+ spin_lock(&dentry->d_lock);
58c5fc13
MT		 53212+ read_lock(&gr_inode_lock);
53213+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
16454cff 53214+ __get_dev(dentry), role);
58c5fc13 53215+ read_unlock(&gr_inode_lock);
16454cff
MT		 53216+ parent = dentry->d_parent;
53217+ spin_unlock(&dentry->d_lock);
53218+
58c5fc13
MT		 53219+ if (retval != NULL)
53220+ goto out;
53221+
16454cff 53222+ dentry = parent;
58c5fc13
MT		 53223+ }
53224+
16454cff 53225+ spin_lock(&dentry->d_lock);
58c5fc13
MT		 53226+ read_lock(&gr_inode_lock);
53227+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
16454cff 53228+ __get_dev(dentry), role);
58c5fc13 53229+ read_unlock(&gr_inode_lock);
16454cff 53230+ spin_unlock(&dentry->d_lock);
58c5fc13
MT		 53231+
53232+ if (unlikely(retval == NULL)) {
16454cff 53233+ /* real_root is pinned, we don't need to hold a reference */
58c5fc13 53234+ read_lock(&gr_inode_lock);
6892158b 53235+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
16454cff 53236+ __get_dev(real_root.dentry), role);
58c5fc13
MT		 53237+ read_unlock(&gr_inode_lock);
53238+ }
53239+out:
bc901d79 53240+ br_read_unlock(vfsmount_lock);
16454cff 53241+ write_sequnlock(&rename_lock);
58c5fc13 53242+
bc901d79
MT		 53243+ BUG_ON(retval == NULL);
53244+
58c5fc13
MT		 53245+ return retval;
53246+}
53247+
53248+static void
53249+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53250+{
53251+ struct task_struct *task = current;
53252+ const struct cred *cred = current_cred();
53253+
53254+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53255+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53256+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
bc901d79 53257+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
58c5fc13
MT		 53258+
53259+ return;
53260+}
53261+
53262+static void
53263+gr_log_learn_sysctl(const char *path, const __u32 mode)
53264+{
53265+ struct task_struct *task = current;
53266+ const struct cred *cred = current_cred();
53267+
53268+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53269+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53270+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
bc901d79 53271+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
58c5fc13
MT		 53272+
53273+ return;
53274+}
53275+
53276+static void
53277+gr_log_learn_id_change(const char type, const unsigned int real,
53278+ const unsigned int effective, const unsigned int fs)
53279+{
53280+ struct task_struct *task = current;
53281+ const struct cred *cred = current_cred();
53282+
53283+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53284+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53285+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
bc901d79 53286+ type, real, effective, fs, &task->signal->saved_ip);
58c5fc13
MT		 53287+
53288+ return;
53289+}
53290+
53291+__u32
53292+gr_check_link(const struct dentry * new_dentry,
53293+ const struct dentry * parent_dentry,
53294+ const struct vfsmount * parent_mnt,
53295+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53296+{
53297+ struct acl_object_label *obj;
53298+ __u32 oldmode, newmode;
53299+ __u32 needmode;
53300+
53301+ if (unlikely(!(gr_status & GR_READY)))
53302+ return (GR_CREATE | GR_LINK);
53303+
53304+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53305+ oldmode = obj->mode;
53306+
53307+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53308+ oldmode |= (GR_CREATE | GR_LINK);
53309+
53310+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
53311+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53312+ needmode |= GR_SETID | GR_AUDIT_SETID;
53313+
53314+ newmode =
53315+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
53316+ oldmode | needmode);
53317+
53318+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
53319+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
53320+ GR_INHERIT | GR_AUDIT_INHERIT);
53321+
53322+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
53323+ goto bad;
53324+
53325+ if ((oldmode & needmode) != needmode)
53326+ goto bad;
53327+
53328+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53329+ if ((newmode & needmode) != needmode)
53330+ goto bad;
53331+
53332+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53333+ return newmode;
53334+bad:
53335+ needmode = oldmode;
53336+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53337+ needmode |= GR_SETID;
53338+
53339+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53340+ gr_log_learn(old_dentry, old_mnt, needmode);
53341+ return (GR_CREATE | GR_LINK);
53342+ } else if (newmode & GR_SUPPRESS)
53343+ return GR_SUPPRESS;
53344+ else
53345+ return 0;
53346+}
53347+
53348+__u32
53349+gr_search_file(const struct dentry * dentry, const __u32 mode,
53350+ const struct vfsmount * mnt)
53351+{
53352+ __u32 retval = mode;
53353+ struct acl_subject_label *curracl;
53354+ struct acl_object_label *currobj;
53355+
53356+ if (unlikely(!(gr_status & GR_READY)))
53357+ return (mode & ~GR_AUDITS);
53358+
53359+ curracl = current->acl;
53360+
53361+ currobj = chk_obj_label(dentry, mnt, curracl);
53362+ retval = currobj->mode & mode;
53363+
16454cff
MT		 53364+ /* if we're opening a specified transfer file for writing
53365+ (e.g. /dev/initctl), then transfer our role to init
53366+ */
53367+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53368+ current->role->roletype & GR_ROLE_PERSIST)) {
53369+ struct task_struct *task = init_pid_ns.child_reaper;
53370+
53371+ if (task->role != current->role) {
53372+ task->acl_sp_role = 0;
53373+ task->acl_role_id = current->acl_role_id;
53374+ task->role = current->role;
53375+ rcu_read_lock();
53376+ read_lock(&grsec_exec_file_lock);
53377+ gr_apply_subject_to_task(task);
53378+ read_unlock(&grsec_exec_file_lock);
53379+ rcu_read_unlock();
53380+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53381+ }
53382+ }
53383+
58c5fc13
MT		 53384+ if (unlikely
53385+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53386+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53387+ __u32 new_mode = mode;
53388+
53389+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53390+
53391+ retval = new_mode;
53392+
53393+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53394+ new_mode |= GR_INHERIT;
53395+
53396+ if (!(mode & GR_NOLEARN))
53397+ gr_log_learn(dentry, mnt, new_mode);
53398+ }
53399+
53400+ return retval;
53401+}
53402+
53403+__u32
53404+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53405+ const struct vfsmount * mnt, const __u32 mode)
53406+{
53407+ struct name_entry *match;
53408+ struct acl_object_label *matchpo;
53409+ struct acl_subject_label *curracl;
53410+ char *path;
53411+ __u32 retval;
53412+
53413+ if (unlikely(!(gr_status & GR_READY)))
53414+ return (mode & ~GR_AUDITS);
53415+
53416+ preempt_disable();
53417+ path = gr_to_filename_rbac(new_dentry, mnt);
53418+ match = lookup_name_entry_create(path);
53419+
53420+ if (!match)
53421+ goto check_parent;
53422+
53423+ curracl = current->acl;
53424+
53425+ read_lock(&gr_inode_lock);
53426+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53427+ read_unlock(&gr_inode_lock);
53428+
53429+ if (matchpo) {
53430+ if ((matchpo->mode & mode) !=
53431+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
53432+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53433+ __u32 new_mode = mode;
53434+
53435+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53436+
53437+ gr_log_learn(new_dentry, mnt, new_mode);
53438+
53439+ preempt_enable();
53440+ return new_mode;
53441+ }
53442+ preempt_enable();
53443+ return (matchpo->mode & mode);
53444+ }
53445+
53446+ check_parent:
53447+ curracl = current->acl;
53448+
53449+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53450+ retval = matchpo->mode & mode;
53451+
53452+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53453+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53454+ __u32 new_mode = mode;
53455+
53456+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53457+
53458+ gr_log_learn(new_dentry, mnt, new_mode);
53459+ preempt_enable();
53460+ return new_mode;
53461+ }
53462+
53463+ preempt_enable();
53464+ return retval;
53465+}
53466+
53467+int
53468+gr_check_hidden_task(const struct task_struct *task)
53469+{
53470+ if (unlikely(!(gr_status & GR_READY)))
53471+ return 0;
53472+
53473+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53474+ return 1;
53475+
53476+ return 0;
53477+}
53478+
53479+int
53480+gr_check_protected_task(const struct task_struct *task)
53481+{
53482+ if (unlikely(!(gr_status & GR_READY) || !task))
53483+ return 0;
53484+
53485+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53486+ task->acl != current->acl)
53487+ return 1;
53488+
53489+ return 0;
53490+}
53491+
57199397
MT		 53492+int
53493+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53494+{
53495+ struct task_struct *p;
53496+ int ret = 0;
53497+
53498+ if (unlikely(!(gr_status & GR_READY) || !pid))
53499+ return ret;
53500+
53501+ read_lock(&tasklist_lock);
53502+ do_each_pid_task(pid, type, p) {
53503+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53504+ p->acl != current->acl) {
53505+ ret = 1;
53506+ goto out;
53507+ }
53508+ } while_each_pid_task(pid, type, p);
53509+out:
53510+ read_unlock(&tasklist_lock);
53511+
53512+ return ret;
53513+}
53514+
58c5fc13
MT		 53515+void
53516+gr_copy_label(struct task_struct *tsk)
53517+{
53518+ tsk->signal->used_accept = 0;
53519+ tsk->acl_sp_role = 0;
53520+ tsk->acl_role_id = current->acl_role_id;
53521+ tsk->acl = current->acl;
53522+ tsk->role = current->role;
53523+ tsk->signal->curr_ip = current->signal->curr_ip;
bc901d79 53524+ tsk->signal->saved_ip = current->signal->saved_ip;
58c5fc13
MT		 53525+ if (current->exec_file)
53526+ get_file(current->exec_file);
53527+ tsk->exec_file = current->exec_file;
53528+ tsk->is_writable = current->is_writable;
bc901d79 53529+ if (unlikely(current->signal->used_accept)) {
58c5fc13 53530+ current->signal->curr_ip = 0;
bc901d79
MT		 53531+ current->signal->saved_ip = 0;
53532+ }
58c5fc13
MT		 53533+
53534+ return;
53535+}
53536+
53537+static void
53538+gr_set_proc_res(struct task_struct *task)
53539+{
53540+ struct acl_subject_label *proc;
53541+ unsigned short i;
53542+
53543+ proc = task->acl;
53544+
53545+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53546+ return;
53547+
53548+ for (i = 0; i < RLIM_NLIMITS; i++) {
53549+ if (!(proc->resmask & (1 << i)))
53550+ continue;
53551+
53552+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53553+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53554+ }
53555+
53556+ return;
53557+}
53558+
66a7e928
MT		 53559+extern int __gr_process_user_ban(struct user_struct *user);
53560+
58c5fc13
MT		 53561+int
53562+gr_check_user_change(int real, int effective, int fs)
53563+{
53564+ unsigned int i;
53565+ __u16 num;
53566+ uid_t *uidlist;
53567+ int curuid;
53568+ int realok = 0;
53569+ int effectiveok = 0;
53570+ int fsok = 0;
53571+
66a7e928
MT		 53572+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53573+ struct user_struct *user;
53574+
53575+ if (real == -1)
53576+ goto skipit;
53577+
53578+ user = find_user(real);
53579+ if (user == NULL)
53580+ goto skipit;
53581+
53582+ if (__gr_process_user_ban(user)) {
53583+ /* for find_user */
53584+ free_uid(user);
53585+ return 1;
53586+ }
53587+
53588+ /* for find_user */
53589+ free_uid(user);
53590+
53591+skipit:
53592+#endif
53593+
58c5fc13
MT		 53594+ if (unlikely(!(gr_status & GR_READY)))
53595+ return 0;
53596+
53597+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53598+ gr_log_learn_id_change('u', real, effective, fs);
53599+
53600+ num = current->acl->user_trans_num;
53601+ uidlist = current->acl->user_transitions;
53602+
53603+ if (uidlist == NULL)
53604+ return 0;
53605+
53606+ if (real == -1)
53607+ realok = 1;
53608+ if (effective == -1)
53609+ effectiveok = 1;
53610+ if (fs == -1)
53611+ fsok = 1;
53612+
53613+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53614+ for (i = 0; i < num; i++) {
53615+ curuid = (int)uidlist[i];
53616+ if (real == curuid)
53617+ realok = 1;
53618+ if (effective == curuid)
53619+ effectiveok = 1;
53620+ if (fs == curuid)
53621+ fsok = 1;
53622+ }
53623+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53624+ for (i = 0; i < num; i++) {
53625+ curuid = (int)uidlist[i];
53626+ if (real == curuid)
53627+ break;
53628+ if (effective == curuid)
53629+ break;
53630+ if (fs == curuid)
53631+ break;
53632+ }
53633+ /* not in deny list */
53634+ if (i == num) {
53635+ realok = 1;
53636+ effectiveok = 1;
53637+ fsok = 1;
53638+ }
53639+ }
53640+
53641+ if (realok && effectiveok && fsok)
53642+ return 0;
53643+ else {
53644+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53645+ return 1;
53646+ }
53647+}
53648+
53649+int
53650+gr_check_group_change(int real, int effective, int fs)
53651+{
53652+ unsigned int i;
53653+ __u16 num;
53654+ gid_t *gidlist;
53655+ int curgid;
53656+ int realok = 0;
53657+ int effectiveok = 0;
53658+ int fsok = 0;
53659+
53660+ if (unlikely(!(gr_status & GR_READY)))
53661+ return 0;
53662+
53663+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53664+ gr_log_learn_id_change('g', real, effective, fs);
53665+
53666+ num = current->acl->group_trans_num;
53667+ gidlist = current->acl->group_transitions;
53668+
53669+ if (gidlist == NULL)
53670+ return 0;
53671+
53672+ if (real == -1)
53673+ realok = 1;
53674+ if (effective == -1)
53675+ effectiveok = 1;
53676+ if (fs == -1)
53677+ fsok = 1;
53678+
53679+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
53680+ for (i = 0; i < num; i++) {
53681+ curgid = (int)gidlist[i];
53682+ if (real == curgid)
53683+ realok = 1;
53684+ if (effective == curgid)
53685+ effectiveok = 1;
53686+ if (fs == curgid)
53687+ fsok = 1;
53688+ }
53689+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
53690+ for (i = 0; i < num; i++) {
53691+ curgid = (int)gidlist[i];
53692+ if (real == curgid)
53693+ break;
53694+ if (effective == curgid)
53695+ break;
53696+ if (fs == curgid)
53697+ break;
53698+ }
53699+ /* not in deny list */
53700+ if (i == num) {
53701+ realok = 1;
53702+ effectiveok = 1;
53703+ fsok = 1;
53704+ }
53705+ }
53706+
53707+ if (realok && effectiveok && fsok)
53708+ return 0;
53709+ else {
53710+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53711+ return 1;
53712+ }
53713+}
53714+
53715+void
53716+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53717+{
53718+ struct acl_role_label *role = task->role;
53719+ struct acl_subject_label *subj = NULL;
53720+ struct acl_object_label *obj;
53721+ struct file *filp;
53722+
53723+ if (unlikely(!(gr_status & GR_READY)))
53724+ return;
53725+
53726+ filp = task->exec_file;
53727+
53728+ /* kernel process, we'll give them the kernel role */
53729+ if (unlikely(!filp)) {
53730+ task->role = kernel_role;
53731+ task->acl = kernel_role->root_label;
53732+ return;
53733+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53734+ role = lookup_acl_role_label(task, uid, gid);
53735+
53736+ /* perform subject lookup in possibly new role
53737+ we can use this result below in the case where role == task->role
53738+ */
53739+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53740+
53741+ /* if we changed uid/gid, but result in the same role
53742+ and are using inheritance, don't lose the inherited subject
53743+ if current subject is other than what normal lookup
53744+ would result in, we arrived via inheritance, don't
53745+ lose subject
53746+ */
53747+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53748+ (subj == task->acl)))
53749+ task->acl = subj;
53750+
53751+ task->role = role;
53752+
53753+ task->is_writable = 0;
53754+
53755+ /* ignore additional mmap checks for processes that are writable
53756+ by the default ACL */
53757+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53758+ if (unlikely(obj->mode & GR_WRITE))
53759+ task->is_writable = 1;
53760+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53761+ if (unlikely(obj->mode & GR_WRITE))
53762+ task->is_writable = 1;
53763+
16454cff 53764+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
58c5fc13
MT		 53765+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53766+#endif
53767+
53768+ gr_set_proc_res(task);
53769+
53770+ return;
53771+}
53772+
53773+int
53774+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53775+ const int unsafe_share)
53776+{
53777+ struct task_struct *task = current;
53778+ struct acl_subject_label *newacl;
53779+ struct acl_object_label *obj;
53780+ __u32 retmode;
53781+
53782+ if (unlikely(!(gr_status & GR_READY)))
53783+ return 0;
53784+
53785+ newacl = chk_subj_label(dentry, mnt, task->role);
53786+
53787+ task_lock(task);
ae4e228f
MT		 53788+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53789+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
58c5fc13
MT		 53790+ !(task->role->roletype & GR_ROLE_GOD) &&
53791+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
ae4e228f 53792+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
58c5fc13 53793+ task_unlock(task);
ae4e228f
MT		 53794+ if (unsafe_share)
53795+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53796+ else
53797+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
58c5fc13
MT		 53798+ return -EACCES;
53799+ }
53800+ task_unlock(task);
53801+
53802+ obj = chk_obj_label(dentry, mnt, task->acl);
53803+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53804+
53805+ if (!(task->acl->mode & GR_INHERITLEARN) &&
53806+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53807+ if (obj->nested)
53808+ task->acl = obj->nested;
53809+ else
53810+ task->acl = newacl;
53811+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53812+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53813+
53814+ task->is_writable = 0;
53815+
53816+ /* ignore additional mmap checks for processes that are writable
53817+ by the default ACL */
53818+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
53819+ if (unlikely(obj->mode & GR_WRITE))
53820+ task->is_writable = 1;
53821+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
53822+ if (unlikely(obj->mode & GR_WRITE))
53823+ task->is_writable = 1;
53824+
53825+ gr_set_proc_res(task);
53826+
16454cff 53827+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
58c5fc13
MT		 53828+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53829+#endif
53830+ return 0;
53831+}
53832+
53833+/* always called with valid inodev ptr */
53834+static void
53835+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53836+{
53837+ struct acl_object_label *matchpo;
53838+ struct acl_subject_label *matchps;
53839+ struct acl_subject_label *subj;
53840+ struct acl_role_label *role;
ae4e228f 53841+ unsigned int x;
58c5fc13 53842+
ae4e228f 53843+ FOR_EACH_ROLE_START(role)
58c5fc13
MT		 53844+ FOR_EACH_SUBJECT_START(role, subj, x)
53845+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53846+ matchpo->mode |= GR_DELETED;
53847+ FOR_EACH_SUBJECT_END(subj,x)
53848+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53849+ if (subj->inode == ino && subj->device == dev)
53850+ subj->mode |= GR_DELETED;
53851+ FOR_EACH_NESTED_SUBJECT_END(subj)
53852+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53853+ matchps->mode |= GR_DELETED;
ae4e228f 53854+ FOR_EACH_ROLE_END(role)
58c5fc13
MT		 53855+
53856+ inodev->nentry->deleted = 1;
53857+
53858+ return;
53859+}
53860+
53861+void
53862+gr_handle_delete(const ino_t ino, const dev_t dev)
53863+{
53864+ struct inodev_entry *inodev;
53865+
53866+ if (unlikely(!(gr_status & GR_READY)))
53867+ return;
53868+
53869+ write_lock(&gr_inode_lock);
53870+ inodev = lookup_inodev_entry(ino, dev);
53871+ if (inodev != NULL)
53872+ do_handle_delete(inodev, ino, dev);
53873+ write_unlock(&gr_inode_lock);
53874+
53875+ return;
53876+}
53877+
53878+static void
53879+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53880+ const ino_t newinode, const dev_t newdevice,
53881+ struct acl_subject_label *subj)
53882+{
53883+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53884+ struct acl_object_label *match;
53885+
53886+ match = subj->obj_hash[index];
53887+
53888+ while (match && (match->inode != oldinode ||
53889+ match->device != olddevice ||
53890+ !(match->mode & GR_DELETED)))
53891+ match = match->next;
53892+
53893+ if (match && (match->inode == oldinode)
53894+ && (match->device == olddevice)
53895+ && (match->mode & GR_DELETED)) {
53896+ if (match->prev == NULL) {
53897+ subj->obj_hash[index] = match->next;
53898+ if (match->next != NULL)
53899+ match->next->prev = NULL;
53900+ } else {
53901+ match->prev->next = match->next;
53902+ if (match->next != NULL)
53903+ match->next->prev = match->prev;
53904+ }
53905+ match->prev = NULL;
53906+ match->next = NULL;
53907+ match->inode = newinode;
53908+ match->device = newdevice;
53909+ match->mode &= ~GR_DELETED;
53910+
53911+ insert_acl_obj_label(match, subj);
53912+ }
53913+
53914+ return;
53915+}
53916+
53917+static void
53918+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53919+ const ino_t newinode, const dev_t newdevice,
53920+ struct acl_role_label *role)
53921+{
53922+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53923+ struct acl_subject_label *match;
53924+
53925+ match = role->subj_hash[index];
53926+
53927+ while (match && (match->inode != oldinode ||
53928+ match->device != olddevice ||
53929+ !(match->mode & GR_DELETED)))
53930+ match = match->next;
53931+
53932+ if (match && (match->inode == oldinode)
53933+ && (match->device == olddevice)
53934+ && (match->mode & GR_DELETED)) {
53935+ if (match->prev == NULL) {
53936+ role->subj_hash[index] = match->next;
53937+ if (match->next != NULL)
53938+ match->next->prev = NULL;
53939+ } else {
53940+ match->prev->next = match->next;
53941+ if (match->next != NULL)
53942+ match->next->prev = match->prev;
53943+ }
53944+ match->prev = NULL;
53945+ match->next = NULL;
53946+ match->inode = newinode;
53947+ match->device = newdevice;
53948+ match->mode &= ~GR_DELETED;
53949+
53950+ insert_acl_subj_label(match, role);
53951+ }
53952+
53953+ return;
53954+}
53955+
53956+static void
53957+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53958+ const ino_t newinode, const dev_t newdevice)
53959+{
53960+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53961+ struct inodev_entry *match;
53962+
53963+ match = inodev_set.i_hash[index];
53964+
53965+ while (match && (match->nentry->inode != oldinode ||
53966+ match->nentry->device != olddevice || !match->nentry->deleted))
53967+ match = match->next;
53968+
53969+ if (match && (match->nentry->inode == oldinode)
53970+ && (match->nentry->device == olddevice) &&
53971+ match->nentry->deleted) {
53972+ if (match->prev == NULL) {
53973+ inodev_set.i_hash[index] = match->next;
53974+ if (match->next != NULL)
53975+ match->next->prev = NULL;
53976+ } else {
53977+ match->prev->next = match->next;
53978+ if (match->next != NULL)
53979+ match->next->prev = match->prev;
53980+ }
53981+ match->prev = NULL;
53982+ match->next = NULL;
53983+ match->nentry->inode = newinode;
53984+ match->nentry->device = newdevice;
53985+ match->nentry->deleted = 0;
53986+
53987+ insert_inodev_entry(match);
53988+ }
53989+
53990+ return;
53991+}
53992+
53993+static void
53994+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
53995+ const struct vfsmount *mnt)
53996+{
53997+ struct acl_subject_label *subj;
53998+ struct acl_role_label *role;
ae4e228f 53999+ unsigned int x;
16454cff
MT		 54000+ ino_t ino = dentry->d_inode->i_ino;
54001+ dev_t dev = __get_dev(dentry);
ae4e228f
MT		 54002+
54003+ FOR_EACH_ROLE_START(role)
16454cff 54004+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
58c5fc13
MT		 54005+
54006+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
16454cff
MT		 54007+ if ((subj->inode == ino) && (subj->device == dev)) {
54008+ subj->inode = ino;
54009+ subj->device = dev;
58c5fc13
MT		 54010+ }
54011+ FOR_EACH_NESTED_SUBJECT_END(subj)
54012+ FOR_EACH_SUBJECT_START(role, subj, x)
54013+ update_acl_obj_label(matchn->inode, matchn->device,
16454cff 54014+ ino, dev, subj);
58c5fc13 54015+ FOR_EACH_SUBJECT_END(subj,x)
ae4e228f 54016+ FOR_EACH_ROLE_END(role)
58c5fc13 54017+
16454cff 54018+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
58c5fc13
MT		 54019+
54020+ return;
54021+}
54022+
54023+void
54024+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54025+{
54026+ struct name_entry *matchn;
54027+
54028+ if (unlikely(!(gr_status & GR_READY)))
54029+ return;
54030+
54031+ preempt_disable();
54032+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54033+
54034+ if (unlikely((unsigned long)matchn)) {
54035+ write_lock(&gr_inode_lock);
54036+ do_handle_create(matchn, dentry, mnt);
54037+ write_unlock(&gr_inode_lock);
54038+ }
54039+ preempt_enable();
54040+
54041+ return;
54042+}
54043+
54044+void
54045+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54046+ struct dentry *old_dentry,
54047+ struct dentry *new_dentry,
54048+ struct vfsmount *mnt, const __u8 replace)
54049+{
54050+ struct name_entry *matchn;
54051+ struct inodev_entry *inodev;
16454cff
MT		 54052+ ino_t old_ino = old_dentry->d_inode->i_ino;
54053+ dev_t old_dev = __get_dev(old_dentry);
58c5fc13
MT		 54054+
54055+ /* vfs_rename swaps the name and parent link for old_dentry and
54056+ new_dentry
54057+ at this point, old_dentry has the new name, parent link, and inode
54058+ for the renamed file
54059+ if a file is being replaced by a rename, new_dentry has the inode
54060+ and name for the replaced file
54061+ */
54062+
54063+ if (unlikely(!(gr_status & GR_READY)))
54064+ return;
54065+
54066+ preempt_disable();
54067+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54068+
54069+ /* we wouldn't have to check d_inode if it weren't for
54070+ NFS silly-renaming
54071+ */
54072+
54073+ write_lock(&gr_inode_lock);
54074+ if (unlikely(replace && new_dentry->d_inode)) {
16454cff
MT		 54075+ ino_t new_ino = new_dentry->d_inode->i_ino;
54076+ dev_t new_dev = __get_dev(new_dentry);
54077+
54078+ inodev = lookup_inodev_entry(new_ino, new_dev);
58c5fc13 54079+ if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
16454cff 54080+ do_handle_delete(inodev, new_ino, new_dev);
58c5fc13
MT		 54081+ }
54082+
16454cff 54083+ inodev = lookup_inodev_entry(old_ino, old_dev);
58c5fc13 54084+ if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
16454cff 54085+ do_handle_delete(inodev, old_ino, old_dev);
58c5fc13
MT		 54086+
54087+ if (unlikely((unsigned long)matchn))
54088+ do_handle_create(matchn, old_dentry, mnt);
54089+
54090+ write_unlock(&gr_inode_lock);
54091+ preempt_enable();
54092+
54093+ return;
54094+}
54095+
54096+static int
54097+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54098+ unsigned char **sum)
54099+{
54100+ struct acl_role_label *r;
54101+ struct role_allowed_ip *ipp;
54102+ struct role_transition *trans;
54103+ unsigned int i;
54104+ int found = 0;
bc901d79
MT		 54105+ u32 curr_ip = current->signal->curr_ip;
54106+
54107+ current->signal->saved_ip = curr_ip;
58c5fc13
MT		 54108+
54109+ /* check transition table */
54110+
54111+ for (trans = current->role->transitions; trans; trans = trans->next) {
54112+ if (!strcmp(rolename, trans->rolename)) {
54113+ found = 1;
54114+ break;
54115+ }
54116+ }
54117+
54118+ if (!found)
54119+ return 0;
54120+
54121+ /* handle special roles that do not require authentication
54122+ and check ip */
54123+
ae4e228f 54124+ FOR_EACH_ROLE_START(r)
58c5fc13
MT		 54125+ if (!strcmp(rolename, r->rolename) &&
54126+ (r->roletype & GR_ROLE_SPECIAL)) {
54127+ found = 0;
54128+ if (r->allowed_ips != NULL) {
54129+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
bc901d79 54130+ if ((ntohl(curr_ip) & ipp->netmask) ==
58c5fc13
MT		 54131+ (ntohl(ipp->addr) & ipp->netmask))
54132+ found = 1;
54133+ }
54134+ } else
54135+ found = 2;
54136+ if (!found)
54137+ return 0;
54138+
54139+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54140+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54141+ *salt = NULL;
54142+ *sum = NULL;
54143+ return 1;
54144+ }
54145+ }
ae4e228f 54146+ FOR_EACH_ROLE_END(r)
58c5fc13
MT		 54147+
54148+ for (i = 0; i < num_sprole_pws; i++) {
54149+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54150+ *salt = acl_special_roles[i]->salt;
54151+ *sum = acl_special_roles[i]->sum;
54152+ return 1;
54153+ }
54154+ }
54155+
54156+ return 0;
54157+}
54158+
54159+static void
54160+assign_special_role(char *rolename)
54161+{
54162+ struct acl_object_label *obj;
54163+ struct acl_role_label *r;
54164+ struct acl_role_label *assigned = NULL;
54165+ struct task_struct *tsk;
54166+ struct file *filp;
58c5fc13 54167+
ae4e228f 54168+ FOR_EACH_ROLE_START(r)
58c5fc13 54169+ if (!strcmp(rolename, r->rolename) &&
ae4e228f 54170+ (r->roletype & GR_ROLE_SPECIAL)) {
58c5fc13 54171+ assigned = r;
ae4e228f
MT		 54172+ break;
54173+ }
54174+ FOR_EACH_ROLE_END(r)
58c5fc13
MT		 54175+
54176+ if (!assigned)
54177+ return;
54178+
54179+ read_lock(&tasklist_lock);
54180+ read_lock(&grsec_exec_file_lock);
54181+
6892158b 54182+ tsk = current->real_parent;
58c5fc13
MT		 54183+ if (tsk == NULL)
54184+ goto out_unlock;
54185+
54186+ filp = tsk->exec_file;
54187+ if (filp == NULL)
54188+ goto out_unlock;
54189+
54190+ tsk->is_writable = 0;
54191+
54192+ tsk->acl_sp_role = 1;
54193+ tsk->acl_role_id = ++acl_sp_role_value;
54194+ tsk->role = assigned;
54195+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54196+
54197+ /* ignore additional mmap checks for processes that are writable
54198+ by the default ACL */
54199+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54200+ if (unlikely(obj->mode & GR_WRITE))
54201+ tsk->is_writable = 1;
54202+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54203+ if (unlikely(obj->mode & GR_WRITE))
54204+ tsk->is_writable = 1;
54205+
16454cff 54206+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
58c5fc13
MT		 54207+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54208+#endif
54209+
54210+out_unlock:
54211+ read_unlock(&grsec_exec_file_lock);
54212+ read_unlock(&tasklist_lock);
54213+ return;
54214+}
54215+
54216+int gr_check_secure_terminal(struct task_struct *task)
54217+{
54218+ struct task_struct *p, *p2, *p3;
54219+ struct files_struct *files;
54220+ struct fdtable *fdt;
54221+ struct file *our_file = NULL, *file;
54222+ int i;
54223+
54224+ if (task->signal->tty == NULL)
54225+ return 1;
54226+
54227+ files = get_files_struct(task);
54228+ if (files != NULL) {
54229+ rcu_read_lock();
54230+ fdt = files_fdtable(files);
54231+ for (i=0; i < fdt->max_fds; i++) {
54232+ file = fcheck_files(files, i);
54233+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54234+ get_file(file);
54235+ our_file = file;
54236+ }
54237+ }
54238+ rcu_read_unlock();
54239+ put_files_struct(files);
54240+ }
54241+
54242+ if (our_file == NULL)
54243+ return 1;
54244+
54245+ read_lock(&tasklist_lock);
54246+ do_each_thread(p2, p) {
54247+ files = get_files_struct(p);
54248+ if (files == NULL ||
54249+ (p->signal && p->signal->tty == task->signal->tty)) {
54250+ if (files != NULL)
54251+ put_files_struct(files);
54252+ continue;
54253+ }
54254+ rcu_read_lock();
54255+ fdt = files_fdtable(files);
54256+ for (i=0; i < fdt->max_fds; i++) {
54257+ file = fcheck_files(files, i);
54258+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54259+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54260+ p3 = task;
54261+ while (p3->pid > 0) {
54262+ if (p3 == p)
54263+ break;
6892158b 54264+ p3 = p3->real_parent;
58c5fc13
MT		 54265+ }
54266+ if (p3 == p)
54267+ break;
54268+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54269+ gr_handle_alertkill(p);
54270+ rcu_read_unlock();
54271+ put_files_struct(files);
54272+ read_unlock(&tasklist_lock);
54273+ fput(our_file);
54274+ return 0;
54275+ }
54276+ }
54277+ rcu_read_unlock();
54278+ put_files_struct(files);
54279+ } while_each_thread(p2, p);
54280+ read_unlock(&tasklist_lock);
54281+
54282+ fput(our_file);
54283+ return 1;
54284+}
54285+
54286+ssize_t
54287+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54288+{
54289+ struct gr_arg_wrapper uwrap;
ae4e228f
MT		 54290+ unsigned char *sprole_salt = NULL;
54291+ unsigned char *sprole_sum = NULL;
58c5fc13
MT		 54292+ int error = sizeof (struct gr_arg_wrapper);
54293+ int error2 = 0;
54294+
bc901d79 54295+ mutex_lock(&gr_dev_mutex);
58c5fc13
MT		 54296+
54297+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54298+ error = -EPERM;
54299+ goto out;
54300+ }
54301+
54302+ if (count != sizeof (struct gr_arg_wrapper)) {
54303+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54304+ error = -EINVAL;
54305+ goto out;
54306+ }
54307+
54308+
54309+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54310+ gr_auth_expires = 0;
54311+ gr_auth_attempts = 0;
54312+ }
54313+
54314+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54315+ error = -EFAULT;
54316+ goto out;
54317+ }
54318+
54319+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54320+ error = -EINVAL;
54321+ goto out;
54322+ }
54323+
54324+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54325+ error = -EFAULT;
54326+ goto out;
54327+ }
54328+
54329+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54330+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54331+ time_after(gr_auth_expires, get_seconds())) {
54332+ error = -EBUSY;
54333+ goto out;
54334+ }
54335+
54336+ /* if non-root trying to do anything other than use a special role,
54337+ do not attempt authentication, do not count towards authentication
54338+ locking
54339+ */
54340+
54341+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54342+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54343+ current_uid()) {
54344+ error = -EPERM;
54345+ goto out;
54346+ }
54347+
54348+ /* ensure pw and special role name are null terminated */
54349+
54350+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54351+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54352+
54353+ /* Okay.
54354+ * We have our enough of the argument structure..(we have yet
54355+ * to copy_from_user the tables themselves) . Copy the tables
54356+ * only if we need them, i.e. for loading operations. */
54357+
54358+ switch (gr_usermode->mode) {
54359+ case GR_STATUS:
54360+ if (gr_status & GR_READY) {
54361+ error = 1;
54362+ if (!gr_check_secure_terminal(current))
54363+ error = 3;
54364+ } else
54365+ error = 2;
54366+ goto out;
54367+ case GR_SHUTDOWN:
54368+ if ((gr_status & GR_READY)
54369+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
ae4e228f 54370+ pax_open_kernel();
58c5fc13 54371+ gr_status &= ~GR_READY;
ae4e228f
MT		 54372+ pax_close_kernel();
54373+
58c5fc13
MT		 54374+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54375+ free_variables();
54376+ memset(gr_usermode, 0, sizeof (struct gr_arg));
54377+ memset(gr_system_salt, 0, GR_SALT_LEN);
54378+ memset(gr_system_sum, 0, GR_SHA_LEN);
54379+ } else if (gr_status & GR_READY) {
54380+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54381+ error = -EPERM;
54382+ } else {
54383+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54384+ error = -EAGAIN;
54385+ }
54386+ break;
54387+ case GR_ENABLE:
54388+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54389+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54390+ else {
54391+ if (gr_status & GR_READY)
54392+ error = -EAGAIN;
54393+ else
54394+ error = error2;
54395+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54396+ }
54397+ break;
54398+ case GR_RELOAD:
54399+ if (!(gr_status & GR_READY)) {
54400+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54401+ error = -EAGAIN;
54402+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
c52201e0 54403+ preempt_disable();
58c5fc13 54404+
ae4e228f 54405+ pax_open_kernel();
58c5fc13 54406+ gr_status &= ~GR_READY;
ae4e228f
MT		 54407+ pax_close_kernel();
54408+
58c5fc13
MT		 54409+ free_variables();
54410+ if (!(error2 = gracl_init(gr_usermode))) {
c52201e0 54411+ preempt_enable();
58c5fc13
MT		 54412+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54413+ } else {
c52201e0 54414+ preempt_enable();
58c5fc13
MT		 54415+ error = error2;
54416+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54417+ }
54418+ } else {
54419+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54420+ error = -EPERM;
54421+ }
54422+ break;
54423+ case GR_SEGVMOD:
54424+ if (unlikely(!(gr_status & GR_READY))) {
54425+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54426+ error = -EAGAIN;
54427+ break;
54428+ }
54429+
54430+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54431+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54432+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54433+ struct acl_subject_label *segvacl;
54434+ segvacl =
54435+ lookup_acl_subj_label(gr_usermode->segv_inode,
54436+ gr_usermode->segv_device,
54437+ current->role);
54438+ if (segvacl) {
54439+ segvacl->crashes = 0;
54440+ segvacl->expires = 0;
54441+ }
54442+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54443+ gr_remove_uid(gr_usermode->segv_uid);
54444+ }
54445+ } else {
54446+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54447+ error = -EPERM;
54448+ }
54449+ break;
54450+ case GR_SPROLE:
54451+ case GR_SPROLEPAM:
54452+ if (unlikely(!(gr_status & GR_READY))) {
54453+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54454+ error = -EAGAIN;
54455+ break;
54456+ }
54457+
54458+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54459+ current->role->expires = 0;
54460+ current->role->auth_attempts = 0;
54461+ }
54462+
54463+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54464+ time_after(current->role->expires, get_seconds())) {
54465+ error = -EBUSY;
54466+ goto out;
54467+ }
54468+
54469+ if (lookup_special_role_auth
54470+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54471+ && ((!sprole_salt && !sprole_sum)
54472+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54473+ char *p = "";
54474+ assign_special_role(gr_usermode->sp_role);
54475+ read_lock(&tasklist_lock);
6892158b
MT		 54476+ if (current->real_parent)
54477+ p = current->real_parent->role->rolename;
58c5fc13
MT		 54478+ read_unlock(&tasklist_lock);
54479+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54480+ p, acl_sp_role_value);
54481+ } else {
54482+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54483+ error = -EPERM;
54484+ if(!(current->role->auth_attempts++))
54485+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54486+
54487+ goto out;
54488+ }
54489+ break;
54490+ case GR_UNSPROLE:
54491+ if (unlikely(!(gr_status & GR_READY))) {
54492+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54493+ error = -EAGAIN;
54494+ break;
54495+ }
54496+
54497+ if (current->role->roletype & GR_ROLE_SPECIAL) {
54498+ char *p = "";
54499+ int i = 0;
54500+
54501+ read_lock(&tasklist_lock);
6892158b
MT		 54502+ if (current->real_parent) {
54503+ p = current->real_parent->role->rolename;
54504+ i = current->real_parent->acl_role_id;
58c5fc13
MT		 54505+ }
54506+ read_unlock(&tasklist_lock);
54507+
54508+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54509+ gr_set_acls(1);
54510+ } else {
58c5fc13
MT		 54511+ error = -EPERM;
54512+ goto out;
54513+ }
54514+ break;
54515+ default:
54516+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54517+ error = -EINVAL;
54518+ break;
54519+ }
54520+
54521+ if (error != -EPERM)
54522+ goto out;
54523+
54524+ if(!(gr_auth_attempts++))
54525+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54526+
54527+ out:
bc901d79 54528+ mutex_unlock(&gr_dev_mutex);
58c5fc13
MT		 54529+ return error;
54530+}
54531+
16454cff
MT		 54532+/* must be called with
54533+ rcu_read_lock();
54534+ read_lock(&tasklist_lock);
54535+ read_lock(&grsec_exec_file_lock);
54536+*/
54537+int gr_apply_subject_to_task(struct task_struct *task)
54538+{
54539+ struct acl_object_label *obj;
54540+ char *tmpname;
54541+ struct acl_subject_label *tmpsubj;
54542+ struct file *filp;
54543+ struct name_entry *nmatch;
54544+
54545+ filp = task->exec_file;
54546+ if (filp == NULL)
54547+ return 0;
54548+
54549+ /* the following is to apply the correct subject
54550+ on binaries running when the RBAC system
54551+ is enabled, when the binaries have been
54552+ replaced or deleted since their execution
54553+ -----
54554+ when the RBAC system starts, the inode/dev
54555+ from exec_file will be one the RBAC system
54556+ is unaware of. It only knows the inode/dev
54557+ of the present file on disk, or the absence
54558+ of it.
54559+ */
54560+ preempt_disable();
54561+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54562+
54563+ nmatch = lookup_name_entry(tmpname);
54564+ preempt_enable();
54565+ tmpsubj = NULL;
54566+ if (nmatch) {
54567+ if (nmatch->deleted)
54568+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54569+ else
54570+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54571+ if (tmpsubj != NULL)
54572+ task->acl = tmpsubj;
54573+ }
54574+ if (tmpsubj == NULL)
54575+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54576+ task->role);
54577+ if (task->acl) {
54578+ struct acl_subject_label *curr;
54579+ curr = task->acl;
54580+
54581+ task->is_writable = 0;
54582+ /* ignore additional mmap checks for processes that are writable
54583+ by the default ACL */
54584+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54585+ if (unlikely(obj->mode & GR_WRITE))
54586+ task->is_writable = 1;
54587+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54588+ if (unlikely(obj->mode & GR_WRITE))
54589+ task->is_writable = 1;
54590+
54591+ gr_set_proc_res(task);
54592+
54593+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54594+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54595+#endif
54596+ } else {
54597+ return 1;
54598+ }
54599+
54600+ return 0;
54601+}
54602+
58c5fc13
MT		 54603+int
54604+gr_set_acls(const int type)
54605+{
58c5fc13 54606+ struct task_struct *task, *task2;
58c5fc13
MT		 54607+ struct acl_role_label *role = current->role;
54608+ __u16 acl_role_id = current->acl_role_id;
54609+ const struct cred *cred;
16454cff 54610+ int ret;
58c5fc13 54611+
ae4e228f 54612+ rcu_read_lock();
58c5fc13
MT		 54613+ read_lock(&tasklist_lock);
54614+ read_lock(&grsec_exec_file_lock);
54615+ do_each_thread(task2, task) {
54616+ /* check to see if we're called from the exit handler,
54617+ if so, only replace ACLs that have inherited the admin
54618+ ACL */
54619+
54620+ if (type && (task->role != role ||
54621+ task->acl_role_id != acl_role_id))
54622+ continue;
54623+
54624+ task->acl_role_id = 0;
54625+ task->acl_sp_role = 0;
54626+
16454cff 54627+ if (task->exec_file) {
58c5fc13
MT		 54628+ cred = __task_cred(task);
54629+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
16454cff
MT		 54630+ ret = gr_apply_subject_to_task(task);
54631+ if (ret) {
58c5fc13
MT		 54632+ read_unlock(&grsec_exec_file_lock);
54633+ read_unlock(&tasklist_lock);
ae4e228f 54634+ rcu_read_unlock();
58c5fc13 54635+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
16454cff 54636+ return ret;
58c5fc13
MT		 54637+ }
54638+ } else {
54639+ // it's a kernel process
54640+ task->role = kernel_role;
54641+ task->acl = kernel_role->root_label;
54642+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54643+ task->acl->mode &= ~GR_PROCFIND;
54644+#endif
54645+ }
54646+ } while_each_thread(task2, task);
54647+ read_unlock(&grsec_exec_file_lock);
54648+ read_unlock(&tasklist_lock);
ae4e228f
MT		 54649+ rcu_read_unlock();
54650+
58c5fc13
MT		 54651+ return 0;
54652+}
54653+
54654+void
54655+gr_learn_resource(const struct task_struct *task,
54656+ const int res, const unsigned long wanted, const int gt)
54657+{
54658+ struct acl_subject_label *acl;
54659+ const struct cred *cred;
54660+
54661+ if (unlikely((gr_status & GR_READY) &&
54662+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54663+ goto skip_reslog;
54664+
54665+#ifdef CONFIG_GRKERNSEC_RESLOG
54666+ gr_log_resource(task, res, wanted, gt);
54667+#endif
54668+ skip_reslog:
54669+
54670+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54671+ return;
54672+
54673+ acl = task->acl;
54674+
54675+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54676+ !(acl->resmask & (1 << (unsigned short) res))))
54677+ return;
54678+
54679+ if (wanted >= acl->res[res].rlim_cur) {
54680+ unsigned long res_add;
54681+
54682+ res_add = wanted;
54683+ switch (res) {
54684+ case RLIMIT_CPU:
54685+ res_add += GR_RLIM_CPU_BUMP;
54686+ break;
54687+ case RLIMIT_FSIZE:
54688+ res_add += GR_RLIM_FSIZE_BUMP;
54689+ break;
54690+ case RLIMIT_DATA:
54691+ res_add += GR_RLIM_DATA_BUMP;
54692+ break;
54693+ case RLIMIT_STACK:
54694+ res_add += GR_RLIM_STACK_BUMP;
54695+ break;
54696+ case RLIMIT_CORE:
54697+ res_add += GR_RLIM_CORE_BUMP;
54698+ break;
54699+ case RLIMIT_RSS:
54700+ res_add += GR_RLIM_RSS_BUMP;
54701+ break;
54702+ case RLIMIT_NPROC:
54703+ res_add += GR_RLIM_NPROC_BUMP;
54704+ break;
54705+ case RLIMIT_NOFILE:
54706+ res_add += GR_RLIM_NOFILE_BUMP;
54707+ break;
54708+ case RLIMIT_MEMLOCK:
54709+ res_add += GR_RLIM_MEMLOCK_BUMP;
54710+ break;
54711+ case RLIMIT_AS:
54712+ res_add += GR_RLIM_AS_BUMP;
54713+ break;
54714+ case RLIMIT_LOCKS:
54715+ res_add += GR_RLIM_LOCKS_BUMP;
54716+ break;
54717+ case RLIMIT_SIGPENDING:
54718+ res_add += GR_RLIM_SIGPENDING_BUMP;
54719+ break;
54720+ case RLIMIT_MSGQUEUE:
54721+ res_add += GR_RLIM_MSGQUEUE_BUMP;
54722+ break;
54723+ case RLIMIT_NICE:
54724+ res_add += GR_RLIM_NICE_BUMP;
54725+ break;
54726+ case RLIMIT_RTPRIO:
54727+ res_add += GR_RLIM_RTPRIO_BUMP;
54728+ break;
54729+ case RLIMIT_RTTIME:
54730+ res_add += GR_RLIM_RTTIME_BUMP;
54731+ break;
54732+ }
54733+
54734+ acl->res[res].rlim_cur = res_add;
54735+
54736+ if (wanted > acl->res[res].rlim_max)
54737+ acl->res[res].rlim_max = res_add;
54738+
54739+ /* only log the subject filename, since resource logging is supported for
54740+ single-subject learning only */
ae4e228f 54741+ rcu_read_lock();
58c5fc13
MT		 54742+ cred = __task_cred(task);
54743+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54744+ task->role->roletype, cred->uid, cred->gid, acl->filename,
54745+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
bc901d79 54746+ "", (unsigned long) res, &task->signal->saved_ip);
ae4e228f 54747+ rcu_read_unlock();
58c5fc13
MT		 54748+ }
54749+
54750+ return;
54751+}
54752+
54753+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54754+void
54755+pax_set_initial_flags(struct linux_binprm *bprm)
54756+{
54757+ struct task_struct *task = current;
54758+ struct acl_subject_label *proc;
54759+ unsigned long flags;
54760+
54761+ if (unlikely(!(gr_status & GR_READY)))
54762+ return;
54763+
54764+ flags = pax_get_flags(task);
54765+
54766+ proc = task->acl;
54767+
54768+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54769+ flags &= ~MF_PAX_PAGEEXEC;
54770+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54771+ flags &= ~MF_PAX_SEGMEXEC;
54772+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54773+ flags &= ~MF_PAX_RANDMMAP;
54774+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54775+ flags &= ~MF_PAX_EMUTRAMP;
54776+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54777+ flags &= ~MF_PAX_MPROTECT;
54778+
54779+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54780+ flags |= MF_PAX_PAGEEXEC;
54781+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54782+ flags |= MF_PAX_SEGMEXEC;
54783+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54784+ flags |= MF_PAX_RANDMMAP;
54785+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54786+ flags |= MF_PAX_EMUTRAMP;
54787+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54788+ flags |= MF_PAX_MPROTECT;
54789+
54790+ pax_set_flags(task, flags);
54791+
54792+ return;
54793+}
54794+#endif
54795+
54796+#ifdef CONFIG_SYSCTL
54797+/* Eric Biederman likes breaking userland ABI and every inode-based security
54798+ system to save 35kb of memory */
54799+
54800+/* we modify the passed in filename, but adjust it back before returning */
54801+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54802+{
54803+ struct name_entry *nmatch;
54804+ char *p, *lastp = NULL;
54805+ struct acl_object_label *obj = NULL, *tmp;
54806+ struct acl_subject_label *tmpsubj;
54807+ char c = '\0';
54808+
54809+ read_lock(&gr_inode_lock);
54810+
54811+ p = name + len - 1;
54812+ do {
54813+ nmatch = lookup_name_entry(name);
54814+ if (lastp != NULL)
54815+ *lastp = c;
54816+
54817+ if (nmatch == NULL)
54818+ goto next_component;
54819+ tmpsubj = current->acl;
54820+ do {
54821+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54822+ if (obj != NULL) {
54823+ tmp = obj->globbed;
54824+ while (tmp) {
54825+ if (!glob_match(tmp->filename, name)) {
54826+ obj = tmp;
54827+ goto found_obj;
54828+ }
54829+ tmp = tmp->next;
54830+ }
54831+ goto found_obj;
54832+ }
54833+ } while ((tmpsubj = tmpsubj->parent_subject));
54834+next_component:
54835+ /* end case */
54836+ if (p == name)
54837+ break;
54838+
54839+ while (*p != '/')
54840+ p--;
54841+ if (p == name)
54842+ lastp = p + 1;
54843+ else {
54844+ lastp = p;
54845+ p--;
54846+ }
54847+ c = *lastp;
54848+ *lastp = '\0';
54849+ } while (1);
54850+found_obj:
54851+ read_unlock(&gr_inode_lock);
54852+ /* obj returned will always be non-null */
54853+ return obj;
54854+}
54855+
54856+/* returns 0 when allowing, non-zero on error
54857+ op of 0 is used for readdir, so we don't log the names of hidden files
54858+*/
54859+__u32
54860+gr_handle_sysctl(const struct ctl_table *table, const int op)
54861+{
57199397 54862+ struct ctl_table *tmp;
58c5fc13
MT		 54863+ const char *proc_sys = "/proc/sys";
54864+ char *path;
54865+ struct acl_object_label *obj;
54866+ unsigned short len = 0, pos = 0, depth = 0, i;
54867+ __u32 err = 0;
54868+ __u32 mode = 0;
54869+
54870+ if (unlikely(!(gr_status & GR_READY)))
54871+ return 0;
54872+
54873+ /* for now, ignore operations on non-sysctl entries if it's not a
54874+ readdir*/
54875+ if (table->child != NULL && op != 0)
54876+ return 0;
54877+
54878+ mode |= GR_FIND;
54879+ /* it's only a read if it's an entry, read on dirs is for readdir */
54880+ if (op & MAY_READ)
54881+ mode |= GR_READ;
54882+ if (op & MAY_WRITE)
54883+ mode |= GR_WRITE;
54884+
54885+ preempt_disable();
54886+
54887+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54888+
54889+ /* it's only a read/write if it's an actual entry, not a dir
54890+ (which are opened for readdir)
54891+ */
54892+
54893+ /* convert the requested sysctl entry into a pathname */
54894+
57199397 54895+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
58c5fc13
MT		 54896+ len += strlen(tmp->procname);
54897+ len++;
54898+ depth++;
54899+ }
54900+
54901+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54902+ /* deny */
54903+ goto out;
54904+ }
54905+
54906+ memset(path, 0, PAGE_SIZE);
54907+
54908+ memcpy(path, proc_sys, strlen(proc_sys));
54909+
54910+ pos += strlen(proc_sys);
54911+
54912+ for (; depth > 0; depth--) {
54913+ path[pos] = '/';
54914+ pos++;
57199397 54915+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
58c5fc13
MT		 54916+ if (depth == i) {
54917+ memcpy(path + pos, tmp->procname,
54918+ strlen(tmp->procname));
54919+ pos += strlen(tmp->procname);
54920+ }
54921+ i++;
54922+ }
54923+ }
54924+
54925+ obj = gr_lookup_by_name(path, pos);
54926+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
54927+
54928+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
54929+ ((err & mode) != mode))) {
54930+ __u32 new_mode = mode;
54931+
54932+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54933+
54934+ err = 0;
54935+ gr_log_learn_sysctl(path, new_mode);
54936+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
54937+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
54938+ err = -ENOENT;
54939+ } else if (!(err & GR_FIND)) {
54940+ err = -ENOENT;
54941+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
54942+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
54943+ path, (mode & GR_READ) ? " reading" : "",
54944+ (mode & GR_WRITE) ? " writing" : "");
54945+ err = -EACCES;
54946+ } else if ((err & mode) != mode) {
54947+ err = -EACCES;
54948+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
54949+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
54950+ path, (mode & GR_READ) ? " reading" : "",
54951+ (mode & GR_WRITE) ? " writing" : "");
54952+ err = 0;
54953+ } else
54954+ err = 0;
54955+
54956+ out:
54957+ preempt_enable();
54958+
54959+ return err;
54960+}
54961+#endif
54962+
54963+int
54964+gr_handle_proc_ptrace(struct task_struct *task)
54965+{
54966+ struct file *filp;
54967+ struct task_struct *tmp = task;
54968+ struct task_struct *curtemp = current;
54969+ __u32 retmode;
54970+
54971+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54972+ if (unlikely(!(gr_status & GR_READY)))
54973+ return 0;
54974+#endif
54975+
54976+ read_lock(&tasklist_lock);
54977+ read_lock(&grsec_exec_file_lock);
54978+ filp = task->exec_file;
54979+
54980+ while (tmp->pid > 0) {
54981+ if (tmp == curtemp)
54982+ break;
6892158b 54983+ tmp = tmp->real_parent;
58c5fc13
MT		 54984+ }
54985+
54986+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54987+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54988+ read_unlock(&grsec_exec_file_lock);
54989+ read_unlock(&tasklist_lock);
54990+ return 1;
54991+ }
54992+
54993+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54994+ if (!(gr_status & GR_READY)) {
54995+ read_unlock(&grsec_exec_file_lock);
54996+ read_unlock(&tasklist_lock);
54997+ return 0;
54998+ }
54999+#endif
55000+
55001+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
55002+ read_unlock(&grsec_exec_file_lock);
55003+ read_unlock(&tasklist_lock);
55004+
55005+ if (retmode & GR_NOPTRACE)
55006+ return 1;
55007+
55008+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
55009+ && (current->acl != task->acl || (current->acl != current->role->root_label
55010+ && current->pid != task->pid)))
55011+ return 1;
55012+
55013+ return 0;
55014+}
55015+
6892158b
MT		 55016+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
55017+{
55018+ if (unlikely(!(gr_status & GR_READY)))
55019+ return;
55020+
55021+ if (!(current->role->roletype & GR_ROLE_GOD))
55022+ return;
55023+
55024+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
55025+ p->role->rolename, gr_task_roletype_to_char(p),
55026+ p->acl->filename);
55027+}
55028+
58c5fc13
MT		 55029+int
55030+gr_handle_ptrace(struct task_struct *task, const long request)
55031+{
55032+ struct task_struct *tmp = task;
55033+ struct task_struct *curtemp = current;
55034+ __u32 retmode;
55035+
55036+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55037+ if (unlikely(!(gr_status & GR_READY)))
55038+ return 0;
55039+#endif
55040+
55041+ read_lock(&tasklist_lock);
55042+ while (tmp->pid > 0) {
55043+ if (tmp == curtemp)
55044+ break;
6892158b 55045+ tmp = tmp->real_parent;
58c5fc13
MT		 55046+ }
55047+
55048+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55049+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
55050+ read_unlock(&tasklist_lock);
55051+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55052+ return 1;
55053+ }
55054+ read_unlock(&tasklist_lock);
55055+
55056+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55057+ if (!(gr_status & GR_READY))
55058+ return 0;
55059+#endif
55060+
55061+ read_lock(&grsec_exec_file_lock);
55062+ if (unlikely(!task->exec_file)) {
55063+ read_unlock(&grsec_exec_file_lock);
55064+ return 0;
55065+ }
55066+
55067+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
55068+ read_unlock(&grsec_exec_file_lock);
55069+
55070+ if (retmode & GR_NOPTRACE) {
55071+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55072+ return 1;
55073+ }
55074+
55075+ if (retmode & GR_PTRACERD) {
55076+ switch (request) {
55077+ case PTRACE_POKETEXT:
55078+ case PTRACE_POKEDATA:
55079+ case PTRACE_POKEUSR:
55080+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
55081+ case PTRACE_SETREGS:
55082+ case PTRACE_SETFPREGS:
55083+#endif
55084+#ifdef CONFIG_X86
55085+ case PTRACE_SETFPXREGS:
55086+#endif
55087+#ifdef CONFIG_ALTIVEC
55088+ case PTRACE_SETVRREGS:
55089+#endif
55090+ return 1;
55091+ default:
55092+ return 0;
55093+ }
55094+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
55095+ !(current->role->roletype & GR_ROLE_GOD) &&
55096+ (current->acl != task->acl)) {
55097+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55098+ return 1;
55099+ }
55100+
55101+ return 0;
55102+}
55103+
55104+static int is_writable_mmap(const struct file *filp)
55105+{
55106+ struct task_struct *task = current;
55107+ struct acl_object_label *obj, *obj2;
55108+
55109+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
71d190be 55110+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
58c5fc13
MT		 55111+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55112+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55113+ task->role->root_label);
55114+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55115+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55116+ return 1;
55117+ }
55118+ }
55119+ return 0;
55120+}
55121+
55122+int
55123+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55124+{
55125+ __u32 mode;
55126+
55127+ if (unlikely(!file || !(prot & PROT_EXEC)))
55128+ return 1;
55129+
55130+ if (is_writable_mmap(file))
55131+ return 0;
55132+
55133+ mode =
55134+ gr_search_file(file->f_path.dentry,
55135+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55136+ file->f_path.mnt);
55137+
55138+ if (!gr_tpe_allow(file))
55139+ return 0;
55140+
55141+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55142+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55143+ return 0;
55144+ } else if (unlikely(!(mode & GR_EXEC))) {
55145+ return 0;
55146+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55147+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55148+ return 1;
55149+ }
55150+
55151+ return 1;
55152+}
55153+
55154+int
55155+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55156+{
55157+ __u32 mode;
55158+
55159+ if (unlikely(!file || !(prot & PROT_EXEC)))
55160+ return 1;
55161+
55162+ if (is_writable_mmap(file))
55163+ return 0;
55164+
55165+ mode =
55166+ gr_search_file(file->f_path.dentry,
55167+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55168+ file->f_path.mnt);
55169+
55170+ if (!gr_tpe_allow(file))
55171+ return 0;
55172+
55173+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55174+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55175+ return 0;
55176+ } else if (unlikely(!(mode & GR_EXEC))) {
55177+ return 0;
55178+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55179+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55180+ return 1;
55181+ }
55182+
55183+ return 1;
55184+}
55185+
55186+void
55187+gr_acl_handle_psacct(struct task_struct *task, const long code)
55188+{
55189+ unsigned long runtime;
55190+ unsigned long cputime;
55191+ unsigned int wday, cday;
55192+ __u8 whr, chr;
55193+ __u8 wmin, cmin;
55194+ __u8 wsec, csec;
55195+ struct timespec timeval;
55196+
55197+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55198+ !(task->acl->mode & GR_PROCACCT)))
55199+ return;
55200+
55201+ do_posix_clock_monotonic_gettime(&timeval);
55202+ runtime = timeval.tv_sec - task->start_time.tv_sec;
55203+ wday = runtime / (3600 * 24);
55204+ runtime -= wday * (3600 * 24);
55205+ whr = runtime / 3600;
55206+ runtime -= whr * 3600;
55207+ wmin = runtime / 60;
55208+ runtime -= wmin * 60;
55209+ wsec = runtime;
55210+
55211+ cputime = (task->utime + task->stime) / HZ;
55212+ cday = cputime / (3600 * 24);
55213+ cputime -= cday * (3600 * 24);
55214+ chr = cputime / 3600;
55215+ cputime -= chr * 3600;
55216+ cmin = cputime / 60;
55217+ cputime -= cmin * 60;
55218+ csec = cputime;
55219+
55220+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55221+
55222+ return;
55223+}
55224+
55225+void gr_set_kernel_label(struct task_struct *task)
55226+{
55227+ if (gr_status & GR_READY) {
55228+ task->role = kernel_role;
55229+ task->acl = kernel_role->root_label;
55230+ }
55231+ return;
55232+}
55233+
55234+#ifdef CONFIG_TASKSTATS
55235+int gr_is_taskstats_denied(int pid)
55236+{
55237+ struct task_struct *task;
55238+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55239+ const struct cred *cred;
55240+#endif
55241+ int ret = 0;
55242+
55243+ /* restrict taskstats viewing to un-chrooted root users
55244+ who have the 'view' subject flag if the RBAC system is enabled
55245+ */
55246+
df50ba0c 55247+ rcu_read_lock();
58c5fc13
MT		 55248+ read_lock(&tasklist_lock);
55249+ task = find_task_by_vpid(pid);
55250+ if (task) {
58c5fc13
MT		 55251+#ifdef CONFIG_GRKERNSEC_CHROOT
55252+ if (proc_is_chrooted(task))
55253+ ret = -EACCES;
55254+#endif
55255+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55256+ cred = __task_cred(task);
55257+#ifdef CONFIG_GRKERNSEC_PROC_USER
55258+ if (cred->uid != 0)
55259+ ret = -EACCES;
55260+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55261+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55262+ ret = -EACCES;
55263+#endif
55264+#endif
55265+ if (gr_status & GR_READY) {
55266+ if (!(task->acl->mode & GR_VIEW))
55267+ ret = -EACCES;
55268+ }
58c5fc13
MT		 55269+ } else
55270+ ret = -ENOENT;
55271+
55272+ read_unlock(&tasklist_lock);
df50ba0c 55273+ rcu_read_unlock();
58c5fc13
MT		 55274+
55275+ return ret;
55276+}
55277+#endif
55278+
bc901d79
MT		 55279+/* AUXV entries are filled via a descendant of search_binary_handler
55280+ after we've already applied the subject for the target
55281+*/
55282+int gr_acl_enable_at_secure(void)
55283+{
55284+ if (unlikely(!(gr_status & GR_READY)))
55285+ return 0;
55286+
55287+ if (current->acl->mode & GR_ATSECURE)
55288+ return 1;
55289+
55290+ return 0;
55291+}
55292+
58c5fc13
MT		 55293+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55294+{
55295+ struct task_struct *task = current;
55296+ struct dentry *dentry = file->f_path.dentry;
55297+ struct vfsmount *mnt = file->f_path.mnt;
55298+ struct acl_object_label *obj, *tmp;
55299+ struct acl_subject_label *subj;
55300+ unsigned int bufsize;
55301+ int is_not_root;
55302+ char *path;
16454cff 55303+ dev_t dev = __get_dev(dentry);
58c5fc13
MT		 55304+
55305+ if (unlikely(!(gr_status & GR_READY)))
55306+ return 1;
55307+
55308+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55309+ return 1;
55310+
55311+ /* ignore Eric Biederman */
55312+ if (IS_PRIVATE(dentry->d_inode))
55313+ return 1;
55314+
55315+ subj = task->acl;
55316+ do {
16454cff 55317+ obj = lookup_acl_obj_label(ino, dev, subj);
58c5fc13
MT		 55318+ if (obj != NULL)
55319+ return (obj->mode & GR_FIND) ? 1 : 0;
55320+ } while ((subj = subj->parent_subject));
55321+
55322+ /* this is purely an optimization since we're looking for an object
55323+ for the directory we're doing a readdir on
55324+ if it's possible for any globbed object to match the entry we're
55325+ filling into the directory, then the object we find here will be
55326+ an anchor point with attached globbed objects
55327+ */
55328+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55329+ if (obj->globbed == NULL)
55330+ return (obj->mode & GR_FIND) ? 1 : 0;
55331+
55332+ is_not_root = ((obj->filename[0] == '/') &&
55333+ (obj->filename[1] == '\0')) ? 0 : 1;
55334+ bufsize = PAGE_SIZE - namelen - is_not_root;
55335+
55336+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
55337+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55338+ return 1;
55339+
55340+ preempt_disable();
55341+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55342+ bufsize);
55343+
55344+ bufsize = strlen(path);
55345+
55346+ /* if base is "/", don't append an additional slash */
55347+ if (is_not_root)
55348+ *(path + bufsize) = '/';
55349+ memcpy(path + bufsize + is_not_root, name, namelen);
55350+ *(path + bufsize + namelen + is_not_root) = '\0';
55351+
55352+ tmp = obj->globbed;
55353+ while (tmp) {
55354+ if (!glob_match(tmp->filename, path)) {
55355+ preempt_enable();
55356+ return (tmp->mode & GR_FIND) ? 1 : 0;
55357+ }
55358+ tmp = tmp->next;
55359+ }
55360+ preempt_enable();
55361+ return (obj->mode & GR_FIND) ? 1 : 0;
55362+}
55363+
6892158b
MT		 55364+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55365+EXPORT_SYMBOL(gr_acl_is_enabled);
55366+#endif
58c5fc13
MT		 55367+EXPORT_SYMBOL(gr_learn_resource);
55368+EXPORT_SYMBOL(gr_set_kernel_label);
55369+#ifdef CONFIG_SECURITY
55370+EXPORT_SYMBOL(gr_check_user_change);
55371+EXPORT_SYMBOL(gr_check_group_change);
55372+#endif
55373+
66a7e928
MT		 55374diff -urNp linux-2.6.39/grsecurity/gracl_cap.c linux-2.6.39/grsecurity/gracl_cap.c
55375--- linux-2.6.39/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
55376+++ linux-2.6.39/grsecurity/gracl_cap.c 2011-05-22 19:41:42.000000000 -0400
16454cff 55377@@ -0,0 +1,139 @@
58c5fc13
MT		 55378+#include <linux/kernel.h>
55379+#include <linux/module.h>
55380+#include <linux/sched.h>
55381+#include <linux/gracl.h>
55382+#include <linux/grsecurity.h>
55383+#include <linux/grinternal.h>
55384+
55385+static const char *captab_log[] = {
55386+ "CAP_CHOWN",
55387+ "CAP_DAC_OVERRIDE",
55388+ "CAP_DAC_READ_SEARCH",
55389+ "CAP_FOWNER",
55390+ "CAP_FSETID",
55391+ "CAP_KILL",
55392+ "CAP_SETGID",
55393+ "CAP_SETUID",
55394+ "CAP_SETPCAP",
55395+ "CAP_LINUX_IMMUTABLE",
55396+ "CAP_NET_BIND_SERVICE",
55397+ "CAP_NET_BROADCAST",
55398+ "CAP_NET_ADMIN",
55399+ "CAP_NET_RAW",
55400+ "CAP_IPC_LOCK",
55401+ "CAP_IPC_OWNER",
55402+ "CAP_SYS_MODULE",
55403+ "CAP_SYS_RAWIO",
55404+ "CAP_SYS_CHROOT",
55405+ "CAP_SYS_PTRACE",
55406+ "CAP_SYS_PACCT",
55407+ "CAP_SYS_ADMIN",
55408+ "CAP_SYS_BOOT",
55409+ "CAP_SYS_NICE",
55410+ "CAP_SYS_RESOURCE",
55411+ "CAP_SYS_TIME",
55412+ "CAP_SYS_TTY_CONFIG",
55413+ "CAP_MKNOD",
55414+ "CAP_LEASE",
55415+ "CAP_AUDIT_WRITE",
55416+ "CAP_AUDIT_CONTROL",
55417+ "CAP_SETFCAP",
55418+ "CAP_MAC_OVERRIDE",
16454cff
MT		 55419+ "CAP_MAC_ADMIN",
55420+ "CAP_SYSLOG"
58c5fc13
MT		 55421+};
55422+
55423+EXPORT_SYMBOL(gr_is_capable);
55424+EXPORT_SYMBOL(gr_is_capable_nolog);
55425+
55426+int
55427+gr_is_capable(const int cap)
55428+{
55429+ struct task_struct *task = current;
55430+ const struct cred *cred = current_cred();
55431+ struct acl_subject_label *curracl;
55432+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
df50ba0c 55433+ kernel_cap_t cap_audit = __cap_empty_set;
58c5fc13
MT		 55434+
55435+ if (!gr_acl_is_enabled())
55436+ return 1;
55437+
55438+ curracl = task->acl;
55439+
55440+ cap_drop = curracl->cap_lower;
55441+ cap_mask = curracl->cap_mask;
df50ba0c 55442+ cap_audit = curracl->cap_invert_audit;
58c5fc13
MT		 55443+
55444+ while ((curracl = curracl->parent_subject)) {
55445+ /* if the cap isn't specified in the current computed mask but is specified in the
55446+ current level subject, and is lowered in the current level subject, then add
55447+ it to the set of dropped capabilities
55448+ otherwise, add the current level subject's mask to the current computed mask
55449+ */
55450+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55451+ cap_raise(cap_mask, cap);
55452+ if (cap_raised(curracl->cap_lower, cap))
55453+ cap_raise(cap_drop, cap);
df50ba0c
MT		 55454+ if (cap_raised(curracl->cap_invert_audit, cap))
55455+ cap_raise(cap_audit, cap);
58c5fc13
MT		 55456+ }
55457+ }
55458+
df50ba0c
MT		 55459+ if (!cap_raised(cap_drop, cap)) {
55460+ if (cap_raised(cap_audit, cap))
55461+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
58c5fc13 55462+ return 1;
df50ba0c 55463+ }
58c5fc13
MT		 55464+
55465+ curracl = task->acl;
55466+
55467+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55468+ && cap_raised(cred->cap_effective, cap)) {
55469+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55470+ task->role->roletype, cred->uid,
55471+ cred->gid, task->exec_file ?
55472+ gr_to_filename(task->exec_file->f_path.dentry,
55473+ task->exec_file->f_path.mnt) : curracl->filename,
55474+ curracl->filename, 0UL,
bc901d79 55475+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
58c5fc13
MT		 55476+ return 1;
55477+ }
55478+
df50ba0c 55479+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
58c5fc13
MT		 55480+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55481+ return 0;
55482+}
55483+
55484+int
55485+gr_is_capable_nolog(const int cap)
55486+{
55487+ struct acl_subject_label *curracl;
55488+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55489+
55490+ if (!gr_acl_is_enabled())
55491+ return 1;
55492+
55493+ curracl = current->acl;
55494+
55495+ cap_drop = curracl->cap_lower;
55496+ cap_mask = curracl->cap_mask;
55497+
55498+ while ((curracl = curracl->parent_subject)) {
55499+ /* if the cap isn't specified in the current computed mask but is specified in the
55500+ current level subject, and is lowered in the current level subject, then add
55501+ it to the set of dropped capabilities
55502+ otherwise, add the current level subject's mask to the current computed mask
55503+ */
55504+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55505+ cap_raise(cap_mask, cap);
55506+ if (cap_raised(curracl->cap_lower, cap))
55507+ cap_raise(cap_drop, cap);
55508+ }
55509+ }
55510+
55511+ if (!cap_raised(cap_drop, cap))
55512+ return 1;
55513+
55514+ return 0;
55515+}
55516+
66a7e928
MT		 55517diff -urNp linux-2.6.39/grsecurity/gracl_fs.c linux-2.6.39/grsecurity/gracl_fs.c
55518--- linux-2.6.39/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
55519+++ linux-2.6.39/grsecurity/gracl_fs.c 2011-05-22 19:41:42.000000000 -0400
16454cff 55520@@ -0,0 +1,431 @@
58c5fc13
MT		 55521+#include <linux/kernel.h>
55522+#include <linux/sched.h>
55523+#include <linux/types.h>
55524+#include <linux/fs.h>
55525+#include <linux/file.h>
55526+#include <linux/stat.h>
55527+#include <linux/grsecurity.h>
55528+#include <linux/grinternal.h>
55529+#include <linux/gracl.h>
55530+
55531+__u32
55532+gr_acl_handle_hidden_file(const struct dentry * dentry,
55533+ const struct vfsmount * mnt)
55534+{
55535+ __u32 mode;
55536+
55537+ if (unlikely(!dentry->d_inode))
55538+ return GR_FIND;
55539+
55540+ mode =
55541+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55542+
55543+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55544+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55545+ return mode;
55546+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55547+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55548+ return 0;
55549+ } else if (unlikely(!(mode & GR_FIND)))
55550+ return 0;
55551+
55552+ return GR_FIND;
55553+}
55554+
55555+__u32
55556+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55557+ const int fmode)
55558+{
55559+ __u32 reqmode = GR_FIND;
55560+ __u32 mode;
55561+
55562+ if (unlikely(!dentry->d_inode))
55563+ return reqmode;
55564+
55565+ if (unlikely(fmode & O_APPEND))
55566+ reqmode |= GR_APPEND;
55567+ else if (unlikely(fmode & FMODE_WRITE))
55568+ reqmode |= GR_WRITE;
55569+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55570+ reqmode |= GR_READ;
16454cff 55571+ if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
58c5fc13
MT		 55572+ reqmode &= ~GR_READ;
55573+ mode =
55574+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55575+ mnt);
55576+
55577+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55578+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55579+ reqmode & GR_READ ? " reading" : "",
55580+ reqmode & GR_WRITE ? " writing" : reqmode &
55581+ GR_APPEND ? " appending" : "");
55582+ return reqmode;
55583+ } else
55584+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55585+ {
55586+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55587+ reqmode & GR_READ ? " reading" : "",
55588+ reqmode & GR_WRITE ? " writing" : reqmode &
55589+ GR_APPEND ? " appending" : "");
55590+ return 0;
55591+ } else if (unlikely((mode & reqmode) != reqmode))
55592+ return 0;
55593+
55594+ return reqmode;
55595+}
55596+
55597+__u32
55598+gr_acl_handle_creat(const struct dentry * dentry,
55599+ const struct dentry * p_dentry,
55600+ const struct vfsmount * p_mnt, const int fmode,
55601+ const int imode)
55602+{
55603+ __u32 reqmode = GR_WRITE | GR_CREATE;
55604+ __u32 mode;
55605+
55606+ if (unlikely(fmode & O_APPEND))
55607+ reqmode |= GR_APPEND;
55608+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55609+ reqmode |= GR_READ;
55610+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
55611+ reqmode |= GR_SETID;
55612+
55613+ mode =
55614+ gr_check_create(dentry, p_dentry, p_mnt,
55615+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55616+
55617+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55618+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55619+ reqmode & GR_READ ? " reading" : "",
55620+ reqmode & GR_WRITE ? " writing" : reqmode &
55621+ GR_APPEND ? " appending" : "");
55622+ return reqmode;
55623+ } else
55624+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55625+ {
55626+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55627+ reqmode & GR_READ ? " reading" : "",
55628+ reqmode & GR_WRITE ? " writing" : reqmode &
55629+ GR_APPEND ? " appending" : "");
55630+ return 0;
55631+ } else if (unlikely((mode & reqmode) != reqmode))
55632+ return 0;
55633+
55634+ return reqmode;
55635+}
55636+
55637+__u32
55638+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55639+ const int fmode)
55640+{
55641+ __u32 mode, reqmode = GR_FIND;
55642+
55643+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55644+ reqmode |= GR_EXEC;
55645+ if (fmode & S_IWOTH)
55646+ reqmode |= GR_WRITE;
55647+ if (fmode & S_IROTH)
55648+ reqmode |= GR_READ;
55649+
55650+ mode =
55651+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55652+ mnt);
55653+
55654+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55655+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55656+ reqmode & GR_READ ? " reading" : "",
55657+ reqmode & GR_WRITE ? " writing" : "",
55658+ reqmode & GR_EXEC ? " executing" : "");
55659+ return reqmode;
55660+ } else
55661+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55662+ {
55663+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55664+ reqmode & GR_READ ? " reading" : "",
55665+ reqmode & GR_WRITE ? " writing" : "",
55666+ reqmode & GR_EXEC ? " executing" : "");
55667+ return 0;
55668+ } else if (unlikely((mode & reqmode) != reqmode))
55669+ return 0;
55670+
55671+ return reqmode;
55672+}
55673+
55674+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55675+{
55676+ __u32 mode;
55677+
55678+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55679+
55680+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55681+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55682+ return mode;
55683+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55684+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55685+ return 0;
55686+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55687+ return 0;
55688+
55689+ return (reqmode);
55690+}
55691+
55692+__u32
55693+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55694+{
55695+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55696+}
55697+
55698+__u32
55699+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55700+{
55701+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55702+}
55703+
55704+__u32
55705+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55706+{
55707+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55708+}
55709+
55710+__u32
55711+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55712+{
55713+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55714+}
55715+
55716+__u32
55717+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55718+ mode_t mode)
55719+{
55720+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55721+ return 1;
55722+
55723+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55724+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55725+ GR_FCHMOD_ACL_MSG);
55726+ } else {
55727+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55728+ }
55729+}
55730+
55731+__u32
55732+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55733+ mode_t mode)
55734+{
55735+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55736+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55737+ GR_CHMOD_ACL_MSG);
55738+ } else {
55739+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55740+ }
55741+}
55742+
55743+__u32
55744+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55745+{
55746+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55747+}
55748+
55749+__u32
bc901d79
MT		 55750+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55751+{
55752+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55753+}
55754+
55755+__u32
58c5fc13
MT		 55756+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55757+{
55758+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55759+}
55760+
55761+__u32
55762+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55763+{
55764+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55765+ GR_UNIXCONNECT_ACL_MSG);
55766+}
55767+
55768+/* hardlinks require at minimum create permission,
55769+ any additional privilege required is based on the
55770+ privilege of the file being linked to
55771+*/
55772+__u32
55773+gr_acl_handle_link(const struct dentry * new_dentry,
55774+ const struct dentry * parent_dentry,
55775+ const struct vfsmount * parent_mnt,
55776+ const struct dentry * old_dentry,
55777+ const struct vfsmount * old_mnt, const char *to)
55778+{
55779+ __u32 mode;
55780+ __u32 needmode = GR_CREATE | GR_LINK;
55781+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55782+
55783+ mode =
55784+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55785+ old_mnt);
55786+
55787+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55788+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55789+ return mode;
55790+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55791+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55792+ return 0;
55793+ } else if (unlikely((mode & needmode) != needmode))
55794+ return 0;
55795+
55796+ return 1;
55797+}
55798+
55799+__u32
55800+gr_acl_handle_symlink(const struct dentry * new_dentry,
55801+ const struct dentry * parent_dentry,
55802+ const struct vfsmount * parent_mnt, const char *from)
55803+{
55804+ __u32 needmode = GR_WRITE | GR_CREATE;
55805+ __u32 mode;
55806+
55807+ mode =
55808+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
55809+ GR_CREATE | GR_AUDIT_CREATE |
55810+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55811+
55812+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55813+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55814+ return mode;
55815+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55816+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55817+ return 0;
55818+ } else if (unlikely((mode & needmode) != needmode))
55819+ return 0;
55820+
55821+ return (GR_WRITE | GR_CREATE);
55822+}
55823+
55824+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55825+{
55826+ __u32 mode;
55827+
55828+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55829+
55830+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55831+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55832+ return mode;
55833+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55834+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55835+ return 0;
55836+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55837+ return 0;
55838+
55839+ return (reqmode);
55840+}
55841+
55842+__u32
55843+gr_acl_handle_mknod(const struct dentry * new_dentry,
55844+ const struct dentry * parent_dentry,
55845+ const struct vfsmount * parent_mnt,
55846+ const int mode)
55847+{
55848+ __u32 reqmode = GR_WRITE | GR_CREATE;
55849+ if (unlikely(mode & (S_ISUID | S_ISGID)))
55850+ reqmode |= GR_SETID;
55851+
55852+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55853+ reqmode, GR_MKNOD_ACL_MSG);
55854+}
55855+
55856+__u32
55857+gr_acl_handle_mkdir(const struct dentry *new_dentry,
55858+ const struct dentry *parent_dentry,
55859+ const struct vfsmount *parent_mnt)
55860+{
55861+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55862+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55863+}
55864+
55865+#define RENAME_CHECK_SUCCESS(old, new) \
55866+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55867+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55868+
55869+int
55870+gr_acl_handle_rename(struct dentry *new_dentry,
55871+ struct dentry *parent_dentry,
55872+ const struct vfsmount *parent_mnt,
55873+ struct dentry *old_dentry,
55874+ struct inode *old_parent_inode,
55875+ struct vfsmount *old_mnt, const char *newname)
55876+{
55877+ __u32 comp1, comp2;
55878+ int error = 0;
55879+
55880+ if (unlikely(!gr_acl_is_enabled()))
55881+ return 0;
55882+
55883+ if (!new_dentry->d_inode) {
55884+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55885+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55886+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55887+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55888+ GR_DELETE | GR_AUDIT_DELETE |
55889+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55890+ GR_SUPPRESS, old_mnt);
55891+ } else {
55892+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55893+ GR_CREATE | GR_DELETE |
55894+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55895+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55896+ GR_SUPPRESS, parent_mnt);
55897+ comp2 =
55898+ gr_search_file(old_dentry,
55899+ GR_READ | GR_WRITE | GR_AUDIT_READ |
55900+ GR_DELETE | GR_AUDIT_DELETE |
55901+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55902+ }
55903+
55904+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55905+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55906+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55907+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55908+ && !(comp2 & GR_SUPPRESS)) {
55909+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55910+ error = -EACCES;
55911+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55912+ error = -EACCES;
55913+
55914+ return error;
55915+}
55916+
55917+void
55918+gr_acl_handle_exit(void)
55919+{
55920+ u16 id;
55921+ char *rolename;
55922+ struct file *exec_file;
55923+
16454cff
MT		 55924+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55925+ !(current->role->roletype & GR_ROLE_PERSIST))) {
58c5fc13
MT		 55926+ id = current->acl_role_id;
55927+ rolename = current->role->rolename;
55928+ gr_set_acls(1);
55929+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55930+ }
55931+
55932+ write_lock(&grsec_exec_file_lock);
55933+ exec_file = current->exec_file;
55934+ current->exec_file = NULL;
55935+ write_unlock(&grsec_exec_file_lock);
55936+
55937+ if (exec_file)
55938+ fput(exec_file);
55939+}
55940+
55941+int
55942+gr_acl_handle_procpidmem(const struct task_struct *task)
55943+{
55944+ if (unlikely(!gr_acl_is_enabled()))
55945+ return 0;
55946+
55947+ if (task != current && task->acl->mode & GR_PROTPROCFD)
55948+ return -EACCES;
55949+
55950+ return 0;
55951+}
66a7e928
MT		 55952diff -urNp linux-2.6.39/grsecurity/gracl_ip.c linux-2.6.39/grsecurity/gracl_ip.c
55953--- linux-2.6.39/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
55954+++ linux-2.6.39/grsecurity/gracl_ip.c 2011-05-22 22:47:31.000000000 -0400
55955@@ -0,0 +1,381 @@
58c5fc13
MT		 55956+#include <linux/kernel.h>
55957+#include <asm/uaccess.h>
55958+#include <asm/errno.h>
55959+#include <net/sock.h>
55960+#include <linux/file.h>
55961+#include <linux/fs.h>
55962+#include <linux/net.h>
55963+#include <linux/in.h>
55964+#include <linux/skbuff.h>
55965+#include <linux/ip.h>
55966+#include <linux/udp.h>
58c5fc13
MT		 55967+#include <linux/types.h>
55968+#include <linux/sched.h>
55969+#include <linux/netdevice.h>
55970+#include <linux/inetdevice.h>
55971+#include <linux/gracl.h>
55972+#include <linux/grsecurity.h>
55973+#include <linux/grinternal.h>
55974+
55975+#define GR_BIND 0x01
55976+#define GR_CONNECT 0x02
55977+#define GR_INVERT 0x04
55978+#define GR_BINDOVERRIDE 0x08
55979+#define GR_CONNECTOVERRIDE 0x10
bc901d79 55980+#define GR_SOCK_FAMILY 0x20
58c5fc13 55981+
bc901d79 55982+static const char * gr_protocols[IPPROTO_MAX] = {
58c5fc13
MT		 55983+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55984+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55985+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55986+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55987+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55988+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55989+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55990+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55991+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
55992+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
55993+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
55994+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
55995+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
55996+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
55997+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
55998+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
55999+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
56000+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
56001+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
56002+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
56003+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
56004+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
56005+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
56006+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56007+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56008+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56009+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56010+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56011+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56012+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56013+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56014+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56015+ };
56016+
bc901d79 56017+static const char * gr_socktypes[SOCK_MAX] = {
58c5fc13
MT		 56018+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56019+ "unknown:7", "unknown:8", "unknown:9", "packet"
56020+ };
56021+
bc901d79
MT		 56022+static const char * gr_sockfamilies[AF_MAX+1] = {
56023+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56024+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
c52201e0
MT		 56025+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56026+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
bc901d79
MT		 56027+ };
56028+
58c5fc13
MT		 56029+const char *
56030+gr_proto_to_name(unsigned char proto)
56031+{
56032+ return gr_protocols[proto];
56033+}
56034+
56035+const char *
56036+gr_socktype_to_name(unsigned char type)
56037+{
56038+ return gr_socktypes[type];
56039+}
56040+
bc901d79
MT		 56041+const char *
56042+gr_sockfamily_to_name(unsigned char family)
56043+{
56044+ return gr_sockfamilies[family];
56045+}
56046+
58c5fc13
MT		 56047+int
56048+gr_search_socket(const int domain, const int type, const int protocol)
56049+{
56050+ struct acl_subject_label *curr;
56051+ const struct cred *cred = current_cred();
56052+
56053+ if (unlikely(!gr_acl_is_enabled()))
56054+ goto exit;
56055+
bc901d79
MT		 56056+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
56057+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
58c5fc13
MT		 56058+ goto exit; // let the kernel handle it
56059+
56060+ curr = current->acl;
56061+
bc901d79
MT		 56062+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56063+ /* the family is allowed, if this is PF_INET allow it only if
56064+ the extra sock type/protocol checks pass */
56065+ if (domain == PF_INET)
56066+ goto inet_check;
56067+ goto exit;
56068+ } else {
56069+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56070+ __u32 fakeip = 0;
56071+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56072+ current->role->roletype, cred->uid,
56073+ cred->gid, current->exec_file ?
56074+ gr_to_filename(current->exec_file->f_path.dentry,
56075+ current->exec_file->f_path.mnt) :
56076+ curr->filename, curr->filename,
56077+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56078+ &current->signal->saved_ip);
56079+ goto exit;
56080+ }
56081+ goto exit_fail;
56082+ }
56083+
56084+inet_check:
56085+ /* the rest of this checking is for IPv4 only */
58c5fc13
MT		 56086+ if (!curr->ips)
56087+ goto exit;
56088+
56089+ if ((curr->ip_type & (1 << type)) &&
56090+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56091+ goto exit;
56092+
56093+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56094+ /* we don't place acls on raw sockets , and sometimes
56095+ dgram/ip sockets are opened for ioctl and not
56096+ bind/connect, so we'll fake a bind learn log */
56097+ if (type == SOCK_RAW || type == SOCK_PACKET) {
56098+ __u32 fakeip = 0;
56099+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56100+ current->role->roletype, cred->uid,
56101+ cred->gid, current->exec_file ?
56102+ gr_to_filename(current->exec_file->f_path.dentry,
56103+ current->exec_file->f_path.mnt) :
56104+ curr->filename, curr->filename,
ae4e228f 56105+ &fakeip, 0, type,
bc901d79 56106+ protocol, GR_CONNECT, &current->signal->saved_ip);
58c5fc13
MT		 56107+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56108+ __u32 fakeip = 0;
56109+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56110+ current->role->roletype, cred->uid,
56111+ cred->gid, current->exec_file ?
56112+ gr_to_filename(current->exec_file->f_path.dentry,
56113+ current->exec_file->f_path.mnt) :
56114+ curr->filename, curr->filename,
ae4e228f 56115+ &fakeip, 0, type,
bc901d79 56116+ protocol, GR_BIND, &current->signal->saved_ip);
58c5fc13
MT		 56117+ }
56118+ /* we'll log when they use connect or bind */
56119+ goto exit;
56120+ }
56121+
bc901d79
MT		 56122+exit_fail:
56123+ if (domain == PF_INET)
56124+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56125+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
56126+ else
56127+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56128+ gr_socktype_to_name(type), protocol);
58c5fc13
MT		 56129+
56130+ return 0;
bc901d79 56131+exit:
58c5fc13
MT		 56132+ return 1;
56133+}
56134+
56135+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56136+{
56137+ if ((ip->mode & mode) &&
56138+ (ip_port >= ip->low) &&
56139+ (ip_port <= ip->high) &&
56140+ ((ntohl(ip_addr) & our_netmask) ==
56141+ (ntohl(our_addr) & our_netmask))
56142+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56143+ && (ip->type & (1 << type))) {
56144+ if (ip->mode & GR_INVERT)
56145+ return 2; // specifically denied
56146+ else
56147+ return 1; // allowed
56148+ }
56149+
56150+ return 0; // not specifically allowed, may continue parsing
56151+}
56152+
56153+static int
56154+gr_search_connectbind(const int full_mode, struct sock *sk,
56155+ struct sockaddr_in *addr, const int type)
56156+{
56157+ char iface[IFNAMSIZ] = {0};
56158+ struct acl_subject_label *curr;
56159+ struct acl_ip_label *ip;
56160+ struct inet_sock *isk;
56161+ struct net_device *dev;
56162+ struct in_device *idev;
56163+ unsigned long i;
56164+ int ret;
56165+ int mode = full_mode & (GR_BIND | GR_CONNECT);
56166+ __u32 ip_addr = 0;
56167+ __u32 our_addr;
56168+ __u32 our_netmask;
56169+ char *p;
56170+ __u16 ip_port = 0;
56171+ const struct cred *cred = current_cred();
56172+
56173+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56174+ return 0;
56175+
56176+ curr = current->acl;
56177+ isk = inet_sk(sk);
56178+
56179+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56180+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56181+ addr->sin_addr.s_addr = curr->inaddr_any_override;
ae4e228f 56182+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
58c5fc13
MT		 56183+ struct sockaddr_in saddr;
56184+ int err;
56185+
56186+ saddr.sin_family = AF_INET;
56187+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
ae4e228f 56188+ saddr.sin_port = isk->inet_sport;
58c5fc13
MT		 56189+
56190+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56191+ if (err)
56192+ return err;
56193+
56194+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56195+ if (err)
56196+ return err;
56197+ }
56198+
56199+ if (!curr->ips)
56200+ return 0;
56201+
56202+ ip_addr = addr->sin_addr.s_addr;
56203+ ip_port = ntohs(addr->sin_port);
56204+
56205+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56206+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56207+ current->role->roletype, cred->uid,
56208+ cred->gid, current->exec_file ?
56209+ gr_to_filename(current->exec_file->f_path.dentry,
56210+ current->exec_file->f_path.mnt) :
56211+ curr->filename, curr->filename,
ae4e228f 56212+ &ip_addr, ip_port, type,
bc901d79 56213+ sk->sk_protocol, mode, &current->signal->saved_ip);
58c5fc13
MT		 56214+ return 0;
56215+ }
56216+
56217+ for (i = 0; i < curr->ip_num; i++) {
56218+ ip = *(curr->ips + i);
56219+ if (ip->iface != NULL) {
56220+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
56221+ p = strchr(iface, ':');
56222+ if (p != NULL)
56223+ *p = '\0';
56224+ dev = dev_get_by_name(sock_net(sk), iface);
56225+ if (dev == NULL)
56226+ continue;
56227+ idev = in_dev_get(dev);
56228+ if (idev == NULL) {
56229+ dev_put(dev);
56230+ continue;
56231+ }
56232+ rcu_read_lock();
56233+ for_ifa(idev) {
56234+ if (!strcmp(ip->iface, ifa->ifa_label)) {
56235+ our_addr = ifa->ifa_address;
56236+ our_netmask = 0xffffffff;
56237+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56238+ if (ret == 1) {
56239+ rcu_read_unlock();
56240+ in_dev_put(idev);
56241+ dev_put(dev);
56242+ return 0;
56243+ } else if (ret == 2) {
56244+ rcu_read_unlock();
56245+ in_dev_put(idev);
56246+ dev_put(dev);
56247+ goto denied;
56248+ }
56249+ }
56250+ } endfor_ifa(idev);
56251+ rcu_read_unlock();
56252+ in_dev_put(idev);
56253+ dev_put(dev);
56254+ } else {
56255+ our_addr = ip->addr;
56256+ our_netmask = ip->netmask;
56257+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56258+ if (ret == 1)
56259+ return 0;
56260+ else if (ret == 2)
56261+ goto denied;
56262+ }
56263+ }
56264+
56265+denied:
56266+ if (mode == GR_BIND)
ae4e228f 56267+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
58c5fc13 56268+ else if (mode == GR_CONNECT)
ae4e228f 56269+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
58c5fc13
MT		 56270+
56271+ return -EACCES;
56272+}
56273+
56274+int
56275+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56276+{
56277+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56278+}
56279+
56280+int
56281+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56282+{
56283+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56284+}
56285+
56286+int gr_search_listen(struct socket *sock)
56287+{
56288+ struct sock *sk = sock->sk;
56289+ struct sockaddr_in addr;
56290+
ae4e228f
MT		 56291+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56292+ addr.sin_port = inet_sk(sk)->inet_sport;
58c5fc13
MT		 56293+
56294+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56295+}
56296+
56297+int gr_search_accept(struct socket *sock)
56298+{
56299+ struct sock *sk = sock->sk;
56300+ struct sockaddr_in addr;
56301+
ae4e228f
MT		 56302+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56303+ addr.sin_port = inet_sk(sk)->inet_sport;
58c5fc13
MT		 56304+
56305+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56306+}
56307+
56308+int
56309+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56310+{
56311+ if (addr)
56312+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56313+ else {
56314+ struct sockaddr_in sin;
56315+ const struct inet_sock *inet = inet_sk(sk);
56316+
ae4e228f
MT		 56317+ sin.sin_addr.s_addr = inet->inet_daddr;
56318+ sin.sin_port = inet->inet_dport;
58c5fc13
MT		 56319+
56320+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56321+ }
56322+}
56323+
56324+int
56325+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56326+{
56327+ struct sockaddr_in sin;
56328+
56329+ if (unlikely(skb->len < sizeof (struct udphdr)))
56330+ return 0; // skip this packet
56331+
56332+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56333+ sin.sin_port = udp_hdr(skb)->source;
56334+
56335+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56336+}
66a7e928
MT		 56337diff -urNp linux-2.6.39/grsecurity/gracl_learn.c linux-2.6.39/grsecurity/gracl_learn.c
56338--- linux-2.6.39/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
56339+++ linux-2.6.39/grsecurity/gracl_learn.c 2011-05-22 22:47:45.000000000 -0400
56340@@ -0,0 +1,210 @@
58c5fc13
MT		 56341+#include <linux/kernel.h>
56342+#include <linux/mm.h>
56343+#include <linux/sched.h>
56344+#include <linux/poll.h>
58c5fc13
MT		 56345+#include <linux/string.h>
56346+#include <linux/file.h>
56347+#include <linux/types.h>
56348+#include <linux/vmalloc.h>
56349+#include <linux/grinternal.h>
56350+
56351+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56352+ size_t count, loff_t *ppos);
56353+extern int gr_acl_is_enabled(void);
56354+
56355+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56356+static int gr_learn_attached;
56357+
56358+/* use a 512k buffer */
56359+#define LEARN_BUFFER_SIZE (512 * 1024)
56360+
56361+static DEFINE_SPINLOCK(gr_learn_lock);
bc901d79 56362+static DEFINE_MUTEX(gr_learn_user_mutex);
58c5fc13
MT		 56363+
56364+/* we need to maintain two buffers, so that the kernel context of grlearn
56365+ uses a semaphore around the userspace copying, and the other kernel contexts
56366+ use a spinlock when copying into the buffer, since they cannot sleep
56367+*/
56368+static char *learn_buffer;
56369+static char *learn_buffer_user;
56370+static int learn_buffer_len;
56371+static int learn_buffer_user_len;
56372+
56373+static ssize_t
56374+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56375+{
56376+ DECLARE_WAITQUEUE(wait, current);
56377+ ssize_t retval = 0;
56378+
56379+ add_wait_queue(&learn_wait, &wait);
56380+ set_current_state(TASK_INTERRUPTIBLE);
56381+ do {
bc901d79 56382+ mutex_lock(&gr_learn_user_mutex);
58c5fc13
MT		 56383+ spin_lock(&gr_learn_lock);
56384+ if (learn_buffer_len)
56385+ break;
56386+ spin_unlock(&gr_learn_lock);
bc901d79 56387+ mutex_unlock(&gr_learn_user_mutex);
58c5fc13
MT		 56388+ if (file->f_flags & O_NONBLOCK) {
56389+ retval = -EAGAIN;
56390+ goto out;
56391+ }
56392+ if (signal_pending(current)) {
56393+ retval = -ERESTARTSYS;
56394+ goto out;
56395+ }
56396+
56397+ schedule();
56398+ } while (1);
56399+
56400+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56401+ learn_buffer_user_len = learn_buffer_len;
56402+ retval = learn_buffer_len;
56403+ learn_buffer_len = 0;
56404+
56405+ spin_unlock(&gr_learn_lock);
56406+
56407+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56408+ retval = -EFAULT;
56409+
bc901d79 56410+ mutex_unlock(&gr_learn_user_mutex);
58c5fc13
MT		 56411+out:
56412+ set_current_state(TASK_RUNNING);
56413+ remove_wait_queue(&learn_wait, &wait);
56414+ return retval;
56415+}
56416+
56417+static unsigned int
56418+poll_learn(struct file * file, poll_table * wait)
56419+{
56420+ poll_wait(file, &learn_wait, wait);
56421+
56422+ if (learn_buffer_len)
56423+ return (POLLIN | POLLRDNORM);
56424+
56425+ return 0;
56426+}
56427+
56428+void
56429+gr_clear_learn_entries(void)
56430+{
56431+ char *tmp;
56432+
bc901d79 56433+ mutex_lock(&gr_learn_user_mutex);
58c5fc13
MT		 56434+ if (learn_buffer != NULL) {
56435+ spin_lock(&gr_learn_lock);
56436+ tmp = learn_buffer;
56437+ learn_buffer = NULL;
56438+ spin_unlock(&gr_learn_lock);
56439+ vfree(learn_buffer);
56440+ }
56441+ if (learn_buffer_user != NULL) {
56442+ vfree(learn_buffer_user);
56443+ learn_buffer_user = NULL;
56444+ }
56445+ learn_buffer_len = 0;
bc901d79 56446+ mutex_unlock(&gr_learn_user_mutex);
58c5fc13
MT		 56447+
56448+ return;
56449+}
56450+
56451+void
56452+gr_add_learn_entry(const char *fmt, ...)
56453+{
56454+ va_list args;
56455+ unsigned int len;
56456+
56457+ if (!gr_learn_attached)
56458+ return;
56459+
56460+ spin_lock(&gr_learn_lock);
56461+
56462+ /* leave a gap at the end so we know when it's "full" but don't have to
56463+ compute the exact length of the string we're trying to append
56464+ */
56465+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56466+ spin_unlock(&gr_learn_lock);
56467+ wake_up_interruptible(&learn_wait);
56468+ return;
56469+ }
56470+ if (learn_buffer == NULL) {
56471+ spin_unlock(&gr_learn_lock);
56472+ return;
56473+ }
56474+
56475+ va_start(args, fmt);
56476+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56477+ va_end(args);
56478+
56479+ learn_buffer_len += len + 1;
56480+
56481+ spin_unlock(&gr_learn_lock);
56482+ wake_up_interruptible(&learn_wait);
56483+
56484+ return;
56485+}
56486+
56487+static int
56488+open_learn(struct inode *inode, struct file *file)
56489+{
56490+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56491+ return -EBUSY;
56492+ if (file->f_mode & FMODE_READ) {
56493+ int retval = 0;
bc901d79 56494+ mutex_lock(&gr_learn_user_mutex);
58c5fc13
MT		 56495+ if (learn_buffer == NULL)
56496+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56497+ if (learn_buffer_user == NULL)
56498+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56499+ if (learn_buffer == NULL) {
56500+ retval = -ENOMEM;
56501+ goto out_error;
56502+ }
56503+ if (learn_buffer_user == NULL) {
56504+ retval = -ENOMEM;
56505+ goto out_error;
56506+ }
56507+ learn_buffer_len = 0;
56508+ learn_buffer_user_len = 0;
56509+ gr_learn_attached = 1;
56510+out_error:
bc901d79 56511+ mutex_unlock(&gr_learn_user_mutex);
58c5fc13
MT		 56512+ return retval;
56513+ }
56514+ return 0;
56515+}
56516+
56517+static int
56518+close_learn(struct inode *inode, struct file *file)
56519+{
56520+ char *tmp;
56521+
56522+ if (file->f_mode & FMODE_READ) {
bc901d79 56523+ mutex_lock(&gr_learn_user_mutex);
58c5fc13
MT		 56524+ if (learn_buffer != NULL) {
56525+ spin_lock(&gr_learn_lock);
56526+ tmp = learn_buffer;
56527+ learn_buffer = NULL;
56528+ spin_unlock(&gr_learn_lock);
56529+ vfree(tmp);
56530+ }
56531+ if (learn_buffer_user != NULL) {
56532+ vfree(learn_buffer_user);
56533+ learn_buffer_user = NULL;
56534+ }
56535+ learn_buffer_len = 0;
56536+ learn_buffer_user_len = 0;
56537+ gr_learn_attached = 0;
bc901d79 56538+ mutex_unlock(&gr_learn_user_mutex);
58c5fc13
MT		 56539+ }
56540+
56541+ return 0;
56542+}
56543+
56544+const struct file_operations grsec_fops = {
56545+ .read = read_learn,
56546+ .write = write_grsec_handler,
56547+ .open = open_learn,
56548+ .release = close_learn,
56549+ .poll = poll_learn,
56550+};
66a7e928
MT		 56551diff -urNp linux-2.6.39/grsecurity/gracl_res.c linux-2.6.39/grsecurity/gracl_res.c
56552--- linux-2.6.39/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
56553+++ linux-2.6.39/grsecurity/gracl_res.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c 56554@@ -0,0 +1,68 @@
58c5fc13
MT		 56555+#include <linux/kernel.h>
56556+#include <linux/sched.h>
56557+#include <linux/gracl.h>
56558+#include <linux/grinternal.h>
56559+
56560+static const char *restab_log[] = {
56561+ [RLIMIT_CPU] = "RLIMIT_CPU",
56562+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56563+ [RLIMIT_DATA] = "RLIMIT_DATA",
56564+ [RLIMIT_STACK] = "RLIMIT_STACK",
56565+ [RLIMIT_CORE] = "RLIMIT_CORE",
56566+ [RLIMIT_RSS] = "RLIMIT_RSS",
56567+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56568+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56569+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56570+ [RLIMIT_AS] = "RLIMIT_AS",
56571+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56572+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56573+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56574+ [RLIMIT_NICE] = "RLIMIT_NICE",
56575+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56576+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56577+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56578+};
56579+
56580+void
56581+gr_log_resource(const struct task_struct *task,
56582+ const int res, const unsigned long wanted, const int gt)
56583+{
ae4e228f 56584+ const struct cred *cred;
df50ba0c 56585+ unsigned long rlim;
58c5fc13
MT		 56586+
56587+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56588+ return;
56589+
56590+ // not yet supported resource
df50ba0c
MT		 56591+ if (unlikely(!restab_log[res]))
56592+ return;
56593+
56594+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56595+ rlim = task_rlimit_max(task, res);
56596+ else
56597+ rlim = task_rlimit(task, res);
56598+
56599+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
58c5fc13
MT		 56600+ return;
56601+
ae4e228f
MT		 56602+ rcu_read_lock();
56603+ cred = __task_cred(task);
56604+
56605+ if (res == RLIMIT_NPROC &&
56606+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56607+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56608+ goto out_rcu_unlock;
56609+ else if (res == RLIMIT_MEMLOCK &&
56610+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56611+ goto out_rcu_unlock;
56612+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56613+ goto out_rcu_unlock;
56614+ rcu_read_unlock();
56615+
df50ba0c 56616+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
58c5fc13
MT		 56617+
56618+ return;
ae4e228f
MT		 56619+out_rcu_unlock:
56620+ rcu_read_unlock();
56621+ return;
58c5fc13 56622+}
66a7e928
MT		 56623diff -urNp linux-2.6.39/grsecurity/gracl_segv.c linux-2.6.39/grsecurity/gracl_segv.c
56624--- linux-2.6.39/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
56625+++ linux-2.6.39/grsecurity/gracl_segv.c 2011-05-22 22:47:39.000000000 -0400
56626@@ -0,0 +1,299 @@
58c5fc13
MT		 56627+#include <linux/kernel.h>
56628+#include <linux/mm.h>
56629+#include <asm/uaccess.h>
56630+#include <asm/errno.h>
56631+#include <asm/mman.h>
56632+#include <net/sock.h>
56633+#include <linux/file.h>
56634+#include <linux/fs.h>
56635+#include <linux/net.h>
56636+#include <linux/in.h>
58c5fc13
MT		 56637+#include <linux/slab.h>
56638+#include <linux/types.h>
56639+#include <linux/sched.h>
56640+#include <linux/timer.h>
56641+#include <linux/gracl.h>
56642+#include <linux/grsecurity.h>
56643+#include <linux/grinternal.h>
56644+
56645+static struct crash_uid *uid_set;
56646+static unsigned short uid_used;
56647+static DEFINE_SPINLOCK(gr_uid_lock);
56648+extern rwlock_t gr_inode_lock;
56649+extern struct acl_subject_label *
56650+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56651+ struct acl_role_label *role);
16454cff
MT		 56652+
56653+#ifdef CONFIG_BTRFS_FS
56654+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56655+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56656+#endif
56657+
56658+static inline dev_t __get_dev(const struct dentry *dentry)
56659+{
56660+#ifdef CONFIG_BTRFS_FS
56661+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56662+ return get_btrfs_dev_from_inode(dentry->d_inode);
56663+ else
56664+#endif
56665+ return dentry->d_inode->i_sb->s_dev;
56666+}
56667+
58c5fc13
MT		 56668+int
56669+gr_init_uidset(void)
56670+{
56671+ uid_set =
56672+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56673+ uid_used = 0;
56674+
56675+ return uid_set ? 1 : 0;
56676+}
56677+
56678+void
56679+gr_free_uidset(void)
56680+{
56681+ if (uid_set)
56682+ kfree(uid_set);
56683+
56684+ return;
56685+}
56686+
56687+int
56688+gr_find_uid(const uid_t uid)
56689+{
56690+ struct crash_uid *tmp = uid_set;
56691+ uid_t buid;
56692+ int low = 0, high = uid_used - 1, mid;
56693+
56694+ while (high >= low) {
56695+ mid = (low + high) >> 1;
56696+ buid = tmp[mid].uid;
56697+ if (buid == uid)
56698+ return mid;
56699+ if (buid > uid)
56700+ high = mid - 1;
56701+ if (buid < uid)
56702+ low = mid + 1;
56703+ }
56704+
56705+ return -1;
56706+}
56707+
56708+static __inline__ void
56709+gr_insertsort(void)
56710+{
56711+ unsigned short i, j;
56712+ struct crash_uid index;
56713+
56714+ for (i = 1; i < uid_used; i++) {
56715+ index = uid_set[i];
56716+ j = i;
56717+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56718+ uid_set[j] = uid_set[j - 1];
56719+ j--;
56720+ }
56721+ uid_set[j] = index;
56722+ }
56723+
56724+ return;
56725+}
56726+
56727+static __inline__ void
56728+gr_insert_uid(const uid_t uid, const unsigned long expires)
56729+{
56730+ int loc;
56731+
56732+ if (uid_used == GR_UIDTABLE_MAX)
56733+ return;
56734+
56735+ loc = gr_find_uid(uid);
56736+
56737+ if (loc >= 0) {
56738+ uid_set[loc].expires = expires;
56739+ return;
56740+ }
56741+
56742+ uid_set[uid_used].uid = uid;
56743+ uid_set[uid_used].expires = expires;
56744+ uid_used++;
56745+
56746+ gr_insertsort();
56747+
56748+ return;
56749+}
56750+
56751+void
56752+gr_remove_uid(const unsigned short loc)
56753+{
56754+ unsigned short i;
56755+
56756+ for (i = loc + 1; i < uid_used; i++)
56757+ uid_set[i - 1] = uid_set[i];
56758+
56759+ uid_used--;
56760+
56761+ return;
56762+}
56763+
56764+int
56765+gr_check_crash_uid(const uid_t uid)
56766+{
56767+ int loc;
56768+ int ret = 0;
56769+
56770+ if (unlikely(!gr_acl_is_enabled()))
56771+ return 0;
56772+
56773+ spin_lock(&gr_uid_lock);
56774+ loc = gr_find_uid(uid);
56775+
56776+ if (loc < 0)
56777+ goto out_unlock;
56778+
56779+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
56780+ gr_remove_uid(loc);
56781+ else
56782+ ret = 1;
56783+
56784+out_unlock:
56785+ spin_unlock(&gr_uid_lock);
56786+ return ret;
56787+}
56788+
56789+static __inline__ int
56790+proc_is_setxid(const struct cred *cred)
56791+{
56792+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
56793+ cred->uid != cred->fsuid)
56794+ return 1;
56795+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56796+ cred->gid != cred->fsgid)
56797+ return 1;
56798+
56799+ return 0;
56800+}
58c5fc13 56801+
71d190be 56802+extern int gr_fake_force_sig(int sig, struct task_struct *t);
58c5fc13
MT		 56803+
56804+void
56805+gr_handle_crash(struct task_struct *task, const int sig)
56806+{
56807+ struct acl_subject_label *curr;
56808+ struct acl_subject_label *curr2;
56809+ struct task_struct *tsk, *tsk2;
ae4e228f 56810+ const struct cred *cred;
58c5fc13
MT		 56811+ const struct cred *cred2;
56812+
56813+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56814+ return;
56815+
56816+ if (unlikely(!gr_acl_is_enabled()))
56817+ return;
56818+
56819+ curr = task->acl;
56820+
56821+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
56822+ return;
56823+
56824+ if (time_before_eq(curr->expires, get_seconds())) {
56825+ curr->expires = 0;
56826+ curr->crashes = 0;
56827+ }
56828+
56829+ curr->crashes++;
56830+
56831+ if (!curr->expires)
56832+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56833+
56834+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56835+ time_after(curr->expires, get_seconds())) {
ae4e228f
MT		 56836+ rcu_read_lock();
56837+ cred = __task_cred(task);
58c5fc13
MT		 56838+ if (cred->uid && proc_is_setxid(cred)) {
56839+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56840+ spin_lock(&gr_uid_lock);
56841+ gr_insert_uid(cred->uid, curr->expires);
56842+ spin_unlock(&gr_uid_lock);
56843+ curr->expires = 0;
56844+ curr->crashes = 0;
56845+ read_lock(&tasklist_lock);
56846+ do_each_thread(tsk2, tsk) {
56847+ cred2 = __task_cred(tsk);
56848+ if (tsk != task && cred2->uid == cred->uid)
56849+ gr_fake_force_sig(SIGKILL, tsk);
56850+ } while_each_thread(tsk2, tsk);
56851+ read_unlock(&tasklist_lock);
56852+ } else {
56853+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56854+ read_lock(&tasklist_lock);
56855+ do_each_thread(tsk2, tsk) {
56856+ if (likely(tsk != task)) {
56857+ curr2 = tsk->acl;
56858+
56859+ if (curr2->device == curr->device &&
56860+ curr2->inode == curr->inode)
56861+ gr_fake_force_sig(SIGKILL, tsk);
56862+ }
56863+ } while_each_thread(tsk2, tsk);
56864+ read_unlock(&tasklist_lock);
56865+ }
ae4e228f 56866+ rcu_read_unlock();
58c5fc13
MT		 56867+ }
56868+
56869+ return;
56870+}
56871+
56872+int
56873+gr_check_crash_exec(const struct file *filp)
56874+{
56875+ struct acl_subject_label *curr;
56876+
56877+ if (unlikely(!gr_acl_is_enabled()))
56878+ return 0;
56879+
56880+ read_lock(&gr_inode_lock);
56881+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
16454cff 56882+ __get_dev(filp->f_path.dentry),
58c5fc13
MT		 56883+ current->role);
56884+ read_unlock(&gr_inode_lock);
56885+
56886+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56887+ (!curr->crashes && !curr->expires))
56888+ return 0;
56889+
56890+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56891+ time_after(curr->expires, get_seconds()))
56892+ return 1;
56893+ else if (time_before_eq(curr->expires, get_seconds())) {
56894+ curr->crashes = 0;
56895+ curr->expires = 0;
56896+ }
56897+
56898+ return 0;
56899+}
56900+
56901+void
56902+gr_handle_alertkill(struct task_struct *task)
56903+{
56904+ struct acl_subject_label *curracl;
56905+ __u32 curr_ip;
56906+ struct task_struct *p, *p2;
56907+
56908+ if (unlikely(!gr_acl_is_enabled()))
56909+ return;
56910+
56911+ curracl = task->acl;
56912+ curr_ip = task->signal->curr_ip;
56913+
56914+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56915+ read_lock(&tasklist_lock);
56916+ do_each_thread(p2, p) {
56917+ if (p->signal->curr_ip == curr_ip)
56918+ gr_fake_force_sig(SIGKILL, p);
56919+ } while_each_thread(p2, p);
56920+ read_unlock(&tasklist_lock);
56921+ } else if (curracl->mode & GR_KILLPROC)
56922+ gr_fake_force_sig(SIGKILL, task);
56923+
56924+ return;
56925+}
66a7e928
MT		 56926diff -urNp linux-2.6.39/grsecurity/gracl_shm.c linux-2.6.39/grsecurity/gracl_shm.c
56927--- linux-2.6.39/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
56928+++ linux-2.6.39/grsecurity/gracl_shm.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c 56929@@ -0,0 +1,40 @@
58c5fc13
MT		 56930+#include <linux/kernel.h>
56931+#include <linux/mm.h>
56932+#include <linux/sched.h>
56933+#include <linux/file.h>
56934+#include <linux/ipc.h>
56935+#include <linux/gracl.h>
56936+#include <linux/grsecurity.h>
56937+#include <linux/grinternal.h>
56938+
56939+int
56940+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56941+ const time_t shm_createtime, const uid_t cuid, const int shmid)
56942+{
56943+ struct task_struct *task;
56944+
56945+ if (!gr_acl_is_enabled())
56946+ return 1;
56947+
df50ba0c 56948+ rcu_read_lock();
58c5fc13
MT		 56949+ read_lock(&tasklist_lock);
56950+
56951+ task = find_task_by_vpid(shm_cprid);
56952+
56953+ if (unlikely(!task))
56954+ task = find_task_by_vpid(shm_lapid);
56955+
56956+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56957+ (task->pid == shm_lapid)) &&
56958+ (task->acl->mode & GR_PROTSHM) &&
56959+ (task->acl != current->acl))) {
56960+ read_unlock(&tasklist_lock);
df50ba0c 56961+ rcu_read_unlock();
58c5fc13
MT		 56962+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56963+ return 0;
56964+ }
56965+ read_unlock(&tasklist_lock);
df50ba0c 56966+ rcu_read_unlock();
58c5fc13
MT		 56967+
56968+ return 1;
56969+}
66a7e928
MT		 56970diff -urNp linux-2.6.39/grsecurity/grsec_chdir.c linux-2.6.39/grsecurity/grsec_chdir.c
56971--- linux-2.6.39/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
56972+++ linux-2.6.39/grsecurity/grsec_chdir.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 56973@@ -0,0 +1,19 @@
56974+#include <linux/kernel.h>
56975+#include <linux/sched.h>
56976+#include <linux/fs.h>
56977+#include <linux/file.h>
56978+#include <linux/grsecurity.h>
56979+#include <linux/grinternal.h>
56980+
56981+void
56982+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56983+{
56984+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56985+ if ((grsec_enable_chdir && grsec_enable_group &&
56986+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56987+ !grsec_enable_group)) {
56988+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56989+ }
56990+#endif
56991+ return;
56992+}
66a7e928
MT		 56993diff -urNp linux-2.6.39/grsecurity/grsec_chroot.c linux-2.6.39/grsecurity/grsec_chroot.c
56994--- linux-2.6.39/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
56995+++ linux-2.6.39/grsecurity/grsec_chroot.c 2011-05-22 19:41:42.000000000 -0400
71d190be 56996@@ -0,0 +1,355 @@
58c5fc13
MT		 56997+#include <linux/kernel.h>
56998+#include <linux/module.h>
56999+#include <linux/sched.h>
57000+#include <linux/file.h>
57001+#include <linux/fs.h>
57002+#include <linux/mount.h>
57003+#include <linux/types.h>
57004+#include <linux/pid_namespace.h>
57005+#include <linux/grsecurity.h>
57006+#include <linux/grinternal.h>
57007+
df50ba0c
MT		 57008+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57009+{
57010+#ifdef CONFIG_GRKERNSEC
57011+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57012+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
57013+ task->gr_is_chrooted = 1;
57014+ else
57015+ task->gr_is_chrooted = 0;
57016+
57017+ task->gr_chroot_dentry = path->dentry;
57018+#endif
57019+ return;
57020+}
57021+
57022+void gr_clear_chroot_entries(struct task_struct *task)
57023+{
57024+#ifdef CONFIG_GRKERNSEC
57025+ task->gr_is_chrooted = 0;
57026+ task->gr_chroot_dentry = NULL;
57027+#endif
57028+ return;
57029+}
57030+
58c5fc13 57031+int
6892158b 57032+gr_handle_chroot_unix(struct pid *pid)
58c5fc13
MT		 57033+{
57034+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
6892158b 57035+ struct task_struct *p;
58c5fc13
MT		 57036+
57037+ if (unlikely(!grsec_enable_chroot_unix))
57038+ return 1;
57039+
57040+ if (likely(!proc_is_chrooted(current)))
57041+ return 1;
57042+
df50ba0c 57043+ rcu_read_lock();
58c5fc13 57044+ read_lock(&tasklist_lock);
6892158b 57045+ p = pid_task(pid, PIDTYPE_PID);
71d190be 57046+ if (unlikely(p && !have_same_root(current, p))) {
6892158b
MT		 57047+ read_unlock(&tasklist_lock);
57048+ rcu_read_unlock();
57049+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57050+ return 0;
58c5fc13
MT		 57051+ }
57052+ read_unlock(&tasklist_lock);
df50ba0c 57053+ rcu_read_unlock();
58c5fc13
MT		 57054+#endif
57055+ return 1;
57056+}
57057+
57058+int
57059+gr_handle_chroot_nice(void)
57060+{
57061+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57062+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57063+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57064+ return -EPERM;
57065+ }
57066+#endif
57067+ return 0;
57068+}
57069+
57070+int
57071+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57072+{
57073+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57074+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57075+ && proc_is_chrooted(current)) {
57076+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57077+ return -EACCES;
57078+ }
57079+#endif
57080+ return 0;
57081+}
57082+
57083+int
57084+gr_handle_chroot_rawio(const struct inode *inode)
57085+{
57086+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57087+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57088+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57089+ return 1;
57090+#endif
57091+ return 0;
57092+}
57093+
57094+int
57199397
MT		 57095+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57096+{
57097+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57098+ struct task_struct *p;
57099+ int ret = 0;
57100+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57101+ return ret;
57102+
57103+ read_lock(&tasklist_lock);
57104+ do_each_pid_task(pid, type, p) {
57105+ if (!have_same_root(current, p)) {
57106+ ret = 1;
57107+ goto out;
57108+ }
57109+ } while_each_pid_task(pid, type, p);
57110+out:
57111+ read_unlock(&tasklist_lock);
57112+ return ret;
57113+#endif
57114+ return 0;
57115+}
57116+
57117+int
58c5fc13
MT		 57118+gr_pid_is_chrooted(struct task_struct *p)
57119+{
57120+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57121+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57122+ return 0;
57123+
58c5fc13
MT		 57124+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57125+ !have_same_root(current, p)) {
58c5fc13
MT		 57126+ return 1;
57127+ }
58c5fc13
MT		 57128+#endif
57129+ return 0;
57130+}
57131+
57132+EXPORT_SYMBOL(gr_pid_is_chrooted);
57133+
57134+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57135+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57136+{
16454cff
MT		 57137+ struct path path, currentroot;
57138+ int ret = 0;
58c5fc13 57139+
16454cff
MT		 57140+ path.dentry = (struct dentry *)u_dentry;
57141+ path.mnt = (struct vfsmount *)u_mnt;
6892158b 57142+ get_fs_root(current->fs, &currentroot);
16454cff
MT		 57143+ if (path_is_under(&path, &currentroot))
57144+ ret = 1;
6892158b 57145+ path_put(&currentroot);
58c5fc13 57146+
58c5fc13
MT		 57147+ return ret;
57148+}
57149+#endif
57150+
57151+int
57152+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57153+{
57154+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57155+ if (!grsec_enable_chroot_fchdir)
57156+ return 1;
57157+
57158+ if (!proc_is_chrooted(current))
57159+ return 1;
57160+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57161+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57162+ return 0;
57163+ }
57164+#endif
57165+ return 1;
57166+}
57167+
57168+int
57169+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57170+ const time_t shm_createtime)
57171+{
57172+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57173+ struct pid *pid = NULL;
57174+ time_t starttime;
57175+
57176+ if (unlikely(!grsec_enable_chroot_shmat))
57177+ return 1;
57178+
57179+ if (likely(!proc_is_chrooted(current)))
57180+ return 1;
57181+
df50ba0c 57182+ rcu_read_lock();
58c5fc13
MT		 57183+ read_lock(&tasklist_lock);
57184+
57185+ pid = find_vpid(shm_cprid);
57186+ if (pid) {
57187+ struct task_struct *p;
57188+ p = pid_task(pid, PIDTYPE_PID);
71d190be
MT		 57189+ if (p == NULL)
57190+ goto unlock;
58c5fc13
MT		 57191+ starttime = p->start_time.tv_sec;
57192+ if (unlikely(!have_same_root(current, p) &&
57193+ time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
58c5fc13 57194+ read_unlock(&tasklist_lock);
df50ba0c 57195+ rcu_read_unlock();
58c5fc13
MT		 57196+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57197+ return 0;
57198+ }
58c5fc13
MT		 57199+ } else {
57200+ pid = find_vpid(shm_lapid);
57201+ if (pid) {
57202+ struct task_struct *p;
57203+ p = pid_task(pid, PIDTYPE_PID);
71d190be
MT		 57204+ if (p == NULL)
57205+ goto unlock;
58c5fc13 57206+ if (unlikely(!have_same_root(current, p))) {
58c5fc13 57207+ read_unlock(&tasklist_lock);
df50ba0c 57208+ rcu_read_unlock();
58c5fc13
MT		 57209+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57210+ return 0;
57211+ }
58c5fc13
MT		 57212+ }
57213+ }
71d190be 57214+unlock:
58c5fc13 57215+ read_unlock(&tasklist_lock);
df50ba0c 57216+ rcu_read_unlock();
58c5fc13
MT		 57217+#endif
57218+ return 1;
57219+}
57220+
57221+void
57222+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57223+{
57224+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57225+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57226+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57227+#endif
57228+ return;
57229+}
57230+
57231+int
57232+gr_handle_chroot_mknod(const struct dentry *dentry,
57233+ const struct vfsmount *mnt, const int mode)
57234+{
57235+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57236+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57237+ proc_is_chrooted(current)) {
57238+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57239+ return -EPERM;
57240+ }
57241+#endif
57242+ return 0;
57243+}
57244+
57245+int
57246+gr_handle_chroot_mount(const struct dentry *dentry,
57247+ const struct vfsmount *mnt, const char *dev_name)
57248+{
57249+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57250+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57251+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
57252+ return -EPERM;
57253+ }
57254+#endif
57255+ return 0;
57256+}
57257+
57258+int
57259+gr_handle_chroot_pivot(void)
57260+{
57261+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57262+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57263+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57264+ return -EPERM;
57265+ }
57266+#endif
57267+ return 0;
57268+}
57269+
57270+int
57271+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57272+{
57273+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57274+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57275+ !gr_is_outside_chroot(dentry, mnt)) {
57276+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57277+ return -EPERM;
57278+ }
57279+#endif
57280+ return 0;
57281+}
57282+
57283+int
57284+gr_handle_chroot_caps(struct path *path)
57285+{
57286+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57287+ if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
57288+ (init_task.fs->root.dentry != path->dentry) &&
57289+ (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
57290+
57291+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57292+ const struct cred *old = current_cred();
57293+ struct cred *new = prepare_creds();
57294+ if (new == NULL)
57295+ return 1;
57296+
57297+ new->cap_permitted = cap_drop(old->cap_permitted,
57298+ chroot_caps);
57299+ new->cap_inheritable = cap_drop(old->cap_inheritable,
57300+ chroot_caps);
57301+ new->cap_effective = cap_drop(old->cap_effective,
57302+ chroot_caps);
57303+
57304+ commit_creds(new);
57305+
57306+ return 0;
57307+ }
57308+#endif
57309+ return 0;
57310+}
57311+
57312+int
57313+gr_handle_chroot_sysctl(const int op)
57314+{
57315+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
ae4e228f
MT		 57316+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57317+ proc_is_chrooted(current))
58c5fc13
MT		 57318+ return -EACCES;
57319+#endif
57320+ return 0;
57321+}
57322+
57323+void
57324+gr_handle_chroot_chdir(struct path *path)
57325+{
57326+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57327+ if (grsec_enable_chroot_chdir)
57328+ set_fs_pwd(current->fs, path);
57329+#endif
57330+ return;
57331+}
57332+
57333+int
57334+gr_handle_chroot_chmod(const struct dentry *dentry,
57335+ const struct vfsmount *mnt, const int mode)
57336+{
57337+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
bc901d79
MT		 57338+ /* allow chmod +s on directories, but not files */
57339+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
58c5fc13
MT		 57340+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57341+ proc_is_chrooted(current)) {
57342+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57343+ return -EPERM;
57344+ }
57345+#endif
57346+ return 0;
57347+}
57348+
57349+#ifdef CONFIG_SECURITY
57350+EXPORT_SYMBOL(gr_handle_chroot_caps);
57351+#endif
66a7e928
MT		 57352diff -urNp linux-2.6.39/grsecurity/grsec_disabled.c linux-2.6.39/grsecurity/grsec_disabled.c
57353--- linux-2.6.39/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
57354+++ linux-2.6.39/grsecurity/grsec_disabled.c 2011-05-22 19:41:42.000000000 -0400
16454cff 57355@@ -0,0 +1,447 @@
58c5fc13
MT		 57356+#include <linux/kernel.h>
57357+#include <linux/module.h>
57358+#include <linux/sched.h>
57359+#include <linux/file.h>
57360+#include <linux/fs.h>
57361+#include <linux/kdev_t.h>
57362+#include <linux/net.h>
57363+#include <linux/in.h>
57364+#include <linux/ip.h>
57365+#include <linux/skbuff.h>
57366+#include <linux/sysctl.h>
57367+
57368+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57369+void
57370+pax_set_initial_flags(struct linux_binprm *bprm)
57371+{
57372+ return;
57373+}
57374+#endif
57375+
57376+#ifdef CONFIG_SYSCTL
57377+__u32
57378+gr_handle_sysctl(const struct ctl_table * table, const int op)
57379+{
57380+ return 0;
57381+}
57382+#endif
57383+
57384+#ifdef CONFIG_TASKSTATS
57385+int gr_is_taskstats_denied(int pid)
57386+{
57387+ return 0;
57388+}
57389+#endif
57390+
57391+int
57392+gr_acl_is_enabled(void)
57393+{
57394+ return 0;
57395+}
57396+
57397+int
57398+gr_handle_rawio(const struct inode *inode)
57399+{
57400+ return 0;
57401+}
57402+
57403+void
57404+gr_acl_handle_psacct(struct task_struct *task, const long code)
57405+{
57406+ return;
57407+}
57408+
57409+int
57410+gr_handle_ptrace(struct task_struct *task, const long request)
57411+{
57412+ return 0;
57413+}
57414+
57415+int
57416+gr_handle_proc_ptrace(struct task_struct *task)
57417+{
57418+ return 0;
57419+}
57420+
57421+void
57422+gr_learn_resource(const struct task_struct *task,
57423+ const int res, const unsigned long wanted, const int gt)
57424+{
57425+ return;
57426+}
57427+
57428+int
57429+gr_set_acls(const int type)
57430+{
57431+ return 0;
57432+}
57433+
57434+int
57435+gr_check_hidden_task(const struct task_struct *tsk)
57436+{
57437+ return 0;
57438+}
57439+
57440+int
57441+gr_check_protected_task(const struct task_struct *task)
57442+{
57443+ return 0;
57444+}
57445+
57199397
MT		 57446+int
57447+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57448+{
57449+ return 0;
57450+}
57451+
58c5fc13
MT		 57452+void
57453+gr_copy_label(struct task_struct *tsk)
57454+{
57455+ return;
57456+}
57457+
57458+void
57459+gr_set_pax_flags(struct task_struct *task)
57460+{
57461+ return;
57462+}
57463+
57464+int
57465+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57466+ const int unsafe_share)
57467+{
57468+ return 0;
57469+}
57470+
57471+void
57472+gr_handle_delete(const ino_t ino, const dev_t dev)
57473+{
57474+ return;
57475+}
57476+
57477+void
57478+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57479+{
57480+ return;
57481+}
57482+
57483+void
57484+gr_handle_crash(struct task_struct *task, const int sig)
57485+{
57486+ return;
57487+}
57488+
57489+int
57490+gr_check_crash_exec(const struct file *filp)
57491+{
57492+ return 0;
57493+}
57494+
57495+int
57496+gr_check_crash_uid(const uid_t uid)
57497+{
57498+ return 0;
57499+}
57500+
57501+void
57502+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57503+ struct dentry *old_dentry,
57504+ struct dentry *new_dentry,
57505+ struct vfsmount *mnt, const __u8 replace)
57506+{
57507+ return;
57508+}
57509+
57510+int
57511+gr_search_socket(const int family, const int type, const int protocol)
57512+{
57513+ return 1;
57514+}
57515+
57516+int
57517+gr_search_connectbind(const int mode, const struct socket *sock,
57518+ const struct sockaddr_in *addr)
57519+{
57520+ return 0;
57521+}
57522+
57523+int
57524+gr_is_capable(const int cap)
57525+{
57526+ return 1;
57527+}
57528+
57529+int
57530+gr_is_capable_nolog(const int cap)
57531+{
57532+ return 1;
57533+}
57534+
57535+void
57536+gr_handle_alertkill(struct task_struct *task)
57537+{
57538+ return;
57539+}
57540+
57541+__u32
57542+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57543+{
57544+ return 1;
57545+}
57546+
57547+__u32
57548+gr_acl_handle_hidden_file(const struct dentry * dentry,
57549+ const struct vfsmount * mnt)
57550+{
57551+ return 1;
57552+}
57553+
57554+__u32
57555+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57556+ const int fmode)
57557+{
57558+ return 1;
57559+}
57560+
57561+__u32
57562+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57563+{
57564+ return 1;
57565+}
57566+
57567+__u32
57568+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57569+{
57570+ return 1;
57571+}
57572+
57573+int
57574+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57575+ unsigned int *vm_flags)
57576+{
57577+ return 1;
57578+}
57579+
57580+__u32
57581+gr_acl_handle_truncate(const struct dentry * dentry,
57582+ const struct vfsmount * mnt)
57583+{
57584+ return 1;
57585+}
57586+
57587+__u32
57588+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57589+{
57590+ return 1;
57591+}
57592+
57593+__u32
57594+gr_acl_handle_access(const struct dentry * dentry,
57595+ const struct vfsmount * mnt, const int fmode)
57596+{
57597+ return 1;
57598+}
57599+
57600+__u32
57601+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57602+ mode_t mode)
57603+{
57604+ return 1;
57605+}
57606+
57607+__u32
57608+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57609+ mode_t mode)
57610+{
57611+ return 1;
57612+}
57613+
57614+__u32
57615+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57616+{
57617+ return 1;
57618+}
57619+
bc901d79
MT		 57620+__u32
57621+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57622+{
57623+ return 1;
57624+}
57625+
58c5fc13
MT		 57626+void
57627+grsecurity_init(void)
57628+{
57629+ return;
57630+}
57631+
57632+__u32
57633+gr_acl_handle_mknod(const struct dentry * new_dentry,
57634+ const struct dentry * parent_dentry,
57635+ const struct vfsmount * parent_mnt,
57636+ const int mode)
57637+{
57638+ return 1;
57639+}
57640+
57641+__u32
57642+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57643+ const struct dentry * parent_dentry,
57644+ const struct vfsmount * parent_mnt)
57645+{
57646+ return 1;
57647+}
57648+
57649+__u32
57650+gr_acl_handle_symlink(const struct dentry * new_dentry,
57651+ const struct dentry * parent_dentry,
57652+ const struct vfsmount * parent_mnt, const char *from)
57653+{
57654+ return 1;
57655+}
57656+
57657+__u32
57658+gr_acl_handle_link(const struct dentry * new_dentry,
57659+ const struct dentry * parent_dentry,
57660+ const struct vfsmount * parent_mnt,
57661+ const struct dentry * old_dentry,
57662+ const struct vfsmount * old_mnt, const char *to)
57663+{
57664+ return 1;
57665+}
57666+
57667+int
57668+gr_acl_handle_rename(const struct dentry *new_dentry,
57669+ const struct dentry *parent_dentry,
57670+ const struct vfsmount *parent_mnt,
57671+ const struct dentry *old_dentry,
57672+ const struct inode *old_parent_inode,
57673+ const struct vfsmount *old_mnt, const char *newname)
57674+{
57675+ return 0;
57676+}
57677+
57678+int
57679+gr_acl_handle_filldir(const struct file *file, const char *name,
57680+ const int namelen, const ino_t ino)
57681+{
57682+ return 1;
57683+}
57684+
57685+int
57686+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57687+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57688+{
57689+ return 1;
57690+}
57691+
57692+int
57693+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57694+{
57695+ return 0;
57696+}
57697+
57698+int
57699+gr_search_accept(const struct socket *sock)
57700+{
57701+ return 0;
57702+}
57703+
57704+int
57705+gr_search_listen(const struct socket *sock)
57706+{
57707+ return 0;
57708+}
57709+
57710+int
57711+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57712+{
57713+ return 0;
57714+}
57715+
57716+__u32
57717+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57718+{
57719+ return 1;
57720+}
57721+
57722+__u32
57723+gr_acl_handle_creat(const struct dentry * dentry,
57724+ const struct dentry * p_dentry,
57725+ const struct vfsmount * p_mnt, const int fmode,
57726+ const int imode)
57727+{
57728+ return 1;
57729+}
57730+
57731+void
57732+gr_acl_handle_exit(void)
57733+{
57734+ return;
57735+}
57736+
57737+int
57738+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57739+{
57740+ return 1;
57741+}
57742+
57743+void
57744+gr_set_role_label(const uid_t uid, const gid_t gid)
57745+{
57746+ return;
57747+}
57748+
57749+int
57750+gr_acl_handle_procpidmem(const struct task_struct *task)
57751+{
57752+ return 0;
57753+}
57754+
57755+int
57756+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57757+{
57758+ return 0;
57759+}
57760+
57761+int
57762+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57763+{
57764+ return 0;
57765+}
57766+
57767+void
57768+gr_set_kernel_label(struct task_struct *task)
57769+{
57770+ return;
57771+}
57772+
57773+int
57774+gr_check_user_change(int real, int effective, int fs)
57775+{
57776+ return 0;
57777+}
57778+
57779+int
57780+gr_check_group_change(int real, int effective, int fs)
57781+{
57782+ return 0;
57783+}
57784+
bc901d79
MT		 57785+int gr_acl_enable_at_secure(void)
57786+{
57787+ return 0;
57788+}
57789+
16454cff
MT		 57790+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57791+{
57792+ return dentry->d_inode->i_sb->s_dev;
57793+}
57794+
58c5fc13
MT		 57795+EXPORT_SYMBOL(gr_is_capable);
57796+EXPORT_SYMBOL(gr_is_capable_nolog);
57797+EXPORT_SYMBOL(gr_learn_resource);
57798+EXPORT_SYMBOL(gr_set_kernel_label);
57799+#ifdef CONFIG_SECURITY
57800+EXPORT_SYMBOL(gr_check_user_change);
57801+EXPORT_SYMBOL(gr_check_group_change);
57802+#endif
66a7e928
MT		 57803diff -urNp linux-2.6.39/grsecurity/grsec_exec.c linux-2.6.39/grsecurity/grsec_exec.c
57804--- linux-2.6.39/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
57805+++ linux-2.6.39/grsecurity/grsec_exec.c 2011-05-22 22:41:29.000000000 -0400
57806@@ -0,0 +1,146 @@
58c5fc13
MT		 57807+#include <linux/kernel.h>
57808+#include <linux/sched.h>
57809+#include <linux/file.h>
57810+#include <linux/binfmts.h>
58c5fc13
MT		 57811+#include <linux/fs.h>
57812+#include <linux/types.h>
57813+#include <linux/grdefs.h>
57814+#include <linux/grinternal.h>
57815+#include <linux/capability.h>
bc901d79 57816+#include <linux/compat.h>
58c5fc13
MT		 57817+
57818+#include <asm/uaccess.h>
57819+
57820+#ifdef CONFIG_GRKERNSEC_EXECLOG
57821+static char gr_exec_arg_buf[132];
bc901d79 57822+static DEFINE_MUTEX(gr_exec_arg_mutex);
58c5fc13
MT		 57823+#endif
57824+
57825+int
57826+gr_handle_nproc(void)
57827+{
57828+#ifdef CONFIG_GRKERNSEC_EXECVE
57829+ const struct cred *cred = current_cred();
57830+ if (grsec_enable_execve && cred->user &&
df50ba0c 57831+ (atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) &&
58c5fc13
MT		 57832+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
57833+ gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
57834+ return -EAGAIN;
57835+ }
57836+#endif
57837+ return 0;
57838+}
57839+
57840+void
6892158b 57841+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
58c5fc13
MT		 57842+{
57843+#ifdef CONFIG_GRKERNSEC_EXECLOG
57844+ char *grarg = gr_exec_arg_buf;
57845+ unsigned int i, x, execlen = 0;
57846+ char c;
57847+
57848+ if (!((grsec_enable_execlog && grsec_enable_group &&
57849+ in_group_p(grsec_audit_gid))
57850+ || (grsec_enable_execlog && !grsec_enable_group)))
57851+ return;
57852+
bc901d79 57853+ mutex_lock(&gr_exec_arg_mutex);
58c5fc13
MT		 57854+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57855+
57856+ if (unlikely(argv == NULL))
57857+ goto log;
57858+
57859+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57860+ const char __user *p;
57861+ unsigned int len;
57862+
57863+ if (copy_from_user(&p, argv + i, sizeof(p)))
57864+ goto log;
57865+ if (!p)
57866+ goto log;
57867+ len = strnlen_user(p, 128 - execlen);
57868+ if (len > 128 - execlen)
57869+ len = 128 - execlen;
57870+ else if (len > 0)
57871+ len--;
57872+ if (copy_from_user(grarg + execlen, p, len))
57873+ goto log;
57874+
57875+ /* rewrite unprintable characters */
57876+ for (x = 0; x < len; x++) {
57877+ c = *(grarg + execlen + x);
57878+ if (c < 32 || c > 126)
57879+ *(grarg + execlen + x) = ' ';
57880+ }
57881+
57882+ execlen += len;
57883+ *(grarg + execlen) = ' ';
57884+ *(grarg + execlen + 1) = '\0';
57885+ execlen++;
57886+ }
57887+
57888+ log:
57889+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57890+ bprm->file->f_path.mnt, grarg);
bc901d79 57891+ mutex_unlock(&gr_exec_arg_mutex);
58c5fc13
MT		 57892+#endif
57893+ return;
57894+}
bc901d79
MT		 57895+
57896+#ifdef CONFIG_COMPAT
57897+void
57898+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
57899+{
57900+#ifdef CONFIG_GRKERNSEC_EXECLOG
57901+ char *grarg = gr_exec_arg_buf;
57902+ unsigned int i, x, execlen = 0;
57903+ char c;
57904+
57905+ if (!((grsec_enable_execlog && grsec_enable_group &&
57906+ in_group_p(grsec_audit_gid))
57907+ || (grsec_enable_execlog && !grsec_enable_group)))
57908+ return;
57909+
57910+ mutex_lock(&gr_exec_arg_mutex);
57911+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57912+
57913+ if (unlikely(argv == NULL))
57914+ goto log;
57915+
57916+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57917+ compat_uptr_t p;
57918+ unsigned int len;
57919+
57920+ if (get_user(p, argv + i))
57921+ goto log;
57922+ len = strnlen_user(compat_ptr(p), 128 - execlen);
57923+ if (len > 128 - execlen)
57924+ len = 128 - execlen;
57925+ else if (len > 0)
57926+ len--;
57927+ else
57928+ goto log;
57929+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
57930+ goto log;
57931+
57932+ /* rewrite unprintable characters */
57933+ for (x = 0; x < len; x++) {
57934+ c = *(grarg + execlen + x);
57935+ if (c < 32 || c > 126)
57936+ *(grarg + execlen + x) = ' ';
57937+ }
57938+
57939+ execlen += len;
57940+ *(grarg + execlen) = ' ';
57941+ *(grarg + execlen + 1) = '\0';
57942+ execlen++;
57943+ }
57944+
57945+ log:
57946+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57947+ bprm->file->f_path.mnt, grarg);
57948+ mutex_unlock(&gr_exec_arg_mutex);
57949+#endif
57950+ return;
57951+}
57952+#endif
66a7e928
MT		 57953diff -urNp linux-2.6.39/grsecurity/grsec_fifo.c linux-2.6.39/grsecurity/grsec_fifo.c
57954--- linux-2.6.39/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
57955+++ linux-2.6.39/grsecurity/grsec_fifo.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 57956@@ -0,0 +1,24 @@
57957+#include <linux/kernel.h>
57958+#include <linux/sched.h>
57959+#include <linux/fs.h>
57960+#include <linux/file.h>
57961+#include <linux/grinternal.h>
57962+
57963+int
57964+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
57965+ const struct dentry *dir, const int flag, const int acc_mode)
57966+{
57967+#ifdef CONFIG_GRKERNSEC_FIFO
57968+ const struct cred *cred = current_cred();
57969+
57970+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
57971+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
57972+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
57973+ (cred->fsuid != dentry->d_inode->i_uid)) {
16454cff 57974+ if (!inode_permission(dentry->d_inode, acc_mode))
58c5fc13
MT		 57975+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
57976+ return -EACCES;
57977+ }
57978+#endif
57979+ return 0;
57980+}
66a7e928
MT		 57981diff -urNp linux-2.6.39/grsecurity/grsec_fork.c linux-2.6.39/grsecurity/grsec_fork.c
57982--- linux-2.6.39/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
57983+++ linux-2.6.39/grsecurity/grsec_fork.c 2011-05-22 19:41:42.000000000 -0400
6892158b 57984@@ -0,0 +1,23 @@
58c5fc13
MT		 57985+#include <linux/kernel.h>
57986+#include <linux/sched.h>
57987+#include <linux/grsecurity.h>
57988+#include <linux/grinternal.h>
57989+#include <linux/errno.h>
57990+
57991+void
57992+gr_log_forkfail(const int retval)
57993+{
57994+#ifdef CONFIG_GRKERNSEC_FORKFAIL
6892158b
MT		 57995+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
57996+ switch (retval) {
57997+ case -EAGAIN:
57998+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
57999+ break;
58000+ case -ENOMEM:
58001+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58002+ break;
58003+ }
58004+ }
58c5fc13
MT		 58005+#endif
58006+ return;
58007+}
66a7e928
MT		 58008diff -urNp linux-2.6.39/grsecurity/grsec_init.c linux-2.6.39/grsecurity/grsec_init.c
58009--- linux-2.6.39/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
58010+++ linux-2.6.39/grsecurity/grsec_init.c 2011-05-22 22:47:15.000000000 -0400
58011@@ -0,0 +1,269 @@
58c5fc13
MT		 58012+#include <linux/kernel.h>
58013+#include <linux/sched.h>
58014+#include <linux/mm.h>
58c5fc13
MT		 58015+#include <linux/gracl.h>
58016+#include <linux/slab.h>
58017+#include <linux/vmalloc.h>
58018+#include <linux/percpu.h>
df50ba0c 58019+#include <linux/module.h>
58c5fc13
MT		 58020+
58021+int grsec_enable_link;
58022+int grsec_enable_dmesg;
58023+int grsec_enable_harden_ptrace;
58024+int grsec_enable_fifo;
58025+int grsec_enable_execve;
58026+int grsec_enable_execlog;
58027+int grsec_enable_signal;
58028+int grsec_enable_forkfail;
ae4e228f 58029+int grsec_enable_audit_ptrace;
58c5fc13
MT		 58030+int grsec_enable_time;
58031+int grsec_enable_audit_textrel;
58032+int grsec_enable_group;
58033+int grsec_audit_gid;
58034+int grsec_enable_chdir;
58035+int grsec_enable_mount;
ae4e228f 58036+int grsec_enable_rofs;
58c5fc13
MT		 58037+int grsec_enable_chroot_findtask;
58038+int grsec_enable_chroot_mount;
58039+int grsec_enable_chroot_shmat;
58040+int grsec_enable_chroot_fchdir;
58041+int grsec_enable_chroot_double;
58042+int grsec_enable_chroot_pivot;
58043+int grsec_enable_chroot_chdir;
58044+int grsec_enable_chroot_chmod;
58045+int grsec_enable_chroot_mknod;
58046+int grsec_enable_chroot_nice;
58047+int grsec_enable_chroot_execlog;
58048+int grsec_enable_chroot_caps;
58049+int grsec_enable_chroot_sysctl;
58050+int grsec_enable_chroot_unix;
58051+int grsec_enable_tpe;
58052+int grsec_tpe_gid;
ae4e228f 58053+int grsec_enable_blackhole;
df50ba0c
MT		 58054+#ifdef CONFIG_IPV6_MODULE
58055+EXPORT_SYMBOL(grsec_enable_blackhole);
58056+#endif
ae4e228f 58057+int grsec_lastack_retries;
58c5fc13 58058+int grsec_enable_tpe_all;
57199397 58059+int grsec_enable_tpe_invert;
58c5fc13
MT		 58060+int grsec_enable_socket_all;
58061+int grsec_socket_all_gid;
58062+int grsec_enable_socket_client;
58063+int grsec_socket_client_gid;
58064+int grsec_enable_socket_server;
58065+int grsec_socket_server_gid;
58066+int grsec_resource_logging;
df50ba0c 58067+int grsec_disable_privio;
6892158b 58068+int grsec_enable_log_rwxmaps;
58c5fc13
MT		 58069+int grsec_lock;
58070+
58071+DEFINE_SPINLOCK(grsec_alert_lock);
58072+unsigned long grsec_alert_wtime = 0;
58073+unsigned long grsec_alert_fyet = 0;
58074+
58075+DEFINE_SPINLOCK(grsec_audit_lock);
58076+
58077+DEFINE_RWLOCK(grsec_exec_file_lock);
58078+
58079+char *gr_shared_page[4];
58080+
58081+char *gr_alert_log_fmt;
58082+char *gr_audit_log_fmt;
58083+char *gr_alert_log_buf;
58084+char *gr_audit_log_buf;
58085+
58086+extern struct gr_arg *gr_usermode;
58087+extern unsigned char *gr_system_salt;
58088+extern unsigned char *gr_system_sum;
58089+
58090+void __init
58091+grsecurity_init(void)
58092+{
58093+ int j;
58094+ /* create the per-cpu shared pages */
58095+
58096+#ifdef CONFIG_X86
58097+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58098+#endif
58099+
58100+ for (j = 0; j < 4; j++) {
58101+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58102+ if (gr_shared_page[j] == NULL) {
58103+ panic("Unable to allocate grsecurity shared page");
58104+ return;
58105+ }
58106+ }
58107+
58108+ /* allocate log buffers */
58109+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58110+ if (!gr_alert_log_fmt) {
58111+ panic("Unable to allocate grsecurity alert log format buffer");
58112+ return;
58113+ }
58114+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58115+ if (!gr_audit_log_fmt) {
58116+ panic("Unable to allocate grsecurity audit log format buffer");
58117+ return;
58118+ }
58119+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58120+ if (!gr_alert_log_buf) {
58121+ panic("Unable to allocate grsecurity alert log buffer");
58122+ return;
58123+ }
58124+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58125+ if (!gr_audit_log_buf) {
58126+ panic("Unable to allocate grsecurity audit log buffer");
58127+ return;
58128+ }
58129+
58130+ /* allocate memory for authentication structure */
58131+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58132+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58133+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58134+
58135+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58136+ panic("Unable to allocate grsecurity authentication structure");
58137+ return;
58138+ }
58139+
df50ba0c
MT		 58140+
58141+#ifdef CONFIG_GRKERNSEC_IO
58142+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58143+ grsec_disable_privio = 1;
58144+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58145+ grsec_disable_privio = 1;
58146+#else
58147+ grsec_disable_privio = 0;
58148+#endif
58149+#endif
58150+
57199397
MT		 58151+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58152+ /* for backward compatibility, tpe_invert always defaults to on if
58153+ enabled in the kernel
58154+ */
58155+ grsec_enable_tpe_invert = 1;
58156+#endif
58157+
58c5fc13
MT		 58158+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58159+#ifndef CONFIG_GRKERNSEC_SYSCTL
58160+ grsec_lock = 1;
58161+#endif
df50ba0c 58162+
58c5fc13
MT		 58163+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58164+ grsec_enable_audit_textrel = 1;
58165+#endif
6892158b
MT		 58166+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58167+ grsec_enable_log_rwxmaps = 1;
58168+#endif
58c5fc13
MT		 58169+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58170+ grsec_enable_group = 1;
58171+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58172+#endif
58173+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58174+ grsec_enable_chdir = 1;
58175+#endif
58176+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58177+ grsec_enable_harden_ptrace = 1;
58178+#endif
58179+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58180+ grsec_enable_mount = 1;
58181+#endif
58182+#ifdef CONFIG_GRKERNSEC_LINK
58183+ grsec_enable_link = 1;
58184+#endif
58185+#ifdef CONFIG_GRKERNSEC_DMESG
58186+ grsec_enable_dmesg = 1;
58187+#endif
ae4e228f
MT		 58188+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58189+ grsec_enable_blackhole = 1;
58190+ grsec_lastack_retries = 4;
58191+#endif
58c5fc13
MT		 58192+#ifdef CONFIG_GRKERNSEC_FIFO
58193+ grsec_enable_fifo = 1;
58194+#endif
58195+#ifdef CONFIG_GRKERNSEC_EXECVE
58196+ grsec_enable_execve = 1;
58197+#endif
58198+#ifdef CONFIG_GRKERNSEC_EXECLOG
58199+ grsec_enable_execlog = 1;
58200+#endif
58201+#ifdef CONFIG_GRKERNSEC_SIGNAL
58202+ grsec_enable_signal = 1;
58203+#endif
58204+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58205+ grsec_enable_forkfail = 1;
58206+#endif
58207+#ifdef CONFIG_GRKERNSEC_TIME
58208+ grsec_enable_time = 1;
58209+#endif
58210+#ifdef CONFIG_GRKERNSEC_RESLOG
58211+ grsec_resource_logging = 1;
58212+#endif
58213+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58214+ grsec_enable_chroot_findtask = 1;
58215+#endif
58216+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58217+ grsec_enable_chroot_unix = 1;
58218+#endif
58219+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58220+ grsec_enable_chroot_mount = 1;
58221+#endif
58222+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58223+ grsec_enable_chroot_fchdir = 1;
58224+#endif
58225+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58226+ grsec_enable_chroot_shmat = 1;
58227+#endif
ae4e228f
MT		 58228+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58229+ grsec_enable_audit_ptrace = 1;
58230+#endif
58c5fc13
MT		 58231+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58232+ grsec_enable_chroot_double = 1;
58233+#endif
58234+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58235+ grsec_enable_chroot_pivot = 1;
58236+#endif
58237+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58238+ grsec_enable_chroot_chdir = 1;
58239+#endif
58240+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58241+ grsec_enable_chroot_chmod = 1;
58242+#endif
58243+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58244+ grsec_enable_chroot_mknod = 1;
58245+#endif
58246+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58247+ grsec_enable_chroot_nice = 1;
58248+#endif
58249+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58250+ grsec_enable_chroot_execlog = 1;
58251+#endif
58252+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58253+ grsec_enable_chroot_caps = 1;
58254+#endif
58255+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58256+ grsec_enable_chroot_sysctl = 1;
58257+#endif
58258+#ifdef CONFIG_GRKERNSEC_TPE
58259+ grsec_enable_tpe = 1;
58260+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58261+#ifdef CONFIG_GRKERNSEC_TPE_ALL
58262+ grsec_enable_tpe_all = 1;
58263+#endif
58264+#endif
58265+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58266+ grsec_enable_socket_all = 1;
58267+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58268+#endif
58269+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58270+ grsec_enable_socket_client = 1;
58271+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58272+#endif
58273+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58274+ grsec_enable_socket_server = 1;
58275+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58276+#endif
58277+#endif
58278+
58279+ return;
58280+}
66a7e928
MT		 58281diff -urNp linux-2.6.39/grsecurity/grsec_link.c linux-2.6.39/grsecurity/grsec_link.c
58282--- linux-2.6.39/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
58283+++ linux-2.6.39/grsecurity/grsec_link.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 58284@@ -0,0 +1,43 @@
58285+#include <linux/kernel.h>
58286+#include <linux/sched.h>
58287+#include <linux/fs.h>
58288+#include <linux/file.h>
58289+#include <linux/grinternal.h>
58290+
58291+int
58292+gr_handle_follow_link(const struct inode *parent,
58293+ const struct inode *inode,
58294+ const struct dentry *dentry, const struct vfsmount *mnt)
58295+{
58296+#ifdef CONFIG_GRKERNSEC_LINK
58297+ const struct cred *cred = current_cred();
58298+
58299+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58300+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
58301+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
58302+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58303+ return -EACCES;
58304+ }
58305+#endif
58306+ return 0;
58307+}
58308+
58309+int
58310+gr_handle_hardlink(const struct dentry *dentry,
58311+ const struct vfsmount *mnt,
58312+ struct inode *inode, const int mode, const char *to)
58313+{
58314+#ifdef CONFIG_GRKERNSEC_LINK
58315+ const struct cred *cred = current_cred();
58316+
58317+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
58318+ (!S_ISREG(mode) || (mode & S_ISUID) ||
58319+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
16454cff 58320+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58c5fc13
MT		 58321+ !capable(CAP_FOWNER) && cred->uid) {
58322+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58323+ return -EPERM;
58324+ }
58325+#endif
58326+ return 0;
58327+}
66a7e928
MT		 58328diff -urNp linux-2.6.39/grsecurity/grsec_log.c linux-2.6.39/grsecurity/grsec_log.c
58329--- linux-2.6.39/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
58330+++ linux-2.6.39/grsecurity/grsec_log.c 2011-05-22 19:41:42.000000000 -0400
6892158b 58331@@ -0,0 +1,310 @@
58c5fc13
MT		 58332+#include <linux/kernel.h>
58333+#include <linux/sched.h>
58334+#include <linux/file.h>
58335+#include <linux/tty.h>
58336+#include <linux/fs.h>
58337+#include <linux/grinternal.h>
58338+
df50ba0c
MT		 58339+#ifdef CONFIG_TREE_PREEMPT_RCU
58340+#define DISABLE_PREEMPT() preempt_disable()
58341+#define ENABLE_PREEMPT() preempt_enable()
58342+#else
58343+#define DISABLE_PREEMPT()
58344+#define ENABLE_PREEMPT()
58345+#endif
58346+
58c5fc13 58347+#define BEGIN_LOCKS(x) \
df50ba0c 58348+ DISABLE_PREEMPT(); \
ae4e228f 58349+ rcu_read_lock(); \
58c5fc13
MT		 58350+ read_lock(&tasklist_lock); \
58351+ read_lock(&grsec_exec_file_lock); \
58352+ if (x != GR_DO_AUDIT) \
58353+ spin_lock(&grsec_alert_lock); \
58354+ else \
58355+ spin_lock(&grsec_audit_lock)
58356+
58357+#define END_LOCKS(x) \
58358+ if (x != GR_DO_AUDIT) \
58359+ spin_unlock(&grsec_alert_lock); \
58360+ else \
58361+ spin_unlock(&grsec_audit_lock); \
58362+ read_unlock(&grsec_exec_file_lock); \
58363+ read_unlock(&tasklist_lock); \
ae4e228f 58364+ rcu_read_unlock(); \
df50ba0c 58365+ ENABLE_PREEMPT(); \
58c5fc13
MT		 58366+ if (x == GR_DONT_AUDIT) \
58367+ gr_handle_alertkill(current)
58368+
58369+enum {
58370+ FLOODING,
58371+ NO_FLOODING
58372+};
58373+
58374+extern char *gr_alert_log_fmt;
58375+extern char *gr_audit_log_fmt;
58376+extern char *gr_alert_log_buf;
58377+extern char *gr_audit_log_buf;
58378+
58379+static int gr_log_start(int audit)
58380+{
58381+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58382+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58383+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58384+
58385+ if (audit == GR_DO_AUDIT)
58386+ goto set_fmt;
58387+
58388+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
58389+ grsec_alert_wtime = jiffies;
58390+ grsec_alert_fyet = 0;
58391+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58392+ grsec_alert_fyet++;
58393+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58394+ grsec_alert_wtime = jiffies;
58395+ grsec_alert_fyet++;
58396+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58397+ return FLOODING;
58398+ } else return FLOODING;
58399+
58400+set_fmt:
58401+ memset(buf, 0, PAGE_SIZE);
58402+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
ae4e228f
MT		 58403+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58404+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58c5fc13 58405+ } else if (current->signal->curr_ip) {
ae4e228f
MT		 58406+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58407+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58c5fc13
MT		 58408+ } else if (gr_acl_is_enabled()) {
58409+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58410+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58411+ } else {
58412+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
58413+ strcpy(buf, fmt);
58414+ }
58415+
58416+ return NO_FLOODING;
58417+}
58418+
58419+static void gr_log_middle(int audit, const char *msg, va_list ap)
58420+ __attribute__ ((format (printf, 2, 0)));
58421+
58422+static void gr_log_middle(int audit, const char *msg, va_list ap)
58423+{
58424+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58425+ unsigned int len = strlen(buf);
58426+
58427+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58428+
58429+ return;
58430+}
58431+
58432+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58433+ __attribute__ ((format (printf, 2, 3)));
58434+
58435+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58436+{
58437+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58438+ unsigned int len = strlen(buf);
58439+ va_list ap;
58440+
58441+ va_start(ap, msg);
58442+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58443+ va_end(ap);
58444+
58445+ return;
58446+}
58447+
58448+static void gr_log_end(int audit)
58449+{
58450+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58451+ unsigned int len = strlen(buf);
58452+
6892158b 58453+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58c5fc13
MT		 58454+ printk("%s\n", buf);
58455+
58456+ return;
58457+}
58458+
58459+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58460+{
58461+ int logtype;
58462+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
66a7e928
MT		 58463+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58464+ void *voidptr = NULL;
58465+ int num1 = 0, num2 = 0;
58466+ unsigned long ulong1 = 0, ulong2 = 0;
58467+ struct dentry *dentry = NULL;
58468+ struct vfsmount *mnt = NULL;
58469+ struct file *file = NULL;
58470+ struct task_struct *task = NULL;
58c5fc13
MT		 58471+ const struct cred *cred, *pcred;
58472+ va_list ap;
58473+
58474+ BEGIN_LOCKS(audit);
58475+ logtype = gr_log_start(audit);
58476+ if (logtype == FLOODING) {
58477+ END_LOCKS(audit);
58478+ return;
58479+ }
58480+ va_start(ap, argtypes);
58481+ switch (argtypes) {
58482+ case GR_TTYSNIFF:
58483+ task = va_arg(ap, struct task_struct *);
6892158b 58484+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58c5fc13
MT		 58485+ break;
58486+ case GR_SYSCTL_HIDDEN:
58487+ str1 = va_arg(ap, char *);
58488+ gr_log_middle_varargs(audit, msg, result, str1);
58489+ break;
58490+ case GR_RBAC:
58491+ dentry = va_arg(ap, struct dentry *);
58492+ mnt = va_arg(ap, struct vfsmount *);
58493+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58494+ break;
58495+ case GR_RBAC_STR:
58496+ dentry = va_arg(ap, struct dentry *);
58497+ mnt = va_arg(ap, struct vfsmount *);
58498+ str1 = va_arg(ap, char *);
58499+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58500+ break;
58501+ case GR_STR_RBAC:
58502+ str1 = va_arg(ap, char *);
58503+ dentry = va_arg(ap, struct dentry *);
58504+ mnt = va_arg(ap, struct vfsmount *);
58505+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58506+ break;
58507+ case GR_RBAC_MODE2:
58508+ dentry = va_arg(ap, struct dentry *);
58509+ mnt = va_arg(ap, struct vfsmount *);
58510+ str1 = va_arg(ap, char *);
58511+ str2 = va_arg(ap, char *);
58512+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58513+ break;
58514+ case GR_RBAC_MODE3:
58515+ dentry = va_arg(ap, struct dentry *);
58516+ mnt = va_arg(ap, struct vfsmount *);
58517+ str1 = va_arg(ap, char *);
58518+ str2 = va_arg(ap, char *);
58519+ str3 = va_arg(ap, char *);
58520+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58521+ break;
58522+ case GR_FILENAME:
58523+ dentry = va_arg(ap, struct dentry *);
58524+ mnt = va_arg(ap, struct vfsmount *);
58525+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58526+ break;
58527+ case GR_STR_FILENAME:
58528+ str1 = va_arg(ap, char *);
58529+ dentry = va_arg(ap, struct dentry *);
58530+ mnt = va_arg(ap, struct vfsmount *);
58531+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58532+ break;
58533+ case GR_FILENAME_STR:
58534+ dentry = va_arg(ap, struct dentry *);
58535+ mnt = va_arg(ap, struct vfsmount *);
58536+ str1 = va_arg(ap, char *);
58537+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58538+ break;
58539+ case GR_FILENAME_TWO_INT:
58540+ dentry = va_arg(ap, struct dentry *);
58541+ mnt = va_arg(ap, struct vfsmount *);
58542+ num1 = va_arg(ap, int);
58543+ num2 = va_arg(ap, int);
58544+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58545+ break;
58546+ case GR_FILENAME_TWO_INT_STR:
58547+ dentry = va_arg(ap, struct dentry *);
58548+ mnt = va_arg(ap, struct vfsmount *);
58549+ num1 = va_arg(ap, int);
58550+ num2 = va_arg(ap, int);
58551+ str1 = va_arg(ap, char *);
58552+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58553+ break;
58554+ case GR_TEXTREL:
58555+ file = va_arg(ap, struct file *);
58556+ ulong1 = va_arg(ap, unsigned long);
58557+ ulong2 = va_arg(ap, unsigned long);
58558+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58559+ break;
58560+ case GR_PTRACE:
58561+ task = va_arg(ap, struct task_struct *);
58562+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58563+ break;
58564+ case GR_RESOURCE:
58565+ task = va_arg(ap, struct task_struct *);
58566+ cred = __task_cred(task);
6892158b 58567+ pcred = __task_cred(task->real_parent);
58c5fc13
MT		 58568+ ulong1 = va_arg(ap, unsigned long);
58569+ str1 = va_arg(ap, char *);
58570+ ulong2 = va_arg(ap, unsigned long);
6892158b 58571+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58c5fc13
MT		 58572+ break;
58573+ case GR_CAP:
58574+ task = va_arg(ap, struct task_struct *);
58575+ cred = __task_cred(task);
6892158b 58576+ pcred = __task_cred(task->real_parent);
58c5fc13 58577+ str1 = va_arg(ap, char *);
6892158b 58578+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58c5fc13
MT		 58579+ break;
58580+ case GR_SIG:
58581+ str1 = va_arg(ap, char *);
58582+ voidptr = va_arg(ap, void *);
58583+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58584+ break;
58585+ case GR_SIG2:
58586+ task = va_arg(ap, struct task_struct *);
58587+ cred = __task_cred(task);
6892158b 58588+ pcred = __task_cred(task->real_parent);
58c5fc13 58589+ num1 = va_arg(ap, int);
6892158b 58590+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58c5fc13
MT		 58591+ break;
58592+ case GR_CRASH1:
58593+ task = va_arg(ap, struct task_struct *);
58594+ cred = __task_cred(task);
6892158b 58595+ pcred = __task_cred(task->real_parent);
58c5fc13 58596+ ulong1 = va_arg(ap, unsigned long);
6892158b 58597+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58c5fc13
MT		 58598+ break;
58599+ case GR_CRASH2:
58600+ task = va_arg(ap, struct task_struct *);
58601+ cred = __task_cred(task);
6892158b 58602+ pcred = __task_cred(task->real_parent);
58c5fc13 58603+ ulong1 = va_arg(ap, unsigned long);
6892158b
MT		 58604+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58605+ break;
58606+ case GR_RWXMAP:
58607+ file = va_arg(ap, struct file *);
58608+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58c5fc13
MT		 58609+ break;
58610+ case GR_PSACCT:
58611+ {
58612+ unsigned int wday, cday;
58613+ __u8 whr, chr;
58614+ __u8 wmin, cmin;
58615+ __u8 wsec, csec;
58616+ char cur_tty[64] = { 0 };
58617+ char parent_tty[64] = { 0 };
58618+
58619+ task = va_arg(ap, struct task_struct *);
58620+ wday = va_arg(ap, unsigned int);
58621+ cday = va_arg(ap, unsigned int);
58622+ whr = va_arg(ap, int);
58623+ chr = va_arg(ap, int);
58624+ wmin = va_arg(ap, int);
58625+ cmin = va_arg(ap, int);
58626+ wsec = va_arg(ap, int);
58627+ csec = va_arg(ap, int);
58628+ ulong1 = va_arg(ap, unsigned long);
58629+ cred = __task_cred(task);
6892158b 58630+ pcred = __task_cred(task->real_parent);
58c5fc13 58631+
6892158b 58632+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58c5fc13
MT		 58633+ }
58634+ break;
58635+ default:
58636+ gr_log_middle(audit, msg, ap);
58637+ }
58638+ va_end(ap);
58639+ gr_log_end(audit);
58640+ END_LOCKS(audit);
58641+}
66a7e928
MT		 58642diff -urNp linux-2.6.39/grsecurity/grsec_mem.c linux-2.6.39/grsecurity/grsec_mem.c
58643--- linux-2.6.39/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
58644+++ linux-2.6.39/grsecurity/grsec_mem.c 2011-05-22 19:41:42.000000000 -0400
71d190be 58645@@ -0,0 +1,33 @@
58c5fc13
MT		 58646+#include <linux/kernel.h>
58647+#include <linux/sched.h>
58648+#include <linux/mm.h>
58649+#include <linux/mman.h>
58650+#include <linux/grinternal.h>
58651+
58652+void
58653+gr_handle_ioperm(void)
58654+{
58655+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58656+ return;
58657+}
58658+
58659+void
58660+gr_handle_iopl(void)
58661+{
58662+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58663+ return;
58664+}
58665+
58666+void
71d190be 58667+gr_handle_mem_readwrite(u64 from, u64 to)
58c5fc13 58668+{
71d190be 58669+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58c5fc13
MT		 58670+ return;
58671+}
58672+
58673+void
ae4e228f
MT		 58674+gr_handle_vm86(void)
58675+{
58676+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58677+ return;
58678+}
66a7e928
MT		 58679diff -urNp linux-2.6.39/grsecurity/grsec_mount.c linux-2.6.39/grsecurity/grsec_mount.c
58680--- linux-2.6.39/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
58681+++ linux-2.6.39/grsecurity/grsec_mount.c 2011-05-22 19:41:42.000000000 -0400
ae4e228f 58682@@ -0,0 +1,62 @@
58c5fc13
MT		 58683+#include <linux/kernel.h>
58684+#include <linux/sched.h>
ae4e228f 58685+#include <linux/mount.h>
58c5fc13
MT		 58686+#include <linux/grsecurity.h>
58687+#include <linux/grinternal.h>
58688+
58689+void
58690+gr_log_remount(const char *devname, const int retval)
58691+{
58692+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58693+ if (grsec_enable_mount && (retval >= 0))
58694+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58695+#endif
58696+ return;
58697+}
58698+
58699+void
58700+gr_log_unmount(const char *devname, const int retval)
58701+{
58702+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58703+ if (grsec_enable_mount && (retval >= 0))
58704+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58705+#endif
58706+ return;
58707+}
58708+
58709+void
58710+gr_log_mount(const char *from, const char *to, const int retval)
58711+{
58712+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58713+ if (grsec_enable_mount && (retval >= 0))
58714+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
58715+#endif
58716+ return;
58717+}
ae4e228f
MT		 58718+
58719+int
58720+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58721+{
58722+#ifdef CONFIG_GRKERNSEC_ROFS
58723+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58724+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58725+ return -EPERM;
58726+ } else
58727+ return 0;
58728+#endif
58729+ return 0;
58730+}
58731+
58732+int
58733+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58734+{
58735+#ifdef CONFIG_GRKERNSEC_ROFS
58736+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58737+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58738+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58739+ return -EPERM;
58740+ } else
58741+ return 0;
58742+#endif
58743+ return 0;
58744+}
66a7e928
MT		 58745diff -urNp linux-2.6.39/grsecurity/grsec_pax.c linux-2.6.39/grsecurity/grsec_pax.c
58746--- linux-2.6.39/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
58747+++ linux-2.6.39/grsecurity/grsec_pax.c 2011-05-22 19:41:42.000000000 -0400
6892158b
MT		 58748@@ -0,0 +1,36 @@
58749+#include <linux/kernel.h>
58750+#include <linux/sched.h>
58751+#include <linux/mm.h>
58752+#include <linux/file.h>
58753+#include <linux/grinternal.h>
58754+#include <linux/grsecurity.h>
58755+
58756+void
58757+gr_log_textrel(struct vm_area_struct * vma)
58758+{
58759+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58760+ if (grsec_enable_audit_textrel)
58761+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58762+#endif
58763+ return;
58764+}
58765+
58766+void
58767+gr_log_rwxmmap(struct file *file)
58768+{
58769+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58770+ if (grsec_enable_log_rwxmaps)
58771+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58772+#endif
58773+ return;
58774+}
58775+
58776+void
58777+gr_log_rwxmprotect(struct file *file)
58778+{
58779+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58780+ if (grsec_enable_log_rwxmaps)
58781+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58782+#endif
58783+ return;
58784+}
66a7e928
MT		 58785diff -urNp linux-2.6.39/grsecurity/grsec_ptrace.c linux-2.6.39/grsecurity/grsec_ptrace.c
58786--- linux-2.6.39/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
58787+++ linux-2.6.39/grsecurity/grsec_ptrace.c 2011-05-22 19:41:42.000000000 -0400
ae4e228f
MT		 58788@@ -0,0 +1,14 @@
58789+#include <linux/kernel.h>
58790+#include <linux/sched.h>
58791+#include <linux/grinternal.h>
58792+#include <linux/grsecurity.h>
58793+
58794+void
58795+gr_audit_ptrace(struct task_struct *task)
58796+{
58797+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58798+ if (grsec_enable_audit_ptrace)
58799+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58800+#endif
58801+ return;
58802+}
66a7e928
MT		 58803diff -urNp linux-2.6.39/grsecurity/grsec_sig.c linux-2.6.39/grsecurity/grsec_sig.c
58804--- linux-2.6.39/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
58805+++ linux-2.6.39/grsecurity/grsec_sig.c 2011-05-22 19:41:42.000000000 -0400
58806@@ -0,0 +1,203 @@
58c5fc13
MT		 58807+#include <linux/kernel.h>
58808+#include <linux/sched.h>
58809+#include <linux/delay.h>
58810+#include <linux/grsecurity.h>
58811+#include <linux/grinternal.h>
71d190be 58812+#include <linux/hardirq.h>
58c5fc13
MT		 58813+
58814+char *signames[] = {
58815+ [SIGSEGV] = "Segmentation fault",
58816+ [SIGILL] = "Illegal instruction",
58817+ [SIGABRT] = "Abort",
58818+ [SIGBUS] = "Invalid alignment/Bus error"
58819+};
58820+
58821+void
58822+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58823+{
58824+#ifdef CONFIG_GRKERNSEC_SIGNAL
58825+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58826+ (sig == SIGABRT) || (sig == SIGBUS))) {
58827+ if (t->pid == current->pid) {
58828+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58829+ } else {
58830+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58831+ }
58832+ }
58833+#endif
58834+ return;
58835+}
58836+
58837+int
58838+gr_handle_signal(const struct task_struct *p, const int sig)
58839+{
58840+#ifdef CONFIG_GRKERNSEC
58841+ if (current->pid > 1 && gr_check_protected_task(p)) {
58842+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58843+ return -EPERM;
58844+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58845+ return -EPERM;
58846+ }
58847+#endif
58848+ return 0;
58849+}
58850+
71d190be
MT		 58851+#ifdef CONFIG_GRKERNSEC
58852+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58853+
58854+int gr_fake_force_sig(int sig, struct task_struct *t)
58855+{
58856+ unsigned long int flags;
58857+ int ret, blocked, ignored;
58858+ struct k_sigaction *action;
58859+
58860+ spin_lock_irqsave(&t->sighand->siglock, flags);
58861+ action = &t->sighand->action[sig-1];
58862+ ignored = action->sa.sa_handler == SIG_IGN;
58863+ blocked = sigismember(&t->blocked, sig);
58864+ if (blocked || ignored) {
58865+ action->sa.sa_handler = SIG_DFL;
58866+ if (blocked) {
58867+ sigdelset(&t->blocked, sig);
58868+ recalc_sigpending_and_wake(t);
58869+ }
58870+ }
58871+ if (action->sa.sa_handler == SIG_DFL)
58872+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
58873+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58874+
58875+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
58876+
58877+ return ret;
58878+}
58879+#endif
58880+
58881+#ifdef CONFIG_GRKERNSEC_BRUTE
58882+#define GR_USER_BAN_TIME (15 * 60)
58883+
58884+static int __get_dumpable(unsigned long mm_flags)
58885+{
58886+ int ret;
58887+
58888+ ret = mm_flags & MMF_DUMPABLE_MASK;
58889+ return (ret >= 2) ? 2 : ret;
58890+}
58891+#endif
58892+
58893+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58c5fc13
MT		 58894+{
58895+#ifdef CONFIG_GRKERNSEC_BRUTE
71d190be
MT		 58896+ uid_t uid = 0;
58897+
58898+ rcu_read_lock();
58c5fc13
MT		 58899+ read_lock(&tasklist_lock);
58900+ read_lock(&grsec_exec_file_lock);
6892158b
MT		 58901+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58902+ p->real_parent->brute = 1;
71d190be
MT		 58903+ else {
58904+ const struct cred *cred = __task_cred(p), *cred2;
58905+ struct task_struct *tsk, *tsk2;
58906+
58907+ if (!__get_dumpable(mm_flags) && cred->uid) {
58908+ struct user_struct *user;
58909+
58910+ uid = cred->uid;
58911+
58912+ /* this is put upon execution past expiration */
58913+ user = find_user(uid);
58914+ if (user == NULL)
58915+ goto unlock;
58916+ user->banned = 1;
58917+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
58918+ if (user->ban_expires == ~0UL)
58919+ user->ban_expires--;
58920+
58921+ do_each_thread(tsk2, tsk) {
58922+ cred2 = __task_cred(tsk);
58923+ if (tsk != p && cred2->uid == uid)
58924+ gr_fake_force_sig(SIGKILL, tsk);
58925+ } while_each_thread(tsk2, tsk);
58926+ }
58927+ }
58928+unlock:
58c5fc13
MT		 58929+ read_unlock(&grsec_exec_file_lock);
58930+ read_unlock(&tasklist_lock);
71d190be
MT		 58931+ rcu_read_unlock();
58932+
58933+ if (uid)
58934+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
58935+
58c5fc13
MT		 58936+#endif
58937+ return;
58938+}
58939+
58940+void gr_handle_brute_check(void)
58941+{
58942+#ifdef CONFIG_GRKERNSEC_BRUTE
58943+ if (current->brute)
58944+ msleep(30 * 1000);
58945+#endif
58946+ return;
58947+}
58948+
71d190be
MT		 58949+void gr_handle_kernel_exploit(void)
58950+{
58951+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
58952+ const struct cred *cred;
58953+ struct task_struct *tsk, *tsk2;
58954+ struct user_struct *user;
58955+ uid_t uid;
58956+
58957+ if (in_irq() || in_serving_softirq() || in_nmi())
58958+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
58959+
58960+ uid = current_uid();
58961+
58962+ if (uid == 0)
58963+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
58964+ else {
58965+ /* kill all the processes of this user, hold a reference
58966+ to their creds struct, and prevent them from creating
58967+ another process until system reset
58968+ */
58969+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
58970+ /* we intentionally leak this ref */
58971+ user = get_uid(current->cred->user);
58972+ if (user) {
58973+ user->banned = 1;
58974+ user->ban_expires = ~0UL;
58975+ }
58976+
58977+ read_lock(&tasklist_lock);
58978+ do_each_thread(tsk2, tsk) {
58979+ cred = __task_cred(tsk);
58980+ if (cred->uid == uid)
58981+ gr_fake_force_sig(SIGKILL, tsk);
58982+ } while_each_thread(tsk2, tsk);
58983+ read_unlock(&tasklist_lock);
58984+ }
58985+#endif
58986+}
58987+
66a7e928 58988+int __gr_process_user_ban(struct user_struct *user)
71d190be
MT		 58989+{
58990+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
66a7e928 58991+ if (unlikely(user->banned)) {
71d190be
MT		 58992+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
58993+ user->banned = 0;
58994+ user->ban_expires = 0;
58995+ free_uid(user);
58996+ } else
58997+ return -EPERM;
58998+ }
58999+#endif
59000+ return 0;
66a7e928 59001+}
71d190be 59002+
66a7e928
MT		 59003+int gr_process_user_ban(void)
59004+{
59005+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59006+ return __gr_process_user_ban(current->cred->user);
59007+#endif
59008+ return 0;
71d190be 59009+}
66a7e928
MT		 59010diff -urNp linux-2.6.39/grsecurity/grsec_sock.c linux-2.6.39/grsecurity/grsec_sock.c
59011--- linux-2.6.39/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
59012+++ linux-2.6.39/grsecurity/grsec_sock.c 2011-05-22 20:29:21.000000000 -0400
59013@@ -0,0 +1,244 @@
58c5fc13
MT		 59014+#include <linux/kernel.h>
59015+#include <linux/module.h>
59016+#include <linux/sched.h>
59017+#include <linux/file.h>
59018+#include <linux/net.h>
59019+#include <linux/in.h>
59020+#include <linux/ip.h>
59021+#include <net/sock.h>
59022+#include <net/inet_sock.h>
59023+#include <linux/grsecurity.h>
59024+#include <linux/grinternal.h>
59025+#include <linux/gracl.h>
59026+
58c5fc13
MT		 59027+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59028+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59029+
59030+EXPORT_SYMBOL(gr_search_udp_recvmsg);
59031+EXPORT_SYMBOL(gr_search_udp_sendmsg);
59032+
59033+#ifdef CONFIG_UNIX_MODULE
59034+EXPORT_SYMBOL(gr_acl_handle_unix);
59035+EXPORT_SYMBOL(gr_acl_handle_mknod);
59036+EXPORT_SYMBOL(gr_handle_chroot_unix);
59037+EXPORT_SYMBOL(gr_handle_create);
59038+#endif
59039+
59040+#ifdef CONFIG_GRKERNSEC
59041+#define gr_conn_table_size 32749
59042+struct conn_table_entry {
59043+ struct conn_table_entry *next;
59044+ struct signal_struct *sig;
59045+};
59046+
59047+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59048+DEFINE_SPINLOCK(gr_conn_table_lock);
59049+
59050+extern const char * gr_socktype_to_name(unsigned char type);
59051+extern const char * gr_proto_to_name(unsigned char proto);
bc901d79 59052+extern const char * gr_sockfamily_to_name(unsigned char family);
58c5fc13
MT		 59053+
59054+static __inline__ int
59055+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59056+{
59057+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59058+}
59059+
59060+static __inline__ int
59061+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59062+ __u16 sport, __u16 dport)
59063+{
59064+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59065+ sig->gr_sport == sport && sig->gr_dport == dport))
59066+ return 1;
59067+ else
59068+ return 0;
59069+}
59070+
59071+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59072+{
59073+ struct conn_table_entry **match;
59074+ unsigned int index;
59075+
59076+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59077+ sig->gr_sport, sig->gr_dport,
59078+ gr_conn_table_size);
59079+
59080+ newent->sig = sig;
59081+
59082+ match = &gr_conn_table[index];
59083+ newent->next = *match;
59084+ *match = newent;
59085+
59086+ return;
59087+}
59088+
59089+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59090+{
59091+ struct conn_table_entry *match, *last = NULL;
59092+ unsigned int index;
59093+
59094+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59095+ sig->gr_sport, sig->gr_dport,
59096+ gr_conn_table_size);
59097+
59098+ match = gr_conn_table[index];
59099+ while (match && !conn_match(match->sig,
59100+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59101+ sig->gr_dport)) {
59102+ last = match;
59103+ match = match->next;
59104+ }
59105+
59106+ if (match) {
59107+ if (last)
59108+ last->next = match->next;
59109+ else
59110+ gr_conn_table[index] = NULL;
59111+ kfree(match);
59112+ }
59113+
59114+ return;
59115+}
59116+
59117+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59118+ __u16 sport, __u16 dport)
59119+{
59120+ struct conn_table_entry *match;
59121+ unsigned int index;
59122+
59123+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59124+
59125+ match = gr_conn_table[index];
59126+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59127+ match = match->next;
59128+
59129+ if (match)
59130+ return match->sig;
59131+ else
59132+ return NULL;
59133+}
59134+
59135+#endif
59136+
59137+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59138+{
59139+#ifdef CONFIG_GRKERNSEC
59140+ struct signal_struct *sig = task->signal;
59141+ struct conn_table_entry *newent;
59142+
59143+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59144+ if (newent == NULL)
59145+ return;
59146+ /* no bh lock needed since we are called with bh disabled */
59147+ spin_lock(&gr_conn_table_lock);
59148+ gr_del_task_from_ip_table_nolock(sig);
ae4e228f
MT		 59149+ sig->gr_saddr = inet->inet_rcv_saddr;
59150+ sig->gr_daddr = inet->inet_daddr;
59151+ sig->gr_sport = inet->inet_sport;
59152+ sig->gr_dport = inet->inet_dport;
58c5fc13
MT		 59153+ gr_add_to_task_ip_table_nolock(sig, newent);
59154+ spin_unlock(&gr_conn_table_lock);
59155+#endif
59156+ return;
59157+}
59158+
59159+void gr_del_task_from_ip_table(struct task_struct *task)
59160+{
59161+#ifdef CONFIG_GRKERNSEC
59162+ spin_lock_bh(&gr_conn_table_lock);
59163+ gr_del_task_from_ip_table_nolock(task->signal);
59164+ spin_unlock_bh(&gr_conn_table_lock);
59165+#endif
59166+ return;
59167+}
59168+
59169+void
59170+gr_attach_curr_ip(const struct sock *sk)
59171+{
59172+#ifdef CONFIG_GRKERNSEC
59173+ struct signal_struct *p, *set;
59174+ const struct inet_sock *inet = inet_sk(sk);
59175+
59176+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59177+ return;
59178+
59179+ set = current->signal;
59180+
59181+ spin_lock_bh(&gr_conn_table_lock);
ae4e228f
MT		 59182+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59183+ inet->inet_dport, inet->inet_sport);
58c5fc13
MT		 59184+ if (unlikely(p != NULL)) {
59185+ set->curr_ip = p->curr_ip;
59186+ set->used_accept = 1;
59187+ gr_del_task_from_ip_table_nolock(p);
59188+ spin_unlock_bh(&gr_conn_table_lock);
59189+ return;
59190+ }
59191+ spin_unlock_bh(&gr_conn_table_lock);
59192+
ae4e228f 59193+ set->curr_ip = inet->inet_daddr;
58c5fc13
MT		 59194+ set->used_accept = 1;
59195+#endif
59196+ return;
59197+}
59198+
59199+int
59200+gr_handle_sock_all(const int family, const int type, const int protocol)
59201+{
59202+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59203+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
bc901d79
MT		 59204+ (family != AF_UNIX)) {
59205+ if (family == AF_INET)
59206+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59207+ else
59208+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
58c5fc13
MT		 59209+ return -EACCES;
59210+ }
59211+#endif
59212+ return 0;
59213+}
59214+
59215+int
59216+gr_handle_sock_server(const struct sockaddr *sck)
59217+{
59218+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59219+ if (grsec_enable_socket_server &&
59220+ in_group_p(grsec_socket_server_gid) &&
59221+ sck && (sck->sa_family != AF_UNIX) &&
59222+ (sck->sa_family != AF_LOCAL)) {
59223+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59224+ return -EACCES;
59225+ }
59226+#endif
59227+ return 0;
59228+}
59229+
59230+int
59231+gr_handle_sock_server_other(const struct sock *sck)
59232+{
59233+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59234+ if (grsec_enable_socket_server &&
59235+ in_group_p(grsec_socket_server_gid) &&
59236+ sck && (sck->sk_family != AF_UNIX) &&
59237+ (sck->sk_family != AF_LOCAL)) {
59238+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59239+ return -EACCES;
59240+ }
59241+#endif
59242+ return 0;
59243+}
59244+
59245+int
59246+gr_handle_sock_client(const struct sockaddr *sck)
59247+{
59248+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59249+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59250+ sck && (sck->sa_family != AF_UNIX) &&
59251+ (sck->sa_family != AF_LOCAL)) {
59252+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59253+ return -EACCES;
59254+ }
59255+#endif
59256+ return 0;
59257+}
66a7e928
MT		 59258diff -urNp linux-2.6.39/grsecurity/grsec_sysctl.c linux-2.6.39/grsecurity/grsec_sysctl.c
59259--- linux-2.6.39/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
59260+++ linux-2.6.39/grsecurity/grsec_sysctl.c 2011-05-22 19:41:42.000000000 -0400
6892158b 59261@@ -0,0 +1,433 @@
58c5fc13
MT		 59262+#include <linux/kernel.h>
59263+#include <linux/sched.h>
59264+#include <linux/sysctl.h>
59265+#include <linux/grsecurity.h>
59266+#include <linux/grinternal.h>
59267+
59268+int
59269+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59270+{
59271+#ifdef CONFIG_GRKERNSEC_SYSCTL
59272+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59273+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59274+ return -EACCES;
59275+ }
59276+#endif
59277+ return 0;
59278+}
59279+
ae4e228f
MT		 59280+#ifdef CONFIG_GRKERNSEC_ROFS
59281+static int __maybe_unused one = 1;
59282+#endif
59283+
59284+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
57199397 59285+struct ctl_table grsecurity_table[] = {
58c5fc13 59286+#ifdef CONFIG_GRKERNSEC_SYSCTL
df50ba0c
MT		 59287+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59288+#ifdef CONFIG_GRKERNSEC_IO
59289+ {
59290+ .procname = "disable_priv_io",
59291+ .data = &grsec_disable_privio,
59292+ .maxlen = sizeof(int),
59293+ .mode = 0600,
59294+ .proc_handler = &proc_dointvec,
59295+ },
59296+#endif
59297+#endif
58c5fc13
MT		 59298+#ifdef CONFIG_GRKERNSEC_LINK
59299+ {
58c5fc13
MT		 59300+ .procname = "linking_restrictions",
59301+ .data = &grsec_enable_link,
59302+ .maxlen = sizeof(int),
59303+ .mode = 0600,
59304+ .proc_handler = &proc_dointvec,
59305+ },
59306+#endif
59307+#ifdef CONFIG_GRKERNSEC_FIFO
59308+ {
58c5fc13
MT		 59309+ .procname = "fifo_restrictions",
59310+ .data = &grsec_enable_fifo,
59311+ .maxlen = sizeof(int),
59312+ .mode = 0600,
59313+ .proc_handler = &proc_dointvec,
59314+ },
59315+#endif
59316+#ifdef CONFIG_GRKERNSEC_EXECVE
59317+ {
58c5fc13
MT		 59318+ .procname = "execve_limiting",
59319+ .data = &grsec_enable_execve,
59320+ .maxlen = sizeof(int),
59321+ .mode = 0600,
59322+ .proc_handler = &proc_dointvec,
59323+ },
59324+#endif
ae4e228f
MT		 59325+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59326+ {
59327+ .procname = "ip_blackhole",
59328+ .data = &grsec_enable_blackhole,
59329+ .maxlen = sizeof(int),
59330+ .mode = 0600,
59331+ .proc_handler = &proc_dointvec,
59332+ },
59333+ {
59334+ .procname = "lastack_retries",
59335+ .data = &grsec_lastack_retries,
59336+ .maxlen = sizeof(int),
59337+ .mode = 0600,
59338+ .proc_handler = &proc_dointvec,
59339+ },
59340+#endif
58c5fc13
MT		 59341+#ifdef CONFIG_GRKERNSEC_EXECLOG
59342+ {
58c5fc13
MT		 59343+ .procname = "exec_logging",
59344+ .data = &grsec_enable_execlog,
59345+ .maxlen = sizeof(int),
59346+ .mode = 0600,
59347+ .proc_handler = &proc_dointvec,
59348+ },
59349+#endif
6892158b
MT		 59350+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59351+ {
59352+ .procname = "rwxmap_logging",
59353+ .data = &grsec_enable_log_rwxmaps,
59354+ .maxlen = sizeof(int),
59355+ .mode = 0600,
59356+ .proc_handler = &proc_dointvec,
59357+ },
59358+#endif
58c5fc13
MT		 59359+#ifdef CONFIG_GRKERNSEC_SIGNAL
59360+ {
58c5fc13
MT		 59361+ .procname = "signal_logging",
59362+ .data = &grsec_enable_signal,
59363+ .maxlen = sizeof(int),
59364+ .mode = 0600,
59365+ .proc_handler = &proc_dointvec,
59366+ },
59367+#endif
59368+#ifdef CONFIG_GRKERNSEC_FORKFAIL
59369+ {
58c5fc13
MT		 59370+ .procname = "forkfail_logging",
59371+ .data = &grsec_enable_forkfail,
59372+ .maxlen = sizeof(int),
59373+ .mode = 0600,
59374+ .proc_handler = &proc_dointvec,
59375+ },
59376+#endif
59377+#ifdef CONFIG_GRKERNSEC_TIME
59378+ {
58c5fc13
MT		 59379+ .procname = "timechange_logging",
59380+ .data = &grsec_enable_time,
59381+ .maxlen = sizeof(int),
59382+ .mode = 0600,
59383+ .proc_handler = &proc_dointvec,
59384+ },
59385+#endif
59386+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59387+ {
58c5fc13
MT		 59388+ .procname = "chroot_deny_shmat",
59389+ .data = &grsec_enable_chroot_shmat,
59390+ .maxlen = sizeof(int),
59391+ .mode = 0600,
59392+ .proc_handler = &proc_dointvec,
59393+ },
59394+#endif
59395+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59396+ {
58c5fc13
MT		 59397+ .procname = "chroot_deny_unix",
59398+ .data = &grsec_enable_chroot_unix,
59399+ .maxlen = sizeof(int),
59400+ .mode = 0600,
59401+ .proc_handler = &proc_dointvec,
59402+ },
59403+#endif
59404+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59405+ {
58c5fc13
MT		 59406+ .procname = "chroot_deny_mount",
59407+ .data = &grsec_enable_chroot_mount,
59408+ .maxlen = sizeof(int),
59409+ .mode = 0600,
59410+ .proc_handler = &proc_dointvec,
59411+ },
59412+#endif
59413+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59414+ {
58c5fc13
MT		 59415+ .procname = "chroot_deny_fchdir",
59416+ .data = &grsec_enable_chroot_fchdir,
59417+ .maxlen = sizeof(int),
59418+ .mode = 0600,
59419+ .proc_handler = &proc_dointvec,
59420+ },
59421+#endif
59422+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59423+ {
58c5fc13
MT		 59424+ .procname = "chroot_deny_chroot",
59425+ .data = &grsec_enable_chroot_double,
59426+ .maxlen = sizeof(int),
59427+ .mode = 0600,
59428+ .proc_handler = &proc_dointvec,
59429+ },
59430+#endif
59431+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59432+ {
58c5fc13
MT		 59433+ .procname = "chroot_deny_pivot",
59434+ .data = &grsec_enable_chroot_pivot,
59435+ .maxlen = sizeof(int),
59436+ .mode = 0600,
59437+ .proc_handler = &proc_dointvec,
59438+ },
59439+#endif
59440+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59441+ {
58c5fc13
MT		 59442+ .procname = "chroot_enforce_chdir",
59443+ .data = &grsec_enable_chroot_chdir,
59444+ .maxlen = sizeof(int),
59445+ .mode = 0600,
59446+ .proc_handler = &proc_dointvec,
59447+ },
59448+#endif
59449+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59450+ {
58c5fc13
MT		 59451+ .procname = "chroot_deny_chmod",
59452+ .data = &grsec_enable_chroot_chmod,
59453+ .maxlen = sizeof(int),
59454+ .mode = 0600,
59455+ .proc_handler = &proc_dointvec,
59456+ },
59457+#endif
59458+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59459+ {
58c5fc13
MT		 59460+ .procname = "chroot_deny_mknod",
59461+ .data = &grsec_enable_chroot_mknod,
59462+ .maxlen = sizeof(int),
59463+ .mode = 0600,
59464+ .proc_handler = &proc_dointvec,
59465+ },
59466+#endif
59467+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59468+ {
58c5fc13
MT		 59469+ .procname = "chroot_restrict_nice",
59470+ .data = &grsec_enable_chroot_nice,
59471+ .maxlen = sizeof(int),
59472+ .mode = 0600,
59473+ .proc_handler = &proc_dointvec,
59474+ },
59475+#endif
59476+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59477+ {
58c5fc13
MT		 59478+ .procname = "chroot_execlog",
59479+ .data = &grsec_enable_chroot_execlog,
59480+ .maxlen = sizeof(int),
59481+ .mode = 0600,
59482+ .proc_handler = &proc_dointvec,
59483+ },
59484+#endif
59485+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59486+ {
58c5fc13
MT		 59487+ .procname = "chroot_caps",
59488+ .data = &grsec_enable_chroot_caps,
59489+ .maxlen = sizeof(int),
59490+ .mode = 0600,
59491+ .proc_handler = &proc_dointvec,
59492+ },
59493+#endif
59494+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59495+ {
58c5fc13
MT		 59496+ .procname = "chroot_deny_sysctl",
59497+ .data = &grsec_enable_chroot_sysctl,
59498+ .maxlen = sizeof(int),
59499+ .mode = 0600,
59500+ .proc_handler = &proc_dointvec,
59501+ },
59502+#endif
59503+#ifdef CONFIG_GRKERNSEC_TPE
59504+ {
58c5fc13
MT		 59505+ .procname = "tpe",
59506+ .data = &grsec_enable_tpe,
59507+ .maxlen = sizeof(int),
59508+ .mode = 0600,
59509+ .proc_handler = &proc_dointvec,
59510+ },
59511+ {
58c5fc13
MT		 59512+ .procname = "tpe_gid",
59513+ .data = &grsec_tpe_gid,
59514+ .maxlen = sizeof(int),
59515+ .mode = 0600,
59516+ .proc_handler = &proc_dointvec,
59517+ },
59518+#endif
57199397
MT		 59519+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59520+ {
59521+ .procname = "tpe_invert",
59522+ .data = &grsec_enable_tpe_invert,
59523+ .maxlen = sizeof(int),
59524+ .mode = 0600,
59525+ .proc_handler = &proc_dointvec,
59526+ },
59527+#endif
58c5fc13
MT		 59528+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59529+ {
58c5fc13
MT		 59530+ .procname = "tpe_restrict_all",
59531+ .data = &grsec_enable_tpe_all,
59532+ .maxlen = sizeof(int),
59533+ .mode = 0600,
59534+ .proc_handler = &proc_dointvec,
59535+ },
59536+#endif
59537+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59538+ {
58c5fc13
MT		 59539+ .procname = "socket_all",
59540+ .data = &grsec_enable_socket_all,
59541+ .maxlen = sizeof(int),
59542+ .mode = 0600,
59543+ .proc_handler = &proc_dointvec,
59544+ },
59545+ {
58c5fc13
MT		 59546+ .procname = "socket_all_gid",
59547+ .data = &grsec_socket_all_gid,
59548+ .maxlen = sizeof(int),
59549+ .mode = 0600,
59550+ .proc_handler = &proc_dointvec,
59551+ },
59552+#endif
59553+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59554+ {
58c5fc13
MT		 59555+ .procname = "socket_client",
59556+ .data = &grsec_enable_socket_client,
59557+ .maxlen = sizeof(int),
59558+ .mode = 0600,
59559+ .proc_handler = &proc_dointvec,
efbe55a5
MT		 59560+ },
59561+ {
59562+ .procname = "socket_client_gid",
59563+ .data = &grsec_socket_client_gid,
59564+ .maxlen = sizeof(int),
59565+ .mode = 0600,
59566+ .proc_handler = &proc_dointvec,
59567+ },
59568+#endif
59569+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59570+ {
59571+ .procname = "socket_server",
59572+ .data = &grsec_enable_socket_server,
59573+ .maxlen = sizeof(int),
59574+ .mode = 0600,
59575+ .proc_handler = &proc_dointvec,
59576+ },
59577+ {
59578+ .procname = "socket_server_gid",
59579+ .data = &grsec_socket_server_gid,
59580+ .maxlen = sizeof(int),
59581+ .mode = 0600,
59582+ .proc_handler = &proc_dointvec,
59583+ },
59584+#endif
59585+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59586+ {
59587+ .procname = "audit_group",
59588+ .data = &grsec_enable_group,
59589+ .maxlen = sizeof(int),
59590+ .mode = 0600,
59591+ .proc_handler = &proc_dointvec,
59592+ },
59593+ {
59594+ .procname = "audit_gid",
59595+ .data = &grsec_audit_gid,
59596+ .maxlen = sizeof(int),
59597+ .mode = 0600,
59598+ .proc_handler = &proc_dointvec,
59599+ },
59600+#endif
59601+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59602+ {
59603+ .procname = "audit_chdir",
59604+ .data = &grsec_enable_chdir,
59605+ .maxlen = sizeof(int),
59606+ .mode = 0600,
59607+ .proc_handler = &proc_dointvec,
59608+ },
59609+#endif
59610+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59611+ {
59612+ .procname = "audit_mount",
59613+ .data = &grsec_enable_mount,
59614+ .maxlen = sizeof(int),
59615+ .mode = 0600,
59616+ .proc_handler = &proc_dointvec,
59617+ },
59618+#endif
59619+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59620+ {
59621+ .procname = "audit_textrel",
59622+ .data = &grsec_enable_audit_textrel,
59623+ .maxlen = sizeof(int),
59624+ .mode = 0600,
59625+ .proc_handler = &proc_dointvec,
59626+ },
59627+#endif
59628+#ifdef CONFIG_GRKERNSEC_DMESG
59629+ {
59630+ .procname = "dmesg",
59631+ .data = &grsec_enable_dmesg,
59632+ .maxlen = sizeof(int),
59633+ .mode = 0600,
59634+ .proc_handler = &proc_dointvec,
59635+ },
59636+#endif
59637+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59638+ {
59639+ .procname = "chroot_findtask",
59640+ .data = &grsec_enable_chroot_findtask,
59641+ .maxlen = sizeof(int),
59642+ .mode = 0600,
59643+ .proc_handler = &proc_dointvec,
59644+ },
59645+#endif
59646+#ifdef CONFIG_GRKERNSEC_RESLOG
59647+ {
59648+ .procname = "resource_logging",
59649+ .data = &grsec_resource_logging,
59650+ .maxlen = sizeof(int),
59651+ .mode = 0600,
59652+ .proc_handler = &proc_dointvec,
59653+ },
59654+#endif
59655+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59656+ {
59657+ .procname = "audit_ptrace",
59658+ .data = &grsec_enable_audit_ptrace,
59659+ .maxlen = sizeof(int),
59660+ .mode = 0600,
59661+ .proc_handler = &proc_dointvec,
59662+ },
59663+#endif
59664+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59665+ {
59666+ .procname = "harden_ptrace",
59667+ .data = &grsec_enable_harden_ptrace,
59668+ .maxlen = sizeof(int),
59669+ .mode = 0600,
59670+ .proc_handler = &proc_dointvec,
59671+ },
59672+#endif
59673+ {
59674+ .procname = "grsec_lock",
59675+ .data = &grsec_lock,
59676+ .maxlen = sizeof(int),
59677+ .mode = 0600,
59678+ .proc_handler = &proc_dointvec,
59679+ },
59680+#endif
59681+#ifdef CONFIG_GRKERNSEC_ROFS
59682+ {
59683+ .procname = "romount_protect",
59684+ .data = &grsec_enable_rofs,
59685+ .maxlen = sizeof(int),
59686+ .mode = 0600,
59687+ .proc_handler = &proc_dointvec_minmax,
59688+ .extra1 = &one,
59689+ .extra2 = &one,
59690+ },
59691+#endif
59692+ { }
59693+};
59694+#endif
66a7e928
MT		 59695diff -urNp linux-2.6.39/grsecurity/grsec_time.c linux-2.6.39/grsecurity/grsec_time.c
59696--- linux-2.6.39/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
59697+++ linux-2.6.39/grsecurity/grsec_time.c 2011-05-22 19:41:42.000000000 -0400
bc901d79 59698@@ -0,0 +1,16 @@
57199397
MT		 59699+#include <linux/kernel.h>
59700+#include <linux/sched.h>
59701+#include <linux/grinternal.h>
bc901d79 59702+#include <linux/module.h>
57199397
MT		 59703+
59704+void
59705+gr_log_timechange(void)
59706+{
59707+#ifdef CONFIG_GRKERNSEC_TIME
59708+ if (grsec_enable_time)
59709+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59710+#endif
59711+ return;
59712+}
bc901d79
MT		 59713+
59714+EXPORT_SYMBOL(gr_log_timechange);
66a7e928
MT		 59715diff -urNp linux-2.6.39/grsecurity/grsec_tpe.c linux-2.6.39/grsecurity/grsec_tpe.c
59716--- linux-2.6.39/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
59717+++ linux-2.6.39/grsecurity/grsec_tpe.c 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 59718@@ -0,0 +1,39 @@
59719+#include <linux/kernel.h>
59720+#include <linux/sched.h>
59721+#include <linux/file.h>
59722+#include <linux/fs.h>
59723+#include <linux/grinternal.h>
59724+
59725+extern int gr_acl_tpe_check(void);
59726+
59727+int
59728+gr_tpe_allow(const struct file *file)
59729+{
59730+#ifdef CONFIG_GRKERNSEC
59731+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59732+ const struct cred *cred = current_cred();
59733+
59734+ if (cred->uid && ((grsec_enable_tpe &&
59735+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59736+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59737+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59738+#else
59739+ in_group_p(grsec_tpe_gid)
59740+#endif
59741+ ) || gr_acl_tpe_check()) &&
59742+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59743+ (inode->i_mode & S_IWOTH))))) {
59744+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59745+ return 0;
59746+ }
59747+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59748+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59749+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59750+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59751+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59752+ return 0;
59753+ }
59754+#endif
59755+#endif
59756+ return 1;
59757+}
66a7e928
MT		 59758diff -urNp linux-2.6.39/grsecurity/grsum.c linux-2.6.39/grsecurity/grsum.c
59759--- linux-2.6.39/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
59760+++ linux-2.6.39/grsecurity/grsum.c 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 59761@@ -0,0 +1,61 @@
59762+#include <linux/err.h>
59763+#include <linux/kernel.h>
59764+#include <linux/sched.h>
59765+#include <linux/mm.h>
59766+#include <linux/scatterlist.h>
59767+#include <linux/crypto.h>
59768+#include <linux/gracl.h>
59769+
59770+
59771+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59772+#error "crypto and sha256 must be built into the kernel"
59773+#endif
59774+
59775+int
59776+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59777+{
59778+ char *p;
59779+ struct crypto_hash *tfm;
59780+ struct hash_desc desc;
59781+ struct scatterlist sg;
59782+ unsigned char temp_sum[GR_SHA_LEN];
59783+ volatile int retval = 0;
59784+ volatile int dummy = 0;
59785+ unsigned int i;
59786+
59787+ sg_init_table(&sg, 1);
59788+
59789+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59790+ if (IS_ERR(tfm)) {
59791+ /* should never happen, since sha256 should be built in */
59792+ return 1;
59793+ }
59794+
59795+ desc.tfm = tfm;
59796+ desc.flags = 0;
59797+
59798+ crypto_hash_init(&desc);
59799+
59800+ p = salt;
59801+ sg_set_buf(&sg, p, GR_SALT_LEN);
59802+ crypto_hash_update(&desc, &sg, sg.length);
59803+
59804+ p = entry->pw;
59805+ sg_set_buf(&sg, p, strlen(p));
59806+
59807+ crypto_hash_update(&desc, &sg, sg.length);
59808+
59809+ crypto_hash_final(&desc, temp_sum);
59810+
59811+ memset(entry->pw, 0, GR_PW_LEN);
59812+
59813+ for (i = 0; i < GR_SHA_LEN; i++)
59814+ if (sum[i] != temp_sum[i])
59815+ retval = 1;
59816+ else
59817+ dummy = 1; // waste a cycle
59818+
59819+ crypto_free_hash(tfm);
59820+
59821+ return retval;
59822+}
66a7e928
MT		 59823diff -urNp linux-2.6.39/grsecurity/Kconfig linux-2.6.39/grsecurity/Kconfig
59824--- linux-2.6.39/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
59825+++ linux-2.6.39/grsecurity/Kconfig 2011-05-22 19:41:42.000000000 -0400
71d190be 59826@@ -0,0 +1,1045 @@
57199397
MT		 59827+#
59828+# grecurity configuration
59829+#
59830+
59831+menu "Grsecurity"
59832+
59833+config GRKERNSEC
59834+ bool "Grsecurity"
59835+ select CRYPTO
59836+ select CRYPTO_SHA256
59837+ help
59838+ If you say Y here, you will be able to configure many features
59839+ that will enhance the security of your system. It is highly
59840+ recommended that you say Y here and read through the help
59841+ for each option so that you fully understand the features and
59842+ can evaluate their usefulness for your machine.
59843+
59844+choice
59845+ prompt "Security Level"
59846+ depends on GRKERNSEC
59847+ default GRKERNSEC_CUSTOM
59848+
59849+config GRKERNSEC_LOW
59850+ bool "Low"
59851+ select GRKERNSEC_LINK
59852+ select GRKERNSEC_FIFO
59853+ select GRKERNSEC_EXECVE
59854+ select GRKERNSEC_RANDNET
59855+ select GRKERNSEC_DMESG
59856+ select GRKERNSEC_CHROOT
59857+ select GRKERNSEC_CHROOT_CHDIR
59858+
59859+ help
59860+ If you choose this option, several of the grsecurity options will
59861+ be enabled that will give you greater protection against a number
59862+ of attacks, while assuring that none of your software will have any
59863+ conflicts with the additional security measures. If you run a lot
59864+ of unusual software, or you are having problems with the higher
59865+ security levels, you should say Y here. With this option, the
59866+ following features are enabled:
59867+
59868+ - Linking restrictions
59869+ - FIFO restrictions
59870+ - Enforcing RLIMIT_NPROC on execve
59871+ - Restricted dmesg
59872+ - Enforced chdir("/") on chroot
59873+ - Runtime module disabling
59874+
59875+config GRKERNSEC_MEDIUM
59876+ bool "Medium"
59877+ select PAX
59878+ select PAX_EI_PAX
59879+ select PAX_PT_PAX_FLAGS
59880+ select PAX_HAVE_ACL_FLAGS
59881+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59882+ select GRKERNSEC_CHROOT
59883+ select GRKERNSEC_CHROOT_SYSCTL
59884+ select GRKERNSEC_LINK
59885+ select GRKERNSEC_FIFO
59886+ select GRKERNSEC_EXECVE
59887+ select GRKERNSEC_DMESG
59888+ select GRKERNSEC_RANDNET
59889+ select GRKERNSEC_FORKFAIL
59890+ select GRKERNSEC_TIME
59891+ select GRKERNSEC_SIGNAL
59892+ select GRKERNSEC_CHROOT
59893+ select GRKERNSEC_CHROOT_UNIX
59894+ select GRKERNSEC_CHROOT_MOUNT
59895+ select GRKERNSEC_CHROOT_PIVOT
59896+ select GRKERNSEC_CHROOT_DOUBLE
59897+ select GRKERNSEC_CHROOT_CHDIR
59898+ select GRKERNSEC_CHROOT_MKNOD
59899+ select GRKERNSEC_PROC
59900+ select GRKERNSEC_PROC_USERGROUP
59901+ select PAX_RANDUSTACK
59902+ select PAX_ASLR
59903+ select PAX_RANDMMAP
59904+ select PAX_REFCOUNT if (X86 || SPARC64)
59905+ select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC) && (SLAB || SLUB || SLOB))
59906+
59907+ help
59908+ If you say Y here, several features in addition to those included
59909+ in the low additional security level will be enabled. These
59910+ features provide even more security to your system, though in rare
59911+ cases they may be incompatible with very old or poorly written
59912+ software. If you enable this option, make sure that your auth
59913+ service (identd) is running as gid 1001. With this option,
59914+ the following features (in addition to those provided in the
59915+ low additional security level) will be enabled:
59916+
59917+ - Failed fork logging
59918+ - Time change logging
59919+ - Signal logging
59920+ - Deny mounts in chroot
59921+ - Deny double chrooting
59922+ - Deny sysctl writes in chroot
59923+ - Deny mknod in chroot
59924+ - Deny access to abstract AF_UNIX sockets out of chroot
59925+ - Deny pivot_root in chroot
59926+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
59927+ - /proc restrictions with special GID set to 10 (usually wheel)
59928+ - Address Space Layout Randomization (ASLR)
59929+ - Prevent exploitation of most refcount overflows
59930+ - Bounds checking of copying between the kernel and userland
59931+
59932+config GRKERNSEC_HIGH
59933+ bool "High"
59934+ select GRKERNSEC_LINK
59935+ select GRKERNSEC_FIFO
59936+ select GRKERNSEC_EXECVE
59937+ select GRKERNSEC_DMESG
59938+ select GRKERNSEC_FORKFAIL
59939+ select GRKERNSEC_TIME
59940+ select GRKERNSEC_SIGNAL
59941+ select GRKERNSEC_CHROOT
59942+ select GRKERNSEC_CHROOT_SHMAT
59943+ select GRKERNSEC_CHROOT_UNIX
59944+ select GRKERNSEC_CHROOT_MOUNT
59945+ select GRKERNSEC_CHROOT_FCHDIR
59946+ select GRKERNSEC_CHROOT_PIVOT
59947+ select GRKERNSEC_CHROOT_DOUBLE
59948+ select GRKERNSEC_CHROOT_CHDIR
59949+ select GRKERNSEC_CHROOT_MKNOD
59950+ select GRKERNSEC_CHROOT_CAPS
59951+ select GRKERNSEC_CHROOT_SYSCTL
59952+ select GRKERNSEC_CHROOT_FINDTASK
16454cff 59953+ select GRKERNSEC_SYSFS_RESTRICT
57199397
MT		 59954+ select GRKERNSEC_PROC
59955+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59956+ select GRKERNSEC_HIDESYM
59957+ select GRKERNSEC_BRUTE
59958+ select GRKERNSEC_PROC_USERGROUP
59959+ select GRKERNSEC_KMEM
59960+ select GRKERNSEC_RESLOG
59961+ select GRKERNSEC_RANDNET
59962+ select GRKERNSEC_PROC_ADD
59963+ select GRKERNSEC_CHROOT_CHMOD
59964+ select GRKERNSEC_CHROOT_NICE
59965+ select GRKERNSEC_AUDIT_MOUNT
59966+ select GRKERNSEC_MODHARDEN if (MODULES)
59967+ select GRKERNSEC_HARDEN_PTRACE
59968+ select GRKERNSEC_VM86 if (X86_32)
71d190be 59969+ select GRKERNSEC_KERN_LOCKOUT if (X86)
57199397
MT		 59970+ select PAX
59971+ select PAX_RANDUSTACK
59972+ select PAX_ASLR
59973+ select PAX_RANDMMAP
59974+ select PAX_NOEXEC
59975+ select PAX_MPROTECT
59976+ select PAX_EI_PAX
59977+ select PAX_PT_PAX_FLAGS
59978+ select PAX_HAVE_ACL_FLAGS
59979+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
59980+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
71d190be 59981+ select PAX_RANDKSTACK if (X86_TSC && X86)
57199397
MT		 59982+ select PAX_SEGMEXEC if (X86_32)
59983+ select PAX_PAGEEXEC
59984+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
59985+ select PAX_EMUTRAMP if (PARISC)
59986+ select PAX_EMUSIGRT if (PARISC)
59987+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
59988+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
59989+ select PAX_REFCOUNT if (X86 || SPARC64)
59990+ select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
59991+ help
59992+ If you say Y here, many of the features of grsecurity will be
59993+ enabled, which will protect you against many kinds of attacks
59994+ against your system. The heightened security comes at a cost
59995+ of an increased chance of incompatibilities with rare software
59996+ on your machine. Since this security level enables PaX, you should
59997+ view <http://pax.grsecurity.net> and read about the PaX
59998+ project. While you are there, download chpax and run it on
59999+ binaries that cause problems with PaX. Also remember that
60000+ since the /proc restrictions are enabled, you must run your
60001+ identd as gid 1001. This security level enables the following
60002+ features in addition to those listed in the low and medium
60003+ security levels:
60004+
60005+ - Additional /proc restrictions
60006+ - Chmod restrictions in chroot
60007+ - No signals, ptrace, or viewing of processes outside of chroot
60008+ - Capability restrictions in chroot
60009+ - Deny fchdir out of chroot
60010+ - Priority restrictions in chroot
60011+ - Segmentation-based implementation of PaX
60012+ - Mprotect restrictions
60013+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
60014+ - Kernel stack randomization
60015+ - Mount/unmount/remount logging
60016+ - Kernel symbol hiding
60017+ - Prevention of memory exhaustion-based exploits
60018+ - Hardening of module auto-loading
60019+ - Ptrace restrictions
60020+ - Restricted vm86 mode
16454cff 60021+ - Restricted sysfs/debugfs
71d190be 60022+ - Active kernel exploit response
57199397
MT		 60023+
60024+config GRKERNSEC_CUSTOM
60025+ bool "Custom"
60026+ help
60027+ If you say Y here, you will be able to configure every grsecurity
60028+ option, which allows you to enable many more features that aren't
60029+ covered in the basic security levels. These additional features
60030+ include TPE, socket restrictions, and the sysctl system for
60031+ grsecurity. It is advised that you read through the help for
60032+ each option to determine its usefulness in your situation.
60033+
60034+endchoice
60035+
60036+menu "Address Space Protection"
60037+depends on GRKERNSEC
60038+
60039+config GRKERNSEC_KMEM
60040+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
71d190be 60041+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
57199397
MT		 60042+ help
60043+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
60044+ be written to via mmap or otherwise to modify the running kernel.
60045+ /dev/port will also not be allowed to be opened. If you have module
60046+ support disabled, enabling this will close up four ways that are
60047+ currently used to insert malicious code into the running kernel.
60048+ Even with all these features enabled, we still highly recommend that
60049+ you use the RBAC system, as it is still possible for an attacker to
60050+ modify the running kernel through privileged I/O granted by ioperm/iopl.
60051+ If you are not using XFree86, you may be able to stop this additional
60052+ case by enabling the 'Disable privileged I/O' option. Though nothing
60053+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
60054+ but only to video memory, which is the only writing we allow in this
60055+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
60056+ not be allowed to mprotect it with PROT_WRITE later.
60057+ It is highly recommended that you say Y here if you meet all the
60058+ conditions above.
60059+
60060+config GRKERNSEC_VM86
60061+ bool "Restrict VM86 mode"
60062+ depends on X86_32
60063+
60064+ help
60065+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
60066+ make use of a special execution mode on 32bit x86 processors called
60067+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
60068+ video cards and will still work with this option enabled. The purpose
60069+ of the option is to prevent exploitation of emulation errors in
60070+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
60071+ Nearly all users should be able to enable this option.
60072+
60073+config GRKERNSEC_IO
60074+ bool "Disable privileged I/O"
60075+ depends on X86
60076+ select RTC_CLASS
60077+ select RTC_INTF_DEV
60078+ select RTC_DRV_CMOS
60079+
60080+ help
60081+ If you say Y here, all ioperm and iopl calls will return an error.
60082+ Ioperm and iopl can be used to modify the running kernel.
60083+ Unfortunately, some programs need this access to operate properly,
60084+ the most notable of which are XFree86 and hwclock. hwclock can be
60085+ remedied by having RTC support in the kernel, so real-time
60086+ clock support is enabled if this option is enabled, to ensure
60087+ that hwclock operates correctly. XFree86 still will not
60088+ operate correctly with this option enabled, so DO NOT CHOOSE Y
60089+ IF YOU USE XFree86. If you use XFree86 and you still want to
60090+ protect your kernel against modification, use the RBAC system.
60091+
60092+config GRKERNSEC_PROC_MEMMAP
60093+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
60094+ default y if (PAX_NOEXEC || PAX_ASLR)
60095+ depends on PAX_NOEXEC || PAX_ASLR
60096+ help
60097+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
60098+ give no information about the addresses of its mappings if
60099+ PaX features that rely on random addresses are enabled on the task.
60100+ If you use PaX it is greatly recommended that you say Y here as it
60101+ closes up a hole that makes the full ASLR useless for suid
60102+ binaries.
60103+
60104+config GRKERNSEC_BRUTE
60105+ bool "Deter exploit bruteforcing"
60106+ help
60107+ If you say Y here, attempts to bruteforce exploits against forking
71d190be
MT		 60108+ daemons such as apache or sshd, as well as against suid/sgid binaries
60109+ will be deterred. When a child of a forking daemon is killed by PaX
60110+ or crashes due to an illegal instruction or other suspicious signal,
60111+ the parent process will be delayed 30 seconds upon every subsequent
60112+ fork until the administrator is able to assess the situation and
60113+ restart the daemon.
60114+ In the suid/sgid case, the attempt is logged, the user has all their
60115+ processes terminated, and they are prevented from executing any further
60116+ processes for 15 minutes.
60117+ It is recommended that you also enable signal logging in the auditing
60118+ section so that logs are generated when a process triggers a suspicious
60119+ signal.
57199397
MT		 60120+
60121+config GRKERNSEC_MODHARDEN
60122+ bool "Harden module auto-loading"
60123+ depends on MODULES
60124+ help
60125+ If you say Y here, module auto-loading in response to use of some
60126+ feature implemented by an unloaded module will be restricted to
60127+ root users. Enabling this option helps defend against attacks
60128+ by unprivileged users who abuse the auto-loading behavior to
60129+ cause a vulnerable module to load that is then exploited.
60130+
60131+ If this option prevents a legitimate use of auto-loading for a
60132+ non-root user, the administrator can execute modprobe manually
60133+ with the exact name of the module mentioned in the alert log.
60134+ Alternatively, the administrator can add the module to the list
60135+ of modules loaded at boot by modifying init scripts.
60136+
60137+ Modification of init scripts will most likely be needed on
60138+ Ubuntu servers with encrypted home directory support enabled,
60139+ as the first non-root user logging in will cause the ecb(aes),
60140+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
60141+
60142+config GRKERNSEC_HIDESYM
60143+ bool "Hide kernel symbols"
60144+ help
60145+ If you say Y here, getting information on loaded modules, and
60146+ displaying all kernel symbols through a syscall will be restricted
60147+ to users with CAP_SYS_MODULE. For software compatibility reasons,
60148+ /proc/kallsyms will be restricted to the root user. The RBAC
60149+ system can hide that entry even from root.
60150+
60151+ This option also prevents leaking of kernel addresses through
60152+ several /proc entries.
60153+
60154+ Note that this option is only effective provided the following
60155+ conditions are met:
60156+ 1) The kernel using grsecurity is not precompiled by some distribution
bc901d79
MT		 60157+ 2) You have also enabled GRKERNSEC_DMESG
60158+ 3) You are using the RBAC system and hiding other files such as your
57199397
MT		 60159+ kernel image and System.map. Alternatively, enabling this option
60160+ causes the permissions on /boot, /lib/modules, and the kernel
60161+ source directory to change at compile time to prevent
60162+ reading by non-root users.
60163+ If the above conditions are met, this option will aid in providing a
60164+ useful protection against local kernel exploitation of overflows
60165+ and arbitrary read/write vulnerabilities.
60166+
71d190be
MT		 60167+config GRKERNSEC_KERN_LOCKOUT
60168+ bool "Active kernel exploit response"
60169+ depends on X86
60170+ help
60171+ If you say Y here, when a PaX alert is triggered due to suspicious
60172+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
60173+ or an OOPs occurs due to bad memory accesses, instead of just
60174+ terminating the offending process (and potentially allowing
60175+ a subsequent exploit from the same user), we will take one of two
60176+ actions:
60177+ If the user was root, we will panic the system
60178+ If the user was non-root, we will log the attempt, terminate
60179+ all processes owned by the user, then prevent them from creating
60180+ any new processes until the system is restarted
60181+ This deters repeated kernel exploitation/bruteforcing attempts
60182+ and is useful for later forensics.
60183+
57199397
MT		 60184+endmenu
60185+menu "Role Based Access Control Options"
60186+depends on GRKERNSEC
60187+
16454cff
MT		 60188+config GRKERNSEC_RBAC_DEBUG
60189+ bool
60190+
57199397
MT		 60191+config GRKERNSEC_NO_RBAC
60192+ bool "Disable RBAC system"
60193+ help
60194+ If you say Y here, the /dev/grsec device will be removed from the kernel,
60195+ preventing the RBAC system from being enabled. You should only say Y
60196+ here if you have no intention of using the RBAC system, so as to prevent
60197+ an attacker with root access from misusing the RBAC system to hide files
60198+ and processes when loadable module support and /dev/[k]mem have been
60199+ locked down.
60200+
60201+config GRKERNSEC_ACL_HIDEKERN
60202+ bool "Hide kernel processes"
60203+ help
60204+ If you say Y here, all kernel threads will be hidden to all
60205+ processes but those whose subject has the "view hidden processes"
60206+ flag.
60207+
60208+config GRKERNSEC_ACL_MAXTRIES
60209+ int "Maximum tries before password lockout"
60210+ default 3
60211+ help
60212+ This option enforces the maximum number of times a user can attempt
60213+ to authorize themselves with the grsecurity RBAC system before being
60214+ denied the ability to attempt authorization again for a specified time.
60215+ The lower the number, the harder it will be to brute-force a password.
60216+
60217+config GRKERNSEC_ACL_TIMEOUT
60218+ int "Time to wait after max password tries, in seconds"
60219+ default 30
60220+ help
60221+ This option specifies the time the user must wait after attempting to
60222+ authorize to the RBAC system with the maximum number of invalid
60223+ passwords. The higher the number, the harder it will be to brute-force
60224+ a password.
60225+
60226+endmenu
60227+menu "Filesystem Protections"
60228+depends on GRKERNSEC
60229+
60230+config GRKERNSEC_PROC
60231+ bool "Proc restrictions"
60232+ help
60233+ If you say Y here, the permissions of the /proc filesystem
60234+ will be altered to enhance system security and privacy. You MUST
60235+ choose either a user only restriction or a user and group restriction.
60236+ Depending upon the option you choose, you can either restrict users to
60237+ see only the processes they themselves run, or choose a group that can
60238+ view all processes and files normally restricted to root if you choose
60239+ the "restrict to user only" option. NOTE: If you're running identd as
60240+ a non-root user, you will have to run it as the group you specify here.
60241+
60242+config GRKERNSEC_PROC_USER
60243+ bool "Restrict /proc to user only"
60244+ depends on GRKERNSEC_PROC
60245+ help
60246+ If you say Y here, non-root users will only be able to view their own
60247+ processes, and restricts them from viewing network-related information,
60248+ and viewing kernel symbol and module information.
60249+
60250+config GRKERNSEC_PROC_USERGROUP
60251+ bool "Allow special group"
60252+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
60253+ help
60254+ If you say Y here, you will be able to select a group that will be
bc901d79
MT		 60255+ able to view all processes and network-related information. If you've
60256+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
60257+ remain hidden. This option is useful if you want to run identd as
60258+ a non-root user.
57199397
MT		 60259+
60260+config GRKERNSEC_PROC_GID
60261+ int "GID for special group"
60262+ depends on GRKERNSEC_PROC_USERGROUP
60263+ default 1001
60264+
60265+config GRKERNSEC_PROC_ADD
60266+ bool "Additional restrictions"
60267+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
60268+ help
60269+ If you say Y here, additional restrictions will be placed on
60270+ /proc that keep normal users from viewing device information and
60271+ slabinfo information that could be useful for exploits.
60272+
60273+config GRKERNSEC_LINK
60274+ bool "Linking restrictions"
60275+ help
60276+ If you say Y here, /tmp race exploits will be prevented, since users
60277+ will no longer be able to follow symlinks owned by other users in
16454cff 60278+ world-writable +t directories (e.g. /tmp), unless the owner of the
57199397
MT		 60279+ symlink is the owner of the directory. users will also not be
60280+ able to hardlink to files they do not own. If the sysctl option is
60281+ enabled, a sysctl option with name "linking_restrictions" is created.
60282+
60283+config GRKERNSEC_FIFO
60284+ bool "FIFO restrictions"
60285+ help
60286+ If you say Y here, users will not be able to write to FIFOs they don't
16454cff 60287+ own in world-writable +t directories (e.g. /tmp), unless the owner of
57199397
MT		 60288+ the FIFO is the same owner of the directory it's held in. If the sysctl
60289+ option is enabled, a sysctl option with name "fifo_restrictions" is
60290+ created.
60291+
16454cff
MT		 60292+config GRKERNSEC_SYSFS_RESTRICT
60293+ bool "Sysfs/debugfs restriction"
60294+ depends on SYSFS
60295+ help
60296+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
60297+ any filesystem normally mounted under it (e.g. debugfs) will only
60298+ be accessible by root. These filesystems generally provide access
60299+ to hardware and debug information that isn't appropriate for unprivileged
60300+ users of the system. Sysfs and debugfs have also become a large source
60301+ of new vulnerabilities, ranging from infoleaks to local compromise.
60302+ There has been very little oversight with an eye toward security involved
60303+ in adding new exporters of information to these filesystems, so their
60304+ use is discouraged.
60305+ This option is equivalent to a chmod 0700 of the mount paths.
60306+
57199397
MT		 60307+config GRKERNSEC_ROFS
60308+ bool "Runtime read-only mount protection"
60309+ help
60310+ If you say Y here, a sysctl option with name "romount_protect" will
60311+ be created. By setting this option to 1 at runtime, filesystems
60312+ will be protected in the following ways:
60313+ * No new writable mounts will be allowed
60314+ * Existing read-only mounts won't be able to be remounted read/write
60315+ * Write operations will be denied on all block devices
60316+ This option acts independently of grsec_lock: once it is set to 1,
60317+ it cannot be turned off. Therefore, please be mindful of the resulting
60318+ behavior if this option is enabled in an init script on a read-only
60319+ filesystem. This feature is mainly intended for secure embedded systems.
60320+
60321+config GRKERNSEC_CHROOT
60322+ bool "Chroot jail restrictions"
60323+ help
60324+ If you say Y here, you will be able to choose several options that will
60325+ make breaking out of a chrooted jail much more difficult. If you
60326+ encounter no software incompatibilities with the following options, it
60327+ is recommended that you enable each one.
60328+
60329+config GRKERNSEC_CHROOT_MOUNT
60330+ bool "Deny mounts"
60331+ depends on GRKERNSEC_CHROOT
60332+ help
60333+ If you say Y here, processes inside a chroot will not be able to
60334+ mount or remount filesystems. If the sysctl option is enabled, a
60335+ sysctl option with name "chroot_deny_mount" is created.
60336+
60337+config GRKERNSEC_CHROOT_DOUBLE
60338+ bool "Deny double-chroots"
60339+ depends on GRKERNSEC_CHROOT
60340+ help
60341+ If you say Y here, processes inside a chroot will not be able to chroot
60342+ again outside the chroot. This is a widely used method of breaking
60343+ out of a chroot jail and should not be allowed. If the sysctl
60344+ option is enabled, a sysctl option with name
60345+ "chroot_deny_chroot" is created.
60346+
60347+config GRKERNSEC_CHROOT_PIVOT
60348+ bool "Deny pivot_root in chroot"
60349+ depends on GRKERNSEC_CHROOT
60350+ help
60351+ If you say Y here, processes inside a chroot will not be able to use
60352+ a function called pivot_root() that was introduced in Linux 2.3.41. It
60353+ works similar to chroot in that it changes the root filesystem. This
60354+ function could be misused in a chrooted process to attempt to break out
60355+ of the chroot, and therefore should not be allowed. If the sysctl
60356+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
60357+ created.
60358+
60359+config GRKERNSEC_CHROOT_CHDIR
60360+ bool "Enforce chdir(\"/\") on all chroots"
60361+ depends on GRKERNSEC_CHROOT
60362+ help
60363+ If you say Y here, the current working directory of all newly-chrooted
60364+ applications will be set to the the root directory of the chroot.
60365+ The man page on chroot(2) states:
60366+ Note that this call does not change the current working
60367+ directory, so that `.' can be outside the tree rooted at
60368+ `/'. In particular, the super-user can escape from a
60369+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
60370+
60371+ It is recommended that you say Y here, since it's not known to break
60372+ any software. If the sysctl option is enabled, a sysctl option with
60373+ name "chroot_enforce_chdir" is created.
60374+
60375+config GRKERNSEC_CHROOT_CHMOD
60376+ bool "Deny (f)chmod +s"
60377+ depends on GRKERNSEC_CHROOT
60378+ help
60379+ If you say Y here, processes inside a chroot will not be able to chmod
60380+ or fchmod files to make them have suid or sgid bits. This protects
60381+ against another published method of breaking a chroot. If the sysctl
60382+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
60383+ created.
60384+
60385+config GRKERNSEC_CHROOT_FCHDIR
60386+ bool "Deny fchdir out of chroot"
60387+ depends on GRKERNSEC_CHROOT
60388+ help
60389+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
60390+ to a file descriptor of the chrooting process that points to a directory
60391+ outside the filesystem will be stopped. If the sysctl option
60392+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
60393+
60394+config GRKERNSEC_CHROOT_MKNOD
60395+ bool "Deny mknod"
60396+ depends on GRKERNSEC_CHROOT
60397+ help
60398+ If you say Y here, processes inside a chroot will not be allowed to
60399+ mknod. The problem with using mknod inside a chroot is that it
60400+ would allow an attacker to create a device entry that is the same
60401+ as one on the physical root of your system, which could range from
60402+ anything from the console device to a device for your harddrive (which
60403+ they could then use to wipe the drive or steal data). It is recommended
60404+ that you say Y here, unless you run into software incompatibilities.
60405+ If the sysctl option is enabled, a sysctl option with name
60406+ "chroot_deny_mknod" is created.
60407+
60408+config GRKERNSEC_CHROOT_SHMAT
60409+ bool "Deny shmat() out of chroot"
60410+ depends on GRKERNSEC_CHROOT
60411+ help
60412+ If you say Y here, processes inside a chroot will not be able to attach
60413+ to shared memory segments that were created outside of the chroot jail.
60414+ It is recommended that you say Y here. If the sysctl option is enabled,
60415+ a sysctl option with name "chroot_deny_shmat" is created.
60416+
60417+config GRKERNSEC_CHROOT_UNIX
60418+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
60419+ depends on GRKERNSEC_CHROOT
60420+ help
60421+ If you say Y here, processes inside a chroot will not be able to
60422+ connect to abstract (meaning not belonging to a filesystem) Unix
60423+ domain sockets that were bound outside of a chroot. It is recommended
60424+ that you say Y here. If the sysctl option is enabled, a sysctl option
60425+ with name "chroot_deny_unix" is created.
60426+
60427+config GRKERNSEC_CHROOT_FINDTASK
60428+ bool "Protect outside processes"
60429+ depends on GRKERNSEC_CHROOT
60430+ help
60431+ If you say Y here, processes inside a chroot will not be able to
60432+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
60433+ getsid, or view any process outside of the chroot. If the sysctl
60434+ option is enabled, a sysctl option with name "chroot_findtask" is
60435+ created.
60436+
60437+config GRKERNSEC_CHROOT_NICE
60438+ bool "Restrict priority changes"
60439+ depends on GRKERNSEC_CHROOT
60440+ help
60441+ If you say Y here, processes inside a chroot will not be able to raise
60442+ the priority of processes in the chroot, or alter the priority of
60443+ processes outside the chroot. This provides more security than simply
60444+ removing CAP_SYS_NICE from the process' capability set. If the
60445+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
60446+ is created.
60447+
60448+config GRKERNSEC_CHROOT_SYSCTL
60449+ bool "Deny sysctl writes"
60450+ depends on GRKERNSEC_CHROOT
60451+ help
60452+ If you say Y here, an attacker in a chroot will not be able to
60453+ write to sysctl entries, either by sysctl(2) or through a /proc
60454+ interface. It is strongly recommended that you say Y here. If the
60455+ sysctl option is enabled, a sysctl option with name
60456+ "chroot_deny_sysctl" is created.
60457+
60458+config GRKERNSEC_CHROOT_CAPS
60459+ bool "Capability restrictions"
60460+ depends on GRKERNSEC_CHROOT
60461+ help
60462+ If you say Y here, the capabilities on all root processes within a
60463+ chroot jail will be lowered to stop module insertion, raw i/o,
60464+ system and net admin tasks, rebooting the system, modifying immutable
60465+ files, modifying IPC owned by another, and changing the system time.
60466+ This is left an option because it can break some apps. Disable this
60467+ if your chrooted apps are having problems performing those kinds of
60468+ tasks. If the sysctl option is enabled, a sysctl option with
60469+ name "chroot_caps" is created.
60470+
60471+endmenu
60472+menu "Kernel Auditing"
60473+depends on GRKERNSEC
60474+
60475+config GRKERNSEC_AUDIT_GROUP
60476+ bool "Single group for auditing"
60477+ help
60478+ If you say Y here, the exec, chdir, and (un)mount logging features
60479+ will only operate on a group you specify. This option is recommended
60480+ if you only want to watch certain users instead of having a large
60481+ amount of logs from the entire system. If the sysctl option is enabled,
60482+ a sysctl option with name "audit_group" is created.
60483+
60484+config GRKERNSEC_AUDIT_GID
60485+ int "GID for auditing"
60486+ depends on GRKERNSEC_AUDIT_GROUP
60487+ default 1007
60488+
60489+config GRKERNSEC_EXECLOG
60490+ bool "Exec logging"
60491+ help
60492+ If you say Y here, all execve() calls will be logged (since the
60493+ other exec*() calls are frontends to execve(), all execution
60494+ will be logged). Useful for shell-servers that like to keep track
60495+ of their users. If the sysctl option is enabled, a sysctl option with
60496+ name "exec_logging" is created.
60497+ WARNING: This option when enabled will produce a LOT of logs, especially
60498+ on an active system.
60499+
60500+config GRKERNSEC_RESLOG
60501+ bool "Resource logging"
60502+ help
60503+ If you say Y here, all attempts to overstep resource limits will
60504+ be logged with the resource name, the requested size, and the current
60505+ limit. It is highly recommended that you say Y here. If the sysctl
60506+ option is enabled, a sysctl option with name "resource_logging" is
60507+ created. If the RBAC system is enabled, the sysctl value is ignored.
60508+
60509+config GRKERNSEC_CHROOT_EXECLOG
60510+ bool "Log execs within chroot"
60511+ help
60512+ If you say Y here, all executions inside a chroot jail will be logged
60513+ to syslog. This can cause a large amount of logs if certain
60514+ applications (eg. djb's daemontools) are installed on the system, and
60515+ is therefore left as an option. If the sysctl option is enabled, a
60516+ sysctl option with name "chroot_execlog" is created.
60517+
60518+config GRKERNSEC_AUDIT_PTRACE
60519+ bool "Ptrace logging"
60520+ help
60521+ If you say Y here, all attempts to attach to a process via ptrace
60522+ will be logged. If the sysctl option is enabled, a sysctl option
60523+ with name "audit_ptrace" is created.
60524+
60525+config GRKERNSEC_AUDIT_CHDIR
60526+ bool "Chdir logging"
60527+ help
60528+ If you say Y here, all chdir() calls will be logged. If the sysctl
60529+ option is enabled, a sysctl option with name "audit_chdir" is created.
60530+
60531+config GRKERNSEC_AUDIT_MOUNT
60532+ bool "(Un)Mount logging"
60533+ help
60534+ If you say Y here, all mounts and unmounts will be logged. If the
60535+ sysctl option is enabled, a sysctl option with name "audit_mount" is
60536+ created.
60537+
60538+config GRKERNSEC_SIGNAL
60539+ bool "Signal logging"
60540+ help
60541+ If you say Y here, certain important signals will be logged, such as
60542+ SIGSEGV, which will as a result inform you of when a error in a program
60543+ occurred, which in some cases could mean a possible exploit attempt.
60544+ If the sysctl option is enabled, a sysctl option with name
60545+ "signal_logging" is created.
60546+
60547+config GRKERNSEC_FORKFAIL
60548+ bool "Fork failure logging"
60549+ help
60550+ If you say Y here, all failed fork() attempts will be logged.
60551+ This could suggest a fork bomb, or someone attempting to overstep
60552+ their process limit. If the sysctl option is enabled, a sysctl option
60553+ with name "forkfail_logging" is created.
60554+
60555+config GRKERNSEC_TIME
60556+ bool "Time change logging"
60557+ help
60558+ If you say Y here, any changes of the system clock will be logged.
60559+ If the sysctl option is enabled, a sysctl option with name
60560+ "timechange_logging" is created.
60561+
60562+config GRKERNSEC_PROC_IPADDR
60563+ bool "/proc/<pid>/ipaddr support"
60564+ help
60565+ If you say Y here, a new entry will be added to each /proc/<pid>
60566+ directory that contains the IP address of the person using the task.
60567+ The IP is carried across local TCP and AF_UNIX stream sockets.
60568+ This information can be useful for IDS/IPSes to perform remote response
60569+ to a local attack. The entry is readable by only the owner of the
60570+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
60571+ the RBAC system), and thus does not create privacy concerns.
60572+
6892158b
MT		 60573+config GRKERNSEC_RWXMAP_LOG
60574+ bool 'Denied RWX mmap/mprotect logging'
60575+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
60576+ help
60577+ If you say Y here, calls to mmap() and mprotect() with explicit
60578+ usage of PROT_WRITE and PROT_EXEC together will be logged when
60579+ denied by the PAX_MPROTECT feature. If the sysctl option is
60580+ enabled, a sysctl option with name "rwxmap_logging" is created.
60581+
57199397
MT		 60582+config GRKERNSEC_AUDIT_TEXTREL
60583+ bool 'ELF text relocations logging (READ HELP)'
60584+ depends on PAX_MPROTECT
60585+ help
60586+ If you say Y here, text relocations will be logged with the filename
60587+ of the offending library or binary. The purpose of the feature is
60588+ to help Linux distribution developers get rid of libraries and
60589+ binaries that need text relocations which hinder the future progress
60590+ of PaX. Only Linux distribution developers should say Y here, and
60591+ never on a production machine, as this option creates an information
60592+ leak that could aid an attacker in defeating the randomization of
60593+ a single memory region. If the sysctl option is enabled, a sysctl
60594+ option with name "audit_textrel" is created.
60595+
60596+endmenu
60597+
60598+menu "Executable Protections"
60599+depends on GRKERNSEC
60600+
60601+config GRKERNSEC_EXECVE
60602+ bool "Enforce RLIMIT_NPROC on execs"
60603+ help
60604+ If you say Y here, users with a resource limit on processes will
60605+ have the value checked during execve() calls. The current system
60606+ only checks the system limit during fork() calls. If the sysctl option
60607+ is enabled, a sysctl option with name "execve_limiting" is created.
60608+
60609+config GRKERNSEC_DMESG
60610+ bool "Dmesg(8) restriction"
60611+ help
60612+ If you say Y here, non-root users will not be able to use dmesg(8)
60613+ to view up to the last 4kb of messages in the kernel's log buffer.
bc901d79
MT		 60614+ The kernel's log buffer often contains kernel addresses and other
60615+ identifying information useful to an attacker in fingerprinting a
60616+ system for a targeted exploit.
57199397
MT		 60617+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
60618+ created.
60619+
60620+config GRKERNSEC_HARDEN_PTRACE
60621+ bool "Deter ptrace-based process snooping"
60622+ help
60623+ If you say Y here, TTY sniffers and other malicious monitoring
60624+ programs implemented through ptrace will be defeated. If you
60625+ have been using the RBAC system, this option has already been
60626+ enabled for several years for all users, with the ability to make
60627+ fine-grained exceptions.
60628+
60629+ This option only affects the ability of non-root users to ptrace
60630+ processes that are not a descendent of the ptracing process.
60631+ This means that strace ./binary and gdb ./binary will still work,
60632+ but attaching to arbitrary processes will not. If the sysctl
60633+ option is enabled, a sysctl option with name "harden_ptrace" is
60634+ created.
60635+
60636+config GRKERNSEC_TPE
60637+ bool "Trusted Path Execution (TPE)"
60638+ help
60639+ If you say Y here, you will be able to choose a gid to add to the
60640+ supplementary groups of users you want to mark as "untrusted."
60641+ These users will not be able to execute any files that are not in
60642+ root-owned directories writable only by root. If the sysctl option
60643+ is enabled, a sysctl option with name "tpe" is created.
60644+
60645+config GRKERNSEC_TPE_ALL
60646+ bool "Partially restrict all non-root users"
60647+ depends on GRKERNSEC_TPE
60648+ help
60649+ If you say Y here, all non-root users will be covered under
60650+ a weaker TPE restriction. This is separate from, and in addition to,
60651+ the main TPE options that you have selected elsewhere. Thus, if a
60652+ "trusted" GID is chosen, this restriction applies to even that GID.
60653+ Under this restriction, all non-root users will only be allowed to
60654+ execute files in directories they own that are not group or
60655+ world-writable, or in directories owned by root and writable only by
60656+ root. If the sysctl option is enabled, a sysctl option with name
60657+ "tpe_restrict_all" is created.
60658+
60659+config GRKERNSEC_TPE_INVERT
60660+ bool "Invert GID option"
60661+ depends on GRKERNSEC_TPE
60662+ help
60663+ If you say Y here, the group you specify in the TPE configuration will
60664+ decide what group TPE restrictions will be *disabled* for. This
60665+ option is useful if you want TPE restrictions to be applied to most
60666+ users on the system. If the sysctl option is enabled, a sysctl option
60667+ with name "tpe_invert" is created. Unlike other sysctl options, this
60668+ entry will default to on for backward-compatibility.
58c5fc13 60669+
57199397
MT		 60670+config GRKERNSEC_TPE_GID
60671+ int "GID for untrusted users"
60672+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
60673+ default 1005
60674+ help
60675+ Setting this GID determines what group TPE restrictions will be
60676+ *enabled* for. If the sysctl option is enabled, a sysctl option
60677+ with name "tpe_gid" is created.
58c5fc13 60678+
57199397
MT		 60679+config GRKERNSEC_TPE_GID
60680+ int "GID for trusted users"
60681+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
60682+ default 1005
60683+ help
60684+ Setting this GID determines what group TPE restrictions will be
60685+ *disabled* for. If the sysctl option is enabled, a sysctl option
60686+ with name "tpe_gid" is created.
58c5fc13 60687+
57199397
MT		 60688+endmenu
60689+menu "Network Protections"
60690+depends on GRKERNSEC
58c5fc13 60691+
57199397
MT		 60692+config GRKERNSEC_RANDNET
60693+ bool "Larger entropy pools"
60694+ help
60695+ If you say Y here, the entropy pools used for many features of Linux
60696+ and grsecurity will be doubled in size. Since several grsecurity
60697+ features use additional randomness, it is recommended that you say Y
60698+ here. Saying Y here has a similar effect as modifying
60699+ /proc/sys/kernel/random/poolsize.
58c5fc13 60700+
57199397
MT		 60701+config GRKERNSEC_BLACKHOLE
60702+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
60703+ help
60704+ If you say Y here, neither TCP resets nor ICMP
60705+ destination-unreachable packets will be sent in response to packets
60706+ sent to ports for which no associated listening process exists.
60707+ This feature supports both IPV4 and IPV6 and exempts the
60708+ loopback interface from blackholing. Enabling this feature
60709+ makes a host more resilient to DoS attacks and reduces network
60710+ visibility against scanners.
58c5fc13 60711+
57199397
MT		 60712+ The blackhole feature as-implemented is equivalent to the FreeBSD
60713+ blackhole feature, as it prevents RST responses to all packets, not
60714+ just SYNs. Under most application behavior this causes no
60715+ problems, but applications (like haproxy) may not close certain
60716+ connections in a way that cleanly terminates them on the remote
60717+ end, leaving the remote host in LAST_ACK state. Because of this
60718+ side-effect and to prevent intentional LAST_ACK DoSes, this
60719+ feature also adds automatic mitigation against such attacks.
60720+ The mitigation drastically reduces the amount of time a socket
60721+ can spend in LAST_ACK state. If you're using haproxy and not
60722+ all servers it connects to have this option enabled, consider
60723+ disabling this feature on the haproxy host.
58c5fc13 60724+
57199397
MT		 60725+ If the sysctl option is enabled, two sysctl options with names
60726+ "ip_blackhole" and "lastack_retries" will be created.
60727+ While "ip_blackhole" takes the standard zero/non-zero on/off
60728+ toggle, "lastack_retries" uses the same kinds of values as
60729+ "tcp_retries1" and "tcp_retries2". The default value of 4
60730+ prevents a socket from lasting more than 45 seconds in LAST_ACK
60731+ state.
df50ba0c 60732+
57199397
MT		 60733+config GRKERNSEC_SOCKET
60734+ bool "Socket restrictions"
60735+ help
60736+ If you say Y here, you will be able to choose from several options.
60737+ If you assign a GID on your system and add it to the supplementary
60738+ groups of users you want to restrict socket access to, this patch
60739+ will perform up to three things, based on the option(s) you choose.
df50ba0c 60740+
57199397
MT		 60741+config GRKERNSEC_SOCKET_ALL
60742+ bool "Deny any sockets to group"
60743+ depends on GRKERNSEC_SOCKET
60744+ help
60745+ If you say Y here, you will be able to choose a GID of whose users will
60746+ be unable to connect to other hosts from your machine or run server
60747+ applications from your machine. If the sysctl option is enabled, a
60748+ sysctl option with name "socket_all" is created.
58c5fc13 60749+
57199397
MT		 60750+config GRKERNSEC_SOCKET_ALL_GID
60751+ int "GID to deny all sockets for"
60752+ depends on GRKERNSEC_SOCKET_ALL
60753+ default 1004
60754+ help
60755+ Here you can choose the GID to disable socket access for. Remember to
60756+ add the users you want socket access disabled for to the GID
60757+ specified here. If the sysctl option is enabled, a sysctl option
60758+ with name "socket_all_gid" is created.
58c5fc13 60759+
57199397
MT		 60760+config GRKERNSEC_SOCKET_CLIENT
60761+ bool "Deny client sockets to group"
60762+ depends on GRKERNSEC_SOCKET
60763+ help
60764+ If you say Y here, you will be able to choose a GID of whose users will
60765+ be unable to connect to other hosts from your machine, but will be
60766+ able to run servers. If this option is enabled, all users in the group
60767+ you specify will have to use passive mode when initiating ftp transfers
60768+ from the shell on your machine. If the sysctl option is enabled, a
60769+ sysctl option with name "socket_client" is created.
58c5fc13 60770+
57199397
MT		 60771+config GRKERNSEC_SOCKET_CLIENT_GID
60772+ int "GID to deny client sockets for"
60773+ depends on GRKERNSEC_SOCKET_CLIENT
60774+ default 1003
60775+ help
60776+ Here you can choose the GID to disable client socket access for.
60777+ Remember to add the users you want client socket access disabled for to
60778+ the GID specified here. If the sysctl option is enabled, a sysctl
60779+ option with name "socket_client_gid" is created.
58c5fc13 60780+
57199397
MT		 60781+config GRKERNSEC_SOCKET_SERVER
60782+ bool "Deny server sockets to group"
60783+ depends on GRKERNSEC_SOCKET
60784+ help
60785+ If you say Y here, you will be able to choose a GID of whose users will
60786+ be unable to run server applications from your machine. If the sysctl
60787+ option is enabled, a sysctl option with name "socket_server" is created.
58c5fc13 60788+
57199397
MT		 60789+config GRKERNSEC_SOCKET_SERVER_GID
60790+ int "GID to deny server sockets for"
60791+ depends on GRKERNSEC_SOCKET_SERVER
60792+ default 1002
60793+ help
60794+ Here you can choose the GID to disable server socket access for.
60795+ Remember to add the users you want server socket access disabled for to
60796+ the GID specified here. If the sysctl option is enabled, a sysctl
60797+ option with name "socket_server_gid" is created.
58c5fc13 60798+
57199397
MT		 60799+endmenu
60800+menu "Sysctl support"
60801+depends on GRKERNSEC && SYSCTL
58c5fc13 60802+
57199397
MT		 60803+config GRKERNSEC_SYSCTL
60804+ bool "Sysctl support"
60805+ help
60806+ If you say Y here, you will be able to change the options that
60807+ grsecurity runs with at bootup, without having to recompile your
60808+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
60809+ to enable (1) or disable (0) various features. All the sysctl entries
60810+ are mutable until the "grsec_lock" entry is set to a non-zero value.
60811+ All features enabled in the kernel configuration are disabled at boot
60812+ if you do not say Y to the "Turn on features by default" option.
60813+ All options should be set at startup, and the grsec_lock entry should
60814+ be set to a non-zero value after all the options are set.
60815+ *THIS IS EXTREMELY IMPORTANT*
58c5fc13 60816+
57199397
MT		 60817+config GRKERNSEC_SYSCTL_DISTRO
60818+ bool "Extra sysctl support for distro makers (READ HELP)"
60819+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
60820+ help
60821+ If you say Y here, additional sysctl options will be created
60822+ for features that affect processes running as root. Therefore,
60823+ it is critical when using this option that the grsec_lock entry be
60824+ enabled after boot. Only distros with prebuilt kernel packages
60825+ with this option enabled that can ensure grsec_lock is enabled
60826+ after boot should use this option.
60827+ *Failure to set grsec_lock after boot makes all grsec features
60828+ this option covers useless*
58c5fc13 60829+
57199397
MT		 60830+ Currently this option creates the following sysctl entries:
60831+ "Disable Privileged I/O": "disable_priv_io"
60832+
60833+config GRKERNSEC_SYSCTL_ON
60834+ bool "Turn on features by default"
60835+ depends on GRKERNSEC_SYSCTL
60836+ help
60837+ If you say Y here, instead of having all features enabled in the
60838+ kernel configuration disabled at boot time, the features will be
60839+ enabled at boot time. It is recommended you say Y here unless
60840+ there is some reason you would want all sysctl-tunable features to
60841+ be disabled by default. As mentioned elsewhere, it is important
60842+ to enable the grsec_lock entry once you have finished modifying
60843+ the sysctl entries.
60844+
60845+endmenu
60846+menu "Logging Options"
60847+depends on GRKERNSEC
60848+
60849+config GRKERNSEC_FLOODTIME
60850+ int "Seconds in between log messages (minimum)"
60851+ default 10
60852+ help
60853+ This option allows you to enforce the number of seconds between
60854+ grsecurity log messages. The default should be suitable for most
60855+ people, however, if you choose to change it, choose a value small enough
60856+ to allow informative logs to be produced, but large enough to
60857+ prevent flooding.
60858+
60859+config GRKERNSEC_FLOODBURST
60860+ int "Number of messages in a burst (maximum)"
60861+ default 4
60862+ help
60863+ This option allows you to choose the maximum number of messages allowed
60864+ within the flood time interval you chose in a separate option. The
60865+ default should be suitable for most people, however if you find that
60866+ many of your logs are being interpreted as flooding, you may want to
60867+ raise this value.
60868+
60869+endmenu
60870+
60871+endmenu
66a7e928
MT		 60872diff -urNp linux-2.6.39/grsecurity/Makefile linux-2.6.39/grsecurity/Makefile
60873--- linux-2.6.39/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
60874+++ linux-2.6.39/grsecurity/Makefile 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 60875@@ -0,0 +1,29 @@
60876+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
60877+# during 2001-2009 it has been completely redesigned by Brad Spengler
60878+# into an RBAC system
60879+#
60880+# All code in this directory and various hooks inserted throughout the kernel
60881+# are copyright Brad Spengler - Open Source Security, Inc., and released
60882+# under the GPL v2 or higher
60883+
60884+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
60885+ grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
6892158b 60886+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
57199397
MT		 60887+
60888+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
60889+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
60890+ gracl_learn.o grsec_log.o
60891+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
60892+
60893+ifndef CONFIG_GRKERNSEC
60894+obj-y += grsec_disabled.o
60895+endif
60896+
60897+ifdef CONFIG_GRKERNSEC_HIDESYM
60898+extra-y := grsec_hidesym.o
60899+$(obj)/grsec_hidesym.o:
60900+ @-chmod -f 500 /boot
60901+ @-chmod -f 500 /lib/modules
60902+ @-chmod -f 700 .
60903+ @echo ' grsec: protected kernel image paths'
60904+endif
66a7e928
MT		 60905diff -urNp linux-2.6.39/include/acpi/acpi_drivers.h linux-2.6.39/include/acpi/acpi_drivers.h
60906--- linux-2.6.39/include/acpi/acpi_drivers.h 2011-05-19 00:06:34.000000000 -0400
60907+++ linux-2.6.39/include/acpi/acpi_drivers.h 2011-05-22 19:36:32.000000000 -0400
bc901d79 60908@@ -119,8 +119,8 @@ void pci_acpi_crs_quirks(void);
ae4e228f
MT		 60909 Dock Station
60910 -------------------------------------------------------------------------- */
60911 struct acpi_dock_ops {
60912- acpi_notify_handler handler;
60913- acpi_notify_handler uevent;
60914+ const acpi_notify_handler handler;
60915+ const acpi_notify_handler uevent;
60916 };
58c5fc13 60917
ae4e228f 60918 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
bc901d79 60919@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
ae4e228f
MT		 60920 extern int register_dock_notifier(struct notifier_block *nb);
60921 extern void unregister_dock_notifier(struct notifier_block *nb);
60922 extern int register_hotplug_dock_device(acpi_handle handle,
60923- struct acpi_dock_ops *ops,
60924+ const struct acpi_dock_ops *ops,
60925 void *context);
60926 extern void unregister_hotplug_dock_device(acpi_handle handle);
60927 #else
bc901d79 60928@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
ae4e228f
MT		 60929 {
60930 }
60931 static inline int register_hotplug_dock_device(acpi_handle handle,
60932- struct acpi_dock_ops *ops,
60933+ const struct acpi_dock_ops *ops,
60934 void *context)
60935 {
60936 return -ENODEV;
66a7e928
MT		 60937diff -urNp linux-2.6.39/include/acpi/processor.h linux-2.6.39/include/acpi/processor.h
60938--- linux-2.6.39/include/acpi/processor.h 2011-05-19 00:06:34.000000000 -0400
60939+++ linux-2.6.39/include/acpi/processor.h 2011-05-22 19:36:32.000000000 -0400
60940@@ -344,7 +344,7 @@ extern struct cpuidle_driver acpi_idle_d
60941
60942 /* in processor_thermal.c */
60943 int acpi_processor_get_limit_info(struct acpi_processor *pr);
60944-extern struct thermal_cooling_device_ops processor_cooling_ops;
60945+extern const struct thermal_cooling_device_ops processor_cooling_ops;
60946 #ifdef CONFIG_CPU_FREQ
60947 void acpi_thermal_cpufreq_init(void);
60948 void acpi_thermal_cpufreq_exit(void);
60949diff -urNp linux-2.6.39/include/asm-generic/atomic-long.h linux-2.6.39/include/asm-generic/atomic-long.h
60950--- linux-2.6.39/include/asm-generic/atomic-long.h 2011-05-19 00:06:34.000000000 -0400
60951+++ linux-2.6.39/include/asm-generic/atomic-long.h 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 60952@@ -22,6 +22,12 @@
60953
60954 typedef atomic64_t atomic_long_t;
60955
60956+#ifdef CONFIG_PAX_REFCOUNT
60957+typedef atomic64_unchecked_t atomic_long_unchecked_t;
60958+#else
60959+typedef atomic64_t atomic_long_unchecked_t;
60960+#endif
58c5fc13 60961+
ae4e228f 60962 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
58c5fc13 60963
ae4e228f
MT		 60964 static inline long atomic_long_read(atomic_long_t *l)
60965@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
60966 return (long)atomic64_read(v);
60967 }
60968
60969+#ifdef CONFIG_PAX_REFCOUNT
60970+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60971+{
60972+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
58c5fc13 60973+
ae4e228f
MT		 60974+ return (long)atomic64_read_unchecked(v);
60975+}
60976+#endif
60977+
60978 static inline void atomic_long_set(atomic_long_t *l, long i)
60979 {
60980 atomic64_t *v = (atomic64_t *)l;
60981@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
60982 atomic64_set(v, i);
60983 }
58c5fc13 60984
ae4e228f
MT		 60985+#ifdef CONFIG_PAX_REFCOUNT
60986+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60987+{
60988+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60989+
60990+ atomic64_set_unchecked(v, i);
60991+}
60992+#endif
60993+
60994 static inline void atomic_long_inc(atomic_long_t *l)
60995 {
60996 atomic64_t *v = (atomic64_t *)l;
60997@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
60998 atomic64_inc(v);
58c5fc13
MT		 60999 }
61000
ae4e228f
MT		 61001+#ifdef CONFIG_PAX_REFCOUNT
61002+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
58c5fc13 61003+{
ae4e228f
MT		 61004+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61005+
61006+ atomic64_inc_unchecked(v);
58c5fc13 61007+}
ae4e228f 61008+#endif
58c5fc13 61009+
ae4e228f 61010 static inline void atomic_long_dec(atomic_long_t *l)
58c5fc13 61011 {
ae4e228f 61012 atomic64_t *v = (atomic64_t *)l;
df50ba0c
MT		 61013@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
61014 atomic64_dec(v);
61015 }
61016
61017+#ifdef CONFIG_PAX_REFCOUNT
61018+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61019+{
61020+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61021+
61022+ atomic64_dec_unchecked(v);
61023+}
61024+#endif
61025+
61026 static inline void atomic_long_add(long i, atomic_long_t *l)
61027 {
61028 atomic64_t *v = (atomic64_t *)l;
61029@@ -59,6 +101,15 @@ static inline void atomic_long_add(long
ae4e228f 61030 atomic64_add(i, v);
58c5fc13
MT		 61031 }
61032
ae4e228f
MT		 61033+#ifdef CONFIG_PAX_REFCOUNT
61034+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
58c5fc13 61035+{
ae4e228f
MT		 61036+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61037+
61038+ atomic64_add_unchecked(i, v);
58c5fc13 61039+}
ae4e228f 61040+#endif
58c5fc13 61041+
ae4e228f 61042 static inline void atomic_long_sub(long i, atomic_long_t *l)
58c5fc13 61043 {
ae4e228f 61044 atomic64_t *v = (atomic64_t *)l;
6892158b
MT		 61045@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
61046 atomic64_sub(i, v);
61047 }
61048
61049+#ifdef CONFIG_PAX_REFCOUNT
61050+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61051+{
61052+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61053+
61054+ atomic64_sub_unchecked(i, v);
61055+}
61056+#endif
61057+
61058 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61059 {
61060 atomic64_t *v = (atomic64_t *)l;
61061@@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
ae4e228f 61062 return (long)atomic64_inc_return(v);
58c5fc13
MT		 61063 }
61064
ae4e228f
MT		 61065+#ifdef CONFIG_PAX_REFCOUNT
61066+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
58c5fc13 61067+{
ae4e228f
MT		 61068+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61069+
61070+ return (long)atomic64_inc_return_unchecked(v);
58c5fc13 61071+}
ae4e228f 61072+#endif
58c5fc13 61073+
ae4e228f
MT		 61074 static inline long atomic_long_dec_return(atomic_long_t *l)
61075 {
61076 atomic64_t *v = (atomic64_t *)l;
6892158b 61077@@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
ae4e228f
MT		 61078
61079 typedef atomic_t atomic_long_t;
61080
61081+#ifdef CONFIG_PAX_REFCOUNT
61082+typedef atomic_unchecked_t atomic_long_unchecked_t;
61083+#else
61084+typedef atomic_t atomic_long_unchecked_t;
61085+#endif
61086+
61087 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
61088 static inline long atomic_long_read(atomic_long_t *l)
61089 {
6892158b 61090@@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
ae4e228f
MT		 61091 return (long)atomic_read(v);
61092 }
61093
61094+#ifdef CONFIG_PAX_REFCOUNT
61095+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61096+{
61097+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61098+
61099+ return (long)atomic_read_unchecked(v);
61100+}
61101+#endif
61102+
61103 static inline void atomic_long_set(atomic_long_t *l, long i)
61104 {
61105 atomic_t *v = (atomic_t *)l;
6892158b 61106@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
ae4e228f
MT		 61107 atomic_set(v, i);
61108 }
61109
61110+#ifdef CONFIG_PAX_REFCOUNT
61111+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61112+{
61113+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61114+
61115+ atomic_set_unchecked(v, i);
61116+}
61117+#endif
61118+
61119 static inline void atomic_long_inc(atomic_long_t *l)
61120 {
61121 atomic_t *v = (atomic_t *)l;
6892158b 61122@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
ae4e228f
MT		 61123 atomic_inc(v);
61124 }
61125
61126+#ifdef CONFIG_PAX_REFCOUNT
61127+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61128+{
61129+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61130+
61131+ atomic_inc_unchecked(v);
61132+}
61133+#endif
61134+
61135 static inline void atomic_long_dec(atomic_long_t *l)
61136 {
61137 atomic_t *v = (atomic_t *)l;
6892158b 61138@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
df50ba0c
MT		 61139 atomic_dec(v);
61140 }
61141
61142+#ifdef CONFIG_PAX_REFCOUNT
61143+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61144+{
61145+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61146+
61147+ atomic_dec_unchecked(v);
61148+}
61149+#endif
61150+
61151 static inline void atomic_long_add(long i, atomic_long_t *l)
61152 {
61153 atomic_t *v = (atomic_t *)l;
6892158b 61154@@ -176,6 +287,15 @@ static inline void atomic_long_add(long
ae4e228f
MT		 61155 atomic_add(i, v);
61156 }
61157
61158+#ifdef CONFIG_PAX_REFCOUNT
61159+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61160+{
61161+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61162+
61163+ atomic_add_unchecked(i, v);
61164+}
61165+#endif
61166+
61167 static inline void atomic_long_sub(long i, atomic_long_t *l)
58c5fc13 61168 {
ae4e228f 61169 atomic_t *v = (atomic_t *)l;
6892158b
MT		 61170@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
61171 atomic_sub(i, v);
61172 }
61173
61174+#ifdef CONFIG_PAX_REFCOUNT
61175+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61176+{
61177+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61178+
61179+ atomic_sub_unchecked(i, v);
61180+}
61181+#endif
61182+
61183 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61184 {
61185 atomic_t *v = (atomic_t *)l;
61186@@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
ae4e228f
MT		 61187 return (long)atomic_inc_return(v);
61188 }
61189
61190+#ifdef CONFIG_PAX_REFCOUNT
61191+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61192+{
61193+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61194+
61195+ return (long)atomic_inc_return_unchecked(v);
61196+}
61197+#endif
61198+
61199 static inline long atomic_long_dec_return(atomic_long_t *l)
61200 {
61201 atomic_t *v = (atomic_t *)l;
8308f9c9 61202@@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
ae4e228f
MT		 61203
61204 #endif /* BITS_PER_LONG == 64 */
61205
61206+#ifdef CONFIG_PAX_REFCOUNT
61207+static inline void pax_refcount_needs_these_functions(void)
61208+{
61209+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
61210+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
61211+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
61212+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
61213+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
8308f9c9 61214+ atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
57199397 61215+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
6892158b 61216+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
8308f9c9
MT		 61217+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
61218+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
61219+ atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
ae4e228f
MT		 61220+
61221+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
61222+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
61223+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
6892158b 61224+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
ae4e228f
MT		 61225+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
61226+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
df50ba0c 61227+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
ae4e228f
MT		 61228+}
61229+#else
61230+#define atomic_read_unchecked(v) atomic_read(v)
61231+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
61232+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
61233+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
61234+#define atomic_inc_unchecked(v) atomic_inc(v)
66a7e928 61235+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
57199397 61236+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
6892158b 61237+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
8308f9c9
MT		 61238+#define atomic_dec_unchecked(v) atomic_dec(v)
61239+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
61240+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
ae4e228f
MT		 61241+
61242+#define atomic_long_read_unchecked(v) atomic_long_read(v)
61243+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
61244+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
6892158b 61245+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
ae4e228f
MT		 61246+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
61247+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
df50ba0c 61248+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
ae4e228f
MT		 61249+#endif
61250+
61251 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
66a7e928
MT		 61252diff -urNp linux-2.6.39/include/asm-generic/cache.h linux-2.6.39/include/asm-generic/cache.h
61253--- linux-2.6.39/include/asm-generic/cache.h 2011-05-19 00:06:34.000000000 -0400
61254+++ linux-2.6.39/include/asm-generic/cache.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 61255@@ -6,7 +6,7 @@
61256 * cache lines need to provide their own cache.h.
61257 */
61258
61259-#define L1_CACHE_SHIFT 5
61260-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
61261+#define L1_CACHE_SHIFT 5U
61262+#define L1_CACHE_BYTES (1U << L1_CACHE_SHIFT)
61263
61264 #endif /* __ASM_GENERIC_CACHE_H */
66a7e928
MT		 61265diff -urNp linux-2.6.39/include/asm-generic/dma-mapping-common.h linux-2.6.39/include/asm-generic/dma-mapping-common.h
61266--- linux-2.6.39/include/asm-generic/dma-mapping-common.h 2011-05-19 00:06:34.000000000 -0400
61267+++ linux-2.6.39/include/asm-generic/dma-mapping-common.h 2011-05-22 19:36:32.000000000 -0400
ae4e228f
MT		 61268@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
61269 enum dma_data_direction dir,
61270 struct dma_attrs *attrs)
61271 {
61272- struct dma_map_ops *ops = get_dma_ops(dev);
61273+ const struct dma_map_ops *ops = get_dma_ops(dev);
61274 dma_addr_t addr;
61275
61276 kmemcheck_mark_initialized(ptr, size);
61277@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
61278 enum dma_data_direction dir,
61279 struct dma_attrs *attrs)
61280 {
61281- struct dma_map_ops *ops = get_dma_ops(dev);
61282+ const struct dma_map_ops *ops = get_dma_ops(dev);
61283
61284 BUG_ON(!valid_dma_direction(dir));
61285 if (ops->unmap_page)
61286@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
61287 int nents, enum dma_data_direction dir,
61288 struct dma_attrs *attrs)
61289 {
61290- struct dma_map_ops *ops = get_dma_ops(dev);
61291+ const struct dma_map_ops *ops = get_dma_ops(dev);
61292 int i, ents;
61293 struct scatterlist *s;
61294
61295@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
61296 int nents, enum dma_data_direction dir,
61297 struct dma_attrs *attrs)
61298 {
61299- struct dma_map_ops *ops = get_dma_ops(dev);
61300+ const struct dma_map_ops *ops = get_dma_ops(dev);
61301
61302 BUG_ON(!valid_dma_direction(dir));
61303 debug_dma_unmap_sg(dev, sg, nents, dir);
61304@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
61305 size_t offset, size_t size,
61306 enum dma_data_direction dir)
61307 {
61308- struct dma_map_ops *ops = get_dma_ops(dev);
61309+ const struct dma_map_ops *ops = get_dma_ops(dev);
61310 dma_addr_t addr;
61311
61312 kmemcheck_mark_initialized(page_address(page) + offset, size);
61313@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
61314 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
61315 size_t size, enum dma_data_direction dir)
61316 {
61317- struct dma_map_ops *ops = get_dma_ops(dev);
61318+ const struct dma_map_ops *ops = get_dma_ops(dev);
61319
61320 BUG_ON(!valid_dma_direction(dir));
61321 if (ops->unmap_page)
61322@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
61323 size_t size,
61324 enum dma_data_direction dir)
61325 {
61326- struct dma_map_ops *ops = get_dma_ops(dev);
61327+ const struct dma_map_ops *ops = get_dma_ops(dev);
61328
61329 BUG_ON(!valid_dma_direction(dir));
61330 if (ops->sync_single_for_cpu)
61331@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
61332 dma_addr_t addr, size_t size,
61333 enum dma_data_direction dir)
61334 {
61335- struct dma_map_ops *ops = get_dma_ops(dev);
61336+ const struct dma_map_ops *ops = get_dma_ops(dev);
61337
61338 BUG_ON(!valid_dma_direction(dir));
61339 if (ops->sync_single_for_device)
57199397 61340@@ -139,7 +139,7 @@ static inline void
ae4e228f
MT		 61341 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
61342 int nelems, enum dma_data_direction dir)
61343 {
61344- struct dma_map_ops *ops = get_dma_ops(dev);
61345+ const struct dma_map_ops *ops = get_dma_ops(dev);
61346
61347 BUG_ON(!valid_dma_direction(dir));
61348 if (ops->sync_sg_for_cpu)
57199397 61349@@ -151,7 +151,7 @@ static inline void
ae4e228f
MT		 61350 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
61351 int nelems, enum dma_data_direction dir)
61352 {
61353- struct dma_map_ops *ops = get_dma_ops(dev);
61354+ const struct dma_map_ops *ops = get_dma_ops(dev);
61355
61356 BUG_ON(!valid_dma_direction(dir));
61357 if (ops->sync_sg_for_device)
66a7e928
MT		 61358diff -urNp linux-2.6.39/include/asm-generic/int-l64.h linux-2.6.39/include/asm-generic/int-l64.h
61359--- linux-2.6.39/include/asm-generic/int-l64.h 2011-05-19 00:06:34.000000000 -0400
61360+++ linux-2.6.39/include/asm-generic/int-l64.h 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 61361@@ -46,6 +46,8 @@ typedef unsigned int u32;
61362 typedef signed long s64;
61363 typedef unsigned long u64;
61364
61365+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
61366+
61367 #define S8_C(x) x
61368 #define U8_C(x) x ## U
61369 #define S16_C(x) x
66a7e928
MT		 61370diff -urNp linux-2.6.39/include/asm-generic/int-ll64.h linux-2.6.39/include/asm-generic/int-ll64.h
61371--- linux-2.6.39/include/asm-generic/int-ll64.h 2011-05-19 00:06:34.000000000 -0400
61372+++ linux-2.6.39/include/asm-generic/int-ll64.h 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 61373@@ -51,6 +51,8 @@ typedef unsigned int u32;
61374 typedef signed long long s64;
61375 typedef unsigned long long u64;
61376
61377+typedef unsigned long long intoverflow_t;
61378+
61379 #define S8_C(x) x
61380 #define U8_C(x) x ## U
61381 #define S16_C(x) x
66a7e928
MT		 61382diff -urNp linux-2.6.39/include/asm-generic/kmap_types.h linux-2.6.39/include/asm-generic/kmap_types.h
61383--- linux-2.6.39/include/asm-generic/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
61384+++ linux-2.6.39/include/asm-generic/kmap_types.h 2011-05-22 19:36:32.000000000 -0400
57199397 61385@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
ae4e228f
MT		 61386 KMAP_D(17) KM_NMI,
61387 KMAP_D(18) KM_NMI_PTE,
57199397
MT		 61388 KMAP_D(19) KM_KDB,
61389+KMAP_D(20) KM_CLEARPAGE,
61390 /*
61391 * Remember to update debug_kmap_atomic() when adding new kmap types!
61392 */
61393-KMAP_D(20) KM_TYPE_NR
61394+KMAP_D(21) KM_TYPE_NR
58c5fc13
MT		 61395 };
61396
ae4e228f 61397 #undef KMAP_D
66a7e928
MT		 61398diff -urNp linux-2.6.39/include/asm-generic/pgtable.h linux-2.6.39/include/asm-generic/pgtable.h
61399--- linux-2.6.39/include/asm-generic/pgtable.h 2011-05-19 00:06:34.000000000 -0400
61400+++ linux-2.6.39/include/asm-generic/pgtable.h 2011-05-22 19:36:32.000000000 -0400
16454cff
MT		 61401@@ -447,6 +447,14 @@ static inline int pmd_write(pmd_t pmd)
61402 #endif /* __HAVE_ARCH_PMD_WRITE */
ae4e228f
MT		 61403 #endif
61404
61405+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
61406+static inline unsigned long pax_open_kernel(void) { return 0; }
61407+#endif
61408+
61409+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
61410+static inline unsigned long pax_close_kernel(void) { return 0; }
61411+#endif
61412+
61413 #endif /* !__ASSEMBLY__ */
61414
61415 #endif /* _ASM_GENERIC_PGTABLE_H */
66a7e928
MT		 61416diff -urNp linux-2.6.39/include/asm-generic/pgtable-nopmd.h linux-2.6.39/include/asm-generic/pgtable-nopmd.h
61417--- linux-2.6.39/include/asm-generic/pgtable-nopmd.h 2011-05-19 00:06:34.000000000 -0400
61418+++ linux-2.6.39/include/asm-generic/pgtable-nopmd.h 2011-05-22 19:36:32.000000000 -0400
57199397
MT		 61419@@ -1,14 +1,19 @@
61420 #ifndef _PGTABLE_NOPMD_H
61421 #define _PGTABLE_NOPMD_H
61422
61423-#ifndef __ASSEMBLY__
61424-
61425 #include <asm-generic/pgtable-nopud.h>
61426
61427-struct mm_struct;
61428-
61429 #define __PAGETABLE_PMD_FOLDED
61430
61431+#define PMD_SHIFT PUD_SHIFT
61432+#define PTRS_PER_PMD 1
61433+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
61434+#define PMD_MASK (~(PMD_SIZE-1))
61435+
61436+#ifndef __ASSEMBLY__
61437+
61438+struct mm_struct;
61439+
61440 /*
61441 * Having the pmd type consist of a pud gets the size right, and allows
61442 * us to conceptually access the pud entry that this pmd is folded into
61443@@ -16,11 +21,6 @@ struct mm_struct;
61444 */
61445 typedef struct { pud_t pud; } pmd_t;
61446
61447-#define PMD_SHIFT PUD_SHIFT
61448-#define PTRS_PER_PMD 1
61449-#define PMD_SIZE (1UL << PMD_SHIFT)
61450-#define PMD_MASK (~(PMD_SIZE-1))
61451-
61452 /*
61453 * The "pud_xxx()" functions here are trivial for a folded two-level
61454 * setup: the pmd is never bad, and a pmd always exists (as it's folded
66a7e928
MT		 61455diff -urNp linux-2.6.39/include/asm-generic/pgtable-nopud.h linux-2.6.39/include/asm-generic/pgtable-nopud.h
61456--- linux-2.6.39/include/asm-generic/pgtable-nopud.h 2011-05-19 00:06:34.000000000 -0400
61457+++ linux-2.6.39/include/asm-generic/pgtable-nopud.h 2011-05-22 19:36:32.000000000 -0400
57199397
MT		 61458@@ -1,10 +1,15 @@
61459 #ifndef _PGTABLE_NOPUD_H
61460 #define _PGTABLE_NOPUD_H
61461
61462-#ifndef __ASSEMBLY__
61463-
61464 #define __PAGETABLE_PUD_FOLDED
61465
61466+#define PUD_SHIFT PGDIR_SHIFT
61467+#define PTRS_PER_PUD 1
61468+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
61469+#define PUD_MASK (~(PUD_SIZE-1))
61470+
61471+#ifndef __ASSEMBLY__
61472+
61473 /*
61474 * Having the pud type consist of a pgd gets the size right, and allows
61475 * us to conceptually access the pgd entry that this pud is folded into
61476@@ -12,11 +17,6 @@
61477 */
61478 typedef struct { pgd_t pgd; } pud_t;
61479
61480-#define PUD_SHIFT PGDIR_SHIFT
61481-#define PTRS_PER_PUD 1
61482-#define PUD_SIZE (1UL << PUD_SHIFT)
61483-#define PUD_MASK (~(PUD_SIZE-1))
61484-
61485 /*
61486 * The "pgd_xxx()" functions here are trivial for a folded two-level
61487 * setup: the pud is never bad, and a pud always exists (as it's folded
66a7e928
MT		 61488diff -urNp linux-2.6.39/include/asm-generic/vmlinux.lds.h linux-2.6.39/include/asm-generic/vmlinux.lds.h
61489--- linux-2.6.39/include/asm-generic/vmlinux.lds.h 2011-05-19 00:06:34.000000000 -0400
61490+++ linux-2.6.39/include/asm-generic/vmlinux.lds.h 2011-05-22 19:36:32.000000000 -0400
16454cff 61491@@ -213,6 +213,7 @@
58c5fc13
MT		 61492 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
61493 VMLINUX_SYMBOL(__start_rodata) = .; \
61494 *(.rodata) *(.rodata.*) \
57199397 61495+ *(.data..read_only) \
58c5fc13 61496 *(__vermagic) /* Kernel version magic */ \
16454cff
MT		 61497 . = ALIGN(8); \
61498 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
66a7e928 61499@@ -707,14 +708,15 @@
58c5fc13
MT		 61500 * section in the linker script will go there too. @phdr should have
61501 * a leading colon.
61502 *
61503- * Note that this macros defines __per_cpu_load as an absolute symbol.
61504+ * Note that this macros defines per_cpu_load as an absolute symbol.
61505 * If there is no need to put the percpu section at a predetermined
61506 * address, use PERCPU().
61507 */
66a7e928 61508 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
58c5fc13 61509- VMLINUX_SYMBOL(__per_cpu_load) = .; \
57199397 61510- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
58c5fc13 61511+ per_cpu_load = .; \
57199397 61512+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
58c5fc13
MT		 61513 - LOAD_OFFSET) { \
61514+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
61515 VMLINUX_SYMBOL(__per_cpu_start) = .; \
57199397 61516 *(.data..percpu..first) \
bc901d79 61517 . = ALIGN(PAGE_SIZE); \
66a7e928 61518@@ -726,7 +728,7 @@
57199397 61519 *(.data..percpu..shared_aligned) \
58c5fc13
MT		 61520 VMLINUX_SYMBOL(__per_cpu_end) = .; \
61521 } phdr \
57199397
MT		 61522- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
61523+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
58c5fc13
MT		 61524
61525 /**
61526 * PERCPU - define output section for percpu area, simple version
66a7e928
MT		 61527diff -urNp linux-2.6.39/include/drm/drmP.h linux-2.6.39/include/drm/drmP.h
61528--- linux-2.6.39/include/drm/drmP.h 2011-05-19 00:06:34.000000000 -0400
61529+++ linux-2.6.39/include/drm/drmP.h 2011-05-22 19:41:42.000000000 -0400
c52201e0
MT		 61530@@ -73,6 +73,7 @@
61531 #include <linux/workqueue.h>
61532 #include <linux/poll.h>
61533 #include <asm/pgalloc.h>
61534+#include <asm/local.h>
61535 #include "drm.h"
61536
61537 #include <linux/idr.h>
66a7e928
MT		 61538@@ -908,7 +909,7 @@ struct drm_driver {
61539 uint32_t handle);
57199397
MT		 61540
61541 /* Driver private ops for this object */
61542- struct vm_operations_struct *gem_vm_ops;
61543+ const struct vm_operations_struct *gem_vm_ops;
61544
61545 int major;
61546 int minor;
66a7e928 61547@@ -1023,7 +1024,7 @@ struct drm_device {
57199397
MT		 61548
61549 /** \name Usage Counters */
61550 /*@{ */
61551- int open_count; /**< Outstanding files open */
c52201e0 61552+ local_t open_count; /**< Outstanding files open */
57199397
MT		 61553 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
61554 atomic_t vma_count; /**< Outstanding vma areas open */
61555 int buf_use; /**< Buffers in use -- cannot alloc */
66a7e928 61556@@ -1034,7 +1035,7 @@ struct drm_device {
57199397
MT		 61557 /*@{ */
61558 unsigned long counters;
61559 enum drm_stat_type types[15];
61560- atomic_t counts[15];
61561+ atomic_unchecked_t counts[15];
61562 /*@} */
61563
61564 struct list_head filelist;
66a7e928
MT		 61565diff -urNp linux-2.6.39/include/linux/a.out.h linux-2.6.39/include/linux/a.out.h
61566--- linux-2.6.39/include/linux/a.out.h 2011-05-19 00:06:34.000000000 -0400
61567+++ linux-2.6.39/include/linux/a.out.h 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 61568@@ -39,6 +39,14 @@ enum machine_type {
61569 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
61570 };
61571
61572+/* Constants for the N_FLAGS field */
61573+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61574+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
61575+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
61576+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
61577+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61578+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61579+
61580 #if !defined (N_MAGIC)
61581 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
61582 #endif
66a7e928
MT		 61583diff -urNp linux-2.6.39/include/linux/atmdev.h linux-2.6.39/include/linux/atmdev.h
61584--- linux-2.6.39/include/linux/atmdev.h 2011-05-19 00:06:34.000000000 -0400
61585+++ linux-2.6.39/include/linux/atmdev.h 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 61586@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
61587 #endif
61588
61589 struct k_atm_aal_stats {
61590-#define __HANDLE_ITEM(i) atomic_t i
61591+#define __HANDLE_ITEM(i) atomic_unchecked_t i
61592 __AAL_STAT_ITEMS
61593 #undef __HANDLE_ITEM
61594 };
66a7e928
MT		 61595diff -urNp linux-2.6.39/include/linux/binfmts.h linux-2.6.39/include/linux/binfmts.h
61596--- linux-2.6.39/include/linux/binfmts.h 2011-05-19 00:06:34.000000000 -0400
61597+++ linux-2.6.39/include/linux/binfmts.h 2011-05-22 19:36:32.000000000 -0400
bc901d79 61598@@ -92,6 +92,7 @@ struct linux_binfmt {
58c5fc13
MT		 61599 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
61600 int (*load_shlib)(struct file *);
ae4e228f 61601 int (*core_dump)(struct coredump_params *cprm);
58c5fc13
MT		 61602+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
61603 unsigned long min_coredump; /* minimal dump size */
58c5fc13 61604 };
16454cff 61605
66a7e928
MT		 61606diff -urNp linux-2.6.39/include/linux/blkdev.h linux-2.6.39/include/linux/blkdev.h
61607--- linux-2.6.39/include/linux/blkdev.h 2011-05-19 00:06:34.000000000 -0400
61608+++ linux-2.6.39/include/linux/blkdev.h 2011-05-22 19:36:32.000000000 -0400
61609@@ -1281,22 +1281,22 @@ queue_max_integrity_segments(struct requ
ae4e228f
MT		 61610 #endif /* CONFIG_BLK_DEV_INTEGRITY */
61611
61612 struct block_device_operations {
61613- int (*open) (struct block_device *, fmode_t);
61614- int (*release) (struct gendisk *, fmode_t);
ae4e228f
MT		 61615- int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61616- int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61617- int (*direct_access) (struct block_device *, sector_t,
61618+ int (* const open) (struct block_device *, fmode_t);
61619+ int (* const release) (struct gendisk *, fmode_t);
ae4e228f
MT		 61620+ int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61621+ int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61622+ int (* const direct_access) (struct block_device *, sector_t,
61623 void **, unsigned long *);
16454cff
MT		 61624- unsigned int (*check_events) (struct gendisk *disk,
61625+ unsigned int (* const check_events) (struct gendisk *disk,
61626 unsigned int clearing);
61627 /* ->media_changed() is DEPRECATED, use ->check_events() instead */
ae4e228f 61628- int (*media_changed) (struct gendisk *);
57199397 61629- void (*unlock_native_capacity) (struct gendisk *);
ae4e228f
MT		 61630- int (*revalidate_disk) (struct gendisk *);
61631- int (*getgeo)(struct block_device *, struct hd_geometry *);
57199397
MT		 61632+ int (* const media_changed) (struct gendisk *);
61633+ void (* const unlock_native_capacity) (struct gendisk *);
ae4e228f 61634+ int (* const revalidate_disk) (struct gendisk *);
6892158b 61635+ int (* const getgeo)(struct block_device *, struct hd_geometry *);
57199397
MT		 61636 /* this callback is with swap_lock and sometimes page table lock held */
61637- void (*swap_slot_free_notify) (struct block_device *, unsigned long);
61638- struct module *owner;
61639+ void (* const swap_slot_free_notify) (struct block_device *, unsigned long);
ae4e228f
MT		 61640+ struct module * const owner;
61641 };
61642
61643 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
66a7e928
MT		 61644diff -urNp linux-2.6.39/include/linux/blktrace_api.h linux-2.6.39/include/linux/blktrace_api.h
61645--- linux-2.6.39/include/linux/blktrace_api.h 2011-05-19 00:06:34.000000000 -0400
61646+++ linux-2.6.39/include/linux/blktrace_api.h 2011-05-22 19:36:32.000000000 -0400
8308f9c9
MT		 61647@@ -161,7 +161,7 @@ struct blk_trace {
61648 struct dentry *dir;
61649 struct dentry *dropped_file;
61650 struct dentry *msg_file;
61651- atomic_t dropped;
61652+ atomic_unchecked_t dropped;
61653 };
61654
61655 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
66a7e928
MT		 61656diff -urNp linux-2.6.39/include/linux/byteorder/little_endian.h linux-2.6.39/include/linux/byteorder/little_endian.h
61657--- linux-2.6.39/include/linux/byteorder/little_endian.h 2011-05-19 00:06:34.000000000 -0400
61658+++ linux-2.6.39/include/linux/byteorder/little_endian.h 2011-05-22 19:36:32.000000000 -0400
bc901d79
MT		 61659@@ -42,51 +42,51 @@
61660
61661 static inline __le64 __cpu_to_le64p(const __u64 *p)
61662 {
61663- return (__force __le64)*p;
61664+ return (__force const __le64)*p;
61665 }
61666 static inline __u64 __le64_to_cpup(const __le64 *p)
61667 {
61668- return (__force __u64)*p;
61669+ return (__force const __u64)*p;
61670 }
61671 static inline __le32 __cpu_to_le32p(const __u32 *p)
61672 {
61673- return (__force __le32)*p;
61674+ return (__force const __le32)*p;
61675 }
61676 static inline __u32 __le32_to_cpup(const __le32 *p)
61677 {
61678- return (__force __u32)*p;
61679+ return (__force const __u32)*p;
61680 }
61681 static inline __le16 __cpu_to_le16p(const __u16 *p)
61682 {
61683- return (__force __le16)*p;
61684+ return (__force const __le16)*p;
61685 }
61686 static inline __u16 __le16_to_cpup(const __le16 *p)
61687 {
61688- return (__force __u16)*p;
61689+ return (__force const __u16)*p;
61690 }
61691 static inline __be64 __cpu_to_be64p(const __u64 *p)
61692 {
61693- return (__force __be64)__swab64p(p);
61694+ return (__force const __be64)__swab64p(p);
61695 }
61696 static inline __u64 __be64_to_cpup(const __be64 *p)
61697 {
61698- return __swab64p((__u64 *)p);
61699+ return __swab64p((const __u64 *)p);
61700 }
61701 static inline __be32 __cpu_to_be32p(const __u32 *p)
61702 {
61703- return (__force __be32)__swab32p(p);
61704+ return (__force const __be32)__swab32p(p);
61705 }
61706 static inline __u32 __be32_to_cpup(const __be32 *p)
61707 {
61708- return __swab32p((__u32 *)p);
61709+ return __swab32p((const __u32 *)p);
61710 }
61711 static inline __be16 __cpu_to_be16p(const __u16 *p)
61712 {
61713- return (__force __be16)__swab16p(p);
61714+ return (__force const __be16)__swab16p(p);
61715 }
61716 static inline __u16 __be16_to_cpup(const __be16 *p)
61717 {
61718- return __swab16p((__u16 *)p);
61719+ return __swab16p((const __u16 *)p);
61720 }
61721 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
61722 #define __le64_to_cpus(x) do { (void)(x); } while (0)
66a7e928
MT		 61723diff -urNp linux-2.6.39/include/linux/cache.h linux-2.6.39/include/linux/cache.h
61724--- linux-2.6.39/include/linux/cache.h 2011-05-19 00:06:34.000000000 -0400
61725+++ linux-2.6.39/include/linux/cache.h 2011-05-22 19:36:32.000000000 -0400
58c5fc13
MT		 61726@@ -16,6 +16,10 @@
61727 #define __read_mostly
61728 #endif
61729
61730+#ifndef __read_only
61731+#define __read_only __read_mostly
61732+#endif
61733+
61734 #ifndef ____cacheline_aligned
61735 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
61736 #endif
66a7e928
MT		 61737diff -urNp linux-2.6.39/include/linux/capability.h linux-2.6.39/include/linux/capability.h
61738--- linux-2.6.39/include/linux/capability.h 2011-05-19 00:06:34.000000000 -0400
61739+++ linux-2.6.39/include/linux/capability.h 2011-05-22 21:02:47.000000000 -0400
61740@@ -547,6 +547,9 @@ extern bool capable(int cap);
61741 extern bool ns_capable(struct user_namespace *ns, int cap);
61742 extern bool task_ns_capable(struct task_struct *t, int cap);
61743 extern bool nsown_capable(int cap);
61744+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
61745+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
61746+extern bool capable_nolog(int cap);
58c5fc13
MT		 61747
61748 /* audit system wants to get cap info from files as well */
66a7e928
MT		 61749 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
61750diff -urNp linux-2.6.39/include/linux/compiler-gcc4.h linux-2.6.39/include/linux/compiler-gcc4.h
61751--- linux-2.6.39/include/linux/compiler-gcc4.h 2011-05-19 00:06:34.000000000 -0400
61752+++ linux-2.6.39/include/linux/compiler-gcc4.h 2011-05-22 19:36:32.000000000 -0400
61753@@ -46,6 +46,11 @@
61754 #define __noclone __attribute__((__noclone__))
57199397 61755
ae4e228f 61756 #endif
66a7e928 61757+
58c5fc13
MT		 61758+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
61759+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
61760+#define __bos0(ptr) __bos((ptr), 0)
61761+#define __bos1(ptr) __bos((ptr), 1)
61762 #endif
ae4e228f
MT		 61763
61764 #if __GNUC_MINOR__ > 0
66a7e928
MT		 61765diff -urNp linux-2.6.39/include/linux/compiler.h linux-2.6.39/include/linux/compiler.h
61766--- linux-2.6.39/include/linux/compiler.h 2011-05-19 00:06:34.000000000 -0400
61767+++ linux-2.6.39/include/linux/compiler.h 2011-05-22 19:36:32.000000000 -0400
bc901d79 61768@@ -273,6 +273,22 @@ void ftrace_likely_update(struct ftrace_
58c5fc13
MT		 61769 #define __cold
61770 #endif
61771
61772+#ifndef __alloc_size
61773+#define __alloc_size
61774+#endif
61775+
61776+#ifndef __bos
61777+#define __bos
61778+#endif
61779+
61780+#ifndef __bos0
61781+#define __bos0
61782+#endif
61783+
61784+#ifndef __bos1
61785+#define __bos1
61786+#endif
61787+
61788 /* Simple shorthand for a section definition */
61789 #ifndef __section
61790 # define __section(S) __attribute__ ((__section__(#S)))
bc901d79
MT		 61791@@ -306,6 +322,7 @@ void ftrace_likely_update(struct ftrace_
61792 * use is to mediate communication between process-level code and irq/NMI
61793 * handlers, all running on the same CPU.
61794 */
61795-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61796+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61797+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61798
61799 #endif /* __LINUX_COMPILER_H */
66a7e928
MT		 61800diff -urNp linux-2.6.39/include/linux/concap.h linux-2.6.39/include/linux/concap.h
61801--- linux-2.6.39/include/linux/concap.h 2011-05-19 00:06:34.000000000 -0400
61802+++ linux-2.6.39/include/linux/concap.h 2011-05-22 19:36:32.000000000 -0400
61803@@ -30,7 +30,7 @@ struct concap_device_ops;
61804 struct concap_proto{
61805 struct net_device *net_dev; /* net device using our service */
61806 struct concap_device_ops *dops; /* callbacks provided by device */
61807- struct concap_proto_ops *pops; /* callbacks provided by us */
61808+ const struct concap_proto_ops *pops; /* callbacks provided by us */
61809 spinlock_t lock;
61810 int flags;
61811 void *proto_data; /* protocol specific private data, to
61812diff -urNp linux-2.6.39/include/linux/configfs.h linux-2.6.39/include/linux/configfs.h
61813--- linux-2.6.39/include/linux/configfs.h 2011-05-19 00:06:34.000000000 -0400
61814+++ linux-2.6.39/include/linux/configfs.h 2011-05-22 19:36:32.000000000 -0400
61815@@ -82,7 +82,7 @@ extern void config_item_put(struct confi
61816 struct config_item_type {
61817 struct module *ct_owner;
61818 struct configfs_item_operations *ct_item_ops;
61819- struct configfs_group_operations *ct_group_ops;
61820+ const struct configfs_group_operations *ct_group_ops;
61821 struct configfs_attribute **ct_attrs;
61822 };
61823
61824diff -urNp linux-2.6.39/include/linux/cpuset.h linux-2.6.39/include/linux/cpuset.h
61825--- linux-2.6.39/include/linux/cpuset.h 2011-05-19 00:06:34.000000000 -0400
61826+++ linux-2.6.39/include/linux/cpuset.h 2011-05-22 19:36:32.000000000 -0400
bc901d79
MT		 61827@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
61828 * nodemask.
61829 */
61830 smp_mb();
61831- --ACCESS_ONCE(current->mems_allowed_change_disable);
61832+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
61833 }
61834
61835 static inline void set_mems_allowed(nodemask_t nodemask)
66a7e928
MT		 61836diff -urNp linux-2.6.39/include/linux/dca.h linux-2.6.39/include/linux/dca.h
61837--- linux-2.6.39/include/linux/dca.h 2011-05-19 00:06:34.000000000 -0400
61838+++ linux-2.6.39/include/linux/dca.h 2011-05-22 19:36:32.000000000 -0400
61839@@ -34,7 +34,7 @@ void dca_unregister_notify(struct notifi
61840
61841 struct dca_provider {
61842 struct list_head node;
61843- struct dca_ops *ops;
61844+ const struct dca_ops *ops;
61845 struct device *cd;
61846 int id;
61847 };
61848@@ -53,7 +53,7 @@ struct dca_ops {
61849 int (*dev_managed) (struct dca_provider *, struct device *);
61850 };
61851
61852-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size);
61853+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size);
61854 void free_dca_provider(struct dca_provider *dca);
61855 int register_dca_provider(struct dca_provider *dca, struct device *dev);
61856 void unregister_dca_provider(struct dca_provider *dca, struct device *dev);
61857diff -urNp linux-2.6.39/include/linux/decompress/mm.h linux-2.6.39/include/linux/decompress/mm.h
61858--- linux-2.6.39/include/linux/decompress/mm.h 2011-05-19 00:06:34.000000000 -0400
61859+++ linux-2.6.39/include/linux/decompress/mm.h 2011-05-22 19:36:33.000000000 -0400
16454cff 61860@@ -77,7 +77,7 @@ static void free(void *where)
58c5fc13
MT		 61861 * warnings when not needed (indeed large_malloc / large_free are not
61862 * needed by inflate */
61863
61864-#define malloc(a) kmalloc(a, GFP_KERNEL)
61865+#define malloc(a) kmalloc((a), GFP_KERNEL)
61866 #define free(a) kfree(a)
61867
61868 #define large_malloc(a) vmalloc(a)
66a7e928
MT		 61869diff -urNp linux-2.6.39/include/linux/dma-mapping.h linux-2.6.39/include/linux/dma-mapping.h
61870--- linux-2.6.39/include/linux/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
61871+++ linux-2.6.39/include/linux/dma-mapping.h 2011-05-22 19:36:33.000000000 -0400
57199397 61872@@ -16,40 +16,40 @@ enum dma_data_direction {
ae4e228f
MT		 61873 };
61874
61875 struct dma_map_ops {
61876- void* (*alloc_coherent)(struct device *dev, size_t size,
61877+ void* (* const alloc_coherent)(struct device *dev, size_t size,
61878 dma_addr_t *dma_handle, gfp_t gfp);
61879- void (*free_coherent)(struct device *dev, size_t size,
61880+ void (* const free_coherent)(struct device *dev, size_t size,
61881 void *vaddr, dma_addr_t dma_handle);
61882- dma_addr_t (*map_page)(struct device *dev, struct page *page,
61883+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
61884 unsigned long offset, size_t size,
61885 enum dma_data_direction dir,
61886 struct dma_attrs *attrs);
61887- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
61888+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
61889 size_t size, enum dma_data_direction dir,
61890 struct dma_attrs *attrs);
61891- int (*map_sg)(struct device *dev, struct scatterlist *sg,
61892+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
61893 int nents, enum dma_data_direction dir,
61894 struct dma_attrs *attrs);
61895- void (*unmap_sg)(struct device *dev,
61896+ void (* const unmap_sg)(struct device *dev,
61897 struct scatterlist *sg, int nents,
61898 enum dma_data_direction dir,
61899 struct dma_attrs *attrs);
61900- void (*sync_single_for_cpu)(struct device *dev,
61901+ void (* const sync_single_for_cpu)(struct device *dev,
61902 dma_addr_t dma_handle, size_t size,
61903 enum dma_data_direction dir);
61904- void (*sync_single_for_device)(struct device *dev,
61905+ void (* const sync_single_for_device)(struct device *dev,
61906 dma_addr_t dma_handle, size_t size,
61907 enum dma_data_direction dir);
ae4e228f
MT		 61908- void (*sync_sg_for_cpu)(struct device *dev,
61909+ void (* const sync_sg_for_cpu)(struct device *dev,
61910 struct scatterlist *sg, int nents,
61911 enum dma_data_direction dir);
61912- void (*sync_sg_for_device)(struct device *dev,
61913+ void (* const sync_sg_for_device)(struct device *dev,
61914 struct scatterlist *sg, int nents,
61915 enum dma_data_direction dir);
61916- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
61917- int (*dma_supported)(struct device *dev, u64 mask);
61918- int (*set_dma_mask)(struct device *dev, u64 mask);
61919- int is_phys;
61920+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
61921+ int (* const dma_supported)(struct device *dev, u64 mask);
61922+ int (* set_dma_mask)(struct device *dev, u64 mask);
61923+ const int is_phys;
61924 };
61925
61926 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
66a7e928
MT		 61927diff -urNp linux-2.6.39/include/linux/elf.h linux-2.6.39/include/linux/elf.h
61928--- linux-2.6.39/include/linux/elf.h 2011-05-19 00:06:34.000000000 -0400
61929+++ linux-2.6.39/include/linux/elf.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 61930@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
61931 #define PT_GNU_EH_FRAME 0x6474e550
61932
61933 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
61934+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
61935+
61936+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
61937+
61938+/* Constants for the e_flags field */
61939+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61940+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
61941+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
61942+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
61943+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61944+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61945
df50ba0c
MT		 61946 /*
61947 * Extended Numbering
61948@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
58c5fc13
MT		 61949 #define DT_DEBUG 21
61950 #define DT_TEXTREL 22
61951 #define DT_JMPREL 23
61952+#define DT_FLAGS 30
61953+ #define DF_TEXTREL 0x00000004
61954 #define DT_ENCODING 32
61955 #define OLD_DT_LOOS 0x60000000
61956 #define DT_LOOS 0x6000000d
df50ba0c 61957@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
58c5fc13
MT		 61958 #define PF_W 0x2
61959 #define PF_X 0x1
61960
61961+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
61962+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
61963+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
61964+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
61965+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
61966+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
61967+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
61968+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
61969+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
61970+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
61971+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
61972+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
61973+
61974 typedef struct elf32_phdr{
61975 Elf32_Word p_type;
61976 Elf32_Off p_offset;
df50ba0c 61977@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
58c5fc13
MT		 61978 #define EI_OSABI 7
61979 #define EI_PAD 8
61980
61981+#define EI_PAX 14
61982+
61983 #define ELFMAG0 0x7f /* EI_MAG */
61984 #define ELFMAG1 'E'
61985 #define ELFMAG2 'L'
57199397 61986@@ -421,6 +449,7 @@ extern Elf32_Dyn _DYNAMIC [];
58c5fc13
MT		 61987 #define elf_note elf32_note
61988 #define elf_addr_t Elf32_Off
df50ba0c 61989 #define Elf_Half Elf32_Half
58c5fc13
MT		 61990+#define elf_dyn Elf32_Dyn
61991
61992 #else
61993
57199397 61994@@ -431,6 +460,7 @@ extern Elf64_Dyn _DYNAMIC [];
58c5fc13
MT		 61995 #define elf_note elf64_note
61996 #define elf_addr_t Elf64_Off
df50ba0c 61997 #define Elf_Half Elf64_Half
58c5fc13
MT		 61998+#define elf_dyn Elf64_Dyn
61999
62000 #endif
62001
66a7e928
MT		 62002diff -urNp linux-2.6.39/include/linux/enclosure.h linux-2.6.39/include/linux/enclosure.h
62003--- linux-2.6.39/include/linux/enclosure.h 2011-05-19 00:06:34.000000000 -0400
62004+++ linux-2.6.39/include/linux/enclosure.h 2011-05-22 19:36:33.000000000 -0400
62005@@ -98,7 +98,7 @@ struct enclosure_device {
62006 void *scratch;
62007 struct list_head node;
62008 struct device edev;
62009- struct enclosure_component_callbacks *cb;
62010+ const struct enclosure_component_callbacks *cb;
62011 int components;
62012 struct enclosure_component component[0];
62013 };
62014diff -urNp linux-2.6.39/include/linux/fscache-cache.h linux-2.6.39/include/linux/fscache-cache.h
62015--- linux-2.6.39/include/linux/fscache-cache.h 2011-05-19 00:06:34.000000000 -0400
62016+++ linux-2.6.39/include/linux/fscache-cache.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 62017@@ -113,7 +113,7 @@ struct fscache_operation {
62018 #endif
62019 };
62020
62021-extern atomic_t fscache_op_debug_id;
62022+extern atomic_unchecked_t fscache_op_debug_id;
62023 extern void fscache_op_work_func(struct work_struct *work);
62024
62025 extern void fscache_enqueue_operation(struct fscache_operation *);
62026@@ -133,7 +133,7 @@ static inline void fscache_operation_ini
62027 {
62028 INIT_WORK(&op->work, fscache_op_work_func);
62029 atomic_set(&op->usage, 1);
62030- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
62031+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
62032 op->processor = processor;
62033 op->release = release;
62034 INIT_LIST_HEAD(&op->pend_link);
66a7e928
MT		 62035diff -urNp linux-2.6.39/include/linux/fs.h linux-2.6.39/include/linux/fs.h
62036--- linux-2.6.39/include/linux/fs.h 2011-05-19 00:06:34.000000000 -0400
62037+++ linux-2.6.39/include/linux/fs.h 2011-05-22 19:41:42.000000000 -0400
62038@@ -108,6 +108,11 @@ struct inodes_stat_t {
bc901d79
MT		 62039 /* File was opened by fanotify and shouldn't generate fanotify events */
62040 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
58c5fc13
MT		 62041
62042+/* Hack for grsec so as not to require read permission simply to execute
ae4e228f
MT		 62043+ * a binary
62044+ */
bc901d79 62045+#define FMODE_GREXEC ((__force fmode_t)0x2000000)
58c5fc13 62046+
bc901d79
MT		 62047 /*
62048 * The below are the various read and write types that we support. Some of
62049 * them include behavioral modifiers that send information down to the
66a7e928 62050@@ -575,41 +580,41 @@ typedef int (*read_actor_t)(read_descrip
ae4e228f
MT		 62051 unsigned long, unsigned long);
62052
62053 struct address_space_operations {
62054- int (*writepage)(struct page *page, struct writeback_control *wbc);
62055- int (*readpage)(struct file *, struct page *);
ae4e228f
MT		 62056+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
62057+ int (* const readpage)(struct file *, struct page *);
ae4e228f
MT		 62058
62059 /* Write back some dirty pages from this mapping. */
62060- int (*writepages)(struct address_space *, struct writeback_control *);
62061+ int (* const writepages)(struct address_space *, struct writeback_control *);
62062
62063 /* Set a page dirty. Return true if this dirtied it */
62064- int (*set_page_dirty)(struct page *page);
62065+ int (* const set_page_dirty)(struct page *page);
62066
62067- int (*readpages)(struct file *filp, struct address_space *mapping,
62068+ int (* const readpages)(struct file *filp, struct address_space *mapping,
62069 struct list_head *pages, unsigned nr_pages);
62070
62071- int (*write_begin)(struct file *, struct address_space *mapping,
62072+ int (* const write_begin)(struct file *, struct address_space *mapping,
62073 loff_t pos, unsigned len, unsigned flags,
62074 struct page **pagep, void **fsdata);
62075- int (*write_end)(struct file *, struct address_space *mapping,
62076+ int (* const write_end)(struct file *, struct address_space *mapping,
62077 loff_t pos, unsigned len, unsigned copied,
62078 struct page *page, void *fsdata);
62079
62080 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
62081- sector_t (*bmap)(struct address_space *, sector_t);
62082- void (*invalidatepage) (struct page *, unsigned long);
62083- int (*releasepage) (struct page *, gfp_t);
bc901d79 62084- void (*freepage)(struct page *);
ae4e228f
MT		 62085- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
62086+ sector_t (* const bmap)(struct address_space *, sector_t);
62087+ void (* const invalidatepage) (struct page *, unsigned long);
62088+ int (* const releasepage) (struct page *, gfp_t);
bc901d79 62089+ void (* const freepage)(struct page *);
ae4e228f
MT		 62090+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
62091 loff_t offset, unsigned long nr_segs);
62092- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
62093+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
62094 void **, unsigned long *);
62095 /* migrate the contents of a page to the specified target */
62096- int (*migratepage) (struct address_space *,
62097+ int (* const migratepage) (struct address_space *,
62098 struct page *, struct page *);
62099- int (*launder_page) (struct page *);
62100- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
62101+ int (* const launder_page) (struct page *);
62102+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
62103 unsigned long);
62104- int (*error_remove_page)(struct address_space *, struct page *);
62105+ int (* const error_remove_page)(struct address_space *, struct page *);
62106 };
62107
66a7e928
MT		 62108 extern const struct address_space_operations empty_aops;
62109@@ -1060,17 +1065,17 @@ static inline int file_check_writeable(s
ae4e228f
MT		 62110 typedef struct files_struct *fl_owner_t;
62111
62112 struct file_lock_operations {
62113- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
62114- void (*fl_release_private)(struct file_lock *);
62115+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
62116+ void (* const fl_release_private)(struct file_lock *);
62117 };
62118
62119 struct lock_manager_operations {
62120- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
62121- void (*fl_notify)(struct file_lock *); /* unblock callback */
62122- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
ae4e228f
MT		 62123- void (*fl_release_private)(struct file_lock *);
62124- void (*fl_break)(struct file_lock *);
ae4e228f
MT		 62125- int (*fl_change)(struct file_lock **, int);
62126+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
62127+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
62128+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
ae4e228f
MT		 62129+ void (* const fl_release_private)(struct file_lock *);
62130+ void (* const fl_break)(struct file_lock *);
ae4e228f
MT		 62131+ int (* const fl_change)(struct file_lock **, int);
62132 };
62133
62134 struct lock_manager {
66a7e928 62135@@ -1611,31 +1616,31 @@ extern ssize_t vfs_writev(struct file *,
ae4e228f
MT		 62136 unsigned long, loff_t *);
62137
62138 struct super_operations {
62139- struct inode *(*alloc_inode)(struct super_block *sb);
62140- void (*destroy_inode)(struct inode *);
62141+ struct inode *(* const alloc_inode)(struct super_block *sb);
62142+ void (* const destroy_inode)(struct inode *);
62143
62144- void (*dirty_inode) (struct inode *);
df50ba0c 62145- int (*write_inode) (struct inode *, struct writeback_control *wbc);
6892158b
MT		 62146- int (*drop_inode) (struct inode *);
62147- void (*evict_inode) (struct inode *);
ae4e228f
MT		 62148- void (*put_super) (struct super_block *);
62149- void (*write_super) (struct super_block *);
62150- int (*sync_fs)(struct super_block *sb, int wait);
62151- int (*freeze_fs) (struct super_block *);
62152- int (*unfreeze_fs) (struct super_block *);
62153- int (*statfs) (struct dentry *, struct kstatfs *);
62154- int (*remount_fs) (struct super_block *, int *, char *);
ae4e228f 62155- void (*umount_begin) (struct super_block *);
66a7e928
MT		 62156-
62157- int (*show_options)(struct seq_file *, struct vfsmount *);
62158- int (*show_devname)(struct seq_file *, struct vfsmount *);
62159- int (*show_path)(struct seq_file *, struct vfsmount *);
62160- int (*show_stats)(struct seq_file *, struct vfsmount *);
ae4e228f 62161+ void (* const dirty_inode) (struct inode *);
df50ba0c 62162+ int (* const write_inode) (struct inode *, struct writeback_control *wbc);
6892158b
MT		 62163+ int (* const drop_inode) (struct inode *);
62164+ void (* const evict_inode) (struct inode *);
ae4e228f
MT		 62165+ void (* const put_super) (struct super_block *);
62166+ void (* const write_super) (struct super_block *);
62167+ int (* const sync_fs)(struct super_block *sb, int wait);
62168+ int (* const freeze_fs) (struct super_block *);
62169+ int (* const unfreeze_fs) (struct super_block *);
62170+ int (* const statfs) (struct dentry *, struct kstatfs *);
62171+ int (* const remount_fs) (struct super_block *, int *, char *);
ae4e228f 62172+ void (* const umount_begin) (struct super_block *);
66a7e928 62173+
ae4e228f 62174+ int (* const show_options)(struct seq_file *, struct vfsmount *);
66a7e928
MT		 62175+ int (* const show_devname)(struct seq_file *, struct vfsmount *);
62176+ int (* const show_path)(struct seq_file *, struct vfsmount *);
ae4e228f
MT		 62177+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
62178 #ifdef CONFIG_QUOTA
62179- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
62180- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62181+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
62182+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62183 #endif
62184- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62185+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62186 };
62187
62188 /*
66a7e928
MT		 62189diff -urNp linux-2.6.39/include/linux/fs_struct.h linux-2.6.39/include/linux/fs_struct.h
62190--- linux-2.6.39/include/linux/fs_struct.h 2011-05-19 00:06:34.000000000 -0400
62191+++ linux-2.6.39/include/linux/fs_struct.h 2011-05-22 19:36:33.000000000 -0400
16454cff
MT		 62192@@ -6,7 +6,7 @@
62193 #include <linux/seqlock.h>
58c5fc13
MT		 62194
62195 struct fs_struct {
62196- int users;
62197+ atomic_t users;
6892158b 62198 spinlock_t lock;
16454cff 62199 seqcount_t seq;
58c5fc13 62200 int umask;
66a7e928
MT		 62201diff -urNp linux-2.6.39/include/linux/ftrace_event.h linux-2.6.39/include/linux/ftrace_event.h
62202--- linux-2.6.39/include/linux/ftrace_event.h 2011-05-19 00:06:34.000000000 -0400
62203+++ linux-2.6.39/include/linux/ftrace_event.h 2011-05-22 19:36:33.000000000 -0400
62204@@ -235,7 +235,7 @@ extern int trace_define_field(struct ftr
62205 extern int trace_add_event_call(struct ftrace_event_call *call);
62206 extern void trace_remove_event_call(struct ftrace_event_call *call);
62207
62208-#define is_signed_type(type) (((type)(-1)) < 0)
62209+#define is_signed_type(type) (((type)(-1)) < (type)1)
62210
62211 int trace_set_clr_event(const char *system, const char *event, int set);
62212
62213diff -urNp linux-2.6.39/include/linux/ftrace.h linux-2.6.39/include/linux/ftrace.h
62214--- linux-2.6.39/include/linux/ftrace.h 2011-05-19 00:06:34.000000000 -0400
62215+++ linux-2.6.39/include/linux/ftrace.h 2011-05-22 19:36:33.000000000 -0400
62216@@ -140,7 +140,7 @@ extern void
62217 unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
62218 void *data);
62219 extern void
62220-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops);
62221+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops);
62222 extern void unregister_ftrace_function_probe_all(char *glob);
62223
62224 extern int ftrace_text_reserved(void *start, void *end);
62225diff -urNp linux-2.6.39/include/linux/genhd.h linux-2.6.39/include/linux/genhd.h
62226--- linux-2.6.39/include/linux/genhd.h 2011-05-19 00:06:34.000000000 -0400
62227+++ linux-2.6.39/include/linux/genhd.h 2011-05-22 19:36:33.000000000 -0400
16454cff
MT		 62228@@ -183,7 +183,7 @@ struct gendisk {
62229 struct kobject *slave_dir;
58c5fc13
MT		 62230
62231 struct timer_rand_state *random;
58c5fc13
MT		 62232- atomic_t sync_io; /* RAID */
62233+ atomic_unchecked_t sync_io; /* RAID */
16454cff 62234 struct disk_events *ev;
58c5fc13
MT		 62235 #ifdef CONFIG_BLK_DEV_INTEGRITY
62236 struct blk_integrity *integrity;
66a7e928
MT		 62237diff -urNp linux-2.6.39/include/linux/gracl.h linux-2.6.39/include/linux/gracl.h
62238--- linux-2.6.39/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
62239+++ linux-2.6.39/include/linux/gracl.h 2011-05-22 19:41:42.000000000 -0400
bc901d79 62240@@ -0,0 +1,317 @@
58c5fc13
MT		 62241+#ifndef GR_ACL_H
62242+#define GR_ACL_H
62243+
62244+#include <linux/grdefs.h>
62245+#include <linux/resource.h>
62246+#include <linux/capability.h>
62247+#include <linux/dcache.h>
62248+#include <asm/resource.h>
62249+
62250+/* Major status information */
62251+
16454cff
MT		 62252+#define GR_VERSION "grsecurity 2.2.2"
62253+#define GRSECURITY_VERSION 0x2202
58c5fc13
MT		 62254+
62255+enum {
62256+ GR_SHUTDOWN = 0,
62257+ GR_ENABLE = 1,
62258+ GR_SPROLE = 2,
62259+ GR_RELOAD = 3,
62260+ GR_SEGVMOD = 4,
62261+ GR_STATUS = 5,
62262+ GR_UNSPROLE = 6,
62263+ GR_PASSSET = 7,
62264+ GR_SPROLEPAM = 8,
62265+};
62266+
62267+/* Password setup definitions
62268+ * kernel/grhash.c */
62269+enum {
62270+ GR_PW_LEN = 128,
62271+ GR_SALT_LEN = 16,
62272+ GR_SHA_LEN = 32,
62273+};
62274+
62275+enum {
62276+ GR_SPROLE_LEN = 64,
62277+};
62278+
bc901d79
MT		 62279+enum {
62280+ GR_NO_GLOB = 0,
62281+ GR_REG_GLOB,
62282+ GR_CREATE_GLOB
62283+};
62284+
58c5fc13
MT		 62285+#define GR_NLIMITS 32
62286+
62287+/* Begin Data Structures */
62288+
62289+struct sprole_pw {
62290+ unsigned char *rolename;
62291+ unsigned char salt[GR_SALT_LEN];
62292+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
62293+};
62294+
62295+struct name_entry {
62296+ __u32 key;
62297+ ino_t inode;
62298+ dev_t device;
62299+ char *name;
62300+ __u16 len;
62301+ __u8 deleted;
62302+ struct name_entry *prev;
62303+ struct name_entry *next;
62304+};
62305+
62306+struct inodev_entry {
62307+ struct name_entry *nentry;
62308+ struct inodev_entry *prev;
62309+ struct inodev_entry *next;
62310+};
62311+
62312+struct acl_role_db {
62313+ struct acl_role_label **r_hash;
62314+ __u32 r_size;
62315+};
62316+
62317+struct inodev_db {
62318+ struct inodev_entry **i_hash;
62319+ __u32 i_size;
62320+};
62321+
62322+struct name_db {
62323+ struct name_entry **n_hash;
62324+ __u32 n_size;
62325+};
62326+
62327+struct crash_uid {
62328+ uid_t uid;
62329+ unsigned long expires;
62330+};
62331+
62332+struct gr_hash_struct {
62333+ void **table;
62334+ void **nametable;
62335+ void *first;
62336+ __u32 table_size;
62337+ __u32 used_size;
62338+ int type;
62339+};
62340+
62341+/* Userspace Grsecurity ACL data structures */
62342+
62343+struct acl_subject_label {
62344+ char *filename;
62345+ ino_t inode;
62346+ dev_t device;
62347+ __u32 mode;
62348+ kernel_cap_t cap_mask;
62349+ kernel_cap_t cap_lower;
df50ba0c 62350+ kernel_cap_t cap_invert_audit;
58c5fc13
MT		 62351+
62352+ struct rlimit res[GR_NLIMITS];
62353+ __u32 resmask;
62354+
62355+ __u8 user_trans_type;
62356+ __u8 group_trans_type;
62357+ uid_t *user_transitions;
62358+ gid_t *group_transitions;
62359+ __u16 user_trans_num;
62360+ __u16 group_trans_num;
62361+
bc901d79 62362+ __u32 sock_families[2];
58c5fc13
MT		 62363+ __u32 ip_proto[8];
62364+ __u32 ip_type;
62365+ struct acl_ip_label **ips;
62366+ __u32 ip_num;
62367+ __u32 inaddr_any_override;
62368+
62369+ __u32 crashes;
62370+ unsigned long expires;
62371+
62372+ struct acl_subject_label *parent_subject;
62373+ struct gr_hash_struct *hash;
62374+ struct acl_subject_label *prev;
62375+ struct acl_subject_label *next;
62376+
62377+ struct acl_object_label **obj_hash;
62378+ __u32 obj_hash_size;
62379+ __u16 pax_flags;
62380+};
62381+
62382+struct role_allowed_ip {
62383+ __u32 addr;
62384+ __u32 netmask;
62385+
62386+ struct role_allowed_ip *prev;
62387+ struct role_allowed_ip *next;
62388+};
62389+
62390+struct role_transition {
62391+ char *rolename;
62392+
62393+ struct role_transition *prev;
62394+ struct role_transition *next;
62395+};
62396+
62397+struct acl_role_label {
62398+ char *rolename;
62399+ uid_t uidgid;
62400+ __u16 roletype;
62401+
62402+ __u16 auth_attempts;
62403+ unsigned long expires;
62404+
62405+ struct acl_subject_label *root_label;
62406+ struct gr_hash_struct *hash;
62407+
62408+ struct acl_role_label *prev;
62409+ struct acl_role_label *next;
62410+
62411+ struct role_transition *transitions;
62412+ struct role_allowed_ip *allowed_ips;
62413+ uid_t *domain_children;
62414+ __u16 domain_child_num;
62415+
62416+ struct acl_subject_label **subj_hash;
62417+ __u32 subj_hash_size;
62418+};
62419+
62420+struct user_acl_role_db {
62421+ struct acl_role_label **r_table;
62422+ __u32 num_pointers; /* Number of allocations to track */
62423+ __u32 num_roles; /* Number of roles */
62424+ __u32 num_domain_children; /* Number of domain children */
62425+ __u32 num_subjects; /* Number of subjects */
62426+ __u32 num_objects; /* Number of objects */
62427+};
62428+
62429+struct acl_object_label {
62430+ char *filename;
62431+ ino_t inode;
62432+ dev_t device;
62433+ __u32 mode;
62434+
62435+ struct acl_subject_label *nested;
62436+ struct acl_object_label *globbed;
62437+
62438+ /* next two structures not used */
62439+
62440+ struct acl_object_label *prev;
62441+ struct acl_object_label *next;
62442+};
62443+
62444+struct acl_ip_label {
62445+ char *iface;
62446+ __u32 addr;
62447+ __u32 netmask;
62448+ __u16 low, high;
62449+ __u8 mode;
62450+ __u32 type;
62451+ __u32 proto[8];
62452+
62453+ /* next two structures not used */
62454+
62455+ struct acl_ip_label *prev;
62456+ struct acl_ip_label *next;
62457+};
62458+
62459+struct gr_arg {
62460+ struct user_acl_role_db role_db;
62461+ unsigned char pw[GR_PW_LEN];
62462+ unsigned char salt[GR_SALT_LEN];
62463+ unsigned char sum[GR_SHA_LEN];
62464+ unsigned char sp_role[GR_SPROLE_LEN];
62465+ struct sprole_pw *sprole_pws;
62466+ dev_t segv_device;
62467+ ino_t segv_inode;
62468+ uid_t segv_uid;
62469+ __u16 num_sprole_pws;
62470+ __u16 mode;
62471+};
62472+
62473+struct gr_arg_wrapper {
62474+ struct gr_arg *arg;
62475+ __u32 version;
62476+ __u32 size;
62477+};
62478+
62479+struct subject_map {
62480+ struct acl_subject_label *user;
62481+ struct acl_subject_label *kernel;
62482+ struct subject_map *prev;
62483+ struct subject_map *next;
62484+};
62485+
62486+struct acl_subj_map_db {
62487+ struct subject_map **s_hash;
62488+ __u32 s_size;
62489+};
62490+
62491+/* End Data Structures Section */
62492+
62493+/* Hash functions generated by empirical testing by Brad Spengler
62494+ Makes good use of the low bits of the inode. Generally 0-1 times
62495+ in loop for successful match. 0-3 for unsuccessful match.
62496+ Shift/add algorithm with modulus of table size and an XOR*/
62497+
62498+static __inline__ unsigned int
62499+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
62500+{
ae4e228f 62501+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
58c5fc13
MT		 62502+}
62503+
62504+ static __inline__ unsigned int
62505+shash(const struct acl_subject_label *userp, const unsigned int sz)
62506+{
62507+ return ((const unsigned long)userp % sz);
62508+}
62509+
62510+static __inline__ unsigned int
62511+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
62512+{
62513+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
62514+}
62515+
62516+static __inline__ unsigned int
62517+nhash(const char *name, const __u16 len, const unsigned int sz)
62518+{
62519+ return full_name_hash((const unsigned char *)name, len) % sz;
62520+}
62521+
ae4e228f
MT		 62522+#define FOR_EACH_ROLE_START(role) \
62523+ role = role_list; \
62524+ while (role) {
58c5fc13 62525+
ae4e228f
MT		 62526+#define FOR_EACH_ROLE_END(role) \
62527+ role = role->prev; \
58c5fc13
MT		 62528+ }
62529+
62530+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
62531+ subj = NULL; \
62532+ iter = 0; \
62533+ while (iter < role->subj_hash_size) { \
62534+ if (subj == NULL) \
62535+ subj = role->subj_hash[iter]; \
62536+ if (subj == NULL) { \
62537+ iter++; \
62538+ continue; \
62539+ }
62540+
62541+#define FOR_EACH_SUBJECT_END(subj,iter) \
62542+ subj = subj->next; \
62543+ if (subj == NULL) \
62544+ iter++; \
62545+ }
62546+
62547+
62548+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
62549+ subj = role->hash->first; \
62550+ while (subj != NULL) {
62551+
62552+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
62553+ subj = subj->next; \
62554+ }
62555+
62556+#endif
62557+
66a7e928
MT		 62558diff -urNp linux-2.6.39/include/linux/gralloc.h linux-2.6.39/include/linux/gralloc.h
62559--- linux-2.6.39/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
62560+++ linux-2.6.39/include/linux/gralloc.h 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 62561@@ -0,0 +1,9 @@
62562+#ifndef __GRALLOC_H
62563+#define __GRALLOC_H
62564+
62565+void acl_free_all(void);
62566+int acl_alloc_stack_init(unsigned long size);
62567+void *acl_alloc(unsigned long len);
62568+void *acl_alloc_num(unsigned long num, unsigned long len);
62569+
62570+#endif
66a7e928
MT		 62571diff -urNp linux-2.6.39/include/linux/grdefs.h linux-2.6.39/include/linux/grdefs.h
62572--- linux-2.6.39/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
62573+++ linux-2.6.39/include/linux/grdefs.h 2011-05-22 19:41:42.000000000 -0400
16454cff 62574@@ -0,0 +1,139 @@
58c5fc13
MT		 62575+#ifndef GRDEFS_H
62576+#define GRDEFS_H
62577+
62578+/* Begin grsecurity status declarations */
62579+
62580+enum {
62581+ GR_READY = 0x01,
62582+ GR_STATUS_INIT = 0x00 // disabled state
62583+};
62584+
62585+/* Begin ACL declarations */
62586+
62587+/* Role flags */
62588+
62589+enum {
62590+ GR_ROLE_USER = 0x0001,
62591+ GR_ROLE_GROUP = 0x0002,
62592+ GR_ROLE_DEFAULT = 0x0004,
62593+ GR_ROLE_SPECIAL = 0x0008,
62594+ GR_ROLE_AUTH = 0x0010,
62595+ GR_ROLE_NOPW = 0x0020,
62596+ GR_ROLE_GOD = 0x0040,
62597+ GR_ROLE_LEARN = 0x0080,
62598+ GR_ROLE_TPE = 0x0100,
62599+ GR_ROLE_DOMAIN = 0x0200,
16454cff
MT		 62600+ GR_ROLE_PAM = 0x0400,
62601+ GR_ROLE_PERSIST = 0x0800
58c5fc13
MT		 62602+};
62603+
62604+/* ACL Subject and Object mode flags */
62605+enum {
62606+ GR_DELETED = 0x80000000
62607+};
62608+
62609+/* ACL Object-only mode flags */
62610+enum {
62611+ GR_READ = 0x00000001,
62612+ GR_APPEND = 0x00000002,
62613+ GR_WRITE = 0x00000004,
62614+ GR_EXEC = 0x00000008,
62615+ GR_FIND = 0x00000010,
62616+ GR_INHERIT = 0x00000020,
62617+ GR_SETID = 0x00000040,
62618+ GR_CREATE = 0x00000080,
62619+ GR_DELETE = 0x00000100,
62620+ GR_LINK = 0x00000200,
62621+ GR_AUDIT_READ = 0x00000400,
62622+ GR_AUDIT_APPEND = 0x00000800,
62623+ GR_AUDIT_WRITE = 0x00001000,
62624+ GR_AUDIT_EXEC = 0x00002000,
62625+ GR_AUDIT_FIND = 0x00004000,
62626+ GR_AUDIT_INHERIT= 0x00008000,
62627+ GR_AUDIT_SETID = 0x00010000,
62628+ GR_AUDIT_CREATE = 0x00020000,
62629+ GR_AUDIT_DELETE = 0x00040000,
62630+ GR_AUDIT_LINK = 0x00080000,
62631+ GR_PTRACERD = 0x00100000,
62632+ GR_NOPTRACE = 0x00200000,
62633+ GR_SUPPRESS = 0x00400000,
16454cff
MT		 62634+ GR_NOLEARN = 0x00800000,
62635+ GR_INIT_TRANSFER= 0x01000000
58c5fc13
MT		 62636+};
62637+
62638+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
62639+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
62640+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
62641+
62642+/* ACL subject-only mode flags */
62643+enum {
62644+ GR_KILL = 0x00000001,
62645+ GR_VIEW = 0x00000002,
62646+ GR_PROTECTED = 0x00000004,
62647+ GR_LEARN = 0x00000008,
62648+ GR_OVERRIDE = 0x00000010,
62649+ /* just a placeholder, this mode is only used in userspace */
62650+ GR_DUMMY = 0x00000020,
62651+ GR_PROTSHM = 0x00000040,
62652+ GR_KILLPROC = 0x00000080,
62653+ GR_KILLIPPROC = 0x00000100,
62654+ /* just a placeholder, this mode is only used in userspace */
62655+ GR_NOTROJAN = 0x00000200,
62656+ GR_PROTPROCFD = 0x00000400,
62657+ GR_PROCACCT = 0x00000800,
62658+ GR_RELAXPTRACE = 0x00001000,
62659+ GR_NESTED = 0x00002000,
62660+ GR_INHERITLEARN = 0x00004000,
62661+ GR_PROCFIND = 0x00008000,
62662+ GR_POVERRIDE = 0x00010000,
62663+ GR_KERNELAUTH = 0x00020000,
bc901d79 62664+ GR_ATSECURE = 0x00040000
58c5fc13
MT		 62665+};
62666+
62667+enum {
62668+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
62669+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
62670+ GR_PAX_ENABLE_MPROTECT = 0x0004,
62671+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
62672+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
62673+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
62674+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
62675+ GR_PAX_DISABLE_MPROTECT = 0x0400,
62676+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
62677+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
62678+};
62679+
62680+enum {
62681+ GR_ID_USER = 0x01,
62682+ GR_ID_GROUP = 0x02,
62683+};
62684+
62685+enum {
62686+ GR_ID_ALLOW = 0x01,
62687+ GR_ID_DENY = 0x02,
62688+};
62689+
62690+#define GR_CRASH_RES 31
62691+#define GR_UIDTABLE_MAX 500
62692+
62693+/* begin resource learning section */
62694+enum {
62695+ GR_RLIM_CPU_BUMP = 60,
62696+ GR_RLIM_FSIZE_BUMP = 50000,
62697+ GR_RLIM_DATA_BUMP = 10000,
62698+ GR_RLIM_STACK_BUMP = 1000,
62699+ GR_RLIM_CORE_BUMP = 10000,
62700+ GR_RLIM_RSS_BUMP = 500000,
62701+ GR_RLIM_NPROC_BUMP = 1,
62702+ GR_RLIM_NOFILE_BUMP = 5,
62703+ GR_RLIM_MEMLOCK_BUMP = 50000,
62704+ GR_RLIM_AS_BUMP = 500000,
62705+ GR_RLIM_LOCKS_BUMP = 2,
62706+ GR_RLIM_SIGPENDING_BUMP = 5,
62707+ GR_RLIM_MSGQUEUE_BUMP = 10000,
62708+ GR_RLIM_NICE_BUMP = 1,
62709+ GR_RLIM_RTPRIO_BUMP = 1,
62710+ GR_RLIM_RTTIME_BUMP = 1000000
62711+};
62712+
62713+#endif
66a7e928
MT		 62714diff -urNp linux-2.6.39/include/linux/grinternal.h linux-2.6.39/include/linux/grinternal.h
62715--- linux-2.6.39/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
62716+++ linux-2.6.39/include/linux/grinternal.h 2011-05-22 19:41:42.000000000 -0400
71d190be 62717@@ -0,0 +1,219 @@
58c5fc13
MT		 62718+#ifndef __GRINTERNAL_H
62719+#define __GRINTERNAL_H
62720+
62721+#ifdef CONFIG_GRKERNSEC
62722+
62723+#include <linux/fs.h>
62724+#include <linux/mnt_namespace.h>
62725+#include <linux/nsproxy.h>
62726+#include <linux/gracl.h>
62727+#include <linux/grdefs.h>
62728+#include <linux/grmsg.h>
62729+
62730+void gr_add_learn_entry(const char *fmt, ...)
62731+ __attribute__ ((format (printf, 1, 2)));
62732+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
62733+ const struct vfsmount *mnt);
62734+__u32 gr_check_create(const struct dentry *new_dentry,
62735+ const struct dentry *parent,
62736+ const struct vfsmount *mnt, const __u32 mode);
62737+int gr_check_protected_task(const struct task_struct *task);
62738+__u32 to_gr_audit(const __u32 reqmode);
62739+int gr_set_acls(const int type);
16454cff 62740+int gr_apply_subject_to_task(struct task_struct *task);
58c5fc13
MT		 62741+int gr_acl_is_enabled(void);
62742+char gr_roletype_to_char(void);
62743+
62744+void gr_handle_alertkill(struct task_struct *task);
62745+char *gr_to_filename(const struct dentry *dentry,
62746+ const struct vfsmount *mnt);
62747+char *gr_to_filename1(const struct dentry *dentry,
62748+ const struct vfsmount *mnt);
62749+char *gr_to_filename2(const struct dentry *dentry,
62750+ const struct vfsmount *mnt);
62751+char *gr_to_filename3(const struct dentry *dentry,
62752+ const struct vfsmount *mnt);
62753+
62754+extern int grsec_enable_harden_ptrace;
62755+extern int grsec_enable_link;
62756+extern int grsec_enable_fifo;
62757+extern int grsec_enable_execve;
62758+extern int grsec_enable_shm;
62759+extern int grsec_enable_execlog;
62760+extern int grsec_enable_signal;
ae4e228f 62761+extern int grsec_enable_audit_ptrace;
58c5fc13
MT		 62762+extern int grsec_enable_forkfail;
62763+extern int grsec_enable_time;
ae4e228f 62764+extern int grsec_enable_rofs;
58c5fc13
MT		 62765+extern int grsec_enable_chroot_shmat;
62766+extern int grsec_enable_chroot_findtask;
62767+extern int grsec_enable_chroot_mount;
62768+extern int grsec_enable_chroot_double;
62769+extern int grsec_enable_chroot_pivot;
62770+extern int grsec_enable_chroot_chdir;
62771+extern int grsec_enable_chroot_chmod;
62772+extern int grsec_enable_chroot_mknod;
62773+extern int grsec_enable_chroot_fchdir;
62774+extern int grsec_enable_chroot_nice;
62775+extern int grsec_enable_chroot_execlog;
62776+extern int grsec_enable_chroot_caps;
62777+extern int grsec_enable_chroot_sysctl;
62778+extern int grsec_enable_chroot_unix;
62779+extern int grsec_enable_tpe;
62780+extern int grsec_tpe_gid;
62781+extern int grsec_enable_tpe_all;
57199397 62782+extern int grsec_enable_tpe_invert;
58c5fc13
MT		 62783+extern int grsec_enable_socket_all;
62784+extern int grsec_socket_all_gid;
62785+extern int grsec_enable_socket_client;
62786+extern int grsec_socket_client_gid;
62787+extern int grsec_enable_socket_server;
62788+extern int grsec_socket_server_gid;
62789+extern int grsec_audit_gid;
62790+extern int grsec_enable_group;
62791+extern int grsec_enable_audit_textrel;
6892158b 62792+extern int grsec_enable_log_rwxmaps;
58c5fc13
MT		 62793+extern int grsec_enable_mount;
62794+extern int grsec_enable_chdir;
62795+extern int grsec_resource_logging;
ae4e228f
MT		 62796+extern int grsec_enable_blackhole;
62797+extern int grsec_lastack_retries;
58c5fc13
MT		 62798+extern int grsec_lock;
62799+
62800+extern spinlock_t grsec_alert_lock;
62801+extern unsigned long grsec_alert_wtime;
62802+extern unsigned long grsec_alert_fyet;
62803+
62804+extern spinlock_t grsec_audit_lock;
62805+
62806+extern rwlock_t grsec_exec_file_lock;
62807+
6892158b
MT		 62808+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62809+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62810+ (tsk)->exec_file->f_vfsmnt) : "/")
58c5fc13 62811+
6892158b
MT		 62812+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62813+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62814+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
58c5fc13 62815+
6892158b
MT		 62816+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
62817+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
62818+ (tsk)->exec_file->f_vfsmnt) : "/")
58c5fc13 62819+
6892158b
MT		 62820+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
62821+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
62822+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
58c5fc13 62823+
6892158b 62824+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
58c5fc13 62825+
6892158b 62826+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
58c5fc13 62827+
6892158b
MT		 62828+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
62829+ (task)->pid, (cred)->uid, \
62830+ (cred)->euid, (cred)->gid, (cred)->egid, \
58c5fc13 62831+ gr_parent_task_fullpath(task), \
6892158b
MT		 62832+ (task)->real_parent->comm, (task)->real_parent->pid, \
62833+ (pcred)->uid, (pcred)->euid, \
62834+ (pcred)->gid, (pcred)->egid
58c5fc13
MT		 62835+
62836+#define GR_CHROOT_CAPS {{ \
62837+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
62838+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
62839+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
62840+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
62841+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
62842+ CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
62843+
62844+#define security_learn(normal_msg,args...) \
62845+({ \
62846+ read_lock(&grsec_exec_file_lock); \
62847+ gr_add_learn_entry(normal_msg "\n", ## args); \
62848+ read_unlock(&grsec_exec_file_lock); \
62849+})
62850+
62851+enum {
62852+ GR_DO_AUDIT,
62853+ GR_DONT_AUDIT,
16454cff 62854+ /* used for non-audit messages that we shouldn't kill the task on */
58c5fc13
MT		 62855+ GR_DONT_AUDIT_GOOD
62856+};
62857+
62858+enum {
62859+ GR_TTYSNIFF,
62860+ GR_RBAC,
62861+ GR_RBAC_STR,
62862+ GR_STR_RBAC,
62863+ GR_RBAC_MODE2,
62864+ GR_RBAC_MODE3,
62865+ GR_FILENAME,
62866+ GR_SYSCTL_HIDDEN,
62867+ GR_NOARGS,
62868+ GR_ONE_INT,
62869+ GR_ONE_INT_TWO_STR,
62870+ GR_ONE_STR,
62871+ GR_STR_INT,
bc901d79 62872+ GR_TWO_STR_INT,
58c5fc13 62873+ GR_TWO_INT,
71d190be 62874+ GR_TWO_U64,
58c5fc13
MT		 62875+ GR_THREE_INT,
62876+ GR_FIVE_INT_TWO_STR,
62877+ GR_TWO_STR,
62878+ GR_THREE_STR,
62879+ GR_FOUR_STR,
62880+ GR_STR_FILENAME,
62881+ GR_FILENAME_STR,
62882+ GR_FILENAME_TWO_INT,
62883+ GR_FILENAME_TWO_INT_STR,
62884+ GR_TEXTREL,
62885+ GR_PTRACE,
62886+ GR_RESOURCE,
62887+ GR_CAP,
62888+ GR_SIG,
62889+ GR_SIG2,
62890+ GR_CRASH1,
62891+ GR_CRASH2,
6892158b
MT		 62892+ GR_PSACCT,
62893+ GR_RWXMAP
58c5fc13
MT		 62894+};
62895+
62896+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
62897+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
62898+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
62899+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
62900+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
62901+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
62902+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
62903+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
62904+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
62905+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
62906+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
62907+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
62908+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
62909+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
71d190be 62910+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
58c5fc13
MT		 62911+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
62912+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
62913+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
bc901d79 62914+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
58c5fc13
MT		 62915+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
62916+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
62917+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
62918+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
62919+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
62920+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
62921+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
62922+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
62923+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
62924+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
62925+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
62926+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
62927+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
62928+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
62929+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
6892158b 62930+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
58c5fc13
MT		 62931+
62932+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
62933+
62934+#endif
62935+
62936+#endif
66a7e928
MT		 62937diff -urNp linux-2.6.39/include/linux/grmsg.h linux-2.6.39/include/linux/grmsg.h
62938--- linux-2.6.39/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
62939+++ linux-2.6.39/include/linux/grmsg.h 2011-05-22 19:41:42.000000000 -0400
71d190be 62940@@ -0,0 +1,108 @@
58c5fc13 62941+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
ae4e228f 62942+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
58c5fc13
MT		 62943+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
62944+#define GR_STOPMOD_MSG "denied modification of module state by "
ae4e228f
MT		 62945+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
62946+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
58c5fc13
MT		 62947+#define GR_IOPERM_MSG "denied use of ioperm() by "
62948+#define GR_IOPL_MSG "denied use of iopl() by "
62949+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
62950+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
62951+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
71d190be 62952+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
58c5fc13 62953+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
ae4e228f
MT		 62954+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
62955+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
58c5fc13
MT		 62956+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
62957+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
62958+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
62959+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
62960+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
62961+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
62962+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
ae4e228f 62963+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
58c5fc13
MT		 62964+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
62965+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
62966+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
62967+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
62968+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
62969+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
62970+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
62971+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
ae4e228f 62972+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
58c5fc13
MT		 62973+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
62974+#define GR_NPROC_MSG "denied overstep of process limit by "
62975+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
62976+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
62977+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
62978+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
62979+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
62980+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
62981+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
62982+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
62983+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
62984+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
62985+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
62986+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
62987+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
62988+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
62989+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
bc901d79 62990+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
58c5fc13
MT		 62991+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
62992+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
62993+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
62994+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
62995+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
62996+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
62997+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
62998+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
62999+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
63000+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
63001+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
63002+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
63003+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
63004+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
63005+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
63006+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
63007+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
63008+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
63009+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
63010+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
63011+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
58c5fc13
MT		 63012+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
63013+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
6892158b 63014+#define GR_FAILFORK_MSG "failed fork with errno %s by "
58c5fc13
MT		 63015+#define GR_NICE_CHROOT_MSG "denied priority change by "
63016+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
63017+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
63018+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
63019+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
63020+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
63021+#define GR_TIME_MSG "time set by "
63022+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
63023+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
63024+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
63025+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
bc901d79 63026+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
58c5fc13
MT		 63027+#define GR_BIND_MSG "denied bind() by "
63028+#define GR_CONNECT_MSG "denied connect() by "
ae4e228f
MT		 63029+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
63030+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
63031+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
58c5fc13
MT		 63032+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
63033+#define GR_CAP_ACL_MSG "use of %s denied for "
df50ba0c 63034+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
58c5fc13
MT		 63035+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
63036+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
63037+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
63038+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
63039+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
63040+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
63041+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
63042+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
6892158b
MT		 63043+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
63044+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
58c5fc13 63045+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
ae4e228f
MT		 63046+#define GR_VM86_MSG "denied use of vm86 by "
63047+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
16454cff 63048+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
66a7e928
MT		 63049diff -urNp linux-2.6.39/include/linux/grsecurity.h linux-2.6.39/include/linux/grsecurity.h
63050--- linux-2.6.39/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
63051+++ linux-2.6.39/include/linux/grsecurity.h 2011-05-22 19:41:42.000000000 -0400
71d190be 63052@@ -0,0 +1,212 @@
58c5fc13
MT		 63053+#ifndef GR_SECURITY_H
63054+#define GR_SECURITY_H
63055+#include <linux/fs.h>
63056+#include <linux/fs_struct.h>
63057+#include <linux/binfmts.h>
63058+#include <linux/gracl.h>
bc901d79 63059+#include <linux/compat.h>
58c5fc13
MT		 63060+
63061+/* notify of brain-dead configs */
63062+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
63063+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
63064+#endif
63065+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63066+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63067+#endif
63068+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63069+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63070+#endif
63071+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
63072+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
63073+#endif
63074+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
63075+#error "CONFIG_PAX enabled, but no PaX options are enabled."
63076+#endif
63077+
71d190be 63078+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
58c5fc13 63079+void gr_handle_brute_check(void);
71d190be
MT		 63080+void gr_handle_kernel_exploit(void);
63081+int gr_process_user_ban(void);
58c5fc13
MT		 63082+
63083+char gr_roletype_to_char(void);
63084+
bc901d79
MT		 63085+int gr_acl_enable_at_secure(void);
63086+
58c5fc13
MT		 63087+int gr_check_user_change(int real, int effective, int fs);
63088+int gr_check_group_change(int real, int effective, int fs);
63089+
63090+void gr_del_task_from_ip_table(struct task_struct *p);
63091+
63092+int gr_pid_is_chrooted(struct task_struct *p);
57199397 63093+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
58c5fc13
MT		 63094+int gr_handle_chroot_nice(void);
63095+int gr_handle_chroot_sysctl(const int op);
63096+int gr_handle_chroot_setpriority(struct task_struct *p,
63097+ const int niceval);
63098+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
63099+int gr_handle_chroot_chroot(const struct dentry *dentry,
63100+ const struct vfsmount *mnt);
63101+int gr_handle_chroot_caps(struct path *path);
63102+void gr_handle_chroot_chdir(struct path *path);
63103+int gr_handle_chroot_chmod(const struct dentry *dentry,
63104+ const struct vfsmount *mnt, const int mode);
63105+int gr_handle_chroot_mknod(const struct dentry *dentry,
63106+ const struct vfsmount *mnt, const int mode);
63107+int gr_handle_chroot_mount(const struct dentry *dentry,
63108+ const struct vfsmount *mnt,
63109+ const char *dev_name);
63110+int gr_handle_chroot_pivot(void);
6892158b 63111+int gr_handle_chroot_unix(struct pid *pid);
58c5fc13
MT		 63112+
63113+int gr_handle_rawio(const struct inode *inode);
63114+int gr_handle_nproc(void);
63115+
63116+void gr_handle_ioperm(void);
63117+void gr_handle_iopl(void);
63118+
63119+int gr_tpe_allow(const struct file *file);
63120+
df50ba0c
MT		 63121+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
63122+void gr_clear_chroot_entries(struct task_struct *task);
58c5fc13
MT		 63123+
63124+void gr_log_forkfail(const int retval);
63125+void gr_log_timechange(void);
63126+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
63127+void gr_log_chdir(const struct dentry *dentry,
63128+ const struct vfsmount *mnt);
63129+void gr_log_chroot_exec(const struct dentry *dentry,
63130+ const struct vfsmount *mnt);
6892158b 63131+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
bc901d79
MT		 63132+#ifdef CONFIG_COMPAT
63133+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
63134+#endif
58c5fc13
MT		 63135+void gr_log_remount(const char *devname, const int retval);
63136+void gr_log_unmount(const char *devname, const int retval);
63137+void gr_log_mount(const char *from, const char *to, const int retval);
63138+void gr_log_textrel(struct vm_area_struct *vma);
6892158b
MT		 63139+void gr_log_rwxmmap(struct file *file);
63140+void gr_log_rwxmprotect(struct file *file);
58c5fc13
MT		 63141+
63142+int gr_handle_follow_link(const struct inode *parent,
63143+ const struct inode *inode,
63144+ const struct dentry *dentry,
63145+ const struct vfsmount *mnt);
63146+int gr_handle_fifo(const struct dentry *dentry,
63147+ const struct vfsmount *mnt,
63148+ const struct dentry *dir, const int flag,
63149+ const int acc_mode);
63150+int gr_handle_hardlink(const struct dentry *dentry,
63151+ const struct vfsmount *mnt,
63152+ struct inode *inode,
63153+ const int mode, const char *to);
63154+
63155+int gr_is_capable(const int cap);
63156+int gr_is_capable_nolog(const int cap);
63157+void gr_learn_resource(const struct task_struct *task, const int limit,
63158+ const unsigned long wanted, const int gt);
63159+void gr_copy_label(struct task_struct *tsk);
63160+void gr_handle_crash(struct task_struct *task, const int sig);
63161+int gr_handle_signal(const struct task_struct *p, const int sig);
63162+int gr_check_crash_uid(const uid_t uid);
63163+int gr_check_protected_task(const struct task_struct *task);
57199397 63164+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
58c5fc13
MT		 63165+int gr_acl_handle_mmap(const struct file *file,
63166+ const unsigned long prot);
63167+int gr_acl_handle_mprotect(const struct file *file,
63168+ const unsigned long prot);
63169+int gr_check_hidden_task(const struct task_struct *tsk);
63170+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
63171+ const struct vfsmount *mnt);
63172+__u32 gr_acl_handle_utime(const struct dentry *dentry,
63173+ const struct vfsmount *mnt);
63174+__u32 gr_acl_handle_access(const struct dentry *dentry,
63175+ const struct vfsmount *mnt, const int fmode);
63176+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
63177+ const struct vfsmount *mnt, mode_t mode);
63178+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
63179+ const struct vfsmount *mnt, mode_t mode);
63180+__u32 gr_acl_handle_chown(const struct dentry *dentry,
63181+ const struct vfsmount *mnt);
bc901d79
MT		 63182+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
63183+ const struct vfsmount *mnt);
58c5fc13
MT		 63184+int gr_handle_ptrace(struct task_struct *task, const long request);
63185+int gr_handle_proc_ptrace(struct task_struct *task);
63186+__u32 gr_acl_handle_execve(const struct dentry *dentry,
63187+ const struct vfsmount *mnt);
63188+int gr_check_crash_exec(const struct file *filp);
63189+int gr_acl_is_enabled(void);
63190+void gr_set_kernel_label(struct task_struct *task);
63191+void gr_set_role_label(struct task_struct *task, const uid_t uid,
63192+ const gid_t gid);
63193+int gr_set_proc_label(const struct dentry *dentry,
63194+ const struct vfsmount *mnt,
63195+ const int unsafe_share);
63196+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
63197+ const struct vfsmount *mnt);
63198+__u32 gr_acl_handle_open(const struct dentry *dentry,
63199+ const struct vfsmount *mnt, const int fmode);
63200+__u32 gr_acl_handle_creat(const struct dentry *dentry,
63201+ const struct dentry *p_dentry,
63202+ const struct vfsmount *p_mnt, const int fmode,
63203+ const int imode);
63204+void gr_handle_create(const struct dentry *dentry,
63205+ const struct vfsmount *mnt);
63206+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
63207+ const struct dentry *parent_dentry,
63208+ const struct vfsmount *parent_mnt,
63209+ const int mode);
63210+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
63211+ const struct dentry *parent_dentry,
63212+ const struct vfsmount *parent_mnt);
63213+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
63214+ const struct vfsmount *mnt);
63215+void gr_handle_delete(const ino_t ino, const dev_t dev);
63216+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
63217+ const struct vfsmount *mnt);
63218+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
63219+ const struct dentry *parent_dentry,
63220+ const struct vfsmount *parent_mnt,
63221+ const char *from);
63222+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
63223+ const struct dentry *parent_dentry,
63224+ const struct vfsmount *parent_mnt,
63225+ const struct dentry *old_dentry,
63226+ const struct vfsmount *old_mnt, const char *to);
63227+int gr_acl_handle_rename(struct dentry *new_dentry,
63228+ struct dentry *parent_dentry,
63229+ const struct vfsmount *parent_mnt,
63230+ struct dentry *old_dentry,
63231+ struct inode *old_parent_inode,
63232+ struct vfsmount *old_mnt, const char *newname);
63233+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
63234+ struct dentry *old_dentry,
63235+ struct dentry *new_dentry,
63236+ struct vfsmount *mnt, const __u8 replace);
63237+__u32 gr_check_link(const struct dentry *new_dentry,
63238+ const struct dentry *parent_dentry,
63239+ const struct vfsmount *parent_mnt,
63240+ const struct dentry *old_dentry,
63241+ const struct vfsmount *old_mnt);
63242+int gr_acl_handle_filldir(const struct file *file, const char *name,
63243+ const unsigned int namelen, const ino_t ino);
63244+
63245+__u32 gr_acl_handle_unix(const struct dentry *dentry,
63246+ const struct vfsmount *mnt);
63247+void gr_acl_handle_exit(void);
63248+void gr_acl_handle_psacct(struct task_struct *task, const long code);
63249+int gr_acl_handle_procpidmem(const struct task_struct *task);
ae4e228f
MT		 63250+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
63251+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
63252+void gr_audit_ptrace(struct task_struct *task);
16454cff 63253+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
58c5fc13
MT		 63254+
63255+#ifdef CONFIG_GRKERNSEC
6892158b 63256+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
ae4e228f 63257+void gr_handle_vm86(void);
71d190be 63258+void gr_handle_mem_readwrite(u64 from, u64 to);
58c5fc13
MT		 63259+
63260+extern int grsec_enable_dmesg;
df50ba0c 63261+extern int grsec_disable_privio;
58c5fc13
MT		 63262+#endif
63263+
63264+#endif
66a7e928
MT		 63265diff -urNp linux-2.6.39/include/linux/grsock.h linux-2.6.39/include/linux/grsock.h
63266--- linux-2.6.39/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
63267+++ linux-2.6.39/include/linux/grsock.h 2011-05-22 19:41:42.000000000 -0400
ae4e228f
MT		 63268@@ -0,0 +1,19 @@
63269+#ifndef __GRSOCK_H
63270+#define __GRSOCK_H
63271+
63272+extern void gr_attach_curr_ip(const struct sock *sk);
63273+extern int gr_handle_sock_all(const int family, const int type,
63274+ const int protocol);
63275+extern int gr_handle_sock_server(const struct sockaddr *sck);
df50ba0c 63276+extern int gr_handle_sock_server_other(const struct sock *sck);
ae4e228f
MT		 63277+extern int gr_handle_sock_client(const struct sockaddr *sck);
63278+extern int gr_search_connect(struct socket * sock,
63279+ struct sockaddr_in * addr);
63280+extern int gr_search_bind(struct socket * sock,
63281+ struct sockaddr_in * addr);
63282+extern int gr_search_listen(struct socket * sock);
63283+extern int gr_search_accept(struct socket * sock);
63284+extern int gr_search_socket(const int domain, const int type,
63285+ const int protocol);
63286+
63287+#endif
66a7e928
MT		 63288diff -urNp linux-2.6.39/include/linux/highmem.h linux-2.6.39/include/linux/highmem.h
63289--- linux-2.6.39/include/linux/highmem.h 2011-05-19 00:06:34.000000000 -0400
63290+++ linux-2.6.39/include/linux/highmem.h 2011-05-22 19:36:33.000000000 -0400
16454cff 63291@@ -185,6 +185,18 @@ static inline void clear_highpage(struct
58c5fc13
MT		 63292 kunmap_atomic(kaddr, KM_USER0);
63293 }
63294
63295+static inline void sanitize_highpage(struct page *page)
63296+{
63297+ void *kaddr;
63298+ unsigned long flags;
63299+
63300+ local_irq_save(flags);
63301+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
63302+ clear_page(kaddr);
63303+ kunmap_atomic(kaddr, KM_CLEARPAGE);
63304+ local_irq_restore(flags);
63305+}
63306+
63307 static inline void zero_user_segments(struct page *page,
63308 unsigned start1, unsigned end1,
63309 unsigned start2, unsigned end2)
66a7e928
MT		 63310diff -urNp linux-2.6.39/include/linux/i2o.h linux-2.6.39/include/linux/i2o.h
63311--- linux-2.6.39/include/linux/i2o.h 2011-05-19 00:06:34.000000000 -0400
63312+++ linux-2.6.39/include/linux/i2o.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 63313@@ -564,7 +564,7 @@ struct i2o_controller {
63314 struct i2o_device *exec; /* Executive */
63315 #if BITS_PER_LONG == 64
63316 spinlock_t context_list_lock; /* lock for context_list */
63317- atomic_t context_list_counter; /* needed for unique contexts */
63318+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
63319 struct list_head context_list; /* list of context id's
63320 and pointers */
63321 #endif
66a7e928
MT		 63322diff -urNp linux-2.6.39/include/linux/if_phonet.h linux-2.6.39/include/linux/if_phonet.h
63323--- linux-2.6.39/include/linux/if_phonet.h 2011-05-19 00:06:34.000000000 -0400
63324+++ linux-2.6.39/include/linux/if_phonet.h 2011-05-22 19:36:33.000000000 -0400
63325@@ -13,7 +13,7 @@
63326 #define PHONET_DEV_MTU PHONET_MAX_MTU
63327
63328 #ifdef __KERNEL__
63329-extern struct header_ops phonet_header_ops;
63330+extern const struct header_ops phonet_header_ops;
63331 #endif
63332
63333 #endif
63334diff -urNp linux-2.6.39/include/linux/init.h linux-2.6.39/include/linux/init.h
63335--- linux-2.6.39/include/linux/init.h 2011-05-19 00:06:34.000000000 -0400
63336+++ linux-2.6.39/include/linux/init.h 2011-05-22 19:36:33.000000000 -0400
bc901d79 63337@@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
6892158b
MT		 63338
63339 /* Each module must use one module_init(). */
63340 #define module_init(initfn) \
63341- static inline initcall_t __inittest(void) \
63342+ static inline __used initcall_t __inittest(void) \
63343 { return initfn; } \
63344 int init_module(void) __attribute__((alias(#initfn)));
63345
63346 /* This is only required if you want to be unloadable. */
63347 #define module_exit(exitfn) \
63348- static inline exitcall_t __exittest(void) \
63349+ static inline __used exitcall_t __exittest(void) \
63350 { return exitfn; } \
63351 void cleanup_module(void) __attribute__((alias(#exitfn)));
63352
66a7e928
MT		 63353diff -urNp linux-2.6.39/include/linux/init_task.h linux-2.6.39/include/linux/init_task.h
63354--- linux-2.6.39/include/linux/init_task.h 2011-05-19 00:06:34.000000000 -0400
63355+++ linux-2.6.39/include/linux/init_task.h 2011-05-22 19:36:33.000000000 -0400
63356@@ -83,6 +83,12 @@ extern struct group_info init_groups;
71d190be
MT		 63357 #define INIT_IDS
63358 #endif
63359
63360+#ifdef CONFIG_X86
63361+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
63362+#else
63363+#define INIT_TASK_THREAD_INFO
63364+#endif
63365+
63366 /*
63367 * Because of the reduced scope of CAP_SETPCAP when filesystem
63368 * capabilities are in effect, it is safe to allow CAP_SETPCAP to
66a7e928 63369@@ -163,6 +169,7 @@ extern struct cred init_cred;
71d190be
MT		 63370 RCU_INIT_POINTER(.cred, &init_cred), \
63371 .comm = "swapper", \
63372 .thread = INIT_THREAD, \
63373+ INIT_TASK_THREAD_INFO \
63374 .fs = &init_fs, \
63375 .files = &init_files, \
63376 .signal = &init_signals, \
66a7e928
MT		 63377diff -urNp linux-2.6.39/include/linux/interrupt.h linux-2.6.39/include/linux/interrupt.h
63378--- linux-2.6.39/include/linux/interrupt.h 2011-05-19 00:06:34.000000000 -0400
63379+++ linux-2.6.39/include/linux/interrupt.h 2011-05-22 19:36:33.000000000 -0400
63380@@ -422,7 +422,7 @@ enum
ae4e228f
MT		 63381 /* map softirq index to softirq name. update 'softirq_to_name' in
63382 * kernel/softirq.c when adding a new softirq.
63383 */
63384-extern char *softirq_to_name[NR_SOFTIRQS];
63385+extern const char * const softirq_to_name[NR_SOFTIRQS];
63386
63387 /* softirq mask and active fields moved to irq_cpustat_t in
63388 * asm/hardirq.h to get better cache usage. KAO
66a7e928 63389@@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
ae4e228f
MT		 63390
63391 struct softirq_action
63392 {
63393- void (*action)(struct softirq_action *);
63394+ void (*action)(void);
63395 };
63396
63397 asmlinkage void do_softirq(void);
63398 asmlinkage void __do_softirq(void);
63399-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
63400+extern void open_softirq(int nr, void (*action)(void));
63401 extern void softirq_init(void);
bc901d79
MT		 63402 static inline void __raise_softirq_irqoff(unsigned int nr)
63403 {
66a7e928
MT		 63404diff -urNp linux-2.6.39/include/linux/iommu.h linux-2.6.39/include/linux/iommu.h
63405--- linux-2.6.39/include/linux/iommu.h 2011-05-19 00:06:34.000000000 -0400
63406+++ linux-2.6.39/include/linux/iommu.h 2011-05-22 19:36:33.000000000 -0400
63407@@ -49,7 +49,7 @@ struct iommu_ops {
63408
63409 #ifdef CONFIG_IOMMU_API
63410
63411-extern void register_iommu(struct iommu_ops *ops);
63412+extern void register_iommu(const struct iommu_ops *ops);
63413 extern bool iommu_found(void);
63414 extern struct iommu_domain *iommu_domain_alloc(void);
63415 extern void iommu_domain_free(struct iommu_domain *domain);
63416diff -urNp linux-2.6.39/include/linux/ipmi.h linux-2.6.39/include/linux/ipmi.h
63417--- linux-2.6.39/include/linux/ipmi.h 2011-05-19 00:06:34.000000000 -0400
63418+++ linux-2.6.39/include/linux/ipmi.h 2011-05-22 19:36:33.000000000 -0400
63419@@ -282,7 +282,7 @@ struct ipmi_user_hndl {
63420
63421 /* Create a new user of the IPMI layer on the given interface number. */
63422 int ipmi_create_user(unsigned int if_num,
63423- struct ipmi_user_hndl *handler,
63424+ const struct ipmi_user_hndl *handler,
63425 void *handler_data,
63426 ipmi_user_t *user);
63427
63428diff -urNp linux-2.6.39/include/linux/kallsyms.h linux-2.6.39/include/linux/kallsyms.h
63429--- linux-2.6.39/include/linux/kallsyms.h 2011-05-19 00:06:34.000000000 -0400
63430+++ linux-2.6.39/include/linux/kallsyms.h 2011-05-22 22:52:54.000000000 -0400
58c5fc13
MT		 63431@@ -15,7 +15,8 @@
63432
63433 struct module;
63434
63435-#ifdef CONFIG_KALLSYMS
bc901d79 63436+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
58c5fc13
MT		 63437+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63438 /* Lookup the address for a symbol. Returns 0 if not found. */
63439 unsigned long kallsyms_lookup_name(const char *name);
63440
66a7e928 63441@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
58c5fc13
MT		 63442 /* Stupid that this does nothing, but I didn't create this mess. */
63443 #define __print_symbol(fmt, addr)
63444 #endif /*CONFIG_KALLSYMS*/
bc901d79
MT		 63445+#else /* when included by kallsyms.c, vsnprintf.c, or
63446+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
58c5fc13 63447+extern void __print_symbol(const char *fmt, unsigned long address);
66a7e928 63448+extern int sprint_backtrace(char *buffer, unsigned long address);
bc901d79
MT		 63449+extern int sprint_symbol(char *buffer, unsigned long address);
63450+const char *kallsyms_lookup(unsigned long addr,
63451+ unsigned long *symbolsize,
63452+ unsigned long *offset,
63453+ char **modname, char *namebuf);
58c5fc13
MT		 63454+#endif
63455
63456 /* This macro allows us to keep printk typechecking */
63457 static void __check_printsym_format(const char *fmt, ...)
66a7e928
MT		 63458diff -urNp linux-2.6.39/include/linux/kgdb.h linux-2.6.39/include/linux/kgdb.h
63459--- linux-2.6.39/include/linux/kgdb.h 2011-05-19 00:06:34.000000000 -0400
63460+++ linux-2.6.39/include/linux/kgdb.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 63461@@ -53,7 +53,7 @@ extern int kgdb_connected;
63462 extern int kgdb_io_module_registered;
63463
63464 extern atomic_t kgdb_setting_breakpoint;
63465-extern atomic_t kgdb_cpu_doing_single_step;
63466+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
63467
63468 extern struct task_struct *kgdb_usethread;
63469 extern struct task_struct *kgdb_contthread;
bc901d79 63470@@ -269,22 +269,22 @@ struct kgdb_arch {
ae4e228f
MT		 63471 */
63472 struct kgdb_io {
63473 const char *name;
63474- int (*read_char) (void);
63475- void (*write_char) (u8);
63476- void (*flush) (void);
63477- int (*init) (void);
63478- void (*pre_exception) (void);
63479- void (*post_exception) (void);
63480+ int (* const read_char) (void);
63481+ void (* const write_char) (u8);
63482+ void (* const flush) (void);
63483+ int (* const init) (void);
63484+ void (* const pre_exception) (void);
63485+ void (* const post_exception) (void);
57199397 63486 int is_console;
ae4e228f
MT		 63487 };
63488
63489-extern struct kgdb_arch arch_kgdb_ops;
63490+extern const struct kgdb_arch arch_kgdb_ops;
63491
63492 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
63493
63494-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
63495-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
57199397 63496-extern struct kgdb_io *dbg_io_ops;
ae4e228f
MT		 63497+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
63498+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
57199397 63499+extern const struct kgdb_io *dbg_io_ops;
ae4e228f
MT		 63500
63501 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
6892158b 63502 extern char *kgdb_mem2hex(char *mem, char *buf, int count);
66a7e928
MT		 63503diff -urNp linux-2.6.39/include/linux/kmod.h linux-2.6.39/include/linux/kmod.h
63504--- linux-2.6.39/include/linux/kmod.h 2011-05-19 00:06:34.000000000 -0400
63505+++ linux-2.6.39/include/linux/kmod.h 2011-05-22 19:41:42.000000000 -0400
71d190be
MT		 63506@@ -33,6 +33,8 @@ extern char modprobe_path[]; /* for sysc
63507 * usually useless though. */
63508 extern int __request_module(bool wait, const char *name, ...) \
63509 __attribute__((format(printf, 2, 3)));
63510+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
63511+ __attribute__((format(printf, 3, 4)));
63512 #define request_module(mod...) __request_module(true, mod)
63513 #define request_module_nowait(mod...) __request_module(false, mod)
63514 #define try_then_request_module(x, mod...) \
66a7e928
MT		 63515diff -urNp linux-2.6.39/include/linux/kvm_host.h linux-2.6.39/include/linux/kvm_host.h
63516--- linux-2.6.39/include/linux/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
63517+++ linux-2.6.39/include/linux/kvm_host.h 2011-05-22 19:36:33.000000000 -0400
63518@@ -302,7 +302,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
58c5fc13
MT		 63519 void vcpu_load(struct kvm_vcpu *vcpu);
63520 void vcpu_put(struct kvm_vcpu *vcpu);
63521
57199397
MT		 63522-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63523+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
58c5fc13
MT		 63524 struct module *module);
63525 void kvm_exit(void);
63526
66a7e928 63527@@ -442,7 +442,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
58c5fc13
MT		 63528 struct kvm_guest_debug *dbg);
63529 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
63530
63531-int kvm_arch_init(void *opaque);
63532+int kvm_arch_init(const void *opaque);
63533 void kvm_arch_exit(void);
63534
63535 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
66a7e928
MT		 63536diff -urNp linux-2.6.39/include/linux/lapb.h linux-2.6.39/include/linux/lapb.h
63537--- linux-2.6.39/include/linux/lapb.h 2011-05-19 00:06:34.000000000 -0400
63538+++ linux-2.6.39/include/linux/lapb.h 2011-05-22 19:36:33.000000000 -0400
63539@@ -44,7 +44,7 @@ struct lapb_parms_struct {
63540 unsigned int mode;
63541 };
63542
63543-extern int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks);
63544+extern int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks);
63545 extern int lapb_unregister(struct net_device *dev);
63546 extern int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms);
63547 extern int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms);
63548diff -urNp linux-2.6.39/include/linux/lcd.h linux-2.6.39/include/linux/lcd.h
63549--- linux-2.6.39/include/linux/lcd.h 2011-05-19 00:06:34.000000000 -0400
63550+++ linux-2.6.39/include/linux/lcd.h 2011-05-22 19:36:33.000000000 -0400
63551@@ -60,7 +60,7 @@ struct lcd_device {
63552 points to something in the body of that driver, it is also invalid. */
63553 struct mutex ops_lock;
63554 /* If this is NULL, the backing module is unloaded */
63555- struct lcd_ops *ops;
63556+ const struct lcd_ops *ops;
63557 /* Serialise access to set_power method */
63558 struct mutex update_lock;
63559 /* The framebuffer notifier block */
63560@@ -101,7 +101,7 @@ static inline void lcd_set_power(struct
63561 }
63562
63563 extern struct lcd_device *lcd_device_register(const char *name,
63564- struct device *parent, void *devdata, struct lcd_ops *ops);
63565+ struct device *parent, void *devdata, const struct lcd_ops *ops);
63566 extern void lcd_device_unregister(struct lcd_device *ld);
63567
63568 #define to_lcd_device(obj) container_of(obj, struct lcd_device, dev)
63569diff -urNp linux-2.6.39/include/linux/libata.h linux-2.6.39/include/linux/libata.h
63570--- linux-2.6.39/include/linux/libata.h 2011-05-19 00:06:34.000000000 -0400
63571+++ linux-2.6.39/include/linux/libata.h 2011-05-22 19:36:33.000000000 -0400
63572@@ -524,11 +524,11 @@ struct ata_ioports {
ae4e228f
MT		 63573
63574 struct ata_host {
63575 spinlock_t lock;
63576- struct device *dev;
63577+ struct device *dev;
63578 void __iomem * const *iomap;
63579 unsigned int n_ports;
63580 void *private_data;
63581- struct ata_port_operations *ops;
63582+ const struct ata_port_operations *ops;
63583 unsigned long flags;
bc901d79
MT		 63584
63585 struct mutex eh_mutex;
66a7e928 63586@@ -719,7 +719,7 @@ struct ata_link {
ae4e228f
MT		 63587
63588 struct ata_port {
63589 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
63590- struct ata_port_operations *ops;
63591+ const struct ata_port_operations *ops;
63592 spinlock_t *lock;
63593 /* Flags owned by the EH context. Only EH should touch these once the
63594 port is active */
66a7e928 63595@@ -907,7 +907,7 @@ struct ata_port_info {
ae4e228f
MT		 63596 unsigned long pio_mask;
63597 unsigned long mwdma_mask;
63598 unsigned long udma_mask;
63599- struct ata_port_operations *port_ops;
63600+ const struct ata_port_operations *port_ops;
63601 void *private_data;
63602 };
63603
66a7e928 63604@@ -931,7 +931,7 @@ extern const unsigned long sata_deb_timi
ae4e228f
MT		 63605 extern const unsigned long sata_deb_timing_hotplug[];
63606 extern const unsigned long sata_deb_timing_long[];
63607
63608-extern struct ata_port_operations ata_dummy_port_ops;
63609+extern const struct ata_port_operations ata_dummy_port_ops;
63610 extern const struct ata_port_info ata_dummy_port_info;
63611
63612 static inline const unsigned long *
66a7e928 63613@@ -977,7 +977,7 @@ extern int ata_host_activate(struct ata_
ae4e228f
MT		 63614 struct scsi_host_template *sht);
63615 extern void ata_host_detach(struct ata_host *host);
63616 extern void ata_host_init(struct ata_host *, struct device *,
63617- unsigned long, struct ata_port_operations *);
63618+ unsigned long, const struct ata_port_operations *);
63619 extern int ata_scsi_detect(struct scsi_host_template *sht);
63620 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
bc901d79 63621 extern int ata_scsi_queuecmd(struct Scsi_Host *h, struct scsi_cmnd *cmd);
66a7e928
MT		 63622diff -urNp linux-2.6.39/include/linux/lockd/bind.h linux-2.6.39/include/linux/lockd/bind.h
63623--- linux-2.6.39/include/linux/lockd/bind.h 2011-05-19 00:06:34.000000000 -0400
63624+++ linux-2.6.39/include/linux/lockd/bind.h 2011-05-22 19:36:33.000000000 -0400
ae4e228f
MT		 63625@@ -23,13 +23,13 @@ struct svc_rqst;
63626 * This is the set of functions for lockd->nfsd communication
63627 */
63628 struct nlmsvc_binding {
63629- __be32 (*fopen)(struct svc_rqst *,
63630+ __be32 (* const fopen)(struct svc_rqst *,
63631 struct nfs_fh *,
63632 struct file **);
63633- void (*fclose)(struct file *);
63634+ void (* const fclose)(struct file *);
63635 };
63636
63637-extern struct nlmsvc_binding * nlmsvc_ops;
63638+extern const struct nlmsvc_binding * nlmsvc_ops;
63639
63640 /*
63641 * Similar to nfs_client_initdata, but without the NFS-specific
66a7e928
MT		 63642diff -urNp linux-2.6.39/include/linux/mfd/abx500.h linux-2.6.39/include/linux/mfd/abx500.h
63643--- linux-2.6.39/include/linux/mfd/abx500.h 2011-05-19 00:06:34.000000000 -0400
63644+++ linux-2.6.39/include/linux/mfd/abx500.h 2011-05-22 19:36:33.000000000 -0400
63645@@ -227,6 +227,6 @@ struct abx500_ops {
63646 int (*startup_irq_enabled) (struct device *, unsigned int);
63647 };
63648
63649-int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
63650+int abx500_register_ops(struct device *core_dev, const struct abx500_ops *ops);
63651 void abx500_remove_ops(struct device *dev);
63652 #endif
63653diff -urNp linux-2.6.39/include/linux/mm.h linux-2.6.39/include/linux/mm.h
63654--- linux-2.6.39/include/linux/mm.h 2011-05-19 00:06:34.000000000 -0400
63655+++ linux-2.6.39/include/linux/mm.h 2011-05-22 19:36:33.000000000 -0400
16454cff 63656@@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
58c5fc13 63657
df50ba0c
MT		 63658 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
63659 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
63660+
63661+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
63662+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
63663+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
63664+#else
63665 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
58c5fc13
MT		 63666+#endif
63667+
df50ba0c
MT		 63668 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
63669 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
63670
66a7e928 63671@@ -1010,34 +1017,6 @@ int set_page_dirty(struct page *page);
bc901d79
MT		 63672 int set_page_dirty_lock(struct page *page);
63673 int clear_page_dirty_for_io(struct page *page);
63674
63675-/* Is the vma a continuation of the stack vma above it? */
66a7e928 63676-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
bc901d79
MT		 63677-{
63678- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
63679-}
66a7e928
MT		 63680-
63681-static inline int stack_guard_page_start(struct vm_area_struct *vma,
63682- unsigned long addr)
63683-{
63684- return (vma->vm_flags & VM_GROWSDOWN) &&
63685- (vma->vm_start == addr) &&
63686- !vma_growsdown(vma->vm_prev, addr);
63687-}
63688-
63689-/* Is the vma a continuation of the stack vma below it? */
63690-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
63691-{
63692- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
63693-}
63694-
63695-static inline int stack_guard_page_end(struct vm_area_struct *vma,
63696- unsigned long addr)
63697-{
63698- return (vma->vm_flags & VM_GROWSUP) &&
63699- (vma->vm_end == addr) &&
63700- !vma_growsup(vma->vm_next, addr);
63701-}
bc901d79
MT		 63702-
63703 extern unsigned long move_page_tables(struct vm_area_struct *vma,
63704 unsigned long old_addr, struct vm_area_struct *new_vma,
63705 unsigned long new_addr, unsigned long len);
66a7e928 63706@@ -1189,6 +1168,15 @@ struct shrinker {
58c5fc13
MT		 63707 extern void register_shrinker(struct shrinker *);
63708 extern void unregister_shrinker(struct shrinker *);
63709
6892158b 63710+#ifdef CONFIG_MMU
58c5fc13 63711+pgprot_t vm_get_page_prot(unsigned long vm_flags);
6892158b
MT		 63712+#else
63713+static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63714+{
63715+ return __pgprot(0);
63716+}
63717+#endif
58c5fc13
MT		 63718+
63719 int vma_wants_writenotify(struct vm_area_struct *vma);
63720
bc901d79 63721 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
66a7e928 63722@@ -1476,6 +1464,7 @@ out:
58c5fc13
MT		 63723 }
63724
63725 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
63726+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
63727
63728 extern unsigned long do_brk(unsigned long, unsigned long);
63729
66a7e928 63730@@ -1532,6 +1521,10 @@ extern struct vm_area_struct * find_vma(
58c5fc13
MT		 63731 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
63732 struct vm_area_struct **pprev);
63733
63734+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
df50ba0c 63735+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
58c5fc13
MT		 63736+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
63737+
63738 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
63739 NULL if none. Assume start_addr < end_addr. */
63740 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
66a7e928 63741@@ -1548,15 +1541,6 @@ static inline unsigned long vma_pages(st
58c5fc13
MT		 63742 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
63743 }
63744
6892158b 63745-#ifdef CONFIG_MMU
58c5fc13 63746-pgprot_t vm_get_page_prot(unsigned long vm_flags);
6892158b
MT		 63747-#else
63748-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63749-{
63750- return __pgprot(0);
63751-}
63752-#endif
63753-
58c5fc13
MT		 63754 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
63755 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
63756 unsigned long pfn, unsigned long size, pgprot_t);
66a7e928 63757@@ -1668,7 +1652,7 @@ extern int unpoison_memory(unsigned long
ae4e228f
MT		 63758 extern int sysctl_memory_failure_early_kill;
63759 extern int sysctl_memory_failure_recovery;
63760 extern void shake_page(struct page *p, int access);
63761-extern atomic_long_t mce_bad_pages;
63762+extern atomic_long_unchecked_t mce_bad_pages;
63763 extern int soft_offline_page(struct page *page, int flags);
66a7e928
MT		 63764
63765 extern void dump_page(struct page *page);
63766@@ -1682,5 +1666,11 @@ extern void copy_user_huge_page(struct p
16454cff
MT		 63767 unsigned int pages_per_huge_page);
63768 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
df50ba0c 63769
58c5fc13
MT		 63770+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
63771+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
63772+#else
63773+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
63774+#endif
63775+
63776 #endif /* __KERNEL__ */
63777 #endif /* _LINUX_MM_H */
66a7e928
MT		 63778diff -urNp linux-2.6.39/include/linux/mm_types.h linux-2.6.39/include/linux/mm_types.h
63779--- linux-2.6.39/include/linux/mm_types.h 2011-05-19 00:06:34.000000000 -0400
63780+++ linux-2.6.39/include/linux/mm_types.h 2011-05-22 19:36:33.000000000 -0400
df50ba0c 63781@@ -183,6 +183,8 @@ struct vm_area_struct {
58c5fc13
MT		 63782 #ifdef CONFIG_NUMA
63783 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
63784 #endif
63785+
63786+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
63787 };
63788
63789 struct core_thread {
66a7e928
MT		 63790@@ -317,6 +319,24 @@ struct mm_struct {
63791 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
63792 pgtable_t pmd_huge_pte; /* protected by page_table_lock */
58c5fc13
MT		 63793 #endif
63794+
63795+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63796+ unsigned long pax_flags;
63797+#endif
63798+
63799+#ifdef CONFIG_PAX_DLRESOLVE
63800+ unsigned long call_dl_resolve;
63801+#endif
63802+
63803+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
63804+ unsigned long call_syscall;
63805+#endif
63806+
63807+#ifdef CONFIG_PAX_ASLR
63808+ unsigned long delta_mmap; /* randomized offset */
63809+ unsigned long delta_stack; /* randomized offset */
63810+#endif
63811+
63812 };
63813
63814 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
66a7e928
MT		 63815diff -urNp linux-2.6.39/include/linux/mmu_notifier.h linux-2.6.39/include/linux/mmu_notifier.h
63816--- linux-2.6.39/include/linux/mmu_notifier.h 2011-05-19 00:06:34.000000000 -0400
63817+++ linux-2.6.39/include/linux/mmu_notifier.h 2011-05-22 19:36:33.000000000 -0400
16454cff 63818@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
ae4e228f
MT		 63819 */
63820 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
63821 ({ \
63822- pte_t __pte; \
63823+ pte_t ___pte; \
63824 struct vm_area_struct *___vma = __vma; \
63825 unsigned long ___address = __address; \
63826- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
63827+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
63828 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
63829- __pte; \
63830+ ___pte; \
63831 })
63832
16454cff 63833 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
66a7e928
MT		 63834diff -urNp linux-2.6.39/include/linux/mmzone.h linux-2.6.39/include/linux/mmzone.h
63835--- linux-2.6.39/include/linux/mmzone.h 2011-05-19 00:06:34.000000000 -0400
63836+++ linux-2.6.39/include/linux/mmzone.h 2011-05-22 19:36:33.000000000 -0400
16454cff 63837@@ -355,7 +355,7 @@ struct zone {
57199397
MT		 63838 unsigned long flags; /* zone flags, see below */
63839
63840 /* Zone statistics */
63841- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63842+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63843
63844 /*
6892158b 63845 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
66a7e928
MT		 63846diff -urNp linux-2.6.39/include/linux/mod_devicetable.h linux-2.6.39/include/linux/mod_devicetable.h
63847--- linux-2.6.39/include/linux/mod_devicetable.h 2011-05-19 00:06:34.000000000 -0400
63848+++ linux-2.6.39/include/linux/mod_devicetable.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 63849@@ -12,7 +12,7 @@
63850 typedef unsigned long kernel_ulong_t;
63851 #endif
63852
63853-#define PCI_ANY_ID (~0)
63854+#define PCI_ANY_ID ((__u16)~0)
63855
63856 struct pci_device_id {
63857 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
63858@@ -131,7 +131,7 @@ struct usb_device_id {
63859 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
63860 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
63861
63862-#define HID_ANY_ID (~0)
63863+#define HID_ANY_ID (~0U)
63864
63865 struct hid_device_id {
63866 __u16 bus;
66a7e928
MT		 63867diff -urNp linux-2.6.39/include/linux/module.h linux-2.6.39/include/linux/module.h
63868--- linux-2.6.39/include/linux/module.h 2011-05-19 00:06:34.000000000 -0400
63869+++ linux-2.6.39/include/linux/module.h 2011-05-22 19:36:33.000000000 -0400
16454cff 63870@@ -324,19 +324,16 @@ struct module
58c5fc13
MT		 63871 int (*init)(void);
63872
63873 /* If this is non-NULL, vfree after init() returns */
63874- void *module_init;
63875+ void *module_init_rx, *module_init_rw;
63876
63877 /* Here is the actual code + data, vfree'd on unload. */
63878- void *module_core;
63879+ void *module_core_rx, *module_core_rw;
63880
63881 /* Here are the sizes of the init and core sections */
63882- unsigned int init_size, core_size;
63883+ unsigned int init_size_rw, core_size_rw;
63884
63885 /* The size of the executable code in each section. */
63886- unsigned int init_text_size, core_text_size;
16454cff
MT		 63887-
63888- /* Size of RO sections of the module (text+rodata) */
63889- unsigned int init_ro_size, core_ro_size;
58c5fc13
MT		 63890+ unsigned int init_size_rx, core_size_rx;
63891
63892 /* Arch-specific module values */
63893 struct mod_arch_specific arch;
16454cff 63894@@ -441,16 +438,46 @@ bool is_module_address(unsigned long add
df50ba0c 63895 bool is_module_percpu_address(unsigned long addr);
58c5fc13
MT		 63896 bool is_module_text_address(unsigned long addr);
63897
63898+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
63899+{
63900+
63901+#ifdef CONFIG_PAX_KERNEXEC
63902+ if (ktla_ktva(addr) >= (unsigned long)start &&
63903+ ktla_ktva(addr) < (unsigned long)start + size)
63904+ return 1;
63905+#endif
63906+
63907+ return ((void *)addr >= start && (void *)addr < start + size);
63908+}
63909+
63910+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
63911+{
63912+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
63913+}
63914+
63915+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
63916+{
63917+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
63918+}
63919+
63920+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
63921+{
63922+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
63923+}
63924+
63925+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
63926+{
63927+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
63928+}
63929+
63930 static inline int within_module_core(unsigned long addr, struct module *mod)
63931 {
63932- return (unsigned long)mod->module_core <= addr &&
63933- addr < (unsigned long)mod->module_core + mod->core_size;
63934+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
63935 }
63936
63937 static inline int within_module_init(unsigned long addr, struct module *mod)
63938 {
63939- return (unsigned long)mod->module_init <= addr &&
63940- addr < (unsigned long)mod->module_init + mod->init_size;
63941+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
63942 }
63943
63944 /* Search for module by name: must hold module_mutex. */
66a7e928
MT		 63945diff -urNp linux-2.6.39/include/linux/moduleloader.h linux-2.6.39/include/linux/moduleloader.h
63946--- linux-2.6.39/include/linux/moduleloader.h 2011-05-19 00:06:34.000000000 -0400
63947+++ linux-2.6.39/include/linux/moduleloader.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 63948@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
63949 sections. Returns NULL on failure. */
63950 void *module_alloc(unsigned long size);
63951
63952+#ifdef CONFIG_PAX_KERNEXEC
63953+void *module_alloc_exec(unsigned long size);
63954+#else
63955+#define module_alloc_exec(x) module_alloc(x)
63956+#endif
63957+
63958 /* Free memory returned from module_alloc. */
63959 void module_free(struct module *mod, void *module_region);
63960
63961+#ifdef CONFIG_PAX_KERNEXEC
63962+void module_free_exec(struct module *mod, void *module_region);
63963+#else
ae4e228f 63964+#define module_free_exec(x, y) module_free((x), (y))
58c5fc13
MT		 63965+#endif
63966+
63967 /* Apply the given relocation to the (simplified) ELF. Return -error
63968 or 0. */
63969 int apply_relocate(Elf_Shdr *sechdrs,
66a7e928
MT		 63970diff -urNp linux-2.6.39/include/linux/moduleparam.h linux-2.6.39/include/linux/moduleparam.h
63971--- linux-2.6.39/include/linux/moduleparam.h 2011-05-19 00:06:34.000000000 -0400
63972+++ linux-2.6.39/include/linux/moduleparam.h 2011-05-22 19:36:33.000000000 -0400
16454cff 63973@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
6892158b
MT		 63974 * @len is usually just sizeof(string).
63975 */
63976 #define module_param_string(name, string, len, perm) \
63977- static const struct kparam_string __param_string_##name \
63978+ static const struct kparam_string __param_string_##name __used \
63979 = { len, string }; \
63980 __module_param_call(MODULE_PARAM_PREFIX, name, \
63981 &param_ops_string, \
66a7e928
MT		 63982@@ -285,48 +285,48 @@ static inline void destroy_params(const
63983 #define __param_check(name, p, type) \
63984 static inline type *__check_##name(void) { return(p); }
63985
63986-extern struct kernel_param_ops param_ops_byte;
63987+extern const struct kernel_param_ops param_ops_byte;
63988 extern int param_set_byte(const char *val, const struct kernel_param *kp);
63989 extern int param_get_byte(char *buffer, const struct kernel_param *kp);
63990 #define param_check_byte(name, p) __param_check(name, p, unsigned char)
63991
63992-extern struct kernel_param_ops param_ops_short;
63993+extern const struct kernel_param_ops param_ops_short;
63994 extern int param_set_short(const char *val, const struct kernel_param *kp);
63995 extern int param_get_short(char *buffer, const struct kernel_param *kp);
63996 #define param_check_short(name, p) __param_check(name, p, short)
63997
63998-extern struct kernel_param_ops param_ops_ushort;
63999+extern const struct kernel_param_ops param_ops_ushort;
64000 extern int param_set_ushort(const char *val, const struct kernel_param *kp);
64001 extern int param_get_ushort(char *buffer, const struct kernel_param *kp);
64002 #define param_check_ushort(name, p) __param_check(name, p, unsigned short)
64003
64004-extern struct kernel_param_ops param_ops_int;
64005+extern const struct kernel_param_ops param_ops_int;
64006 extern int param_set_int(const char *val, const struct kernel_param *kp);
64007 extern int param_get_int(char *buffer, const struct kernel_param *kp);
64008 #define param_check_int(name, p) __param_check(name, p, int)
64009
64010-extern struct kernel_param_ops param_ops_uint;
64011+extern const struct kernel_param_ops param_ops_uint;
64012 extern int param_set_uint(const char *val, const struct kernel_param *kp);
64013 extern int param_get_uint(char *buffer, const struct kernel_param *kp);
64014 #define param_check_uint(name, p) __param_check(name, p, unsigned int)
64015
64016-extern struct kernel_param_ops param_ops_long;
64017+extern const struct kernel_param_ops param_ops_long;
64018 extern int param_set_long(const char *val, const struct kernel_param *kp);
64019 extern int param_get_long(char *buffer, const struct kernel_param *kp);
64020 #define param_check_long(name, p) __param_check(name, p, long)
64021
64022-extern struct kernel_param_ops param_ops_ulong;
64023+extern const struct kernel_param_ops param_ops_ulong;
64024 extern int param_set_ulong(const char *val, const struct kernel_param *kp);
64025 extern int param_get_ulong(char *buffer, const struct kernel_param *kp);
64026 #define param_check_ulong(name, p) __param_check(name, p, unsigned long)
64027
64028-extern struct kernel_param_ops param_ops_charp;
64029+extern const struct kernel_param_ops param_ops_charp;
64030 extern int param_set_charp(const char *val, const struct kernel_param *kp);
64031 extern int param_get_charp(char *buffer, const struct kernel_param *kp);
64032 #define param_check_charp(name, p) __param_check(name, p, char *)
64033
64034 /* For historical reasons "bool" parameters can be (unsigned) "int". */
64035-extern struct kernel_param_ops param_ops_bool;
64036+extern const struct kernel_param_ops param_ops_bool;
64037 extern int param_set_bool(const char *val, const struct kernel_param *kp);
64038 extern int param_get_bool(char *buffer, const struct kernel_param *kp);
64039 #define param_check_bool(name, p) \
64040@@ -337,7 +337,7 @@ extern int param_get_bool(char *buffer,
64041 !__same_type((p), int *)); \
64042 }
64043
64044-extern struct kernel_param_ops param_ops_invbool;
64045+extern const struct kernel_param_ops param_ops_invbool;
64046 extern int param_set_invbool(const char *val, const struct kernel_param *kp);
64047 extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
64048 #define param_check_invbool(name, p) __param_check(name, p, bool)
16454cff 64049@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
6892158b
MT		 64050 * module_param_named() for why this might be necessary.
64051 */
64052 #define module_param_array_named(name, array, type, nump, perm) \
64053- static const struct kparam_array __param_arr_##name \
64054+ static const struct kparam_array __param_arr_##name __used \
64055 = { ARRAY_SIZE(array), nump, &param_ops_##type, \
64056 sizeof(array[0]), array }; \
64057 __module_param_call(MODULE_PARAM_PREFIX, name, \
66a7e928
MT		 64058@@ -379,9 +379,9 @@ extern int param_get_invbool(char *buffe
64059 __same_type(array[0], bool), perm); \
64060 __MODULE_PARM_TYPE(name, "array of " #type)
64061
64062-extern struct kernel_param_ops param_array_ops;
64063+extern const struct kernel_param_ops param_array_ops;
64064
64065-extern struct kernel_param_ops param_ops_string;
64066+extern const struct kernel_param_ops param_ops_string;
64067 extern int param_set_copystring(const char *val, const struct kernel_param *);
64068 extern int param_get_string(char *buffer, const struct kernel_param *kp);
64069
64070diff -urNp linux-2.6.39/include/linux/mutex.h linux-2.6.39/include/linux/mutex.h
64071--- linux-2.6.39/include/linux/mutex.h 2011-05-19 00:06:34.000000000 -0400
64072+++ linux-2.6.39/include/linux/mutex.h 2011-05-22 19:36:33.000000000 -0400
71d190be
MT		 64073@@ -51,7 +51,7 @@ struct mutex {
64074 spinlock_t wait_lock;
64075 struct list_head wait_list;
64076 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
64077- struct thread_info *owner;
64078+ struct task_struct *owner;
64079 #endif
64080 #ifdef CONFIG_DEBUG_MUTEXES
64081 const char *name;
66a7e928
MT		 64082diff -urNp linux-2.6.39/include/linux/namei.h linux-2.6.39/include/linux/namei.h
64083--- linux-2.6.39/include/linux/namei.h 2011-05-19 00:06:34.000000000 -0400
64084+++ linux-2.6.39/include/linux/namei.h 2011-05-22 19:36:33.000000000 -0400
64085@@ -24,7 +24,7 @@ struct nameidata {
16454cff 64086 unsigned seq;
58c5fc13
MT		 64087 int last_type;
64088 unsigned depth;
64089- char *saved_names[MAX_NESTED_LINKS + 1];
64090+ const char *saved_names[MAX_NESTED_LINKS + 1];
64091
64092 /* Intent data */
64093 union {
66a7e928 64094@@ -91,12 +91,12 @@ extern int follow_up(struct path *);
58c5fc13
MT		 64095 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
64096 extern void unlock_rename(struct dentry *, struct dentry *);
64097
64098-static inline void nd_set_link(struct nameidata *nd, char *path)
64099+static inline void nd_set_link(struct nameidata *nd, const char *path)
64100 {
64101 nd->saved_names[nd->depth] = path;
64102 }
64103
64104-static inline char *nd_get_link(struct nameidata *nd)
ae4e228f 64105+static inline const char *nd_get_link(const struct nameidata *nd)
58c5fc13
MT		 64106 {
64107 return nd->saved_names[nd->depth];
64108 }
66a7e928
MT		 64109diff -urNp linux-2.6.39/include/linux/netfilter/xt_gradm.h linux-2.6.39/include/linux/netfilter/xt_gradm.h
64110--- linux-2.6.39/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
64111+++ linux-2.6.39/include/linux/netfilter/xt_gradm.h 2011-05-22 19:41:42.000000000 -0400
6892158b
MT		 64112@@ -0,0 +1,9 @@
64113+#ifndef _LINUX_NETFILTER_XT_GRADM_H
64114+#define _LINUX_NETFILTER_XT_GRADM_H 1
64115+
64116+struct xt_gradm_mtinfo {
64117+ __u16 flags;
64118+ __u16 invflags;
64119+};
64120+
64121+#endif
66a7e928
MT		 64122diff -urNp linux-2.6.39/include/linux/oprofile.h linux-2.6.39/include/linux/oprofile.h
64123--- linux-2.6.39/include/linux/oprofile.h 2011-05-19 00:06:34.000000000 -0400
64124+++ linux-2.6.39/include/linux/oprofile.h 2011-05-22 19:36:33.000000000 -0400
64125@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
ae4e228f
MT		 64126 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
64127 char const * name, ulong * val);
58c5fc13 64128
ae4e228f
MT		 64129-/** Create a file for read-only access to an atomic_t. */
64130+/** Create a file for read-only access to an atomic_unchecked_t. */
58c5fc13
MT		 64131 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
64132- char const * name, atomic_t * val);
64133+ char const * name, atomic_unchecked_t * val);
64134
64135 /** create a directory */
64136 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
66a7e928
MT		 64137diff -urNp linux-2.6.39/include/linux/padata.h linux-2.6.39/include/linux/padata.h
64138--- linux-2.6.39/include/linux/padata.h 2011-05-19 00:06:34.000000000 -0400
64139+++ linux-2.6.39/include/linux/padata.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 64140@@ -129,7 +129,7 @@ struct parallel_data {
64141 struct padata_instance *pinst;
64142 struct padata_parallel_queue __percpu *pqueue;
64143 struct padata_serial_queue __percpu *squeue;
64144- atomic_t seq_nr;
64145+ atomic_unchecked_t seq_nr;
64146 atomic_t reorder_objects;
64147 atomic_t refcnt;
64148 unsigned int max_seq_nr;
66a7e928
MT		 64149diff -urNp linux-2.6.39/include/linux/pci.h linux-2.6.39/include/linux/pci.h
64150--- linux-2.6.39/include/linux/pci.h 2011-05-19 00:06:34.000000000 -0400
64151+++ linux-2.6.39/include/linux/pci.h 2011-05-22 19:36:33.000000000 -0400
64152@@ -411,7 +411,7 @@ struct pci_bus {
64153 struct resource *resource[PCI_BRIDGE_RESOURCE_NUM];
64154 struct list_head resources; /* address space routed to this bus */
64155
64156- struct pci_ops *ops; /* configuration access functions */
64157+ const struct pci_ops *ops; /* configuration access functions */
64158 void *sysdata; /* hook for sys-specific extension */
64159 struct proc_dir_entry *procdir; /* directory entry in /proc/bus/pci */
64160
64161@@ -550,7 +550,7 @@ struct pci_driver {
64162 int (*resume_early) (struct pci_dev *dev);
64163 int (*resume) (struct pci_dev *dev); /* Device woken up */
64164 void (*shutdown) (struct pci_dev *dev);
64165- struct pci_error_handlers *err_handler;
64166+ const struct pci_error_handlers *err_handler;
64167 struct device_driver driver;
64168 struct pci_dynids dynids;
64169 };
64170@@ -639,7 +639,7 @@ void pcibios_scan_specific_bus(int busn)
64171 extern struct pci_bus *pci_find_bus(int domain, int busnr);
64172 void pci_bus_add_devices(const struct pci_bus *bus);
64173 struct pci_bus *pci_scan_bus_parented(struct device *parent, int bus,
64174- struct pci_ops *ops, void *sysdata);
64175+ const struct pci_ops *ops, void *sysdata);
64176 static inline struct pci_bus * __devinit pci_scan_bus(int bus, struct pci_ops *ops,
64177 void *sysdata)
64178 {
64179@@ -650,7 +650,7 @@ static inline struct pci_bus * __devinit
64180 return root_bus;
64181 }
64182 struct pci_bus *pci_create_bus(struct device *parent, int bus,
64183- struct pci_ops *ops, void *sysdata);
64184+ const struct pci_ops *ops, void *sysdata);
64185 struct pci_bus *pci_add_new_bus(struct pci_bus *parent, struct pci_dev *dev,
64186 int busnr);
64187 void pcie_update_link_speed(struct pci_bus *bus, u16 link_status);
64188@@ -727,7 +727,7 @@ int pci_bus_write_config_word(struct pci
64189 int where, u16 val);
64190 int pci_bus_write_config_dword(struct pci_bus *bus, unsigned int devfn,
64191 int where, u32 val);
64192-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops);
64193+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops);
64194
64195 static inline int pci_read_config_byte(struct pci_dev *dev, int where, u8 *val)
64196 {
64197diff -urNp linux-2.6.39/include/linux/perf_event.h linux-2.6.39/include/linux/perf_event.h
64198--- linux-2.6.39/include/linux/perf_event.h 2011-05-19 00:06:34.000000000 -0400
64199+++ linux-2.6.39/include/linux/perf_event.h 2011-05-22 19:36:33.000000000 -0400
64200@@ -759,8 +759,8 @@ struct perf_event {
8308f9c9
MT		 64201
64202 enum perf_event_active_state state;
64203 unsigned int attach_state;
64204- local64_t count;
64205- atomic64_t child_count;
64206+ local64_t count; /* PaX: fix it one day */
64207+ atomic64_unchecked_t child_count;
64208
64209 /*
64210 * These are the total time in nanoseconds that the event
66a7e928 64211@@ -811,8 +811,8 @@ struct perf_event {
8308f9c9
MT		 64212 * These accumulate total time (in nanoseconds) that children
64213 * events have been enabled and running, respectively.
64214 */
64215- atomic64_t child_total_time_enabled;
64216- atomic64_t child_total_time_running;
64217+ atomic64_unchecked_t child_total_time_enabled;
64218+ atomic64_unchecked_t child_total_time_running;
64219
64220 /*
64221 * Protect attach/detach and child_list:
66a7e928
MT		 64222@@ -1090,9 +1090,9 @@ void perf_event_task_sched_out(struct ta
64223 }
64224
64225 extern void perf_event_mmap(struct vm_area_struct *vma);
64226-extern struct perf_guest_info_callbacks *perf_guest_cbs;
64227-extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64228-extern int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64229+extern const struct perf_guest_info_callbacks *perf_guest_cbs;
64230+extern int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64231+extern int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64232
64233 extern void perf_event_comm(struct task_struct *tsk);
64234 extern void perf_event_fork(struct task_struct *tsk);
64235diff -urNp linux-2.6.39/include/linux/pipe_fs_i.h linux-2.6.39/include/linux/pipe_fs_i.h
64236--- linux-2.6.39/include/linux/pipe_fs_i.h 2011-05-19 00:06:34.000000000 -0400
64237+++ linux-2.6.39/include/linux/pipe_fs_i.h 2011-05-22 19:36:33.000000000 -0400
16454cff 64238@@ -46,9 +46,9 @@ struct pipe_buffer {
57199397 64239 struct pipe_inode_info {
ae4e228f 64240 wait_queue_head_t wait;
57199397 64241 unsigned int nrbufs, curbuf, buffers;
ae4e228f
MT		 64242- unsigned int readers;
64243- unsigned int writers;
64244- unsigned int waiting_writers;
64245+ atomic_t readers;
64246+ atomic_t writers;
64247+ atomic_t waiting_writers;
64248 unsigned int r_counter;
64249 unsigned int w_counter;
57199397 64250 struct page *tmp_page;
66a7e928
MT		 64251diff -urNp linux-2.6.39/include/linux/pm.h linux-2.6.39/include/linux/pm.h
64252--- linux-2.6.39/include/linux/pm.h 2011-05-19 00:06:34.000000000 -0400
64253+++ linux-2.6.39/include/linux/pm.h 2011-05-22 19:36:33.000000000 -0400
64254@@ -268,7 +268,7 @@ const struct dev_pm_ops name = { \
64255 * runtime PM, make the pm member point to generic_subsys_pm_ops.
64256 */
64257 #ifdef CONFIG_PM
64258-extern struct dev_pm_ops generic_subsys_pm_ops;
64259+extern const struct dev_pm_ops generic_subsys_pm_ops;
64260 #define GENERIC_SUBSYS_PM_OPS (&generic_subsys_pm_ops)
64261 #else
64262 #define GENERIC_SUBSYS_PM_OPS NULL
64263@@ -471,7 +471,7 @@ extern void update_pm_runtime_accounting
64264 * subsystem-level and driver-level callbacks.
64265 */
64266 struct dev_power_domain {
64267- struct dev_pm_ops ops;
64268+ const struct dev_pm_ops ops;
64269 };
64270
64271 /*
64272diff -urNp linux-2.6.39/include/linux/pm_runtime.h linux-2.6.39/include/linux/pm_runtime.h
64273--- linux-2.6.39/include/linux/pm_runtime.h 2011-05-19 00:06:34.000000000 -0400
64274+++ linux-2.6.39/include/linux/pm_runtime.h 2011-05-22 19:36:33.000000000 -0400
64275@@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
bc901d79
MT		 64276
64277 static inline void pm_runtime_mark_last_busy(struct device *dev)
64278 {
64279- ACCESS_ONCE(dev->power.last_busy) = jiffies;
64280+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
64281 }
64282
64283 #else /* !CONFIG_PM_RUNTIME */
66a7e928
MT		 64284diff -urNp linux-2.6.39/include/linux/poison.h linux-2.6.39/include/linux/poison.h
64285--- linux-2.6.39/include/linux/poison.h 2011-05-19 00:06:34.000000000 -0400
64286+++ linux-2.6.39/include/linux/poison.h 2011-05-22 19:36:33.000000000 -0400
ae4e228f 64287@@ -19,8 +19,8 @@
58c5fc13
MT		 64288 * under normal circumstances, used to verify that nobody uses
64289 * non-initialized list entries.
64290 */
ae4e228f
MT		 64291-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
64292-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
64293+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
64294+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
58c5fc13
MT		 64295
64296 /********** include/linux/timer.h **********/
64297 /*
66a7e928
MT		 64298diff -urNp linux-2.6.39/include/linux/posix-timers.h linux-2.6.39/include/linux/posix-timers.h
64299--- linux-2.6.39/include/linux/posix-timers.h 2011-05-19 00:06:34.000000000 -0400
64300+++ linux-2.6.39/include/linux/posix-timers.h 2011-05-22 19:36:33.000000000 -0400
64301@@ -102,10 +102,10 @@ struct k_clock {
64302 struct itimerspec * cur_setting);
64303 };
64304
64305-extern struct k_clock clock_posix_cpu;
64306-extern struct k_clock clock_posix_dynamic;
64307+extern const struct k_clock clock_posix_cpu;
64308+extern const struct k_clock clock_posix_dynamic;
64309
64310-void posix_timers_register_clock(const clockid_t clock_id, struct k_clock *new_clock);
64311+void posix_timers_register_clock(const clockid_t clock_id, const struct k_clock *new_clock);
64312
64313 /* function to call to trigger timer event */
64314 int posix_timer_event(struct k_itimer *timr, int si_private);
64315diff -urNp linux-2.6.39/include/linux/proc_fs.h linux-2.6.39/include/linux/proc_fs.h
64316--- linux-2.6.39/include/linux/proc_fs.h 2011-05-19 00:06:34.000000000 -0400
64317+++ linux-2.6.39/include/linux/proc_fs.h 2011-05-22 19:41:42.000000000 -0400
ae4e228f 64318@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
58c5fc13
MT		 64319 return proc_create_data(name, mode, parent, proc_fops, NULL);
64320 }
64321
64322+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
64323+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
64324+{
64325+#ifdef CONFIG_GRKERNSEC_PROC_USER
64326+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
64327+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64328+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
64329+#else
64330+ return proc_create_data(name, mode, parent, proc_fops, NULL);
64331+#endif
64332+}
64333+
64334+
64335 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
64336 mode_t mode, struct proc_dir_entry *base,
64337 read_proc_t *read_proc, void * data)
66a7e928
MT		 64338diff -urNp linux-2.6.39/include/linux/ptrace.h linux-2.6.39/include/linux/ptrace.h
64339--- linux-2.6.39/include/linux/ptrace.h 2011-05-19 00:06:34.000000000 -0400
64340+++ linux-2.6.39/include/linux/ptrace.h 2011-05-22 19:41:42.000000000 -0400
16454cff
MT		 64341@@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
64342 extern void exit_ptrace(struct task_struct *tracer);
64343 #define PTRACE_MODE_READ 1
64344 #define PTRACE_MODE_ATTACH 2
64345-/* Returns 0 on success, -errno on denial. */
64346-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
64347 /* Returns true on success, false on denial. */
64348 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
64349+/* Returns true on success, false on denial. */
64350+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
64351
64352 static inline int ptrace_reparented(struct task_struct *child)
64353 {
66a7e928
MT		 64354diff -urNp linux-2.6.39/include/linux/random.h linux-2.6.39/include/linux/random.h
64355--- linux-2.6.39/include/linux/random.h 2011-05-19 00:06:34.000000000 -0400
64356+++ linux-2.6.39/include/linux/random.h 2011-05-22 19:36:33.000000000 -0400
57199397
MT		 64357@@ -80,12 +80,17 @@ void srandom32(u32 seed);
64358
64359 u32 prandom32(struct rnd_state *);
58c5fc13
MT		 64360
64361+static inline unsigned long pax_get_random_long(void)
64362+{
64363+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
64364+}
64365+
57199397
MT		 64366 /*
64367 * Handle minimum values for seeds
64368 */
64369 static inline u32 __seed(u32 x, u32 m)
64370 {
64371- return (x < m) ? x + m : x;
64372+ return (x <= m) ? x + m + 1 : x;
64373 }
58c5fc13 64374
57199397 64375 /**
66a7e928
MT		 64376diff -urNp linux-2.6.39/include/linux/reboot.h linux-2.6.39/include/linux/reboot.h
64377--- linux-2.6.39/include/linux/reboot.h 2011-05-19 00:06:34.000000000 -0400
64378+++ linux-2.6.39/include/linux/reboot.h 2011-05-22 19:36:33.000000000 -0400
64379@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
64380 * Architecture-specific implementations of sys_reboot commands.
64381 */
64382
64383-extern void machine_restart(char *cmd);
64384-extern void machine_halt(void);
64385-extern void machine_power_off(void);
64386+extern void machine_restart(char *cmd) __noreturn;
64387+extern void machine_halt(void) __noreturn;
64388+extern void machine_power_off(void) __noreturn;
64389
64390 extern void machine_shutdown(void);
64391 struct pt_regs;
64392@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
64393 */
64394
64395 extern void kernel_restart_prepare(char *cmd);
64396-extern void kernel_restart(char *cmd);
64397-extern void kernel_halt(void);
64398-extern void kernel_power_off(void);
64399+extern void kernel_restart(char *cmd) __noreturn;
64400+extern void kernel_halt(void) __noreturn;
64401+extern void kernel_power_off(void) __noreturn;
64402
64403 extern int C_A_D; /* for sysctl */
64404 void ctrl_alt_del(void);
64405@@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
64406 * Emergency restart, callable from an interrupt handler.
64407 */
64408
64409-extern void emergency_restart(void);
64410+extern void emergency_restart(void) __noreturn;
64411 #include <asm/emergency-restart.h>
64412
64413 #endif
64414diff -urNp linux-2.6.39/include/linux/reiserfs_fs.h linux-2.6.39/include/linux/reiserfs_fs.h
64415--- linux-2.6.39/include/linux/reiserfs_fs.h 2011-05-19 00:06:34.000000000 -0400
64416+++ linux-2.6.39/include/linux/reiserfs_fs.h 2011-05-22 19:36:33.000000000 -0400
64417@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
58c5fc13
MT		 64418 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
64419
64420 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
64421-#define get_generation(s) atomic_read (&fs_generation(s))
64422+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
64423 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
64424 #define __fs_changed(gen,s) (gen != get_generation (s))
ae4e228f 64425 #define fs_changed(gen,s) \
66a7e928 64426@@ -1618,24 +1618,24 @@ static inline struct super_block *sb_fro
ae4e228f
MT		 64427 */
64428
64429 struct item_operations {
64430- int (*bytes_number) (struct item_head * ih, int block_size);
64431- void (*decrement_key) (struct cpu_key *);
64432- int (*is_left_mergeable) (struct reiserfs_key * ih,
64433+ int (* const bytes_number) (struct item_head * ih, int block_size);
64434+ void (* const decrement_key) (struct cpu_key *);
64435+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
64436 unsigned long bsize);
64437- void (*print_item) (struct item_head *, char *item);
64438- void (*check_item) (struct item_head *, char *item);
64439+ void (* const print_item) (struct item_head *, char *item);
64440+ void (* const check_item) (struct item_head *, char *item);
64441
64442- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64443+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64444 int is_affected, int insert_size);
64445- int (*check_left) (struct virtual_item * vi, int free,
64446+ int (* const check_left) (struct virtual_item * vi, int free,
64447 int start_skip, int end_skip);
64448- int (*check_right) (struct virtual_item * vi, int free);
64449- int (*part_size) (struct virtual_item * vi, int from, int to);
64450- int (*unit_num) (struct virtual_item * vi);
64451- void (*print_vi) (struct virtual_item * vi);
64452+ int (* const check_right) (struct virtual_item * vi, int free);
64453+ int (* const part_size) (struct virtual_item * vi, int from, int to);
64454+ int (* const unit_num) (struct virtual_item * vi);
64455+ void (* const print_vi) (struct virtual_item * vi);
64456 };
64457
64458-extern struct item_operations *item_ops[TYPE_ANY + 1];
64459+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
64460
64461 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
64462 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
66a7e928
MT		 64463diff -urNp linux-2.6.39/include/linux/reiserfs_fs_sb.h linux-2.6.39/include/linux/reiserfs_fs_sb.h
64464--- linux-2.6.39/include/linux/reiserfs_fs_sb.h 2011-05-19 00:06:34.000000000 -0400
64465+++ linux-2.6.39/include/linux/reiserfs_fs_sb.h 2011-05-22 19:36:33.000000000 -0400
ae4e228f 64466@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
58c5fc13
MT		 64467 /* Comment? -Hans */
64468 wait_queue_head_t s_wait;
64469 /* To be obsoleted soon by per buffer seals.. -Hans */
64470- atomic_t s_generation_counter; // increased by one every time the
64471+ atomic_unchecked_t s_generation_counter; // increased by one every time the
64472 // tree gets re-balanced
64473 unsigned long s_properties; /* File system properties. Currently holds
64474 on-disk FS format */
66a7e928
MT		 64475diff -urNp linux-2.6.39/include/linux/rmap.h linux-2.6.39/include/linux/rmap.h
64476--- linux-2.6.39/include/linux/rmap.h 2011-05-19 00:06:34.000000000 -0400
64477+++ linux-2.6.39/include/linux/rmap.h 2011-05-22 19:36:33.000000000 -0400
64478@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
57199397
MT		 64479 void anon_vma_init(void); /* create anon_vma_cachep */
64480 int anon_vma_prepare(struct vm_area_struct *);
64481 void unlink_anon_vmas(struct vm_area_struct *);
64482-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
64483-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
64484+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
64485+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
64486 void __anon_vma_link(struct vm_area_struct *);
57199397 64487
66a7e928
MT		 64488 static inline void anon_vma_merge(struct vm_area_struct *vma,
64489diff -urNp linux-2.6.39/include/linux/sched.h linux-2.6.39/include/linux/sched.h
64490--- linux-2.6.39/include/linux/sched.h 2011-05-19 00:06:34.000000000 -0400
64491+++ linux-2.6.39/include/linux/sched.h 2011-05-22 19:41:42.000000000 -0400
64492@@ -100,6 +100,7 @@ struct bio_list;
58c5fc13 64493 struct fs_struct;
ae4e228f 64494 struct perf_event_context;
66a7e928 64495 struct blk_plug;
58c5fc13
MT		 64496+struct linux_binprm;
64497
64498 /*
64499 * List of flags we want to share for kernel threads,
66a7e928 64500@@ -360,7 +361,7 @@ extern signed long schedule_timeout_inte
71d190be
MT		 64501 extern signed long schedule_timeout_killable(signed long timeout);
64502 extern signed long schedule_timeout_uninterruptible(signed long timeout);
64503 asmlinkage void schedule(void);
64504-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
64505+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
64506
64507 struct nsproxy;
64508 struct user_namespace;
66a7e928 64509@@ -381,10 +382,13 @@ struct user_namespace;
57199397
MT		 64510 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
64511
64512 extern int sysctl_max_map_count;
64513+extern unsigned long sysctl_heap_stack_gap;
64514
64515 #include <linux/aio.h>
64516
64517 #ifdef CONFIG_MMU
16454cff
MT		 64518+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
64519+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
57199397
MT		 64520 extern void arch_pick_mmap_layout(struct mm_struct *mm);
64521 extern unsigned long
64522 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
66a7e928 64523@@ -629,6 +633,17 @@ struct signal_struct {
16454cff
MT		 64524 #ifdef CONFIG_TASKSTATS
64525 struct taskstats *stats;
58c5fc13 64526 #endif
16454cff 64527+
58c5fc13
MT		 64528+#ifdef CONFIG_GRKERNSEC
64529+ u32 curr_ip;
bc901d79 64530+ u32 saved_ip;
58c5fc13
MT		 64531+ u32 gr_saddr;
64532+ u32 gr_daddr;
64533+ u16 gr_sport;
64534+ u16 gr_dport;
64535+ u8 used_accept:1;
64536+#endif
ae4e228f 64537+
16454cff
MT		 64538 #ifdef CONFIG_AUDIT
64539 unsigned audit_tty;
64540 struct tty_audit_buf *tty_audit_buf;
66a7e928 64541@@ -701,6 +716,11 @@ struct user_struct {
71d190be
MT		 64542 struct key *session_keyring; /* UID's default session keyring */
64543 #endif
64544
64545+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
64546+ unsigned int banned;
64547+ unsigned long ban_expires;
64548+#endif
64549+
64550 /* Hash table maintenance information */
64551 struct hlist_node uidhash_node;
64552 uid_t uid;
64553@@ -1310,8 +1330,8 @@ struct task_struct {
58c5fc13
MT		 64554 struct list_head thread_group;
64555
64556 struct completion *vfork_done; /* for vfork() */
64557- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
64558- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64559+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
64560+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64561
64562 cputime_t utime, stime, utimescaled, stimescaled;
64563 cputime_t gtime;
71d190be 64564@@ -1327,13 +1347,6 @@ struct task_struct {
58c5fc13
MT		 64565 struct task_cputime cputime_expires;
64566 struct list_head cpu_timers[3];
64567
64568-/* process credentials */
bc901d79 64569- const struct cred __rcu *real_cred; /* objective and real subjective task
58c5fc13 64570- * credentials (COW) */
bc901d79 64571- const struct cred __rcu *cred; /* effective (overridable) subjective task
58c5fc13 64572- * credentials (COW) */
ae4e228f 64573- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
58c5fc13
MT		 64574-
64575 char comm[TASK_COMM_LEN]; /* executable name excluding path
64576 - access with [gs]et_task_comm (which lock
64577 it with task_lock())
71d190be
MT		 64578@@ -1350,8 +1363,16 @@ struct task_struct {
64579 #endif
64580 /* CPU-specific state of this task */
bc901d79 64581 struct thread_struct thread;
71d190be
MT		 64582+/* thread_info moved to task_struct */
64583+#ifdef CONFIG_X86
64584+ struct thread_info tinfo;
64585+#endif
bc901d79
MT		 64586 /* filesystem information */
64587 struct fs_struct *fs;
58c5fc13 64588+
bc901d79 64589+ const struct cred __rcu *cred; /* effective (overridable) subjective task
58c5fc13 64590+ * credentials (COW) */
58c5fc13 64591+
bc901d79
MT		 64592 /* open file information */
64593 struct files_struct *files;
64594 /* namespaces */
71d190be 64595@@ -1398,6 +1419,11 @@ struct task_struct {
bc901d79
MT		 64596 struct rt_mutex_waiter *pi_blocked_on;
64597 #endif
ae4e228f 64598
bc901d79
MT		 64599+/* process credentials */
64600+ const struct cred __rcu *real_cred; /* objective and real subjective task
ae4e228f 64601+ * credentials (COW) */
bc901d79 64602+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
ae4e228f 64603+
bc901d79
MT		 64604 #ifdef CONFIG_DEBUG_MUTEXES
64605 /* mutex deadlock detection */
64606 struct mutex_waiter *blocked_on;
66a7e928 64607@@ -1508,6 +1534,21 @@ struct task_struct {
ae4e228f
MT		 64608 unsigned long default_timer_slack_ns;
64609
64610 struct list_head *scm_work_list;
58c5fc13
MT		 64611+
64612+#ifdef CONFIG_GRKERNSEC
64613+ /* grsecurity */
df50ba0c 64614+ struct dentry *gr_chroot_dentry;
58c5fc13
MT		 64615+ struct acl_subject_label *acl;
64616+ struct acl_role_label *role;
64617+ struct file *exec_file;
64618+ u16 acl_role_id;
16454cff 64619+ /* is this the task that authenticated to the special role */
58c5fc13
MT		 64620+ u8 acl_sp_role;
64621+ u8 is_writable;
64622+ u8 brute;
df50ba0c 64623+ u8 gr_is_chrooted;
58c5fc13
MT		 64624+#endif
64625+
ae4e228f 64626 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
df50ba0c 64627 /* Index of current stored address in ret_stack */
ae4e228f 64628 int curr_ret_stack;
66a7e928 64629@@ -1542,6 +1583,63 @@ struct task_struct {
ae4e228f 64630 #endif
58c5fc13
MT		 64631 };
64632
64633+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
64634+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
64635+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
64636+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
64637+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
64638+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
64639+
64640+#ifdef CONFIG_PAX_SOFTMODE
64641+extern unsigned int pax_softmode;
64642+#endif
64643+
64644+extern int pax_check_flags(unsigned long *);
64645+
64646+/* if tsk != current then task_lock must be held on it */
64647+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
64648+static inline unsigned long pax_get_flags(struct task_struct *tsk)
64649+{
64650+ if (likely(tsk->mm))
64651+ return tsk->mm->pax_flags;
64652+ else
64653+ return 0UL;
64654+}
64655+
64656+/* if tsk != current then task_lock must be held on it */
64657+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
64658+{
64659+ if (likely(tsk->mm)) {
64660+ tsk->mm->pax_flags = flags;
64661+ return 0;
64662+ }
64663+ return -EINVAL;
64664+}
64665+#endif
64666+
64667+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
64668+extern void pax_set_initial_flags(struct linux_binprm *bprm);
64669+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
64670+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
64671+#endif
64672+
64673+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
64674+void pax_report_insns(void *pc, void *sp);
64675+void pax_report_refcount_overflow(struct pt_regs *regs);
71d190be 64676+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
66a7e928
MT		 64677+
64678+static inline void pax_track_stack(void)
64679+{
64680+
64681+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
64682+ unsigned long sp = current_stack_pointer;
64683+ if (current_thread_info()->lowest_stack > sp &&
64684+ (unsigned long)task_stack_page(current) < sp)
64685+ current_thread_info()->lowest_stack = sp;
64686+#endif
64687+
64688+}
58c5fc13
MT		 64689+
64690 /* Future-safe accessor for struct task_struct's cpus_allowed. */
ae4e228f 64691 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
58c5fc13 64692
66a7e928 64693@@ -2009,7 +2107,9 @@ void yield(void);
71d190be
MT		 64694 extern struct exec_domain default_exec_domain;
64695
64696 union thread_union {
64697+#ifndef CONFIG_X86
64698 struct thread_info thread_info;
64699+#endif
64700 unsigned long stack[THREAD_SIZE/sizeof(long)];
64701 };
64702
66a7e928 64703@@ -2179,7 +2279,7 @@ extern void __cleanup_sighand(struct sig
58c5fc13
MT		 64704 extern void exit_itimers(struct signal_struct *);
64705 extern void flush_itimer_signals(void);
64706
64707-extern NORET_TYPE void do_group_exit(int);
64708+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
64709
64710 extern void daemonize(const char *, ...);
64711 extern int allow_signal(int);
66a7e928 64712@@ -2320,13 +2420,17 @@ static inline unsigned long *end_of_stac
58c5fc13
MT		 64713
64714 #endif
64715
64716-static inline int object_is_on_stack(void *obj)
ae4e228f 64717+static inline int object_starts_on_stack(void *obj)
58c5fc13 64718 {
ae4e228f
MT		 64719- void *stack = task_stack_page(current);
64720+ const void *stack = task_stack_page(current);
58c5fc13 64721
ae4e228f
MT		 64722 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
64723 }
64724
57199397
MT		 64725+#ifdef CONFIG_PAX_USERCOPY
64726+extern int object_is_on_stack(const void *obj, unsigned long len);
64727+#endif
ae4e228f
MT		 64728+
64729 extern void thread_info_cache_init(void);
64730
64731 #ifdef CONFIG_DEBUG_STACK_USAGE
66a7e928
MT		 64732diff -urNp linux-2.6.39/include/linux/screen_info.h linux-2.6.39/include/linux/screen_info.h
64733--- linux-2.6.39/include/linux/screen_info.h 2011-05-19 00:06:34.000000000 -0400
64734+++ linux-2.6.39/include/linux/screen_info.h 2011-05-22 19:36:33.000000000 -0400
ae4e228f 64735@@ -43,7 +43,8 @@ struct screen_info {
58c5fc13
MT		 64736 __u16 pages; /* 0x32 */
64737 __u16 vesa_attributes; /* 0x34 */
64738 __u32 capabilities; /* 0x36 */
64739- __u8 _reserved[6]; /* 0x3a */
64740+ __u16 vesapm_size; /* 0x3a */
64741+ __u8 _reserved[4]; /* 0x3c */
64742 } __attribute__((packed));
64743
64744 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
66a7e928
MT		 64745diff -urNp linux-2.6.39/include/linux/security.h linux-2.6.39/include/linux/security.h
64746--- linux-2.6.39/include/linux/security.h 2011-05-19 00:06:34.000000000 -0400
64747+++ linux-2.6.39/include/linux/security.h 2011-05-22 19:41:42.000000000 -0400
64748@@ -36,6 +36,7 @@
58c5fc13
MT		 64749 #include <linux/key.h>
64750 #include <linux/xfrm.h>
df50ba0c 64751 #include <linux/slab.h>
58c5fc13
MT		 64752+#include <linux/grsecurity.h>
64753 #include <net/flow.h>
64754
64755 /* Maximum number of letters for an LSM name string */
66a7e928
MT		 64756diff -urNp linux-2.6.39/include/linux/shm.h linux-2.6.39/include/linux/shm.h
64757--- linux-2.6.39/include/linux/shm.h 2011-05-19 00:06:34.000000000 -0400
64758+++ linux-2.6.39/include/linux/shm.h 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 64759@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
64760 pid_t shm_cprid;
64761 pid_t shm_lprid;
64762 struct user_struct *mlock_user;
64763+#ifdef CONFIG_GRKERNSEC
64764+ time_t shm_createtime;
64765+ pid_t shm_lapid;
64766+#endif
64767 };
64768
64769 /* shm_mode upper byte flags */
66a7e928
MT		 64770diff -urNp linux-2.6.39/include/linux/skbuff.h linux-2.6.39/include/linux/skbuff.h
64771--- linux-2.6.39/include/linux/skbuff.h 2011-05-19 00:06:34.000000000 -0400
64772+++ linux-2.6.39/include/linux/skbuff.h 2011-05-22 19:36:33.000000000 -0400
64773@@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
bc901d79
MT		 64774 */
64775 static inline int skb_queue_empty(const struct sk_buff_head *list)
64776 {
64777- return list->next == (struct sk_buff *)list;
64778+ return list->next == (const struct sk_buff *)list;
64779 }
64780
64781 /**
66a7e928 64782@@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
bc901d79
MT		 64783 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
64784 const struct sk_buff *skb)
64785 {
64786- return skb->next == (struct sk_buff *)list;
64787+ return skb->next == (const struct sk_buff *)list;
64788 }
64789
64790 /**
66a7e928 64791@@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
bc901d79
MT		 64792 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
64793 const struct sk_buff *skb)
64794 {
64795- return skb->prev == (struct sk_buff *)list;
64796+ return skb->prev == (const struct sk_buff *)list;
64797 }
64798
64799 /**
66a7e928 64800@@ -1435,7 +1435,7 @@ static inline int pskb_network_may_pull(
8308f9c9
MT		 64801 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
64802 */
64803 #ifndef NET_SKB_PAD
64804-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
64805+#define NET_SKB_PAD max(_AC(32,U), L1_CACHE_BYTES)
64806 #endif
64807
64808 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
66a7e928
MT		 64809diff -urNp linux-2.6.39/include/linux/slab_def.h linux-2.6.39/include/linux/slab_def.h
64810--- linux-2.6.39/include/linux/slab_def.h 2011-05-19 00:06:34.000000000 -0400
64811+++ linux-2.6.39/include/linux/slab_def.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 64812@@ -96,10 +96,10 @@ struct kmem_cache {
64813 unsigned long node_allocs;
64814 unsigned long node_frees;
64815 unsigned long node_overflow;
64816- atomic_t allochit;
64817- atomic_t allocmiss;
64818- atomic_t freehit;
64819- atomic_t freemiss;
64820+ atomic_unchecked_t allochit;
64821+ atomic_unchecked_t allocmiss;
64822+ atomic_unchecked_t freehit;
64823+ atomic_unchecked_t freemiss;
64824
64825 /*
64826 * If debugging is enabled, then the allocator can add additional
66a7e928
MT		 64827diff -urNp linux-2.6.39/include/linux/slab.h linux-2.6.39/include/linux/slab.h
64828--- linux-2.6.39/include/linux/slab.h 2011-05-19 00:06:34.000000000 -0400
64829+++ linux-2.6.39/include/linux/slab.h 2011-05-23 17:07:00.000000000 -0400
71d190be 64830@@ -11,12 +11,20 @@
ae4e228f
MT		 64831
64832 #include <linux/gfp.h>
64833 #include <linux/types.h>
64834+#include <linux/err.h>
64835
64836 /*
64837 * Flags to pass to kmem_cache_create().
71d190be
MT		 64838 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
64839 */
64840 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
64841+
64842+#ifdef CONFIG_PAX_USERCOPY
64843+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
64844+#else
64845+#define SLAB_USERCOPY 0x00000000UL
64846+#endif
64847+
64848 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
64849 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
64850 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
64851@@ -87,10 +95,13 @@
58c5fc13
MT		 64852 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
64853 * Both make kfree a no-op.
64854 */
64855-#define ZERO_SIZE_PTR ((void *)16)
ae4e228f
MT		 64856+#define ZERO_SIZE_PTR \
64857+({ \
64858+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
64859+ (void *)(-MAX_ERRNO-1L); \
64860+})
58c5fc13
MT		 64861
64862-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
64863- (unsigned long)ZERO_SIZE_PTR)
df50ba0c 64864+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
58c5fc13
MT		 64865
64866 /*
64867 * struct kmem_cache related prototypes
66a7e928 64868@@ -141,6 +152,7 @@ void * __must_check krealloc(const void
58c5fc13
MT		 64869 void kfree(const void *);
64870 void kzfree(const void *);
64871 size_t ksize(const void *);
64872+void check_object_size(const void *ptr, unsigned long n, bool to);
64873
64874 /*
64875 * Allocator specific definitions. These are mainly used to establish optimized
66a7e928 64876@@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
58c5fc13
MT		 64877
64878 void __init kmem_cache_init_late(void);
64879
66a7e928
MT		 64880+#define kmalloc(x, y) \
64881+({ \
64882+ void *___retval; \
64883+ intoverflow_t ___x = (intoverflow_t)x; \
64884+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
64885+ ___retval = NULL; \
64886+ else \
64887+ ___retval = kmalloc((size_t)___x, (y)); \
64888+ ___retval; \
58c5fc13
MT		 64889+})
64890+
64891+#define kmalloc_node(x, y, z) \
64892+({ \
64893+ void *___retval; \
64894+ intoverflow_t ___x = (intoverflow_t)x; \
64895+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
64896+ ___retval = NULL; \
64897+ else \
64898+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
64899+ ___retval; \
64900+})
64901+
66a7e928
MT		 64902+#define kzalloc(x, y) \
64903+({ \
64904+ void *___retval; \
64905+ intoverflow_t ___x = (intoverflow_t)x; \
64906+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
64907+ ___retval = NULL; \
64908+ else \
64909+ ___retval = kzalloc((size_t)___x, (y)); \
64910+ ___retval; \
64911+})
64912+
64913+#define __krealloc(x, y, z) \
64914+({ \
64915+ void *___retval; \
64916+ intoverflow_t ___y = (intoverflow_t)y; \
64917+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
64918+ ___retval = NULL; \
64919+ else \
64920+ ___retval = __krealloc((x), (size_t)___y, (z)); \
64921+ ___retval; \
64922+})
64923+
64924+#define krealloc(x, y, z) \
64925+({ \
64926+ void *___retval; \
64927+ intoverflow_t ___y = (intoverflow_t)y; \
64928+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
64929+ ___retval = NULL; \
64930+ else \
64931+ ___retval = krealloc((x), (size_t)___y, (z)); \
64932+ ___retval; \
58c5fc13
MT		 64933+})
64934+
64935 #endif /* _LINUX_SLAB_H */
66a7e928
MT		 64936diff -urNp linux-2.6.39/include/linux/slub_def.h linux-2.6.39/include/linux/slub_def.h
64937--- linux-2.6.39/include/linux/slub_def.h 2011-05-19 00:06:34.000000000 -0400
64938+++ linux-2.6.39/include/linux/slub_def.h 2011-05-22 19:36:33.000000000 -0400
64939@@ -84,7 +84,7 @@ struct kmem_cache {
58c5fc13
MT		 64940 struct kmem_cache_order_objects max;
64941 struct kmem_cache_order_objects min;
64942 gfp_t allocflags; /* gfp flags to use on each alloc */
64943- int refcount; /* Refcount for slab cache destroy */
64944+ atomic_t refcount; /* Refcount for slab cache destroy */
64945 void (*ctor)(void *);
64946 int inuse; /* Offset to metadata */
64947 int align; /* Alignment */
66a7e928
MT		 64948diff -urNp linux-2.6.39/include/linux/sonet.h linux-2.6.39/include/linux/sonet.h
64949--- linux-2.6.39/include/linux/sonet.h 2011-05-19 00:06:34.000000000 -0400
64950+++ linux-2.6.39/include/linux/sonet.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 64951@@ -61,7 +61,7 @@ struct sonet_stats {
64952 #include <asm/atomic.h>
64953
64954 struct k_sonet_stats {
64955-#define __HANDLE_ITEM(i) atomic_t i
64956+#define __HANDLE_ITEM(i) atomic_unchecked_t i
64957 __SONET_ITEMS
64958 #undef __HANDLE_ITEM
64959 };
66a7e928
MT		 64960diff -urNp linux-2.6.39/include/linux/ssb/ssb_driver_gige.h linux-2.6.39/include/linux/ssb/ssb_driver_gige.h
64961--- linux-2.6.39/include/linux/ssb/ssb_driver_gige.h 2011-05-19 00:06:34.000000000 -0400
64962+++ linux-2.6.39/include/linux/ssb/ssb_driver_gige.h 2011-05-22 19:36:33.000000000 -0400
64963@@ -44,7 +44,7 @@ struct ssb_gige {
64964
64965 /* The PCI controller device. */
64966 struct pci_controller pci_controller;
64967- struct pci_ops pci_ops;
64968+ const struct pci_ops pci_ops;
64969 struct resource mem_resource;
64970 struct resource io_resource;
64971 };
64972diff -urNp linux-2.6.39/include/linux/sunrpc/clnt.h linux-2.6.39/include/linux/sunrpc/clnt.h
64973--- linux-2.6.39/include/linux/sunrpc/clnt.h 2011-05-19 00:06:34.000000000 -0400
64974+++ linux-2.6.39/include/linux/sunrpc/clnt.h 2011-05-22 19:36:33.000000000 -0400
64975@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
bc901d79
MT		 64976 {
64977 switch (sap->sa_family) {
64978 case AF_INET:
64979- return ntohs(((struct sockaddr_in *)sap)->sin_port);
64980+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
64981 case AF_INET6:
64982- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
64983+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
64984 }
64985 return 0;
64986 }
66a7e928 64987@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
bc901d79
MT		 64988 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
64989 const struct sockaddr *src)
64990 {
64991- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
64992+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
64993 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
64994
64995 dsin->sin_family = ssin->sin_family;
66a7e928 64996@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
bc901d79
MT		 64997 if (sa->sa_family != AF_INET6)
64998 return 0;
64999
65000- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
65001+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
65002 }
65003
65004 #endif /* __KERNEL__ */
66a7e928
MT		 65005diff -urNp linux-2.6.39/include/linux/sunrpc/svc_rdma.h linux-2.6.39/include/linux/sunrpc/svc_rdma.h
65006--- linux-2.6.39/include/linux/sunrpc/svc_rdma.h 2011-05-19 00:06:34.000000000 -0400
65007+++ linux-2.6.39/include/linux/sunrpc/svc_rdma.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 65008@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
65009 extern unsigned int svcrdma_max_requests;
65010 extern unsigned int svcrdma_max_req_size;
65011
65012-extern atomic_t rdma_stat_recv;
65013-extern atomic_t rdma_stat_read;
65014-extern atomic_t rdma_stat_write;
65015-extern atomic_t rdma_stat_sq_starve;
65016-extern atomic_t rdma_stat_rq_starve;
65017-extern atomic_t rdma_stat_rq_poll;
65018-extern atomic_t rdma_stat_rq_prod;
65019-extern atomic_t rdma_stat_sq_poll;
65020-extern atomic_t rdma_stat_sq_prod;
65021+extern atomic_unchecked_t rdma_stat_recv;
65022+extern atomic_unchecked_t rdma_stat_read;
65023+extern atomic_unchecked_t rdma_stat_write;
65024+extern atomic_unchecked_t rdma_stat_sq_starve;
65025+extern atomic_unchecked_t rdma_stat_rq_starve;
65026+extern atomic_unchecked_t rdma_stat_rq_poll;
65027+extern atomic_unchecked_t rdma_stat_rq_prod;
65028+extern atomic_unchecked_t rdma_stat_sq_poll;
65029+extern atomic_unchecked_t rdma_stat_sq_prod;
65030
65031 #define RPCRDMA_VERSION 1
65032
66a7e928
MT		 65033diff -urNp linux-2.6.39/include/linux/suspend.h linux-2.6.39/include/linux/suspend.h
65034--- linux-2.6.39/include/linux/suspend.h 2011-05-19 00:06:34.000000000 -0400
65035+++ linux-2.6.39/include/linux/suspend.h 2011-05-22 19:36:33.000000000 -0400
6892158b 65036@@ -106,15 +106,15 @@ typedef int __bitwise suspend_state_t;
ae4e228f
MT		 65037 * which require special recovery actions in that situation.
65038 */
65039 struct platform_suspend_ops {
65040- int (*valid)(suspend_state_t state);
65041- int (*begin)(suspend_state_t state);
65042- int (*prepare)(void);
65043- int (*prepare_late)(void);
65044- int (*enter)(suspend_state_t state);
65045- void (*wake)(void);
65046- void (*finish)(void);
65047- void (*end)(void);
65048- void (*recover)(void);
65049+ int (* const valid)(suspend_state_t state);
65050+ int (* const begin)(suspend_state_t state);
65051+ int (* const prepare)(void);
65052+ int (* const prepare_late)(void);
65053+ int (* const enter)(suspend_state_t state);
65054+ void (* const wake)(void);
65055+ void (* const finish)(void);
65056+ void (* const end)(void);
65057+ void (* const recover)(void);
65058 };
65059
65060 #ifdef CONFIG_SUSPEND
6892158b 65061@@ -217,16 +217,16 @@ extern void mark_free_pages(struct zone
ae4e228f
MT		 65062 * platforms which require special recovery actions in that situation.
65063 */
65064 struct platform_hibernation_ops {
65065- int (*begin)(void);
65066- void (*end)(void);
65067- int (*pre_snapshot)(void);
65068- void (*finish)(void);
65069- int (*prepare)(void);
65070- int (*enter)(void);
65071- void (*leave)(void);
65072- int (*pre_restore)(void);
65073- void (*restore_cleanup)(void);
65074- void (*recover)(void);
65075+ int (* const begin)(void);
65076+ void (* const end)(void);
65077+ int (* const pre_snapshot)(void);
65078+ void (* const finish)(void);
65079+ int (* const prepare)(void);
65080+ int (* const enter)(void);
65081+ void (* const leave)(void);
65082+ int (* const pre_restore)(void);
65083+ void (* const restore_cleanup)(void);
65084+ void (* const recover)(void);
65085 };
65086
65087 #ifdef CONFIG_HIBERNATION
66a7e928
MT		 65088diff -urNp linux-2.6.39/include/linux/sysctl.h linux-2.6.39/include/linux/sysctl.h
65089--- linux-2.6.39/include/linux/sysctl.h 2011-05-19 00:06:34.000000000 -0400
65090+++ linux-2.6.39/include/linux/sysctl.h 2011-05-22 19:41:42.000000000 -0400
ae4e228f 65091@@ -155,7 +155,11 @@ enum
58c5fc13
MT		 65092 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
65093 };
65094
65095-
65096+#ifdef CONFIG_PAX_SOFTMODE
65097+enum {
65098+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
65099+};
65100+#endif
65101
65102 /* CTL_VM names: */
65103 enum
16454cff 65104@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
bc901d79
MT		 65105
65106 extern int proc_dostring(struct ctl_table *, int,
65107 void __user *, size_t *, loff_t *);
65108+extern int proc_dostring_modpriv(struct ctl_table *, int,
65109+ void __user *, size_t *, loff_t *);
65110 extern int proc_dointvec(struct ctl_table *, int,
65111 void __user *, size_t *, loff_t *);
65112 extern int proc_dointvec_minmax(struct ctl_table *, int,
66a7e928
MT		 65113diff -urNp linux-2.6.39/include/linux/sysfs.h linux-2.6.39/include/linux/sysfs.h
65114--- linux-2.6.39/include/linux/sysfs.h 2011-05-19 00:06:34.000000000 -0400
65115+++ linux-2.6.39/include/linux/sysfs.h 2011-05-22 19:36:33.000000000 -0400
6892158b 65116@@ -110,8 +110,8 @@ struct bin_attribute {
df50ba0c 65117 #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
ae4e228f
MT		 65118
65119 struct sysfs_ops {
65120- ssize_t (*show)(struct kobject *, struct attribute *,char *);
65121- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
65122+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
65123+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
65124 };
65125
65126 struct sysfs_dirent;
66a7e928
MT		 65127diff -urNp linux-2.6.39/include/linux/tty.h linux-2.6.39/include/linux/tty.h
65128--- linux-2.6.39/include/linux/tty.h 2011-05-19 00:06:34.000000000 -0400
65129+++ linux-2.6.39/include/linux/tty.h 2011-05-22 19:36:33.000000000 -0400
65130@@ -13,6 +13,7 @@
ae4e228f
MT		 65131 #include <linux/tty_driver.h>
65132 #include <linux/tty_ldisc.h>
65133 #include <linux/mutex.h>
65134+#include <linux/poll.h>
65135
65136 #include <asm/system.h>
bc901d79 65137
66a7e928 65138@@ -466,7 +467,6 @@ extern int tty_perform_flush(struct tty_
ae4e228f
MT		 65139 extern dev_t tty_devnum(struct tty_struct *tty);
65140 extern void proc_clear_tty(struct task_struct *p);
65141 extern struct tty_struct *get_current_tty(void);
65142-extern void tty_default_fops(struct file_operations *fops);
65143 extern struct tty_struct *alloc_tty_struct(void);
bc901d79 65144 extern int tty_add_file(struct tty_struct *tty, struct file *file);
ae4e228f 65145 extern void free_tty_struct(struct tty_struct *tty);
66a7e928 65146@@ -529,6 +529,18 @@ extern void tty_ldisc_begin(void);
ae4e228f
MT		 65147 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
65148 extern void tty_ldisc_enable(struct tty_struct *tty);
65149
65150+/* tty_io.c */
65151+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
65152+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
65153+extern unsigned int tty_poll(struct file *, poll_table *);
65154+#ifdef CONFIG_COMPAT
65155+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
65156+ unsigned long arg);
65157+#else
65158+#define tty_compat_ioctl NULL
65159+#endif
65160+extern int tty_release(struct inode *, struct file *);
65161+extern int tty_fasync(int fd, struct file *filp, int on);
65162
65163 /* n_tty.c */
65164 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
66a7e928
MT		 65165diff -urNp linux-2.6.39/include/linux/tty_ldisc.h linux-2.6.39/include/linux/tty_ldisc.h
65166--- linux-2.6.39/include/linux/tty_ldisc.h 2011-05-19 00:06:34.000000000 -0400
65167+++ linux-2.6.39/include/linux/tty_ldisc.h 2011-05-22 19:36:33.000000000 -0400
16454cff 65168@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
58c5fc13
MT		 65169
65170 struct module *owner;
65171
65172- int refcount;
65173+ atomic_t refcount;
65174 };
65175
65176 struct tty_ldisc {
66a7e928
MT		 65177diff -urNp linux-2.6.39/include/linux/types.h linux-2.6.39/include/linux/types.h
65178--- linux-2.6.39/include/linux/types.h 2011-05-19 00:06:34.000000000 -0400
65179+++ linux-2.6.39/include/linux/types.h 2011-05-22 19:36:33.000000000 -0400
65180@@ -213,10 +213,26 @@ typedef struct {
57199397 65181 int counter;
58c5fc13
MT		 65182 } atomic_t;
65183
65184+#ifdef CONFIG_PAX_REFCOUNT
65185+typedef struct {
57199397 65186+ int counter;
58c5fc13
MT		 65187+} atomic_unchecked_t;
65188+#else
65189+typedef atomic_t atomic_unchecked_t;
65190+#endif
65191+
65192 #ifdef CONFIG_64BIT
65193 typedef struct {
57199397 65194 long counter;
58c5fc13
MT		 65195 } atomic64_t;
65196+
65197+#ifdef CONFIG_PAX_REFCOUNT
65198+typedef struct {
57199397 65199+ long counter;
58c5fc13
MT		 65200+} atomic64_unchecked_t;
65201+#else
65202+typedef atomic64_t atomic64_unchecked_t;
65203+#endif
65204 #endif
65205
6892158b 65206 struct list_head {
66a7e928
MT		 65207diff -urNp linux-2.6.39/include/linux/uaccess.h linux-2.6.39/include/linux/uaccess.h
65208--- linux-2.6.39/include/linux/uaccess.h 2011-05-19 00:06:34.000000000 -0400
65209+++ linux-2.6.39/include/linux/uaccess.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 65210@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
65211 long ret; \
65212 mm_segment_t old_fs = get_fs(); \
65213 \
65214- set_fs(KERNEL_DS); \
65215 pagefault_disable(); \
65216+ set_fs(KERNEL_DS); \
65217 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
65218- pagefault_enable(); \
65219 set_fs(old_fs); \
65220+ pagefault_enable(); \
65221 ret; \
65222 })
65223
ae4e228f
MT		 65224@@ -93,8 +93,8 @@ static inline unsigned long __copy_from_
65225 * Safely read from address @src to the buffer at @dst. If a kernel fault
65226 * happens, handle that and return -EFAULT.
65227 */
65228-extern long probe_kernel_read(void *dst, void *src, size_t size);
65229-extern long __probe_kernel_read(void *dst, void *src, size_t size);
65230+extern long probe_kernel_read(void *dst, const void *src, size_t size);
65231+extern long __probe_kernel_read(void *dst, const void *src, size_t size);
65232
65233 /*
65234 * probe_kernel_write(): safely attempt to write to a location
65235@@ -105,7 +105,7 @@ extern long __probe_kernel_read(void *ds
65236 * Safely write to address @dst from the buffer at @src. If a kernel fault
65237 * happens, handle that and return -EFAULT.
65238 */
65239-extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
65240-extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
65241+extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
65242+extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
65243
65244 #endif /* __LINUX_UACCESS_H__ */
66a7e928
MT		 65245diff -urNp linux-2.6.39/include/linux/unaligned/access_ok.h linux-2.6.39/include/linux/unaligned/access_ok.h
65246--- linux-2.6.39/include/linux/unaligned/access_ok.h 2011-05-19 00:06:34.000000000 -0400
65247+++ linux-2.6.39/include/linux/unaligned/access_ok.h 2011-05-22 19:36:33.000000000 -0400
bc901d79
MT		 65248@@ -6,32 +6,32 @@
65249
65250 static inline u16 get_unaligned_le16(const void *p)
65251 {
65252- return le16_to_cpup((__le16 *)p);
65253+ return le16_to_cpup((const __le16 *)p);
65254 }
65255
65256 static inline u32 get_unaligned_le32(const void *p)
65257 {
65258- return le32_to_cpup((__le32 *)p);
65259+ return le32_to_cpup((const __le32 *)p);
65260 }
65261
65262 static inline u64 get_unaligned_le64(const void *p)
65263 {
65264- return le64_to_cpup((__le64 *)p);
65265+ return le64_to_cpup((const __le64 *)p);
65266 }
65267
65268 static inline u16 get_unaligned_be16(const void *p)
65269 {
65270- return be16_to_cpup((__be16 *)p);
65271+ return be16_to_cpup((const __be16 *)p);
65272 }
65273
65274 static inline u32 get_unaligned_be32(const void *p)
65275 {
65276- return be32_to_cpup((__be32 *)p);
65277+ return be32_to_cpup((const __be32 *)p);
65278 }
65279
65280 static inline u64 get_unaligned_be64(const void *p)
65281 {
65282- return be64_to_cpup((__be64 *)p);
65283+ return be64_to_cpup((const __be64 *)p);
65284 }
65285
65286 static inline void put_unaligned_le16(u16 val, void *p)
66a7e928
MT		 65287diff -urNp linux-2.6.39/include/linux/usb/hcd.h linux-2.6.39/include/linux/usb/hcd.h
65288--- linux-2.6.39/include/linux/usb/hcd.h 2011-05-19 00:06:34.000000000 -0400
65289+++ linux-2.6.39/include/linux/usb/hcd.h 2011-05-22 19:36:33.000000000 -0400
65290@@ -615,7 +615,7 @@ struct usb_mon_operations {
57199397
MT		 65291 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
65292 };
65293
65294-extern struct usb_mon_operations *mon_ops;
65295+extern const struct usb_mon_operations *mon_ops;
65296
65297 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
65298 {
66a7e928 65299@@ -637,7 +637,7 @@ static inline void usbmon_urb_complete(s
57199397
MT		 65300 (*mon_ops->urb_complete)(bus, urb, status);
65301 }
65302
65303-int usb_mon_register(struct usb_mon_operations *ops);
65304+int usb_mon_register(const struct usb_mon_operations *ops);
65305 void usb_mon_deregister(void);
65306
65307 #else
66a7e928
MT		 65308diff -urNp linux-2.6.39/include/linux/usb/intel_mid_otg.h linux-2.6.39/include/linux/usb/intel_mid_otg.h
65309--- linux-2.6.39/include/linux/usb/intel_mid_otg.h 2011-05-19 00:06:34.000000000 -0400
65310+++ linux-2.6.39/include/linux/usb/intel_mid_otg.h 2011-05-22 19:36:33.000000000 -0400
65311@@ -115,7 +115,7 @@ struct intel_mid_otg_xceiv {
65312 void __iomem *base;
65313
65314 /* ops to access ulpi */
65315- struct iotg_ulpi_access_ops ulpi_ops;
65316+ const struct iotg_ulpi_access_ops ulpi_ops;
65317
65318 /* atomic notifier for interrupt context */
65319 struct atomic_notifier_head iotg_notifier;
65320diff -urNp linux-2.6.39/include/linux/usb/ulpi.h linux-2.6.39/include/linux/usb/ulpi.h
65321--- linux-2.6.39/include/linux/usb/ulpi.h 2011-05-19 00:06:34.000000000 -0400
65322+++ linux-2.6.39/include/linux/usb/ulpi.h 2011-05-22 19:36:33.000000000 -0400
65323@@ -186,7 +186,7 @@ struct otg_transceiver *otg_ulpi_create(
65324
65325 #ifdef CONFIG_USB_ULPI_VIEWPORT
65326 /* access ops for controllers with a viewport register */
65327-extern struct otg_io_access_ops ulpi_viewport_access_ops;
65328+extern const struct otg_io_access_ops ulpi_viewport_access_ops;
65329 #endif
65330
65331 #endif /* __LINUX_USB_ULPI_H */
65332diff -urNp linux-2.6.39/include/linux/vga_switcheroo.h linux-2.6.39/include/linux/vga_switcheroo.h
65333--- linux-2.6.39/include/linux/vga_switcheroo.h 2011-05-19 00:06:34.000000000 -0400
65334+++ linux-2.6.39/include/linux/vga_switcheroo.h 2011-05-22 19:36:33.000000000 -0400
65335@@ -39,7 +39,7 @@ int vga_switcheroo_register_client(struc
65336 void vga_switcheroo_client_fb_set(struct pci_dev *dev,
65337 struct fb_info *info);
65338
65339-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler);
65340+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler);
65341 void vga_switcheroo_unregister_handler(void);
65342
65343 int vga_switcheroo_process_delayed_switch(void);
65344@@ -52,7 +52,7 @@ static inline int vga_switcheroo_registe
65345 void (*reprobe)(struct pci_dev *dev),
65346 bool (*can_switch)(struct pci_dev *dev)) { return 0; }
65347 static inline void vga_switcheroo_client_fb_set(struct pci_dev *dev, struct fb_info *info) {}
65348-static inline int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler) { return 0; }
65349+static inline int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler) { return 0; }
65350 static inline void vga_switcheroo_unregister_handler(void) {}
65351 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
65352
65353diff -urNp linux-2.6.39/include/linux/virtio.h linux-2.6.39/include/linux/virtio.h
65354--- linux-2.6.39/include/linux/virtio.h 2011-05-19 00:06:34.000000000 -0400
65355+++ linux-2.6.39/include/linux/virtio.h 2011-05-22 19:36:33.000000000 -0400
65356@@ -102,7 +102,7 @@ struct virtio_device {
65357 int index;
65358 struct device dev;
65359 struct virtio_device_id id;
65360- struct virtio_config_ops *config;
65361+ const struct virtio_config_ops *config;
65362 struct list_head vqs;
65363 /* Note that this is a Linux set_bit-style bitmap. */
65364 unsigned long features[1];
65365diff -urNp linux-2.6.39/include/linux/vmalloc.h linux-2.6.39/include/linux/vmalloc.h
65366--- linux-2.6.39/include/linux/vmalloc.h 2011-05-19 00:06:34.000000000 -0400
65367+++ linux-2.6.39/include/linux/vmalloc.h 2011-05-22 19:36:33.000000000 -0400
bc901d79 65368@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
58c5fc13
MT		 65369 #define VM_MAP 0x00000004 /* vmap()ed pages */
65370 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
65371 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
65372+
df50ba0c 65373+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
58c5fc13
MT		 65374+#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
65375+#endif
65376+
65377 /* bits [20..32] reserved for arch specific ioremap internals */
65378
65379 /*
66a7e928
MT		 65380@@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
65381 # endif
bc901d79 65382 #endif
58c5fc13
MT		 65383
65384+#define vmalloc(x) \
65385+({ \
65386+ void *___retval; \
65387+ intoverflow_t ___x = (intoverflow_t)x; \
65388+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
65389+ ___retval = NULL; \
65390+ else \
65391+ ___retval = vmalloc((unsigned long)___x); \
65392+ ___retval; \
65393+})
65394+
bc901d79
MT		 65395+#define vzalloc(x) \
65396+({ \
65397+ void *___retval; \
65398+ intoverflow_t ___x = (intoverflow_t)x; \
65399+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
65400+ ___retval = NULL; \
65401+ else \
65402+ ___retval = vzalloc((unsigned long)___x); \
65403+ ___retval; \
65404+})
65405+
58c5fc13
MT		 65406+#define __vmalloc(x, y, z) \
65407+({ \
65408+ void *___retval; \
65409+ intoverflow_t ___x = (intoverflow_t)x; \
65410+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
65411+ ___retval = NULL; \
65412+ else \
65413+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
65414+ ___retval; \
65415+})
65416+
65417+#define vmalloc_user(x) \
65418+({ \
65419+ void *___retval; \
65420+ intoverflow_t ___x = (intoverflow_t)x; \
65421+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
65422+ ___retval = NULL; \
65423+ else \
65424+ ___retval = vmalloc_user((unsigned long)___x); \
65425+ ___retval; \
65426+})
65427+
65428+#define vmalloc_exec(x) \
65429+({ \
65430+ void *___retval; \
65431+ intoverflow_t ___x = (intoverflow_t)x; \
65432+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
65433+ ___retval = NULL; \
65434+ else \
65435+ ___retval = vmalloc_exec((unsigned long)___x); \
65436+ ___retval; \
65437+})
65438+
65439+#define vmalloc_node(x, y) \
65440+({ \
65441+ void *___retval; \
65442+ intoverflow_t ___x = (intoverflow_t)x; \
65443+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
65444+ ___retval = NULL; \
65445+ else \
65446+ ___retval = vmalloc_node((unsigned long)___x, (y));\
65447+ ___retval; \
65448+})
65449+
bc901d79
MT		 65450+#define vzalloc_node(x, y) \
65451+({ \
65452+ void *___retval; \
65453+ intoverflow_t ___x = (intoverflow_t)x; \
65454+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
65455+ ___retval = NULL; \
65456+ else \
65457+ ___retval = vzalloc_node((unsigned long)___x, (y));\
65458+ ___retval; \
65459+})
65460+
58c5fc13
MT		 65461+#define vmalloc_32(x) \
65462+({ \
65463+ void *___retval; \
65464+ intoverflow_t ___x = (intoverflow_t)x; \
65465+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
65466+ ___retval = NULL; \
65467+ else \
65468+ ___retval = vmalloc_32((unsigned long)___x); \
65469+ ___retval; \
65470+})
65471+
65472+#define vmalloc_32_user(x) \
65473+({ \
bc901d79 65474+void *___retval; \
58c5fc13
MT		 65475+ intoverflow_t ___x = (intoverflow_t)x; \
65476+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
65477+ ___retval = NULL; \
65478+ else \
65479+ ___retval = vmalloc_32_user((unsigned long)___x);\
65480+ ___retval; \
65481+})
65482+
65483 #endif /* _LINUX_VMALLOC_H */
66a7e928
MT		 65484diff -urNp linux-2.6.39/include/linux/vmstat.h linux-2.6.39/include/linux/vmstat.h
65485--- linux-2.6.39/include/linux/vmstat.h 2011-05-19 00:06:34.000000000 -0400
65486+++ linux-2.6.39/include/linux/vmstat.h 2011-05-22 19:36:33.000000000 -0400
65487@@ -147,18 +147,18 @@ static inline void vm_events_fold_cpu(in
57199397
MT		 65488 /*
65489 * Zone based page accounting with per cpu differentials.
65490 */
65491-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65492+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65493
65494 static inline void zone_page_state_add(long x, struct zone *zone,
65495 enum zone_stat_item item)
65496 {
65497- atomic_long_add(x, &zone->vm_stat[item]);
65498- atomic_long_add(x, &vm_stat[item]);
65499+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
65500+ atomic_long_add_unchecked(x, &vm_stat[item]);
65501 }
65502
65503 static inline unsigned long global_page_state(enum zone_stat_item item)
65504 {
65505- long x = atomic_long_read(&vm_stat[item]);
65506+ long x = atomic_long_read_unchecked(&vm_stat[item]);
65507 #ifdef CONFIG_SMP
65508 if (x < 0)
65509 x = 0;
66a7e928 65510@@ -169,7 +169,7 @@ static inline unsigned long global_page_
57199397
MT		 65511 static inline unsigned long zone_page_state(struct zone *zone,
65512 enum zone_stat_item item)
65513 {
65514- long x = atomic_long_read(&zone->vm_stat[item]);
65515+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65516 #ifdef CONFIG_SMP
65517 if (x < 0)
65518 x = 0;
66a7e928 65519@@ -186,7 +186,7 @@ static inline unsigned long zone_page_st
6892158b
MT		 65520 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
65521 enum zone_stat_item item)
65522 {
65523- long x = atomic_long_read(&zone->vm_stat[item]);
65524+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65525
65526 #ifdef CONFIG_SMP
65527 int cpu;
66a7e928 65528@@ -280,8 +280,8 @@ static inline void __mod_zone_page_state
57199397
MT		 65529
65530 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
65531 {
65532- atomic_long_inc(&zone->vm_stat[item]);
65533- atomic_long_inc(&vm_stat[item]);
65534+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
65535+ atomic_long_inc_unchecked(&vm_stat[item]);
65536 }
65537
65538 static inline void __inc_zone_page_state(struct page *page,
66a7e928 65539@@ -292,8 +292,8 @@ static inline void __inc_zone_page_state
57199397
MT		 65540
65541 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
65542 {
65543- atomic_long_dec(&zone->vm_stat[item]);
65544- atomic_long_dec(&vm_stat[item]);
65545+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
65546+ atomic_long_dec_unchecked(&vm_stat[item]);
65547 }
65548
65549 static inline void __dec_zone_page_state(struct page *page,
66a7e928
MT		 65550diff -urNp linux-2.6.39/include/media/saa7146_vv.h linux-2.6.39/include/media/saa7146_vv.h
65551--- linux-2.6.39/include/media/saa7146_vv.h 2011-05-19 00:06:34.000000000 -0400
65552+++ linux-2.6.39/include/media/saa7146_vv.h 2011-05-22 19:36:33.000000000 -0400
65553@@ -202,13 +202,13 @@ void saa7146_set_gpio(struct saa7146_dev
65554
65555 /* from saa7146_video.c */
65556 extern const struct v4l2_ioctl_ops saa7146_video_ioctl_ops;
65557-extern struct saa7146_use_ops saa7146_video_uops;
65558+extern const struct saa7146_use_ops saa7146_video_uops;
65559 int saa7146_start_preview(struct saa7146_fh *fh);
65560 int saa7146_stop_preview(struct saa7146_fh *fh);
65561 long saa7146_video_do_ioctl(struct file *file, unsigned int cmd, void *arg);
65562
65563 /* from saa7146_vbi.c */
65564-extern struct saa7146_use_ops saa7146_vbi_uops;
65565+extern const struct saa7146_use_ops saa7146_vbi_uops;
65566
65567 /* resource management functions */
65568 int saa7146_res_get(struct saa7146_fh *fh, unsigned int bit);
65569diff -urNp linux-2.6.39/include/media/v4l2-device.h linux-2.6.39/include/media/v4l2-device.h
65570--- linux-2.6.39/include/media/v4l2-device.h 2011-05-19 00:06:34.000000000 -0400
65571+++ linux-2.6.39/include/media/v4l2-device.h 2011-05-22 19:36:33.000000000 -0400
65572@@ -95,7 +95,7 @@ int __must_check v4l2_device_register(st
8308f9c9
MT		 65573 this function returns 0. If the name ends with a digit (e.g. cx18),
65574 then the name will be set to cx18-0 since cx180 looks really odd. */
65575 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
65576- atomic_t *instance);
65577+ atomic_unchecked_t *instance);
65578
65579 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
65580 Since the parent disappears this ensures that v4l2_dev doesn't have an
66a7e928
MT		 65581diff -urNp linux-2.6.39/include/net/caif/cfctrl.h linux-2.6.39/include/net/caif/cfctrl.h
65582--- linux-2.6.39/include/net/caif/cfctrl.h 2011-05-19 00:06:34.000000000 -0400
65583+++ linux-2.6.39/include/net/caif/cfctrl.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 65584@@ -101,8 +101,8 @@ struct cfctrl_request_info {
65585 struct cfctrl {
65586 struct cfsrvl serv;
65587 struct cfctrl_rsp res;
65588- atomic_t req_seq_no;
65589- atomic_t rsp_seq_no;
65590+ atomic_unchecked_t req_seq_no;
65591+ atomic_unchecked_t rsp_seq_no;
65592 struct list_head list;
65593 /* Protects from simultaneous access to first_req list */
65594 spinlock_t info_list_lock;
66a7e928
MT		 65595diff -urNp linux-2.6.39/include/net/flow.h linux-2.6.39/include/net/flow.h
65596--- linux-2.6.39/include/net/flow.h 2011-05-19 00:06:34.000000000 -0400
65597+++ linux-2.6.39/include/net/flow.h 2011-05-22 19:36:33.000000000 -0400
65598@@ -167,6 +167,6 @@ extern struct flow_cache_object *flow_ca
8308f9c9
MT		 65599 u8 dir, flow_resolve_t resolver, void *ctx);
65600
65601 extern void flow_cache_flush(void);
65602-extern atomic_t flow_cache_genid;
65603+extern atomic_unchecked_t flow_cache_genid;
65604
66a7e928
MT		 65605 #endif
65606diff -urNp linux-2.6.39/include/net/inetpeer.h linux-2.6.39/include/net/inetpeer.h
65607--- linux-2.6.39/include/net/inetpeer.h 2011-05-19 00:06:34.000000000 -0400
65608+++ linux-2.6.39/include/net/inetpeer.h 2011-05-22 19:36:33.000000000 -0400
65609@@ -43,8 +43,8 @@ struct inet_peer {
6892158b
MT		 65610 */
65611 union {
65612 struct {
66a7e928
MT		 65613- atomic_t rid; /* Frag reception counter */
65614- atomic_t ip_id_count; /* IP ID for the next packet */
65615+ atomic_unchecked_t rid; /* Frag reception counter */
65616+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
65617 __u32 tcp_ts;
65618 __u32 tcp_ts_stamp;
65619 u32 metrics[RTAX_MAX];
65620@@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
6892158b
MT		 65621 {
65622 more++;
65623 inet_peer_refcheck(p);
65624- return atomic_add_return(more, &p->ip_id_count) - more;
65625+ return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
65626 }
65627
65628 #endif /* _NET_INETPEER_H */
66a7e928
MT		 65629diff -urNp linux-2.6.39/include/net/ip_fib.h linux-2.6.39/include/net/ip_fib.h
65630--- linux-2.6.39/include/net/ip_fib.h 2011-05-19 00:06:34.000000000 -0400
65631+++ linux-2.6.39/include/net/ip_fib.h 2011-05-22 19:36:33.000000000 -0400
65632@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
65633
65634 #define FIB_RES_SADDR(net, res) \
65635 ((FIB_RES_NH(res).nh_saddr_genid == \
65636- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
65637+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
65638 FIB_RES_NH(res).nh_saddr : \
65639 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
65640 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
65641diff -urNp linux-2.6.39/include/net/ip_vs.h linux-2.6.39/include/net/ip_vs.h
65642--- linux-2.6.39/include/net/ip_vs.h 2011-05-19 00:06:34.000000000 -0400
65643+++ linux-2.6.39/include/net/ip_vs.h 2011-05-22 19:36:33.000000000 -0400
65644@@ -512,7 +512,7 @@ struct ip_vs_conn {
8308f9c9
MT		 65645 struct ip_vs_conn *control; /* Master control connection */
65646 atomic_t n_control; /* Number of controlled ones */
65647 struct ip_vs_dest *dest; /* real server */
65648- atomic_t in_pkts; /* incoming packet counter */
65649+ atomic_unchecked_t in_pkts; /* incoming packet counter */
65650
65651 /* packet transmitter for different forwarding methods. If it
65652 mangles the packet, it must return NF_DROP or better NF_STOLEN,
66a7e928 65653@@ -650,7 +650,7 @@ struct ip_vs_dest {
8308f9c9 65654 __be16 port; /* port number of the server */
66a7e928 65655 union nf_inet_addr addr; /* IP address of the server */
8308f9c9
MT		 65656 volatile unsigned flags; /* dest status flags */
65657- atomic_t conn_flags; /* flags to copy to conn */
65658+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
65659 atomic_t weight; /* server weight */
65660
65661 atomic_t refcnt; /* reference counter */
66a7e928
MT		 65662diff -urNp linux-2.6.39/include/net/irda/ircomm_tty.h linux-2.6.39/include/net/irda/ircomm_tty.h
65663--- linux-2.6.39/include/net/irda/ircomm_tty.h 2011-05-19 00:06:34.000000000 -0400
65664+++ linux-2.6.39/include/net/irda/ircomm_tty.h 2011-05-22 19:36:33.000000000 -0400
c52201e0
MT		 65665@@ -35,6 +35,7 @@
65666 #include <linux/termios.h>
65667 #include <linux/timer.h>
65668 #include <linux/tty.h> /* struct tty_struct */
65669+#include <asm/local.h>
65670
65671 #include <net/irda/irias_object.h>
65672 #include <net/irda/ircomm_core.h>
65673@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
58c5fc13
MT		 65674 unsigned short close_delay;
65675 unsigned short closing_wait; /* time to wait before closing */
65676
65677- int open_count;
65678- int blocked_open; /* # of blocked opens */
c52201e0
MT		 65679+ local_t open_count;
65680+ local_t blocked_open; /* # of blocked opens */
58c5fc13
MT		 65681
65682 /* Protect concurent access to :
65683 * o self->open_count
66a7e928
MT		 65684diff -urNp linux-2.6.39/include/net/iucv/af_iucv.h linux-2.6.39/include/net/iucv/af_iucv.h
65685--- linux-2.6.39/include/net/iucv/af_iucv.h 2011-05-19 00:06:34.000000000 -0400
65686+++ linux-2.6.39/include/net/iucv/af_iucv.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 65687@@ -87,7 +87,7 @@ struct iucv_sock {
65688 struct iucv_sock_list {
65689 struct hlist_head head;
65690 rwlock_t lock;
65691- atomic_t autobind_name;
65692+ atomic_unchecked_t autobind_name;
65693 };
65694
65695 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
66a7e928
MT		 65696diff -urNp linux-2.6.39/include/net/neighbour.h linux-2.6.39/include/net/neighbour.h
65697--- linux-2.6.39/include/net/neighbour.h 2011-05-19 00:06:34.000000000 -0400
65698+++ linux-2.6.39/include/net/neighbour.h 2011-05-22 19:36:33.000000000 -0400
bc901d79 65699@@ -118,12 +118,12 @@ struct neighbour {
ae4e228f
MT		 65700
65701 struct neigh_ops {
65702 int family;
65703- void (*solicit)(struct neighbour *, struct sk_buff*);
65704- void (*error_report)(struct neighbour *, struct sk_buff*);
65705- int (*output)(struct sk_buff*);
65706- int (*connected_output)(struct sk_buff*);
65707- int (*hh_output)(struct sk_buff*);
65708- int (*queue_xmit)(struct sk_buff*);
65709+ void (* const solicit)(struct neighbour *, struct sk_buff*);
65710+ void (* const error_report)(struct neighbour *, struct sk_buff*);
65711+ int (* const output)(struct sk_buff*);
65712+ int (* const connected_output)(struct sk_buff*);
65713+ int (* const hh_output)(struct sk_buff*);
65714+ int (* const queue_xmit)(struct sk_buff*);
65715 };
65716
65717 struct pneigh_entry {
66a7e928
MT		 65718diff -urNp linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h
65719--- linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h 2011-05-19 00:06:34.000000000 -0400
65720+++ linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h 2011-05-22 19:36:33.000000000 -0400
65721@@ -95,7 +95,7 @@ nf_conntrack_eventmask_report(unsigned i
65722 int report)
65723 {
65724 int ret = 0;
65725- struct nf_ct_event_notifier *notify;
65726+ const struct nf_ct_event_notifier *notify;
65727 struct nf_conntrack_ecache *e;
65728
65729 rcu_read_lock();
65730@@ -174,7 +174,7 @@ nf_ct_expect_event_report(enum ip_conntr
65731 u32 pid,
65732 int report)
65733 {
65734- struct nf_exp_event_notifier *notify;
65735+ const struct nf_exp_event_notifier *notify;
65736 struct nf_conntrack_ecache *e;
65737
65738 rcu_read_lock();
65739diff -urNp linux-2.6.39/include/net/netlink.h linux-2.6.39/include/net/netlink.h
65740--- linux-2.6.39/include/net/netlink.h 2011-05-19 00:06:34.000000000 -0400
65741+++ linux-2.6.39/include/net/netlink.h 2011-05-22 19:36:33.000000000 -0400
16454cff 65742@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
bc901d79
MT		 65743 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
65744 {
65745 if (mark)
65746- skb_trim(skb, (unsigned char *) mark - skb->data);
65747+ skb_trim(skb, (const unsigned char *) mark - skb->data);
65748 }
65749
65750 /**
66a7e928
MT		 65751diff -urNp linux-2.6.39/include/net/netns/ipv4.h linux-2.6.39/include/net/netns/ipv4.h
65752--- linux-2.6.39/include/net/netns/ipv4.h 2011-05-19 00:06:34.000000000 -0400
65753+++ linux-2.6.39/include/net/netns/ipv4.h 2011-05-22 19:36:33.000000000 -0400
65754@@ -54,8 +54,8 @@ struct netns_ipv4 {
8308f9c9
MT		 65755 int sysctl_rt_cache_rebuild_count;
65756 int current_rt_cache_rebuild_count;
65757
65758- atomic_t rt_genid;
66a7e928 65759- atomic_t dev_addr_genid;
8308f9c9 65760+ atomic_unchecked_t rt_genid;
66a7e928 65761+ atomic_unchecked_t dev_addr_genid;
8308f9c9
MT		 65762
65763 #ifdef CONFIG_IP_MROUTE
65764 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
66a7e928
MT		 65765diff -urNp linux-2.6.39/include/net/sctp/sctp.h linux-2.6.39/include/net/sctp/sctp.h
65766--- linux-2.6.39/include/net/sctp/sctp.h 2011-05-19 00:06:34.000000000 -0400
65767+++ linux-2.6.39/include/net/sctp/sctp.h 2011-05-22 19:36:33.000000000 -0400
bc901d79 65768@@ -316,9 +316,9 @@ do { \
58c5fc13
MT		 65769
65770 #else /* SCTP_DEBUG */
65771
65772-#define SCTP_DEBUG_PRINTK(whatever...)
bc901d79 65773-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
58c5fc13
MT		 65774-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
65775+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
bc901d79 65776+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
58c5fc13
MT		 65777+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
65778 #define SCTP_ENABLE_DEBUG
65779 #define SCTP_DISABLE_DEBUG
65780 #define SCTP_ASSERT(expr, str, func)
66a7e928
MT		 65781diff -urNp linux-2.6.39/include/net/sock.h linux-2.6.39/include/net/sock.h
65782--- linux-2.6.39/include/net/sock.h 2011-05-19 00:06:34.000000000 -0400
65783+++ linux-2.6.39/include/net/sock.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 65784@@ -277,7 +277,7 @@ struct sock {
65785 #ifdef CONFIG_RPS
65786 __u32 sk_rxhash;
65787 #endif
65788- atomic_t sk_drops;
65789+ atomic_unchecked_t sk_drops;
65790 int sk_rcvbuf;
65791
65792 struct sk_filter __rcu *sk_filter;
66a7e928
MT		 65793diff -urNp linux-2.6.39/include/net/tcp.h linux-2.6.39/include/net/tcp.h
65794--- linux-2.6.39/include/net/tcp.h 2011-05-19 00:06:34.000000000 -0400
65795+++ linux-2.6.39/include/net/tcp.h 2011-05-22 19:36:33.000000000 -0400
65796@@ -1374,7 +1374,7 @@ enum tcp_seq_states {
ae4e228f
MT		 65797 struct tcp_seq_afinfo {
65798 char *name;
65799 sa_family_t family;
16454cff
MT		 65800- struct file_operations seq_fops;
65801+ struct file_operations seq_fops; /* cannot be const */
ae4e228f
MT		 65802 struct seq_operations seq_ops;
65803 };
16454cff 65804
66a7e928
MT		 65805diff -urNp linux-2.6.39/include/net/udp.h linux-2.6.39/include/net/udp.h
65806--- linux-2.6.39/include/net/udp.h 2011-05-19 00:06:34.000000000 -0400
65807+++ linux-2.6.39/include/net/udp.h 2011-05-22 19:36:33.000000000 -0400
65808@@ -234,7 +234,7 @@ struct udp_seq_afinfo {
ae4e228f
MT		 65809 char *name;
65810 sa_family_t family;
65811 struct udp_table *udp_table;
16454cff
MT		 65812- struct file_operations seq_fops;
65813+ struct file_operations seq_fops; /* cannot be const */
ae4e228f
MT		 65814 struct seq_operations seq_ops;
65815 };
16454cff 65816
66a7e928
MT		 65817diff -urNp linux-2.6.39/include/net/xfrm.h linux-2.6.39/include/net/xfrm.h
65818--- linux-2.6.39/include/net/xfrm.h 2011-05-19 00:06:34.000000000 -0400
65819+++ linux-2.6.39/include/net/xfrm.h 2011-05-22 19:36:33.000000000 -0400
65820@@ -505,7 +505,7 @@ struct xfrm_policy {
8308f9c9
MT		 65821 struct timer_list timer;
65822
65823 struct flow_cache_object flo;
65824- atomic_t genid;
65825+ atomic_unchecked_t genid;
65826 u32 priority;
65827 u32 index;
65828 struct xfrm_mark mark;
66a7e928
MT		 65829diff -urNp linux-2.6.39/include/pcmcia/ss.h linux-2.6.39/include/pcmcia/ss.h
65830--- linux-2.6.39/include/pcmcia/ss.h 2011-05-19 00:06:34.000000000 -0400
65831+++ linux-2.6.39/include/pcmcia/ss.h 2011-05-22 19:36:33.000000000 -0400
65832@@ -241,9 +241,9 @@ struct pcmcia_socket {
65833 * "select PCCARD_NONSTATIC" in Kconfig.
65834 *
65835 */
65836-extern struct pccard_resource_ops pccard_static_ops;
65837+extern const struct pccard_resource_ops pccard_static_ops;
65838 #if defined(CONFIG_PCMCIA) || defined(CONFIG_PCMCIA_MODULE)
65839-extern struct pccard_resource_ops pccard_iodyn_ops;
65840+extern const struct pccard_resource_ops pccard_iodyn_ops;
65841 extern struct pccard_resource_ops pccard_nonstatic_ops;
65842 #else
65843 /* If PCMCIA is not used, but only CARDBUS, these functions are not used
65844diff -urNp linux-2.6.39/include/rdma/ib_verbs.h linux-2.6.39/include/rdma/ib_verbs.h
65845--- linux-2.6.39/include/rdma/ib_verbs.h 2011-05-19 00:06:34.000000000 -0400
65846+++ linux-2.6.39/include/rdma/ib_verbs.h 2011-05-22 19:36:33.000000000 -0400
65847@@ -1149,7 +1149,7 @@ struct ib_device {
65848 struct ib_mad *in_mad,
65849 struct ib_mad *out_mad);
65850
65851- struct ib_dma_mapping_ops *dma_ops;
65852+ const struct ib_dma_mapping_ops *dma_ops;
65853
65854 struct module *owner;
65855 struct device dev;
65856diff -urNp linux-2.6.39/include/scsi/libfc.h linux-2.6.39/include/scsi/libfc.h
65857--- linux-2.6.39/include/scsi/libfc.h 2011-05-19 00:06:34.000000000 -0400
65858+++ linux-2.6.39/include/scsi/libfc.h 2011-05-22 19:36:33.000000000 -0400
65859@@ -202,7 +202,7 @@ struct fc_rport_priv {
65860 struct mutex rp_mutex;
65861 struct delayed_work retry_work;
65862 enum fc_rport_event event;
65863- struct fc_rport_operations *ops;
65864+ const struct fc_rport_operations *ops;
65865 struct list_head peers;
65866 struct work_struct event_work;
65867 u32 supported_classes;
65868diff -urNp linux-2.6.39/include/scsi/scsi_device.h linux-2.6.39/include/scsi/scsi_device.h
65869--- linux-2.6.39/include/scsi/scsi_device.h 2011-05-19 00:06:34.000000000 -0400
65870+++ linux-2.6.39/include/scsi/scsi_device.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 65871@@ -161,9 +161,9 @@ struct scsi_device {
65872 unsigned int max_device_blocked; /* what device_blocked counts down from */
65873 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
65874
65875- atomic_t iorequest_cnt;
65876- atomic_t iodone_cnt;
65877- atomic_t ioerr_cnt;
65878+ atomic_unchecked_t iorequest_cnt;
65879+ atomic_unchecked_t iodone_cnt;
65880+ atomic_unchecked_t ioerr_cnt;
65881
65882 struct device sdev_gendev,
65883 sdev_dev;
66a7e928
MT		 65884diff -urNp linux-2.6.39/include/sound/ac97_codec.h linux-2.6.39/include/sound/ac97_codec.h
65885--- linux-2.6.39/include/sound/ac97_codec.h 2011-05-19 00:06:34.000000000 -0400
65886+++ linux-2.6.39/include/sound/ac97_codec.h 2011-05-22 19:36:33.000000000 -0400
65887@@ -424,15 +424,15 @@
ae4e228f
MT		 65888 struct snd_ac97;
65889
65890 struct snd_ac97_build_ops {
65891- int (*build_3d) (struct snd_ac97 *ac97);
65892- int (*build_specific) (struct snd_ac97 *ac97);
65893- int (*build_spdif) (struct snd_ac97 *ac97);
65894- int (*build_post_spdif) (struct snd_ac97 *ac97);
65895+ int (* const build_3d) (struct snd_ac97 *ac97);
65896+ int (* const build_specific) (struct snd_ac97 *ac97);
65897+ int (* const build_spdif) (struct snd_ac97 *ac97);
65898+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
65899 #ifdef CONFIG_PM
65900- void (*suspend) (struct snd_ac97 *ac97);
65901- void (*resume) (struct snd_ac97 *ac97);
65902+ void (* const suspend) (struct snd_ac97 *ac97);
65903+ void (* const resume) (struct snd_ac97 *ac97);
58c5fc13 65904 #endif
ae4e228f
MT		 65905- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65906+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65907 };
65908
65909 struct snd_ac97_bus_ops {
66a7e928
MT		 65910@@ -446,7 +446,7 @@ struct snd_ac97_bus_ops {
65911
65912 struct snd_ac97_bus {
65913 /* -- lowlevel (hardware) driver specific -- */
65914- struct snd_ac97_bus_ops *ops;
65915+ const struct snd_ac97_bus_ops *ops;
65916 void *private_data;
65917 void (*private_free) (struct snd_ac97_bus *bus);
65918 /* --- */
65919@@ -556,7 +556,7 @@ static inline int ac97_can_spdif(struct
65920
65921 /* functions */
65922 /* create new AC97 bus */
65923-int snd_ac97_bus(struct snd_card *card, int num, struct snd_ac97_bus_ops *ops,
65924+int snd_ac97_bus(struct snd_card *card, int num, const struct snd_ac97_bus_ops *ops,
65925 void *private_data, struct snd_ac97_bus **rbus);
65926 /* create mixer controls */
65927 int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
65928diff -urNp linux-2.6.39/include/sound/core.h linux-2.6.39/include/sound/core.h
65929--- linux-2.6.39/include/sound/core.h 2011-05-19 00:06:34.000000000 -0400
65930+++ linux-2.6.39/include/sound/core.h 2011-05-22 19:36:33.000000000 -0400
65931@@ -88,7 +88,7 @@ struct snd_device {
65932 snd_device_state_t state; /* state of the device */
65933 snd_device_type_t type; /* device type */
65934 void *device_data; /* device structure */
65935- struct snd_device_ops *ops; /* operations */
65936+ const struct snd_device_ops *ops; /* operations */
65937 };
65938
65939 #define snd_device(n) list_entry(n, struct snd_device, list)
65940@@ -301,7 +301,7 @@ int snd_card_file_remove(struct snd_card
65941 /* device.c */
65942
65943 int snd_device_new(struct snd_card *card, snd_device_type_t type,
65944- void *device_data, struct snd_device_ops *ops);
65945+ void *device_data, const struct snd_device_ops *ops);
65946 int snd_device_register(struct snd_card *card, void *device_data);
65947 int snd_device_register_all(struct snd_card *card);
65948 int snd_device_disconnect(struct snd_card *card, void *device_data);
65949diff -urNp linux-2.6.39/include/sound/pcm.h linux-2.6.39/include/sound/pcm.h
65950--- linux-2.6.39/include/sound/pcm.h 2011-05-19 00:06:34.000000000 -0400
65951+++ linux-2.6.39/include/sound/pcm.h 2011-05-22 19:36:33.000000000 -0400
65952@@ -379,7 +379,7 @@ struct snd_pcm_substream {
65953 unsigned int dma_buf_id;
65954 size_t dma_max;
65955 /* -- hardware operations -- */
65956- struct snd_pcm_ops *ops;
65957+ const struct snd_pcm_ops *ops;
65958 /* -- runtime information -- */
65959 struct snd_pcm_runtime *runtime;
65960 /* -- timer section -- */
65961@@ -845,7 +845,7 @@ const unsigned char *snd_pcm_format_sile
65962 int snd_pcm_format_set_silence(snd_pcm_format_t format, void *buf, unsigned int frames);
65963 snd_pcm_format_t snd_pcm_build_linear_format(int width, int unsignd, int big_endian);
65964
65965-void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, struct snd_pcm_ops *ops);
65966+void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, const struct snd_pcm_ops *ops);
65967 void snd_pcm_set_sync(struct snd_pcm_substream *substream);
65968 int snd_pcm_lib_interleave_len(struct snd_pcm_substream *substream);
65969 int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
65970diff -urNp linux-2.6.39/include/sound/rawmidi.h linux-2.6.39/include/sound/rawmidi.h
65971--- linux-2.6.39/include/sound/rawmidi.h 2011-05-19 00:06:34.000000000 -0400
65972+++ linux-2.6.39/include/sound/rawmidi.h 2011-05-22 19:36:33.000000000 -0400
65973@@ -100,7 +100,7 @@ struct snd_rawmidi_substream {
65974 struct snd_rawmidi_runtime *runtime;
65975 struct pid *pid;
65976 /* hardware layer */
65977- struct snd_rawmidi_ops *ops;
65978+ const struct snd_rawmidi_ops *ops;
65979 };
65980
65981 struct snd_rawmidi_file {
65982@@ -127,7 +127,7 @@ struct snd_rawmidi {
65983 int ossreg;
65984 #endif
65985
65986- struct snd_rawmidi_global_ops *ops;
65987+ const struct snd_rawmidi_global_ops *ops;
65988
65989 struct snd_rawmidi_str streams[2];
65990
65991@@ -151,7 +151,7 @@ int snd_rawmidi_new(struct snd_card *car
65992 int output_count, int input_count,
65993 struct snd_rawmidi **rmidi);
65994 void snd_rawmidi_set_ops(struct snd_rawmidi *rmidi, int stream,
65995- struct snd_rawmidi_ops *ops);
65996+ const struct snd_rawmidi_ops *ops);
65997
65998 /* callbacks */
65999
66000diff -urNp linux-2.6.39/include/sound/seq_device.h linux-2.6.39/include/sound/seq_device.h
66001--- linux-2.6.39/include/sound/seq_device.h 2011-05-19 00:06:34.000000000 -0400
66002+++ linux-2.6.39/include/sound/seq_device.h 2011-05-22 19:36:33.000000000 -0400
66003@@ -69,7 +69,7 @@ struct snd_seq_dev_ops {
66004 */
66005 void snd_seq_device_load_drivers(void);
66006 int snd_seq_device_new(struct snd_card *card, int device, char *id, int argsize, struct snd_seq_device **result);
66007-int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry, int argsize);
66008+int snd_seq_device_register_driver(char *id, const struct snd_seq_dev_ops *entry, int argsize);
66009 int snd_seq_device_unregister_driver(char *id);
66010
66011 #define SNDRV_SEQ_DEVICE_ARGPTR(dev) (void *)((char *)(dev) + sizeof(struct snd_seq_device))
66012diff -urNp linux-2.6.39/include/sound/snd_wavefront.h linux-2.6.39/include/sound/snd_wavefront.h
66013--- linux-2.6.39/include/sound/snd_wavefront.h 2011-05-19 00:06:34.000000000 -0400
66014+++ linux-2.6.39/include/sound/snd_wavefront.h 2011-05-22 19:36:33.000000000 -0400
66015@@ -37,8 +37,8 @@ struct _snd_wavefront_midi {
66016 #define MPU_ACK 0xFE
66017 #define UART_MODE_ON 0x3F
66018
66019-extern struct snd_rawmidi_ops snd_wavefront_midi_output;
66020-extern struct snd_rawmidi_ops snd_wavefront_midi_input;
66021+extern const struct snd_rawmidi_ops snd_wavefront_midi_output;
66022+extern const struct snd_rawmidi_ops snd_wavefront_midi_input;
66023
66024 extern void snd_wavefront_midi_enable_virtual (snd_wavefront_card_t *);
66025 extern void snd_wavefront_midi_disable_virtual (snd_wavefront_card_t *);
66026diff -urNp linux-2.6.39/include/sound/soc.h linux-2.6.39/include/sound/soc.h
66027--- linux-2.6.39/include/sound/soc.h 2011-05-19 00:06:34.000000000 -0400
66028+++ linux-2.6.39/include/sound/soc.h 2011-05-22 19:36:33.000000000 -0400
66029@@ -245,7 +245,7 @@ struct snd_soc_jack_gpio;
66030
66031 typedef int (*hw_write_t)(void *,const char* ,int);
66032
66033-extern struct snd_ac97_bus_ops soc_ac97_ops;
66034+extern const struct snd_ac97_bus_ops soc_ac97_ops;
66035
66036 enum snd_soc_control_type {
66037 SND_SOC_CUSTOM,
66038diff -urNp linux-2.6.39/include/sound/ymfpci.h linux-2.6.39/include/sound/ymfpci.h
66039--- linux-2.6.39/include/sound/ymfpci.h 2011-05-19 00:06:34.000000000 -0400
66040+++ linux-2.6.39/include/sound/ymfpci.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 66041@@ -358,7 +358,7 @@ struct snd_ymfpci {
66042 spinlock_t reg_lock;
66043 spinlock_t voice_lock;
66044 wait_queue_head_t interrupt_sleep;
66045- atomic_t interrupt_sleep_count;
66046+ atomic_unchecked_t interrupt_sleep_count;
66047 struct snd_info_entry *proc_entry;
66048 const struct firmware *dsp_microcode;
66049 const struct firmware *controller_microcode;
66a7e928
MT		 66050diff -urNp linux-2.6.39/include/target/target_core_base.h linux-2.6.39/include/target/target_core_base.h
66051--- linux-2.6.39/include/target/target_core_base.h 2011-05-19 00:06:34.000000000 -0400
66052+++ linux-2.6.39/include/target/target_core_base.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 66053@@ -431,8 +431,8 @@ struct se_transport_task {
66054 atomic_t t_task_cdbs_left;
66055 atomic_t t_task_cdbs_ex_left;
66056 atomic_t t_task_cdbs_timeout_left;
66057- atomic_t t_task_cdbs_sent;
66058- atomic_t t_transport_aborted;
66059+ atomic_unchecked_t t_task_cdbs_sent;
66060+ atomic_unchecked_t t_transport_aborted;
66061 atomic_t t_transport_active;
66062 atomic_t t_transport_complete;
66063 atomic_t t_transport_queue_active;
66a7e928 66064@@ -773,7 +773,7 @@ struct se_device {
8308f9c9
MT		 66065 atomic_t active_cmds;
66066 atomic_t simple_cmds;
66067 atomic_t depth_left;
66068- atomic_t dev_ordered_id;
66069+ atomic_unchecked_t dev_ordered_id;
66070 atomic_t dev_tur_active;
66071 atomic_t execute_tasks;
66072 atomic_t dev_status_thr_count;
66a7e928
MT		 66073diff -urNp linux-2.6.39/include/trace/events/irq.h linux-2.6.39/include/trace/events/irq.h
66074--- linux-2.6.39/include/trace/events/irq.h 2011-05-19 00:06:34.000000000 -0400
66075+++ linux-2.6.39/include/trace/events/irq.h 2011-05-22 19:36:33.000000000 -0400
bc901d79 66076@@ -36,7 +36,7 @@ struct softirq_action;
ae4e228f
MT		 66077 */
66078 TRACE_EVENT(irq_handler_entry,
66079
66080- TP_PROTO(int irq, struct irqaction *action),
66081+ TP_PROTO(int irq, const struct irqaction *action),
66082
66083 TP_ARGS(irq, action),
66084
bc901d79 66085@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
ae4e228f
MT		 66086 */
66087 TRACE_EVENT(irq_handler_exit,
66088
66089- TP_PROTO(int irq, struct irqaction *action, int ret),
66090+ TP_PROTO(int irq, const struct irqaction *action, int ret),
66091
66092 TP_ARGS(irq, action, ret),
66093
66a7e928
MT		 66094diff -urNp linux-2.6.39/include/video/udlfb.h linux-2.6.39/include/video/udlfb.h
66095--- linux-2.6.39/include/video/udlfb.h 2011-05-19 00:06:34.000000000 -0400
66096+++ linux-2.6.39/include/video/udlfb.h 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 66097@@ -51,10 +51,10 @@ struct dlfb_data {
66098 int base8;
66099 u32 pseudo_palette[256];
66100 /* blit-only rendering path metrics, exposed through sysfs */
66101- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66102- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
66103- atomic_t bytes_sent; /* to usb, after compression including overhead */
66104- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
66105+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66106+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
66107+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
66108+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
66109 };
66110
66111 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
66a7e928
MT		 66112diff -urNp linux-2.6.39/include/video/uvesafb.h linux-2.6.39/include/video/uvesafb.h
66113--- linux-2.6.39/include/video/uvesafb.h 2011-05-19 00:06:34.000000000 -0400
66114+++ linux-2.6.39/include/video/uvesafb.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 66115@@ -177,6 +177,7 @@ struct uvesafb_par {
66116 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
66117 u8 pmi_setpal; /* PMI for palette changes */
66118 u16 *pmi_base; /* protected mode interface location */
66119+ u8 *pmi_code; /* protected mode code location */
66120 void *pmi_start;
66121 void *pmi_pal;
66122 u8 *vbe_state_orig; /*
66a7e928
MT		 66123diff -urNp linux-2.6.39/init/do_mounts.c linux-2.6.39/init/do_mounts.c
66124--- linux-2.6.39/init/do_mounts.c 2011-05-19 00:06:34.000000000 -0400
66125+++ linux-2.6.39/init/do_mounts.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 66126@@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa
58c5fc13
MT		 66127
66128 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
66129 {
66130- int err = sys_mount(name, "/root", fs, flags, data);
ae4e228f 66131+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
58c5fc13
MT		 66132 if (err)
66133 return err;
66134
66a7e928 66135@@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
58c5fc13
MT		 66136 va_start(args, fmt);
66137 vsprintf(buf, fmt, args);
66138 va_end(args);
66139- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
66140+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
66141 if (fd >= 0) {
66142 sys_ioctl(fd, FDEJECT, 0);
66143 sys_close(fd);
66144 }
66145 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
66146- fd = sys_open("/dev/console", O_RDWR, 0);
df50ba0c 66147+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
58c5fc13
MT		 66148 if (fd >= 0) {
66149 sys_ioctl(fd, TCGETS, (long)&termios);
66150 termios.c_lflag &= ~ICANON;
66151 sys_ioctl(fd, TCSETSF, (long)&termios);
66152- sys_read(fd, &c, 1);
66153+ sys_read(fd, (char __user *)&c, 1);
66154 termios.c_lflag |= ICANON;
66155 sys_ioctl(fd, TCSETSF, (long)&termios);
66156 sys_close(fd);
66a7e928 66157@@ -488,6 +488,6 @@ void __init prepare_namespace(void)
58c5fc13
MT		 66158 mount_root();
66159 out:
ae4e228f 66160 devtmpfs_mount("dev");
58c5fc13 66161- sys_mount(".", "/", NULL, MS_MOVE, NULL);
ae4e228f 66162+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
bc901d79 66163 sys_chroot((const char __user __force *)".");
58c5fc13 66164 }
66a7e928
MT		 66165diff -urNp linux-2.6.39/init/do_mounts.h linux-2.6.39/init/do_mounts.h
66166--- linux-2.6.39/init/do_mounts.h 2011-05-19 00:06:34.000000000 -0400
66167+++ linux-2.6.39/init/do_mounts.h 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 66168@@ -15,15 +15,15 @@ extern int root_mountflags;
66169
66170 static inline int create_dev(char *name, dev_t dev)
66171 {
66172- sys_unlink(name);
66173- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
ae4e228f
MT		 66174+ sys_unlink((__force char __user *)name);
66175+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
58c5fc13
MT		 66176 }
66177
66178 #if BITS_PER_LONG == 32
66179 static inline u32 bstat(char *name)
66180 {
66181 struct stat64 stat;
66182- if (sys_stat64(name, &stat) != 0)
ae4e228f 66183+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
58c5fc13
MT		 66184 return 0;
66185 if (!S_ISBLK(stat.st_mode))
66186 return 0;
66a7e928
MT		 66187diff -urNp linux-2.6.39/init/do_mounts_initrd.c linux-2.6.39/init/do_mounts_initrd.c
66188--- linux-2.6.39/init/do_mounts_initrd.c 2011-05-19 00:06:34.000000000 -0400
66189+++ linux-2.6.39/init/do_mounts_initrd.c 2011-05-22 19:36:33.000000000 -0400
6892158b 66190@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
58c5fc13
MT		 66191 create_dev("/dev/root.old", Root_RAM0);
66192 /* mount initrd on rootfs' /root */
66193 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
66194- sys_mkdir("/old", 0700);
66195- root_fd = sys_open("/", 0, 0);
66196- old_fd = sys_open("/old", 0, 0);
ae4e228f
MT		 66197+ sys_mkdir((__force const char __user *)"/old", 0700);
66198+ root_fd = sys_open((__force const char __user *)"/", 0, 0);
66199+ old_fd = sys_open((__force const char __user *)"/old", 0, 0);
58c5fc13
MT		 66200 /* move initrd over / and chdir/chroot in initrd root */
66201- sys_chdir("/root");
66202- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66203- sys_chroot(".");
ae4e228f
MT		 66204+ sys_chdir((__force const char __user *)"/root");
66205+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66206+ sys_chroot((__force const char __user *)".");
58c5fc13
MT		 66207
66208 /*
66209 * In case that a resume from disk is carried out by linuxrc or one of
6892158b 66210@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
58c5fc13
MT		 66211
66212 /* move initrd to rootfs' /old */
66213 sys_fchdir(old_fd);
66214- sys_mount("/", ".", NULL, MS_MOVE, NULL);
ae4e228f 66215+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
58c5fc13
MT		 66216 /* switch root and cwd back to / of rootfs */
66217 sys_fchdir(root_fd);
66218- sys_chroot(".");
ae4e228f 66219+ sys_chroot((__force const char __user *)".");
58c5fc13
MT		 66220 sys_close(old_fd);
66221 sys_close(root_fd);
66222
66223 if (new_decode_dev(real_root_dev) == Root_RAM0) {
66224- sys_chdir("/old");
ae4e228f 66225+ sys_chdir((__force const char __user *)"/old");
58c5fc13
MT		 66226 return;
66227 }
66228
6892158b 66229@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
58c5fc13
MT		 66230 mount_root();
66231
66232 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
66233- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
ae4e228f 66234+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
58c5fc13
MT		 66235 if (!error)
66236 printk("okay\n");
66237 else {
66238- int fd = sys_open("/dev/root.old", O_RDWR, 0);
ae4e228f 66239+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
58c5fc13
MT		 66240 if (error == -ENOENT)
66241 printk("/initrd does not exist. Ignored.\n");
66242 else
66243 printk("failed\n");
66244 printk(KERN_NOTICE "Unmounting old root\n");
66245- sys_umount("/old", MNT_DETACH);
ae4e228f 66246+ sys_umount((__force char __user *)"/old", MNT_DETACH);
58c5fc13
MT		 66247 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
66248 if (fd < 0) {
66249 error = fd;
6892158b 66250@@ -116,11 +116,11 @@ int __init initrd_load(void)
58c5fc13
MT		 66251 * mounted in the normal path.
66252 */
66253 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
66254- sys_unlink("/initrd.image");
ae4e228f 66255+ sys_unlink((__force const char __user *)"/initrd.image");
58c5fc13
MT		 66256 handle_initrd();
66257 return 1;
66258 }
66259 }
66260- sys_unlink("/initrd.image");
ae4e228f 66261+ sys_unlink((__force const char __user *)"/initrd.image");
58c5fc13
MT		 66262 return 0;
66263 }
66a7e928
MT		 66264diff -urNp linux-2.6.39/init/do_mounts_md.c linux-2.6.39/init/do_mounts_md.c
66265--- linux-2.6.39/init/do_mounts_md.c 2011-05-19 00:06:34.000000000 -0400
66266+++ linux-2.6.39/init/do_mounts_md.c 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 66267@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
66268 partitioned ? "_d" : "", minor,
66269 md_setup_args[ent].device_names);
66270
66271- fd = sys_open(name, 0, 0);
ae4e228f 66272+ fd = sys_open((__force char __user *)name, 0, 0);
58c5fc13
MT		 66273 if (fd < 0) {
66274 printk(KERN_ERR "md: open failed - cannot start "
66275 "array %s\n", name);
66276@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
66277 * array without it
66278 */
66279 sys_close(fd);
66280- fd = sys_open(name, 0, 0);
ae4e228f 66281+ fd = sys_open((__force char __user *)name, 0, 0);
58c5fc13
MT		 66282 sys_ioctl(fd, BLKRRPART, 0);
66283 }
66284 sys_close(fd);
66a7e928
MT		 66285diff -urNp linux-2.6.39/init/initramfs.c linux-2.6.39/init/initramfs.c
66286--- linux-2.6.39/init/initramfs.c 2011-05-19 00:06:34.000000000 -0400
66287+++ linux-2.6.39/init/initramfs.c 2011-05-22 19:36:33.000000000 -0400
ae4e228f
MT		 66288@@ -74,7 +74,7 @@ static void __init free_hash(void)
66289 }
66290 }
66291
66292-static long __init do_utime(char __user *filename, time_t mtime)
66293+static long __init do_utime(__force char __user *filename, time_t mtime)
66294 {
66295 struct timespec t[2];
66296
66297@@ -109,7 +109,7 @@ static void __init dir_utime(void)
66298 struct dir_entry *de, *tmp;
66299 list_for_each_entry_safe(de, tmp, &dir_list, list) {
66300 list_del(&de->list);
66301- do_utime(de->name, de->mtime);
66302+ do_utime((__force char __user *)de->name, de->mtime);
66303 kfree(de->name);
66304 kfree(de);
66305 }
58c5fc13
MT		 66306@@ -271,7 +271,7 @@ static int __init maybe_link(void)
66307 if (nlink >= 2) {
66308 char *old = find_link(major, minor, ino, mode, collected);
66309 if (old)
66310- return (sys_link(old, collected) < 0) ? -1 : 1;
ae4e228f 66311+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
58c5fc13
MT		 66312 }
66313 return 0;
66314 }
66315@@ -280,11 +280,11 @@ static void __init clean_path(char *path
66316 {
66317 struct stat st;
66318
66319- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
ae4e228f 66320+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
58c5fc13
MT		 66321 if (S_ISDIR(st.st_mode))
66322- sys_rmdir(path);
ae4e228f 66323+ sys_rmdir((__force char __user *)path);
58c5fc13
MT		 66324 else
66325- sys_unlink(path);
ae4e228f 66326+ sys_unlink((__force char __user *)path);
58c5fc13
MT		 66327 }
66328 }
66329
66330@@ -305,7 +305,7 @@ static int __init do_name(void)
66331 int openflags = O_WRONLY|O_CREAT;
66332 if (ml != 1)
66333 openflags |= O_TRUNC;
66334- wfd = sys_open(collected, openflags, mode);
ae4e228f 66335+ wfd = sys_open((__force char __user *)collected, openflags, mode);
58c5fc13
MT		 66336
66337 if (wfd >= 0) {
66338 sys_fchown(wfd, uid, gid);
ae4e228f 66339@@ -317,17 +317,17 @@ static int __init do_name(void)
58c5fc13
MT		 66340 }
66341 }
66342 } else if (S_ISDIR(mode)) {
66343- sys_mkdir(collected, mode);
66344- sys_chown(collected, uid, gid);
66345- sys_chmod(collected, mode);
ae4e228f
MT		 66346+ sys_mkdir((__force char __user *)collected, mode);
66347+ sys_chown((__force char __user *)collected, uid, gid);
66348+ sys_chmod((__force char __user *)collected, mode);
58c5fc13
MT		 66349 dir_add(collected, mtime);
66350 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
66351 S_ISFIFO(mode) || S_ISSOCK(mode)) {
66352 if (maybe_link() == 0) {
66353- sys_mknod(collected, mode, rdev);
66354- sys_chown(collected, uid, gid);
66355- sys_chmod(collected, mode);
ae4e228f
MT		 66356- do_utime(collected, mtime);
66357+ sys_mknod((__force char __user *)collected, mode, rdev);
66358+ sys_chown((__force char __user *)collected, uid, gid);
66359+ sys_chmod((__force char __user *)collected, mode);
66360+ do_utime((__force char __user *)collected, mtime);
58c5fc13
MT		 66361 }
66362 }
ae4e228f
MT		 66363 return 0;
66364@@ -336,15 +336,15 @@ static int __init do_name(void)
58c5fc13
MT		 66365 static int __init do_copy(void)
66366 {
66367 if (count >= body_len) {
66368- sys_write(wfd, victim, body_len);
ae4e228f 66369+ sys_write(wfd, (__force char __user *)victim, body_len);
58c5fc13 66370 sys_close(wfd);
ae4e228f
MT		 66371- do_utime(vcollected, mtime);
66372+ do_utime((__force char __user *)vcollected, mtime);
58c5fc13 66373 kfree(vcollected);
ae4e228f 66374 eat(body_len);
58c5fc13
MT		 66375 state = SkipIt;
66376 return 0;
66377 } else {
66378- sys_write(wfd, victim, count);
ae4e228f 66379+ sys_write(wfd, (__force char __user *)victim, count);
58c5fc13
MT		 66380 body_len -= count;
66381 eat(count);
66382 return 1;
ae4e228f 66383@@ -355,9 +355,9 @@ static int __init do_symlink(void)
58c5fc13
MT		 66384 {
66385 collected[N_ALIGN(name_len) + body_len] = '\0';
66386 clean_path(collected, 0);
66387- sys_symlink(collected + N_ALIGN(name_len), collected);
66388- sys_lchown(collected, uid, gid);
ae4e228f
MT		 66389- do_utime(collected, mtime);
66390+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
66391+ sys_lchown((__force char __user *)collected, uid, gid);
66392+ do_utime((__force char __user *)collected, mtime);
58c5fc13
MT		 66393 state = SkipIt;
66394 next_state = Reset;
ae4e228f 66395 return 0;
66a7e928
MT		 66396diff -urNp linux-2.6.39/init/Kconfig linux-2.6.39/init/Kconfig
66397--- linux-2.6.39/init/Kconfig 2011-05-19 00:06:34.000000000 -0400
66398+++ linux-2.6.39/init/Kconfig 2011-05-22 19:36:33.000000000 -0400
66399@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
57199397
MT		 66400
66401 config COMPAT_BRK
66402 bool "Disable heap randomization"
66403- default y
66404+ default n
66405 help
66406 Randomizing heap placement makes heap exploits harder, but it
66407 also breaks ancient binaries (including anything libc5 based).
66a7e928
MT		 66408diff -urNp linux-2.6.39/init/main.c linux-2.6.39/init/main.c
66409--- linux-2.6.39/init/main.c 2011-05-19 00:06:34.000000000 -0400
66410+++ linux-2.6.39/init/main.c 2011-05-22 19:41:42.000000000 -0400
16454cff 66411@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
58c5fc13
MT		 66412 extern void tc_init(void);
66413 #endif
58c5fc13 66414
16454cff
MT		 66415+extern void grsecurity_init(void);
66416+
66417 /*
66418 * Debug helper: via this flag we know that we are in 'early bootup code'
66419 * where only the boot processor is running with IRQ disabled. This means
66a7e928 66420@@ -149,6 +151,49 @@ static int __init set_reset_devices(char
58c5fc13
MT		 66421
66422 __setup("reset_devices", set_reset_devices);
66423
df50ba0c 66424+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
bc901d79
MT		 66425+extern char pax_enter_kernel_user[];
66426+extern char pax_exit_kernel_user[];
df50ba0c
MT		 66427+extern pgdval_t clone_pgd_mask;
66428+#endif
66429+
66430+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
58c5fc13
MT		 66431+static int __init setup_pax_nouderef(char *str)
66432+{
df50ba0c 66433+#ifdef CONFIG_X86_32
58c5fc13 66434+ unsigned int cpu;
66a7e928 66435+ struct desc_struct *gdt;
58c5fc13
MT		 66436+
66437+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
66a7e928
MT		 66438+ gdt = get_cpu_gdt_table(cpu);
66439+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
66440+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
66441+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
66442+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
58c5fc13 66443+ }
bc901d79 66444+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
df50ba0c 66445+#else
6892158b
MT		 66446+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
66447+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
df50ba0c
MT		 66448+ clone_pgd_mask = ~(pgdval_t)0UL;
66449+#endif
58c5fc13
MT		 66450+
66451+ return 0;
66452+}
66453+early_param("pax_nouderef", setup_pax_nouderef);
66454+#endif
66455+
66456+#ifdef CONFIG_PAX_SOFTMODE
66457+unsigned int pax_softmode;
66458+
66459+static int __init setup_pax_softmode(char *str)
66460+{
66461+ get_option(&str, &pax_softmode);
66462+ return 1;
66463+}
66464+__setup("pax_softmode=", setup_pax_softmode);
66465+#endif
66466+
6892158b
MT		 66467 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
66468 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
58c5fc13 66469 static const char *panic_later, *panic_param;
66a7e928 66470@@ -663,6 +708,7 @@ int __init_or_module do_one_initcall(ini
58c5fc13
MT		 66471 {
66472 int count = preempt_count();
6892158b 66473 int ret;
58c5fc13
MT		 66474+ const char *msg1 = "", *msg2 = "";
66475
6892158b
MT		 66476 if (initcall_debug)
66477 ret = do_one_initcall_debug(fn);
66a7e928 66478@@ -675,15 +721,15 @@ int __init_or_module do_one_initcall(ini
6892158b 66479 sprintf(msgbuf, "error code %d ", ret);
58c5fc13
MT		 66480
66481 if (preempt_count() != count) {
66482- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
66483+ msg1 = " preemption imbalance";
66484 preempt_count() = count;
66485 }
66486 if (irqs_disabled()) {
66487- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
66488+ msg2 = " disabled interrupts";
66489 local_irq_enable();
66490 }
66491- if (msgbuf[0]) {
66492- printk("initcall %pF returned with %s\n", fn, msgbuf);
66493+ if (msgbuf[0] || *msg1 || *msg2) {
66494+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
66495 }
66496
6892158b 66497 return ret;
66a7e928 66498@@ -801,7 +847,7 @@ static int __init kernel_init(void * unu
df50ba0c
MT		 66499 do_basic_setup();
66500
66501 /* Open the /dev/console on the rootfs, this should never fail */
66502- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
66503+ if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0)
66504 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
66505
66506 (void) sys_dup(0);
66a7e928 66507@@ -814,11 +860,13 @@ static int __init kernel_init(void * unu
ae4e228f
MT		 66508 if (!ramdisk_execute_command)
66509 ramdisk_execute_command = "/init";
66510
66511- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
66512+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
66513 ramdisk_execute_command = NULL;
58c5fc13
MT		 66514 prepare_namespace();
66515 }
66516
66517+ grsecurity_init();
66518+
66519 /*
66520 * Ok, we have completed the initial bootup, and
66521 * we're essentially up and running. Get rid of the
66a7e928
MT		 66522diff -urNp linux-2.6.39/ipc/mqueue.c linux-2.6.39/ipc/mqueue.c
66523--- linux-2.6.39/ipc/mqueue.c 2011-05-19 00:06:34.000000000 -0400
66524+++ linux-2.6.39/ipc/mqueue.c 2011-05-22 19:41:42.000000000 -0400
bc901d79 66525@@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st
58c5fc13
MT		 66526 mq_bytes = (mq_msg_tblsz +
66527 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
66528
66529+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
66530 spin_lock(&mq_lock);
66531 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
66532 u->mq_bytes + mq_bytes >
66a7e928
MT		 66533diff -urNp linux-2.6.39/ipc/sem.c linux-2.6.39/ipc/sem.c
66534--- linux-2.6.39/ipc/sem.c 2011-05-19 00:06:34.000000000 -0400
66535+++ linux-2.6.39/ipc/sem.c 2011-05-22 19:36:33.000000000 -0400
66536@@ -854,6 +854,8 @@ static int semctl_main(struct ipc_namesp
66537 int nsems;
66538 struct list_head tasks;
66539
66540+ pax_track_stack();
66541+
66542 sma = sem_lock_check(ns, semid);
66543 if (IS_ERR(sma))
66544 return PTR_ERR(sma);
66545@@ -1301,6 +1303,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
66546 struct ipc_namespace *ns;
66547 struct list_head tasks;
66548
66549+ pax_track_stack();
66550+
66551 ns = current->nsproxy->ipc_ns;
66552
66553 if (nsops < 1 || semid < 0)
66554diff -urNp linux-2.6.39/ipc/shm.c linux-2.6.39/ipc/shm.c
66555--- linux-2.6.39/ipc/shm.c 2011-05-19 00:06:34.000000000 -0400
66556+++ linux-2.6.39/ipc/shm.c 2011-05-22 19:41:42.000000000 -0400
ae4e228f 66557@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
58c5fc13
MT		 66558 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
66559 #endif
66560
66561+#ifdef CONFIG_GRKERNSEC
66562+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66563+ const time_t shm_createtime, const uid_t cuid,
66564+ const int shmid);
66565+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66566+ const time_t shm_createtime);
66567+#endif
66568+
66569 void shm_init_ns(struct ipc_namespace *ns)
66570 {
66571 ns->shm_ctlmax = SHMMAX;
bc901d79 66572@@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
58c5fc13
MT		 66573 shp->shm_lprid = 0;
66574 shp->shm_atim = shp->shm_dtim = 0;
66575 shp->shm_ctim = get_seconds();
66576+#ifdef CONFIG_GRKERNSEC
66577+ {
66578+ struct timespec timeval;
66579+ do_posix_clock_monotonic_gettime(&timeval);
66580+
66581+ shp->shm_createtime = timeval.tv_sec;
66582+ }
66583+#endif
66584 shp->shm_segsz = size;
66585 shp->shm_nattch = 0;
66586 shp->shm_file = file;
66a7e928 66587@@ -762,8 +778,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
16454cff
MT		 66588 case SHM_LOCK:
66589 case SHM_UNLOCK:
66590 {
66591- struct file *uninitialized_var(shm_file);
66592-
66593 lru_add_drain_all(); /* drain pagevecs to lru lists */
66594
66595 shp = shm_lock_check(ns, shmid);
66a7e928 66596@@ -896,9 +910,21 @@ long do_shmat(int shmid, char __user *sh
58c5fc13
MT		 66597 if (err)
66598 goto out_unlock;
66599
66600+#ifdef CONFIG_GRKERNSEC
66601+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66602+ shp->shm_perm.cuid, shmid) ||
66603+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66604+ err = -EACCES;
66605+ goto out_unlock;
66606+ }
66607+#endif
66608+
ae4e228f
MT		 66609 path = shp->shm_file->f_path;
66610 path_get(&path);
58c5fc13
MT		 66611 shp->shm_nattch++;
66612+#ifdef CONFIG_GRKERNSEC
66613+ shp->shm_lapid = current->pid;
66614+#endif
66615 size = i_size_read(path.dentry->d_inode);
66616 shm_unlock(shp);
66617
66a7e928
MT		 66618diff -urNp linux-2.6.39/kernel/acct.c linux-2.6.39/kernel/acct.c
66619--- linux-2.6.39/kernel/acct.c 2011-05-19 00:06:34.000000000 -0400
66620+++ linux-2.6.39/kernel/acct.c 2011-05-22 19:36:33.000000000 -0400
57199397 66621@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
58c5fc13
MT		 66622 */
66623 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66624 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66625- file->f_op->write(file, (char *)&ac,
ae4e228f 66626+ file->f_op->write(file, (__force char __user *)&ac,
58c5fc13
MT		 66627 sizeof(acct_t), &file->f_pos);
66628 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66629 set_fs(fs);
66a7e928
MT		 66630diff -urNp linux-2.6.39/kernel/audit.c linux-2.6.39/kernel/audit.c
66631--- linux-2.6.39/kernel/audit.c 2011-05-19 00:06:34.000000000 -0400
66632+++ linux-2.6.39/kernel/audit.c 2011-05-22 19:36:33.000000000 -0400
66633@@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
8308f9c9
MT		 66634 3) suppressed due to audit_rate_limit
66635 4) suppressed due to audit_backlog_limit
66636 */
66637-static atomic_t audit_lost = ATOMIC_INIT(0);
66638+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66639
66640 /* The netlink socket. */
66641 static struct sock *audit_sock;
66a7e928 66642@@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
8308f9c9
MT		 66643 unsigned long now;
66644 int print;
66645
66646- atomic_inc(&audit_lost);
66647+ atomic_inc_unchecked(&audit_lost);
66648
66649 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
66650
66a7e928 66651@@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
8308f9c9
MT		 66652 printk(KERN_WARNING
66653 "audit: audit_lost=%d audit_rate_limit=%d "
66654 "audit_backlog_limit=%d\n",
66655- atomic_read(&audit_lost),
66656+ atomic_read_unchecked(&audit_lost),
66657 audit_rate_limit,
66658 audit_backlog_limit);
66659 audit_panic(message);
66a7e928 66660@@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
8308f9c9
MT		 66661 status_set.pid = audit_pid;
66662 status_set.rate_limit = audit_rate_limit;
66663 status_set.backlog_limit = audit_backlog_limit;
66664- status_set.lost = atomic_read(&audit_lost);
66665+ status_set.lost = atomic_read_unchecked(&audit_lost);
66666 status_set.backlog = skb_queue_len(&audit_skb_queue);
66667 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
66668 &status_set, sizeof(status_set));
66a7e928
MT		 66669diff -urNp linux-2.6.39/kernel/auditsc.c linux-2.6.39/kernel/auditsc.c
66670--- linux-2.6.39/kernel/auditsc.c 2011-05-19 00:06:34.000000000 -0400
66671+++ linux-2.6.39/kernel/auditsc.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 66672@@ -2111,7 +2111,7 @@ int auditsc_get_stamp(struct audit_conte
66673 }
66674
66675 /* global counter which is incremented every time something logs in */
66676-static atomic_t session_id = ATOMIC_INIT(0);
66677+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
66678
66679 /**
66680 * audit_set_loginuid - set a task's audit_context loginuid
66681@@ -2124,7 +2124,7 @@ static atomic_t session_id = ATOMIC_INIT
66682 */
66683 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
66684 {
66685- unsigned int sessionid = atomic_inc_return(&session_id);
66686+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
66687 struct audit_context *context = task->audit_context;
66688
66689 if (context && context->in_syscall) {
66a7e928
MT		 66690diff -urNp linux-2.6.39/kernel/capability.c linux-2.6.39/kernel/capability.c
66691--- linux-2.6.39/kernel/capability.c 2011-05-19 00:06:34.000000000 -0400
66692+++ linux-2.6.39/kernel/capability.c 2011-05-22 21:02:23.000000000 -0400
66693@@ -206,6 +206,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
ae4e228f
MT		 66694 * before modification is attempted and the application
66695 * fails.
66696 */
66697+ if (tocopy > ARRAY_SIZE(kdata))
66698+ return -EFAULT;
66699+
66700 if (copy_to_user(dataptr, kdata, tocopy
66701 * sizeof(struct __user_cap_data_struct))) {
66702 return -EFAULT;
66a7e928 66703@@ -378,7 +381,7 @@ bool ns_capable(struct user_namespace *n
58c5fc13
MT		 66704 BUG();
66705 }
66706
66a7e928
MT		 66707- if (security_capable(ns, current_cred(), cap) == 0) {
66708+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
ae4e228f 66709 current->flags |= PF_SUPERPRIV;
66a7e928 66710 return true;
ae4e228f 66711 }
66a7e928 66712@@ -386,6 +389,27 @@ bool ns_capable(struct user_namespace *n
ae4e228f 66713 }
66a7e928
MT		 66714 EXPORT_SYMBOL(ns_capable);
66715
66716+bool ns_capable_nolog(struct user_namespace *ns, int cap)
bc901d79
MT		 66717+{
66718+ if (unlikely(!cap_valid(cap))) {
66719+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
66720+ BUG();
66721+ }
66722+
66a7e928 66723+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
bc901d79 66724+ current->flags |= PF_SUPERPRIV;
66a7e928 66725+ return true;
bc901d79 66726+ }
66a7e928 66727+ return false;
bc901d79 66728+}
66a7e928 66729+EXPORT_SYMBOL(ns_capable_nolog);
58c5fc13 66730+
66a7e928
MT		 66731+bool capable_nolog(int cap)
66732+{
66733+ return ns_capable_nolog(&init_user_ns, cap);
66734+}
58c5fc13 66735+EXPORT_SYMBOL(capable_nolog);
66a7e928
MT		 66736+
66737 /**
66738 * task_ns_capable - Determine whether current task has a superior
66739 * capability targeted at a specific task's user namespace.
66740@@ -400,6 +424,12 @@ bool task_ns_capable(struct task_struct
66741 }
66742 EXPORT_SYMBOL(task_ns_capable);
66743
66744+bool task_ns_capable_nolog(struct task_struct *t, int cap)
66745+{
66746+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
66747+}
66748+EXPORT_SYMBOL(task_ns_capable_nolog);
66749+
66750 /**
66751 * nsown_capable - Check superior capability to one's own user_ns
66752 * @cap: The capability in question
66753diff -urNp linux-2.6.39/kernel/cgroup.c linux-2.6.39/kernel/cgroup.c
66754--- linux-2.6.39/kernel/cgroup.c 2011-05-19 00:06:34.000000000 -0400
66755+++ linux-2.6.39/kernel/cgroup.c 2011-05-22 19:36:33.000000000 -0400
66756@@ -598,6 +598,8 @@ static struct css_set *find_css_set(
66757 struct hlist_head *hhead;
66758 struct cg_cgroup_link *link;
66759
66760+ pax_track_stack();
66761+
66762 /* First see if we already have a cgroup group that matches
66763 * the desired set */
66764 read_lock(&css_set_lock);
66765diff -urNp linux-2.6.39/kernel/compat.c linux-2.6.39/kernel/compat.c
66766--- linux-2.6.39/kernel/compat.c 2011-05-19 00:06:34.000000000 -0400
66767+++ linux-2.6.39/kernel/compat.c 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 66768@@ -13,6 +13,7 @@
66769
66770 #include <linux/linkage.h>
66771 #include <linux/compat.h>
66772+#include <linux/module.h>
66773 #include <linux/errno.h>
66774 #include <linux/time.h>
66775 #include <linux/signal.h>
66a7e928
MT		 66776diff -urNp linux-2.6.39/kernel/configs.c linux-2.6.39/kernel/configs.c
66777--- linux-2.6.39/kernel/configs.c 2011-05-19 00:06:34.000000000 -0400
66778+++ linux-2.6.39/kernel/configs.c 2011-05-22 19:41:42.000000000 -0400
bc901d79 66779@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
58c5fc13
MT		 66780 struct proc_dir_entry *entry;
66781
66782 /* create the current config file */
66783+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66784+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66785+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66786+ &ikconfig_file_ops);
66787+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66788+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66789+ &ikconfig_file_ops);
66790+#endif
66791+#else
66792 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66793 &ikconfig_file_ops);
66794+#endif
66795+
66796 if (!entry)
66797 return -ENOMEM;
66798
66a7e928
MT		 66799diff -urNp linux-2.6.39/kernel/cred.c linux-2.6.39/kernel/cred.c
66800--- linux-2.6.39/kernel/cred.c 2011-05-19 00:06:34.000000000 -0400
66801+++ linux-2.6.39/kernel/cred.c 2011-05-22 19:41:42.000000000 -0400
66802@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
66803 */
66804 void __put_cred(struct cred *cred)
66805 {
66806+ pax_track_stack();
66807+
66808 kdebug("__put_cred(%p{%d,%d})", cred,
66809 atomic_read(&cred->usage),
66810 read_cred_subscribers(cred));
66811@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
66812 {
66813 struct cred *cred;
66814
66815+ pax_track_stack();
66816+
66817 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
66818 atomic_read(&tsk->cred->usage),
66819 read_cred_subscribers(tsk->cred));
66820@@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
66821 {
66822 const struct cred *cred;
66823
66824+ pax_track_stack();
66825+
66826 rcu_read_lock();
66827
66828 do {
66829@@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
66830 {
66831 struct cred *new;
66832
66833+ pax_track_stack();
66834+
66835 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
66836 if (!new)
66837 return NULL;
66838@@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
66839 const struct cred *old;
66840 struct cred *new;
66841
66842+ pax_track_stack();
66843+
66844 validate_process_creds();
66845
66846 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66847@@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
66848 struct thread_group_cred *tgcred = NULL;
66849 struct cred *new;
66850
66851+ pax_track_stack();
66852+
66853 #ifdef CONFIG_KEYS
66854 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
66855 if (!tgcred)
66856@@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
66857 struct cred *new;
66858 int ret;
66859
66860+ pax_track_stack();
66861+
66862 if (
66863 #ifdef CONFIG_KEYS
66864 !p->cred->thread_keyring &&
66865@@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
66866 struct task_struct *task = current;
66867 const struct cred *old = task->real_cred;
66868
66869+ pax_track_stack();
66870+
66871 kdebug("commit_creds(%p{%d,%d})", new,
66872 atomic_read(&new->usage),
66873 read_cred_subscribers(new));
66874@@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
58c5fc13
MT		 66875
66876 get_cred(new); /* we will require a ref for the subj creds too */
66877
66878+ gr_set_role_label(task, new->uid, new->gid);
66879+
66880 /* dumpability changes */
66881 if (old->euid != new->euid ||
66882 old->egid != new->egid ||
66a7e928
MT		 66883@@ -551,6 +569,8 @@ EXPORT_SYMBOL(commit_creds);
66884 */
66885 void abort_creds(struct cred *new)
66886 {
66887+ pax_track_stack();
66888+
66889 kdebug("abort_creds(%p{%d,%d})", new,
66890 atomic_read(&new->usage),
66891 read_cred_subscribers(new));
66892@@ -574,6 +594,8 @@ const struct cred *override_creds(const
66893 {
66894 const struct cred *old = current->cred;
66895
66896+ pax_track_stack();
66897+
66898 kdebug("override_creds(%p{%d,%d})", new,
66899 atomic_read(&new->usage),
66900 read_cred_subscribers(new));
66901@@ -603,6 +625,8 @@ void revert_creds(const struct cred *old
66902 {
66903 const struct cred *override = current->cred;
66904
66905+ pax_track_stack();
66906+
66907 kdebug("revert_creds(%p{%d,%d})", old,
66908 atomic_read(&old->usage),
66909 read_cred_subscribers(old));
66910@@ -649,6 +673,8 @@ struct cred *prepare_kernel_cred(struct
66911 const struct cred *old;
66912 struct cred *new;
66913
66914+ pax_track_stack();
66915+
66916 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66917 if (!new)
66918 return NULL;
66919@@ -703,6 +729,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
66920 */
66921 int set_security_override(struct cred *new, u32 secid)
66922 {
66923+ pax_track_stack();
66924+
66925 return security_kernel_act_as(new, secid);
66926 }
66927 EXPORT_SYMBOL(set_security_override);
66928@@ -722,6 +750,8 @@ int set_security_override_from_ctx(struc
66929 u32 secid;
66930 int ret;
66931
66932+ pax_track_stack();
66933+
66934 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
66935 if (ret < 0)
66936 return ret;
66937diff -urNp linux-2.6.39/kernel/debug/debug_core.c linux-2.6.39/kernel/debug/debug_core.c
66938--- linux-2.6.39/kernel/debug/debug_core.c 2011-05-19 00:06:34.000000000 -0400
66939+++ linux-2.6.39/kernel/debug/debug_core.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 66940@@ -72,7 +72,7 @@ int kgdb_io_module_registered;
57199397
MT		 66941 /* Guard for recursive entry */
66942 static int exception_level;
66943
66944-struct kgdb_io *dbg_io_ops;
66945+const struct kgdb_io *dbg_io_ops;
66946 static DEFINE_SPINLOCK(kgdb_registration_lock);
66947
66948 /* kgdb console driver is loaded */
8308f9c9
MT		 66949@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
66950 */
66951 static atomic_t masters_in_kgdb;
66952 static atomic_t slaves_in_kgdb;
66953-static atomic_t kgdb_break_tasklet_var;
66954+static atomic_unchecked_t kgdb_break_tasklet_var;
66955 atomic_t kgdb_setting_breakpoint;
66956
66957 struct task_struct *kgdb_usethread;
66958@@ -129,7 +129,7 @@ int kgdb_single_step;
66959 static pid_t kgdb_sstep_pid;
66960
66961 /* to keep track of the CPU which is doing the single stepping*/
66962-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66963+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66964
66965 /*
66966 * If you are debugging a problem where roundup (the collection of
66967@@ -542,7 +542,7 @@ return_normal:
66968 * kernel will only try for the value of sstep_tries before
66969 * giving up and continuing on.
66970 */
66971- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
66972+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
66973 (kgdb_info[cpu].task &&
66974 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
66975 atomic_set(&kgdb_active, -1);
66976@@ -636,8 +636,8 @@ cpu_master_loop:
66977 }
66978
66979 kgdb_restore:
66980- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
66981- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
66982+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
66983+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
66984 if (kgdb_info[sstep_cpu].task)
66985 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
66986 else
66987@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
66988 static void kgdb_tasklet_bpt(unsigned long ing)
66989 {
66990 kgdb_breakpoint();
66991- atomic_set(&kgdb_break_tasklet_var, 0);
66992+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
66993 }
66994
66995 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
66996
66997 void kgdb_schedule_breakpoint(void)
66998 {
66999- if (atomic_read(&kgdb_break_tasklet_var) ||
67000+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
67001 atomic_read(&kgdb_active) != -1 ||
67002 atomic_read(&kgdb_setting_breakpoint))
67003 return;
67004- atomic_inc(&kgdb_break_tasklet_var);
67005+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
67006 tasklet_schedule(&kgdb_tasklet_breakpoint);
67007 }
67008 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
bc901d79 67009@@ -864,7 +864,7 @@ static void kgdb_initial_breakpoint(void
57199397
MT		 67010 *
67011 * Register it with the KGDB core.
67012 */
67013-int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
67014+int kgdb_register_io_module(const struct kgdb_io *new_dbg_io_ops)
67015 {
67016 int err;
67017
bc901d79 67018@@ -909,7 +909,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
57199397
MT		 67019 *
67020 * Unregister it with the KGDB core.
67021 */
67022-void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
67023+void kgdb_unregister_io_module(const struct kgdb_io *old_dbg_io_ops)
67024 {
67025 BUG_ON(kgdb_connected);
67026
66a7e928
MT		 67027diff -urNp linux-2.6.39/kernel/debug/kdb/kdb_main.c linux-2.6.39/kernel/debug/kdb/kdb_main.c
67028--- linux-2.6.39/kernel/debug/kdb/kdb_main.c 2011-05-19 00:06:34.000000000 -0400
67029+++ linux-2.6.39/kernel/debug/kdb/kdb_main.c 2011-05-22 19:36:33.000000000 -0400
6892158b 67030@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
57199397
MT		 67031 list_for_each_entry(mod, kdb_modules, list) {
67032
67033 kdb_printf("%-20s%8u 0x%p ", mod->name,
67034- mod->core_size, (void *)mod);
67035+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
67036 #ifdef CONFIG_MODULE_UNLOAD
67037 kdb_printf("%4d ", module_refcount(mod));
67038 #endif
6892158b 67039@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
57199397
MT		 67040 kdb_printf(" (Loading)");
67041 else
67042 kdb_printf(" (Live)");
67043- kdb_printf(" 0x%p", mod->module_core);
67044+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
67045
67046 #ifdef CONFIG_MODULE_UNLOAD
67047 {
66a7e928
MT		 67048diff -urNp linux-2.6.39/kernel/exit.c linux-2.6.39/kernel/exit.c
67049--- linux-2.6.39/kernel/exit.c 2011-05-19 00:06:34.000000000 -0400
67050+++ linux-2.6.39/kernel/exit.c 2011-05-22 20:02:30.000000000 -0400
bc901d79 67051@@ -57,6 +57,10 @@
57199397 67052 #include <asm/pgtable.h>
58c5fc13 67053 #include <asm/mmu_context.h>
58c5fc13
MT		 67054
67055+#ifdef CONFIG_GRKERNSEC
67056+extern rwlock_t grsec_exec_file_lock;
67057+#endif
67058+
67059 static void exit_mm(struct task_struct * tsk);
67060
57199397 67061 static void __unhash_process(struct task_struct *p, bool group_dead)
bc901d79 67062@@ -169,6 +173,8 @@ void release_task(struct task_struct * p
58c5fc13
MT		 67063 struct task_struct *leader;
67064 int zap_leader;
67065 repeat:
67066+ gr_del_task_from_ip_table(p);
67067+
67068 tracehook_prepare_release_task(p);
67069 /* don't need to get the RCU readlock here - the process is dead and
df50ba0c 67070 * can't be modifying its own credentials. But shut RCU-lockdep up */
bc901d79 67071@@ -338,11 +344,22 @@ static void reparent_to_kthreadd(void)
58c5fc13
MT		 67072 {
67073 write_lock_irq(&tasklist_lock);
67074
67075+#ifdef CONFIG_GRKERNSEC
67076+ write_lock(&grsec_exec_file_lock);
67077+ if (current->exec_file) {
67078+ fput(current->exec_file);
67079+ current->exec_file = NULL;
67080+ }
67081+ write_unlock(&grsec_exec_file_lock);
67082+#endif
67083+
67084 ptrace_unlink(current);
67085 /* Reparent to init */
67086 current->real_parent = current->parent = kthreadd_task;
67087 list_move_tail(&current->sibling, &current->real_parent->children);
67088
67089+ gr_set_kernel_label(current);
67090+
67091 /* Set the exit signal to SIGCHLD so we signal init on exit */
67092 current->exit_signal = SIGCHLD;
67093
bc901d79 67094@@ -394,7 +411,7 @@ int allow_signal(int sig)
ae4e228f
MT		 67095 * know it'll be handled, so that they don't get converted to
67096 * SIGKILL or just silently dropped.
67097 */
67098- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
67099+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
67100 recalc_sigpending();
67101 spin_unlock_irq(&current->sighand->siglock);
67102 return 0;
bc901d79 67103@@ -430,6 +447,17 @@ void daemonize(const char *name, ...)
58c5fc13
MT		 67104 vsnprintf(current->comm, sizeof(current->comm), name, args);
67105 va_end(args);
67106
67107+#ifdef CONFIG_GRKERNSEC
67108+ write_lock(&grsec_exec_file_lock);
67109+ if (current->exec_file) {
67110+ fput(current->exec_file);
67111+ current->exec_file = NULL;
67112+ }
67113+ write_unlock(&grsec_exec_file_lock);
67114+#endif
67115+
67116+ gr_set_kernel_label(current);
67117+
67118 /*
67119 * If we were started as result of loading a module, close all of the
67120 * user space pages. We don't need them, and if we didn't close them
66a7e928 67121@@ -905,15 +933,8 @@ NORET_TYPE void do_exit(long code)
bc901d79
MT		 67122 struct task_struct *tsk = current;
67123 int group_dead;
67124
67125- profile_task_exit(tsk);
67126-
67127- WARN_ON(atomic_read(&tsk->fs_excl));
66a7e928 67128- WARN_ON(blk_needs_flush_plug(tsk));
bc901d79 67129-
bc901d79
MT		 67130 if (unlikely(in_interrupt()))
67131 panic("Aiee, killing interrupt handler!");
67132- if (unlikely(!tsk->pid))
67133- panic("Attempted to kill the idle task!");
67134
67135 /*
66a7e928
MT		 67136 * If do_exit is called because this processes oopsed, it's possible
67137@@ -924,6 +945,14 @@ NORET_TYPE void do_exit(long code)
bc901d79
MT		 67138 */
67139 set_fs(USER_DS);
67140
67141+ profile_task_exit(tsk);
67142+
67143+ WARN_ON(atomic_read(&tsk->fs_excl));
66a7e928 67144+ WARN_ON(blk_needs_flush_plug(tsk));
bc901d79
MT		 67145+
67146+ if (unlikely(!tsk->pid))
67147+ panic("Attempted to kill the idle task!");
67148+
67149 tracehook_report_exit(&code);
67150
67151 validate_creds_for_do_exit(tsk);
66a7e928 67152@@ -984,6 +1013,9 @@ NORET_TYPE void do_exit(long code)
58c5fc13
MT		 67153 tsk->exit_code = code;
67154 taskstats_exit(tsk, group_dead);
67155
67156+ gr_acl_handle_psacct(tsk, code);
67157+ gr_acl_handle_exit();
67158+
67159 exit_mm(tsk);
67160
67161 if (group_dead)
66a7e928
MT		 67162diff -urNp linux-2.6.39/kernel/fork.c linux-2.6.39/kernel/fork.c
67163--- linux-2.6.39/kernel/fork.c 2011-05-19 00:06:34.000000000 -0400
67164+++ linux-2.6.39/kernel/fork.c 2011-05-22 19:41:42.000000000 -0400
67165@@ -287,7 +287,7 @@ static struct task_struct *dup_task_stru
58c5fc13
MT		 67166 *stackend = STACK_END_MAGIC; /* for overflow detection */
67167
67168 #ifdef CONFIG_CC_STACKPROTECTOR
67169- tsk->stack_canary = get_random_int();
67170+ tsk->stack_canary = pax_get_random_long();
67171 #endif
67172
67173 /* One for us, one for whoever does the "release_task()" (usually parent) */
66a7e928 67174@@ -309,13 +309,78 @@ out:
57199397
MT		 67175 }
67176
67177 #ifdef CONFIG_MMU
67178+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
67179+{
67180+ struct vm_area_struct *tmp;
67181+ unsigned long charge;
67182+ struct mempolicy *pol;
67183+ struct file *file;
67184+
67185+ charge = 0;
67186+ if (mpnt->vm_flags & VM_ACCOUNT) {
67187+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67188+ if (security_vm_enough_memory(len))
67189+ goto fail_nomem;
67190+ charge = len;
67191+ }
67192+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67193+ if (!tmp)
67194+ goto fail_nomem;
67195+ *tmp = *mpnt;
67196+ tmp->vm_mm = mm;
67197+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
67198+ pol = mpol_dup(vma_policy(mpnt));
67199+ if (IS_ERR(pol))
67200+ goto fail_nomem_policy;
67201+ vma_set_policy(tmp, pol);
67202+ if (anon_vma_fork(tmp, mpnt))
67203+ goto fail_nomem_anon_vma_fork;
67204+ tmp->vm_flags &= ~VM_LOCKED;
6892158b 67205+ tmp->vm_next = tmp->vm_prev = NULL;
57199397
MT		 67206+ tmp->vm_mirror = NULL;
67207+ file = tmp->vm_file;
67208+ if (file) {
67209+ struct inode *inode = file->f_path.dentry->d_inode;
67210+ struct address_space *mapping = file->f_mapping;
67211+
67212+ get_file(file);
67213+ if (tmp->vm_flags & VM_DENYWRITE)
67214+ atomic_dec(&inode->i_writecount);
67215+ spin_lock(&mapping->i_mmap_lock);
67216+ if (tmp->vm_flags & VM_SHARED)
67217+ mapping->i_mmap_writable++;
67218+ tmp->vm_truncate_count = mpnt->vm_truncate_count;
67219+ flush_dcache_mmap_lock(mapping);
67220+ /* insert tmp into the share list, just after mpnt */
67221+ vma_prio_tree_add(tmp, mpnt);
67222+ flush_dcache_mmap_unlock(mapping);
67223+ spin_unlock(&mapping->i_mmap_lock);
67224+ }
67225+
67226+ /*
67227+ * Clear hugetlb-related page reserves for children. This only
67228+ * affects MAP_PRIVATE mappings. Faults generated by the child
67229+ * are not guaranteed to succeed, even if read-only
67230+ */
67231+ if (is_vm_hugetlb_page(tmp))
67232+ reset_vma_resv_huge_pages(tmp);
67233+
67234+ return tmp;
67235+
67236+fail_nomem_anon_vma_fork:
67237+ mpol_put(pol);
67238+fail_nomem_policy:
67239+ kmem_cache_free(vm_area_cachep, tmp);
67240+fail_nomem:
67241+ vm_unacct_memory(charge);
67242+ return NULL;
67243+}
67244+
67245 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
67246 {
67247 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
67248 struct rb_node **rb_link, *rb_parent;
67249 int retval;
67250- unsigned long charge;
67251- struct mempolicy *pol;
67252
67253 down_write(&oldmm->mmap_sem);
67254 flush_cache_dup_mm(oldmm);
66a7e928 67255@@ -327,8 +392,8 @@ static int dup_mmap(struct mm_struct *mm
58c5fc13
MT		 67256 mm->locked_vm = 0;
67257 mm->mmap = NULL;
67258 mm->mmap_cache = NULL;
67259- mm->free_area_cache = oldmm->mmap_base;
67260- mm->cached_hole_size = ~0UL;
67261+ mm->free_area_cache = oldmm->free_area_cache;
67262+ mm->cached_hole_size = oldmm->cached_hole_size;
67263 mm->map_count = 0;
67264 cpumask_clear(mm_cpumask(mm));
67265 mm->mm_rb = RB_ROOT;
66a7e928 67266@@ -344,8 +409,6 @@ static int dup_mmap(struct mm_struct *mm
57199397
MT		 67267
67268 prev = NULL;
67269 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
67270- struct file *file;
67271-
67272 if (mpnt->vm_flags & VM_DONTCOPY) {
67273 long pages = vma_pages(mpnt);
67274 mm->total_vm -= pages;
66a7e928 67275@@ -353,56 +416,13 @@ static int dup_mmap(struct mm_struct *mm
57199397
MT		 67276 -pages);
67277 continue;
67278 }
67279- charge = 0;
67280- if (mpnt->vm_flags & VM_ACCOUNT) {
67281- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67282- if (security_vm_enough_memory(len))
67283- goto fail_nomem;
67284- charge = len;
67285- }
67286- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67287- if (!tmp)
67288- goto fail_nomem;
67289- *tmp = *mpnt;
67290- INIT_LIST_HEAD(&tmp->anon_vma_chain);
67291- pol = mpol_dup(vma_policy(mpnt));
67292- retval = PTR_ERR(pol);
67293- if (IS_ERR(pol))
67294- goto fail_nomem_policy;
67295- vma_set_policy(tmp, pol);
6892158b 67296- tmp->vm_mm = mm;
57199397
MT		 67297- if (anon_vma_fork(tmp, mpnt))
67298- goto fail_nomem_anon_vma_fork;
67299- tmp->vm_flags &= ~VM_LOCKED;
57199397
MT		 67300- tmp->vm_next = tmp->vm_prev = NULL;
67301- file = tmp->vm_file;
67302- if (file) {
67303- struct inode *inode = file->f_path.dentry->d_inode;
67304- struct address_space *mapping = file->f_mapping;
67305-
67306- get_file(file);
67307- if (tmp->vm_flags & VM_DENYWRITE)
67308- atomic_dec(&inode->i_writecount);
67309- spin_lock(&mapping->i_mmap_lock);
67310- if (tmp->vm_flags & VM_SHARED)
67311- mapping->i_mmap_writable++;
67312- tmp->vm_truncate_count = mpnt->vm_truncate_count;
67313- flush_dcache_mmap_lock(mapping);
67314- /* insert tmp into the share list, just after mpnt */
67315- vma_prio_tree_add(tmp, mpnt);
67316- flush_dcache_mmap_unlock(mapping);
67317- spin_unlock(&mapping->i_mmap_lock);
67318+ tmp = dup_vma(mm, mpnt);
67319+ if (!tmp) {
67320+ retval = -ENOMEM;
67321+ goto out;
67322 }
67323
67324 /*
67325- * Clear hugetlb-related page reserves for children. This only
67326- * affects MAP_PRIVATE mappings. Faults generated by the child
67327- * are not guaranteed to succeed, even if read-only
67328- */
67329- if (is_vm_hugetlb_page(tmp))
67330- reset_vma_resv_huge_pages(tmp);
67331-
67332- /*
67333 * Link in the new vma and copy the page table entries.
67334 */
67335 *pprev = tmp;
66a7e928 67336@@ -423,6 +443,31 @@ static int dup_mmap(struct mm_struct *mm
58c5fc13
MT		 67337 if (retval)
67338 goto out;
67339 }
67340+
67341+#ifdef CONFIG_PAX_SEGMEXEC
67342+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
67343+ struct vm_area_struct *mpnt_m;
67344+
67345+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
67346+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
67347+
67348+ if (!mpnt->vm_mirror)
67349+ continue;
67350+
67351+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
67352+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
67353+ mpnt->vm_mirror = mpnt_m;
67354+ } else {
67355+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
67356+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
67357+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
67358+ mpnt->vm_mirror->vm_mirror = mpnt;
67359+ }
67360+ }
67361+ BUG_ON(mpnt_m);
67362+ }
67363+#endif
67364+
67365 /* a new mm has just been created */
67366 arch_dup_mmap(oldmm, mm);
67367 retval = 0;
66a7e928 67368@@ -431,14 +476,6 @@ out:
57199397
MT		 67369 flush_tlb_mm(oldmm);
67370 up_write(&oldmm->mmap_sem);
67371 return retval;
67372-fail_nomem_anon_vma_fork:
67373- mpol_put(pol);
67374-fail_nomem_policy:
67375- kmem_cache_free(vm_area_cachep, tmp);
67376-fail_nomem:
67377- retval = -ENOMEM;
67378- vm_unacct_memory(charge);
67379- goto out;
67380 }
67381
67382 static inline int mm_alloc_pgd(struct mm_struct * mm)
66a7e928 67383@@ -785,13 +822,14 @@ static int copy_fs(unsigned long clone_f
6892158b 67384 spin_unlock(&fs->lock);
58c5fc13
MT		 67385 return -EAGAIN;
67386 }
67387- fs->users++;
67388+ atomic_inc(&fs->users);
6892158b 67389 spin_unlock(&fs->lock);
58c5fc13
MT		 67390 return 0;
67391 }
df50ba0c
MT		 67392 tsk->fs = copy_fs_struct(fs);
67393 if (!tsk->fs)
67394 return -ENOMEM;
67395+ gr_set_chroot_entries(tsk, &tsk->fs->root);
67396 return 0;
67397 }
67398
66a7e928 67399@@ -1049,10 +1087,13 @@ static struct task_struct *copy_process(
58c5fc13
MT		 67400 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
67401 #endif
67402 retval = -EAGAIN;
67403+
67404+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
67405+
67406 if (atomic_read(&p->real_cred->user->processes) >=
df50ba0c 67407 task_rlimit(p, RLIMIT_NPROC)) {
ae4e228f
MT		 67408- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
67409- p->real_cred->user != INIT_USER)
67410+ if (p->real_cred->user != INIT_USER &&
df50ba0c 67411+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
ae4e228f
MT		 67412 goto bad_fork_free;
67413 }
67414
66a7e928 67415@@ -1200,6 +1241,8 @@ static struct task_struct *copy_process(
58c5fc13
MT		 67416 goto bad_fork_free_pid;
67417 }
67418
67419+ gr_copy_label(p);
67420+
67421 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
67422 /*
67423 * Clear TID on mm_release()?
66a7e928 67424@@ -1360,6 +1403,8 @@ bad_fork_cleanup_count:
58c5fc13
MT		 67425 bad_fork_free:
67426 free_task(p);
67427 fork_out:
67428+ gr_log_forkfail(retval);
67429+
67430 return ERR_PTR(retval);
67431 }
67432
66a7e928 67433@@ -1448,6 +1493,8 @@ long do_fork(unsigned long clone_flags,
58c5fc13
MT		 67434 if (clone_flags & CLONE_PARENT_SETTID)
67435 put_user(nr, parent_tidptr);
67436
67437+ gr_handle_brute_check();
67438+
67439 if (clone_flags & CLONE_VFORK) {
67440 p->vfork_done = &vfork;
67441 init_completion(&vfork);
66a7e928 67442@@ -1549,7 +1596,7 @@ static int unshare_fs(unsigned long unsh
58c5fc13
MT		 67443 return 0;
67444
67445 /* don't need lock here; in the worst case we'll do useless copy */
67446- if (fs->users == 1)
67447+ if (atomic_read(&fs->users) == 1)
67448 return 0;
67449
67450 *new_fsp = copy_fs_struct(fs);
66a7e928 67451@@ -1636,7 +1683,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
58c5fc13 67452 fs = current->fs;
6892158b 67453 spin_lock(&fs->lock);
58c5fc13
MT		 67454 current->fs = new_fs;
67455- if (--fs->users)
df50ba0c 67456+ gr_set_chroot_entries(current, &current->fs->root);
58c5fc13
MT		 67457+ if (atomic_dec_return(&fs->users))
67458 new_fs = NULL;
67459 else
67460 new_fs = fs;
66a7e928
MT		 67461diff -urNp linux-2.6.39/kernel/futex.c linux-2.6.39/kernel/futex.c
67462--- linux-2.6.39/kernel/futex.c 2011-05-19 00:06:34.000000000 -0400
67463+++ linux-2.6.39/kernel/futex.c 2011-05-22 22:41:57.000000000 -0400
ae4e228f
MT		 67464@@ -54,6 +54,7 @@
67465 #include <linux/mount.h>
67466 #include <linux/pagemap.h>
67467 #include <linux/syscalls.h>
67468+#include <linux/ptrace.h>
67469 #include <linux/signal.h>
67470 #include <linux/module.h>
67471 #include <linux/magic.h>
16454cff
MT		 67472@@ -236,6 +237,11 @@ get_futex_key(u32 __user *uaddr, int fsh
67473 struct page *page, *page_head;
58c5fc13
MT		 67474 int err;
67475
67476+#ifdef CONFIG_PAX_SEGMEXEC
67477+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67478+ return -EFAULT;
67479+#endif
67480+
67481 /*
67482 * The futex address must be "naturally" aligned.
67483 */
66a7e928
MT		 67484@@ -1833,6 +1839,8 @@ static int futex_wait(u32 __user *uaddr,
67485 struct futex_q q = futex_q_init;
67486 int ret;
67487
67488+ pax_track_stack();
67489+
67490 if (!bitset)
67491 return -EINVAL;
67492 q.bitset = bitset;
67493@@ -2229,6 +2237,8 @@ static int futex_wait_requeue_pi(u32 __u
67494 struct futex_q q = futex_q_init;
67495 int res, ret;
67496
67497+ pax_track_stack();
67498+
67499 if (!bitset)
67500 return -EINVAL;
67501
67502@@ -2401,7 +2411,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
ae4e228f
MT		 67503 {
67504 struct robust_list_head __user *head;
67505 unsigned long ret;
ae4e228f 67506+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
57199397 67507 const struct cred *cred = current_cred(), *pcred;
ae4e228f
MT		 67508+#endif
67509
67510 if (!futex_cmpxchg_enabled)
67511 return -ENOSYS;
66a7e928 67512@@ -2417,6 +2429,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
ae4e228f
MT		 67513 if (!p)
67514 goto err_unlock;
67515 ret = -EPERM;
67516+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67517+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67518+ goto err_unlock;
67519+#else
67520 pcred = __task_cred(p);
66a7e928
MT		 67521 /* If victim is in different user_ns, then uids are not
67522 comparable, so we must have CAP_SYS_PTRACE */
67523@@ -2431,6 +2447,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67524 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
ae4e228f 67525 goto err_unlock;
66a7e928 67526 ok:
ae4e228f
MT		 67527+#endif
67528 head = p->robust_list;
67529 rcu_read_unlock();
67530 }
66a7e928 67531@@ -2682,6 +2699,7 @@ static int __init futex_init(void)
58c5fc13 67532 {
bc901d79
MT		 67533 u32 curval;
67534 int i;
67535+ mm_segment_t oldfs;
58c5fc13 67536
bc901d79
MT		 67537 /*
67538 * This will fail and we want it. Some arch implementations do
66a7e928 67539@@ -2693,8 +2711,11 @@ static int __init futex_init(void)
bc901d79
MT		 67540 * implementation, the non-functional ones will return
67541 * -ENOSYS.
67542 */
67543+ oldfs = get_fs();
67544+ set_fs(USER_DS);
66a7e928 67545 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
bc901d79 67546 futex_cmpxchg_enabled = 1;
66a7e928 67547+ set_fs(oldfs);
bc901d79 67548
66a7e928
MT		 67549 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
67550 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
67551diff -urNp linux-2.6.39/kernel/futex_compat.c linux-2.6.39/kernel/futex_compat.c
67552--- linux-2.6.39/kernel/futex_compat.c 2011-05-19 00:06:34.000000000 -0400
67553+++ linux-2.6.39/kernel/futex_compat.c 2011-05-22 22:42:09.000000000 -0400
ae4e228f
MT		 67554@@ -10,6 +10,7 @@
67555 #include <linux/compat.h>
67556 #include <linux/nsproxy.h>
67557 #include <linux/futex.h>
67558+#include <linux/ptrace.h>
67559
67560 #include <asm/uaccess.h>
67561
bc901d79 67562@@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
ae4e228f
MT		 67563 {
67564 struct compat_robust_list_head __user *head;
67565 unsigned long ret;
67566- const struct cred *cred = current_cred(), *pcred;
ae4e228f 67567+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
57199397 67568+ const struct cred *cred = current_cred();
ae4e228f
MT		 67569+ const struct cred *pcred;
67570+#endif
67571
67572 if (!futex_cmpxchg_enabled)
67573 return -ENOSYS;
66a7e928 67574@@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
ae4e228f
MT		 67575 if (!p)
67576 goto err_unlock;
67577 ret = -EPERM;
67578+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67579+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67580+ goto err_unlock;
67581+#else
67582 pcred = __task_cred(p);
66a7e928
MT		 67583 /* If victim is in different user_ns, then uids are not
67584 comparable, so we must have CAP_SYS_PTRACE */
67585@@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
67586 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
ae4e228f 67587 goto err_unlock;
66a7e928 67588 ok:
ae4e228f
MT		 67589+#endif
67590 head = p->compat_robust_list;
df50ba0c 67591 rcu_read_unlock();
ae4e228f 67592 }
66a7e928
MT		 67593diff -urNp linux-2.6.39/kernel/gcov/base.c linux-2.6.39/kernel/gcov/base.c
67594--- linux-2.6.39/kernel/gcov/base.c 2011-05-19 00:06:34.000000000 -0400
67595+++ linux-2.6.39/kernel/gcov/base.c 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 67596@@ -102,11 +102,6 @@ void gcov_enable_events(void)
67597 }
67598
67599 #ifdef CONFIG_MODULES
67600-static inline int within(void *addr, void *start, unsigned long size)
67601-{
67602- return ((addr >= start) && (addr < start + size));
67603-}
67604-
67605 /* Update list and generate events when modules are unloaded. */
67606 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67607 void *data)
67608@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
67609 prev = NULL;
67610 /* Remove entries located in module from linked list. */
67611 for (info = gcov_info_head; info; info = info->next) {
67612- if (within(info, mod->module_core, mod->core_size)) {
67613+ if (within_module_core_rw((unsigned long)info, mod)) {
67614 if (prev)
67615 prev->next = info->next;
67616 else
66a7e928
MT		 67617diff -urNp linux-2.6.39/kernel/hrtimer.c linux-2.6.39/kernel/hrtimer.c
67618--- linux-2.6.39/kernel/hrtimer.c 2011-05-19 00:06:34.000000000 -0400
67619+++ linux-2.6.39/kernel/hrtimer.c 2011-05-22 19:36:33.000000000 -0400
67620@@ -1383,7 +1383,7 @@ void hrtimer_peek_ahead_timers(void)
ae4e228f
MT		 67621 local_irq_restore(flags);
67622 }
67623
67624-static void run_hrtimer_softirq(struct softirq_action *h)
67625+static void run_hrtimer_softirq(void)
67626 {
67627 hrtimer_peek_ahead_timers();
67628 }
66a7e928
MT		 67629diff -urNp linux-2.6.39/kernel/jump_label.c linux-2.6.39/kernel/jump_label.c
67630--- linux-2.6.39/kernel/jump_label.c 2011-05-19 00:06:34.000000000 -0400
67631+++ linux-2.6.39/kernel/jump_label.c 2011-05-22 19:36:33.000000000 -0400
bc901d79
MT		 67632@@ -49,6 +49,17 @@ void jump_label_unlock(void)
67633 mutex_unlock(&jump_label_mutex);
67634 }
67635
67636+static void jump_label_swap(void *a, void *b, int size)
67637+{
67638+ struct jump_entry t;
67639+
67640+ t = *(struct jump_entry *)a;
67641+ pax_open_kernel();
67642+ *(struct jump_entry *)a = *(struct jump_entry *)b;
67643+ *(struct jump_entry *)b = t;
67644+ pax_close_kernel();
67645+}
67646+
67647 static int jump_label_cmp(const void *a, const void *b)
67648 {
67649 const struct jump_entry *jea = a;
67650@@ -70,7 +81,7 @@ sort_jump_label_entries(struct jump_entr
67651
67652 size = (((unsigned long)stop - (unsigned long)start)
67653 / sizeof(struct jump_entry));
67654- sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
67655+ sort(start, size, sizeof(struct jump_entry), jump_label_cmp, jump_label_swap);
67656 }
67657
67658 static struct jump_label_entry *get_jump_label_entry(jump_label_t key)
67659@@ -407,8 +418,11 @@ static void remove_jump_label_module_ini
67660 count = e_module->nr_entries;
67661 iter = e_module->table;
67662 while (count--) {
67663- if (within_module_init(iter->code, mod))
67664+ if (within_module_init(iter->code, mod)) {
67665+ pax_open_kernel();
67666 iter->key = 0;
67667+ pax_close_kernel();
67668+ }
67669 iter++;
67670 }
67671 }
66a7e928
MT		 67672diff -urNp linux-2.6.39/kernel/kallsyms.c linux-2.6.39/kernel/kallsyms.c
67673--- linux-2.6.39/kernel/kallsyms.c 2011-05-19 00:06:34.000000000 -0400
67674+++ linux-2.6.39/kernel/kallsyms.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 67675@@ -11,6 +11,9 @@
67676 * Changed the compression method from stem compression to "table lookup"
67677 * compression (see scripts/kallsyms.c for a more complete description)
67678 */
67679+#ifdef CONFIG_GRKERNSEC_HIDESYM
67680+#define __INCLUDED_BY_HIDESYM 1
67681+#endif
67682 #include <linux/kallsyms.h>
67683 #include <linux/module.h>
67684 #include <linux/init.h>
57199397 67685@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
58c5fc13
MT		 67686
67687 static inline int is_kernel_inittext(unsigned long addr)
67688 {
67689+ if (system_state != SYSTEM_BOOTING)
67690+ return 0;
67691+
67692 if (addr >= (unsigned long)_sinittext
67693 && addr <= (unsigned long)_einittext)
67694 return 1;
57199397
MT		 67695 return 0;
67696 }
58c5fc13 67697
ae4e228f 67698+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
df50ba0c 67699+#ifdef CONFIG_MODULES
57199397
MT		 67700+static inline int is_module_text(unsigned long addr)
67701+{
67702+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67703+ return 1;
67704+
67705+ addr = ktla_ktva(addr);
67706+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67707+}
67708+#else
67709+static inline int is_module_text(unsigned long addr)
67710+{
67711+ return 0;
67712+}
67713+#endif
df50ba0c 67714+#endif
58c5fc13 67715+
57199397
MT		 67716 static inline int is_kernel_text(unsigned long addr)
67717 {
67718 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67719@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
67720
67721 static inline int is_kernel(unsigned long addr)
67722 {
ae4e228f 67723+
57199397
MT		 67724+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67725+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
58c5fc13 67726+ return 1;
ae4e228f 67727+
57199397
MT		 67728+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67729+#else
67730 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
ae4e228f 67731+#endif
58c5fc13 67732+
58c5fc13 67733 return 1;
66a7e928 67734 return in_gate_area_no_mm(addr);
57199397
MT		 67735 }
67736
67737 static int is_ksym_addr(unsigned long addr)
67738 {
67739+
67740+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67741+ if (is_module_text(addr))
67742+ return 0;
67743+#endif
67744+
67745 if (all_var)
67746 return is_kernel(addr);
67747
66a7e928 67748@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
58c5fc13
MT		 67749
67750 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67751 {
67752- iter->name[0] = '\0';
67753 iter->nameoff = get_symbol_offset(new_pos);
67754 iter->pos = new_pos;
67755 }
66a7e928 67756@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
ae4e228f
MT		 67757 {
67758 struct kallsym_iter *iter = m->private;
67759
67760+#ifdef CONFIG_GRKERNSEC_HIDESYM
67761+ if (current_uid())
67762+ return 0;
67763+#endif
67764+
67765 /* Some debugging symbols have no name. Ignore them. */
67766 if (!iter->name[0])
67767 return 0;
66a7e928 67768@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
58c5fc13
MT		 67769 struct kallsym_iter *iter;
67770 int ret;
67771
67772- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67773+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67774 if (!iter)
67775 return -ENOMEM;
67776 reset_iter(iter, 0);
66a7e928
MT		 67777diff -urNp linux-2.6.39/kernel/kmod.c linux-2.6.39/kernel/kmod.c
67778--- linux-2.6.39/kernel/kmod.c 2011-05-19 00:06:34.000000000 -0400
67779+++ linux-2.6.39/kernel/kmod.c 2011-05-22 19:41:42.000000000 -0400
71d190be
MT		 67780@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
67781 * If module auto-loading support is disabled then this function
67782 * becomes a no-operation.
67783 */
67784-int __request_module(bool wait, const char *fmt, ...)
67785+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67786 {
67787- va_list args;
67788 char module_name[MODULE_NAME_LEN];
67789 unsigned int max_modprobes;
67790 int ret;
67791- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
67792+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
67793 static char *envp[] = { "HOME=/",
67794 "TERM=linux",
67795 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
67796@@ -80,9 +79,7 @@ int __request_module(bool wait, const ch
67797 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
67798 static int kmod_loop_msg;
67799
67800- va_start(args, fmt);
67801- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67802- va_end(args);
67803+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67804 if (ret >= MODULE_NAME_LEN)
67805 return -ENAMETOOLONG;
67806
67807@@ -90,6 +87,20 @@ int __request_module(bool wait, const ch
ae4e228f
MT		 67808 if (ret)
67809 return ret;
58c5fc13
MT		 67810
67811+#ifdef CONFIG_GRKERNSEC_MODHARDEN
71d190be
MT		 67812+ if (!current_uid()) {
67813+ /* hack to workaround consolekit/udisks stupidity */
67814+ read_lock(&tasklist_lock);
67815+ if (!strcmp(current->comm, "mount") &&
67816+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
67817+ read_unlock(&tasklist_lock);
67818+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
67819+ return -EPERM;
67820+ }
67821+ read_unlock(&tasklist_lock);
58c5fc13
MT		 67822+ }
67823+#endif
67824+
67825 /* If modprobe needs a service that is in a module, we get a recursive
67826 * loop. Limit the number of running kmod threads to max_threads/2 or
67827 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
71d190be
MT		 67828@@ -123,6 +134,47 @@ int __request_module(bool wait, const ch
67829 atomic_dec(&kmod_concurrent);
67830 return ret;
67831 }
67832+
67833+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
67834+{
67835+ va_list args;
67836+ int ret;
67837+
67838+ va_start(args, fmt);
67839+ ret = ____request_module(wait, module_param, fmt, args);
67840+ va_end(args);
67841+
67842+ return ret;
67843+}
67844+
67845+int __request_module(bool wait, const char *fmt, ...)
67846+{
67847+ va_list args;
67848+ int ret;
67849+
67850+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67851+ if (current_uid()) {
67852+ char module_param[MODULE_NAME_LEN];
67853+
67854+ memset(module_param, 0, sizeof(module_param));
67855+
67856+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
67857+
67858+ va_start(args, fmt);
67859+ ret = ____request_module(wait, module_param, fmt, args);
67860+ va_end(args);
67861+
67862+ return ret;
67863+ }
67864+#endif
67865+
67866+ va_start(args, fmt);
67867+ ret = ____request_module(wait, NULL, fmt, args);
67868+ va_end(args);
67869+
67870+ return ret;
67871+}
67872+
67873 EXPORT_SYMBOL(__request_module);
67874 #endif /* CONFIG_MODULES */
67875
66a7e928
MT		 67876diff -urNp linux-2.6.39/kernel/kprobes.c linux-2.6.39/kernel/kprobes.c
67877--- linux-2.6.39/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
67878+++ linux-2.6.39/kernel/kprobes.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 67879@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
58c5fc13
MT		 67880 * kernel image and loaded module images reside. This is required
67881 * so x86_64 can correctly handle the %rip-relative fixups.
67882 */
67883- kip->insns = module_alloc(PAGE_SIZE);
67884+ kip->insns = module_alloc_exec(PAGE_SIZE);
67885 if (!kip->insns) {
67886 kfree(kip);
67887 return NULL;
bc901d79 67888@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
ae4e228f 67889 */
df50ba0c 67890 if (!list_is_singular(&kip->list)) {
ae4e228f 67891 list_del(&kip->list);
58c5fc13
MT		 67892- module_free(NULL, kip->insns);
67893+ module_free_exec(NULL, kip->insns);
67894 kfree(kip);
67895 }
67896 return 1;
16454cff 67897@@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
df50ba0c
MT		 67898 {
67899 int i, err = 0;
67900 unsigned long offset = 0, size = 0;
67901- char *modname, namebuf[128];
67902+ char *modname, namebuf[KSYM_NAME_LEN];
67903 const char *symbol_name;
67904 void *addr;
67905 struct kprobe_blackpoint *kb;
16454cff 67906@@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
df50ba0c
MT		 67907 const char *sym = NULL;
67908 unsigned int i = *(loff_t *) v;
67909 unsigned long offset = 0;
67910- char *modname, namebuf[128];
67911+ char *modname, namebuf[KSYM_NAME_LEN];
67912
67913 head = &kprobe_table[i];
67914 preempt_disable();
66a7e928
MT		 67915diff -urNp linux-2.6.39/kernel/lockdep.c linux-2.6.39/kernel/lockdep.c
67916--- linux-2.6.39/kernel/lockdep.c 2011-05-19 00:06:34.000000000 -0400
67917+++ linux-2.6.39/kernel/lockdep.c 2011-05-22 19:36:33.000000000 -0400
57199397 67918@@ -571,6 +571,10 @@ static int static_obj(void *obj)
df50ba0c
MT		 67919 end = (unsigned long) &_end,
67920 addr = (unsigned long) obj;
58c5fc13
MT		 67921
67922+#ifdef CONFIG_PAX_KERNEXEC
ae4e228f 67923+ start = ktla_ktva(start);
58c5fc13
MT		 67924+#endif
67925+
67926 /*
67927 * static variable?
67928 */
bc901d79 67929@@ -706,6 +710,7 @@ register_lock_class(struct lockdep_map *
ae4e228f
MT		 67930 if (!static_obj(lock->key)) {
67931 debug_locks_off();
67932 printk("INFO: trying to register non-static key.\n");
67933+ printk("lock:%pS key:%pS.\n", lock, lock->key);
67934 printk("the code is fine but needs lockdep annotation.\n");
67935 printk("turning off the locking correctness validator.\n");
67936 dump_stack();
16454cff 67937@@ -2752,7 +2757,7 @@ static int __lock_acquire(struct lockdep
bc901d79
MT		 67938 if (!class)
67939 return 0;
67940 }
67941- atomic_inc((atomic_t *)&class->ops);
67942+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
67943 if (very_verbose(class)) {
67944 printk("\nacquire class [%p] %s", class->key, class->name);
67945 if (class->name_version > 1)
66a7e928
MT		 67946diff -urNp linux-2.6.39/kernel/lockdep_proc.c linux-2.6.39/kernel/lockdep_proc.c
67947--- linux-2.6.39/kernel/lockdep_proc.c 2011-05-19 00:06:34.000000000 -0400
67948+++ linux-2.6.39/kernel/lockdep_proc.c 2011-05-22 19:36:33.000000000 -0400
df50ba0c
MT		 67949@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
67950
67951 static void print_name(struct seq_file *m, struct lock_class *class)
67952 {
67953- char str[128];
67954+ char str[KSYM_NAME_LEN];
67955 const char *name = class->name;
67956
67957 if (!name) {
66a7e928
MT		 67958diff -urNp linux-2.6.39/kernel/module.c linux-2.6.39/kernel/module.c
67959--- linux-2.6.39/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
67960+++ linux-2.6.39/kernel/module.c 2011-05-22 19:41:42.000000000 -0400
71d190be
MT		 67961@@ -57,6 +57,7 @@
67962 #include <linux/kmemleak.h>
67963 #include <linux/jump_label.h>
67964 #include <linux/pfn.h>
67965+#include <linux/grsecurity.h>
67966
67967 #define CREATE_TRACE_POINTS
67968 #include <trace/events/module.h>
67969@@ -118,7 +119,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
58c5fc13 67970
57199397
MT		 67971 /* Bounds of module allocation, for speeding __module_address.
67972 * Protected by module_mutex. */
58c5fc13
MT		 67973-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
67974+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
67975+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
67976
67977 int register_module_notifier(struct notifier_block * nb)
67978 {
71d190be 67979@@ -282,7 +284,7 @@ bool each_symbol(bool (*fn)(const struct
58c5fc13
MT		 67980 return true;
67981
67982 list_for_each_entry_rcu(mod, &modules, list) {
67983- struct symsearch arr[] = {
67984+ struct symsearch modarr[] = {
67985 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
67986 NOT_GPL_ONLY, false },
67987 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
71d190be 67988@@ -304,7 +306,7 @@ bool each_symbol(bool (*fn)(const struct
58c5fc13
MT		 67989 #endif
67990 };
67991
67992- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
67993+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
67994 return true;
67995 }
67996 return false;
71d190be 67997@@ -415,7 +417,7 @@ static inline void __percpu *mod_percpu(
df50ba0c
MT		 67998 static int percpu_modalloc(struct module *mod,
67999 unsigned long size, unsigned long align)
ae4e228f 68000 {
58c5fc13
MT		 68001- if (align > PAGE_SIZE) {
68002+ if (align-1 >= PAGE_SIZE) {
68003 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
df50ba0c 68004 mod->name, align, PAGE_SIZE);
58c5fc13 68005 align = PAGE_SIZE;
71d190be 68006@@ -1143,7 +1145,7 @@ resolve_symbol_wait(struct module *mod,
c52201e0
MT		 68007 */
68008 #ifdef CONFIG_SYSFS
68009
68010-#ifdef CONFIG_KALLSYMS
68011+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
68012 static inline bool sect_empty(const Elf_Shdr *sect)
68013 {
68014 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
71d190be 68015@@ -1612,17 +1614,17 @@ void unset_section_ro_nx(struct module *
16454cff
MT		 68016 {
68017 unsigned long total_pages;
68018
68019- if (mod->module_core == module_region) {
68020+ if (mod->module_core_rx == module_region) {
68021 /* Set core as NX+RW */
68022- total_pages = MOD_NUMBER_OF_PAGES(mod->module_core, mod->core_size);
68023- set_memory_nx((unsigned long)mod->module_core, total_pages);
68024- set_memory_rw((unsigned long)mod->module_core, total_pages);
68025+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_core_rx, mod->core_size_rx);
68026+ set_memory_nx((unsigned long)mod->module_core_rx, total_pages);
68027+ set_memory_rw((unsigned long)mod->module_core_rx, total_pages);
68028
68029- } else if (mod->module_init == module_region) {
68030+ } else if (mod->module_init_rx == module_region) {
68031 /* Set init as NX+RW */
68032- total_pages = MOD_NUMBER_OF_PAGES(mod->module_init, mod->init_size);
68033- set_memory_nx((unsigned long)mod->module_init, total_pages);
68034- set_memory_rw((unsigned long)mod->module_init, total_pages);
68035+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_init_rx, mod->init_size_rx);
68036+ set_memory_nx((unsigned long)mod->module_init_rx, total_pages);
68037+ set_memory_rw((unsigned long)mod->module_init_rx, total_pages);
68038 }
68039 }
68040
71d190be 68041@@ -1633,14 +1635,14 @@ void set_all_modules_text_rw()
16454cff
MT		 68042
68043 mutex_lock(&module_mutex);
68044 list_for_each_entry_rcu(mod, &modules, list) {
68045- if ((mod->module_core) && (mod->core_text_size)) {
68046- set_page_attributes(mod->module_core,
68047- mod->module_core + mod->core_text_size,
68048+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68049+ set_page_attributes(mod->module_core_rx,
68050+ mod->module_core_rx + mod->core_size_rx,
68051 set_memory_rw);
68052 }
68053- if ((mod->module_init) && (mod->init_text_size)) {
68054- set_page_attributes(mod->module_init,
68055- mod->module_init + mod->init_text_size,
68056+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68057+ set_page_attributes(mod->module_init_rx,
68058+ mod->module_init_rx + mod->init_size_rx,
68059 set_memory_rw);
68060 }
68061 }
71d190be 68062@@ -1654,14 +1656,14 @@ void set_all_modules_text_ro()
16454cff
MT		 68063
68064 mutex_lock(&module_mutex);
68065 list_for_each_entry_rcu(mod, &modules, list) {
68066- if ((mod->module_core) && (mod->core_text_size)) {
68067- set_page_attributes(mod->module_core,
68068- mod->module_core + mod->core_text_size,
68069+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68070+ set_page_attributes(mod->module_core_rx,
68071+ mod->module_core_rx + mod->core_size_rx,
68072 set_memory_ro);
68073 }
68074- if ((mod->module_init) && (mod->init_text_size)) {
68075- set_page_attributes(mod->module_init,
68076- mod->module_init + mod->init_text_size,
68077+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68078+ set_page_attributes(mod->module_init_rx,
68079+ mod->module_init_rx + mod->init_size_rx,
68080 set_memory_ro);
68081 }
68082 }
71d190be 68083@@ -1696,17 +1698,20 @@ static void free_module(struct module *m
58c5fc13
MT		 68084 destroy_params(mod->kp, mod->num_kp);
68085
68086 /* This may be NULL, but that's OK */
16454cff 68087- unset_section_ro_nx(mod, mod->module_init);
58c5fc13 68088- module_free(mod, mod->module_init);
16454cff 68089+ unset_section_ro_nx(mod, mod->module_init_rx);
58c5fc13
MT		 68090+ module_free(mod, mod->module_init_rw);
68091+ module_free_exec(mod, mod->module_init_rx);
68092 kfree(mod->args);
df50ba0c 68093 percpu_modfree(mod);
6892158b 68094
58c5fc13
MT		 68095 /* Free lock-classes: */
68096- lockdep_free_key_range(mod->module_core, mod->core_size);
68097+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
68098+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
68099
68100 /* Finally, free the core (containing the module structure) */
16454cff 68101- unset_section_ro_nx(mod, mod->module_core);
58c5fc13 68102- module_free(mod, mod->module_core);
16454cff 68103+ unset_section_ro_nx(mod, mod->module_core_rx);
58c5fc13
MT		 68104+ module_free_exec(mod, mod->module_core_rx);
68105+ module_free(mod, mod->module_core_rw);
58c5fc13 68106
ae4e228f
MT		 68107 #ifdef CONFIG_MPU
68108 update_protections(current->mm);
8308f9c9 68109@@ -1775,10 +1780,31 @@ static int simplify_symbols(struct modul
71d190be
MT		 68110 unsigned int i;
68111 int ret = 0;
68112 const struct kernel_symbol *ksym;
68113+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68114+ int is_fs_load = 0;
68115+ int register_filesystem_found = 0;
8308f9c9 68116+ char *p;
71d190be 68117+
8308f9c9
MT		 68118+ p = strstr(mod->args, "grsec_modharden_fs");
68119+ if (p) {
68120+ char *endptr = p + strlen("grsec_modharden_fs");
68121+ /* copy \0 as well */
68122+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
71d190be 68123+ is_fs_load = 1;
8308f9c9 68124+ }
71d190be
MT		 68125+#endif
68126
68127 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
68128 const char *name = info->strtab + sym[i].st_name;
68129
68130+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68131+ /* it's a real shame this will never get ripped and copied
68132+ upstream! ;(
68133+ */
68134+ if (is_fs_load && !strcmp(name, "register_filesystem"))
68135+ register_filesystem_found = 1;
68136+#endif
68137+
68138 switch (sym[i].st_shndx) {
68139 case SHN_COMMON:
68140 /* We compiled with -fno-common. These are not
8308f9c9 68141@@ -1799,7 +1825,9 @@ static int simplify_symbols(struct modul
6892158b 68142 ksym = resolve_symbol_wait(mod, info, name);
58c5fc13 68143 /* Ok if resolved. */
57199397 68144 if (ksym && !IS_ERR(ksym)) {
ae4e228f 68145+ pax_open_kernel();
58c5fc13 68146 sym[i].st_value = ksym->value;
ae4e228f 68147+ pax_close_kernel();
58c5fc13
MT		 68148 break;
68149 }
68150
8308f9c9 68151@@ -1818,11 +1846,20 @@ static int simplify_symbols(struct modul
df50ba0c 68152 secbase = (unsigned long)mod_percpu(mod);
58c5fc13 68153 else
6892158b 68154 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
ae4e228f 68155+ pax_open_kernel();
58c5fc13 68156 sym[i].st_value += secbase;
ae4e228f 68157+ pax_close_kernel();
58c5fc13
MT		 68158 break;
68159 }
68160 }
71d190be
MT		 68161
68162+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68163+ if (is_fs_load && !register_filesystem_found) {
68164+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
68165+ ret = -EPERM;
68166+ }
68167+#endif
68168+
68169 return ret;
68170 }
68171
8308f9c9 68172@@ -1906,22 +1943,12 @@ static void layout_sections(struct modul
58c5fc13 68173 || s->sh_entsize != ~0UL
6892158b 68174 || strstarts(sname, ".init"))
58c5fc13
MT		 68175 continue;
68176- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
68177+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68178+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
68179+ else
68180+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
6892158b 68181 DEBUGP("\t%s\n", name);
58c5fc13 68182 }
16454cff
MT		 68183- switch (m) {
68184- case 0: /* executable */
68185- mod->core_size = debug_align(mod->core_size);
58c5fc13 68186- mod->core_text_size = mod->core_size;
16454cff
MT		 68187- break;
68188- case 1: /* RO: text and ro-data */
68189- mod->core_size = debug_align(mod->core_size);
68190- mod->core_ro_size = mod->core_size;
68191- break;
68192- case 3: /* whole core */
68193- mod->core_size = debug_align(mod->core_size);
68194- break;
68195- }
58c5fc13
MT		 68196 }
68197
68198 DEBUGP("Init section allocation order:\n");
8308f9c9 68199@@ -1935,23 +1962,13 @@ static void layout_sections(struct modul
58c5fc13 68200 || s->sh_entsize != ~0UL
6892158b 68201 || !strstarts(sname, ".init"))
58c5fc13
MT		 68202 continue;
68203- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
68204- | INIT_OFFSET_MASK);
68205+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68206+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
68207+ else
68208+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
68209+ s->sh_entsize |= INIT_OFFSET_MASK;
6892158b 68210 DEBUGP("\t%s\n", sname);
58c5fc13 68211 }
16454cff
MT		 68212- switch (m) {
68213- case 0: /* executable */
68214- mod->init_size = debug_align(mod->init_size);
58c5fc13 68215- mod->init_text_size = mod->init_size;
16454cff
MT		 68216- break;
68217- case 1: /* RO: text and ro-data */
68218- mod->init_size = debug_align(mod->init_size);
68219- mod->init_ro_size = mod->init_size;
68220- break;
68221- case 3: /* whole init */
68222- mod->init_size = debug_align(mod->init_size);
68223- break;
68224- }
58c5fc13
MT		 68225 }
68226 }
68227
8308f9c9 68228@@ -2119,7 +2136,7 @@ static void layout_symtab(struct module
58c5fc13 68229
ae4e228f
MT		 68230 /* Put symbol section at end of init part of module. */
68231 symsect->sh_flags |= SHF_ALLOC;
68232- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
68233+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
6892158b
MT		 68234 info->index.sym) | INIT_OFFSET_MASK;
68235 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
ae4e228f 68236
8308f9c9 68237@@ -2136,19 +2153,19 @@ static void layout_symtab(struct module
ae4e228f
MT		 68238 }
68239
68240 /* Append room for core symbols at end of core part. */
6892158b
MT		 68241- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
68242- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
68243+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
68244+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
ae4e228f
MT		 68245
68246 /* Put string table section at end of init part of module. */
68247 strsect->sh_flags |= SHF_ALLOC;
68248- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
68249+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
6892158b
MT		 68250 info->index.str) | INIT_OFFSET_MASK;
68251 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
ae4e228f
MT		 68252
68253 /* Append room for core symbols' strings at end of core part. */
6892158b
MT		 68254- info->stroffs = mod->core_size;
68255+ info->stroffs = mod->core_size_rx;
68256 __set_bit(0, info->strmap);
68257- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
68258+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
ae4e228f 68259 }
6892158b
MT		 68260
68261 static void add_kallsyms(struct module *mod, const struct load_info *info)
8308f9c9 68262@@ -2164,11 +2181,13 @@ static void add_kallsyms(struct module *
6892158b
MT		 68263 /* Make sure we get permanent strtab: don't use info->strtab. */
68264 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
58c5fc13 68265
ae4e228f
MT		 68266+ pax_open_kernel();
68267+
58c5fc13 68268 /* Set types up while we still have access to sections. */
ae4e228f 68269 for (i = 0; i < mod->num_symtab; i++)
6892158b 68270 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
ae4e228f 68271
6892158b
MT		 68272- mod->core_symtab = dst = mod->module_core + info->symoffs;
68273+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
ae4e228f
MT		 68274 src = mod->symtab;
68275 *dst = *src;
68276 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
8308f9c9 68277@@ -2181,10 +2200,12 @@ static void add_kallsyms(struct module *
ae4e228f
MT		 68278 }
68279 mod->core_num_syms = ndst;
68280
6892158b
MT		 68281- mod->core_strtab = s = mod->module_core + info->stroffs;
68282+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
68283 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
68284 if (test_bit(i, info->strmap))
ae4e228f 68285 *++s = mod->strtab[i];
58c5fc13 68286+
ae4e228f 68287+ pax_close_kernel();
58c5fc13
MT		 68288 }
68289 #else
6892158b 68290 static inline void layout_symtab(struct module *mod, struct load_info *info)
8308f9c9 68291@@ -2213,17 +2234,33 @@ static void dynamic_debug_remove(struct
57199397 68292 ddebug_remove_module(debug->modname);
58c5fc13
MT		 68293 }
68294
68295-static void *module_alloc_update_bounds(unsigned long size)
68296+static void *module_alloc_update_bounds_rw(unsigned long size)
68297 {
68298 void *ret = module_alloc(size);
68299
68300 if (ret) {
57199397 68301 mutex_lock(&module_mutex);
58c5fc13
MT		 68302 /* Update module bounds. */
68303- if ((unsigned long)ret < module_addr_min)
68304- module_addr_min = (unsigned long)ret;
68305- if ((unsigned long)ret + size > module_addr_max)
68306- module_addr_max = (unsigned long)ret + size;
68307+ if ((unsigned long)ret < module_addr_min_rw)
68308+ module_addr_min_rw = (unsigned long)ret;
68309+ if ((unsigned long)ret + size > module_addr_max_rw)
68310+ module_addr_max_rw = (unsigned long)ret + size;
57199397 68311+ mutex_unlock(&module_mutex);
58c5fc13
MT		 68312+ }
68313+ return ret;
68314+}
68315+
68316+static void *module_alloc_update_bounds_rx(unsigned long size)
68317+{
68318+ void *ret = module_alloc_exec(size);
68319+
68320+ if (ret) {
57199397 68321+ mutex_lock(&module_mutex);
58c5fc13
MT		 68322+ /* Update module bounds. */
68323+ if ((unsigned long)ret < module_addr_min_rx)
68324+ module_addr_min_rx = (unsigned long)ret;
68325+ if ((unsigned long)ret + size > module_addr_max_rx)
68326+ module_addr_max_rx = (unsigned long)ret + size;
57199397 68327 mutex_unlock(&module_mutex);
58c5fc13
MT		 68328 }
68329 return ret;
8308f9c9 68330@@ -2516,7 +2553,7 @@ static int move_module(struct module *mo
6892158b 68331 void *ptr;
58c5fc13
MT		 68332
68333 /* Do the allocs. */
68334- ptr = module_alloc_update_bounds(mod->core_size);
68335+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68336 /*
68337 * The pointer to this block is stored in the module structure
68338 * which is inside the block. Just mark it as not being a
8308f9c9 68339@@ -2526,23 +2563,50 @@ static int move_module(struct module *mo
6892158b
MT		 68340 if (!ptr)
68341 return -ENOMEM;
68342
58c5fc13
MT		 68343- memset(ptr, 0, mod->core_size);
68344- mod->module_core = ptr;
68345+ memset(ptr, 0, mod->core_size_rw);
68346+ mod->module_core_rw = ptr;
68347
68348- ptr = module_alloc_update_bounds(mod->init_size);
68349+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68350 /*
68351 * The pointer to this block is stored in the module structure
68352 * which is inside the block. This block doesn't need to be
68353 * scanned as it contains data and code that will be freed
68354 * after the module is initialized.
68355 */
68356- kmemleak_ignore(ptr);
68357- if (!ptr && mod->init_size) {
6892158b 68358- module_free(mod, mod->module_core);
58c5fc13
MT		 68359+ kmemleak_not_leak(ptr);
68360+ if (!ptr && mod->init_size_rw) {
6892158b 68361+ module_free(mod, mod->module_core_rw);
16454cff
MT		 68362 return -ENOMEM;
68363 }
68364- memset(ptr, 0, mod->init_size);
68365- mod->module_init = ptr;
58c5fc13
MT		 68366+ memset(ptr, 0, mod->init_size_rw);
68367+ mod->module_init_rw = ptr;
68368+
68369+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68370+ kmemleak_not_leak(ptr);
68371+ if (!ptr) {
6892158b
MT		 68372+ module_free(mod, mod->module_init_rw);
68373+ module_free(mod, mod->module_core_rw);
c52201e0
MT		 68374+ return -ENOMEM;
68375+ }
58c5fc13 68376+
ae4e228f 68377+ pax_open_kernel();
58c5fc13 68378+ memset(ptr, 0, mod->core_size_rx);
ae4e228f 68379+ pax_close_kernel();
58c5fc13
MT		 68380+ mod->module_core_rx = ptr;
68381+
68382+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68383+ kmemleak_not_leak(ptr);
68384+ if (!ptr && mod->init_size_rx) {
6892158b
MT		 68385+ module_free_exec(mod, mod->module_core_rx);
68386+ module_free(mod, mod->module_init_rw);
68387+ module_free(mod, mod->module_core_rw);
16454cff
MT		 68388+ return -ENOMEM;
68389+ }
58c5fc13 68390+
ae4e228f 68391+ pax_open_kernel();
58c5fc13 68392+ memset(ptr, 0, mod->init_size_rx);
ae4e228f 68393+ pax_close_kernel();
58c5fc13
MT		 68394+ mod->module_init_rx = ptr;
68395
68396 /* Transfer each section which specifies SHF_ALLOC */
68397 DEBUGP("final section addresses:\n");
8308f9c9 68398@@ -2553,16 +2617,45 @@ static int move_module(struct module *mo
6892158b 68399 if (!(shdr->sh_flags & SHF_ALLOC))
58c5fc13
MT		 68400 continue;
68401
6892158b 68402- if (shdr->sh_entsize & INIT_OFFSET_MASK)
58c5fc13 68403- dest = mod->module_init
6892158b 68404- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
58c5fc13 68405- else
6892158b
MT		 68406- dest = mod->module_core + shdr->sh_entsize;
68407+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
68408+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
58c5fc13 68409+ dest = mod->module_init_rw
6892158b 68410+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
58c5fc13
MT		 68411+ else
68412+ dest = mod->module_init_rx
6892158b 68413+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
58c5fc13 68414+ } else {
6892158b
MT		 68415+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68416+ dest = mod->module_core_rw + shdr->sh_entsize;
58c5fc13 68417+ else
6892158b 68418+ dest = mod->module_core_rx + shdr->sh_entsize;
58c5fc13
MT		 68419+ }
68420+
6892158b
MT		 68421+ if (shdr->sh_type != SHT_NOBITS) {
68422+
58c5fc13 68423+#ifdef CONFIG_PAX_KERNEXEC
bc901d79
MT		 68424+#ifdef CONFIG_X86_64
68425+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
68426+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68427+#endif
6892158b 68428+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
ae4e228f 68429+ pax_open_kernel();
6892158b 68430+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
ae4e228f 68431+ pax_close_kernel();
58c5fc13
MT		 68432+ } else
68433+#endif
6892158b
MT		 68434
68435- if (shdr->sh_type != SHT_NOBITS)
68436 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
58c5fc13
MT		 68437+ }
68438 /* Update sh_addr to point to copy in image. */
6892158b 68439- shdr->sh_addr = (unsigned long)dest;
58c5fc13
MT		 68440+
68441+#ifdef CONFIG_PAX_KERNEXEC
6892158b
MT		 68442+ if (shdr->sh_flags & SHF_EXECINSTR)
68443+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
58c5fc13
MT		 68444+ else
68445+#endif
68446+
6892158b
MT		 68447+ shdr->sh_addr = (unsigned long)dest;
68448 DEBUGP("\t0x%lx %s\n",
68449 shdr->sh_addr, info->secstrings + shdr->sh_name);
58c5fc13 68450 }
8308f9c9 68451@@ -2613,12 +2706,12 @@ static void flush_module_icache(const st
58c5fc13
MT		 68452 * Do it before processing of module parameters, so the module
68453 * can provide parameter accessor functions of its own.
68454 */
68455- if (mod->module_init)
68456- flush_icache_range((unsigned long)mod->module_init,
68457- (unsigned long)mod->module_init
68458- + mod->init_size);
68459- flush_icache_range((unsigned long)mod->module_core,
68460- (unsigned long)mod->module_core + mod->core_size);
68461+ if (mod->module_init_rx)
68462+ flush_icache_range((unsigned long)mod->module_init_rx,
68463+ (unsigned long)mod->module_init_rx
68464+ + mod->init_size_rx);
68465+ flush_icache_range((unsigned long)mod->module_core_rx,
68466+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
68467
68468 set_fs(old_fs);
6892158b 68469 }
8308f9c9 68470@@ -2690,8 +2783,10 @@ static void module_deallocate(struct mod
6892158b
MT		 68471 {
68472 kfree(info->strmap);
68473 percpu_modfree(mod);
58c5fc13 68474- module_free(mod, mod->module_init);
58c5fc13
MT		 68475- module_free(mod, mod->module_core);
68476+ module_free_exec(mod, mod->module_init_rx);
58c5fc13 68477+ module_free_exec(mod, mod->module_core_rx);
58c5fc13 68478+ module_free(mod, mod->module_init_rw);
58c5fc13 68479+ module_free(mod, mod->module_core_rw);
6892158b
MT		 68480 }
68481
68482 static int post_relocation(struct module *mod, const struct load_info *info)
8308f9c9 68483@@ -2748,9 +2843,38 @@ static struct module *load_module(void _
71d190be
MT		 68484 if (err)
68485 goto free_unload;
68486
68487+ /* Now copy in args */
68488+ mod->args = strndup_user(uargs, ~0UL >> 1);
68489+ if (IS_ERR(mod->args)) {
68490+ err = PTR_ERR(mod->args);
68491+ goto free_unload;
68492+ }
68493+
68494 /* Set up MODINFO_ATTR fields */
68495 setup_modinfo(mod, &info);
68496
68497+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68498+ {
68499+ char *p, *p2;
68500+
68501+ if (strstr(mod->args, "grsec_modharden_netdev")) {
68502+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68503+ err = -EPERM;
68504+ goto free_modinfo;
68505+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68506+ p += strlen("grsec_modharden_normal");
68507+ p2 = strstr(p, "_");
68508+ if (p2) {
68509+ *p2 = '\0';
68510+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68511+ *p2 = '_';
68512+ }
68513+ err = -EPERM;
68514+ goto free_modinfo;
68515+ }
68516+ }
68517+#endif
68518+
68519 /* Fix up syms, so that st_value is a pointer to location. */
68520 err = simplify_symbols(mod, &info);
68521 if (err < 0)
8308f9c9 68522@@ -2766,13 +2890,6 @@ static struct module *load_module(void _
71d190be
MT		 68523
68524 flush_module_icache(mod);
68525
68526- /* Now copy in args */
68527- mod->args = strndup_user(uargs, ~0UL >> 1);
68528- if (IS_ERR(mod->args)) {
68529- err = PTR_ERR(mod->args);
68530- goto free_arch_cleanup;
68531- }
68532-
68533 /* Mark state as coming so strong_try_module_get() ignores us. */
68534 mod->state = MODULE_STATE_COMING;
68535
8308f9c9 68536@@ -2832,11 +2949,10 @@ static struct module *load_module(void _
71d190be
MT		 68537 unlock:
68538 mutex_unlock(&module_mutex);
68539 synchronize_sched();
68540- kfree(mod->args);
68541- free_arch_cleanup:
68542 module_arch_cleanup(mod);
68543 free_modinfo:
68544 free_modinfo(mod);
68545+ kfree(mod->args);
68546 free_unload:
68547 module_unload_free(mod);
68548 free_module:
8308f9c9 68549@@ -2877,16 +2993,16 @@ SYSCALL_DEFINE3(init_module, void __user
16454cff
MT		 68550 MODULE_STATE_COMING, mod);
68551
68552 /* Set RO and NX regions for core */
68553- set_section_ro_nx(mod->module_core,
68554- mod->core_text_size,
68555- mod->core_ro_size,
68556- mod->core_size);
68557+ set_section_ro_nx(mod->module_core_rx,
68558+ mod->core_size_rx,
68559+ mod->core_size_rx,
68560+ mod->core_size_rx);
68561
68562 /* Set RO and NX regions for init */
68563- set_section_ro_nx(mod->module_init,
68564- mod->init_text_size,
68565- mod->init_ro_size,
68566- mod->init_size);
68567+ set_section_ro_nx(mod->module_init_rx,
68568+ mod->init_size_rx,
68569+ mod->init_size_rx,
68570+ mod->init_size_rx);
68571
68572 do_mod_ctors(mod);
68573 /* Start the module */
8308f9c9 68574@@ -2931,11 +3047,13 @@ SYSCALL_DEFINE3(init_module, void __user
ae4e228f
MT		 68575 mod->symtab = mod->core_symtab;
68576 mod->strtab = mod->core_strtab;
68577 #endif
16454cff 68578- unset_section_ro_nx(mod, mod->module_init);
58c5fc13
MT		 68579- module_free(mod, mod->module_init);
68580- mod->module_init = NULL;
68581- mod->init_size = 0;
68582- mod->init_text_size = 0;
16454cff 68583+ unset_section_ro_nx(mod, mod->module_init_rx);
58c5fc13
MT		 68584+ module_free(mod, mod->module_init_rw);
68585+ module_free_exec(mod, mod->module_init_rx);
68586+ mod->module_init_rw = NULL;
68587+ mod->module_init_rx = NULL;
68588+ mod->init_size_rw = 0;
68589+ mod->init_size_rx = 0;
68590 mutex_unlock(&module_mutex);
68591
68592 return 0;
8308f9c9 68593@@ -2966,10 +3084,16 @@ static const char *get_ksymbol(struct mo
58c5fc13
MT		 68594 unsigned long nextval;
68595
68596 /* At worse, next value is at end of module */
68597- if (within_module_init(addr, mod))
68598- nextval = (unsigned long)mod->module_init+mod->init_text_size;
68599+ if (within_module_init_rx(addr, mod))
68600+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68601+ else if (within_module_init_rw(addr, mod))
68602+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68603+ else if (within_module_core_rx(addr, mod))
68604+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68605+ else if (within_module_core_rw(addr, mod))
68606+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68607 else
68608- nextval = (unsigned long)mod->module_core+mod->core_text_size;
68609+ return NULL;
68610
66a7e928 68611 /* Scan for closest preceding symbol, and next symbol. (ELF
58c5fc13 68612 starts real symbols at 1). */
8308f9c9 68613@@ -3215,7 +3339,7 @@ static int m_show(struct seq_file *m, vo
58c5fc13
MT		 68614 char buf[8];
68615
68616 seq_printf(m, "%s %u",
68617- mod->name, mod->init_size + mod->core_size);
68618+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68619 print_unload_info(m, mod);
68620
68621 /* Informative for users. */
8308f9c9 68622@@ -3224,7 +3348,7 @@ static int m_show(struct seq_file *m, vo
58c5fc13
MT		 68623 mod->state == MODULE_STATE_COMING ? "Loading":
68624 "Live");
68625 /* Used by oprofile and other similar tools. */
66a7e928
MT		 68626- seq_printf(m, " 0x%pK", mod->module_core);
68627+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
58c5fc13
MT		 68628
68629 /* Taints info */
68630 if (mod->taints)
8308f9c9 68631@@ -3260,7 +3384,17 @@ static const struct file_operations proc
58c5fc13
MT		 68632
68633 static int __init proc_modules_init(void)
68634 {
68635+#ifndef CONFIG_GRKERNSEC_HIDESYM
68636+#ifdef CONFIG_GRKERNSEC_PROC_USER
68637+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68638+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68639+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68640+#else
68641 proc_create("modules", 0, NULL, &proc_modules_operations);
68642+#endif
68643+#else
68644+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68645+#endif
68646 return 0;
68647 }
68648 module_init(proc_modules_init);
8308f9c9 68649@@ -3319,12 +3453,12 @@ struct module *__module_address(unsigned
58c5fc13
MT		 68650 {
68651 struct module *mod;
68652
68653- if (addr < module_addr_min || addr > module_addr_max)
68654+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68655+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
68656 return NULL;
68657
68658 list_for_each_entry_rcu(mod, &modules, list)
68659- if (within_module_core(addr, mod)
68660- || within_module_init(addr, mod))
68661+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
68662 return mod;
68663 return NULL;
68664 }
8308f9c9 68665@@ -3358,11 +3492,20 @@ bool is_module_text_address(unsigned lon
58c5fc13
MT		 68666 */
68667 struct module *__module_text_address(unsigned long addr)
68668 {
68669- struct module *mod = __module_address(addr);
68670+ struct module *mod;
68671+
68672+#ifdef CONFIG_X86_32
68673+ addr = ktla_ktva(addr);
68674+#endif
68675+
68676+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68677+ return NULL;
68678+
68679+ mod = __module_address(addr);
68680+
68681 if (mod) {
68682 /* Make sure it's within the text section. */
68683- if (!within(addr, mod->module_init, mod->init_text_size)
68684- && !within(addr, mod->module_core, mod->core_text_size))
68685+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68686 mod = NULL;
68687 }
68688 return mod;
66a7e928
MT		 68689diff -urNp linux-2.6.39/kernel/mutex.c linux-2.6.39/kernel/mutex.c
68690--- linux-2.6.39/kernel/mutex.c 2011-05-19 00:06:34.000000000 -0400
68691+++ linux-2.6.39/kernel/mutex.c 2011-05-22 19:36:33.000000000 -0400
71d190be
MT		 68692@@ -160,7 +160,7 @@ __mutex_lock_common(struct mutex *lock,
68693 */
68694
68695 for (;;) {
68696- struct thread_info *owner;
68697+ struct task_struct *owner;
68698
68699 /*
68700 * If we own the BKL, then don't spin. The owner of
68701@@ -205,7 +205,7 @@ __mutex_lock_common(struct mutex *lock,
68702 spin_lock_mutex(&lock->wait_lock, flags);
68703
68704 debug_mutex_lock_common(lock, &waiter);
68705- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68706+ debug_mutex_add_waiter(lock, &waiter, task);
68707
68708 /* add waiting tasks to the end of the waitqueue (FIFO): */
68709 list_add_tail(&waiter.list, &lock->wait_list);
68710@@ -234,8 +234,7 @@ __mutex_lock_common(struct mutex *lock,
68711 * TASK_UNINTERRUPTIBLE case.)
68712 */
68713 if (unlikely(signal_pending_state(state, task))) {
68714- mutex_remove_waiter(lock, &waiter,
68715- task_thread_info(task));
68716+ mutex_remove_waiter(lock, &waiter, task);
68717 mutex_release(&lock->dep_map, 1, ip);
68718 spin_unlock_mutex(&lock->wait_lock, flags);
68719
68720@@ -256,7 +255,7 @@ __mutex_lock_common(struct mutex *lock,
68721 done:
68722 lock_acquired(&lock->dep_map, ip);
68723 /* got the lock - rejoice! */
68724- mutex_remove_waiter(lock, &waiter, current_thread_info());
66a7e928 68725+ mutex_remove_waiter(lock, &waiter, task);
71d190be
MT		 68726 mutex_set_owner(lock);
68727
68728 /* set it to 0 if there are no waiters left: */
66a7e928
MT		 68729diff -urNp linux-2.6.39/kernel/mutex-debug.c linux-2.6.39/kernel/mutex-debug.c
68730--- linux-2.6.39/kernel/mutex-debug.c 2011-05-19 00:06:34.000000000 -0400
68731+++ linux-2.6.39/kernel/mutex-debug.c 2011-05-22 19:36:33.000000000 -0400
71d190be
MT		 68732@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
68733 }
68734
68735 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68736- struct thread_info *ti)
68737+ struct task_struct *task)
68738 {
68739 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68740
68741 /* Mark the current thread as blocked on the lock: */
68742- ti->task->blocked_on = waiter;
68743+ task->blocked_on = waiter;
68744 }
68745
68746 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68747- struct thread_info *ti)
68748+ struct task_struct *task)
68749 {
68750 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68751- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68752- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68753- ti->task->blocked_on = NULL;
68754+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
66a7e928 68755+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
71d190be
MT		 68756+ task->blocked_on = NULL;
68757
68758 list_del_init(&waiter->list);
68759 waiter->task = NULL;
68760@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
68761 return;
68762
68763 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
68764- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
68765+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
68766 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
68767 mutex_clear_owner(lock);
68768 }
66a7e928
MT		 68769diff -urNp linux-2.6.39/kernel/mutex-debug.h linux-2.6.39/kernel/mutex-debug.h
68770--- linux-2.6.39/kernel/mutex-debug.h 2011-05-19 00:06:34.000000000 -0400
68771+++ linux-2.6.39/kernel/mutex-debug.h 2011-05-22 19:36:33.000000000 -0400
71d190be
MT		 68772@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
68773 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68774 extern void debug_mutex_add_waiter(struct mutex *lock,
68775 struct mutex_waiter *waiter,
68776- struct thread_info *ti);
68777+ struct task_struct *task);
68778 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68779- struct thread_info *ti);
68780+ struct task_struct *task);
68781 extern void debug_mutex_unlock(struct mutex *lock);
68782 extern void debug_mutex_init(struct mutex *lock, const char *name,
68783 struct lock_class_key *key);
68784
68785 static inline void mutex_set_owner(struct mutex *lock)
68786 {
68787- lock->owner = current_thread_info();
68788+ lock->owner = current;
68789 }
68790
68791 static inline void mutex_clear_owner(struct mutex *lock)
66a7e928
MT		 68792diff -urNp linux-2.6.39/kernel/mutex.h linux-2.6.39/kernel/mutex.h
68793--- linux-2.6.39/kernel/mutex.h 2011-05-19 00:06:34.000000000 -0400
68794+++ linux-2.6.39/kernel/mutex.h 2011-05-22 19:36:33.000000000 -0400
71d190be
MT		 68795@@ -19,7 +19,7 @@
68796 #ifdef CONFIG_SMP
68797 static inline void mutex_set_owner(struct mutex *lock)
68798 {
68799- lock->owner = current_thread_info();
68800+ lock->owner = current;
68801 }
68802
68803 static inline void mutex_clear_owner(struct mutex *lock)
66a7e928
MT		 68804diff -urNp linux-2.6.39/kernel/padata.c linux-2.6.39/kernel/padata.c
68805--- linux-2.6.39/kernel/padata.c 2011-05-19 00:06:34.000000000 -0400
68806+++ linux-2.6.39/kernel/padata.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 68807@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
68808 padata->pd = pd;
68809 padata->cb_cpu = cb_cpu;
68810
68811- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
68812- atomic_set(&pd->seq_nr, -1);
68813+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
68814+ atomic_set_unchecked(&pd->seq_nr, -1);
68815
68816- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
68817+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
68818
68819 target_cpu = padata_cpu_hash(padata);
68820 queue = per_cpu_ptr(pd->pqueue, target_cpu);
68821@@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
68822 padata_init_pqueues(pd);
68823 padata_init_squeues(pd);
68824 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
68825- atomic_set(&pd->seq_nr, -1);
68826+ atomic_set_unchecked(&pd->seq_nr, -1);
68827 atomic_set(&pd->reorder_objects, 0);
68828 atomic_set(&pd->refcnt, 0);
68829 pd->pinst = pinst;
66a7e928
MT		 68830diff -urNp linux-2.6.39/kernel/panic.c linux-2.6.39/kernel/panic.c
68831--- linux-2.6.39/kernel/panic.c 2011-05-19 00:06:34.000000000 -0400
68832+++ linux-2.6.39/kernel/panic.c 2011-05-22 19:41:42.000000000 -0400
16454cff 68833@@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
bc901d79
MT		 68834 const char *board;
68835
68836 printk(KERN_WARNING "------------[ cut here ]------------\n");
68837- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
68838+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
68839 board = dmi_get_system_info(DMI_PRODUCT_NAME);
68840 if (board)
68841 printk(KERN_WARNING "Hardware name: %s\n", board);
16454cff 68842@@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
58c5fc13
MT		 68843 */
68844 void __stack_chk_fail(void)
68845 {
68846- panic("stack-protector: Kernel stack is corrupted in: %p\n",
68847+ dump_stack();
bc901d79 68848+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
58c5fc13
MT		 68849 __builtin_return_address(0));
68850 }
68851 EXPORT_SYMBOL(__stack_chk_fail);
66a7e928
MT		 68852diff -urNp linux-2.6.39/kernel/params.c linux-2.6.39/kernel/params.c
68853--- linux-2.6.39/kernel/params.c 2011-05-19 00:06:34.000000000 -0400
68854+++ linux-2.6.39/kernel/params.c 2011-05-22 19:36:33.000000000 -0400
68855@@ -234,7 +234,7 @@ int parse_args(const char *name,
68856 { \
68857 return sprintf(buffer, format, *((type *)kp->arg)); \
68858 } \
68859- struct kernel_param_ops param_ops_##name = { \
68860+ const struct kernel_param_ops param_ops_##name = { \
68861 .set = param_set_##name, \
68862 .get = param_get_##name, \
68863 }; \
68864@@ -286,7 +286,7 @@ static void param_free_charp(void *arg)
68865 maybe_kfree_parameter(*((char **)arg));
68866 }
68867
68868-struct kernel_param_ops param_ops_charp = {
68869+const struct kernel_param_ops param_ops_charp = {
68870 .set = param_set_charp,
68871 .get = param_get_charp,
68872 .free = param_free_charp,
68873@@ -334,7 +334,7 @@ int param_get_bool(char *buffer, const s
68874 }
68875 EXPORT_SYMBOL(param_get_bool);
68876
68877-struct kernel_param_ops param_ops_bool = {
68878+const struct kernel_param_ops param_ops_bool = {
68879 .set = param_set_bool,
68880 .get = param_get_bool,
68881 };
68882@@ -362,7 +362,7 @@ int param_get_invbool(char *buffer, cons
68883 }
68884 EXPORT_SYMBOL(param_get_invbool);
68885
68886-struct kernel_param_ops param_ops_invbool = {
68887+const struct kernel_param_ops param_ops_invbool = {
68888 .set = param_set_invbool,
68889 .get = param_get_invbool,
68890 };
68891@@ -460,7 +460,7 @@ static void param_array_free(void *arg)
68892 arr->ops->free(arr->elem + arr->elemsize * i);
68893 }
68894
68895-struct kernel_param_ops param_array_ops = {
68896+const struct kernel_param_ops param_array_ops = {
68897 .set = param_array_set,
68898 .get = param_array_get,
68899 .free = param_array_free,
68900@@ -488,7 +488,7 @@ int param_get_string(char *buffer, const
68901 }
68902 EXPORT_SYMBOL(param_get_string);
68903
68904-struct kernel_param_ops param_ops_string = {
68905+const struct kernel_param_ops param_ops_string = {
68906 .set = param_set_copystring,
68907 .get = param_get_string,
68908 };
68909diff -urNp linux-2.6.39/kernel/perf_event.c linux-2.6.39/kernel/perf_event.c
68910--- linux-2.6.39/kernel/perf_event.c 2011-05-19 00:06:34.000000000 -0400
68911+++ linux-2.6.39/kernel/perf_event.c 2011-05-22 19:36:33.000000000 -0400
68912@@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
68913 return 0;
68914 }
8308f9c9
MT		 68915
68916-static atomic64_t perf_event_id;
68917+static atomic64_unchecked_t perf_event_id;
68918
68919 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
68920 enum event_type_t event_type);
66a7e928 68921@@ -2496,7 +2496,7 @@ static void __perf_event_read(void *info
8308f9c9
MT		 68922
68923 static inline u64 perf_event_count(struct perf_event *event)
68924 {
68925- return local64_read(&event->count) + atomic64_read(&event->child_count);
68926+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
68927 }
68928
68929 static u64 perf_event_read(struct perf_event *event)
66a7e928 68930@@ -3031,9 +3031,9 @@ u64 perf_event_read_value(struct perf_ev
8308f9c9
MT		 68931 mutex_lock(&event->child_mutex);
68932 total += perf_event_read(event);
68933 *enabled += event->total_time_enabled +
68934- atomic64_read(&event->child_total_time_enabled);
68935+ atomic64_read_unchecked(&event->child_total_time_enabled);
68936 *running += event->total_time_running +
68937- atomic64_read(&event->child_total_time_running);
68938+ atomic64_read_unchecked(&event->child_total_time_running);
68939
68940 list_for_each_entry(child, &event->child_list, child_list) {
68941 total += perf_event_read(child);
66a7e928 68942@@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct p
8308f9c9
MT		 68943 userpg->offset -= local64_read(&event->hw.prev_count);
68944
68945 userpg->time_enabled = event->total_time_enabled +
68946- atomic64_read(&event->child_total_time_enabled);
68947+ atomic64_read_unchecked(&event->child_total_time_enabled);
68948
68949 userpg->time_running = event->total_time_running +
68950- atomic64_read(&event->child_total_time_running);
68951+ atomic64_read_unchecked(&event->child_total_time_running);
68952
68953 barrier();
68954 ++userpg->lock;
66a7e928
MT		 68955@@ -3884,16 +3884,16 @@ static void perf_pending_event(struct ir
68956 * Later on, we might change it to a list if there is
68957 * another virtualization implementation supporting the callbacks.
68958 */
68959-struct perf_guest_info_callbacks *perf_guest_cbs;
68960+const struct perf_guest_info_callbacks *perf_guest_cbs;
68961
68962-int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
68963+int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
68964 {
68965 perf_guest_cbs = cbs;
68966 return 0;
68967 }
68968 EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks);
68969
68970-int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
68971+int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
68972 {
68973 perf_guest_cbs = NULL;
68974 return 0;
68975@@ -4196,11 +4196,11 @@ static void perf_output_read_one(struct
8308f9c9
MT		 68976 values[n++] = perf_event_count(event);
68977 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
68978 values[n++] = enabled +
68979- atomic64_read(&event->child_total_time_enabled);
68980+ atomic64_read_unchecked(&event->child_total_time_enabled);
68981 }
68982 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
68983 values[n++] = running +
68984- atomic64_read(&event->child_total_time_running);
68985+ atomic64_read_unchecked(&event->child_total_time_running);
68986 }
68987 if (read_format & PERF_FORMAT_ID)
68988 values[n++] = primary_event_id(event);
66a7e928 68989@@ -6201,7 +6201,7 @@ perf_event_alloc(struct perf_event_attr
8308f9c9
MT		 68990 event->parent = parent_event;
68991
68992 event->ns = get_pid_ns(current->nsproxy->pid_ns);
68993- event->id = atomic64_inc_return(&perf_event_id);
68994+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
68995
68996 event->state = PERF_EVENT_STATE_INACTIVE;
68997
66a7e928 68998@@ -6724,10 +6724,10 @@ static void sync_child_event(struct perf
8308f9c9
MT		 68999 /*
69000 * Add back the child's count to the parent's count:
69001 */
69002- atomic64_add(child_val, &parent_event->child_count);
69003- atomic64_add(child_event->total_time_enabled,
69004+ atomic64_add_unchecked(child_val, &parent_event->child_count);
69005+ atomic64_add_unchecked(child_event->total_time_enabled,
69006 &parent_event->child_total_time_enabled);
69007- atomic64_add(child_event->total_time_running,
69008+ atomic64_add_unchecked(child_event->total_time_running,
69009 &parent_event->child_total_time_running);
69010
69011 /*
66a7e928
MT		 69012diff -urNp linux-2.6.39/kernel/pid.c linux-2.6.39/kernel/pid.c
69013--- linux-2.6.39/kernel/pid.c 2011-05-19 00:06:34.000000000 -0400
69014+++ linux-2.6.39/kernel/pid.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 69015@@ -33,6 +33,7 @@
69016 #include <linux/rculist.h>
69017 #include <linux/bootmem.h>
69018 #include <linux/hash.h>
69019+#include <linux/security.h>
69020 #include <linux/pid_namespace.h>
69021 #include <linux/init_task.h>
69022 #include <linux/syscalls.h>
69023@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
69024
69025 int pid_max = PID_MAX_DEFAULT;
69026
69027-#define RESERVED_PIDS 300
69028+#define RESERVED_PIDS 500
69029
69030 int pid_max_min = RESERVED_PIDS + 1;
69031 int pid_max_max = PID_MAX_LIMIT;
71d190be 69032@@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
58c5fc13
MT		 69033 */
69034 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
69035 {
58c5fc13 69036+ struct task_struct *task;
bc901d79
MT		 69037+
69038 rcu_lockdep_assert(rcu_read_lock_held());
69039- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
58c5fc13
MT		 69040+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69041+
69042+ if (gr_pid_is_chrooted(task))
69043+ return NULL;
69044+
69045+ return task;
69046 }
69047
69048 struct task_struct *find_task_by_vpid(pid_t vnr)
66a7e928
MT		 69049diff -urNp linux-2.6.39/kernel/posix-cpu-timers.c linux-2.6.39/kernel/posix-cpu-timers.c
69050--- linux-2.6.39/kernel/posix-cpu-timers.c 2011-05-19 00:06:34.000000000 -0400
69051+++ linux-2.6.39/kernel/posix-cpu-timers.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 69052@@ -6,6 +6,7 @@
69053 #include <linux/posix-timers.h>
69054 #include <linux/errno.h>
69055 #include <linux/math64.h>
69056+#include <linux/security.h>
69057 #include <asm/uaccess.h>
69058 #include <linux/kernel_stat.h>
ae4e228f 69059 #include <trace/events/timer.h>
66a7e928
MT		 69060@@ -1590,7 +1591,7 @@ static int thread_cpu_timer_create(struc
69061 return posix_cpu_timer_create(timer);
69062 }
69063
69064-struct k_clock clock_posix_cpu = {
69065+const struct k_clock clock_posix_cpu = {
69066 .clock_getres = posix_cpu_clock_getres,
69067 .clock_set = posix_cpu_clock_set,
69068 .clock_get = posix_cpu_clock_get,
69069@@ -1604,14 +1605,14 @@ struct k_clock clock_posix_cpu = {
69070
69071 static __init int init_posix_cpu_timers(void)
69072 {
69073- struct k_clock process = {
69074+ const struct k_clock process = {
69075 .clock_getres = process_cpu_clock_getres,
69076 .clock_get = process_cpu_clock_get,
69077 .timer_create = process_cpu_timer_create,
69078 .nsleep = process_cpu_nsleep,
69079 .nsleep_restart = process_cpu_nsleep_restart,
69080 };
69081- struct k_clock thread = {
69082+ const struct k_clock thread = {
69083 .clock_getres = thread_cpu_clock_getres,
69084 .clock_get = thread_cpu_clock_get,
69085 .timer_create = thread_cpu_timer_create,
69086diff -urNp linux-2.6.39/kernel/posix-timers.c linux-2.6.39/kernel/posix-timers.c
69087--- linux-2.6.39/kernel/posix-timers.c 2011-05-19 00:06:34.000000000 -0400
69088+++ linux-2.6.39/kernel/posix-timers.c 2011-05-22 20:13:41.000000000 -0400
69089@@ -43,6 +43,7 @@
bc901d79 69090 #include <linux/idr.h>
66a7e928 69091 #include <linux/posix-clock.h>
bc901d79
MT		 69092 #include <linux/posix-timers.h>
69093+#include <linux/grsecurity.h>
69094 #include <linux/syscalls.h>
69095 #include <linux/wait.h>
69096 #include <linux/workqueue.h>
66a7e928
MT		 69097@@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
69098 */
69099 static __init int init_posix_timers(void)
69100 {
69101- struct k_clock clock_realtime = {
69102+ const struct k_clock clock_realtime = {
69103 .clock_getres = hrtimer_get_res,
69104 .clock_get = posix_clock_realtime_get,
69105 .clock_set = posix_clock_realtime_set,
69106@@ -239,7 +240,7 @@ static __init int init_posix_timers(void
69107 .timer_get = common_timer_get,
69108 .timer_del = common_timer_del,
69109 };
69110- struct k_clock clock_monotonic = {
69111+ const struct k_clock clock_monotonic = {
69112 .clock_getres = hrtimer_get_res,
69113 .clock_get = posix_ktime_get_ts,
69114 .nsleep = common_nsleep,
69115@@ -249,19 +250,19 @@ static __init int init_posix_timers(void
69116 .timer_get = common_timer_get,
69117 .timer_del = common_timer_del,
69118 };
69119- struct k_clock clock_monotonic_raw = {
69120+ const struct k_clock clock_monotonic_raw = {
69121 .clock_getres = hrtimer_get_res,
69122 .clock_get = posix_get_monotonic_raw,
69123 };
69124- struct k_clock clock_realtime_coarse = {
69125+ const struct k_clock clock_realtime_coarse = {
69126 .clock_getres = posix_get_coarse_res,
69127 .clock_get = posix_get_realtime_coarse,
69128 };
69129- struct k_clock clock_monotonic_coarse = {
69130+ const struct k_clock clock_monotonic_coarse = {
69131 .clock_getres = posix_get_coarse_res,
69132 .clock_get = posix_get_monotonic_coarse,
69133 };
69134- struct k_clock clock_boottime = {
69135+ const struct k_clock clock_boottime = {
69136 .clock_getres = hrtimer_get_res,
69137 .clock_get = posix_get_boottime,
69138 .nsleep = common_nsleep,
69139@@ -272,6 +273,8 @@ static __init int init_posix_timers(void
69140 .timer_del = common_timer_del,
69141 };
69142
69143+ pax_track_stack();
69144+
69145 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
69146 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
69147 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
69148@@ -454,7 +457,7 @@ static struct pid *good_sigevent(sigeven
69149 }
69150
69151 void posix_timers_register_clock(const clockid_t clock_id,
69152- struct k_clock *new_clock)
69153+ const struct k_clock *new_clock)
69154 {
69155 if ((unsigned) clock_id >= MAX_CLOCKS) {
69156 printk(KERN_WARNING "POSIX clock register failed for clock_id %d\n",
69157@@ -506,7 +509,7 @@ static void release_posix_timer(struct k
69158 kmem_cache_free(posix_timers_cache, tmr);
69159 }
69160
69161-static struct k_clock *clockid_to_kclock(const clockid_t id)
69162+static const struct k_clock *clockid_to_kclock(const clockid_t id)
69163 {
69164 if (id < 0)
69165 return (id & CLOCKFD_MASK) == CLOCKFD ?
69166@@ -529,7 +532,7 @@ SYSCALL_DEFINE3(timer_create, const cloc
69167 struct sigevent __user *, timer_event_spec,
69168 timer_t __user *, created_timer_id)
69169 {
69170- struct k_clock *kc = clockid_to_kclock(which_clock);
69171+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69172 struct k_itimer *new_timer;
69173 int error, new_timer_id;
69174 sigevent_t event;
69175@@ -714,7 +717,7 @@ SYSCALL_DEFINE2(timer_gettime, timer_t,
69176 {
69177 struct itimerspec cur_setting;
69178 struct k_itimer *timr;
69179- struct k_clock *kc;
69180+ const struct k_clock *kc;
69181 unsigned long flags;
69182 int ret = 0;
69183
69184@@ -822,7 +825,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
69185 int error = 0;
69186 unsigned long flag;
69187 struct itimerspec *rtn = old_setting ? &old_spec : NULL;
69188- struct k_clock *kc;
69189+ const struct k_clock *kc;
69190
69191 if (!new_setting)
69192 return -EINVAL;
69193@@ -868,7 +871,7 @@ static int common_timer_del(struct k_iti
69194
69195 static inline int timer_delete_hook(struct k_itimer *timer)
69196 {
69197- struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69198+ const struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69199
69200 if (WARN_ON_ONCE(!kc || !kc->timer_del))
69201 return -EINVAL;
69202@@ -947,7 +950,7 @@ void exit_itimers(struct signal_struct *
69203 SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
69204 const struct timespec __user *, tp)
69205 {
69206- struct k_clock *kc = clockid_to_kclock(which_clock);
69207+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69208 struct timespec new_tp;
69209
69210 if (!kc || !kc->clock_set)
69211@@ -956,13 +959,20 @@ SYSCALL_DEFINE2(clock_settime, const clo
bc901d79
MT		 69212 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
69213 return -EFAULT;
df50ba0c 69214
bc901d79
MT		 69215+ /* only the CLOCK_REALTIME clock can be set, all other clocks
69216+ have their clock_set fptr set to a nosettime dummy function
69217+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
69218+ call common_clock_set, which calls do_sys_settimeofday, which
69219+ we hook
69220+ */
69221+
66a7e928 69222 return kc->clock_set(which_clock, &new_tp);
bc901d79
MT		 69223 }
69224
66a7e928
MT		 69225 SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
69226 struct timespec __user *,tp)
69227 {
69228- struct k_clock *kc = clockid_to_kclock(which_clock);
69229+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69230 struct timespec kernel_tp;
69231 int error;
69232
69233@@ -980,7 +990,7 @@ SYSCALL_DEFINE2(clock_gettime, const clo
69234 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
69235 struct timex __user *, utx)
69236 {
69237- struct k_clock *kc = clockid_to_kclock(which_clock);
69238+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69239 struct timex ktx;
69240 int err;
69241
69242@@ -1003,7 +1013,7 @@ SYSCALL_DEFINE2(clock_adjtime, const clo
69243 SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
69244 struct timespec __user *, tp)
69245 {
69246- struct k_clock *kc = clockid_to_kclock(which_clock);
69247+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69248 struct timespec rtn_tp;
69249 int error;
69250
69251@@ -1033,7 +1043,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69252 const struct timespec __user *, rqtp,
69253 struct timespec __user *, rmtp)
69254 {
69255- struct k_clock *kc = clockid_to_kclock(which_clock);
69256+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69257 struct timespec t;
69258
69259 if (!kc)
69260@@ -1057,7 +1067,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69261 long clock_nanosleep_restart(struct restart_block *restart_block)
69262 {
69263 clockid_t which_clock = restart_block->nanosleep.index;
69264- struct k_clock *kc = clockid_to_kclock(which_clock);
69265+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69266
69267 if (WARN_ON_ONCE(!kc || !kc->nsleep_restart))
69268 return -EINVAL;
69269diff -urNp linux-2.6.39/kernel/power/poweroff.c linux-2.6.39/kernel/power/poweroff.c
69270--- linux-2.6.39/kernel/power/poweroff.c 2011-05-19 00:06:34.000000000 -0400
69271+++ linux-2.6.39/kernel/power/poweroff.c 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 69272@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
69273 .enable_mask = SYSRQ_ENABLE_BOOT,
69274 };
69275
69276-static int pm_sysrq_init(void)
69277+static int __init pm_sysrq_init(void)
69278 {
69279 register_sysrq_key('o', &sysrq_poweroff_op);
69280 return 0;
66a7e928
MT		 69281diff -urNp linux-2.6.39/kernel/power/process.c linux-2.6.39/kernel/power/process.c
69282--- linux-2.6.39/kernel/power/process.c 2011-05-19 00:06:34.000000000 -0400
69283+++ linux-2.6.39/kernel/power/process.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 69284@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
58c5fc13
MT		 69285 u64 elapsed_csecs64;
69286 unsigned int elapsed_csecs;
bc901d79 69287 bool wakeup = false;
58c5fc13
MT		 69288+ bool timedout = false;
69289
69290 do_gettimeofday(&start);
69291
bc901d79 69292@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
6892158b 69293
ae4e228f 69294 while (true) {
58c5fc13
MT		 69295 todo = 0;
69296+ if (time_after(jiffies, end_time))
69297+ timedout = true;
69298 read_lock(&tasklist_lock);
69299 do_each_thread(g, p) {
16454cff
MT		 69300 if (frozen(p) || !freezable(p))
69301@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
69302 * try_to_stop() after schedule() in ptrace/signal
69303 * stop sees TIF_FREEZE.
58c5fc13
MT		 69304 */
69305- if (!task_is_stopped_or_traced(p) &&
69306- !freezer_should_skip(p))
69307+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
69308 todo++;
69309+ if (timedout) {
69310+ printk(KERN_ERR "Task refusing to freeze:\n");
69311+ sched_show_task(p);
69312+ }
69313+ }
69314 } while_each_thread(g, p);
69315 read_unlock(&tasklist_lock);
6892158b 69316
16454cff 69317@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
6892158b
MT		 69318 todo += wq_busy;
69319 }
69320
ae4e228f
MT		 69321- if (!todo || time_after(jiffies, end_time))
69322+ if (!todo || timedout)
69323 break;
69324
16454cff 69325 if (pm_wakeup_pending()) {
66a7e928
MT		 69326diff -urNp linux-2.6.39/kernel/printk.c linux-2.6.39/kernel/printk.c
69327--- linux-2.6.39/kernel/printk.c 2011-05-19 00:06:34.000000000 -0400
69328+++ linux-2.6.39/kernel/printk.c 2011-05-22 19:41:42.000000000 -0400
69329@@ -284,12 +284,17 @@ static int check_syslog_permissions(int
16454cff
MT		 69330 if (from_file && type != SYSLOG_ACTION_OPEN)
69331 return 0;
58c5fc13
MT		 69332
69333+#ifdef CONFIG_GRKERNSEC_DMESG
16454cff 69334+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
58c5fc13
MT		 69335+ return -EPERM;
69336+#endif
69337+
16454cff
MT		 69338 if (syslog_action_restricted(type)) {
69339 if (capable(CAP_SYSLOG))
69340 return 0;
69341 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
69342 if (capable(CAP_SYS_ADMIN)) {
69343- WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
69344+ printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
69345 "but no CAP_SYSLOG (deprecated).\n");
69346 return 0;
69347 }
66a7e928
MT		 69348diff -urNp linux-2.6.39/kernel/profile.c linux-2.6.39/kernel/profile.c
69349--- linux-2.6.39/kernel/profile.c 2011-05-19 00:06:34.000000000 -0400
69350+++ linux-2.6.39/kernel/profile.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 69351@@ -39,7 +39,7 @@ struct profile_hit {
69352 /* Oprofile timer tick hook */
69353 static int (*timer_hook)(struct pt_regs *) __read_mostly;
69354
69355-static atomic_t *prof_buffer;
69356+static atomic_unchecked_t *prof_buffer;
69357 static unsigned long prof_len, prof_shift;
69358
69359 int prof_on __read_mostly;
69360@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
69361 hits[i].pc = 0;
69362 continue;
69363 }
69364- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69365+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69366 hits[i].hits = hits[i].pc = 0;
69367 }
69368 }
69369@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
69370 * Add the current hit(s) and flush the write-queue out
69371 * to the global buffer:
69372 */
69373- atomic_add(nr_hits, &prof_buffer[pc]);
69374+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
69375 for (i = 0; i < NR_PROFILE_HIT; ++i) {
69376- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69377+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69378 hits[i].pc = hits[i].hits = 0;
69379 }
69380 out:
69381@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
69382 if (prof_on != type || !prof_buffer)
69383 return;
69384 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
69385- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69386+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69387 }
69388 #endif /* !CONFIG_SMP */
69389 EXPORT_SYMBOL_GPL(profile_hits);
69390@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
69391 return -EFAULT;
69392 buf++; p++; count--; read++;
69393 }
69394- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
69395+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
69396 if (copy_to_user(buf, (void *)pnt, count))
69397 return -EFAULT;
69398 read += count;
69399@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
69400 }
69401 #endif
69402 profile_discard_flip_buffers();
69403- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
69404+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
69405 return count;
69406 }
69407
66a7e928
MT		 69408diff -urNp linux-2.6.39/kernel/ptrace.c linux-2.6.39/kernel/ptrace.c
69409--- linux-2.6.39/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
69410+++ linux-2.6.39/kernel/ptrace.c 2011-05-23 17:07:00.000000000 -0400
69411@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
16454cff
MT		 69412 return ret;
69413 }
69414
69415-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
69416+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
69417+ unsigned int log)
69418 {
69419 const struct cred *cred = current_cred(), *tcred;
69420
66a7e928
MT		 69421@@ -143,7 +144,8 @@ int __ptrace_may_access(struct task_stru
69422 cred->gid == tcred->sgid &&
69423 cred->gid == tcred->gid))
69424 goto ok;
69425- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
69426+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
69427+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
69428 goto ok;
69429 rcu_read_unlock();
69430 return -EPERM;
69431@@ -152,7 +154,9 @@ ok:
58c5fc13
MT		 69432 smp_rmb();
69433 if (task->mm)
69434 dumpable = get_dumpable(task->mm);
66a7e928 69435- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
16454cff 69436+ if (!dumpable &&
66a7e928
MT		 69437+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
69438+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
58c5fc13
MT		 69439 return -EPERM;
69440
ae4e228f 69441 return security_ptrace_access_check(task, mode);
66a7e928 69442@@ -162,7 +166,16 @@ bool ptrace_may_access(struct task_struc
16454cff
MT		 69443 {
69444 int err;
69445 task_lock(task);
69446- err = __ptrace_may_access(task, mode);
69447+ err = __ptrace_may_access(task, mode, 0);
69448+ task_unlock(task);
69449+ return !err;
69450+}
69451+
69452+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
69453+{
69454+ int err;
69455+ task_lock(task);
69456+ err = __ptrace_may_access(task, mode, 1);
69457 task_unlock(task);
69458 return !err;
69459 }
66a7e928 69460@@ -189,7 +202,7 @@ static int ptrace_attach(struct task_str
16454cff
MT		 69461 goto out;
69462
69463 task_lock(task);
69464- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
69465+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
69466 task_unlock(task);
69467 if (retval)
69468 goto unlock_creds;
66a7e928 69469@@ -202,7 +215,7 @@ static int ptrace_attach(struct task_str
58c5fc13
MT		 69470 goto unlock_tasklist;
69471
69472 task->ptrace = PT_PTRACED;
66a7e928
MT		 69473- if (task_ns_capable(task, CAP_SYS_PTRACE))
69474+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
58c5fc13
MT		 69475 task->ptrace |= PT_PTRACE_CAP;
69476
69477 __ptrace_link(task, current);
66a7e928
MT		 69478@@ -362,6 +375,8 @@ int ptrace_readdata(struct task_struct *
69479 {
69480 int copied = 0;
69481
69482+ pax_track_stack();
69483+
69484 while (len > 0) {
69485 char buf[128];
69486 int this_len, retval;
69487@@ -373,7 +388,7 @@ int ptrace_readdata(struct task_struct *
ae4e228f
MT		 69488 break;
69489 return -EIO;
69490 }
69491- if (copy_to_user(dst, buf, retval))
69492+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
69493 return -EFAULT;
69494 copied += retval;
69495 src += retval;
66a7e928
MT		 69496@@ -387,6 +402,8 @@ int ptrace_writedata(struct task_struct
69497 {
69498 int copied = 0;
69499
69500+ pax_track_stack();
69501+
69502 while (len > 0) {
69503 char buf[128];
69504 int this_len, retval;
69505@@ -569,9 +586,11 @@ int ptrace_request(struct task_struct *c
bc901d79
MT		 69506 {
69507 int ret = -EIO;
69508 siginfo_t siginfo;
69509- void __user *datavp = (void __user *) data;
69510+ void __user *datavp = (__force void __user *) data;
69511 unsigned long __user *datalp = datavp;
ae4e228f 69512
66a7e928
MT		 69513+ pax_track_stack();
69514+
bc901d79 69515 switch (request) {
66a7e928
MT		 69516 case PTRACE_PEEKTEXT:
69517 case PTRACE_PEEKDATA:
69518@@ -717,14 +736,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
ae4e228f
MT		 69519 goto out;
69520 }
58c5fc13
MT		 69521
69522+ if (gr_handle_ptrace(child, request)) {
69523+ ret = -EPERM;
69524+ goto out_put_task_struct;
69525+ }
69526+
ae4e228f
MT		 69527 if (request == PTRACE_ATTACH) {
69528 ret = ptrace_attach(child);
69529 /*
69530 * Some architectures need to do book-keeping after
69531 * a ptrace attach.
69532 */
69533- if (!ret)
69534+ if (!ret) {
69535 arch_ptrace_attach(child);
69536+ gr_audit_ptrace(child);
69537+ }
69538 goto out_put_task_struct;
69539 }
58c5fc13 69540
66a7e928 69541@@ -749,7 +775,7 @@ int generic_ptrace_peekdata(struct task_
ae4e228f
MT		 69542 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
69543 if (copied != sizeof(tmp))
69544 return -EIO;
69545- return put_user(tmp, (unsigned long __user *)data);
69546+ return put_user(tmp, (__force unsigned long __user *)data);
58c5fc13
MT		 69547 }
69548
bc901d79 69549 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
66a7e928
MT		 69550@@ -772,6 +798,8 @@ int compat_ptrace_request(struct task_st
69551 siginfo_t siginfo;
69552 int ret;
69553
69554+ pax_track_stack();
69555+
69556 switch (request) {
69557 case PTRACE_PEEKTEXT:
69558 case PTRACE_PEEKDATA:
69559@@ -859,14 +887,21 @@ asmlinkage long compat_sys_ptrace(compat
bc901d79
MT		 69560 goto out;
69561 }
69562
69563+ if (gr_handle_ptrace(child, request)) {
69564+ ret = -EPERM;
69565+ goto out_put_task_struct;
69566+ }
69567+
69568 if (request == PTRACE_ATTACH) {
69569 ret = ptrace_attach(child);
69570 /*
69571 * Some architectures need to do book-keeping after
69572 * a ptrace attach.
69573 */
69574- if (!ret)
69575+ if (!ret) {
69576 arch_ptrace_attach(child);
69577+ gr_audit_ptrace(child);
69578+ }
69579 goto out_put_task_struct;
69580 }
69581
66a7e928
MT		 69582diff -urNp linux-2.6.39/kernel/rcutorture.c linux-2.6.39/kernel/rcutorture.c
69583--- linux-2.6.39/kernel/rcutorture.c 2011-05-19 00:06:34.000000000 -0400
69584+++ linux-2.6.39/kernel/rcutorture.c 2011-05-22 19:36:33.000000000 -0400
69585@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
8308f9c9
MT		 69586 { 0 };
69587 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
69588 { 0 };
69589-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69590-static atomic_t n_rcu_torture_alloc;
69591-static atomic_t n_rcu_torture_alloc_fail;
69592-static atomic_t n_rcu_torture_free;
69593-static atomic_t n_rcu_torture_mberror;
69594-static atomic_t n_rcu_torture_error;
69595+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69596+static atomic_unchecked_t n_rcu_torture_alloc;
69597+static atomic_unchecked_t n_rcu_torture_alloc_fail;
69598+static atomic_unchecked_t n_rcu_torture_free;
69599+static atomic_unchecked_t n_rcu_torture_mberror;
69600+static atomic_unchecked_t n_rcu_torture_error;
69601 static long n_rcu_torture_boost_ktrerror;
69602 static long n_rcu_torture_boost_rterror;
69603 static long n_rcu_torture_boost_allocerror;
66a7e928 69604@@ -225,11 +225,11 @@ rcu_torture_alloc(void)
8308f9c9
MT		 69605
69606 spin_lock_bh(&rcu_torture_lock);
69607 if (list_empty(&rcu_torture_freelist)) {
69608- atomic_inc(&n_rcu_torture_alloc_fail);
69609+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
69610 spin_unlock_bh(&rcu_torture_lock);
69611 return NULL;
69612 }
69613- atomic_inc(&n_rcu_torture_alloc);
69614+ atomic_inc_unchecked(&n_rcu_torture_alloc);
69615 p = rcu_torture_freelist.next;
69616 list_del_init(p);
69617 spin_unlock_bh(&rcu_torture_lock);
66a7e928 69618@@ -242,7 +242,7 @@ rcu_torture_alloc(void)
8308f9c9
MT		 69619 static void
69620 rcu_torture_free(struct rcu_torture *p)
69621 {
69622- atomic_inc(&n_rcu_torture_free);
69623+ atomic_inc_unchecked(&n_rcu_torture_free);
69624 spin_lock_bh(&rcu_torture_lock);
69625 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
69626 spin_unlock_bh(&rcu_torture_lock);
66a7e928 69627@@ -362,7 +362,7 @@ rcu_torture_cb(struct rcu_head *p)
8308f9c9
MT		 69628 i = rp->rtort_pipe_count;
69629 if (i > RCU_TORTURE_PIPE_LEN)
69630 i = RCU_TORTURE_PIPE_LEN;
69631- atomic_inc(&rcu_torture_wcount[i]);
69632+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69633 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69634 rp->rtort_mbtest = 0;
69635 rcu_torture_free(rp);
66a7e928 69636@@ -409,7 +409,7 @@ static void rcu_sync_torture_deferred_fr
8308f9c9
MT		 69637 i = rp->rtort_pipe_count;
69638 if (i > RCU_TORTURE_PIPE_LEN)
69639 i = RCU_TORTURE_PIPE_LEN;
69640- atomic_inc(&rcu_torture_wcount[i]);
69641+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69642 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69643 rp->rtort_mbtest = 0;
69644 list_del(&rp->rtort_free);
66a7e928 69645@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
8308f9c9
MT		 69646 i = old_rp->rtort_pipe_count;
69647 if (i > RCU_TORTURE_PIPE_LEN)
69648 i = RCU_TORTURE_PIPE_LEN;
69649- atomic_inc(&rcu_torture_wcount[i]);
69650+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69651 old_rp->rtort_pipe_count++;
69652 cur_ops->deferred_free(old_rp);
69653 }
66a7e928 69654@@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
8308f9c9
MT		 69655 return;
69656 }
69657 if (p->rtort_mbtest == 0)
69658- atomic_inc(&n_rcu_torture_mberror);
69659+ atomic_inc_unchecked(&n_rcu_torture_mberror);
69660 spin_lock(&rand_lock);
69661 cur_ops->read_delay(&rand);
69662 n_rcu_torture_timers++;
66a7e928 69663@@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
8308f9c9
MT		 69664 continue;
69665 }
69666 if (p->rtort_mbtest == 0)
69667- atomic_inc(&n_rcu_torture_mberror);
69668+ atomic_inc_unchecked(&n_rcu_torture_mberror);
69669 cur_ops->read_delay(&rand);
69670 preempt_disable();
69671 pipe_count = p->rtort_pipe_count;
66a7e928 69672@@ -1072,10 +1072,10 @@ rcu_torture_printk(char *page)
8308f9c9
MT		 69673 rcu_torture_current,
69674 rcu_torture_current_version,
69675 list_empty(&rcu_torture_freelist),
69676- atomic_read(&n_rcu_torture_alloc),
69677- atomic_read(&n_rcu_torture_alloc_fail),
69678- atomic_read(&n_rcu_torture_free),
69679- atomic_read(&n_rcu_torture_mberror),
69680+ atomic_read_unchecked(&n_rcu_torture_alloc),
69681+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
69682+ atomic_read_unchecked(&n_rcu_torture_free),
69683+ atomic_read_unchecked(&n_rcu_torture_mberror),
69684 n_rcu_torture_boost_ktrerror,
69685 n_rcu_torture_boost_rterror,
69686 n_rcu_torture_boost_allocerror,
66a7e928 69687@@ -1083,7 +1083,7 @@ rcu_torture_printk(char *page)
8308f9c9
MT		 69688 n_rcu_torture_boost_failure,
69689 n_rcu_torture_boosts,
69690 n_rcu_torture_timers);
69691- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
69692+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
69693 n_rcu_torture_boost_ktrerror != 0 ||
69694 n_rcu_torture_boost_rterror != 0 ||
69695 n_rcu_torture_boost_allocerror != 0 ||
66a7e928 69696@@ -1093,7 +1093,7 @@ rcu_torture_printk(char *page)
8308f9c9
MT		 69697 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
69698 if (i > 1) {
69699 cnt += sprintf(&page[cnt], "!!! ");
69700- atomic_inc(&n_rcu_torture_error);
69701+ atomic_inc_unchecked(&n_rcu_torture_error);
69702 WARN_ON_ONCE(1);
69703 }
69704 cnt += sprintf(&page[cnt], "Reader Pipe: ");
66a7e928 69705@@ -1107,7 +1107,7 @@ rcu_torture_printk(char *page)
8308f9c9
MT		 69706 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
69707 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69708 cnt += sprintf(&page[cnt], " %d",
69709- atomic_read(&rcu_torture_wcount[i]));
69710+ atomic_read_unchecked(&rcu_torture_wcount[i]));
69711 }
69712 cnt += sprintf(&page[cnt], "\n");
69713 if (cur_ops->stats)
66a7e928 69714@@ -1415,7 +1415,7 @@ rcu_torture_cleanup(void)
8308f9c9
MT		 69715
69716 if (cur_ops->cleanup)
69717 cur_ops->cleanup();
69718- if (atomic_read(&n_rcu_torture_error))
69719+ if (atomic_read_unchecked(&n_rcu_torture_error))
69720 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
69721 else
69722 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
66a7e928 69723@@ -1479,11 +1479,11 @@ rcu_torture_init(void)
8308f9c9
MT		 69724
69725 rcu_torture_current = NULL;
69726 rcu_torture_current_version = 0;
69727- atomic_set(&n_rcu_torture_alloc, 0);
69728- atomic_set(&n_rcu_torture_alloc_fail, 0);
69729- atomic_set(&n_rcu_torture_free, 0);
69730- atomic_set(&n_rcu_torture_mberror, 0);
69731- atomic_set(&n_rcu_torture_error, 0);
69732+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
69733+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
69734+ atomic_set_unchecked(&n_rcu_torture_free, 0);
69735+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
69736+ atomic_set_unchecked(&n_rcu_torture_error, 0);
69737 n_rcu_torture_boost_ktrerror = 0;
69738 n_rcu_torture_boost_rterror = 0;
69739 n_rcu_torture_boost_allocerror = 0;
66a7e928 69740@@ -1491,7 +1491,7 @@ rcu_torture_init(void)
8308f9c9
MT		 69741 n_rcu_torture_boost_failure = 0;
69742 n_rcu_torture_boosts = 0;
69743 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
69744- atomic_set(&rcu_torture_wcount[i], 0);
69745+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
69746 for_each_possible_cpu(cpu) {
69747 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69748 per_cpu(rcu_torture_count, cpu)[i] = 0;
66a7e928
MT		 69749diff -urNp linux-2.6.39/kernel/rcutree.c linux-2.6.39/kernel/rcutree.c
69750--- linux-2.6.39/kernel/rcutree.c 2011-05-19 00:06:34.000000000 -0400
69751+++ linux-2.6.39/kernel/rcutree.c 2011-05-22 19:36:33.000000000 -0400
16454cff 69752@@ -1389,7 +1389,7 @@ __rcu_process_callbacks(struct rcu_state
58c5fc13 69753 /*
ae4e228f 69754 * Do softirq processing for the current CPU.
58c5fc13 69755 */
ae4e228f
MT		 69756-static void rcu_process_callbacks(struct softirq_action *unused)
69757+static void rcu_process_callbacks(void)
69758 {
69759 /*
69760 * Memory references from any prior RCU read-side critical sections
66a7e928
MT		 69761diff -urNp linux-2.6.39/kernel/rcutree_plugin.h linux-2.6.39/kernel/rcutree_plugin.h
69762--- linux-2.6.39/kernel/rcutree_plugin.h 2011-05-19 00:06:34.000000000 -0400
69763+++ linux-2.6.39/kernel/rcutree_plugin.h 2011-05-22 19:36:33.000000000 -0400
16454cff 69764@@ -730,7 +730,7 @@ void synchronize_rcu_expedited(void)
bc901d79
MT		 69765
69766 /* Clean up and exit. */
69767 smp_mb(); /* ensure expedited GP seen before counter increment. */
69768- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
69769+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
69770 unlock_mb_ret:
69771 mutex_unlock(&sync_rcu_preempt_exp_mutex);
69772 mb_ret:
8308f9c9
MT		 69773@@ -1025,8 +1025,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
69774
69775 #else /* #ifndef CONFIG_SMP */
69776
69777-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
69778-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
69779+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
69780+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
69781
69782 static int synchronize_sched_expedited_cpu_stop(void *data)
69783 {
69784@@ -1081,7 +1081,7 @@ void synchronize_sched_expedited(void)
69785 int firstsnap, s, snap, trycount = 0;
69786
69787 /* Note that atomic_inc_return() implies full memory barrier. */
69788- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
69789+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
69790 get_online_cpus();
69791
69792 /*
69793@@ -1102,7 +1102,7 @@ void synchronize_sched_expedited(void)
69794 }
69795
69796 /* Check to see if someone else did our work for us. */
69797- s = atomic_read(&sync_sched_expedited_done);
69798+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69799 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
69800 smp_mb(); /* ensure test happens before caller kfree */
69801 return;
69802@@ -1117,7 +1117,7 @@ void synchronize_sched_expedited(void)
69803 * grace period works for us.
69804 */
69805 get_online_cpus();
69806- snap = atomic_read(&sync_sched_expedited_started) - 1;
69807+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
69808 smp_mb(); /* ensure read is before try_stop_cpus(). */
69809 }
69810
69811@@ -1128,12 +1128,12 @@ void synchronize_sched_expedited(void)
69812 * than we did beat us to the punch.
69813 */
69814 do {
69815- s = atomic_read(&sync_sched_expedited_done);
69816+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69817 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
69818 smp_mb(); /* ensure test happens before caller kfree */
69819 break;
69820 }
69821- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
69822+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
69823
69824 put_online_cpus();
69825 }
66a7e928
MT		 69826diff -urNp linux-2.6.39/kernel/relay.c linux-2.6.39/kernel/relay.c
69827--- linux-2.6.39/kernel/relay.c 2011-05-19 00:06:34.000000000 -0400
69828+++ linux-2.6.39/kernel/relay.c 2011-05-22 19:36:33.000000000 -0400
69829@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
69830 };
69831 ssize_t ret;
69832
69833+ pax_track_stack();
69834+
69835 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
69836 return 0;
69837 if (splice_grow_spd(pipe, &spd))
69838diff -urNp linux-2.6.39/kernel/resource.c linux-2.6.39/kernel/resource.c
69839--- linux-2.6.39/kernel/resource.c 2011-05-19 00:06:34.000000000 -0400
69840+++ linux-2.6.39/kernel/resource.c 2011-05-22 19:41:42.000000000 -0400
57199397 69841@@ -133,8 +133,18 @@ static const struct file_operations proc
58c5fc13
MT		 69842
69843 static int __init ioresources_init(void)
69844 {
69845+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69846+#ifdef CONFIG_GRKERNSEC_PROC_USER
69847+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
69848+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
69849+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69850+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
69851+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
69852+#endif
69853+#else
69854 proc_create("ioports", 0, NULL, &proc_ioports_operations);
69855 proc_create("iomem", 0, NULL, &proc_iomem_operations);
69856+#endif
69857 return 0;
69858 }
69859 __initcall(ioresources_init);
66a7e928
MT		 69860diff -urNp linux-2.6.39/kernel/rtmutex-tester.c linux-2.6.39/kernel/rtmutex-tester.c
69861--- linux-2.6.39/kernel/rtmutex-tester.c 2011-05-19 00:06:34.000000000 -0400
69862+++ linux-2.6.39/kernel/rtmutex-tester.c 2011-05-22 19:36:33.000000000 -0400
69863@@ -20,7 +20,7 @@
8308f9c9
MT		 69864 #define MAX_RT_TEST_MUTEXES 8
69865
69866 static spinlock_t rttest_lock;
69867-static atomic_t rttest_event;
69868+static atomic_unchecked_t rttest_event;
69869
69870 struct test_thread_data {
69871 int opcode;
66a7e928 69872@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
8308f9c9
MT		 69873
69874 case RTTEST_LOCKCONT:
69875 td->mutexes[td->opdata] = 1;
69876- td->event = atomic_add_return(1, &rttest_event);
69877+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69878 return 0;
69879
69880 case RTTEST_RESET:
66a7e928 69881@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
8308f9c9
MT		 69882 return 0;
69883
69884 case RTTEST_RESETEVENT:
69885- atomic_set(&rttest_event, 0);
69886+ atomic_set_unchecked(&rttest_event, 0);
69887 return 0;
69888
69889 default:
66a7e928 69890@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
8308f9c9
MT		 69891 return ret;
69892
69893 td->mutexes[id] = 1;
69894- td->event = atomic_add_return(1, &rttest_event);
69895+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69896 rt_mutex_lock(&mutexes[id]);
69897- td->event = atomic_add_return(1, &rttest_event);
69898+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69899 td->mutexes[id] = 4;
69900 return 0;
69901
66a7e928 69902@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
8308f9c9
MT		 69903 return ret;
69904
69905 td->mutexes[id] = 1;
69906- td->event = atomic_add_return(1, &rttest_event);
69907+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69908 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
69909- td->event = atomic_add_return(1, &rttest_event);
69910+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69911 td->mutexes[id] = ret ? 0 : 4;
69912 return ret ? -EINTR : 0;
69913
66a7e928 69914@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
8308f9c9
MT		 69915 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
69916 return ret;
69917
69918- td->event = atomic_add_return(1, &rttest_event);
69919+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69920 rt_mutex_unlock(&mutexes[id]);
69921- td->event = atomic_add_return(1, &rttest_event);
69922+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69923 td->mutexes[id] = 0;
69924 return 0;
69925
66a7e928 69926@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
8308f9c9
MT		 69927 break;
69928
69929 td->mutexes[dat] = 2;
69930- td->event = atomic_add_return(1, &rttest_event);
69931+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69932 break;
69933
66a7e928
MT		 69934 default:
69935@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
8308f9c9
MT		 69936 return;
69937
69938 td->mutexes[dat] = 3;
69939- td->event = atomic_add_return(1, &rttest_event);
69940+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69941 break;
69942
69943 case RTTEST_LOCKNOWAIT:
66a7e928 69944@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
8308f9c9
MT		 69945 return;
69946
69947 td->mutexes[dat] = 1;
69948- td->event = atomic_add_return(1, &rttest_event);
69949+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69950 return;
69951
66a7e928
MT		 69952 default:
69953diff -urNp linux-2.6.39/kernel/sched_autogroup.c linux-2.6.39/kernel/sched_autogroup.c
69954--- linux-2.6.39/kernel/sched_autogroup.c 2011-05-19 00:06:34.000000000 -0400
69955+++ linux-2.6.39/kernel/sched_autogroup.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 69956@@ -7,7 +7,7 @@
69957
69958 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
69959 static struct autogroup autogroup_default;
69960-static atomic_t autogroup_seq_nr;
69961+static atomic_unchecked_t autogroup_seq_nr;
69962
69963 static void __init autogroup_init(struct task_struct *init_task)
69964 {
66a7e928 69965@@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
8308f9c9
MT		 69966
69967 kref_init(&ag->kref);
69968 init_rwsem(&ag->lock);
69969- ag->id = atomic_inc_return(&autogroup_seq_nr);
69970+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
69971 ag->tg = tg;
69972 #ifdef CONFIG_RT_GROUP_SCHED
69973 /*
66a7e928
MT		 69974diff -urNp linux-2.6.39/kernel/sched.c linux-2.6.39/kernel/sched.c
69975--- linux-2.6.39/kernel/sched.c 2011-05-19 00:06:34.000000000 -0400
69976+++ linux-2.6.39/kernel/sched.c 2011-05-23 17:07:00.000000000 -0400
69977@@ -4078,6 +4078,8 @@ asmlinkage void __sched schedule(void)
69978 struct rq *rq;
69979 int cpu;
69980
69981+ pax_track_stack();
69982+
69983 need_resched:
69984 preempt_disable();
69985 cpu = smp_processor_id();
69986@@ -4165,7 +4167,7 @@ EXPORT_SYMBOL(schedule);
71d190be
MT		 69987 * Look out! "owner" is an entirely speculative pointer
69988 * access and not reliable.
69989 */
69990-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
69991+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
69992 {
69993 unsigned int cpu;
69994 struct rq *rq;
66a7e928 69995@@ -4179,10 +4181,10 @@ int mutex_spin_on_owner(struct mutex *lo
71d190be
MT		 69996 * DEBUG_PAGEALLOC could have unmapped it if
69997 * the mutex owner just released it and exited.
69998 */
69999- if (probe_kernel_address(&owner->cpu, cpu))
70000+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
70001 return 0;
70002 #else
70003- cpu = owner->cpu;
70004+ cpu = task_thread_info(owner)->cpu;
70005 #endif
70006
70007 /*
66a7e928 70008@@ -4219,7 +4221,7 @@ int mutex_spin_on_owner(struct mutex *lo
71d190be
MT		 70009 /*
70010 * Is that owner really running on that cpu?
70011 */
70012- if (task_thread_info(rq->curr) != owner || need_resched())
70013+ if (rq->curr != owner || need_resched())
70014 return 0;
70015
70016 arch_mutex_cpu_relax();
66a7e928 70017@@ -4778,6 +4780,8 @@ int can_nice(const struct task_struct *p
58c5fc13
MT		 70018 /* convert nice value [19,-20] to rlimit style value [1,40] */
70019 int nice_rlim = 20 - nice;
70020
70021+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
70022+
df50ba0c 70023 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
58c5fc13
MT		 70024 capable(CAP_SYS_NICE));
70025 }
66a7e928 70026@@ -4811,7 +4815,8 @@ SYSCALL_DEFINE1(nice, int, increment)
58c5fc13
MT		 70027 if (nice > 19)
70028 nice = 19;
70029
70030- if (increment < 0 && !can_nice(current, nice))
70031+ if (increment < 0 && (!can_nice(current, nice) ||
70032+ gr_handle_chroot_nice()))
70033 return -EPERM;
70034
70035 retval = security_task_setnice(current, nice);
66a7e928 70036@@ -4957,6 +4962,7 @@ recheck:
6892158b
MT		 70037 unsigned long rlim_rtprio =
70038 task_rlimit(p, RLIMIT_RTPRIO);
58c5fc13 70039
6892158b 70040+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
df50ba0c
MT		 70041 /* can't set/change the rt policy */
70042 if (policy != p->policy && !rlim_rtprio)
70043 return -EPERM;
66a7e928 70044@@ -7164,7 +7170,7 @@ static void init_sched_groups_power(int
6892158b
MT		 70045 long power;
70046 int weight;
70047
70048- WARN_ON(!sd || !sd->groups);
70049+ BUG_ON(!sd || !sd->groups);
70050
70051 if (cpu != group_first_cpu(sd->groups))
70052 return;
66a7e928
MT		 70053diff -urNp linux-2.6.39/kernel/sched_fair.c linux-2.6.39/kernel/sched_fair.c
70054--- linux-2.6.39/kernel/sched_fair.c 2011-05-19 00:06:34.000000000 -0400
70055+++ linux-2.6.39/kernel/sched_fair.c 2011-05-22 19:36:33.000000000 -0400
70056@@ -3999,7 +3999,7 @@ static void nohz_idle_balance(int this_c
6892158b
MT		 70057 * run_rebalance_domains is triggered when needed from the scheduler tick.
70058 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
df50ba0c
MT		 70059 */
70060-static void run_rebalance_domains(struct softirq_action *h)
70061+static void run_rebalance_domains(void)
70062 {
70063 int this_cpu = smp_processor_id();
70064 struct rq *this_rq = cpu_rq(this_cpu);
66a7e928
MT		 70065diff -urNp linux-2.6.39/kernel/signal.c linux-2.6.39/kernel/signal.c
70066--- linux-2.6.39/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
70067+++ linux-2.6.39/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
df50ba0c
MT		 70068@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
70069
70070 int print_fatal_signals __read_mostly;
70071
70072-static void __user *sig_handler(struct task_struct *t, int sig)
70073+static __sighandler_t sig_handler(struct task_struct *t, int sig)
70074 {
70075 return t->sighand->action[sig - 1].sa.sa_handler;
70076 }
70077
70078-static int sig_handler_ignored(void __user *handler, int sig)
70079+static int sig_handler_ignored(__sighandler_t handler, int sig)
70080 {
70081 /* Is it explicitly or implicitly ignored? */
70082 return handler == SIG_IGN ||
70083@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
70084 static int sig_task_ignored(struct task_struct *t, int sig,
70085 int from_ancestor_ns)
70086 {
70087- void __user *handler;
70088+ __sighandler_t handler;
70089
70090 handler = sig_handler(t, sig);
70091
70092@@ -243,6 +243,9 @@ __sigqueue_alloc(int sig, struct task_st
58c5fc13 70093 atomic_inc(&user->sigpending);
ae4e228f
MT		 70094 rcu_read_unlock();
70095
58c5fc13
MT		 70096+ if (!override_rlimit)
70097+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
ae4e228f 70098+
58c5fc13
MT		 70099 if (override_rlimit ||
70100 atomic_read(&user->sigpending) <=
df50ba0c
MT		 70101 task_rlimit(t, RLIMIT_SIGPENDING)) {
70102@@ -367,7 +370,7 @@ flush_signal_handlers(struct task_struct
70103
70104 int unhandled_signal(struct task_struct *tsk, int sig)
70105 {
70106- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
70107+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
70108 if (is_global_init(tsk))
70109 return 1;
70110 if (handler != SIG_IGN && handler != SIG_DFL)
66a7e928 70111@@ -693,6 +696,9 @@ static int check_kill_permission(int sig
58c5fc13
MT		 70112 }
70113 }
70114
70115+ if (gr_handle_signal(t, sig))
70116+ return -EPERM;
70117+
70118 return security_task_kill(t, info, sig, 0);
70119 }
70120
66a7e928 70121@@ -1041,7 +1047,7 @@ __group_send_sig_info(int sig, struct si
58c5fc13
MT		 70122 return send_signal(sig, info, p, 1);
70123 }
70124
70125-static int
70126+int
70127 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
70128 {
70129 return send_signal(sig, info, t, 0);
66a7e928 70130@@ -1078,6 +1084,7 @@ force_sig_info(int sig, struct siginfo *
c52201e0
MT		 70131 unsigned long int flags;
70132 int ret, blocked, ignored;
70133 struct k_sigaction *action;
70134+ int is_unhandled = 0;
70135
70136 spin_lock_irqsave(&t->sighand->siglock, flags);
70137 action = &t->sighand->action[sig-1];
66a7e928 70138@@ -1092,9 +1099,18 @@ force_sig_info(int sig, struct siginfo *
c52201e0
MT		 70139 }
70140 if (action->sa.sa_handler == SIG_DFL)
70141 t->signal->flags &= ~SIGNAL_UNKILLABLE;
70142+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
70143+ is_unhandled = 1;
58c5fc13
MT		 70144 ret = specific_send_sig_info(sig, info, t);
70145 spin_unlock_irqrestore(&t->sighand->siglock, flags);
70146
c52201e0
MT		 70147+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
70148+ normal operation */
70149+ if (is_unhandled) {
70150+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
70151+ gr_handle_crash(t, sig);
70152+ }
58c5fc13
MT		 70153+
70154 return ret;
70155 }
70156
66a7e928 70157@@ -1153,8 +1169,11 @@ int group_send_sig_info(int sig, struct
57199397
MT		 70158 ret = check_kill_permission(sig, info, p);
70159 rcu_read_unlock();
ae4e228f
MT		 70160
70161- if (!ret && sig)
70162+ if (!ret && sig) {
70163 ret = do_send_sig_info(sig, info, p, true);
58c5fc13
MT		 70164+ if (!ret)
70165+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
ae4e228f 70166+ }
58c5fc13
MT		 70167
70168 return ret;
ae4e228f 70169 }
66a7e928
MT		 70170@@ -1718,6 +1737,8 @@ void ptrace_notify(int exit_code)
70171 {
70172 siginfo_t info;
70173
70174+ pax_track_stack();
70175+
70176 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
70177
70178 memset(&info, 0, sizeof info);
70179diff -urNp linux-2.6.39/kernel/smp.c linux-2.6.39/kernel/smp.c
70180--- linux-2.6.39/kernel/smp.c 2011-05-19 00:06:34.000000000 -0400
70181+++ linux-2.6.39/kernel/smp.c 2011-05-22 19:36:33.000000000 -0400
16454cff 70182@@ -583,22 +583,22 @@ int smp_call_function(smp_call_func_t fu
ae4e228f
MT		 70183 }
70184 EXPORT_SYMBOL(smp_call_function);
70185
70186-void ipi_call_lock(void)
70187+void ipi_call_lock(void) __acquires(call_function.lock)
70188 {
70189 raw_spin_lock(&call_function.lock);
70190 }
70191
70192-void ipi_call_unlock(void)
70193+void ipi_call_unlock(void) __releases(call_function.lock)
70194 {
70195 raw_spin_unlock(&call_function.lock);
70196 }
70197
70198-void ipi_call_lock_irq(void)
70199+void ipi_call_lock_irq(void) __acquires(call_function.lock)
70200 {
70201 raw_spin_lock_irq(&call_function.lock);
70202 }
70203
70204-void ipi_call_unlock_irq(void)
70205+void ipi_call_unlock_irq(void) __releases(call_function.lock)
70206 {
70207 raw_spin_unlock_irq(&call_function.lock);
70208 }
66a7e928
MT		 70209diff -urNp linux-2.6.39/kernel/softirq.c linux-2.6.39/kernel/softirq.c
70210--- linux-2.6.39/kernel/softirq.c 2011-05-19 00:06:34.000000000 -0400
70211+++ linux-2.6.39/kernel/softirq.c 2011-05-22 19:36:33.000000000 -0400
ae4e228f
MT		 70212@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
70213
66a7e928 70214 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
ae4e228f
MT		 70215
70216-char *softirq_to_name[NR_SOFTIRQS] = {
70217+const char * const softirq_to_name[NR_SOFTIRQS] = {
70218 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
70219 "TASKLET", "SCHED", "HRTIMER", "RCU"
70220 };
bc901d79 70221@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
ae4e228f
MT		 70222
70223 asmlinkage void __do_softirq(void)
70224 {
70225- struct softirq_action *h;
70226+ const struct softirq_action *h;
70227 __u32 pending;
70228 int max_restart = MAX_SOFTIRQ_RESTART;
70229 int cpu;
bc901d79
MT		 70230@@ -235,7 +235,7 @@ restart:
70231 kstat_incr_softirqs_this_cpu(vec_nr);
ae4e228f 70232
bc901d79 70233 trace_softirq_entry(vec_nr);
ae4e228f
MT		 70234- h->action(h);
70235+ h->action();
bc901d79 70236 trace_softirq_exit(vec_nr);
ae4e228f 70237 if (unlikely(prev_count != preempt_count())) {
bc901d79 70238 printk(KERN_ERR "huh, entered softirq %u %s %p"
66a7e928 70239@@ -377,7 +377,7 @@ void raise_softirq(unsigned int nr)
ae4e228f
MT		 70240 local_irq_restore(flags);
70241 }
70242
70243-void open_softirq(int nr, void (*action)(struct softirq_action *))
70244+void open_softirq(int nr, void (*action)(void))
70245 {
70246 softirq_vec[nr].action = action;
70247 }
66a7e928 70248@@ -433,7 +433,7 @@ void __tasklet_hi_schedule_first(struct
ae4e228f
MT		 70249
70250 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
70251
70252-static void tasklet_action(struct softirq_action *a)
70253+static void tasklet_action(void)
70254 {
70255 struct tasklet_struct *list;
70256
66a7e928 70257@@ -468,7 +468,7 @@ static void tasklet_action(struct softir
ae4e228f
MT		 70258 }
70259 }
70260
70261-static void tasklet_hi_action(struct softirq_action *a)
70262+static void tasklet_hi_action(void)
70263 {
70264 struct tasklet_struct *list;
70265
66a7e928
MT		 70266diff -urNp linux-2.6.39/kernel/sys.c linux-2.6.39/kernel/sys.c
70267--- linux-2.6.39/kernel/sys.c 2011-05-19 00:06:34.000000000 -0400
70268+++ linux-2.6.39/kernel/sys.c 2011-05-22 21:08:10.000000000 -0400
70269@@ -154,6 +154,12 @@ static int set_one_prio(struct task_stru
58c5fc13
MT		 70270 error = -EACCES;
70271 goto out;
70272 }
70273+
70274+ if (gr_handle_chroot_setpriority(p, niceval)) {
70275+ error = -EACCES;
70276+ goto out;
70277+ }
70278+
70279 no_nice = security_task_setnice(p, niceval);
70280 if (no_nice) {
70281 error = no_nice;
66a7e928 70282@@ -538,6 +544,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
58c5fc13
MT		 70283 goto error;
70284 }
70285
70286+ if (gr_check_group_change(new->gid, new->egid, -1))
70287+ goto error;
70288+
70289 if (rgid != (gid_t) -1 ||
70290 (egid != (gid_t) -1 && egid != old->gid))
70291 new->sgid = new->egid;
66a7e928 70292@@ -567,6 +576,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
57199397 70293 old = current_cred();
58c5fc13
MT		 70294
70295 retval = -EPERM;
70296+
70297+ if (gr_check_group_change(gid, gid, gid))
70298+ goto error;
70299+
66a7e928 70300 if (nsown_capable(CAP_SETGID))
58c5fc13
MT		 70301 new->gid = new->egid = new->sgid = new->fsgid = gid;
70302 else if (gid == old->gid || gid == old->sgid)
66a7e928 70303@@ -647,6 +660,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
58c5fc13
MT		 70304 goto error;
70305 }
70306
70307+ if (gr_check_user_change(new->uid, new->euid, -1))
70308+ goto error;
70309+
70310 if (new->uid != old->uid) {
70311 retval = set_user(new);
70312 if (retval < 0)
66a7e928 70313@@ -691,6 +707,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
57199397 70314 old = current_cred();
58c5fc13
MT		 70315
70316 retval = -EPERM;
70317+
70318+ if (gr_check_crash_uid(uid))
70319+ goto error;
70320+ if (gr_check_user_change(uid, uid, uid))
70321+ goto error;
70322+
66a7e928 70323 if (nsown_capable(CAP_SETUID)) {
58c5fc13
MT		 70324 new->suid = new->uid = uid;
70325 if (uid != old->uid) {
66a7e928 70326@@ -745,6 +767,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
58c5fc13
MT		 70327 goto error;
70328 }
70329
70330+ if (gr_check_user_change(ruid, euid, -1))
70331+ goto error;
70332+
70333 if (ruid != (uid_t) -1) {
70334 new->uid = ruid;
70335 if (ruid != old->uid) {
66a7e928 70336@@ -809,6 +834,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
58c5fc13
MT		 70337 goto error;
70338 }
70339
70340+ if (gr_check_group_change(rgid, egid, -1))
70341+ goto error;
70342+
70343 if (rgid != (gid_t) -1)
70344 new->gid = rgid;
70345 if (egid != (gid_t) -1)
66a7e928 70346@@ -855,6 +883,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
57199397
MT		 70347 old = current_cred();
70348 old_fsuid = old->fsuid;
58c5fc13
MT		 70349
70350+ if (gr_check_user_change(-1, -1, uid))
70351+ goto error;
70352+
70353 if (uid == old->uid || uid == old->euid ||
70354 uid == old->suid || uid == old->fsuid ||
66a7e928
MT		 70355 nsown_capable(CAP_SETUID)) {
70356@@ -865,6 +896,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
57199397
MT		 70357 }
70358 }
70359
70360+error:
70361 abort_creds(new);
70362 return old_fsuid;
70363
66a7e928 70364@@ -891,12 +923,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
58c5fc13
MT		 70365 if (gid == old->gid || gid == old->egid ||
70366 gid == old->sgid || gid == old->fsgid ||
66a7e928 70367 nsown_capable(CAP_SETGID)) {
58c5fc13
MT		 70368+ if (gr_check_group_change(-1, -1, gid))
70369+ goto error;
70370+
70371 if (gid != old_fsgid) {
70372 new->fsgid = gid;
70373 goto change_okay;
57199397
MT		 70374 }
70375 }
70376
70377+error:
70378 abort_creds(new);
70379 return old_fsgid;
70380
66a7e928 70381@@ -1643,7 +1679,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
58c5fc13
MT		 70382 error = get_dumpable(me->mm);
70383 break;
70384 case PR_SET_DUMPABLE:
70385- if (arg2 < 0 || arg2 > 1) {
70386+ if (arg2 > 1) {
70387 error = -EINVAL;
70388 break;
70389 }
66a7e928
MT		 70390diff -urNp linux-2.6.39/kernel/sysctl.c linux-2.6.39/kernel/sysctl.c
70391--- linux-2.6.39/kernel/sysctl.c 2011-05-19 00:06:34.000000000 -0400
70392+++ linux-2.6.39/kernel/sysctl.c 2011-05-22 20:23:10.000000000 -0400
16454cff 70393@@ -84,6 +84,13 @@
ae4e228f 70394
58c5fc13
MT		 70395
70396 #if defined(CONFIG_SYSCTL)
70397+#include <linux/grsecurity.h>
70398+#include <linux/grinternal.h>
70399+
70400+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
70401+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
70402+ const int op);
70403+extern int gr_handle_chroot_sysctl(const int op);
70404
70405 /* External variables not in a header file. */
df50ba0c 70406 extern int sysctl_overcommit_memory;
66a7e928 70407@@ -196,6 +203,7 @@ static int sysrq_sysctl_handler(ctl_tabl
57199397
MT		 70408 }
70409
58c5fc13 70410 #endif
57199397 70411+extern struct ctl_table grsecurity_table[];
58c5fc13
MT		 70412
70413 static struct ctl_table root_table[];
70414 static struct ctl_table_root sysctl_table_root;
66a7e928 70415@@ -225,6 +233,20 @@ extern struct ctl_table epoll_table[];
58c5fc13
MT		 70416 int sysctl_legacy_va_layout;
70417 #endif
70418
70419+#ifdef CONFIG_PAX_SOFTMODE
70420+static ctl_table pax_table[] = {
70421+ {
58c5fc13
MT		 70422+ .procname = "softmode",
70423+ .data = &pax_softmode,
70424+ .maxlen = sizeof(unsigned int),
70425+ .mode = 0600,
70426+ .proc_handler = &proc_dointvec,
70427+ },
70428+
ae4e228f 70429+ { }
58c5fc13
MT		 70430+};
70431+#endif
70432+
df50ba0c 70433 /* The default sysctl tables: */
58c5fc13 70434
df50ba0c 70435 static struct ctl_table root_table[] = {
66a7e928 70436@@ -271,6 +293,22 @@ static int max_extfrag_threshold = 1000;
58c5fc13
MT		 70437 #endif
70438
70439 static struct ctl_table kern_table[] = {
ae4e228f 70440+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
58c5fc13 70441+ {
58c5fc13
MT		 70442+ .procname = "grsecurity",
70443+ .mode = 0500,
70444+ .child = grsecurity_table,
70445+ },
70446+#endif
70447+
70448+#ifdef CONFIG_PAX_SOFTMODE
70449+ {
58c5fc13
MT		 70450+ .procname = "pax",
70451+ .mode = 0500,
70452+ .child = pax_table,
70453+ },
70454+#endif
70455+
58c5fc13 70456 {
ae4e228f
MT		 70457 .procname = "sched_child_runs_first",
70458 .data = &sysctl_sched_child_runs_first,
66a7e928 70459@@ -545,7 +583,7 @@ static struct ctl_table kern_table[] = {
bc901d79
MT		 70460 .data = &modprobe_path,
70461 .maxlen = KMOD_PATH_LEN,
70462 .mode = 0644,
70463- .proc_handler = proc_dostring,
70464+ .proc_handler = proc_dostring_modpriv,
70465 },
70466 {
70467 .procname = "modules_disabled",
66a7e928 70468@@ -707,16 +745,20 @@ static struct ctl_table kern_table[] = {
16454cff
MT		 70469 .extra1 = &zero,
70470 .extra2 = &one,
70471 },
70472+#endif
70473 {
70474 .procname = "kptr_restrict",
70475 .data = &kptr_restrict,
70476 .maxlen = sizeof(int),
70477 .mode = 0644,
ea610fa8 70478 .proc_handler = proc_dmesg_restrict,
16454cff
MT		 70479+#ifdef CONFIG_GRKERNSEC_HIDESYM
70480+ .extra1 = &two,
70481+#else
70482 .extra1 = &zero,
70483+#endif
70484 .extra2 = &two,
70485 },
70486-#endif
70487 {
70488 .procname = "ngroups_max",
70489 .data = &ngroups_max,
66a7e928 70490@@ -1189,6 +1231,13 @@ static struct ctl_table vm_table[] = {
57199397
MT		 70491 .proc_handler = proc_dointvec_minmax,
70492 .extra1 = &zero,
70493 },
70494+ {
70495+ .procname = "heap_stack_gap",
70496+ .data = &sysctl_heap_stack_gap,
70497+ .maxlen = sizeof(sysctl_heap_stack_gap),
70498+ .mode = 0644,
70499+ .proc_handler = proc_doulongvec_minmax,
70500+ },
70501 #else
70502 {
70503 .procname = "nr_trim_pages",
66a7e928
MT		 70504@@ -1698,6 +1747,17 @@ static int test_perm(int mode, int op)
70505 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
70506 {
58c5fc13 70507 int mode;
66a7e928
MT		 70508+ int error;
70509+
58c5fc13
MT		 70510+ if (table->parent != NULL && table->parent->procname != NULL &&
70511+ table->procname != NULL &&
70512+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
70513+ return -EACCES;
70514+ if (gr_handle_chroot_sysctl(op))
70515+ return -EACCES;
70516+ error = gr_handle_sysctl(table, op);
70517+ if (error)
70518+ return error;
66a7e928
MT		 70519
70520 if (root->permissions)
70521 mode = root->permissions(root, current->nsproxy, table);
70522@@ -2102,6 +2162,16 @@ int proc_dostring(struct ctl_table *tabl
bc901d79
MT		 70523 buffer, lenp, ppos);
70524 }
70525
70526+int proc_dostring_modpriv(struct ctl_table *table, int write,
70527+ void __user *buffer, size_t *lenp, loff_t *ppos)
70528+{
70529+ if (write && !capable(CAP_SYS_MODULE))
70530+ return -EPERM;
70531+
70532+ return _proc_do_string(table->data, table->maxlen, write,
70533+ buffer, lenp, ppos);
70534+}
70535+
70536 static size_t proc_skip_spaces(char **buf)
70537 {
70538 size_t ret;
66a7e928 70539@@ -2207,6 +2277,8 @@ static int proc_put_long(void __user **b
57199397
MT		 70540 len = strlen(tmp);
70541 if (len > *size)
70542 len = *size;
70543+ if (len > sizeof(tmp))
70544+ len = sizeof(tmp);
70545 if (copy_to_user(*buf, tmp, len))
70546 return -EFAULT;
70547 *size -= len;
66a7e928 70548@@ -2523,8 +2595,11 @@ static int __do_proc_doulongvec_minmax(v
6892158b
MT		 70549 *i = val;
70550 } else {
70551 val = convdiv * (*i) / convmul;
70552- if (!first)
70553+ if (!first) {
70554 err = proc_put_char(&buffer, &left, '\t');
70555+ if (err)
70556+ break;
70557+ }
70558 err = proc_put_long(&buffer, &left, val, false);
70559 if (err)
70560 break;
66a7e928 70561@@ -2919,6 +2994,12 @@ int proc_dostring(struct ctl_table *tabl
bc901d79
MT		 70562 return -ENOSYS;
70563 }
70564
70565+int proc_dostring_modpriv(struct ctl_table *table, int write,
70566+ void __user *buffer, size_t *lenp, loff_t *ppos)
70567+{
70568+ return -ENOSYS;
70569+}
70570+
70571 int proc_dointvec(struct ctl_table *table, int write,
70572 void __user *buffer, size_t *lenp, loff_t *ppos)
70573 {
66a7e928 70574@@ -2975,6 +3056,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
bc901d79
MT		 70575 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70576 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70577 EXPORT_SYMBOL(proc_dostring);
70578+EXPORT_SYMBOL(proc_dostring_modpriv);
70579 EXPORT_SYMBOL(proc_doulongvec_minmax);
70580 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70581 EXPORT_SYMBOL(register_sysctl_table);
66a7e928
MT		 70582diff -urNp linux-2.6.39/kernel/sysctl_check.c linux-2.6.39/kernel/sysctl_check.c
70583--- linux-2.6.39/kernel/sysctl_check.c 2011-05-19 00:06:34.000000000 -0400
70584+++ linux-2.6.39/kernel/sysctl_check.c 2011-05-22 19:41:42.000000000 -0400
70585@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
bc901d79
MT		 70586 set_fail(&fail, table, "Directory with extra2");
70587 } else {
70588 if ((table->proc_handler == proc_dostring) ||
70589+ (table->proc_handler == proc_dostring_modpriv) ||
70590 (table->proc_handler == proc_dointvec) ||
70591 (table->proc_handler == proc_dointvec_minmax) ||
70592 (table->proc_handler == proc_dointvec_jiffies) ||
66a7e928
MT		 70593diff -urNp linux-2.6.39/kernel/taskstats.c linux-2.6.39/kernel/taskstats.c
70594--- linux-2.6.39/kernel/taskstats.c 2011-05-19 00:06:34.000000000 -0400
70595+++ linux-2.6.39/kernel/taskstats.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c 70596@@ -27,9 +27,12 @@
58c5fc13
MT		 70597 #include <linux/cgroup.h>
70598 #include <linux/fs.h>
70599 #include <linux/file.h>
70600+#include <linux/grsecurity.h>
70601 #include <net/genetlink.h>
70602 #include <asm/atomic.h>
70603
70604+extern int gr_is_taskstats_denied(int pid);
70605+
70606 /*
70607 * Maximum length of a cpumask that can be specified in
70608 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
16454cff 70609@@ -549,6 +552,9 @@ err:
58c5fc13 70610
bc901d79
MT		 70611 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70612 {
58c5fc13
MT		 70613+ if (gr_is_taskstats_denied(current->pid))
70614+ return -EACCES;
70615+
bc901d79
MT		 70616 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70617 return cmd_attr_register_cpumask(info);
70618 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
66a7e928
MT		 70619diff -urNp linux-2.6.39/kernel/time/posix-clock.c linux-2.6.39/kernel/time/posix-clock.c
70620--- linux-2.6.39/kernel/time/posix-clock.c 2011-05-19 00:06:34.000000000 -0400
70621+++ linux-2.6.39/kernel/time/posix-clock.c 2011-05-22 19:36:33.000000000 -0400
70622@@ -433,7 +433,7 @@ static int pc_timer_settime(struct k_iti
70623 return err;
70624 }
70625
70626-struct k_clock clock_posix_dynamic = {
70627+const struct k_clock clock_posix_dynamic = {
70628 .clock_getres = pc_clock_getres,
70629 .clock_set = pc_clock_settime,
70630 .clock_get = pc_clock_gettime,
70631diff -urNp linux-2.6.39/kernel/time/tick-broadcast.c linux-2.6.39/kernel/time/tick-broadcast.c
70632--- linux-2.6.39/kernel/time/tick-broadcast.c 2011-05-19 00:06:34.000000000 -0400
70633+++ linux-2.6.39/kernel/time/tick-broadcast.c 2011-05-22 19:36:33.000000000 -0400
70634@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
58c5fc13
MT		 70635 * then clear the broadcast bit.
70636 */
70637 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70638- int cpu = smp_processor_id();
70639+ cpu = smp_processor_id();
70640
70641 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70642 tick_broadcast_clear_oneshot(cpu);
66a7e928
MT		 70643diff -urNp linux-2.6.39/kernel/time/timekeeping.c linux-2.6.39/kernel/time/timekeeping.c
70644--- linux-2.6.39/kernel/time/timekeeping.c 2011-05-19 00:06:34.000000000 -0400
70645+++ linux-2.6.39/kernel/time/timekeeping.c 2011-05-22 20:40:50.000000000 -0400
bc901d79
MT		 70646@@ -14,6 +14,7 @@
70647 #include <linux/init.h>
70648 #include <linux/mm.h>
70649 #include <linux/sched.h>
70650+#include <linux/grsecurity.h>
66a7e928 70651 #include <linux/syscore_ops.h>
bc901d79
MT		 70652 #include <linux/clocksource.h>
70653 #include <linux/jiffies.h>
66a7e928 70654@@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
bc901d79
MT		 70655 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70656 return -EINVAL;
70657
70658+ gr_log_timechange();
70659+
70660 write_seqlock_irqsave(&xtime_lock, flags);
70661
70662 timekeeping_forward_now();
66a7e928
MT		 70663diff -urNp linux-2.6.39/kernel/time/timer_list.c linux-2.6.39/kernel/time/timer_list.c
70664--- linux-2.6.39/kernel/time/timer_list.c 2011-05-19 00:06:34.000000000 -0400
70665+++ linux-2.6.39/kernel/time/timer_list.c 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 70666@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
70667
70668 static void print_name_offset(struct seq_file *m, void *sym)
70669 {
70670+#ifdef CONFIG_GRKERNSEC_HIDESYM
70671+ SEQ_printf(m, "<%p>", NULL);
70672+#else
70673 char symname[KSYM_NAME_LEN];
70674
70675 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
16454cff 70676 SEQ_printf(m, "<%pK>", sym);
57199397
MT		 70677 else
70678 SEQ_printf(m, "%s", symname);
70679+#endif
70680 }
70681
70682 static void
70683@@ -112,7 +116,11 @@ next_one:
70684 static void
70685 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70686 {
70687+#ifdef CONFIG_GRKERNSEC_HIDESYM
70688+ SEQ_printf(m, " .base: %p\n", NULL);
70689+#else
16454cff 70690 SEQ_printf(m, " .base: %pK\n", base);
57199397
MT		 70691+#endif
70692 SEQ_printf(m, " .index: %d\n",
70693 base->index);
70694 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70695@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
70696 {
70697 struct proc_dir_entry *pe;
70698
70699+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70700+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70701+#else
70702 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70703+#endif
70704 if (!pe)
70705 return -ENOMEM;
70706 return 0;
66a7e928
MT		 70707diff -urNp linux-2.6.39/kernel/time/timer_stats.c linux-2.6.39/kernel/time/timer_stats.c
70708--- linux-2.6.39/kernel/time/timer_stats.c 2011-05-19 00:06:34.000000000 -0400
70709+++ linux-2.6.39/kernel/time/timer_stats.c 2011-05-22 19:41:42.000000000 -0400
8308f9c9
MT		 70710@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70711 static unsigned long nr_entries;
70712 static struct entry entries[MAX_ENTRIES];
70713
70714-static atomic_t overflow_count;
70715+static atomic_unchecked_t overflow_count;
70716
70717 /*
70718 * The entries are in a hash-table, for fast lookup:
70719@@ -140,7 +140,7 @@ static void reset_entries(void)
70720 nr_entries = 0;
70721 memset(entries, 0, sizeof(entries));
70722 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70723- atomic_set(&overflow_count, 0);
70724+ atomic_set_unchecked(&overflow_count, 0);
70725 }
70726
70727 static struct entry *alloc_entry(void)
70728@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
70729 if (likely(entry))
70730 entry->count++;
70731 else
70732- atomic_inc(&overflow_count);
70733+ atomic_inc_unchecked(&overflow_count);
70734
70735 out_unlock:
70736 raw_spin_unlock_irqrestore(lock, flags);
57199397
MT		 70737@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
70738
70739 static void print_name_offset(struct seq_file *m, unsigned long addr)
70740 {
70741+#ifdef CONFIG_GRKERNSEC_HIDESYM
70742+ seq_printf(m, "<%p>", NULL);
70743+#else
70744 char symname[KSYM_NAME_LEN];
70745
70746 if (lookup_symbol_name(addr, symname) < 0)
70747 seq_printf(m, "<%p>", (void *)addr);
70748 else
70749 seq_printf(m, "%s", symname);
70750+#endif
70751 }
70752
70753 static int tstats_show(struct seq_file *m, void *v)
8308f9c9
MT		 70754@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
70755
70756 seq_puts(m, "Timer Stats Version: v0.2\n");
70757 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70758- if (atomic_read(&overflow_count))
70759+ if (atomic_read_unchecked(&overflow_count))
70760 seq_printf(m, "Overflow: %d entries\n",
70761- atomic_read(&overflow_count));
70762+ atomic_read_unchecked(&overflow_count));
70763
70764 for (i = 0; i < nr_entries; i++) {
70765 entry = entries + i;
57199397
MT		 70766@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
70767 {
70768 struct proc_dir_entry *pe;
70769
70770+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70771+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70772+#else
70773 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70774+#endif
70775 if (!pe)
70776 return -ENOMEM;
70777 return 0;
66a7e928
MT		 70778diff -urNp linux-2.6.39/kernel/time.c linux-2.6.39/kernel/time.c
70779--- linux-2.6.39/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
70780+++ linux-2.6.39/kernel/time.c 2011-05-22 19:41:42.000000000 -0400
70781@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
bc901d79 70782 return error;
58c5fc13 70783
bc901d79
MT		 70784 if (tz) {
70785+ /* we log in do_settimeofday called below, so don't log twice
70786+ */
70787+ if (!tv)
70788+ gr_log_timechange();
58c5fc13 70789+
bc901d79
MT		 70790 /* SMP safe, global irq locking makes it work. */
70791 sys_tz = *tz;
70792 update_vsyscall_tz();
66a7e928
MT		 70793diff -urNp linux-2.6.39/kernel/timer.c linux-2.6.39/kernel/timer.c
70794--- linux-2.6.39/kernel/timer.c 2011-05-19 00:06:34.000000000 -0400
70795+++ linux-2.6.39/kernel/timer.c 2011-05-22 19:36:33.000000000 -0400
70796@@ -1305,7 +1305,7 @@ void update_process_times(int user_tick)
ae4e228f
MT		 70797 /*
70798 * This function runs timers and the timer-tq in bottom half context.
70799 */
70800-static void run_timer_softirq(struct softirq_action *h)
70801+static void run_timer_softirq(void)
70802 {
16454cff 70803 struct tvec_base *base = __this_cpu_read(tvec_bases);
58c5fc13 70804
66a7e928
MT		 70805diff -urNp linux-2.6.39/kernel/trace/blktrace.c linux-2.6.39/kernel/trace/blktrace.c
70806--- linux-2.6.39/kernel/trace/blktrace.c 2011-05-19 00:06:34.000000000 -0400
70807+++ linux-2.6.39/kernel/trace/blktrace.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 70808@@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
70809 struct blk_trace *bt = filp->private_data;
70810 char buf[16];
70811
70812- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
70813+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
70814
70815 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
70816 }
70817@@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
70818 return 1;
70819
70820 bt = buf->chan->private_data;
70821- atomic_inc(&bt->dropped);
70822+ atomic_inc_unchecked(&bt->dropped);
70823 return 0;
70824 }
70825
70826@@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
70827
70828 bt->dir = dir;
70829 bt->dev = dev;
70830- atomic_set(&bt->dropped, 0);
70831+ atomic_set_unchecked(&bt->dropped, 0);
70832
70833 ret = -EIO;
70834 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
66a7e928
MT		 70835diff -urNp linux-2.6.39/kernel/trace/ftrace.c linux-2.6.39/kernel/trace/ftrace.c
70836--- linux-2.6.39/kernel/trace/ftrace.c 2011-05-19 00:06:34.000000000 -0400
70837+++ linux-2.6.39/kernel/trace/ftrace.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 70838@@ -1107,13 +1107,18 @@ ftrace_code_disable(struct module *mod,
ae4e228f
MT		 70839
70840 ip = rec->ip;
70841
70842+ ret = ftrace_arch_code_modify_prepare();
70843+ FTRACE_WARN_ON(ret);
70844+ if (ret)
70845+ return 0;
70846+
70847 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
70848+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
70849 if (ret) {
70850 ftrace_bug(ret, ip);
70851 rec->flags |= FTRACE_FL_FAILED;
70852- return 0;
70853 }
70854- return 1;
70855+ return ret ? 0 : 1;
58c5fc13
MT		 70856 }
70857
ae4e228f 70858 /*
66a7e928
MT		 70859@@ -2011,7 +2016,7 @@ static void ftrace_free_entry_rcu(struct
70860
70861 int
70862 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70863- void *data)
70864+ void *data)
70865 {
70866 struct ftrace_func_probe *entry;
70867 struct ftrace_page *pg;
70868@@ -2083,7 +2088,7 @@ enum {
70869 };
70870
70871 static void
70872-__unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70873+__unregister_ftrace_function_probe(char *glob, const struct ftrace_probe_ops *ops,
70874 void *data, int flags)
70875 {
70876 struct ftrace_func_probe *entry;
70877@@ -2144,7 +2149,7 @@ unregister_ftrace_function_probe(char *g
70878 }
70879
70880 void
70881-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops)
70882+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops)
df50ba0c 70883 {
66a7e928
MT		 70884 __unregister_ftrace_function_probe(glob, ops, NULL, PROBE_TEST_FUNC);
70885 }
70886diff -urNp linux-2.6.39/kernel/trace/trace.c linux-2.6.39/kernel/trace/trace.c
70887--- linux-2.6.39/kernel/trace/trace.c 2011-05-19 00:06:34.000000000 -0400
70888+++ linux-2.6.39/kernel/trace/trace.c 2011-05-22 19:36:33.000000000 -0400
70889@@ -3330,6 +3330,8 @@ static ssize_t tracing_splice_read_pipe(
70890 size_t rem;
70891 unsigned int i;
70892
70893+ pax_track_stack();
70894+
70895 if (splice_grow_spd(pipe, &spd))
70896 return -ENOMEM;
70897
70898@@ -3813,6 +3815,8 @@ tracing_buffers_splice_read(struct file
70899 int entries, size, i;
70900 size_t ret;
70901
70902+ pax_track_stack();
70903+
70904 if (splice_grow_spd(pipe, &spd))
70905 return -ENOMEM;
70906
70907@@ -3981,10 +3985,9 @@ static const struct file_operations trac
ae4e228f
MT		 70908 };
70909 #endif
58c5fc13 70910
ae4e228f
MT		 70911-static struct dentry *d_tracer;
70912-
70913 struct dentry *tracing_init_dentry(void)
70914 {
70915+ static struct dentry *d_tracer;
70916 static int once;
70917
70918 if (d_tracer)
66a7e928 70919@@ -4004,10 +4007,9 @@ struct dentry *tracing_init_dentry(void)
ae4e228f 70920 return d_tracer;
58c5fc13
MT		 70921 }
70922
ae4e228f
MT		 70923-static struct dentry *d_percpu;
70924-
70925 struct dentry *tracing_dentry_percpu(void)
70926 {
70927+ static struct dentry *d_percpu;
70928 static int once;
70929 struct dentry *d_tracer;
70930
66a7e928
MT		 70931diff -urNp linux-2.6.39/kernel/trace/trace_events.c linux-2.6.39/kernel/trace/trace_events.c
70932--- linux-2.6.39/kernel/trace/trace_events.c 2011-05-19 00:06:34.000000000 -0400
70933+++ linux-2.6.39/kernel/trace/trace_events.c 2011-05-22 19:36:33.000000000 -0400
70934@@ -1241,10 +1241,10 @@ static LIST_HEAD(ftrace_module_file_list
bc901d79
MT		 70935 struct ftrace_module_file_ops {
70936 struct list_head list;
70937 struct module *mod;
16454cff
MT		 70938- struct file_operations id;
70939- struct file_operations enable;
70940- struct file_operations format;
70941- struct file_operations filter;
70942+ struct file_operations id; /* cannot be const, see trace_create_file_ops() */
70943+ struct file_operations enable; /* cannot be const, see trace_create_file_ops() */
70944+ struct file_operations format; /* cannot be const, see trace_create_file_ops() */
70945+ struct file_operations filter; /* cannot be const, see trace_create_file_ops() */
70946 };
70947
70948 static struct ftrace_module_file_ops *
66a7e928
MT		 70949diff -urNp linux-2.6.39/kernel/trace/trace_functions.c linux-2.6.39/kernel/trace/trace_functions.c
70950--- linux-2.6.39/kernel/trace/trace_functions.c 2011-05-19 00:06:34.000000000 -0400
70951+++ linux-2.6.39/kernel/trace/trace_functions.c 2011-05-22 19:36:33.000000000 -0400
70952@@ -308,7 +308,7 @@ ftrace_trace_onoff_print(struct seq_file
70953 static int
70954 ftrace_trace_onoff_unreg(char *glob, char *cmd, char *param)
70955 {
70956- struct ftrace_probe_ops *ops;
70957+ const struct ftrace_probe_ops *ops;
70958
70959 /* we register both traceon and traceoff to this callback */
70960 if (strcmp(cmd, "traceon") == 0)
70961diff -urNp linux-2.6.39/kernel/trace/trace_mmiotrace.c linux-2.6.39/kernel/trace/trace_mmiotrace.c
70962--- linux-2.6.39/kernel/trace/trace_mmiotrace.c 2011-05-19 00:06:34.000000000 -0400
70963+++ linux-2.6.39/kernel/trace/trace_mmiotrace.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 70964@@ -24,7 +24,7 @@ struct header_iter {
70965 static struct trace_array *mmio_trace_array;
70966 static bool overrun_detected;
70967 static unsigned long prev_overruns;
70968-static atomic_t dropped_count;
70969+static atomic_unchecked_t dropped_count;
70970
70971 static void mmio_reset_data(struct trace_array *tr)
70972 {
70973@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
70974
70975 static unsigned long count_overruns(struct trace_iterator *iter)
70976 {
70977- unsigned long cnt = atomic_xchg(&dropped_count, 0);
70978+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
70979 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
70980
70981 if (over > prev_overruns)
70982@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
70983 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
70984 sizeof(*entry), 0, pc);
70985 if (!event) {
70986- atomic_inc(&dropped_count);
70987+ atomic_inc_unchecked(&dropped_count);
70988 return;
70989 }
70990 entry = ring_buffer_event_data(event);
70991@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
70992 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
70993 sizeof(*entry), 0, pc);
70994 if (!event) {
70995- atomic_inc(&dropped_count);
70996+ atomic_inc_unchecked(&dropped_count);
70997 return;
70998 }
70999 entry = ring_buffer_event_data(event);
66a7e928
MT		 71000diff -urNp linux-2.6.39/kernel/trace/trace_output.c linux-2.6.39/kernel/trace/trace_output.c
71001--- linux-2.6.39/kernel/trace/trace_output.c 2011-05-19 00:06:34.000000000 -0400
71002+++ linux-2.6.39/kernel/trace/trace_output.c 2011-05-22 19:36:33.000000000 -0400
6892158b 71003@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
ae4e228f 71004
58c5fc13
MT		 71005 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
71006 if (!IS_ERR(p)) {
71007- p = mangle_path(s->buffer + s->len, p, "\n");
71008+ p = mangle_path(s->buffer + s->len, p, "\n\\");
71009 if (p) {
71010 s->len = p - s->buffer;
71011 return 1;
66a7e928
MT		 71012diff -urNp linux-2.6.39/kernel/trace/trace_stack.c linux-2.6.39/kernel/trace/trace_stack.c
71013--- linux-2.6.39/kernel/trace/trace_stack.c 2011-05-19 00:06:34.000000000 -0400
71014+++ linux-2.6.39/kernel/trace/trace_stack.c 2011-05-22 19:36:33.000000000 -0400
ae4e228f
MT		 71015@@ -50,7 +50,7 @@ static inline void check_stack(void)
71016 return;
58c5fc13 71017
ae4e228f
MT		 71018 /* we do not handle interrupt stacks yet */
71019- if (!object_is_on_stack(&this_size))
71020+ if (!object_starts_on_stack(&this_size))
71021 return;
71022
71023 local_irq_save(flags);
66a7e928
MT		 71024diff -urNp linux-2.6.39/kernel/trace/trace_workqueue.c linux-2.6.39/kernel/trace/trace_workqueue.c
71025--- linux-2.6.39/kernel/trace/trace_workqueue.c 2011-05-19 00:06:34.000000000 -0400
71026+++ linux-2.6.39/kernel/trace/trace_workqueue.c 2011-05-22 19:36:33.000000000 -0400
71d190be
MT		 71027@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
71028 int cpu;
71029 pid_t pid;
71030 /* Can be inserted from interrupt or user context, need to be atomic */
71031- atomic_t inserted;
71032+ atomic_unchecked_t inserted;
71033 /*
71034 * Don't need to be atomic, works are serialized in a single workqueue thread
71035 * on a single CPU.
71036@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
71037 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
71038 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
71039 if (node->pid == wq_thread->pid) {
71040- atomic_inc(&node->inserted);
71041+ atomic_inc_unchecked(&node->inserted);
71042 goto found;
71043 }
71044 }
71045@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
71046 tsk = get_pid_task(pid, PIDTYPE_PID);
71047 if (tsk) {
71048 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
71049- atomic_read(&cws->inserted), cws->executed,
71050+ atomic_read_unchecked(&cws->inserted), cws->executed,
71051 tsk->comm);
71052 put_task_struct(tsk);
71053 }
66a7e928
MT		 71054diff -urNp linux-2.6.39/lib/bug.c linux-2.6.39/lib/bug.c
71055--- linux-2.6.39/lib/bug.c 2011-05-19 00:06:34.000000000 -0400
71056+++ linux-2.6.39/lib/bug.c 2011-05-22 19:36:33.000000000 -0400
6892158b 71057@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
ae4e228f
MT		 71058 return BUG_TRAP_TYPE_NONE;
71059
71060 bug = find_bug(bugaddr);
71061+ if (!bug)
71062+ return BUG_TRAP_TYPE_NONE;
71063
6892158b
MT		 71064 file = NULL;
71065 line = 0;
66a7e928
MT		 71066diff -urNp linux-2.6.39/lib/debugobjects.c linux-2.6.39/lib/debugobjects.c
71067--- linux-2.6.39/lib/debugobjects.c 2011-05-19 00:06:34.000000000 -0400
71068+++ linux-2.6.39/lib/debugobjects.c 2011-05-22 19:36:33.000000000 -0400
71069@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
ae4e228f
MT		 71070 if (limit > 4)
71071 return;
71072
71073- is_on_stack = object_is_on_stack(addr);
71074+ is_on_stack = object_starts_on_stack(addr);
71075 if (is_on_stack == onstack)
71076 return;
71077
66a7e928
MT		 71078diff -urNp linux-2.6.39/lib/dma-debug.c linux-2.6.39/lib/dma-debug.c
71079--- linux-2.6.39/lib/dma-debug.c 2011-05-19 00:06:34.000000000 -0400
71080+++ linux-2.6.39/lib/dma-debug.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 71081@@ -862,7 +862,7 @@ out:
58c5fc13 71082
ae4e228f
MT		 71083 static void check_for_stack(struct device *dev, void *addr)
71084 {
71085- if (object_is_on_stack(addr))
71086+ if (object_starts_on_stack(addr))
71087 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
71088 "stack [addr=%p]\n", addr);
71089 }
66a7e928
MT		 71090diff -urNp linux-2.6.39/lib/inflate.c linux-2.6.39/lib/inflate.c
71091--- linux-2.6.39/lib/inflate.c 2011-05-19 00:06:34.000000000 -0400
71092+++ linux-2.6.39/lib/inflate.c 2011-05-22 19:36:33.000000000 -0400
6892158b 71093@@ -269,7 +269,7 @@ static void free(void *where)
58c5fc13
MT		 71094 malloc_ptr = free_mem_ptr;
71095 }
71096 #else
71097-#define malloc(a) kmalloc(a, GFP_KERNEL)
71098+#define malloc(a) kmalloc((a), GFP_KERNEL)
71099 #define free(a) kfree(a)
71100 #endif
71101
66a7e928
MT		 71102diff -urNp linux-2.6.39/lib/Kconfig.debug linux-2.6.39/lib/Kconfig.debug
71103--- linux-2.6.39/lib/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
71104+++ linux-2.6.39/lib/Kconfig.debug 2011-05-22 19:41:42.000000000 -0400
71105@@ -1078,6 +1078,7 @@ config LATENCYTOP
6892158b
MT		 71106 depends on DEBUG_KERNEL
71107 depends on STACKTRACE_SUPPORT
71108 depends on PROC_FS
71109+ depends on !GRKERNSEC_HIDESYM
71110 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
71111 select KALLSYMS
71112 select KALLSYMS_ALL
66a7e928
MT		 71113diff -urNp linux-2.6.39/lib/kref.c linux-2.6.39/lib/kref.c
71114--- linux-2.6.39/lib/kref.c 2011-05-19 00:06:34.000000000 -0400
71115+++ linux-2.6.39/lib/kref.c 2011-05-22 19:36:33.000000000 -0400
16454cff 71116@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
6892158b
MT		 71117 */
71118 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
71119 {
71120- WARN_ON(release == NULL);
71121+ BUG_ON(release == NULL);
71122 WARN_ON(release == (void (*)(struct kref *))kfree);
71123
71124 if (atomic_dec_and_test(&kref->refcount)) {
66a7e928
MT		 71125diff -urNp linux-2.6.39/lib/radix-tree.c linux-2.6.39/lib/radix-tree.c
71126--- linux-2.6.39/lib/radix-tree.c 2011-05-19 00:06:34.000000000 -0400
71127+++ linux-2.6.39/lib/radix-tree.c 2011-05-22 19:36:33.000000000 -0400
df50ba0c 71128@@ -80,7 +80,7 @@ struct radix_tree_preload {
58c5fc13
MT		 71129 int nr;
71130 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
71131 };
71132-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
71133+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
71134
bc901d79 71135 static inline void *ptr_to_indirect(void *ptr)
58c5fc13 71136 {
66a7e928
MT		 71137diff -urNp linux-2.6.39/lib/vsprintf.c linux-2.6.39/lib/vsprintf.c
71138--- linux-2.6.39/lib/vsprintf.c 2011-05-19 00:06:34.000000000 -0400
71139+++ linux-2.6.39/lib/vsprintf.c 2011-05-22 20:54:59.000000000 -0400
bc901d79
MT		 71140@@ -16,6 +16,9 @@
71141 * - scnprintf and vscnprintf
71142 */
71143
71144+#ifdef CONFIG_GRKERNSEC_HIDESYM
71145+#define __INCLUDED_BY_HIDESYM 1
71146+#endif
71147 #include <stdarg.h>
71148 #include <linux/module.h>
71149 #include <linux/types.h>
66a7e928 71150@@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
bc901d79 71151 char sym[KSYM_SYMBOL_LEN];
66a7e928
MT		 71152 if (ext == 'B')
71153 sprint_backtrace(sym, value);
71154- else if (ext != 'f' && ext != 's')
71155+ else if (ext != 'f' && ext != 's' && ext != 'a')
bc901d79
MT		 71156 sprint_symbol(sym, value);
71157 else
71158 kallsyms_lookup(value, NULL, NULL, NULL, sym);
66a7e928 71159@@ -797,7 +800,11 @@ char *uuid_string(char *buf, char *end,
16454cff
MT		 71160 return string(buf, end, uuid, spec);
71161 }
71162
71163+#ifdef CONFIG_GRKERNSEC_HIDESYM
66a7e928 71164+int kptr_restrict __read_mostly = 2;
16454cff 71165+#else
66a7e928 71166 int kptr_restrict __read_mostly;
16454cff
MT		 71167+#endif
71168
71169 /*
71170 * Show a '%p' thing. A kernel extension is that the '%p' is followed
66a7e928 71171@@ -811,6 +818,8 @@ int kptr_restrict __read_mostly;
bc901d79
MT		 71172 * - 'S' For symbolic direct pointers with offset
71173 * - 's' For symbolic direct pointers without offset
66a7e928 71174 * - 'B' For backtraced symbolic direct pointers with offset
bc901d79
MT		 71175+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
71176+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
71177 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
71178 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
71179 * - 'M' For a 6-byte MAC address, it prints the address in the
66a7e928 71180@@ -855,12 +864,12 @@ char *pointer(const char *fmt, char *buf
bc901d79 71181 {
66a7e928 71182 if (!ptr && *fmt != 'K') {
bc901d79
MT		 71183 /*
71184- * Print (null) with the same width as a pointer so it makes
71185+ * Print (nil) with the same width as a pointer so it makes
71186 * tabular output look nice.
71187 */
71188 if (spec.field_width == -1)
71189 spec.field_width = 2 * sizeof(void *);
6892158b
MT		 71190- return string(buf, end, "(null)", spec);
71191+ return string(buf, end, "(nil)", spec);
bc901d79 71192 }
6892158b
MT		 71193
71194 switch (*fmt) {
66a7e928 71195@@ -870,6 +879,13 @@ char *pointer(const char *fmt, char *buf
bc901d79
MT		 71196 /* Fallthrough */
71197 case 'S':
71198 case 's':
71199+#ifdef CONFIG_GRKERNSEC_HIDESYM
71200+ break;
71201+#else
71202+ return symbol_string(buf, end, ptr, spec, *fmt);
71203+#endif
71204+ case 'A':
71205+ case 'a':
66a7e928 71206 case 'B':
bc901d79
MT		 71207 return symbol_string(buf, end, ptr, spec, *fmt);
71208 case 'R':
66a7e928 71209@@ -1632,11 +1648,11 @@ int bstr_printf(char *buf, size_t size,
bc901d79
MT		 71210 typeof(type) value; \
71211 if (sizeof(type) == 8) { \
71212 args = PTR_ALIGN(args, sizeof(u32)); \
71213- *(u32 *)&value = *(u32 *)args; \
71214- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
71215+ *(u32 *)&value = *(const u32 *)args; \
71216+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
71217 } else { \
71218 args = PTR_ALIGN(args, sizeof(type)); \
71219- value = *(typeof(type) *)args; \
71220+ value = *(const typeof(type) *)args; \
71221 } \
71222 args += sizeof(type); \
71223 value; \
66a7e928 71224@@ -1699,7 +1715,7 @@ int bstr_printf(char *buf, size_t size,
bc901d79
MT		 71225 case FORMAT_TYPE_STR: {
71226 const char *str_arg = args;
71227 args += strlen(str_arg) + 1;
71228- str = string(str, end, (char *)str_arg, spec);
71229+ str = string(str, end, str_arg, spec);
71230 break;
71231 }
71232
66a7e928
MT		 71233diff -urNp linux-2.6.39/localversion-grsec linux-2.6.39/localversion-grsec
71234--- linux-2.6.39/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
71235+++ linux-2.6.39/localversion-grsec 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 71236@@ -0,0 +1 @@
71237+-grsec
66a7e928
MT		 71238diff -urNp linux-2.6.39/Makefile linux-2.6.39/Makefile
71239--- linux-2.6.39/Makefile 2011-05-19 00:06:34.000000000 -0400
71240+++ linux-2.6.39/Makefile 2011-05-22 19:41:42.000000000 -0400
71241@@ -237,8 +237,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
57199397
MT		 71242
71243 HOSTCC = gcc
71244 HOSTCXX = g++
71245-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
71246-HOSTCXXFLAGS = -O2
66a7e928 71247+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
57199397
MT		 71248+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
71249
71250 # Decide whether to build built-in, modular, or both.
71251 # Normally, just do built-in.
66a7e928 71252@@ -356,6 +356,7 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
71d190be
MT		 71253 KBUILD_CPPFLAGS := -D__KERNEL__
71254
71255 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
71256+ -W -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers \
71257 -fno-strict-aliasing -fno-common \
71258 -Werror-implicit-function-declaration \
71259 -Wno-format-security \
66a7e928 71260@@ -685,7 +686,7 @@ export mod_strip_cmd
57199397
MT		 71261
71262
71263 ifeq ($(KBUILD_EXTMOD),)
71264-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
71265+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
71266
71267 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
71268 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
66a7e928
MT		 71269diff -urNp linux-2.6.39/mm/filemap.c linux-2.6.39/mm/filemap.c
71270--- linux-2.6.39/mm/filemap.c 2011-05-19 00:06:34.000000000 -0400
71271+++ linux-2.6.39/mm/filemap.c 2011-05-22 19:41:42.000000000 -0400
71272@@ -1724,7 +1724,7 @@ int generic_file_mmap(struct file * file
58c5fc13
MT		 71273 struct address_space *mapping = file->f_mapping;
71274
71275 if (!mapping->a_ops->readpage)
71276- return -ENOEXEC;
71277+ return -ENODEV;
71278 file_accessed(file);
71279 vma->vm_ops = &generic_file_vm_ops;
71280 vma->vm_flags |= VM_CAN_NONLINEAR;
66a7e928 71281@@ -2120,6 +2120,7 @@ inline int generic_write_checks(struct f
58c5fc13
MT		 71282 *pos = i_size_read(inode);
71283
71284 if (limit != RLIM_INFINITY) {
71285+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71286 if (*pos >= limit) {
71287 send_sig(SIGXFSZ, current, 0);
71288 return -EFBIG;
66a7e928
MT		 71289diff -urNp linux-2.6.39/mm/fremap.c linux-2.6.39/mm/fremap.c
71290--- linux-2.6.39/mm/fremap.c 2011-05-19 00:06:34.000000000 -0400
71291+++ linux-2.6.39/mm/fremap.c 2011-05-22 19:36:33.000000000 -0400
6892158b 71292@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
58c5fc13
MT		 71293 retry:
71294 vma = find_vma(mm, start);
71295
71296+#ifdef CONFIG_PAX_SEGMEXEC
71297+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71298+ goto out;
71299+#endif
71300+
71301 /*
71302 * Make sure the vma is shared, that it supports prefaulting,
71303 * and that the remapped range is valid and fully within
6892158b 71304@@ -224,7 +229,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
57199397
MT		 71305 /*
71306 * drop PG_Mlocked flag for over-mapped range
71307 */
71308- unsigned int saved_flags = vma->vm_flags;
71309+ unsigned long saved_flags = vma->vm_flags;
71310 munlock_vma_pages_range(vma, start, start + size);
71311 vma->vm_flags = saved_flags;
71312 }
66a7e928
MT		 71313diff -urNp linux-2.6.39/mm/highmem.c linux-2.6.39/mm/highmem.c
71314--- linux-2.6.39/mm/highmem.c 2011-05-19 00:06:34.000000000 -0400
71315+++ linux-2.6.39/mm/highmem.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 71316@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
58c5fc13
MT		 71317 * So no dangers, even with speculative execution.
71318 */
71319 page = pte_page(pkmap_page_table[i]);
ae4e228f 71320+ pax_open_kernel();
58c5fc13
MT		 71321 pte_clear(&init_mm, (unsigned long)page_address(page),
71322 &pkmap_page_table[i]);
ae4e228f
MT		 71323-
71324+ pax_close_kernel();
58c5fc13
MT		 71325 set_page_address(page, NULL);
71326 need_flush = 1;
71327 }
bc901d79 71328@@ -186,9 +187,11 @@ start:
58c5fc13
MT		 71329 }
71330 }
71331 vaddr = PKMAP_ADDR(last_pkmap_nr);
ae4e228f
MT		 71332+
71333+ pax_open_kernel();
58c5fc13
MT		 71334 set_pte_at(&init_mm, vaddr,
71335 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
ae4e228f
MT		 71336-
71337+ pax_close_kernel();
58c5fc13
MT		 71338 pkmap_count[last_pkmap_nr] = 1;
71339 set_page_address(page, (void *)vaddr);
58c5fc13 71340
66a7e928
MT		 71341diff -urNp linux-2.6.39/mm/huge_memory.c linux-2.6.39/mm/huge_memory.c
71342--- linux-2.6.39/mm/huge_memory.c 2011-05-19 00:06:34.000000000 -0400
71343+++ linux-2.6.39/mm/huge_memory.c 2011-05-22 19:36:33.000000000 -0400
71344@@ -702,7 +702,7 @@ out:
71345 * run pte_offset_map on the pmd, if an huge pmd could
71346 * materialize from under us from a different thread.
71347 */
71348- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
71349+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71350 return VM_FAULT_OOM;
71351 /* if an huge pmd materialized from under us just retry later */
71352 if (unlikely(pmd_trans_huge(*pmd)))
71353diff -urNp linux-2.6.39/mm/hugetlb.c linux-2.6.39/mm/hugetlb.c
71354--- linux-2.6.39/mm/hugetlb.c 2011-05-19 00:06:34.000000000 -0400
71355+++ linux-2.6.39/mm/hugetlb.c 2011-05-22 19:36:33.000000000 -0400
71356@@ -2331,6 +2331,27 @@ static int unmap_ref_private(struct mm_s
58c5fc13
MT		 71357 return 1;
71358 }
71359
71360+#ifdef CONFIG_PAX_SEGMEXEC
71361+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71362+{
71363+ struct mm_struct *mm = vma->vm_mm;
71364+ struct vm_area_struct *vma_m;
71365+ unsigned long address_m;
71366+ pte_t *ptep_m;
71367+
71368+ vma_m = pax_find_mirror_vma(vma);
71369+ if (!vma_m)
71370+ return;
71371+
71372+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71373+ address_m = address + SEGMEXEC_TASK_SIZE;
71374+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71375+ get_page(page_m);
6892158b 71376+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
58c5fc13
MT		 71377+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71378+}
71379+#endif
71380+
6892158b
MT		 71381 /*
71382 * Hugetlb_cow() should be called with page lock of the original hugepage held.
71383 */
66a7e928 71384@@ -2432,6 +2453,11 @@ retry_avoidcopy:
58c5fc13 71385 make_huge_pte(vma, new_page, 1));
6892158b
MT		 71386 page_remove_rmap(old_page);
71387 hugepage_add_new_anon_rmap(new_page, vma, address);
58c5fc13
MT		 71388+
71389+#ifdef CONFIG_PAX_SEGMEXEC
71390+ pax_mirror_huge_pte(vma, address, new_page);
71391+#endif
71392+
71393 /* Make the old page be freed below */
71394 new_page = old_page;
6892158b 71395 mmu_notifier_invalidate_range_end(mm,
66a7e928 71396@@ -2583,6 +2609,10 @@ retry:
58c5fc13
MT		 71397 && (vma->vm_flags & VM_SHARED)));
71398 set_huge_pte_at(mm, address, ptep, new_pte);
71399
71400+#ifdef CONFIG_PAX_SEGMEXEC
71401+ pax_mirror_huge_pte(vma, address, page);
71402+#endif
71403+
71404 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71405 /* Optimization, do the COW without a second fault */
71406 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
66a7e928 71407@@ -2612,6 +2642,10 @@ int hugetlb_fault(struct mm_struct *mm,
58c5fc13
MT		 71408 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71409 struct hstate *h = hstate_vma(vma);
71410
71411+#ifdef CONFIG_PAX_SEGMEXEC
71412+ struct vm_area_struct *vma_m;
6892158b 71413+#endif
58c5fc13 71414+
6892158b
MT		 71415 ptep = huge_pte_offset(mm, address);
71416 if (ptep) {
71417 entry = huge_ptep_get(ptep);
66a7e928 71418@@ -2623,6 +2657,26 @@ int hugetlb_fault(struct mm_struct *mm,
bc901d79 71419 VM_FAULT_SET_HINDEX(h - hstates);
6892158b
MT		 71420 }
71421
71422+#ifdef CONFIG_PAX_SEGMEXEC
58c5fc13
MT		 71423+ vma_m = pax_find_mirror_vma(vma);
71424+ if (vma_m) {
71425+ unsigned long address_m;
71426+
71427+ if (vma->vm_start > vma_m->vm_start) {
71428+ address_m = address;
71429+ address -= SEGMEXEC_TASK_SIZE;
71430+ vma = vma_m;
71431+ h = hstate_vma(vma);
71432+ } else
71433+ address_m = address + SEGMEXEC_TASK_SIZE;
71434+
71435+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71436+ return VM_FAULT_OOM;
71437+ address_m &= HPAGE_MASK;
71438+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71439+ }
71440+#endif
71441+
71442 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71443 if (!ptep)
71444 return VM_FAULT_OOM;
66a7e928
MT		 71445diff -urNp linux-2.6.39/mm/Kconfig linux-2.6.39/mm/Kconfig
71446--- linux-2.6.39/mm/Kconfig 2011-05-19 00:06:34.000000000 -0400
71447+++ linux-2.6.39/mm/Kconfig 2011-05-22 19:41:42.000000000 -0400
57199397
MT		 71448@@ -240,7 +240,7 @@ config KSM
71449 config DEFAULT_MMAP_MIN_ADDR
71450 int "Low address space to protect from user allocation"
71451 depends on MMU
71452- default 4096
71453+ default 65536
71454 help
71455 This is the portion of low virtual memory which should be protected
71456 from userspace allocation. Keeping a user from writing to low pages
66a7e928
MT		 71457diff -urNp linux-2.6.39/mm/kmemleak.c linux-2.6.39/mm/kmemleak.c
71458--- linux-2.6.39/mm/kmemleak.c 2011-05-19 00:06:34.000000000 -0400
71459+++ linux-2.6.39/mm/kmemleak.c 2011-05-22 19:41:42.000000000 -0400
16454cff 71460@@ -357,7 +357,7 @@ static void print_unreferenced(struct se
bc901d79
MT		 71461
71462 for (i = 0; i < object->trace_len; i++) {
71463 void *ptr = (void *)object->trace[i];
71464- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71465+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71466 }
71467 }
71468
66a7e928
MT		 71469diff -urNp linux-2.6.39/mm/maccess.c linux-2.6.39/mm/maccess.c
71470--- linux-2.6.39/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
71471+++ linux-2.6.39/mm/maccess.c 2011-05-22 19:36:33.000000000 -0400
ae4e228f
MT		 71472@@ -15,10 +15,10 @@
71473 * happens, handle that and return -EFAULT.
71474 */
71475
71476-long __weak probe_kernel_read(void *dst, void *src, size_t size)
71477+long __weak probe_kernel_read(void *dst, const void *src, size_t size)
71478 __attribute__((alias("__probe_kernel_read")));
71479
71480-long __probe_kernel_read(void *dst, void *src, size_t size)
71481+long __probe_kernel_read(void *dst, const void *src, size_t size)
71482 {
71483 long ret;
71484 mm_segment_t old_fs = get_fs();
71485@@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
71486 * Safely write to address @dst from the buffer at @src. If a kernel fault
71487 * happens, handle that and return -EFAULT.
71488 */
71489-long __weak probe_kernel_write(void *dst, void *src, size_t size)
71490+long __weak probe_kernel_write(void *dst, const void *src, size_t size)
71491 __attribute__((alias("__probe_kernel_write")));
71492
71493-long __probe_kernel_write(void *dst, void *src, size_t size)
71494+long __probe_kernel_write(void *dst, const void *src, size_t size)
71495 {
71496 long ret;
71497 mm_segment_t old_fs = get_fs();
66a7e928
MT		 71498diff -urNp linux-2.6.39/mm/madvise.c linux-2.6.39/mm/madvise.c
71499--- linux-2.6.39/mm/madvise.c 2011-05-19 00:06:34.000000000 -0400
71500+++ linux-2.6.39/mm/madvise.c 2011-05-22 19:36:33.000000000 -0400
ae4e228f 71501@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
58c5fc13 71502 pgoff_t pgoff;
ae4e228f 71503 unsigned long new_flags = vma->vm_flags;
58c5fc13
MT		 71504
71505+#ifdef CONFIG_PAX_SEGMEXEC
71506+ struct vm_area_struct *vma_m;
71507+#endif
71508+
71509 switch (behavior) {
71510 case MADV_NORMAL:
71511 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
16454cff 71512@@ -110,6 +114,13 @@ success:
58c5fc13
MT		 71513 /*
71514 * vm_flags is protected by the mmap_sem held in write mode.
71515 */
71516+
71517+#ifdef CONFIG_PAX_SEGMEXEC
71518+ vma_m = pax_find_mirror_vma(vma);
71519+ if (vma_m)
71520+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71521+#endif
71522+
71523 vma->vm_flags = new_flags;
71524
71525 out:
16454cff 71526@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
ae4e228f
MT		 71527 struct vm_area_struct ** prev,
71528 unsigned long start, unsigned long end)
71529 {
58c5fc13
MT		 71530+
71531+#ifdef CONFIG_PAX_SEGMEXEC
ae4e228f
MT		 71532+ struct vm_area_struct *vma_m;
71533+#endif
58c5fc13 71534+
ae4e228f
MT		 71535 *prev = vma;
71536 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71537 return -EINVAL;
16454cff 71538@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
ae4e228f
MT		 71539 zap_page_range(vma, start, end - start, &details);
71540 } else
71541 zap_page_range(vma, start, end - start, NULL);
71542+
71543+#ifdef CONFIG_PAX_SEGMEXEC
71544+ vma_m = pax_find_mirror_vma(vma);
71545+ if (vma_m) {
71546+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71547+ struct zap_details details = {
71548+ .nonlinear_vma = vma_m,
71549+ .last_index = ULONG_MAX,
71550+ };
71551+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71552+ } else
71553+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71554+ }
58c5fc13
MT		 71555+#endif
71556+
ae4e228f
MT		 71557 return 0;
71558 }
58c5fc13 71559
16454cff 71560@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
58c5fc13
MT		 71561 if (end < start)
71562 goto out;
71563
71564+#ifdef CONFIG_PAX_SEGMEXEC
71565+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71566+ if (end > SEGMEXEC_TASK_SIZE)
71567+ goto out;
71568+ } else
71569+#endif
71570+
71571+ if (end > TASK_SIZE)
71572+ goto out;
71573+
71574 error = 0;
71575 if (end == start)
71576 goto out;
66a7e928
MT		 71577diff -urNp linux-2.6.39/mm/memory.c linux-2.6.39/mm/memory.c
71578--- linux-2.6.39/mm/memory.c 2011-05-19 00:06:34.000000000 -0400
71579+++ linux-2.6.39/mm/memory.c 2011-05-22 19:36:33.000000000 -0400
57199397 71580@@ -259,8 +259,12 @@ static inline void free_pmd_range(struct
df50ba0c
MT		 71581 return;
71582
71583 pmd = pmd_offset(pud, start);
71584+
71585+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71586 pud_clear(pud);
71587 pmd_free_tlb(tlb, pmd, start);
71588+#endif
71589+
71590 }
71591
71592 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
6892158b
MT		 71593@@ -291,9 +295,12 @@ static inline void free_pud_range(struct
71594 if (end - 1 > ceiling - 1)
df50ba0c
MT		 71595 return;
71596
df50ba0c 71597+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
6892158b 71598 pud = pud_offset(pgd, start);
df50ba0c
MT		 71599 pgd_clear(pgd);
71600 pud_free_tlb(tlb, pud, start);
71601+#endif
71602+
71603 }
71604
71605 /*
66a7e928 71606@@ -1410,12 +1417,6 @@ no_page_table:
71d190be
MT		 71607 return page;
71608 }
71609
71610-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
71611-{
66a7e928
MT		 71612- return stack_guard_page_start(vma, addr) ||
71613- stack_guard_page_end(vma, addr+PAGE_SIZE);
71d190be
MT		 71614-}
71615-
66a7e928
MT		 71616 /**
71617 * __get_user_pages() - pin user pages in memory
71618 * @tsk: task_struct of target task
71619@@ -1488,10 +1489,10 @@ int __get_user_pages(struct task_struct
ae4e228f 71620 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
58c5fc13
MT		 71621 i = 0;
71622
71623- do {
71624+ while (nr_pages) {
71625 struct vm_area_struct *vma;
58c5fc13
MT		 71626
71627- vma = find_extend_vma(mm, start);
71628+ vma = find_vma(mm, start);
66a7e928 71629 if (!vma && in_gate_area(mm, start)) {
58c5fc13 71630 unsigned long pg = start & PAGE_MASK;
71d190be 71631 pgd_t *pgd;
66a7e928 71632@@ -1539,7 +1540,7 @@ int __get_user_pages(struct task_struct
71d190be 71633 goto next_page;
58c5fc13
MT		 71634 }
71635
71636- if (!vma ||
71637+ if (!vma || start < vma->vm_start ||
71638 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
ae4e228f 71639 !(vm_flags & vma->vm_flags))
58c5fc13 71640 return i ? : -EFAULT;
66a7e928
MT		 71641@@ -1566,11 +1567,6 @@ int __get_user_pages(struct task_struct
71642 int ret;
71643 unsigned int fault_flags = 0;
71644
71645- /* For mlock, just skip the stack guard page. */
71646- if (foll_flags & FOLL_MLOCK) {
71647- if (stack_guard_page(vma, start))
71648- goto next_page;
71649- }
71650 if (foll_flags & FOLL_WRITE)
71651 fault_flags |= FAULT_FLAG_WRITE;
71652 if (nonblocking)
71653@@ -1644,7 +1640,7 @@ next_page:
58c5fc13
MT		 71654 start += PAGE_SIZE;
71655 nr_pages--;
71656 } while (nr_pages && start < vma->vm_end);
71657- } while (nr_pages);
71658+ }
71659 return i;
71660 }
66a7e928
MT		 71661 EXPORT_SYMBOL(__get_user_pages);
71662@@ -1795,6 +1791,10 @@ static int insert_page(struct vm_area_st
6892158b
MT		 71663 page_add_file_rmap(page);
71664 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71665
71666+#ifdef CONFIG_PAX_SEGMEXEC
71667+ pax_mirror_file_pte(vma, addr, page, ptl);
71668+#endif
71669+
71670 retval = 0;
71671 pte_unmap_unlock(pte, ptl);
71672 return retval;
66a7e928 71673@@ -1829,10 +1829,22 @@ out:
6892158b
MT		 71674 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71675 struct page *page)
71676 {
71677+
71678+#ifdef CONFIG_PAX_SEGMEXEC
71679+ struct vm_area_struct *vma_m;
71680+#endif
71681+
71682 if (addr < vma->vm_start || addr >= vma->vm_end)
71683 return -EFAULT;
71684 if (!page_count(page))
71685 return -EINVAL;
71686+
71687+#ifdef CONFIG_PAX_SEGMEXEC
71688+ vma_m = pax_find_mirror_vma(vma);
71689+ if (vma_m)
71690+ vma_m->vm_flags |= VM_INSERTPAGE;
71691+#endif
71692+
71693 vma->vm_flags |= VM_INSERTPAGE;
71694 return insert_page(vma, addr, page, vma->vm_page_prot);
71695 }
66a7e928 71696@@ -1918,6 +1930,7 @@ int vm_insert_mixed(struct vm_area_struc
6892158b
MT		 71697 unsigned long pfn)
71698 {
71699 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71700+ BUG_ON(vma->vm_mirror);
71701
71702 if (addr < vma->vm_start || addr >= vma->vm_end)
71703 return -EFAULT;
66a7e928 71704@@ -2233,6 +2246,186 @@ static inline void cow_user_page(struct
58c5fc13
MT		 71705 copy_user_highpage(dst, src, va, vma);
71706 }
71707
71708+#ifdef CONFIG_PAX_SEGMEXEC
71709+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71710+{
71711+ struct mm_struct *mm = vma->vm_mm;
71712+ spinlock_t *ptl;
71713+ pte_t *pte, entry;
71714+
71715+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71716+ entry = *pte;
71717+ if (!pte_present(entry)) {
71718+ if (!pte_none(entry)) {
71719+ BUG_ON(pte_file(entry));
71720+ free_swap_and_cache(pte_to_swp_entry(entry));
71721+ pte_clear_not_present_full(mm, address, pte, 0);
71722+ }
71723+ } else {
71724+ struct page *page;
71725+
71726+ flush_cache_page(vma, address, pte_pfn(entry));
71727+ entry = ptep_clear_flush(vma, address, pte);
71728+ BUG_ON(pte_dirty(entry));
71729+ page = vm_normal_page(vma, address, entry);
71730+ if (page) {
71731+ update_hiwater_rss(mm);
71732+ if (PageAnon(page))
df50ba0c 71733+ dec_mm_counter_fast(mm, MM_ANONPAGES);
58c5fc13 71734+ else
df50ba0c 71735+ dec_mm_counter_fast(mm, MM_FILEPAGES);
58c5fc13
MT		 71736+ page_remove_rmap(page);
71737+ page_cache_release(page);
71738+ }
71739+ }
71740+ pte_unmap_unlock(pte, ptl);
71741+}
71742+
71743+/* PaX: if vma is mirrored, synchronize the mirror's PTE
71744+ *
71745+ * the ptl of the lower mapped page is held on entry and is not released on exit
71746+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71747+ */
71748+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71749+{
71750+ struct mm_struct *mm = vma->vm_mm;
71751+ unsigned long address_m;
71752+ spinlock_t *ptl_m;
71753+ struct vm_area_struct *vma_m;
71754+ pmd_t *pmd_m;
71755+ pte_t *pte_m, entry_m;
71756+
71757+ BUG_ON(!page_m || !PageAnon(page_m));
71758+
71759+ vma_m = pax_find_mirror_vma(vma);
71760+ if (!vma_m)
71761+ return;
71762+
71763+ BUG_ON(!PageLocked(page_m));
71764+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71765+ address_m = address + SEGMEXEC_TASK_SIZE;
71766+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
bc901d79 71767+ pte_m = pte_offset_map(pmd_m, address_m);
58c5fc13
MT		 71768+ ptl_m = pte_lockptr(mm, pmd_m);
71769+ if (ptl != ptl_m) {
71770+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71771+ if (!pte_none(*pte_m))
71772+ goto out;
71773+ }
71774+
71775+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71776+ page_cache_get(page_m);
71777+ page_add_anon_rmap(page_m, vma_m, address_m);
df50ba0c 71778+ inc_mm_counter_fast(mm, MM_ANONPAGES);
58c5fc13
MT		 71779+ set_pte_at(mm, address_m, pte_m, entry_m);
71780+ update_mmu_cache(vma_m, address_m, entry_m);
71781+out:
71782+ if (ptl != ptl_m)
71783+ spin_unlock(ptl_m);
bc901d79 71784+ pte_unmap(pte_m);
58c5fc13
MT		 71785+ unlock_page(page_m);
71786+}
71787+
71788+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71789+{
71790+ struct mm_struct *mm = vma->vm_mm;
71791+ unsigned long address_m;
71792+ spinlock_t *ptl_m;
71793+ struct vm_area_struct *vma_m;
71794+ pmd_t *pmd_m;
71795+ pte_t *pte_m, entry_m;
71796+
71797+ BUG_ON(!page_m || PageAnon(page_m));
71798+
71799+ vma_m = pax_find_mirror_vma(vma);
71800+ if (!vma_m)
71801+ return;
71802+
71803+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71804+ address_m = address + SEGMEXEC_TASK_SIZE;
71805+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
bc901d79 71806+ pte_m = pte_offset_map(pmd_m, address_m);
58c5fc13
MT		 71807+ ptl_m = pte_lockptr(mm, pmd_m);
71808+ if (ptl != ptl_m) {
71809+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71810+ if (!pte_none(*pte_m))
71811+ goto out;
71812+ }
71813+
71814+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71815+ page_cache_get(page_m);
71816+ page_add_file_rmap(page_m);
df50ba0c 71817+ inc_mm_counter_fast(mm, MM_FILEPAGES);
58c5fc13
MT		 71818+ set_pte_at(mm, address_m, pte_m, entry_m);
71819+ update_mmu_cache(vma_m, address_m, entry_m);
71820+out:
71821+ if (ptl != ptl_m)
71822+ spin_unlock(ptl_m);
bc901d79 71823+ pte_unmap(pte_m);
58c5fc13
MT		 71824+}
71825+
71826+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
71827+{
71828+ struct mm_struct *mm = vma->vm_mm;
71829+ unsigned long address_m;
71830+ spinlock_t *ptl_m;
71831+ struct vm_area_struct *vma_m;
71832+ pmd_t *pmd_m;
71833+ pte_t *pte_m, entry_m;
71834+
71835+ vma_m = pax_find_mirror_vma(vma);
71836+ if (!vma_m)
71837+ return;
71838+
71839+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71840+ address_m = address + SEGMEXEC_TASK_SIZE;
71841+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
bc901d79 71842+ pte_m = pte_offset_map(pmd_m, address_m);
58c5fc13
MT		 71843+ ptl_m = pte_lockptr(mm, pmd_m);
71844+ if (ptl != ptl_m) {
71845+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71846+ if (!pte_none(*pte_m))
71847+ goto out;
71848+ }
71849+
71850+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
71851+ set_pte_at(mm, address_m, pte_m, entry_m);
71852+out:
71853+ if (ptl != ptl_m)
71854+ spin_unlock(ptl_m);
bc901d79 71855+ pte_unmap(pte_m);
58c5fc13
MT		 71856+}
71857+
71858+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
71859+{
71860+ struct page *page_m;
71861+ pte_t entry;
71862+
71863+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
71864+ goto out;
71865+
71866+ entry = *pte;
71867+ page_m = vm_normal_page(vma, address, entry);
71868+ if (!page_m)
71869+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
71870+ else if (PageAnon(page_m)) {
71871+ if (pax_find_mirror_vma(vma)) {
71872+ pte_unmap_unlock(pte, ptl);
71873+ lock_page(page_m);
71874+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
71875+ if (pte_same(entry, *pte))
71876+ pax_mirror_anon_pte(vma, address, page_m, ptl);
71877+ else
71878+ unlock_page(page_m);
71879+ }
71880+ } else
71881+ pax_mirror_file_pte(vma, address, page_m, ptl);
71882+
71883+out:
71884+ pte_unmap_unlock(pte, ptl);
71885+}
71886+#endif
71887+
71888 /*
71889 * This routine handles present pages, when users try to write
71890 * to a shared page. It is done by copying the page to a new address
66a7e928 71891@@ -2444,6 +2637,12 @@ gotten:
58c5fc13
MT		 71892 */
71893 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71894 if (likely(pte_same(*page_table, orig_pte))) {
71895+
71896+#ifdef CONFIG_PAX_SEGMEXEC
71897+ if (pax_find_mirror_vma(vma))
71898+ BUG_ON(!trylock_page(new_page));
71899+#endif
71900+
71901 if (old_page) {
71902 if (!PageAnon(old_page)) {
df50ba0c 71903 dec_mm_counter_fast(mm, MM_FILEPAGES);
66a7e928 71904@@ -2495,6 +2694,10 @@ gotten:
58c5fc13
MT		 71905 page_remove_rmap(old_page);
71906 }
71907
71908+#ifdef CONFIG_PAX_SEGMEXEC
71909+ pax_mirror_anon_pte(vma, address, new_page, ptl);
71910+#endif
71911+
71912 /* Free the old page.. */
71913 new_page = old_page;
71914 ret |= VM_FAULT_WRITE;
66a7e928 71915@@ -2905,6 +3108,11 @@ static int do_swap_page(struct mm_struct
58c5fc13
MT		 71916 swap_free(entry);
71917 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
71918 try_to_free_swap(page);
71919+
71920+#ifdef CONFIG_PAX_SEGMEXEC
71921+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
71922+#endif
71923+
71924 unlock_page(page);
bc901d79
MT		 71925 if (swapcache) {
71926 /*
66a7e928 71927@@ -2928,6 +3136,11 @@ static int do_swap_page(struct mm_struct
58c5fc13
MT		 71928
71929 /* No need to invalidate - it was non-present before */
df50ba0c 71930 update_mmu_cache(vma, address, page_table);
58c5fc13
MT		 71931+
71932+#ifdef CONFIG_PAX_SEGMEXEC
71933+ pax_mirror_anon_pte(vma, address, page, ptl);
71934+#endif
71935+
71936 unlock:
71937 pte_unmap_unlock(page_table, ptl);
71938 out:
66a7e928 71939@@ -2947,40 +3160,6 @@ out_release:
57199397
MT		 71940 }
71941
71942 /*
6892158b
MT		 71943- * This is like a special single-page "expand_{down|up}wards()",
71944- * except we must first make sure that 'address{-|+}PAGE_SIZE'
57199397 71945- * doesn't hit another vma.
57199397
MT		 71946- */
71947-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
71948-{
71949- address &= PAGE_MASK;
71950- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
71951- struct vm_area_struct *prev = vma->vm_prev;
71952-
71953- /*
71954- * Is there a mapping abutting this one below?
71955- *
71956- * That's only ok if it's the same stack mapping
71957- * that has gotten split..
71958- */
71959- if (prev && prev->vm_end == address)
71960- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
71961-
71962- expand_stack(vma, address - PAGE_SIZE);
71963- }
6892158b
MT		 71964- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
71965- struct vm_area_struct *next = vma->vm_next;
71966-
71967- /* As VM_GROWSDOWN but s/below/above/ */
71968- if (next && next->vm_start == address + PAGE_SIZE)
71969- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
71970-
71971- expand_upwards(vma, address + PAGE_SIZE);
71972- }
57199397
MT		 71973- return 0;
71974-}
71975-
71976-/*
71977 * We enter with non-exclusive mmap_sem (to exclude vma changes,
71978 * but allow concurrent faults), and pte mapped but not yet locked.
71979 * We return with mmap_sem still held, but pte unmapped and unlocked.
66a7e928 71980@@ -2989,27 +3168,23 @@ static int do_anonymous_page(struct mm_s
ae4e228f
MT		 71981 unsigned long address, pte_t *page_table, pmd_t *pmd,
71982 unsigned int flags)
71983 {
71984- struct page *page;
71985+ struct page *page = NULL;
71986 spinlock_t *ptl;
71987 pte_t entry;
71988
57199397
MT		 71989- pte_unmap(page_table);
71990-
71991- /* Check if we need to add a guard page to the stack */
71992- if (check_stack_guard_page(vma, address) < 0)
71993- return VM_FAULT_SIGBUS;
71994-
71995- /* Use the zero-page for reads */
71996 if (!(flags & FAULT_FLAG_WRITE)) {
71997 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
71998 vma->vm_page_prot));
71999- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72000+ ptl = pte_lockptr(mm, pmd);
72001+ spin_lock(ptl);
72002 if (!pte_none(*page_table))
72003 goto unlock;
72004 goto setpte;
72005 }
72006
72007 /* Allocate our own private page. */
72008+ pte_unmap(page_table);
72009+
72010 if (unlikely(anon_vma_prepare(vma)))
72011 goto oom;
72012 page = alloc_zeroed_user_highpage_movable(vma, address);
66a7e928 72013@@ -3028,6 +3203,11 @@ static int do_anonymous_page(struct mm_s
58c5fc13
MT		 72014 if (!pte_none(*page_table))
72015 goto release;
ae4e228f 72016
58c5fc13
MT		 72017+#ifdef CONFIG_PAX_SEGMEXEC
72018+ if (pax_find_mirror_vma(vma))
72019+ BUG_ON(!trylock_page(page));
72020+#endif
72021+
df50ba0c 72022 inc_mm_counter_fast(mm, MM_ANONPAGES);
58c5fc13 72023 page_add_new_anon_rmap(page, vma, address);
ae4e228f 72024 setpte:
66a7e928 72025@@ -3035,6 +3215,12 @@ setpte:
58c5fc13
MT		 72026
72027 /* No need to invalidate - it was non-present before */
df50ba0c 72028 update_mmu_cache(vma, address, page_table);
58c5fc13
MT		 72029+
72030+#ifdef CONFIG_PAX_SEGMEXEC
ae4e228f
MT		 72031+ if (page)
72032+ pax_mirror_anon_pte(vma, address, page, ptl);
58c5fc13
MT		 72033+#endif
72034+
72035 unlock:
72036 pte_unmap_unlock(page_table, ptl);
72037 return 0;
66a7e928 72038@@ -3172,6 +3358,12 @@ static int __do_fault(struct mm_struct *
58c5fc13
MT		 72039 */
72040 /* Only go through if we didn't race with anybody else... */
72041 if (likely(pte_same(*page_table, orig_pte))) {
72042+
72043+#ifdef CONFIG_PAX_SEGMEXEC
72044+ if (anon && pax_find_mirror_vma(vma))
72045+ BUG_ON(!trylock_page(page));
72046+#endif
72047+
72048 flush_icache_page(vma, page);
72049 entry = mk_pte(page, vma->vm_page_prot);
72050 if (flags & FAULT_FLAG_WRITE)
66a7e928 72051@@ -3191,6 +3383,14 @@ static int __do_fault(struct mm_struct *
58c5fc13
MT		 72052
72053 /* no need to invalidate: a not-present page won't be cached */
df50ba0c 72054 update_mmu_cache(vma, address, page_table);
58c5fc13
MT		 72055+
72056+#ifdef CONFIG_PAX_SEGMEXEC
72057+ if (anon)
72058+ pax_mirror_anon_pte(vma, address, page, ptl);
72059+ else
72060+ pax_mirror_file_pte(vma, address, page, ptl);
72061+#endif
72062+
72063 } else {
72064 if (charged)
72065 mem_cgroup_uncharge_page(page);
66a7e928 72066@@ -3338,6 +3538,12 @@ int handle_pte_fault(struct mm_struct *m
58c5fc13 72067 if (flags & FAULT_FLAG_WRITE)
bc901d79 72068 flush_tlb_fix_spurious_fault(vma, address);
58c5fc13
MT		 72069 }
72070+
72071+#ifdef CONFIG_PAX_SEGMEXEC
72072+ pax_mirror_pte(vma, address, pte, pmd, ptl);
72073+ return 0;
72074+#endif
72075+
72076 unlock:
72077 pte_unmap_unlock(pte, ptl);
72078 return 0;
66a7e928 72079@@ -3354,6 +3560,10 @@ int handle_mm_fault(struct mm_struct *mm
58c5fc13
MT		 72080 pmd_t *pmd;
72081 pte_t *pte;
72082
72083+#ifdef CONFIG_PAX_SEGMEXEC
72084+ struct vm_area_struct *vma_m;
72085+#endif
72086+
72087 __set_current_state(TASK_RUNNING);
72088
72089 count_vm_event(PGFAULT);
66a7e928 72090@@ -3364,6 +3574,34 @@ int handle_mm_fault(struct mm_struct *mm
58c5fc13
MT		 72091 if (unlikely(is_vm_hugetlb_page(vma)))
72092 return hugetlb_fault(mm, vma, address, flags);
72093
72094+#ifdef CONFIG_PAX_SEGMEXEC
72095+ vma_m = pax_find_mirror_vma(vma);
72096+ if (vma_m) {
72097+ unsigned long address_m;
72098+ pgd_t *pgd_m;
72099+ pud_t *pud_m;
72100+ pmd_t *pmd_m;
72101+
72102+ if (vma->vm_start > vma_m->vm_start) {
72103+ address_m = address;
72104+ address -= SEGMEXEC_TASK_SIZE;
72105+ vma = vma_m;
72106+ } else
72107+ address_m = address + SEGMEXEC_TASK_SIZE;
72108+
72109+ pgd_m = pgd_offset(mm, address_m);
72110+ pud_m = pud_alloc(mm, pgd_m, address_m);
72111+ if (!pud_m)
72112+ return VM_FAULT_OOM;
72113+ pmd_m = pmd_alloc(mm, pud_m, address_m);
72114+ if (!pmd_m)
72115+ return VM_FAULT_OOM;
16454cff 72116+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
58c5fc13
MT		 72117+ return VM_FAULT_OOM;
72118+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
72119+ }
72120+#endif
72121+
72122 pgd = pgd_offset(mm, address);
72123 pud = pud_alloc(mm, pgd, address);
72124 if (!pud)
66a7e928
MT		 72125@@ -3393,7 +3631,7 @@ int handle_mm_fault(struct mm_struct *mm
72126 * run pte_offset_map on the pmd, if an huge pmd could
72127 * materialize from under us from a different thread.
72128 */
72129- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
72130+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
72131 return VM_FAULT_OOM;
72132 /* if an huge pmd materialized from under us just retry later */
72133 if (unlikely(pmd_trans_huge(*pmd)))
72134@@ -3497,7 +3735,7 @@ static int __init gate_vma_init(void)
58c5fc13
MT		 72135 gate_vma.vm_start = FIXADDR_USER_START;
72136 gate_vma.vm_end = FIXADDR_USER_END;
72137 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72138- gate_vma.vm_page_prot = __P101;
72139+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72140 /*
72141 * Make sure the vDSO gets into every core dump.
72142 * Dumping its contents makes post-mortem fully interpretable later
66a7e928
MT		 72143diff -urNp linux-2.6.39/mm/memory-failure.c linux-2.6.39/mm/memory-failure.c
72144--- linux-2.6.39/mm/memory-failure.c 2011-05-19 00:06:34.000000000 -0400
72145+++ linux-2.6.39/mm/memory-failure.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 72146@@ -58,7 +58,7 @@ int sysctl_memory_failure_early_kill __r
57199397
MT		 72147
72148 int sysctl_memory_failure_recovery __read_mostly = 1;
72149
72150-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72151+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72152
72153 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
72154
16454cff 72155@@ -1012,7 +1012,7 @@ int __memory_failure(unsigned long pfn,
57199397
MT		 72156 }
72157
16454cff 72158 nr_pages = 1 << compound_trans_order(hpage);
6892158b
MT		 72159- atomic_long_add(nr_pages, &mce_bad_pages);
72160+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
57199397
MT		 72161
72162 /*
72163 * We need/can do nothing about count=0 pages.
16454cff 72164@@ -1042,7 +1042,7 @@ int __memory_failure(unsigned long pfn,
bc901d79
MT		 72165 if (!PageHWPoison(hpage)
72166 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
72167 || (p != hpage && TestSetPageHWPoison(hpage))) {
72168- atomic_long_sub(nr_pages, &mce_bad_pages);
72169+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72170 return 0;
72171 }
72172 set_page_hwpoison_huge_page(hpage);
16454cff 72173@@ -1100,7 +1100,7 @@ int __memory_failure(unsigned long pfn,
57199397
MT		 72174 }
72175 if (hwpoison_filter(p)) {
72176 if (TestClearPageHWPoison(p))
6892158b
MT		 72177- atomic_long_sub(nr_pages, &mce_bad_pages);
72178+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72179 unlock_page(hpage);
72180 put_page(hpage);
57199397 72181 return 0;
16454cff 72182@@ -1226,7 +1226,7 @@ int unpoison_memory(unsigned long pfn)
bc901d79
MT		 72183 return 0;
72184 }
57199397 72185 if (TestClearPageHWPoison(p))
6892158b
MT		 72186- atomic_long_sub(nr_pages, &mce_bad_pages);
72187+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
bc901d79 72188 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
57199397
MT		 72189 return 0;
72190 }
16454cff 72191@@ -1240,7 +1240,7 @@ int unpoison_memory(unsigned long pfn)
57199397 72192 */
6892158b 72193 if (TestClearPageHWPoison(page)) {
bc901d79 72194 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
6892158b
MT		 72195- atomic_long_sub(nr_pages, &mce_bad_pages);
72196+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
57199397 72197 freeit = 1;
bc901d79
MT		 72198 if (PageHuge(page))
72199 clear_page_hwpoison_huge_page(page);
16454cff 72200@@ -1353,7 +1353,7 @@ static int soft_offline_huge_page(struct
57199397 72201 }
bc901d79
MT		 72202 done:
72203 if (!PageHWPoison(hpage))
16454cff
MT		 72204- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
72205+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
bc901d79
MT		 72206 set_page_hwpoison_huge_page(hpage);
72207 dequeue_hwpoisoned_huge_page(hpage);
72208 /* keep elevated page count for bad page */
16454cff 72209@@ -1482,7 +1482,7 @@ int soft_offline_page(struct page *page,
57199397
MT		 72210 return ret;
72211
72212 done:
72213- atomic_long_add(1, &mce_bad_pages);
72214+ atomic_long_add_unchecked(1, &mce_bad_pages);
72215 SetPageHWPoison(page);
72216 /* keep elevated page count for bad page */
72217 return ret;
66a7e928
MT		 72218diff -urNp linux-2.6.39/mm/mempolicy.c linux-2.6.39/mm/mempolicy.c
72219--- linux-2.6.39/mm/mempolicy.c 2011-05-19 00:06:34.000000000 -0400
72220+++ linux-2.6.39/mm/mempolicy.c 2011-05-22 19:41:42.000000000 -0400
16454cff 72221@@ -643,6 +643,10 @@ static int mbind_range(struct mm_struct
df50ba0c
MT		 72222 unsigned long vmstart;
72223 unsigned long vmend;
58c5fc13
MT		 72224
72225+#ifdef CONFIG_PAX_SEGMEXEC
72226+ struct vm_area_struct *vma_m;
72227+#endif
72228+
df50ba0c
MT		 72229 vma = find_vma_prev(mm, start, &prev);
72230 if (!vma || vma->vm_start > start)
72231 return -EFAULT;
16454cff 72232@@ -673,6 +677,16 @@ static int mbind_range(struct mm_struct
df50ba0c 72233 err = policy_vma(vma, new_pol);
58c5fc13 72234 if (err)
df50ba0c 72235 goto out;
58c5fc13
MT		 72236+
72237+#ifdef CONFIG_PAX_SEGMEXEC
72238+ vma_m = pax_find_mirror_vma(vma);
72239+ if (vma_m) {
df50ba0c 72240+ err = policy_vma(vma_m, new_pol);
58c5fc13 72241+ if (err)
df50ba0c 72242+ goto out;
58c5fc13
MT		 72243+ }
72244+#endif
72245+
72246 }
df50ba0c
MT		 72247
72248 out:
16454cff 72249@@ -1106,6 +1120,17 @@ static long do_mbind(unsigned long start
58c5fc13
MT		 72250
72251 if (end < start)
72252 return -EINVAL;
72253+
72254+#ifdef CONFIG_PAX_SEGMEXEC
72255+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72256+ if (end > SEGMEXEC_TASK_SIZE)
72257+ return -EINVAL;
72258+ } else
72259+#endif
72260+
72261+ if (end > TASK_SIZE)
72262+ return -EINVAL;
72263+
72264 if (end == start)
72265 return 0;
72266
bc901d79 72267@@ -1324,6 +1349,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
58c5fc13 72268 if (!mm)
6892158b 72269 goto out;
58c5fc13
MT		 72270
72271+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72272+ if (mm != current->mm &&
72273+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72274+ err = -EPERM;
72275+ goto out;
72276+ }
72277+#endif
72278+
72279 /*
72280 * Check if this process has the right to modify the specified
72281 * process. The right exists if the process has administrative
bc901d79 72282@@ -1333,8 +1366,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
58c5fc13
MT		 72283 rcu_read_lock();
72284 tcred = __task_cred(task);
72285 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72286- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72287- !capable(CAP_SYS_NICE)) {
72288+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72289 rcu_read_unlock();
72290 err = -EPERM;
72291 goto out;
66a7e928 72292@@ -2634,7 +2666,7 @@ int show_numa_map(struct seq_file *m, vo
58c5fc13
MT		 72293
72294 if (file) {
72295 seq_printf(m, " file=");
72296- seq_path(m, &file->f_path, "\n\t= ");
72297+ seq_path(m, &file->f_path, "\n\t\\= ");
72298 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
72299 seq_printf(m, " heap");
72300 } else if (vma->vm_start <= mm->start_stack &&
66a7e928
MT		 72301diff -urNp linux-2.6.39/mm/migrate.c linux-2.6.39/mm/migrate.c
72302--- linux-2.6.39/mm/migrate.c 2011-05-19 00:06:34.000000000 -0400
72303+++ linux-2.6.39/mm/migrate.c 2011-05-22 19:41:42.000000000 -0400
72304@@ -1133,6 +1133,8 @@ static int do_pages_move(struct mm_struc
72305 unsigned long chunk_start;
72306 int err;
72307
72308+ pax_track_stack();
72309+
72310 task_nodes = cpuset_mems_allowed(task);
72311
72312 err = -ENOMEM;
72313@@ -1317,6 +1319,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
58c5fc13
MT		 72314 if (!mm)
72315 return -EINVAL;
72316
72317+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72318+ if (mm != current->mm &&
72319+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72320+ err = -EPERM;
72321+ goto out;
72322+ }
72323+#endif
72324+
72325 /*
72326 * Check if this process has the right to modify the specified
72327 * process. The right exists if the process has administrative
66a7e928 72328@@ -1326,8 +1336,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
58c5fc13
MT		 72329 rcu_read_lock();
72330 tcred = __task_cred(task);
72331 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72332- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72333- !capable(CAP_SYS_NICE)) {
72334+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72335 rcu_read_unlock();
72336 err = -EPERM;
72337 goto out;
66a7e928
MT		 72338diff -urNp linux-2.6.39/mm/mlock.c linux-2.6.39/mm/mlock.c
72339--- linux-2.6.39/mm/mlock.c 2011-05-19 00:06:34.000000000 -0400
72340+++ linux-2.6.39/mm/mlock.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 72341@@ -13,6 +13,7 @@
72342 #include <linux/pagemap.h>
72343 #include <linux/mempolicy.h>
72344 #include <linux/syscalls.h>
72345+#include <linux/security.h>
72346 #include <linux/sched.h>
72347 #include <linux/module.h>
72348 #include <linux/rmap.h>
66a7e928 72349@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
58c5fc13
MT		 72350 return -EINVAL;
72351 if (end == start)
72352 return 0;
58c5fc13
MT		 72353+ if (end > TASK_SIZE)
72354+ return -EINVAL;
72355+
72356 vma = find_vma_prev(current->mm, start, &prev);
72357 if (!vma || vma->vm_start > start)
72358 return -ENOMEM;
66a7e928 72359@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
57199397
MT		 72360 for (nstart = start ; ; ) {
72361 unsigned int newflags;
72362
72363+#ifdef CONFIG_PAX_SEGMEXEC
72364+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72365+ break;
72366+#endif
72367+
72368 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72369
72370 newflags = vma->vm_flags | VM_LOCKED;
66a7e928 72371@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
58c5fc13
MT		 72372 lock_limit >>= PAGE_SHIFT;
72373
72374 /* check against resource limits */
72375+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72376 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72377 error = do_mlock(start, len, 1);
72378 up_write(&current->mm->mmap_sem);
66a7e928 72379@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
58c5fc13
MT		 72380 static int do_mlockall(int flags)
72381 {
72382 struct vm_area_struct * vma, * prev = NULL;
72383- unsigned int def_flags = 0;
58c5fc13
MT		 72384
72385 if (flags & MCL_FUTURE)
72386- def_flags = VM_LOCKED;
57199397
MT		 72387- current->mm->def_flags = def_flags;
72388+ current->mm->def_flags |= VM_LOCKED;
72389+ else
72390+ current->mm->def_flags &= ~VM_LOCKED;
58c5fc13
MT		 72391 if (flags == MCL_FUTURE)
72392 goto out;
58c5fc13 72393
57199397
MT		 72394 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72395- unsigned int newflags;
72396+ unsigned long newflags;
72397+
58c5fc13
MT		 72398+#ifdef CONFIG_PAX_SEGMEXEC
72399+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72400+ break;
72401+#endif
57199397 72402
58c5fc13
MT		 72403+ BUG_ON(vma->vm_end > TASK_SIZE);
72404 newflags = vma->vm_flags | VM_LOCKED;
72405 if (!(flags & MCL_CURRENT))
72406 newflags &= ~VM_LOCKED;
66a7e928 72407@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
58c5fc13
MT		 72408 lock_limit >>= PAGE_SHIFT;
72409
72410 ret = -ENOMEM;
57199397 72411+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
58c5fc13
MT		 72412 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72413 capable(CAP_IPC_LOCK))
72414 ret = do_mlockall(flags);
66a7e928
MT		 72415diff -urNp linux-2.6.39/mm/mmap.c linux-2.6.39/mm/mmap.c
72416--- linux-2.6.39/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
72417+++ linux-2.6.39/mm/mmap.c 2011-05-22 19:41:42.000000000 -0400
16454cff 72418@@ -46,6 +46,16 @@
58c5fc13
MT		 72419 #define arch_rebalance_pgtables(addr, len) (addr)
72420 #endif
72421
72422+static inline void verify_mm_writelocked(struct mm_struct *mm)
72423+{
72424+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72425+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72426+ up_read(&mm->mmap_sem);
72427+ BUG();
72428+ }
72429+#endif
72430+}
72431+
72432 static void unmap_region(struct mm_struct *mm,
72433 struct vm_area_struct *vma, struct vm_area_struct *prev,
72434 unsigned long start, unsigned long end);
16454cff 72435@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
58c5fc13
MT		 72436 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72437 *
72438 */
72439-pgprot_t protection_map[16] = {
72440+pgprot_t protection_map[16] __read_only = {
72441 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72442 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72443 };
72444
72445 pgprot_t vm_get_page_prot(unsigned long vm_flags)
72446 {
72447- return __pgprot(pgprot_val(protection_map[vm_flags &
72448+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72449 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72450 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72451+
72452+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
ae4e228f 72453+ if (!(__supported_pte_mask & _PAGE_NX) &&
58c5fc13
MT		 72454+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72455+ (vm_flags & (VM_READ | VM_WRITE)))
72456+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72457+#endif
72458+
72459+ return prot;
72460 }
72461 EXPORT_SYMBOL(vm_get_page_prot);
72462
57199397
MT		 72463 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72464 int sysctl_overcommit_ratio = 50; /* default is 50% */
72465 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72466+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72467 struct percpu_counter vm_committed_as;
72468
72469 /*
16454cff 72470@@ -232,6 +252,7 @@ static struct vm_area_struct *remove_vma
58c5fc13
MT		 72471 struct vm_area_struct *next = vma->vm_next;
72472
72473 might_sleep();
72474+ BUG_ON(vma->vm_mirror);
72475 if (vma->vm_ops && vma->vm_ops->close)
72476 vma->vm_ops->close(vma);
72477 if (vma->vm_file) {
16454cff 72478@@ -276,6 +297,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
58c5fc13
MT		 72479 * not page aligned -Ram Gupta
72480 */
df50ba0c 72481 rlim = rlimit(RLIMIT_DATA);
58c5fc13
MT		 72482+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72483 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72484 (mm->end_data - mm->start_data) > rlim)
72485 goto out;
16454cff 72486@@ -719,6 +741,12 @@ static int
58c5fc13
MT		 72487 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72488 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72489 {
72490+
72491+#ifdef CONFIG_PAX_SEGMEXEC
72492+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72493+ return 0;
72494+#endif
72495+
72496 if (is_mergeable_vma(vma, file, vm_flags) &&
72497 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72498 if (vma->vm_pgoff == vm_pgoff)
16454cff 72499@@ -738,6 +766,12 @@ static int
58c5fc13
MT		 72500 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72501 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72502 {
72503+
72504+#ifdef CONFIG_PAX_SEGMEXEC
72505+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72506+ return 0;
72507+#endif
72508+
72509 if (is_mergeable_vma(vma, file, vm_flags) &&
72510 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72511 pgoff_t vm_pglen;
16454cff 72512@@ -780,13 +814,20 @@ can_vma_merge_after(struct vm_area_struc
58c5fc13
MT		 72513 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72514 struct vm_area_struct *prev, unsigned long addr,
72515 unsigned long end, unsigned long vm_flags,
72516- struct anon_vma *anon_vma, struct file *file,
72517+ struct anon_vma *anon_vma, struct file *file,
72518 pgoff_t pgoff, struct mempolicy *policy)
72519 {
72520 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72521 struct vm_area_struct *area, *next;
df50ba0c 72522 int err;
58c5fc13
MT		 72523
72524+#ifdef CONFIG_PAX_SEGMEXEC
72525+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72526+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72527+
72528+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72529+#endif
72530+
72531 /*
72532 * We later require that vma->vm_flags == vm_flags,
72533 * so this tests vma->vm_flags & VM_SPECIAL, too.
16454cff 72534@@ -802,6 +843,15 @@ struct vm_area_struct *vma_merge(struct
58c5fc13
MT		 72535 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72536 next = next->vm_next;
72537
72538+#ifdef CONFIG_PAX_SEGMEXEC
72539+ if (prev)
72540+ prev_m = pax_find_mirror_vma(prev);
72541+ if (area)
72542+ area_m = pax_find_mirror_vma(area);
72543+ if (next)
72544+ next_m = pax_find_mirror_vma(next);
72545+#endif
72546+
72547 /*
72548 * Can it merge with the predecessor?
72549 */
16454cff 72550@@ -821,9 +871,24 @@ struct vm_area_struct *vma_merge(struct
58c5fc13 72551 /* cases 1, 6 */
df50ba0c 72552 err = vma_adjust(prev, prev->vm_start,
58c5fc13
MT		 72553 next->vm_end, prev->vm_pgoff, NULL);
72554- } else /* cases 2, 5, 7 */
72555+
72556+#ifdef CONFIG_PAX_SEGMEXEC
df50ba0c
MT		 72557+ if (!err && prev_m)
72558+ err = vma_adjust(prev_m, prev_m->vm_start,
58c5fc13
MT		 72559+ next_m->vm_end, prev_m->vm_pgoff, NULL);
72560+#endif
72561+
72562+ } else { /* cases 2, 5, 7 */
df50ba0c 72563 err = vma_adjust(prev, prev->vm_start,
58c5fc13
MT		 72564 end, prev->vm_pgoff, NULL);
72565+
72566+#ifdef CONFIG_PAX_SEGMEXEC
df50ba0c
MT		 72567+ if (!err && prev_m)
72568+ err = vma_adjust(prev_m, prev_m->vm_start,
72569+ end_m, prev_m->vm_pgoff, NULL);
58c5fc13
MT		 72570+#endif
72571+
72572+ }
df50ba0c
MT		 72573 if (err)
72574 return NULL;
16454cff
MT		 72575 khugepaged_enter_vma_merge(prev);
72576@@ -837,12 +902,27 @@ struct vm_area_struct *vma_merge(struct
58c5fc13
MT		 72577 mpol_equal(policy, vma_policy(next)) &&
72578 can_vma_merge_before(next, vm_flags,
72579 anon_vma, file, pgoff+pglen)) {
72580- if (prev && addr < prev->vm_end) /* case 4 */
72581+ if (prev && addr < prev->vm_end) { /* case 4 */
df50ba0c 72582 err = vma_adjust(prev, prev->vm_start,
58c5fc13
MT		 72583 addr, prev->vm_pgoff, NULL);
72584- else /* cases 3, 8 */
72585+
72586+#ifdef CONFIG_PAX_SEGMEXEC
df50ba0c
MT		 72587+ if (!err && prev_m)
72588+ err = vma_adjust(prev_m, prev_m->vm_start,
72589+ addr_m, prev_m->vm_pgoff, NULL);
58c5fc13
MT		 72590+#endif
72591+
72592+ } else { /* cases 3, 8 */
df50ba0c 72593 err = vma_adjust(area, addr, next->vm_end,
58c5fc13
MT		 72594 next->vm_pgoff - pglen, NULL);
72595+
72596+#ifdef CONFIG_PAX_SEGMEXEC
df50ba0c
MT		 72597+ if (!err && area_m)
72598+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
72599+ next_m->vm_pgoff - pglen, NULL);
58c5fc13
MT		 72600+#endif
72601+
72602+ }
df50ba0c
MT		 72603 if (err)
72604 return NULL;
16454cff
MT		 72605 khugepaged_enter_vma_merge(area);
72606@@ -958,14 +1038,11 @@ none:
58c5fc13
MT		 72607 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72608 struct file *file, long pages)
72609 {
72610- const unsigned long stack_flags
72611- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72612-
72613 if (file) {
72614 mm->shared_vm += pages;
72615 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72616 mm->exec_vm += pages;
72617- } else if (flags & stack_flags)
72618+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72619 mm->stack_vm += pages;
72620 if (flags & (VM_RESERVED|VM_IO))
72621 mm->reserved_vm += pages;
16454cff 72622@@ -992,7 +1069,7 @@ unsigned long do_mmap_pgoff(struct file
58c5fc13
MT		 72623 * (the exception is when the underlying filesystem is noexec
72624 * mounted, in which case we dont add PROT_EXEC.)
72625 */
72626- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72627+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72628 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72629 prot |= PROT_EXEC;
72630
16454cff 72631@@ -1018,7 +1095,7 @@ unsigned long do_mmap_pgoff(struct file
58c5fc13
MT		 72632 /* Obtain the address to map to. we verify (or select) it and ensure
72633 * that it represents a valid section of the address space.
72634 */
72635- addr = get_unmapped_area(file, addr, len, pgoff, flags);
72636+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72637 if (addr & ~PAGE_MASK)
72638 return addr;
72639
16454cff 72640@@ -1029,6 +1106,36 @@ unsigned long do_mmap_pgoff(struct file
58c5fc13
MT		 72641 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72642 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72643
58c5fc13 72644+#ifdef CONFIG_PAX_MPROTECT
57199397 72645+ if (mm->pax_flags & MF_PAX_MPROTECT) {
c52201e0 72646+#ifndef CONFIG_PAX_MPROTECT_COMPAT
6892158b
MT		 72647+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72648+ gr_log_rwxmmap(file);
57199397
MT		 72649+
72650+#ifdef CONFIG_PAX_EMUPLT
72651+ vm_flags &= ~VM_EXEC;
72652+#else
72653+ return -EPERM;
58c5fc13
MT		 72654+#endif
72655+
6892158b
MT		 72656+ }
72657+
57199397
MT		 72658+ if (!(vm_flags & VM_EXEC))
72659+ vm_flags &= ~VM_MAYEXEC;
c52201e0
MT		 72660+#else
72661+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72662+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72663+#endif
57199397
MT		 72664+ else
72665+ vm_flags &= ~VM_MAYWRITE;
58c5fc13
MT		 72666+ }
72667+#endif
72668+
72669+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72670+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72671+ vm_flags &= ~VM_PAGEEXEC;
72672+#endif
72673+
ae4e228f 72674 if (flags & MAP_LOCKED)
58c5fc13
MT		 72675 if (!can_do_mlock())
72676 return -EPERM;
16454cff 72677@@ -1040,6 +1147,7 @@ unsigned long do_mmap_pgoff(struct file
58c5fc13 72678 locked += mm->locked_vm;
df50ba0c 72679 lock_limit = rlimit(RLIMIT_MEMLOCK);
58c5fc13
MT		 72680 lock_limit >>= PAGE_SHIFT;
72681+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72682 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72683 return -EAGAIN;
72684 }
16454cff 72685@@ -1110,6 +1218,9 @@ unsigned long do_mmap_pgoff(struct file
58c5fc13
MT		 72686 if (error)
72687 return error;
72688
72689+ if (!gr_acl_handle_mmap(file, prot))
72690+ return -EACCES;
72691+
72692 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72693 }
72694 EXPORT_SYMBOL(do_mmap_pgoff);
16454cff 72695@@ -1187,10 +1298,10 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_ar
58c5fc13
MT		 72696 */
72697 int vma_wants_writenotify(struct vm_area_struct *vma)
72698 {
72699- unsigned int vm_flags = vma->vm_flags;
72700+ unsigned long vm_flags = vma->vm_flags;
72701
72702 /* If it was private or non-writable, the write bit is already clear */
72703- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72704+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72705 return 0;
72706
72707 /* The backer wishes to know when pages are first written to? */
16454cff 72708@@ -1239,14 +1350,24 @@ unsigned long mmap_region(struct file *f
58c5fc13
MT		 72709 unsigned long charged = 0;
72710 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72711
72712+#ifdef CONFIG_PAX_SEGMEXEC
72713+ struct vm_area_struct *vma_m = NULL;
72714+#endif
72715+
72716+ /*
72717+ * mm->mmap_sem is required to protect against another thread
72718+ * changing the mappings in case we sleep.
72719+ */
72720+ verify_mm_writelocked(mm);
72721+
72722 /* Clear old maps */
72723 error = -ENOMEM;
72724-munmap_back:
72725 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72726 if (vma && vma->vm_start < addr + len) {
72727 if (do_munmap(mm, addr, len))
72728 return -ENOMEM;
72729- goto munmap_back;
72730+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72731+ BUG_ON(vma && vma->vm_start < addr + len);
72732 }
72733
72734 /* Check against address space limit. */
16454cff 72735@@ -1295,6 +1416,16 @@ munmap_back:
58c5fc13
MT		 72736 goto unacct_error;
72737 }
72738
72739+#ifdef CONFIG_PAX_SEGMEXEC
72740+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72741+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72742+ if (!vma_m) {
72743+ error = -ENOMEM;
72744+ goto free_vma;
72745+ }
72746+ }
72747+#endif
72748+
72749 vma->vm_mm = mm;
72750 vma->vm_start = addr;
72751 vma->vm_end = addr + len;
16454cff 72752@@ -1318,6 +1449,19 @@ munmap_back:
58c5fc13
MT		 72753 error = file->f_op->mmap(file, vma);
72754 if (error)
72755 goto unmap_and_free_vma;
72756+
72757+#ifdef CONFIG_PAX_SEGMEXEC
72758+ if (vma_m && (vm_flags & VM_EXECUTABLE))
72759+ added_exe_file_vma(mm);
72760+#endif
72761+
72762+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72763+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
72764+ vma->vm_flags |= VM_PAGEEXEC;
72765+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72766+ }
72767+#endif
72768+
72769 if (vm_flags & VM_EXECUTABLE)
72770 added_exe_file_vma(mm);
ae4e228f 72771
16454cff 72772@@ -1353,6 +1497,11 @@ munmap_back:
58c5fc13
MT		 72773 vma_link(mm, vma, prev, rb_link, rb_parent);
72774 file = vma->vm_file;
72775
72776+#ifdef CONFIG_PAX_SEGMEXEC
72777+ if (vma_m)
df50ba0c 72778+ BUG_ON(pax_mirror_vma(vma_m, vma));
58c5fc13
MT		 72779+#endif
72780+
72781 /* Once vma denies write, undo our temporary denial count */
72782 if (correct_wcount)
72783 atomic_inc(&inode->i_writecount);
16454cff 72784@@ -1361,6 +1510,7 @@ out:
58c5fc13
MT		 72785
72786 mm->total_vm += len >> PAGE_SHIFT;
72787 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
72788+ track_exec_limit(mm, addr, addr + len, vm_flags);
72789 if (vm_flags & VM_LOCKED) {
df50ba0c
MT		 72790 if (!mlock_vma_pages_range(vma, addr, addr + len))
72791 mm->locked_vm += (len >> PAGE_SHIFT);
16454cff 72792@@ -1378,6 +1528,12 @@ unmap_and_free_vma:
58c5fc13
MT		 72793 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
72794 charged = 0;
72795 free_vma:
72796+
72797+#ifdef CONFIG_PAX_SEGMEXEC
72798+ if (vma_m)
72799+ kmem_cache_free(vm_area_cachep, vma_m);
72800+#endif
72801+
72802 kmem_cache_free(vm_area_cachep, vma);
72803 unacct_error:
72804 if (charged)
16454cff 72805@@ -1385,6 +1541,44 @@ unacct_error:
57199397
MT		 72806 return error;
72807 }
72808
16454cff 72809+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
57199397
MT		 72810+{
72811+ if (!vma) {
72812+#ifdef CONFIG_STACK_GROWSUP
72813+ if (addr > sysctl_heap_stack_gap)
72814+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
72815+ else
72816+ vma = find_vma(current->mm, 0);
72817+ if (vma && (vma->vm_flags & VM_GROWSUP))
72818+ return false;
72819+#endif
72820+ return true;
72821+ }
72822+
72823+ if (addr + len > vma->vm_start)
72824+ return false;
72825+
72826+ if (vma->vm_flags & VM_GROWSDOWN)
72827+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
72828+#ifdef CONFIG_STACK_GROWSUP
72829+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
72830+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
72831+#endif
72832+
72833+ return true;
72834+}
16454cff
MT		 72835+
72836+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
72837+{
72838+ if (vma->vm_start < len)
72839+ return -ENOMEM;
72840+ if (!(vma->vm_flags & VM_GROWSDOWN))
72841+ return vma->vm_start - len;
72842+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
72843+ return vma->vm_start - len - sysctl_heap_stack_gap;
72844+ return -ENOMEM;
72845+}
57199397
MT		 72846+
72847 /* Get an address range which is currently unmapped.
72848 * For shmat() with addr=0.
72849 *
16454cff 72850@@ -1411,18 +1605,23 @@ arch_get_unmapped_area(struct file *filp
58c5fc13
MT		 72851 if (flags & MAP_FIXED)
72852 return addr;
72853
72854+#ifdef CONFIG_PAX_RANDMMAP
72855+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72856+#endif
72857+
72858 if (addr) {
72859 addr = PAGE_ALIGN(addr);
57199397
MT		 72860- vma = find_vma(mm, addr);
72861- if (TASK_SIZE - len >= addr &&
72862- (!vma || addr + len <= vma->vm_start))
72863- return addr;
72864+ if (TASK_SIZE - len >= addr) {
72865+ vma = find_vma(mm, addr);
72866+ if (check_heap_stack_gap(vma, addr, len))
72867+ return addr;
72868+ }
58c5fc13
MT		 72869 }
72870 if (len > mm->cached_hole_size) {
72871- start_addr = addr = mm->free_area_cache;
72872+ start_addr = addr = mm->free_area_cache;
72873 } else {
72874- start_addr = addr = TASK_UNMAPPED_BASE;
72875- mm->cached_hole_size = 0;
72876+ start_addr = addr = mm->mmap_base;
72877+ mm->cached_hole_size = 0;
72878 }
72879
72880 full_search:
16454cff 72881@@ -1433,34 +1632,40 @@ full_search:
58c5fc13
MT		 72882 * Start a new search - just in case we missed
72883 * some holes.
72884 */
72885- if (start_addr != TASK_UNMAPPED_BASE) {
72886- addr = TASK_UNMAPPED_BASE;
72887- start_addr = addr;
72888+ if (start_addr != mm->mmap_base) {
72889+ start_addr = addr = mm->mmap_base;
72890 mm->cached_hole_size = 0;
72891 goto full_search;
72892 }
57199397
MT		 72893 return -ENOMEM;
72894 }
72895- if (!vma || addr + len <= vma->vm_start) {
72896- /*
72897- * Remember the place where we stopped the search:
72898- */
72899- mm->free_area_cache = addr + len;
72900- return addr;
72901- }
72902+ if (check_heap_stack_gap(vma, addr, len))
72903+ break;
72904 if (addr + mm->cached_hole_size < vma->vm_start)
72905 mm->cached_hole_size = vma->vm_start - addr;
72906 addr = vma->vm_end;
72907 }
72908+
72909+ /*
72910+ * Remember the place where we stopped the search:
72911+ */
72912+ mm->free_area_cache = addr + len;
72913+ return addr;
72914 }
72915 #endif
58c5fc13
MT		 72916
72917 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
72918 {
72919+
72920+#ifdef CONFIG_PAX_SEGMEXEC
72921+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72922+ return;
72923+#endif
72924+
72925 /*
72926 * Is this a new hole at the lowest possible address?
72927 */
72928- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
72929+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
72930 mm->free_area_cache = addr;
72931 mm->cached_hole_size = ~0UL;
72932 }
16454cff 72933@@ -1478,7 +1683,7 @@ arch_get_unmapped_area_topdown(struct fi
58c5fc13
MT		 72934 {
72935 struct vm_area_struct *vma;
72936 struct mm_struct *mm = current->mm;
72937- unsigned long addr = addr0;
72938+ unsigned long base = mm->mmap_base, addr = addr0;
72939
72940 /* requested length too big for entire address space */
72941 if (len > TASK_SIZE)
16454cff 72942@@ -1487,13 +1692,18 @@ arch_get_unmapped_area_topdown(struct fi
58c5fc13
MT		 72943 if (flags & MAP_FIXED)
72944 return addr;
72945
72946+#ifdef CONFIG_PAX_RANDMMAP
72947+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72948+#endif
72949+
72950 /* requesting a specific address */
72951 if (addr) {
72952 addr = PAGE_ALIGN(addr);
57199397
MT		 72953- vma = find_vma(mm, addr);
72954- if (TASK_SIZE - len >= addr &&
72955- (!vma || addr + len <= vma->vm_start))
72956- return addr;
72957+ if (TASK_SIZE - len >= addr) {
72958+ vma = find_vma(mm, addr);
72959+ if (check_heap_stack_gap(vma, addr, len))
72960+ return addr;
72961+ }
72962 }
72963
72964 /* check if free_area_cache is useful for us */
16454cff 72965@@ -1508,7 +1718,7 @@ arch_get_unmapped_area_topdown(struct fi
57199397
MT		 72966 /* make sure it can fit in the remaining address space */
72967 if (addr > len) {
72968 vma = find_vma(mm, addr-len);
72969- if (!vma || addr <= vma->vm_start)
72970+ if (check_heap_stack_gap(vma, addr - len, len))
72971 /* remember the address as a hint for next time */
72972 return (mm->free_area_cache = addr-len);
72973 }
16454cff 72974@@ -1525,7 +1735,7 @@ arch_get_unmapped_area_topdown(struct fi
57199397
MT		 72975 * return with success:
72976 */
72977 vma = find_vma(mm, addr);
72978- if (!vma || addr+len <= vma->vm_start)
72979+ if (check_heap_stack_gap(vma, addr, len))
72980 /* remember the address as a hint for next time */
72981 return (mm->free_area_cache = addr);
72982
16454cff
MT		 72983@@ -1534,8 +1744,8 @@ arch_get_unmapped_area_topdown(struct fi
72984 mm->cached_hole_size = vma->vm_start - addr;
72985
72986 /* try just below the current vma->vm_start */
72987- addr = vma->vm_start-len;
72988- } while (len < vma->vm_start);
72989+ addr = skip_heap_stack_gap(vma, len);
72990+ } while (!IS_ERR_VALUE(addr));
72991
72992 bottomup:
72993 /*
72994@@ -1544,13 +1754,21 @@ bottomup:
58c5fc13
MT		 72995 * can happen with large stack limits and large mmap()
72996 * allocations.
72997 */
72998+ mm->mmap_base = TASK_UNMAPPED_BASE;
72999+
73000+#ifdef CONFIG_PAX_RANDMMAP
73001+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73002+ mm->mmap_base += mm->delta_mmap;
73003+#endif
73004+
73005+ mm->free_area_cache = mm->mmap_base;
73006 mm->cached_hole_size = ~0UL;
73007- mm->free_area_cache = TASK_UNMAPPED_BASE;
73008 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
73009 /*
73010 * Restore the topdown base:
73011 */
73012- mm->free_area_cache = mm->mmap_base;
73013+ mm->mmap_base = base;
73014+ mm->free_area_cache = base;
73015 mm->cached_hole_size = ~0UL;
73016
73017 return addr;
16454cff 73018@@ -1559,6 +1777,12 @@ bottomup:
58c5fc13
MT		 73019
73020 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
73021 {
73022+
73023+#ifdef CONFIG_PAX_SEGMEXEC
73024+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73025+ return;
73026+#endif
73027+
73028 /*
73029 * Is this a new hole at the highest possible address?
73030 */
16454cff 73031@@ -1566,8 +1790,10 @@ void arch_unmap_area_topdown(struct mm_s
58c5fc13
MT		 73032 mm->free_area_cache = addr;
73033
73034 /* dont allow allocations above current base */
73035- if (mm->free_area_cache > mm->mmap_base)
73036+ if (mm->free_area_cache > mm->mmap_base) {
73037 mm->free_area_cache = mm->mmap_base;
73038+ mm->cached_hole_size = ~0UL;
73039+ }
73040 }
73041
73042 unsigned long
16454cff 73043@@ -1675,6 +1901,28 @@ out:
58c5fc13
MT		 73044 return prev ? prev->vm_next : vma;
73045 }
73046
73047+#ifdef CONFIG_PAX_SEGMEXEC
73048+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
73049+{
73050+ struct vm_area_struct *vma_m;
73051+
73052+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
73053+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
73054+ BUG_ON(vma->vm_mirror);
73055+ return NULL;
73056+ }
73057+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
73058+ vma_m = vma->vm_mirror;
73059+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
73060+ BUG_ON(vma->vm_file != vma_m->vm_file);
73061+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
57199397 73062+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
6892158b
MT		 73063+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
73064+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
58c5fc13
MT		 73065+ return vma_m;
73066+}
73067+#endif
73068+
73069 /*
73070 * Verify that the stack growth is acceptable and
73071 * update accounting. This is shared with both the
16454cff 73072@@ -1691,6 +1939,7 @@ static int acct_stack_growth(struct vm_a
58c5fc13
MT		 73073 return -ENOMEM;
73074
73075 /* Stack limit test */
73076+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
df50ba0c 73077 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
58c5fc13
MT		 73078 return -ENOMEM;
73079
16454cff 73080@@ -1701,6 +1950,7 @@ static int acct_stack_growth(struct vm_a
58c5fc13 73081 locked = mm->locked_vm + grow;
df50ba0c
MT		 73082 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
73083 limit >>= PAGE_SHIFT;
58c5fc13
MT		 73084+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73085 if (locked > limit && !capable(CAP_IPC_LOCK))
73086 return -ENOMEM;
73087 }
16454cff 73088@@ -1731,37 +1981,48 @@ static int acct_stack_growth(struct vm_a
6892158b
MT		 73089 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
73090 * vma is the last one with address > vma->vm_end. Have to extend vma.
73091 */
73092+#ifndef CONFIG_IA64
73093+static
73094+#endif
58c5fc13
MT		 73095 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
73096 {
bc901d79
MT		 73097 int error;
73098+ bool locknext;
58c5fc13
MT		 73099
73100 if (!(vma->vm_flags & VM_GROWSUP))
73101 return -EFAULT;
73102
73103+ /* Also guard against wrapping around to address 0. */
73104+ if (address < PAGE_ALIGN(address+1))
73105+ address = PAGE_ALIGN(address+1);
73106+ else
73107+ return -ENOMEM;
73108+
73109 /*
73110 * We must make sure the anon_vma is allocated
73111 * so that the anon_vma locking is not a noop.
73112 */
73113 if (unlikely(anon_vma_prepare(vma)))
73114 return -ENOMEM;
73115+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
57199397 73116+ if (locknext && anon_vma_prepare(vma->vm_next))
58c5fc13 73117+ return -ENOMEM;
6892158b 73118 vma_lock_anon_vma(vma);
58c5fc13 73119+ if (locknext)
6892158b 73120+ vma_lock_anon_vma(vma->vm_next);
58c5fc13
MT		 73121
73122 /*
73123 * vma->vm_start/vm_end cannot change under us because the caller
73124 * is required to hold the mmap_sem in read mode. We need the
73125- * anon_vma lock to serialize against concurrent expand_stacks.
73126- * Also guard against wrapping around to address 0.
73127+ * anon_vma locks to serialize against concurrent expand_stacks
73128+ * and expand_upwards.
73129 */
73130- if (address < PAGE_ALIGN(address+4))
73131- address = PAGE_ALIGN(address+4);
73132- else {
6892158b 73133- vma_unlock_anon_vma(vma);
58c5fc13
MT		 73134- return -ENOMEM;
73135- }
73136 error = 0;
73137
73138 /* Somebody else might have raced and expanded it already */
73139- if (address > vma->vm_end) {
57199397
MT		 73140+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
73141+ error = -ENOMEM;
73142+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
58c5fc13
MT		 73143 unsigned long size, grow;
73144
73145 size = address - vma->vm_start;
66a7e928
MT		 73146@@ -1776,6 +2037,8 @@ int expand_upwards(struct vm_area_struct
73147 }
6892158b 73148 }
58c5fc13
MT		 73149 }
73150+ if (locknext)
6892158b
MT		 73151+ vma_unlock_anon_vma(vma->vm_next);
73152 vma_unlock_anon_vma(vma);
16454cff 73153 khugepaged_enter_vma_merge(vma);
58c5fc13 73154 return error;
66a7e928 73155@@ -1789,6 +2052,8 @@ static int expand_downwards(struct vm_ar
58c5fc13
MT		 73156 unsigned long address)
73157 {
bc901d79
MT		 73158 int error;
73159+ bool lockprev = false;
57199397 73160+ struct vm_area_struct *prev;
58c5fc13
MT		 73161
73162 /*
73163 * We must make sure the anon_vma is allocated
66a7e928 73164@@ -1802,6 +2067,15 @@ static int expand_downwards(struct vm_ar
58c5fc13
MT		 73165 if (error)
73166 return error;
73167
57199397 73168+ prev = vma->vm_prev;
58c5fc13 73169+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
58c5fc13
MT		 73170+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
73171+#endif
57199397 73172+ if (lockprev && anon_vma_prepare(prev))
58c5fc13
MT		 73173+ return -ENOMEM;
73174+ if (lockprev)
6892158b 73175+ vma_lock_anon_vma(prev);
58c5fc13 73176+
6892158b 73177 vma_lock_anon_vma(vma);
58c5fc13
MT		 73178
73179 /*
66a7e928 73180@@ -1811,9 +2085,17 @@ static int expand_downwards(struct vm_ar
58c5fc13
MT		 73181 */
73182
73183 /* Somebody else might have raced and expanded it already */
73184- if (address < vma->vm_start) {
57199397
MT		 73185+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
73186+ error = -ENOMEM;
73187+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
58c5fc13
MT		 73188 unsigned long size, grow;
73189
73190+#ifdef CONFIG_PAX_SEGMEXEC
73191+ struct vm_area_struct *vma_m;
73192+
73193+ vma_m = pax_find_mirror_vma(vma);
73194+#endif
73195+
73196 size = vma->vm_end - address;
73197 grow = (vma->vm_start - address) >> PAGE_SHIFT;
73198
66a7e928 73199@@ -1823,11 +2105,22 @@ static int expand_downwards(struct vm_ar
71d190be
MT		 73200 if (!error) {
73201 vma->vm_start = address;
73202 vma->vm_pgoff -= grow;
73203+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
58c5fc13
MT		 73204+
73205+#ifdef CONFIG_PAX_SEGMEXEC
71d190be
MT		 73206+ if (vma_m) {
73207+ vma_m->vm_start -= grow << PAGE_SHIFT;
73208+ vma_m->vm_pgoff -= grow;
73209+ }
58c5fc13
MT		 73210+#endif
73211+
71d190be
MT		 73212 perf_event_mmap(vma);
73213 }
58c5fc13
MT		 73214 }
73215 }
6892158b 73216 vma_unlock_anon_vma(vma);
58c5fc13 73217+ if (lockprev)
6892158b 73218+ vma_unlock_anon_vma(prev);
16454cff 73219 khugepaged_enter_vma_merge(vma);
58c5fc13
MT		 73220 return error;
73221 }
66a7e928 73222@@ -1902,6 +2195,13 @@ static void remove_vma_list(struct mm_st
58c5fc13
MT		 73223 do {
73224 long nrpages = vma_pages(vma);
73225
73226+#ifdef CONFIG_PAX_SEGMEXEC
73227+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73228+ vma = remove_vma(vma);
73229+ continue;
73230+ }
73231+#endif
73232+
73233 mm->total_vm -= nrpages;
73234 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
73235 vma = remove_vma(vma);
66a7e928 73236@@ -1947,6 +2247,16 @@ detach_vmas_to_be_unmapped(struct mm_str
58c5fc13 73237 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
57199397 73238 vma->vm_prev = NULL;
58c5fc13
MT		 73239 do {
73240+
73241+#ifdef CONFIG_PAX_SEGMEXEC
73242+ if (vma->vm_mirror) {
73243+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73244+ vma->vm_mirror->vm_mirror = NULL;
73245+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
73246+ vma->vm_mirror = NULL;
73247+ }
73248+#endif
73249+
73250 rb_erase(&vma->vm_rb, &mm->mm_rb);
73251 mm->map_count--;
73252 tail_vma = vma;
66a7e928 73253@@ -1975,14 +2285,33 @@ static int __split_vma(struct mm_struct
ae4e228f 73254 struct vm_area_struct *new;
df50ba0c 73255 int err = -ENOMEM;
ae4e228f 73256
58c5fc13 73257+#ifdef CONFIG_PAX_SEGMEXEC
ae4e228f 73258+ struct vm_area_struct *vma_m, *new_m = NULL;
58c5fc13 73259+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
ae4e228f 73260+#endif
58c5fc13 73261+
ae4e228f
MT		 73262 if (is_vm_hugetlb_page(vma) && (addr &
73263 ~(huge_page_mask(hstate_vma(vma)))))
73264 return -EINVAL;
73265
73266+#ifdef CONFIG_PAX_SEGMEXEC
58c5fc13 73267+ vma_m = pax_find_mirror_vma(vma);
ae4e228f 73268+#endif
58c5fc13 73269+
ae4e228f
MT		 73270 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73271 if (!new)
df50ba0c 73272 goto out_err;
ae4e228f
MT		 73273
73274+#ifdef CONFIG_PAX_SEGMEXEC
58c5fc13
MT		 73275+ if (vma_m) {
73276+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73277+ if (!new_m) {
73278+ kmem_cache_free(vm_area_cachep, new);
df50ba0c 73279+ goto out_err;
58c5fc13
MT		 73280+ }
73281+ }
ae4e228f 73282+#endif
58c5fc13 73283+
ae4e228f
MT		 73284 /* most fields are the same, copy all, and then fixup */
73285 *new = *vma;
73286
66a7e928 73287@@ -1995,6 +2324,22 @@ static int __split_vma(struct mm_struct
ae4e228f
MT		 73288 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73289 }
73290
73291+#ifdef CONFIG_PAX_SEGMEXEC
58c5fc13
MT		 73292+ if (vma_m) {
73293+ *new_m = *vma_m;
df50ba0c 73294+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
58c5fc13
MT		 73295+ new_m->vm_mirror = new;
73296+ new->vm_mirror = new_m;
73297+
73298+ if (new_below)
73299+ new_m->vm_end = addr_m;
73300+ else {
73301+ new_m->vm_start = addr_m;
73302+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73303+ }
73304+ }
ae4e228f
MT		 73305+#endif
73306+
73307 pol = mpol_dup(vma_policy(vma));
73308 if (IS_ERR(pol)) {
df50ba0c 73309 err = PTR_ERR(pol);
66a7e928 73310@@ -2020,6 +2365,42 @@ static int __split_vma(struct mm_struct
ae4e228f 73311 else
df50ba0c 73312 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
ae4e228f
MT		 73313
73314+#ifdef CONFIG_PAX_SEGMEXEC
df50ba0c
MT		 73315+ if (!err && vma_m) {
73316+ if (anon_vma_clone(new_m, vma_m))
73317+ goto out_free_mpol;
73318+
58c5fc13
MT		 73319+ mpol_get(pol);
73320+ vma_set_policy(new_m, pol);
73321+
73322+ if (new_m->vm_file) {
73323+ get_file(new_m->vm_file);
73324+ if (vma_m->vm_flags & VM_EXECUTABLE)
73325+ added_exe_file_vma(mm);
73326+ }
73327+
73328+ if (new_m->vm_ops && new_m->vm_ops->open)
73329+ new_m->vm_ops->open(new_m);
73330+
73331+ if (new_below)
df50ba0c 73332+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
58c5fc13
MT		 73333+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73334+ else
df50ba0c
MT		 73335+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73336+
73337+ if (err) {
73338+ if (new_m->vm_ops && new_m->vm_ops->close)
73339+ new_m->vm_ops->close(new_m);
73340+ if (new_m->vm_file) {
73341+ if (vma_m->vm_flags & VM_EXECUTABLE)
73342+ removed_exe_file_vma(mm);
73343+ fput(new_m->vm_file);
73344+ }
73345+ mpol_put(pol);
73346+ }
58c5fc13 73347+ }
ae4e228f 73348+#endif
58c5fc13 73349+
df50ba0c
MT		 73350 /* Success. */
73351 if (!err)
73352 return 0;
66a7e928 73353@@ -2032,10 +2413,18 @@ static int __split_vma(struct mm_struct
6892158b
MT		 73354 removed_exe_file_vma(mm);
73355 fput(new->vm_file);
73356 }
73357- unlink_anon_vmas(new);
df50ba0c
MT		 73358 out_free_mpol:
73359 mpol_put(pol);
73360 out_free_vma:
73361+
73362+#ifdef CONFIG_PAX_SEGMEXEC
73363+ if (new_m) {
73364+ unlink_anon_vmas(new_m);
73365+ kmem_cache_free(vm_area_cachep, new_m);
73366+ }
73367+#endif
73368+
73369+ unlink_anon_vmas(new);
73370 kmem_cache_free(vm_area_cachep, new);
73371 out_err:
73372 return err;
66a7e928 73373@@ -2048,6 +2437,15 @@ static int __split_vma(struct mm_struct
ae4e228f
MT		 73374 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73375 unsigned long addr, int new_below)
73376 {
73377+
73378+#ifdef CONFIG_PAX_SEGMEXEC
73379+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73380+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73381+ if (mm->map_count >= sysctl_max_map_count-1)
73382+ return -ENOMEM;
73383+ } else
58c5fc13 73384+#endif
ae4e228f
MT		 73385+
73386 if (mm->map_count >= sysctl_max_map_count)
73387 return -ENOMEM;
58c5fc13 73388
66a7e928 73389@@ -2059,11 +2457,30 @@ int split_vma(struct mm_struct *mm, stru
58c5fc13
MT		 73390 * work. This now handles partial unmappings.
73391 * Jeremy Fitzhardinge <jeremy@goop.org>
73392 */
73393+#ifdef CONFIG_PAX_SEGMEXEC
71d190be
MT		 73394+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73395+{
58c5fc13
MT		 73396+ int ret = __do_munmap(mm, start, len);
73397+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73398+ return ret;
73399+
73400+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73401+}
73402+
73403+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73404+#else
71d190be 73405 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
58c5fc13 73406+#endif
71d190be 73407 {
58c5fc13
MT		 73408 unsigned long end;
73409 struct vm_area_struct *vma, *prev, *last;
73410
73411+ /*
73412+ * mm->mmap_sem is required to protect against another thread
73413+ * changing the mappings in case we sleep.
73414+ */
73415+ verify_mm_writelocked(mm);
73416+
73417 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73418 return -EINVAL;
73419
66a7e928 73420@@ -2137,6 +2554,8 @@ int do_munmap(struct mm_struct *mm, unsi
58c5fc13
MT		 73421 /* Fix up all other VM information */
73422 remove_vma_list(mm, vma);
73423
73424+ track_exec_limit(mm, start, end, 0UL);
73425+
73426 return 0;
73427 }
73428
66a7e928 73429@@ -2149,22 +2568,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
58c5fc13
MT		 73430
73431 profile_munmap(addr);
73432
73433+#ifdef CONFIG_PAX_SEGMEXEC
73434+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73435+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73436+ return -EINVAL;
73437+#endif
73438+
73439 down_write(&mm->mmap_sem);
73440 ret = do_munmap(mm, addr, len);
73441 up_write(&mm->mmap_sem);
73442 return ret;
73443 }
73444
73445-static inline void verify_mm_writelocked(struct mm_struct *mm)
73446-{
73447-#ifdef CONFIG_DEBUG_VM
73448- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73449- WARN_ON(1);
73450- up_read(&mm->mmap_sem);
73451- }
73452-#endif
73453-}
73454-
73455 /*
73456 * this is really a simplified "do_mmap". it only handles
73457 * anonymous maps. eventually we may be able to do some
66a7e928 73458@@ -2178,6 +2593,7 @@ unsigned long do_brk(unsigned long addr,
58c5fc13
MT		 73459 struct rb_node ** rb_link, * rb_parent;
73460 pgoff_t pgoff = addr >> PAGE_SHIFT;
73461 int error;
73462+ unsigned long charged;
58c5fc13
MT		 73463
73464 len = PAGE_ALIGN(len);
73465 if (!len)
66a7e928 73466@@ -2189,16 +2605,30 @@ unsigned long do_brk(unsigned long addr,
58c5fc13
MT		 73467
73468 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73469
73470+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73471+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73472+ flags &= ~VM_EXEC;
73473+
73474+#ifdef CONFIG_PAX_MPROTECT
73475+ if (mm->pax_flags & MF_PAX_MPROTECT)
73476+ flags &= ~VM_MAYEXEC;
73477+#endif
73478+
73479+ }
73480+#endif
73481+
ae4e228f
MT		 73482 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73483 if (error & ~PAGE_MASK)
58c5fc13
MT		 73484 return error;
73485
73486+ charged = len >> PAGE_SHIFT;
73487+
73488 /*
73489 * mlock MCL_FUTURE?
73490 */
73491 if (mm->def_flags & VM_LOCKED) {
73492 unsigned long locked, lock_limit;
73493- locked = len >> PAGE_SHIFT;
73494+ locked = charged;
73495 locked += mm->locked_vm;
df50ba0c 73496 lock_limit = rlimit(RLIMIT_MEMLOCK);
58c5fc13 73497 lock_limit >>= PAGE_SHIFT;
66a7e928 73498@@ -2215,22 +2645,22 @@ unsigned long do_brk(unsigned long addr,
58c5fc13
MT		 73499 /*
73500 * Clear old maps. this also does some error checking for us
73501 */
73502- munmap_back:
73503 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73504 if (vma && vma->vm_start < addr + len) {
73505 if (do_munmap(mm, addr, len))
73506 return -ENOMEM;
73507- goto munmap_back;
73508+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73509+ BUG_ON(vma && vma->vm_start < addr + len);
73510 }
73511
73512 /* Check against address space limits *after* clearing old maps... */
73513- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73514+ if (!may_expand_vm(mm, charged))
73515 return -ENOMEM;
73516
73517 if (mm->map_count > sysctl_max_map_count)
73518 return -ENOMEM;
73519
73520- if (security_vm_enough_memory(len >> PAGE_SHIFT))
73521+ if (security_vm_enough_memory(charged))
73522 return -ENOMEM;
73523
73524 /* Can we just expand an old private anonymous mapping? */
66a7e928 73525@@ -2244,7 +2674,7 @@ unsigned long do_brk(unsigned long addr,
58c5fc13
MT		 73526 */
73527 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73528 if (!vma) {
73529- vm_unacct_memory(len >> PAGE_SHIFT);
73530+ vm_unacct_memory(charged);
73531 return -ENOMEM;
73532 }
73533
66a7e928 73534@@ -2258,11 +2688,12 @@ unsigned long do_brk(unsigned long addr,
58c5fc13
MT		 73535 vma_link(mm, vma, prev, rb_link, rb_parent);
73536 out:
6892158b 73537 perf_event_mmap(vma);
58c5fc13
MT		 73538- mm->total_vm += len >> PAGE_SHIFT;
73539+ mm->total_vm += charged;
73540 if (flags & VM_LOCKED) {
73541 if (!mlock_vma_pages_range(vma, addr, addr + len))
73542- mm->locked_vm += (len >> PAGE_SHIFT);
73543+ mm->locked_vm += charged;
73544 }
73545+ track_exec_limit(mm, addr, addr + len, flags);
73546 return addr;
73547 }
73548
66a7e928 73549@@ -2309,8 +2740,10 @@ void exit_mmap(struct mm_struct *mm)
58c5fc13
MT		 73550 * Walk the list again, actually closing and freeing it,
73551 * with preemption enabled, without holding any MM locks.
73552 */
73553- while (vma)
73554+ while (vma) {
73555+ vma->vm_mirror = NULL;
73556 vma = remove_vma(vma);
73557+ }
73558
73559 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73560 }
66a7e928 73561@@ -2324,6 +2757,13 @@ int insert_vm_struct(struct mm_struct *
58c5fc13
MT		 73562 struct vm_area_struct * __vma, * prev;
73563 struct rb_node ** rb_link, * rb_parent;
73564
73565+#ifdef CONFIG_PAX_SEGMEXEC
73566+ struct vm_area_struct *vma_m = NULL;
73567+#endif
bc901d79
MT		 73568+
73569+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
73570+ return -EPERM;
58c5fc13
MT		 73571+
73572 /*
73573 * The vm_pgoff of a purely anonymous vma should be irrelevant
73574 * until its first write fault, when page's anon_vma and index
66a7e928 73575@@ -2346,7 +2786,22 @@ int insert_vm_struct(struct mm_struct *
58c5fc13
MT		 73576 if ((vma->vm_flags & VM_ACCOUNT) &&
73577 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73578 return -ENOMEM;
73579+
73580+#ifdef CONFIG_PAX_SEGMEXEC
73581+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73582+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73583+ if (!vma_m)
73584+ return -ENOMEM;
73585+ }
73586+#endif
73587+
73588 vma_link(mm, vma, prev, rb_link, rb_parent);
73589+
73590+#ifdef CONFIG_PAX_SEGMEXEC
73591+ if (vma_m)
df50ba0c 73592+ BUG_ON(pax_mirror_vma(vma_m, vma));
58c5fc13
MT		 73593+#endif
73594+
73595 return 0;
73596 }
73597
66a7e928 73598@@ -2364,6 +2819,8 @@ struct vm_area_struct *copy_vma(struct v
58c5fc13
MT		 73599 struct rb_node **rb_link, *rb_parent;
73600 struct mempolicy *pol;
73601
73602+ BUG_ON(vma->vm_mirror);
73603+
73604 /*
73605 * If anonymous vma has not yet been faulted, update new pgoff
73606 * to match new location, to increase its chance of merging.
66a7e928 73607@@ -2413,6 +2870,39 @@ struct vm_area_struct *copy_vma(struct v
df50ba0c
MT		 73608 kmem_cache_free(vm_area_cachep, new_vma);
73609 return NULL;
58c5fc13 73610 }
df50ba0c 73611+
58c5fc13 73612+#ifdef CONFIG_PAX_SEGMEXEC
df50ba0c 73613+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
58c5fc13
MT		 73614+{
73615+ struct vm_area_struct *prev_m;
73616+ struct rb_node **rb_link_m, *rb_parent_m;
73617+ struct mempolicy *pol_m;
73618+
73619+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73620+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73621+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73622+ *vma_m = *vma;
df50ba0c
MT		 73623+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
73624+ if (anon_vma_clone(vma_m, vma))
73625+ return -ENOMEM;
58c5fc13
MT		 73626+ pol_m = vma_policy(vma_m);
73627+ mpol_get(pol_m);
73628+ vma_set_policy(vma_m, pol_m);
73629+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73630+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73631+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73632+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73633+ if (vma_m->vm_file)
73634+ get_file(vma_m->vm_file);
73635+ if (vma_m->vm_ops && vma_m->vm_ops->open)
73636+ vma_m->vm_ops->open(vma_m);
73637+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73638+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73639+ vma_m->vm_mirror = vma;
73640+ vma->vm_mirror = vma_m;
df50ba0c 73641+ return 0;
58c5fc13
MT		 73642+}
73643+#endif
df50ba0c 73644
58c5fc13
MT		 73645 /*
73646 * Return true if the calling process may expand its vm space by the passed
66a7e928 73647@@ -2424,7 +2914,7 @@ int may_expand_vm(struct mm_struct *mm,
58c5fc13
MT		 73648 unsigned long lim;
73649
df50ba0c 73650 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
58c5fc13
MT		 73651-
73652+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73653 if (cur + npages > lim)
73654 return 0;
73655 return 1;
66a7e928 73656@@ -2495,6 +2985,22 @@ int install_special_mapping(struct mm_st
58c5fc13
MT		 73657 vma->vm_start = addr;
73658 vma->vm_end = addr + len;
73659
73660+#ifdef CONFIG_PAX_MPROTECT
73661+ if (mm->pax_flags & MF_PAX_MPROTECT) {
c52201e0 73662+#ifndef CONFIG_PAX_MPROTECT_COMPAT
57199397
MT		 73663+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73664+ return -EPERM;
73665+ if (!(vm_flags & VM_EXEC))
73666+ vm_flags &= ~VM_MAYEXEC;
c52201e0
MT		 73667+#else
73668+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73669+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73670+#endif
58c5fc13 73671+ else
57199397 73672+ vm_flags &= ~VM_MAYWRITE;
58c5fc13
MT		 73673+ }
73674+#endif
73675+
73676 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73677 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73678
66a7e928
MT		 73679diff -urNp linux-2.6.39/mm/mprotect.c linux-2.6.39/mm/mprotect.c
73680--- linux-2.6.39/mm/mprotect.c 2011-05-19 00:06:34.000000000 -0400
73681+++ linux-2.6.39/mm/mprotect.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c 73682@@ -23,10 +23,16 @@
58c5fc13
MT		 73683 #include <linux/mmu_notifier.h>
73684 #include <linux/migrate.h>
ae4e228f 73685 #include <linux/perf_event.h>
58c5fc13
MT		 73686+
73687+#ifdef CONFIG_PAX_MPROTECT
73688+#include <linux/elf.h>
73689+#endif
73690+
73691 #include <asm/uaccess.h>
73692 #include <asm/pgtable.h>
73693 #include <asm/cacheflush.h>
73694 #include <asm/tlbflush.h>
73695+#include <asm/mmu_context.h>
73696
73697 #ifndef pgprot_modify
73698 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
16454cff 73699@@ -141,6 +147,48 @@ static void change_protection(struct vm_
58c5fc13
MT		 73700 flush_tlb_range(vma, start, end);
73701 }
73702
73703+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73704+/* called while holding the mmap semaphor for writing except stack expansion */
73705+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73706+{
73707+ unsigned long oldlimit, newlimit = 0UL;
73708+
ae4e228f 73709+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
58c5fc13
MT		 73710+ return;
73711+
73712+ spin_lock(&mm->page_table_lock);
73713+ oldlimit = mm->context.user_cs_limit;
73714+ if ((prot & VM_EXEC) && oldlimit < end)
73715+ /* USER_CS limit moved up */
73716+ newlimit = end;
73717+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73718+ /* USER_CS limit moved down */
73719+ newlimit = start;
73720+
73721+ if (newlimit) {
73722+ mm->context.user_cs_limit = newlimit;
73723+
73724+#ifdef CONFIG_SMP
73725+ wmb();
73726+ cpus_clear(mm->context.cpu_user_cs_mask);
73727+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73728+#endif
73729+
73730+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73731+ }
73732+ spin_unlock(&mm->page_table_lock);
73733+ if (newlimit == end) {
73734+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
73735+
73736+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
73737+ if (is_vm_hugetlb_page(vma))
73738+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73739+ else
73740+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73741+ }
73742+}
73743+#endif
73744+
73745 int
73746 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73747 unsigned long start, unsigned long end, unsigned long newflags)
16454cff 73748@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
58c5fc13
MT		 73749 int error;
73750 int dirty_accountable = 0;
73751
73752+#ifdef CONFIG_PAX_SEGMEXEC
73753+ struct vm_area_struct *vma_m = NULL;
73754+ unsigned long start_m, end_m;
73755+
73756+ start_m = start + SEGMEXEC_TASK_SIZE;
73757+ end_m = end + SEGMEXEC_TASK_SIZE;
73758+#endif
73759+
73760 if (newflags == oldflags) {
73761 *pprev = vma;
73762 return 0;
57199397
MT		 73763 }
73764
73765+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
73766+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
73767+
73768+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
73769+ return -ENOMEM;
73770+
73771+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
73772+ return -ENOMEM;
73773+ }
73774+
73775 /*
73776 * If we make a private mapping writable we increase our commit;
73777 * but (without finer accounting) cannot reduce our commit if we
16454cff 73778@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
58c5fc13
MT		 73779 }
73780 }
73781
73782+#ifdef CONFIG_PAX_SEGMEXEC
73783+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
73784+ if (start != vma->vm_start) {
73785+ error = split_vma(mm, vma, start, 1);
73786+ if (error)
73787+ goto fail;
73788+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
73789+ *pprev = (*pprev)->vm_next;
73790+ }
73791+
73792+ if (end != vma->vm_end) {
73793+ error = split_vma(mm, vma, end, 0);
73794+ if (error)
73795+ goto fail;
73796+ }
73797+
73798+ if (pax_find_mirror_vma(vma)) {
73799+ error = __do_munmap(mm, start_m, end_m - start_m);
73800+ if (error)
73801+ goto fail;
73802+ } else {
73803+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73804+ if (!vma_m) {
73805+ error = -ENOMEM;
73806+ goto fail;
73807+ }
73808+ vma->vm_flags = newflags;
df50ba0c
MT		 73809+ error = pax_mirror_vma(vma_m, vma);
73810+ if (error) {
73811+ vma->vm_flags = oldflags;
73812+ goto fail;
73813+ }
58c5fc13
MT		 73814+ }
73815+ }
73816+#endif
73817+
73818 /*
73819 * First try to merge with previous and/or next vma.
73820 */
16454cff 73821@@ -204,9 +306,21 @@ success:
df50ba0c 73822 * vm_flags and vm_page_prot are protected by the mmap_sem
58c5fc13
MT		 73823 * held in write mode.
73824 */
df50ba0c
MT		 73825+
73826+#ifdef CONFIG_PAX_SEGMEXEC
73827+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
73828+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
73829+#endif
73830+
58c5fc13
MT		 73831 vma->vm_flags = newflags;
73832+
73833+#ifdef CONFIG_PAX_MPROTECT
ae4e228f
MT		 73834+ if (mm->binfmt && mm->binfmt->handle_mprotect)
73835+ mm->binfmt->handle_mprotect(vma, newflags);
58c5fc13
MT		 73836+#endif
73837+
73838 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
73839- vm_get_page_prot(newflags));
73840+ vm_get_page_prot(vma->vm_flags));
73841
73842 if (vma_wants_writenotify(vma)) {
73843 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
16454cff 73844@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
58c5fc13
MT		 73845 end = start + len;
73846 if (end <= start)
73847 return -ENOMEM;
73848+
73849+#ifdef CONFIG_PAX_SEGMEXEC
73850+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73851+ if (end > SEGMEXEC_TASK_SIZE)
73852+ return -EINVAL;
73853+ } else
73854+#endif
73855+
73856+ if (end > TASK_SIZE)
73857+ return -EINVAL;
73858+
73859 if (!arch_validate_prot(prot))
73860 return -EINVAL;
73861
16454cff 73862@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
58c5fc13
MT		 73863 /*
73864 * Does the application expect PROT_READ to imply PROT_EXEC:
73865 */
73866- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73867+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73868 prot |= PROT_EXEC;
73869
73870 vm_flags = calc_vm_prot_bits(prot);
16454cff 73871@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
58c5fc13
MT		 73872 if (start > vma->vm_start)
73873 prev = vma;
73874
58c5fc13 73875+#ifdef CONFIG_PAX_MPROTECT
ae4e228f
MT		 73876+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
73877+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
58c5fc13
MT		 73878+#endif
73879+
73880 for (nstart = start ; ; ) {
73881 unsigned long newflags;
73882
16454cff 73883@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
6892158b
MT		 73884
73885 /* newflags >> 4 shift VM_MAY% in place of VM_% */
73886 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
73887+ if (prot & (PROT_WRITE | PROT_EXEC))
73888+ gr_log_rwxmprotect(vma->vm_file);
73889+
73890+ error = -EACCES;
73891+ goto out;
73892+ }
73893+
73894+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
73895 error = -EACCES;
73896 goto out;
73897 }
16454cff 73898@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
bc901d79 73899 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
58c5fc13
MT		 73900 if (error)
73901 goto out;
58c5fc13
MT		 73902+
73903+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
73904+
73905 nstart = tmp;
73906
73907 if (nstart < prev->vm_end)
66a7e928
MT		 73908diff -urNp linux-2.6.39/mm/mremap.c linux-2.6.39/mm/mremap.c
73909--- linux-2.6.39/mm/mremap.c 2011-05-19 00:06:34.000000000 -0400
73910+++ linux-2.6.39/mm/mremap.c 2011-05-22 19:36:33.000000000 -0400
16454cff 73911@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
58c5fc13
MT		 73912 continue;
73913 pte = ptep_clear_flush(vma, old_addr, old_pte);
73914 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
73915+
73916+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
ae4e228f 73917+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
58c5fc13
MT		 73918+ pte = pte_exprotect(pte);
73919+#endif
73920+
73921 set_pte_at(mm, new_addr, new_pte, pte);
73922 }
73923
16454cff 73924@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
ae4e228f
MT		 73925 if (is_vm_hugetlb_page(vma))
73926 goto Einval;
73927
73928+#ifdef CONFIG_PAX_SEGMEXEC
73929+ if (pax_find_mirror_vma(vma))
73930+ goto Einval;
73931+#endif
73932+
73933 /* We can't remap across vm area boundaries */
73934 if (old_len > vma->vm_end - addr)
73935 goto Efault;
71d190be 73936@@ -329,20 +340,25 @@ static unsigned long mremap_to(unsigned
ae4e228f
MT		 73937 unsigned long ret = -EINVAL;
73938 unsigned long charged = 0;
73939 unsigned long map_flags;
73940+ unsigned long pax_task_size = TASK_SIZE;
73941
73942 if (new_addr & ~PAGE_MASK)
73943 goto out;
73944
73945- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
73946+#ifdef CONFIG_PAX_SEGMEXEC
73947+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
73948+ pax_task_size = SEGMEXEC_TASK_SIZE;
73949+#endif
73950+
6892158b
MT		 73951+ pax_task_size -= PAGE_SIZE;
73952+
ae4e228f
MT		 73953+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
73954 goto out;
73955
73956 /* Check if the location we're moving into overlaps the
73957 * old location at all, and fail if it does.
73958 */
73959- if ((new_addr <= addr) && (new_addr+new_len) > addr)
73960- goto out;
73961-
73962- if ((addr <= new_addr) && (addr+old_len) > new_addr)
73963+ if (addr + old_len > new_addr && new_addr + new_len > addr)
73964 goto out;
73965
73966 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
71d190be 73967@@ -414,6 +430,7 @@ unsigned long do_mremap(unsigned long ad
58c5fc13
MT		 73968 struct vm_area_struct *vma;
73969 unsigned long ret = -EINVAL;
73970 unsigned long charged = 0;
73971+ unsigned long pax_task_size = TASK_SIZE;
73972
73973 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
73974 goto out;
71d190be 73975@@ -432,6 +449,17 @@ unsigned long do_mremap(unsigned long ad
58c5fc13
MT		 73976 if (!new_len)
73977 goto out;
73978
73979+#ifdef CONFIG_PAX_SEGMEXEC
ae4e228f 73980+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
58c5fc13
MT		 73981+ pax_task_size = SEGMEXEC_TASK_SIZE;
73982+#endif
73983+
6892158b
MT		 73984+ pax_task_size -= PAGE_SIZE;
73985+
58c5fc13
MT		 73986+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
73987+ old_len > pax_task_size || addr > pax_task_size-old_len)
73988+ goto out;
73989+
58c5fc13 73990 if (flags & MREMAP_FIXED) {
ae4e228f
MT		 73991 if (flags & MREMAP_MAYMOVE)
73992 ret = mremap_to(addr, old_len, new_addr, new_len);
71d190be 73993@@ -481,6 +509,7 @@ unsigned long do_mremap(unsigned long ad
58c5fc13
MT		 73994 addr + new_len);
73995 }
73996 ret = addr;
73997+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
73998 goto out;
73999 }
74000 }
71d190be 74001@@ -507,7 +536,13 @@ unsigned long do_mremap(unsigned long ad
ae4e228f
MT		 74002 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74003 if (ret)
74004 goto out;
74005+
58c5fc13
MT		 74006+ map_flags = vma->vm_flags;
74007 ret = move_vma(vma, addr, old_len, new_len, new_addr);
74008+ if (!(ret & ~PAGE_MASK)) {
74009+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
74010+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
74011+ }
74012 }
74013 out:
74014 if (ret & ~PAGE_MASK)
66a7e928
MT		 74015diff -urNp linux-2.6.39/mm/nobootmem.c linux-2.6.39/mm/nobootmem.c
74016--- linux-2.6.39/mm/nobootmem.c 2011-05-19 00:06:34.000000000 -0400
74017+++ linux-2.6.39/mm/nobootmem.c 2011-05-22 19:36:33.000000000 -0400
74018@@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
74019 unsigned long __init free_all_memory_core_early(int nodeid)
74020 {
74021 int i;
74022- u64 start, end;
74023+ u64 start, end, startrange, endrange;
74024 unsigned long count = 0;
74025- struct range *range = NULL;
74026+ struct range *range = NULL, rangerange = { 0, 0 };
74027 int nr_range;
74028
74029 nr_range = get_free_all_memory_range(&range, nodeid);
74030+ startrange = __pa(range) >> PAGE_SHIFT;
74031+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
74032
74033 for (i = 0; i < nr_range; i++) {
74034 start = range[i].start;
74035 end = range[i].end;
74036+ if (start <= endrange && startrange < end) {
74037+ BUG_ON(rangerange.start | rangerange.end);
74038+ rangerange = range[i];
74039+ continue;
74040+ }
74041 count += end - start;
74042 __free_pages_memory(start, end);
74043 }
74044+ start = rangerange.start;
74045+ end = rangerange.end;
74046+ count += end - start;
74047+ __free_pages_memory(start, end);
74048
74049 return count;
74050 }
74051diff -urNp linux-2.6.39/mm/nommu.c linux-2.6.39/mm/nommu.c
74052--- linux-2.6.39/mm/nommu.c 2011-05-19 00:06:34.000000000 -0400
74053+++ linux-2.6.39/mm/nommu.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 74054@@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
57199397
MT		 74055 int sysctl_overcommit_ratio = 50; /* default is 50% */
74056 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
74057 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
74058-int heap_stack_gap = 0;
74059
74060 atomic_long_t mmap_pages_allocated;
74061
16454cff 74062@@ -833,15 +832,6 @@ struct vm_area_struct *find_vma(struct m
58c5fc13
MT		 74063 EXPORT_SYMBOL(find_vma);
74064
74065 /*
74066- * find a VMA
74067- * - we don't extend stack VMAs under NOMMU conditions
74068- */
74069-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
74070-{
74071- return find_vma(mm, addr);
74072-}
74073-
74074-/*
74075 * expand a stack to a given address
74076 * - not supported under NOMMU conditions
74077 */
16454cff 74078@@ -1563,6 +1553,7 @@ int split_vma(struct mm_struct *mm, stru
df50ba0c
MT		 74079
74080 /* most fields are the same, copy all, and then fixup */
74081 *new = *vma;
74082+ INIT_LIST_HEAD(&new->anon_vma_chain);
74083 *region = *vma->vm_region;
74084 new->vm_region = region;
74085
66a7e928
MT		 74086diff -urNp linux-2.6.39/mm/page_alloc.c linux-2.6.39/mm/page_alloc.c
74087--- linux-2.6.39/mm/page_alloc.c 2011-05-19 00:06:34.000000000 -0400
74088+++ linux-2.6.39/mm/page_alloc.c 2011-05-22 19:36:33.000000000 -0400
74089@@ -650,6 +650,10 @@ static bool free_pages_prepare(struct pa
57199397 74090 int i;
58c5fc13 74091 int bad = 0;
58c5fc13
MT		 74092
74093+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74094+ unsigned long index = 1UL << order;
74095+#endif
74096+
df50ba0c 74097 trace_mm_page_free_direct(page, order);
58c5fc13
MT		 74098 kmemcheck_free_shadow(page, order);
74099
66a7e928 74100@@ -665,6 +669,12 @@ static bool free_pages_prepare(struct pa
58c5fc13
MT		 74101 debug_check_no_obj_freed(page_address(page),
74102 PAGE_SIZE << order);
74103 }
74104+
74105+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74106+ for (; index; --index)
74107+ sanitize_highpage(page + index - 1);
74108+#endif
74109+
74110 arch_free_page(page, order);
74111 kernel_map_pages(page, 1 << order, 0);
74112
66a7e928 74113@@ -780,8 +790,10 @@ static int prep_new_page(struct page *pa
58c5fc13
MT		 74114 arch_alloc_page(page, order);
74115 kernel_map_pages(page, 1 << order, 1);
74116
74117+#ifndef CONFIG_PAX_MEMORY_SANITIZE
74118 if (gfp_flags & __GFP_ZERO)
74119 prep_zero_page(page, order, gfp_flags);
74120+#endif
74121
74122 if (order && (gfp_flags & __GFP_COMP))
74123 prep_compound_page(page, order);
66a7e928
MT		 74124@@ -2504,6 +2516,8 @@ void __show_free_areas(unsigned int filt
74125 int cpu;
74126 struct zone *zone;
74127
74128+ pax_track_stack();
74129+
74130 for_each_populated_zone(zone) {
74131 if (skip_free_areas_zone(filter, zone))
74132 continue;
74133diff -urNp linux-2.6.39/mm/percpu.c linux-2.6.39/mm/percpu.c
74134--- linux-2.6.39/mm/percpu.c 2011-05-19 00:06:34.000000000 -0400
74135+++ linux-2.6.39/mm/percpu.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 74136@@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
ae4e228f 74137 static unsigned int pcpu_last_unit_cpu __read_mostly;
58c5fc13
MT		 74138
74139 /* the address of the first chunk which starts with the kernel static area */
74140-void *pcpu_base_addr __read_mostly;
74141+void *pcpu_base_addr __read_only;
74142 EXPORT_SYMBOL_GPL(pcpu_base_addr);
74143
ae4e228f 74144 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
66a7e928
MT		 74145diff -urNp linux-2.6.39/mm/rmap.c linux-2.6.39/mm/rmap.c
74146--- linux-2.6.39/mm/rmap.c 2011-05-19 00:06:34.000000000 -0400
74147+++ linux-2.6.39/mm/rmap.c 2011-05-22 19:36:33.000000000 -0400
74148@@ -131,6 +131,10 @@ int anon_vma_prepare(struct vm_area_stru
df50ba0c
MT		 74149 struct anon_vma *anon_vma = vma->anon_vma;
74150 struct anon_vma_chain *avc;
74151
74152+#ifdef CONFIG_PAX_SEGMEXEC
74153+ struct anon_vma_chain *avc_m = NULL;
74154+#endif
74155+
74156 might_sleep();
74157 if (unlikely(!anon_vma)) {
58c5fc13 74158 struct mm_struct *mm = vma->vm_mm;
66a7e928 74159@@ -140,6 +144,12 @@ int anon_vma_prepare(struct vm_area_stru
df50ba0c
MT		 74160 if (!avc)
74161 goto out_enomem;
74162
74163+#ifdef CONFIG_PAX_SEGMEXEC
74164+ avc_m = anon_vma_chain_alloc();
74165+ if (!avc_m)
74166+ goto out_enomem_free_avc;
74167+#endif
58c5fc13
MT		 74168+
74169 anon_vma = find_mergeable_anon_vma(vma);
74170 allocated = NULL;
74171 if (!anon_vma) {
66a7e928 74172@@ -153,6 +163,21 @@ int anon_vma_prepare(struct vm_area_stru
57199397
MT		 74173 /* page_table_lock to protect against threads */
74174 spin_lock(&mm->page_table_lock);
74175 if (likely(!vma->anon_vma)) {
58c5fc13
MT		 74176+
74177+#ifdef CONFIG_PAX_SEGMEXEC
57199397
MT		 74178+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74179+
58c5fc13 74180+ if (vma_m) {
df50ba0c 74181+ BUG_ON(vma_m->anon_vma);
58c5fc13 74182+ vma_m->anon_vma = anon_vma;
df50ba0c
MT		 74183+ avc_m->anon_vma = anon_vma;
74184+ avc_m->vma = vma;
74185+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
74186+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
74187+ avc_m = NULL;
58c5fc13
MT		 74188+ }
74189+#endif
74190+
57199397
MT		 74191 vma->anon_vma = anon_vma;
74192 avc->anon_vma = anon_vma;
74193 avc->vma = vma;
66a7e928 74194@@ -166,12 +191,24 @@ int anon_vma_prepare(struct vm_area_stru
df50ba0c
MT		 74195
74196 if (unlikely(allocated))
66a7e928 74197 put_anon_vma(allocated);
df50ba0c
MT		 74198+
74199+#ifdef CONFIG_PAX_SEGMEXEC
74200+ if (unlikely(avc_m))
74201+ anon_vma_chain_free(avc_m);
74202+#endif
74203+
74204 if (unlikely(avc))
74205 anon_vma_chain_free(avc);
74206 }
74207 return 0;
74208
74209 out_enomem_free_avc:
74210+
74211+#ifdef CONFIG_PAX_SEGMEXEC
74212+ if (avc_m)
74213+ anon_vma_chain_free(avc_m);
74214+#endif
74215+
74216 anon_vma_chain_free(avc);
74217 out_enomem:
74218 return -ENOMEM;
66a7e928 74219@@ -198,7 +235,7 @@ static void anon_vma_chain_link(struct v
57199397
MT		 74220 * Attach the anon_vmas from src to dst.
74221 * Returns 0 on success, -ENOMEM on failure.
74222 */
74223-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
74224+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
74225 {
74226 struct anon_vma_chain *avc, *pavc;
74227
66a7e928 74228@@ -220,7 +257,7 @@ int anon_vma_clone(struct vm_area_struct
57199397
MT		 74229 * the corresponding VMA in the parent process is attached to.
74230 * Returns 0 on success, non-zero on failure.
74231 */
74232-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
74233+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
74234 {
74235 struct anon_vma_chain *avc;
74236 struct anon_vma *anon_vma;
66a7e928
MT		 74237diff -urNp linux-2.6.39/mm/shmem.c linux-2.6.39/mm/shmem.c
74238--- linux-2.6.39/mm/shmem.c 2011-05-19 00:06:34.000000000 -0400
74239+++ linux-2.6.39/mm/shmem.c 2011-05-22 19:41:42.000000000 -0400
6892158b
MT		 74240@@ -31,7 +31,7 @@
74241 #include <linux/percpu_counter.h>
58c5fc13 74242 #include <linux/swap.h>
58c5fc13
MT		 74243
74244-static struct vfsmount *shm_mnt;
74245+struct vfsmount *shm_mnt;
74246
74247 #ifdef CONFIG_SHMEM
74248 /*
66a7e928 74249@@ -1086,6 +1086,8 @@ static int shmem_writepage(struct page *
c52201e0
MT		 74250 goto unlock;
74251 }
74252 entry = shmem_swp_entry(info, index, NULL);
74253+ if (!entry)
74254+ goto unlock;
74255 if (entry->val) {
74256 /*
74257 * The more uptodate page coming down from a stacked
66a7e928
MT		 74258@@ -1157,6 +1159,8 @@ static struct page *shmem_swapin(swp_ent
74259 struct vm_area_struct pvma;
74260 struct page *page;
74261
74262+ pax_track_stack();
74263+
74264 spol = mpol_cond_copy(&mpol,
74265 mpol_shared_policy_lookup(&info->policy, idx));
74266
74267@@ -2013,7 +2017,7 @@ static int shmem_symlink(struct inode *d
71d190be
MT		 74268
74269 info = SHMEM_I(inode);
74270 inode->i_size = len-1;
74271- if (len <= (char *)inode - (char *)info) {
66a7e928 74272+ if (len <= (char *)inode - (char *)info && len <= 64) {
71d190be
MT		 74273 /* do it inline */
74274 memcpy(info, symname, len);
74275 inode->i_op = &shmem_symlink_inline_operations;
66a7e928
MT		 74276@@ -2361,8 +2365,7 @@ int shmem_fill_super(struct super_block
74277 int err = -ENOMEM;
74278
74279 /* Round up to L1_CACHE_BYTES to resist false sharing */
74280- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74281- L1_CACHE_BYTES), GFP_KERNEL);
74282+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74283 if (!sbinfo)
74284 return -ENOMEM;
74285
74286diff -urNp linux-2.6.39/mm/slab.c linux-2.6.39/mm/slab.c
74287--- linux-2.6.39/mm/slab.c 2011-05-19 00:06:34.000000000 -0400
74288+++ linux-2.6.39/mm/slab.c 2011-05-22 19:41:42.000000000 -0400
71d190be
MT		 74289@@ -150,7 +150,7 @@
74290
74291 /* Legal flag mask for kmem_cache_create(). */
74292 #if DEBUG
74293-# define CREATE_MASK (SLAB_RED_ZONE | \
74294+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74295 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74296 SLAB_CACHE_DMA | \
74297 SLAB_STORE_USER | \
74298@@ -158,7 +158,7 @@
74299 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74300 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74301 #else
74302-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74303+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74304 SLAB_CACHE_DMA | \
74305 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74306 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
66a7e928 74307@@ -287,7 +287,7 @@ struct kmem_list3 {
58c5fc13
MT		 74308 * Need this for bootstrapping a per node allocator.
74309 */
74310 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
16454cff
MT		 74311-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74312+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
58c5fc13
MT		 74313 #define CACHE_CACHE 0
74314 #define SIZE_AC MAX_NUMNODES
74315 #define SIZE_L3 (2 * MAX_NUMNODES)
66a7e928 74316@@ -388,10 +388,10 @@ static void kmem_list3_init(struct kmem_
8308f9c9
MT		 74317 if ((x)->max_freeable < i) \
74318 (x)->max_freeable = i; \
74319 } while (0)
74320-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74321-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74322-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74323-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74324+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74325+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74326+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74327+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74328 #else
74329 #define STATS_INC_ACTIVE(x) do { } while (0)
74330 #define STATS_DEC_ACTIVE(x) do { } while (0)
66a7e928 74331@@ -537,7 +537,7 @@ static inline void *index_to_obj(struct
58c5fc13
MT		 74332 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74333 */
74334 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74335- const struct slab *slab, void *obj)
74336+ const struct slab *slab, const void *obj)
74337 {
74338 u32 offset = (obj - slab->s_mem);
74339 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
66a7e928 74340@@ -563,7 +563,7 @@ struct cache_names {
58c5fc13
MT		 74341 static struct cache_names __initdata cache_names[] = {
74342 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
74343 #include <linux/kmalloc_sizes.h>
74344- {NULL,}
71d190be 74345+ {NULL}
58c5fc13
MT		 74346 #undef CACHE
74347 };
74348
66a7e928 74349@@ -1529,7 +1529,7 @@ void __init kmem_cache_init(void)
71d190be
MT		 74350 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74351 sizes[INDEX_AC].cs_size,
74352 ARCH_KMALLOC_MINALIGN,
74353- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74354+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74355 NULL);
74356
74357 if (INDEX_AC != INDEX_L3) {
66a7e928 74358@@ -1537,7 +1537,7 @@ void __init kmem_cache_init(void)
71d190be
MT		 74359 kmem_cache_create(names[INDEX_L3].name,
74360 sizes[INDEX_L3].cs_size,
74361 ARCH_KMALLOC_MINALIGN,
74362- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74363+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74364 NULL);
74365 }
74366
66a7e928 74367@@ -1555,7 +1555,7 @@ void __init kmem_cache_init(void)
71d190be
MT		 74368 sizes->cs_cachep = kmem_cache_create(names->name,
74369 sizes->cs_size,
74370 ARCH_KMALLOC_MINALIGN,
74371- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74372+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74373 NULL);
74374 }
74375 #ifdef CONFIG_ZONE_DMA
66a7e928 74376@@ -4270,10 +4270,10 @@ static int s_show(struct seq_file *m, vo
8308f9c9
MT		 74377 }
74378 /* cpu stats */
74379 {
74380- unsigned long allochit = atomic_read(&cachep->allochit);
74381- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74382- unsigned long freehit = atomic_read(&cachep->freehit);
74383- unsigned long freemiss = atomic_read(&cachep->freemiss);
74384+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74385+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74386+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74387+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74388
74389 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74390 allochit, allocmiss, freehit, freemiss);
66a7e928 74391@@ -4530,15 +4530,66 @@ static const struct file_operations proc
58c5fc13 74392
df50ba0c 74393 static int __init slab_proc_init(void)
58c5fc13 74394 {
df50ba0c
MT		 74395- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
74396+ mode_t gr_mode = S_IRUGO;
74397+
74398+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74399+ gr_mode = S_IRUSR;
74400+#endif
74401+
74402+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74403 #ifdef CONFIG_DEBUG_SLAB_LEAK
74404- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74405+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74406 #endif
74407 return 0;
74408 }
58c5fc13
MT		 74409 module_init(slab_proc_init);
74410 #endif
74411
74412+void check_object_size(const void *ptr, unsigned long n, bool to)
74413+{
74414+
74415+#ifdef CONFIG_PAX_USERCOPY
58c5fc13 74416+ struct page *page;
71d190be
MT		 74417+ struct kmem_cache *cachep = NULL;
74418+ struct slab *slabp;
58c5fc13
MT		 74419+ unsigned int objnr;
74420+ unsigned long offset;
74421+
74422+ if (!n)
74423+ return;
74424+
74425+ if (ZERO_OR_NULL_PTR(ptr))
74426+ goto report;
74427+
74428+ if (!virt_addr_valid(ptr))
74429+ return;
74430+
74431+ page = virt_to_head_page(ptr);
74432+
ae4e228f
MT		 74433+ if (!PageSlab(page)) {
74434+ if (object_is_on_stack(ptr, n) == -1)
74435+ goto report;
58c5fc13 74436+ return;
ae4e228f 74437+ }
58c5fc13
MT		 74438+
74439+ cachep = page_get_cache(page);
71d190be
MT		 74440+ if (!(cachep->flags & SLAB_USERCOPY))
74441+ goto report;
74442+
58c5fc13
MT		 74443+ slabp = page_get_slab(page);
74444+ objnr = obj_to_index(cachep, slabp, ptr);
74445+ BUG_ON(objnr >= cachep->num);
74446+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74447+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74448+ return;
74449+
74450+report:
71d190be 74451+ pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
58c5fc13
MT		 74452+#endif
74453+
74454+}
74455+EXPORT_SYMBOL(check_object_size);
74456+
74457 /**
74458 * ksize - get the actual amount of memory allocated for a given object
74459 * @objp: Pointer to the object
66a7e928
MT		 74460diff -urNp linux-2.6.39/mm/slob.c linux-2.6.39/mm/slob.c
74461--- linux-2.6.39/mm/slob.c 2011-05-19 00:06:34.000000000 -0400
74462+++ linux-2.6.39/mm/slob.c 2011-05-22 19:36:33.000000000 -0400
58c5fc13
MT		 74463@@ -29,7 +29,7 @@
74464 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74465 * alloc_pages() directly, allocating compound pages so the page order
74466 * does not have to be separately tracked, and also stores the exact
74467- * allocation size in page->private so that it can be used to accurately
74468+ * allocation size in slob_page->size so that it can be used to accurately
74469 * provide ksize(). These objects are detected in kfree() because slob_page()
74470 * is false for them.
74471 *
74472@@ -58,6 +58,7 @@
74473 */
74474
74475 #include <linux/kernel.h>
74476+#include <linux/sched.h>
74477 #include <linux/slab.h>
74478 #include <linux/mm.h>
74479 #include <linux/swap.h> /* struct reclaim_state */
6892158b 74480@@ -102,7 +103,8 @@ struct slob_page {
58c5fc13
MT		 74481 unsigned long flags; /* mandatory */
74482 atomic_t _count; /* mandatory */
74483 slobidx_t units; /* free units left in page */
74484- unsigned long pad[2];
74485+ unsigned long pad[1];
74486+ unsigned long size; /* size when >=PAGE_SIZE */
74487 slob_t *free; /* first free slob_t in page */
74488 struct list_head list; /* linked list of free pages */
74489 };
6892158b 74490@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
58c5fc13
MT		 74491 */
74492 static inline int is_slob_page(struct slob_page *sp)
74493 {
74494- return PageSlab((struct page *)sp);
74495+ return PageSlab((struct page *)sp) && !sp->size;
74496 }
74497
74498 static inline void set_slob_page(struct slob_page *sp)
6892158b 74499@@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
58c5fc13
MT		 74500
74501 static inline struct slob_page *slob_page(const void *addr)
74502 {
74503- return (struct slob_page *)virt_to_page(addr);
74504+ return (struct slob_page *)virt_to_head_page(addr);
74505 }
74506
74507 /*
6892158b 74508@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
58c5fc13
MT		 74509 /*
74510 * Return the size of a slob block.
74511 */
74512-static slobidx_t slob_units(slob_t *s)
74513+static slobidx_t slob_units(const slob_t *s)
74514 {
74515 if (s->units > 0)
74516 return s->units;
6892158b 74517@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
58c5fc13
MT		 74518 /*
74519 * Return the next free slob block pointer after this one.
74520 */
74521-static slob_t *slob_next(slob_t *s)
74522+static slob_t *slob_next(const slob_t *s)
74523 {
74524 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74525 slobidx_t next;
6892158b 74526@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
58c5fc13
MT		 74527 /*
74528 * Returns true if s is the last free block in its page.
74529 */
74530-static int slob_last(slob_t *s)
74531+static int slob_last(const slob_t *s)
74532 {
74533 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74534 }
6892158b 74535@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
58c5fc13
MT		 74536 if (!page)
74537 return NULL;
74538
74539+ set_slob_page(page);
74540 return page_address(page);
74541 }
74542
6892158b 74543@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
58c5fc13
MT		 74544 if (!b)
74545 return NULL;
74546 sp = slob_page(b);
74547- set_slob_page(sp);
74548
74549 spin_lock_irqsave(&slob_lock, flags);
74550 sp->units = SLOB_UNITS(PAGE_SIZE);
74551 sp->free = b;
74552+ sp->size = 0;
74553 INIT_LIST_HEAD(&sp->list);
74554 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74555 set_slob_page_free(sp, slob_list);
6892158b 74556@@ -476,10 +479,9 @@ out:
57199397
MT		 74557 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74558 */
58c5fc13
MT		 74559
74560-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74561+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74562 {
74563- unsigned int *m;
74564- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74565+ slob_t *m;
74566 void *ret;
74567
74568 lockdep_trace_alloc(gfp);
6892158b 74569@@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
58c5fc13
MT		 74570
74571 if (!m)
74572 return NULL;
74573- *m = size;
74574+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74575+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74576+ m[0].units = size;
74577+ m[1].units = align;
74578 ret = (void *)m + align;
74579
74580 trace_kmalloc_node(_RET_IP_, ret,
bc901d79
MT		 74581@@ -504,9 +509,9 @@ void *__kmalloc_node(size_t size, gfp_t
74582 gfp |= __GFP_COMP;
74583 ret = slob_new_pages(gfp, order, node);
58c5fc13
MT		 74584 if (ret) {
74585- struct page *page;
74586- page = virt_to_page(ret);
74587- page->private = size;
74588+ struct slob_page *sp;
74589+ sp = slob_page(ret);
74590+ sp->size = size;
74591 }
74592
74593 trace_kmalloc_node(_RET_IP_, ret,
bc901d79 74594@@ -516,6 +521,13 @@ void *__kmalloc_node(size_t size, gfp_t
58c5fc13
MT		 74595 kmemleak_alloc(ret, size, 1, gfp);
74596 return ret;
74597 }
74598+
74599+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74600+{
74601+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74602+
74603+ return __kmalloc_node_align(size, gfp, node, align);
74604+}
74605 EXPORT_SYMBOL(__kmalloc_node);
74606
74607 void kfree(const void *block)
71d190be 74608@@ -531,13 +543,81 @@ void kfree(const void *block)
58c5fc13
MT		 74609 sp = slob_page(block);
74610 if (is_slob_page(sp)) {
74611 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74612- unsigned int *m = (unsigned int *)(block - align);
74613- slob_free(m, *m + align);
74614- } else
74615+ slob_t *m = (slob_t *)(block - align);
74616+ slob_free(m, m[0].units + align);
74617+ } else {
74618+ clear_slob_page(sp);
74619+ free_slob_page(sp);
74620+ sp->size = 0;
74621 put_page(&sp->page);
74622+ }
74623 }
74624 EXPORT_SYMBOL(kfree);
74625
74626+void check_object_size(const void *ptr, unsigned long n, bool to)
74627+{
74628+
74629+#ifdef CONFIG_PAX_USERCOPY
74630+ struct slob_page *sp;
74631+ const slob_t *free;
74632+ const void *base;
74633+
74634+ if (!n)
74635+ return;
74636+
74637+ if (ZERO_OR_NULL_PTR(ptr))
74638+ goto report;
74639+
74640+ if (!virt_addr_valid(ptr))
74641+ return;
74642+
74643+ sp = slob_page(ptr);
ae4e228f
MT		 74644+ if (!PageSlab((struct page*)sp)) {
74645+ if (object_is_on_stack(ptr, n) == -1)
74646+ goto report;
58c5fc13 74647+ return;
ae4e228f 74648+ }
58c5fc13
MT		 74649+
74650+ if (sp->size) {
74651+ base = page_address(&sp->page);
74652+ if (base <= ptr && n <= sp->size - (ptr - base))
74653+ return;
74654+ goto report;
74655+ }
74656+
74657+ /* some tricky double walking to find the chunk */
74658+ base = (void *)((unsigned long)ptr & PAGE_MASK);
74659+ free = sp->free;
74660+
74661+ while (!slob_last(free) && (void *)free <= ptr) {
74662+ base = free + slob_units(free);
74663+ free = slob_next(free);
74664+ }
74665+
74666+ while (base < (void *)free) {
74667+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74668+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
74669+ int offset;
74670+
74671+ if (ptr < base + align)
74672+ goto report;
74673+
74674+ offset = ptr - base - align;
74675+ if (offset < m) {
74676+ if (n <= m - offset)
74677+ return;
74678+ goto report;
74679+ }
74680+ base += size;
74681+ }
74682+
74683+report:
71d190be 74684+ pax_report_usercopy(ptr, n, to, NULL);
58c5fc13
MT		 74685+#endif
74686+
74687+}
74688+EXPORT_SYMBOL(check_object_size);
74689+
74690 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74691 size_t ksize(const void *block)
74692 {
71d190be 74693@@ -550,10 +630,10 @@ size_t ksize(const void *block)
58c5fc13
MT		 74694 sp = slob_page(block);
74695 if (is_slob_page(sp)) {
74696 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74697- unsigned int *m = (unsigned int *)(block - align);
74698- return SLOB_UNITS(*m) * SLOB_UNIT;
74699+ slob_t *m = (slob_t *)(block - align);
74700+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74701 } else
74702- return sp->page.private;
74703+ return sp->size;
74704 }
74705 EXPORT_SYMBOL(ksize);
74706
71d190be 74707@@ -608,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
58c5fc13
MT		 74708 {
74709 void *b;
74710
74711+#ifdef CONFIG_PAX_USERCOPY
74712+ b = __kmalloc_node_align(c->size, flags, node, c->align);
74713+#else
74714 if (c->size < PAGE_SIZE) {
74715 b = slob_alloc(c->size, flags, c->align, node);
74716 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74717 SLOB_UNITS(c->size) * SLOB_UNIT,
74718 flags, node);
74719 } else {
74720+ struct slob_page *sp;
74721+
74722 b = slob_new_pages(flags, get_order(c->size), node);
74723+ sp = slob_page(b);
74724+ sp->size = c->size;
74725 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74726 PAGE_SIZE << get_order(c->size),
74727 flags, node);
74728 }
74729+#endif
74730
74731 if (c->ctor)
74732 c->ctor(b);
71d190be 74733@@ -630,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
58c5fc13
MT		 74734
74735 static void __kmem_cache_free(void *b, int size)
74736 {
74737- if (size < PAGE_SIZE)
74738+ struct slob_page *sp = slob_page(b);
74739+
74740+ if (is_slob_page(sp))
74741 slob_free(b, size);
74742- else
74743+ else {
74744+ clear_slob_page(sp);
74745+ free_slob_page(sp);
74746+ sp->size = 0;
74747 slob_free_pages(b, get_order(size));
74748+ }
74749 }
74750
74751 static void kmem_rcu_free(struct rcu_head *head)
71d190be 74752@@ -646,14 +740,23 @@ static void kmem_rcu_free(struct rcu_hea
58c5fc13
MT		 74753
74754 void kmem_cache_free(struct kmem_cache *c, void *b)
74755 {
74756+ int size = c->size;
74757+
74758+#ifdef CONFIG_PAX_USERCOPY
74759+ if (size + c->align < PAGE_SIZE) {
74760+ size += c->align;
74761+ b -= c->align;
74762+ }
74763+#endif
74764+
74765 kmemleak_free_recursive(b, c->flags);
74766 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
74767 struct slob_rcu *slob_rcu;
74768- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
58c5fc13 74769- slob_rcu->size = c->size;
6892158b 74770+ slob_rcu = b + (size - sizeof(struct slob_rcu));
58c5fc13
MT		 74771+ slob_rcu->size = size;
74772 call_rcu(&slob_rcu->head, kmem_rcu_free);
74773 } else {
74774- __kmem_cache_free(b, c->size);
74775+ __kmem_cache_free(b, size);
74776 }
74777
74778 trace_kmem_cache_free(_RET_IP_, b);
66a7e928
MT		 74779diff -urNp linux-2.6.39/mm/slub.c linux-2.6.39/mm/slub.c
74780--- linux-2.6.39/mm/slub.c 2011-05-19 00:06:34.000000000 -0400
74781+++ linux-2.6.39/mm/slub.c 2011-05-22 19:41:42.000000000 -0400
74782@@ -419,7 +419,7 @@ static void print_track(const char *s, s
bc901d79
MT		 74783 if (!t->addr)
74784 return;
74785
74786- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
74787+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
74788 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
74789 }
74790
66a7e928 74791@@ -2171,6 +2171,8 @@ void kmem_cache_free(struct kmem_cache *
ae4e228f
MT		 74792
74793 page = virt_to_head_page(x);
74794
74795+ BUG_ON(!PageSlab(page));
74796+
74797 slab_free(s, page, x, _RET_IP_);
74798
74799 trace_kmem_cache_free(_RET_IP_, x);
66a7e928 74800@@ -2204,7 +2206,7 @@ static int slub_min_objects;
58c5fc13
MT		 74801 * Merge control. If this is set then no merging of slab caches will occur.
74802 * (Could be removed. This was introduced to pacify the merge skeptics.)
74803 */
74804-static int slub_nomerge;
74805+static int slub_nomerge = 1;
74806
74807 /*
74808 * Calculate the order of allocation given an slab object size.
66a7e928 74809@@ -2632,7 +2634,7 @@ static int kmem_cache_open(struct kmem_c
58c5fc13
MT		 74810 * list to avoid pounding the page allocator excessively.
74811 */
74812 set_min_partial(s, ilog2(s->size));
74813- s->refcount = 1;
74814+ atomic_set(&s->refcount, 1);
74815 #ifdef CONFIG_NUMA
74816 s->remote_node_defrag_ratio = 1000;
74817 #endif
66a7e928 74818@@ -2738,8 +2740,7 @@ static inline int kmem_cache_close(struc
58c5fc13
MT		 74819 void kmem_cache_destroy(struct kmem_cache *s)
74820 {
74821 down_write(&slub_lock);
74822- s->refcount--;
74823- if (!s->refcount) {
74824+ if (atomic_dec_and_test(&s->refcount)) {
74825 list_del(&s->list);
58c5fc13 74826 if (kmem_cache_close(s)) {
6892158b 74827 printk(KERN_ERR "SLUB %s: %s called for cache that "
66a7e928 74828@@ -2949,6 +2950,46 @@ void *__kmalloc_node(size_t size, gfp_t
58c5fc13
MT		 74829 EXPORT_SYMBOL(__kmalloc_node);
74830 #endif
74831
74832+void check_object_size(const void *ptr, unsigned long n, bool to)
74833+{
74834+
74835+#ifdef CONFIG_PAX_USERCOPY
74836+ struct page *page;
71d190be 74837+ struct kmem_cache *s = NULL;
58c5fc13
MT		 74838+ unsigned long offset;
74839+
74840+ if (!n)
74841+ return;
74842+
74843+ if (ZERO_OR_NULL_PTR(ptr))
74844+ goto report;
74845+
74846+ if (!virt_addr_valid(ptr))
74847+ return;
74848+
16454cff 74849+ page = virt_to_head_page(ptr);
58c5fc13 74850+
16454cff 74851+ if (!PageSlab(page)) {
ae4e228f
MT		 74852+ if (object_is_on_stack(ptr, n) == -1)
74853+ goto report;
58c5fc13 74854+ return;
ae4e228f 74855+ }
58c5fc13
MT		 74856+
74857+ s = page->slab;
71d190be
MT		 74858+ if (!(s->flags & SLAB_USERCOPY))
74859+ goto report;
74860+
58c5fc13
MT		 74861+ offset = (ptr - page_address(page)) % s->size;
74862+ if (offset <= s->objsize && n <= s->objsize - offset)
74863+ return;
74864+
74865+report:
71d190be 74866+ pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
58c5fc13
MT		 74867+#endif
74868+
74869+}
74870+EXPORT_SYMBOL(check_object_size);
74871+
74872 size_t ksize(const void *object)
74873 {
74874 struct page *page;
66a7e928 74875@@ -3193,7 +3234,7 @@ static void __init kmem_cache_bootstrap_
bc901d79
MT		 74876 int node;
74877
74878 list_add(&s->list, &slab_caches);
74879- s->refcount = -1;
74880+ atomic_set(&s->refcount, -1);
74881
74882 for_each_node_state(node, N_NORMAL_MEMORY) {
74883 struct kmem_cache_node *n = get_node(s, node);
66a7e928 74884@@ -3310,17 +3351,17 @@ void __init kmem_cache_init(void)
71d190be
MT		 74885
74886 /* Caches that are not of the two-to-the-power-of size */
74887 if (KMALLOC_MIN_SIZE <= 32) {
74888- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
74889+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
74890 caches++;
74891 }
74892
74893 if (KMALLOC_MIN_SIZE <= 64) {
74894- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
74895+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
74896 caches++;
74897 }
74898
74899 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
74900- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
74901+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
74902 caches++;
74903 }
74904
66a7e928 74905@@ -3388,7 +3429,7 @@ static int slab_unmergeable(struct kmem_
58c5fc13
MT		 74906 /*
74907 * We may have set a slab to be unmergeable during bootstrap.
74908 */
74909- if (s->refcount < 0)
74910+ if (atomic_read(&s->refcount) < 0)
74911 return 1;
74912
74913 return 0;
66a7e928 74914@@ -3447,7 +3488,7 @@ struct kmem_cache *kmem_cache_create(con
df50ba0c
MT		 74915 down_write(&slub_lock);
74916 s = find_mergeable(size, align, flags, name, ctor);
58c5fc13 74917 if (s) {
58c5fc13
MT		 74918- s->refcount++;
74919+ atomic_inc(&s->refcount);
74920 /*
74921 * Adjust the object sizes so that we clear
74922 * the complete object on kzalloc.
66a7e928 74923@@ -3456,7 +3497,7 @@ struct kmem_cache *kmem_cache_create(con
6892158b 74924 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
58c5fc13
MT		 74925
74926 if (sysfs_slab_alias(s, name)) {
58c5fc13
MT		 74927- s->refcount--;
74928+ atomic_dec(&s->refcount);
58c5fc13
MT		 74929 goto err;
74930 }
6892158b 74931 up_write(&slub_lock);
66a7e928 74932@@ -4189,7 +4230,7 @@ SLAB_ATTR_RO(ctor);
58c5fc13
MT		 74933
74934 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
74935 {
74936- return sprintf(buf, "%d\n", s->refcount - 1);
74937+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
74938 }
74939 SLAB_ATTR_RO(aliases);
74940
66a7e928 74941@@ -4933,7 +4974,13 @@ static const struct file_operations proc
58c5fc13 74942
df50ba0c
MT		 74943 static int __init slab_proc_init(void)
74944 {
74945- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
74946+ mode_t gr_mode = S_IRUGO;
74947+
74948+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74949+ gr_mode = S_IRUSR;
74950+#endif
74951+
74952+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
58c5fc13
MT		 74953 return 0;
74954 }
df50ba0c 74955 module_init(slab_proc_init);
66a7e928
MT		 74956diff -urNp linux-2.6.39/mm/swapfile.c linux-2.6.39/mm/swapfile.c
74957--- linux-2.6.39/mm/swapfile.c 2011-05-19 00:06:34.000000000 -0400
74958+++ linux-2.6.39/mm/swapfile.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 74959@@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
74960
74961 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
74962 /* Activity counter to indicate that a swapon or swapoff has occurred */
74963-static atomic_t proc_poll_event = ATOMIC_INIT(0);
74964+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
74965
74966 static inline unsigned char swap_count(unsigned char ent)
74967 {
66a7e928 74968@@ -1669,7 +1669,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
8308f9c9
MT		 74969 }
74970 filp_close(swap_file, NULL);
74971 err = 0;
74972- atomic_inc(&proc_poll_event);
74973+ atomic_inc_unchecked(&proc_poll_event);
74974 wake_up_interruptible(&proc_poll_wait);
74975
74976 out_dput:
66a7e928 74977@@ -1690,8 +1690,8 @@ static unsigned swaps_poll(struct file *
8308f9c9
MT		 74978
74979 poll_wait(file, &proc_poll_wait, wait);
74980
74981- if (s->event != atomic_read(&proc_poll_event)) {
74982- s->event = atomic_read(&proc_poll_event);
74983+ if (s->event != atomic_read_unchecked(&proc_poll_event)) {
74984+ s->event = atomic_read_unchecked(&proc_poll_event);
74985 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
74986 }
74987
66a7e928 74988@@ -1797,7 +1797,7 @@ static int swaps_open(struct inode *inod
8308f9c9
MT		 74989 }
74990
74991 s->seq.private = s;
74992- s->event = atomic_read(&proc_poll_event);
74993+ s->event = atomic_read_unchecked(&proc_poll_event);
74994 return ret;
74995 }
74996
74997@@ -2131,7 +2131,7 @@ SYSCALL_DEFINE2(swapon, const char __use
66a7e928
MT		 74998 (p->flags & SWP_DISCARDABLE) ? "D" : "");
74999
8308f9c9
MT		 75000 mutex_unlock(&swapon_mutex);
75001- atomic_inc(&proc_poll_event);
75002+ atomic_inc_unchecked(&proc_poll_event);
75003 wake_up_interruptible(&proc_poll_wait);
75004
66a7e928
MT		 75005 if (S_ISREG(inode->i_mode))
75006diff -urNp linux-2.6.39/mm/util.c linux-2.6.39/mm/util.c
75007--- linux-2.6.39/mm/util.c 2011-05-19 00:06:34.000000000 -0400
75008+++ linux-2.6.39/mm/util.c 2011-05-23 17:07:00.000000000 -0400
75009@@ -112,6 +112,7 @@ EXPORT_SYMBOL(memdup_user);
75010 * allocated buffer. Use this if you don't want to free the buffer immediately
75011 * like, for example, with RCU.
75012 */
75013+#undef __krealloc
75014 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
75015 {
75016 void *ret;
75017@@ -145,6 +146,7 @@ EXPORT_SYMBOL(__krealloc);
75018 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
75019 * %NULL pointer, the object pointed to is freed.
75020 */
75021+#undef krealloc
75022 void *krealloc(const void *p, size_t new_size, gfp_t flags)
75023 {
75024 void *ret;
75025@@ -219,6 +221,12 @@ EXPORT_SYMBOL(strndup_user);
58c5fc13
MT		 75026 void arch_pick_mmap_layout(struct mm_struct *mm)
75027 {
75028 mm->mmap_base = TASK_UNMAPPED_BASE;
75029+
75030+#ifdef CONFIG_PAX_RANDMMAP
75031+ if (mm->pax_flags & MF_PAX_RANDMMAP)
75032+ mm->mmap_base += mm->delta_mmap;
75033+#endif
75034+
75035 mm->get_unmapped_area = arch_get_unmapped_area;
75036 mm->unmap_area = arch_unmap_area;
75037 }
66a7e928
MT		 75038diff -urNp linux-2.6.39/mm/vmalloc.c linux-2.6.39/mm/vmalloc.c
75039--- linux-2.6.39/mm/vmalloc.c 2011-05-19 00:06:34.000000000 -0400
75040+++ linux-2.6.39/mm/vmalloc.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 75041@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
ae4e228f
MT		 75042
75043 pte = pte_offset_kernel(pmd, addr);
75044 do {
75045- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75046- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75047+
75048+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75049+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75050+ BUG_ON(!pte_exec(*pte));
75051+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75052+ continue;
75053+ }
75054+#endif
75055+
75056+ {
75057+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75058+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75059+ }
75060 } while (pte++, addr += PAGE_SIZE, addr != end);
75061 }
75062
bc901d79 75063@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
58c5fc13
MT		 75064 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75065 {
75066 pte_t *pte;
75067+ int ret = -ENOMEM;
58c5fc13
MT		 75068
75069 /*
75070 * nr is a running index into the array which helps higher level
bc901d79 75071@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
58c5fc13
MT		 75072 pte = pte_alloc_kernel(pmd, addr);
75073 if (!pte)
75074 return -ENOMEM;
75075+
ae4e228f 75076+ pax_open_kernel();
58c5fc13
MT		 75077 do {
75078 struct page *page = pages[*nr];
75079
75080- if (WARN_ON(!pte_none(*pte)))
75081- return -EBUSY;
75082- if (WARN_ON(!page))
75083- return -ENOMEM;
ae4e228f 75084+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
57199397 75085+ if (pgprot_val(prot) & _PAGE_NX)
ae4e228f
MT		 75086+#endif
75087+
58c5fc13
MT		 75088+ if (WARN_ON(!pte_none(*pte))) {
75089+ ret = -EBUSY;
75090+ goto out;
75091+ }
75092+ if (WARN_ON(!page)) {
75093+ ret = -ENOMEM;
75094+ goto out;
75095+ }
75096 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75097 (*nr)++;
75098 } while (pte++, addr += PAGE_SIZE, addr != end);
75099- return 0;
75100+ ret = 0;
75101+out:
ae4e228f
MT		 75102+ pax_close_kernel();
75103+ return ret;
75104 }
75105
75106 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
bc901d79 75107@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
ae4e228f
MT		 75108 * and fall back on vmalloc() if that fails. Others
75109 * just put it in the vmalloc space.
75110 */
75111-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75112+#ifdef CONFIG_MODULES
75113+#ifdef MODULES_VADDR
75114 unsigned long addr = (unsigned long)x;
75115 if (addr >= MODULES_VADDR && addr < MODULES_END)
75116 return 1;
75117 #endif
58c5fc13 75118+
ae4e228f
MT		 75119+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75120+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75121+ return 1;
58c5fc13
MT		 75122+#endif
75123+
ae4e228f
MT		 75124+#endif
75125+
75126 return is_vmalloc_addr(x);
58c5fc13
MT		 75127 }
75128
bc901d79 75129@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
57199397
MT		 75130
75131 if (!pgd_none(*pgd)) {
75132 pud_t *pud = pud_offset(pgd, addr);
75133+#ifdef CONFIG_X86
75134+ if (!pud_large(*pud))
75135+#endif
75136 if (!pud_none(*pud)) {
75137 pmd_t *pmd = pmd_offset(pud, addr);
75138+#ifdef CONFIG_X86
75139+ if (!pmd_large(*pmd))
75140+#endif
75141 if (!pmd_none(*pmd)) {
75142 pte_t *ptep, pte;
75143
66a7e928 75144@@ -1296,6 +1336,16 @@ static struct vm_struct *__get_vm_area_n
ae4e228f 75145 struct vm_struct *area;
58c5fc13
MT		 75146
75147 BUG_ON(in_interrupt());
75148+
df50ba0c 75149+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
58c5fc13
MT		 75150+ if (flags & VM_KERNEXEC) {
75151+ if (start != VMALLOC_START || end != VMALLOC_END)
75152+ return NULL;
df50ba0c
MT		 75153+ start = (unsigned long)MODULES_EXEC_VADDR;
75154+ end = (unsigned long)MODULES_EXEC_END;
58c5fc13
MT		 75155+ }
75156+#endif
75157+
75158 if (flags & VM_IOREMAP) {
75159 int bit = fls(size);
75160
66a7e928 75161@@ -1514,6 +1564,11 @@ void *vmap(struct page **pages, unsigned
ae4e228f 75162 if (count > totalram_pages)
58c5fc13
MT		 75163 return NULL;
75164
df50ba0c 75165+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
58c5fc13
MT		 75166+ if (!(pgprot_val(prot) & _PAGE_NX))
75167+ flags |= VM_KERNEXEC;
75168+#endif
75169+
75170 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75171 __builtin_return_address(0));
75172 if (!area)
66a7e928 75173@@ -1610,6 +1665,13 @@ void *__vmalloc_node_range(unsigned long
ae4e228f 75174 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
58c5fc13
MT		 75175 return NULL;
75176
df50ba0c 75177+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
58c5fc13 75178+ if (!(pgprot_val(prot) & _PAGE_NX))
ae4e228f 75179+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
58c5fc13
MT		 75180+ node, gfp_mask, caller);
75181+ else
75182+#endif
75183+
16454cff
MT		 75184 area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node,
75185 gfp_mask, caller);
58c5fc13 75186
66a7e928 75187@@ -1649,6 +1711,7 @@ static void *__vmalloc_node(unsigned lon
16454cff 75188 gfp_mask, prot, node, caller);
58c5fc13
MT		 75189 }
75190
75191+#undef __vmalloc
75192 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
75193 {
ae4e228f 75194 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
66a7e928 75195@@ -1672,6 +1735,7 @@ static inline void *__vmalloc_node_flags
58c5fc13
MT		 75196 * For tight control over page level allocator and protection flags
75197 * use __vmalloc() instead.
75198 */
75199+#undef vmalloc
75200 void *vmalloc(unsigned long size)
75201 {
bc901d79 75202 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
66a7e928 75203@@ -1688,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc);
bc901d79
MT		 75204 * For tight control over page level allocator and protection flags
75205 * use __vmalloc() instead.
75206 */
75207+#undef vzalloc
75208 void *vzalloc(unsigned long size)
75209 {
75210 return __vmalloc_node_flags(size, -1,
66a7e928 75211@@ -1702,6 +1767,7 @@ EXPORT_SYMBOL(vzalloc);
58c5fc13
MT		 75212 * The resulting memory area is zeroed so it can be mapped to userspace
75213 * without leaking data.
75214 */
75215+#undef vmalloc_user
75216 void *vmalloc_user(unsigned long size)
75217 {
75218 struct vm_struct *area;
66a7e928 75219@@ -1729,6 +1795,7 @@ EXPORT_SYMBOL(vmalloc_user);
58c5fc13
MT		 75220 * For tight control over page level allocator and protection flags
75221 * use __vmalloc() instead.
75222 */
75223+#undef vmalloc_node
75224 void *vmalloc_node(unsigned long size, int node)
75225 {
ae4e228f 75226 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
66a7e928 75227@@ -1748,6 +1815,7 @@ EXPORT_SYMBOL(vmalloc_node);
bc901d79
MT		 75228 * For tight control over page level allocator and protection flags
75229 * use __vmalloc_node() instead.
75230 */
75231+#undef vzalloc_node
75232 void *vzalloc_node(unsigned long size, int node)
75233 {
75234 return __vmalloc_node_flags(size, node,
66a7e928 75235@@ -1770,10 +1838,10 @@ EXPORT_SYMBOL(vzalloc_node);
58c5fc13
MT		 75236 * For tight control over page level allocator and protection flags
75237 * use __vmalloc() instead.
75238 */
75239-
75240+#undef vmalloc_exec
75241 void *vmalloc_exec(unsigned long size)
75242 {
ae4e228f
MT		 75243- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75244+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
58c5fc13
MT		 75245 -1, __builtin_return_address(0));
75246 }
75247
66a7e928 75248@@ -1792,6 +1860,7 @@ void *vmalloc_exec(unsigned long size)
58c5fc13
MT		 75249 * Allocate enough 32bit PA addressable pages to cover @size from the
75250 * page level allocator and map them into contiguous kernel virtual space.
75251 */
75252+#undef vmalloc_32
75253 void *vmalloc_32(unsigned long size)
75254 {
ae4e228f 75255 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
66a7e928 75256@@ -1806,6 +1875,7 @@ EXPORT_SYMBOL(vmalloc_32);
58c5fc13
MT		 75257 * The resulting memory area is 32bit addressable and zeroed so it can be
75258 * mapped to userspace without leaking data.
75259 */
75260+#undef vmalloc_32_user
75261 void *vmalloc_32_user(unsigned long size)
75262 {
75263 struct vm_struct *area;
66a7e928 75264@@ -2068,6 +2138,8 @@ int remap_vmalloc_range(struct vm_area_s
6892158b
MT		 75265 unsigned long uaddr = vma->vm_start;
75266 unsigned long usize = vma->vm_end - vma->vm_start;
75267
75268+ BUG_ON(vma->vm_mirror);
75269+
75270 if ((PAGE_SIZE-1) & (unsigned long)addr)
75271 return -EINVAL;
75272
66a7e928
MT		 75273diff -urNp linux-2.6.39/mm/vmstat.c linux-2.6.39/mm/vmstat.c
75274--- linux-2.6.39/mm/vmstat.c 2011-05-19 00:06:34.000000000 -0400
75275+++ linux-2.6.39/mm/vmstat.c 2011-05-22 19:41:42.000000000 -0400
bc901d79 75276@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
57199397
MT		 75277 *
75278 * vm_stat contains the global counters
75279 */
75280-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75281+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75282 EXPORT_SYMBOL(vm_stat);
75283
75284 #ifdef CONFIG_SMP
66a7e928 75285@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
57199397
MT		 75286 v = p->vm_stat_diff[i];
75287 p->vm_stat_diff[i] = 0;
75288 local_irq_restore(flags);
75289- atomic_long_add(v, &zone->vm_stat[i]);
75290+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75291 global_diff[i] += v;
75292 #ifdef CONFIG_NUMA
75293 /* 3 seconds idle till flush */
66a7e928 75294@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
57199397
MT		 75295
75296 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75297 if (global_diff[i])
75298- atomic_long_add(global_diff[i], &vm_stat[i]);
75299+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75300 }
75301
75302 #endif
66a7e928 75303@@ -1205,10 +1205,20 @@ static int __init setup_vmstat(void)
57199397
MT		 75304 start_cpu_timer(cpu);
75305 #endif
75306 #ifdef CONFIG_PROC_FS
75307- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75308- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75309- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75310- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75311+ {
75312+ mode_t gr_mode = S_IRUGO;
75313+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75314+ gr_mode = S_IRUSR;
75315+#endif
75316+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75317+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
bc901d79
MT		 75318+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75319+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75320+#else
57199397 75321+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
bc901d79 75322+#endif
57199397
MT		 75323+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75324+ }
75325 #endif
75326 return 0;
75327 }
66a7e928
MT		 75328diff -urNp linux-2.6.39/net/8021q/vlan.c linux-2.6.39/net/8021q/vlan.c
75329--- linux-2.6.39/net/8021q/vlan.c 2011-05-19 00:06:34.000000000 -0400
75330+++ linux-2.6.39/net/8021q/vlan.c 2011-05-22 19:36:33.000000000 -0400
75331@@ -592,8 +592,7 @@ static int vlan_ioctl_handler(struct net
df50ba0c
MT		 75332 err = -EPERM;
75333 if (!capable(CAP_NET_ADMIN))
75334 break;
75335- if ((args.u.name_type >= 0) &&
75336- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75337+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75338 struct vlan_net *vn;
75339
75340 vn = net_generic(net, vlan_net_id);
66a7e928
MT		 75341diff -urNp linux-2.6.39/net/atm/atm_misc.c linux-2.6.39/net/atm/atm_misc.c
75342--- linux-2.6.39/net/atm/atm_misc.c 2011-05-19 00:06:34.000000000 -0400
75343+++ linux-2.6.39/net/atm/atm_misc.c 2011-05-22 19:36:33.000000000 -0400
df50ba0c 75344@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
58c5fc13
MT		 75345 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75346 return 1;
df50ba0c 75347 atm_return(vcc, truesize);
58c5fc13
MT		 75348- atomic_inc(&vcc->stats->rx_drop);
75349+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75350 return 0;
75351 }
df50ba0c
MT		 75352 EXPORT_SYMBOL(atm_charge);
75353@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
58c5fc13
MT		 75354 }
75355 }
df50ba0c 75356 atm_return(vcc, guess);
58c5fc13
MT		 75357- atomic_inc(&vcc->stats->rx_drop);
75358+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75359 return NULL;
75360 }
df50ba0c
MT		 75361 EXPORT_SYMBOL(atm_alloc_charge);
75362@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
58c5fc13 75363
df50ba0c 75364 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
58c5fc13
MT		 75365 {
75366-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75367+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75368 __SONET_ITEMS
75369 #undef __HANDLE_ITEM
75370 }
df50ba0c 75371@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
58c5fc13 75372
df50ba0c 75373 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
58c5fc13 75374 {
df50ba0c 75375-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
58c5fc13
MT		 75376+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75377 __SONET_ITEMS
75378 #undef __HANDLE_ITEM
75379 }
66a7e928
MT		 75380diff -urNp linux-2.6.39/net/atm/mpoa_caches.c linux-2.6.39/net/atm/mpoa_caches.c
75381--- linux-2.6.39/net/atm/mpoa_caches.c 2011-05-19 00:06:34.000000000 -0400
75382+++ linux-2.6.39/net/atm/mpoa_caches.c 2011-05-22 19:36:33.000000000 -0400
75383@@ -255,6 +255,8 @@ static void check_resolving_entries(stru
75384 struct timeval now;
75385 struct k_message msg;
75386
75387+ pax_track_stack();
75388+
75389 do_gettimeofday(&now);
75390
75391 read_lock_bh(&client->ingress_lock);
75392diff -urNp linux-2.6.39/net/atm/proc.c linux-2.6.39/net/atm/proc.c
75393--- linux-2.6.39/net/atm/proc.c 2011-05-19 00:06:34.000000000 -0400
75394+++ linux-2.6.39/net/atm/proc.c 2011-05-22 19:41:42.000000000 -0400
bc901d79 75395@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
58c5fc13
MT		 75396 const struct k_atm_aal_stats *stats)
75397 {
75398 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
df50ba0c
MT		 75399- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75400- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75401- atomic_read(&stats->rx_drop));
75402+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75403+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75404+ atomic_read_unchecked(&stats->rx_drop));
58c5fc13
MT		 75405 }
75406
75407 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
bc901d79 75408@@ -191,7 +191,12 @@ static void vcc_info(struct seq_file *se
57199397
MT		 75409 {
75410 struct sock *sk = sk_atm(vcc);
75411
75412+#ifdef CONFIG_GRKERNSEC_HIDESYM
75413+ seq_printf(seq, "%p ", NULL);
75414+#else
75415 seq_printf(seq, "%p ", vcc);
75416+#endif
75417+
75418 if (!vcc->dev)
75419 seq_printf(seq, "Unassigned ");
75420 else
16454cff
MT		 75421@@ -218,7 +223,11 @@ static void svc_info(struct seq_file *se
75422 {
75423 if (!vcc->dev)
75424 seq_printf(seq, sizeof(void *) == 4 ?
75425+#ifdef CONFIG_GRKERNSEC_HIDESYM
75426+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
75427+#else
75428 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
75429+#endif
75430 else
75431 seq_printf(seq, "%3d %3d %5d ",
75432 vcc->dev->number, vcc->vpi, vcc->vci);
66a7e928
MT		 75433diff -urNp linux-2.6.39/net/atm/resources.c linux-2.6.39/net/atm/resources.c
75434--- linux-2.6.39/net/atm/resources.c 2011-05-19 00:06:34.000000000 -0400
75435+++ linux-2.6.39/net/atm/resources.c 2011-05-22 19:36:33.000000000 -0400
bc901d79 75436@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
58c5fc13
MT		 75437 static void copy_aal_stats(struct k_atm_aal_stats *from,
75438 struct atm_aal_stats *to)
75439 {
75440-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75441+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75442 __AAL_STAT_ITEMS
75443 #undef __HANDLE_ITEM
75444 }
bc901d79 75445@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
58c5fc13
MT		 75446 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75447 struct atm_aal_stats *to)
75448 {
75449-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75450+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75451 __AAL_STAT_ITEMS
75452 #undef __HANDLE_ITEM
75453 }
66a7e928
MT		 75454diff -urNp linux-2.6.39/net/batman-adv/hard-interface.c linux-2.6.39/net/batman-adv/hard-interface.c
75455--- linux-2.6.39/net/batman-adv/hard-interface.c 2011-05-19 00:06:34.000000000 -0400
75456+++ linux-2.6.39/net/batman-adv/hard-interface.c 2011-05-22 19:36:33.000000000 -0400
75457@@ -339,8 +339,8 @@ int hardif_enable_interface(struct hard_
75458 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75459 dev_add_pack(&hard_iface->batman_adv_ptype);
75460
75461- atomic_set(&hard_iface->seqno, 1);
75462- atomic_set(&hard_iface->frag_seqno, 1);
75463+ atomic_set_unchecked(&hard_iface->seqno, 1);
75464+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75465 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75466 hard_iface->net_dev->name);
75467
75468diff -urNp linux-2.6.39/net/batman-adv/routing.c linux-2.6.39/net/batman-adv/routing.c
75469--- linux-2.6.39/net/batman-adv/routing.c 2011-05-19 00:06:34.000000000 -0400
75470+++ linux-2.6.39/net/batman-adv/routing.c 2011-05-22 19:36:33.000000000 -0400
75471@@ -625,7 +625,7 @@ void receive_bat_packet(struct ethhdr *e
8308f9c9
MT		 75472 return;
75473
75474 /* could be changed by schedule_own_packet() */
75475- if_incoming_seqno = atomic_read(&if_incoming->seqno);
75476+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75477
75478 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
75479
66a7e928
MT		 75480diff -urNp linux-2.6.39/net/batman-adv/send.c linux-2.6.39/net/batman-adv/send.c
75481--- linux-2.6.39/net/batman-adv/send.c 2011-05-19 00:06:34.000000000 -0400
75482+++ linux-2.6.39/net/batman-adv/send.c 2011-05-22 19:36:33.000000000 -0400
75483@@ -277,7 +277,7 @@ void schedule_own_packet(struct hard_ifa
8308f9c9
MT		 75484
75485 /* change sequence number to network order */
75486 batman_packet->seqno =
66a7e928
MT		 75487- htonl((uint32_t)atomic_read(&hard_iface->seqno));
75488+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
8308f9c9
MT		 75489
75490 if (vis_server == VIS_TYPE_SERVER_SYNC)
75491 batman_packet->flags |= VIS_SERVER;
66a7e928 75492@@ -291,7 +291,7 @@ void schedule_own_packet(struct hard_ifa
8308f9c9
MT		 75493 else
75494 batman_packet->gw_flags = 0;
75495
66a7e928
MT		 75496- atomic_inc(&hard_iface->seqno);
75497+ atomic_inc_unchecked(&hard_iface->seqno);
8308f9c9 75498
66a7e928 75499 slide_own_bcast_window(hard_iface);
8308f9c9 75500 send_time = own_send_time(bat_priv);
66a7e928
MT		 75501diff -urNp linux-2.6.39/net/batman-adv/soft-interface.c linux-2.6.39/net/batman-adv/soft-interface.c
75502--- linux-2.6.39/net/batman-adv/soft-interface.c 2011-05-19 00:06:34.000000000 -0400
75503+++ linux-2.6.39/net/batman-adv/soft-interface.c 2011-05-22 19:36:33.000000000 -0400
75504@@ -386,7 +386,7 @@ int interface_tx(struct sk_buff *skb, st
8308f9c9
MT		 75505
75506 /* set broadcast sequence number */
75507 bcast_packet->seqno =
75508- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75509+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75510
75511 add_bcast_packet_to_list(bat_priv, skb);
75512
66a7e928 75513@@ -579,7 +579,7 @@ struct net_device *softif_create(char *n
8308f9c9
MT		 75514 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75515
75516 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75517- atomic_set(&bat_priv->bcast_seqno, 1);
75518+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75519 atomic_set(&bat_priv->hna_local_changed, 0);
75520
75521 bat_priv->primary_if = NULL;
66a7e928
MT		 75522diff -urNp linux-2.6.39/net/batman-adv/types.h linux-2.6.39/net/batman-adv/types.h
75523--- linux-2.6.39/net/batman-adv/types.h 2011-05-19 00:06:34.000000000 -0400
75524+++ linux-2.6.39/net/batman-adv/types.h 2011-05-22 19:36:33.000000000 -0400
75525@@ -38,8 +38,8 @@ struct hard_iface {
8308f9c9
MT		 75526 int16_t if_num;
75527 char if_status;
75528 struct net_device *net_dev;
75529- atomic_t seqno;
75530- atomic_t frag_seqno;
75531+ atomic_unchecked_t seqno;
75532+ atomic_unchecked_t frag_seqno;
75533 unsigned char *packet_buff;
75534 int packet_len;
75535 struct kobject *hardif_obj;
66a7e928 75536@@ -141,7 +141,7 @@ struct bat_priv {
8308f9c9
MT		 75537 atomic_t orig_interval; /* uint */
75538 atomic_t hop_penalty; /* uint */
75539 atomic_t log_level; /* uint */
75540- atomic_t bcast_seqno;
75541+ atomic_unchecked_t bcast_seqno;
75542 atomic_t bcast_queue_left;
75543 atomic_t batman_queue_left;
75544 char num_ifaces;
66a7e928
MT		 75545diff -urNp linux-2.6.39/net/batman-adv/unicast.c linux-2.6.39/net/batman-adv/unicast.c
75546--- linux-2.6.39/net/batman-adv/unicast.c 2011-05-19 00:06:34.000000000 -0400
75547+++ linux-2.6.39/net/batman-adv/unicast.c 2011-05-22 19:36:33.000000000 -0400
75548@@ -263,7 +263,7 @@ int frag_send_skb(struct sk_buff *skb, s
75549 frag1->flags = UNI_FRAG_HEAD | large_tail;
75550 frag2->flags = large_tail;
75551
75552- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75553+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75554 frag1->seqno = htons(seqno - 1);
75555 frag2->seqno = htons(seqno);
75556
75557diff -urNp linux-2.6.39/net/bridge/br_multicast.c linux-2.6.39/net/bridge/br_multicast.c
75558--- linux-2.6.39/net/bridge/br_multicast.c 2011-05-19 00:06:34.000000000 -0400
75559+++ linux-2.6.39/net/bridge/br_multicast.c 2011-05-22 19:36:33.000000000 -0400
16454cff 75560@@ -1482,7 +1482,7 @@ static int br_multicast_ipv6_rcv(struct
6892158b
MT		 75561 nexthdr = ip6h->nexthdr;
75562 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
75563
75564- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
75565+ if (nexthdr != IPPROTO_ICMPV6)
75566 return 0;
75567
75568 /* Okay, we found ICMPv6 header */
66a7e928
MT		 75569diff -urNp linux-2.6.39/net/bridge/netfilter/ebtables.c linux-2.6.39/net/bridge/netfilter/ebtables.c
75570--- linux-2.6.39/net/bridge/netfilter/ebtables.c 2011-05-19 00:06:34.000000000 -0400
75571+++ linux-2.6.39/net/bridge/netfilter/ebtables.c 2011-05-22 19:36:33.000000000 -0400
71d190be 75572@@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
ae4e228f
MT		 75573 tmp.valid_hooks = t->table->valid_hooks;
75574 }
75575 mutex_unlock(&ebt_mutex);
75576- if (copy_to_user(user, &tmp, *len) != 0){
75577+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
75578 BUGPRINT("c2u Didn't work\n");
75579 ret = -EFAULT;
75580 break;
66a7e928
MT		 75581@@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
75582 int ret;
75583 void __user *pos;
75584
75585+ pax_track_stack();
75586+
75587 memset(&tinfo, 0, sizeof(tinfo));
75588
75589 if (cmd == EBT_SO_GET_ENTRIES) {
75590diff -urNp linux-2.6.39/net/caif/caif_socket.c linux-2.6.39/net/caif/caif_socket.c
75591--- linux-2.6.39/net/caif/caif_socket.c 2011-05-19 00:06:34.000000000 -0400
75592+++ linux-2.6.39/net/caif/caif_socket.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 75593@@ -48,18 +48,19 @@ static struct dentry *debugfsdir;
75594 #ifdef CONFIG_DEBUG_FS
75595 struct debug_fs_counter {
75596 atomic_t caif_nr_socks;
75597- atomic_t num_connect_req;
75598- atomic_t num_connect_resp;
75599- atomic_t num_connect_fail_resp;
75600- atomic_t num_disconnect;
75601- atomic_t num_remote_shutdown_ind;
75602- atomic_t num_tx_flow_off_ind;
75603- atomic_t num_tx_flow_on_ind;
75604- atomic_t num_rx_flow_off;
75605- atomic_t num_rx_flow_on;
75606+ atomic_unchecked_t num_connect_req;
75607+ atomic_unchecked_t num_connect_resp;
75608+ atomic_unchecked_t num_connect_fail_resp;
75609+ atomic_unchecked_t num_disconnect;
75610+ atomic_unchecked_t num_remote_shutdown_ind;
75611+ atomic_unchecked_t num_tx_flow_off_ind;
75612+ atomic_unchecked_t num_tx_flow_on_ind;
75613+ atomic_unchecked_t num_rx_flow_off;
75614+ atomic_unchecked_t num_rx_flow_on;
75615 };
75616 static struct debug_fs_counter cnt;
75617 #define dbfs_atomic_inc(v) atomic_inc(v)
75618+#define dbfs_atomic_inc_unchecked(v) atomic_inc_unchecked(v)
75619 #define dbfs_atomic_dec(v) atomic_dec(v)
75620 #else
75621 #define dbfs_atomic_inc(v)
75622@@ -159,7 +160,7 @@ static int caif_queue_rcv_skb(struct soc
75623 atomic_read(&cf_sk->sk.sk_rmem_alloc),
75624 sk_rcvbuf_lowwater(cf_sk));
75625 set_rx_flow_off(cf_sk);
75626- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75627+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75628 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75629 }
75630
75631@@ -169,7 +170,7 @@ static int caif_queue_rcv_skb(struct soc
75632 if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
75633 set_rx_flow_off(cf_sk);
75634 pr_debug("sending flow OFF due to rmem_schedule\n");
75635- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75636+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75637 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75638 }
75639 skb->dev = NULL;
75640@@ -218,21 +219,21 @@ static void caif_ctrl_cb(struct cflayer
75641 switch (flow) {
75642 case CAIF_CTRLCMD_FLOW_ON_IND:
75643 /* OK from modem to start sending again */
75644- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
75645+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
75646 set_tx_flow_on(cf_sk);
75647 cf_sk->sk.sk_state_change(&cf_sk->sk);
75648 break;
75649
75650 case CAIF_CTRLCMD_FLOW_OFF_IND:
75651 /* Modem asks us to shut up */
75652- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
75653+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
75654 set_tx_flow_off(cf_sk);
75655 cf_sk->sk.sk_state_change(&cf_sk->sk);
75656 break;
75657
75658 case CAIF_CTRLCMD_INIT_RSP:
75659 /* We're now connected */
75660- dbfs_atomic_inc(&cnt.num_connect_resp);
75661+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
75662 cf_sk->sk.sk_state = CAIF_CONNECTED;
75663 set_tx_flow_on(cf_sk);
75664 cf_sk->sk.sk_state_change(&cf_sk->sk);
75665@@ -247,7 +248,7 @@ static void caif_ctrl_cb(struct cflayer
75666
75667 case CAIF_CTRLCMD_INIT_FAIL_RSP:
75668 /* Connect request failed */
75669- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
75670+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
75671 cf_sk->sk.sk_err = ECONNREFUSED;
75672 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
75673 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75674@@ -261,7 +262,7 @@ static void caif_ctrl_cb(struct cflayer
75675
75676 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
75677 /* Modem has closed this connection, or device is down. */
75678- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
75679+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
75680 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75681 cf_sk->sk.sk_err = ECONNRESET;
75682 set_rx_flow_on(cf_sk);
75683@@ -281,7 +282,7 @@ static void caif_check_flow_release(stru
75684 return;
75685
75686 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
75687- dbfs_atomic_inc(&cnt.num_rx_flow_on);
75688+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
75689 set_rx_flow_on(cf_sk);
75690 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
75691 }
75692@@ -864,7 +865,7 @@ static int caif_connect(struct socket *s
75693 /*ifindex = id of the interface.*/
75694 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
75695
75696- dbfs_atomic_inc(&cnt.num_connect_req);
75697+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
75698 cf_sk->layer.receive = caif_sktrecv_cb;
75699 err = caif_connect_client(&cf_sk->conn_req,
75700 &cf_sk->layer, &ifindex, &headroom, &tailroom);
75701@@ -952,7 +953,7 @@ static int caif_release(struct socket *s
75702 spin_unlock(&sk->sk_receive_queue.lock);
75703 sock->sk = NULL;
75704
75705- dbfs_atomic_inc(&cnt.num_disconnect);
75706+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
75707
75708 if (cf_sk->debugfs_socket_dir != NULL)
75709 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
66a7e928
MT		 75710diff -urNp linux-2.6.39/net/caif/cfctrl.c linux-2.6.39/net/caif/cfctrl.c
75711--- linux-2.6.39/net/caif/cfctrl.c 2011-05-19 00:06:34.000000000 -0400
75712+++ linux-2.6.39/net/caif/cfctrl.c 2011-05-22 19:36:33.000000000 -0400
75713@@ -9,6 +9,7 @@
75714 #include <linux/stddef.h>
75715 #include <linux/spinlock.h>
75716 #include <linux/slab.h>
75717+#include <linux/sched.h>
75718 #include <net/caif/caif_layer.h>
75719 #include <net/caif/cfpkt.h>
75720 #include <net/caif/cfctrl.h>
75721@@ -46,8 +47,8 @@ struct cflayer *cfctrl_create(void)
8308f9c9
MT		 75722 dev_info.id = 0xff;
75723 memset(this, 0, sizeof(*this));
75724 cfsrvl_init(&this->serv, 0, &dev_info, false);
75725- atomic_set(&this->req_seq_no, 1);
75726- atomic_set(&this->rsp_seq_no, 1);
75727+ atomic_set_unchecked(&this->req_seq_no, 1);
75728+ atomic_set_unchecked(&this->rsp_seq_no, 1);
75729 this->serv.layer.receive = cfctrl_recv;
75730 sprintf(this->serv.layer.name, "ctrl");
75731 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
66a7e928 75732@@ -116,8 +117,8 @@ void cfctrl_insert_req(struct cfctrl *ct
8308f9c9
MT		 75733 struct cfctrl_request_info *req)
75734 {
75735 spin_lock(&ctrl->info_list_lock);
75736- atomic_inc(&ctrl->req_seq_no);
75737- req->sequence_no = atomic_read(&ctrl->req_seq_no);
75738+ atomic_inc_unchecked(&ctrl->req_seq_no);
75739+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
75740 list_add_tail(&req->list, &ctrl->list);
75741 spin_unlock(&ctrl->info_list_lock);
75742 }
66a7e928 75743@@ -136,7 +137,7 @@ struct cfctrl_request_info *cfctrl_remov
8308f9c9
MT		 75744 if (p != first)
75745 pr_warn("Requests are not received in order\n");
75746
75747- atomic_set(&ctrl->rsp_seq_no,
75748+ atomic_set_unchecked(&ctrl->rsp_seq_no,
75749 p->sequence_no);
75750 list_del(&p->list);
75751 goto out;
66a7e928
MT		 75752@@ -385,6 +386,7 @@ static int cfctrl_recv(struct cflayer *l
75753 struct cfctrl *cfctrl = container_obj(layer);
75754 struct cfctrl_request_info rsp, *req;
75755
75756+ pax_track_stack();
75757
75758 cfpkt_extr_head(pkt, &cmdrsp, 1);
75759 cmd = cmdrsp & CFCTRL_CMD_MASK;
75760diff -urNp linux-2.6.39/net/can/bcm.c linux-2.6.39/net/can/bcm.c
75761--- linux-2.6.39/net/can/bcm.c 2011-05-19 00:06:34.000000000 -0400
75762+++ linux-2.6.39/net/can/bcm.c 2011-05-22 19:41:42.000000000 -0400
16454cff
MT		 75763@@ -165,9 +165,15 @@ static int bcm_proc_show(struct seq_file
75764 struct bcm_sock *bo = bcm_sk(sk);
75765 struct bcm_op *op;
75766
75767+#ifdef CONFIG_GRKERNSEC_HIDESYM
75768+ seq_printf(m, ">>> socket %p", NULL);
75769+ seq_printf(m, " / sk %p", NULL);
75770+ seq_printf(m, " / bo %p", NULL);
75771+#else
75772 seq_printf(m, ">>> socket %p", sk->sk_socket);
75773 seq_printf(m, " / sk %p", sk);
75774 seq_printf(m, " / bo %p", bo);
75775+#endif
75776 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
75777 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
75778 seq_printf(m, " <<<\n");
66a7e928
MT		 75779diff -urNp linux-2.6.39/net/core/datagram.c linux-2.6.39/net/core/datagram.c
75780--- linux-2.6.39/net/core/datagram.c 2011-05-19 00:06:34.000000000 -0400
75781+++ linux-2.6.39/net/core/datagram.c 2011-05-22 19:36:33.000000000 -0400
8308f9c9
MT		 75782@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
75783 }
75784
75785 kfree_skb(skb);
75786- atomic_inc(&sk->sk_drops);
75787+ atomic_inc_unchecked(&sk->sk_drops);
75788 sk_mem_reclaim_partial(sk);
75789
75790 return err;
66a7e928
MT		 75791diff -urNp linux-2.6.39/net/core/dev.c linux-2.6.39/net/core/dev.c
75792--- linux-2.6.39/net/core/dev.c 2011-05-19 00:06:34.000000000 -0400
75793+++ linux-2.6.39/net/core/dev.c 2011-05-22 19:41:42.000000000 -0400
75794@@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
16454cff
MT		 75795 if (no_module && capable(CAP_NET_ADMIN))
75796 no_module = request_module("netdev-%s", name);
75797 if (no_module && capable(CAP_SYS_MODULE)) {
71d190be
MT		 75798+#ifdef CONFIG_GRKERNSEC_MODHARDEN
75799+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
75800+#else
75801 if (!request_module("%s", name))
16454cff
MT		 75802 pr_err("Loading kernel module for a network device "
75803 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
75804 "instead\n", name);
71d190be
MT		 75805+#endif
75806 }
75807 }
75808 EXPORT_SYMBOL(dev_load);
66a7e928
MT		 75809@@ -1957,7 +1961,7 @@ struct dev_gso_cb {
75810
75811 static void dev_gso_skb_destructor(struct sk_buff *skb)
75812 {
75813- struct dev_gso_cb *cb;
75814+ const struct dev_gso_cb *cb;
75815
75816 do {
75817 struct sk_buff *nskb = skb->next;
75818@@ -2901,7 +2905,7 @@ int netif_rx_ni(struct sk_buff *skb)
ae4e228f
MT		 75819 }
75820 EXPORT_SYMBOL(netif_rx_ni);
75821
75822-static void net_tx_action(struct softirq_action *h)
75823+static void net_tx_action(void)
75824 {
75825 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75826
66a7e928 75827@@ -3765,7 +3769,7 @@ void netif_napi_del(struct napi_struct *
57199397 75828 }
ae4e228f
MT		 75829 EXPORT_SYMBOL(netif_napi_del);
75830
ae4e228f
MT		 75831-static void net_rx_action(struct softirq_action *h)
75832+static void net_rx_action(void)
75833 {
57199397 75834 struct softnet_data *sd = &__get_cpu_var(softnet_data);
ae4e228f 75835 unsigned long time_limit = jiffies + 2;
66a7e928
MT		 75836diff -urNp linux-2.6.39/net/core/flow.c linux-2.6.39/net/core/flow.c
75837--- linux-2.6.39/net/core/flow.c 2011-05-19 00:06:34.000000000 -0400
75838+++ linux-2.6.39/net/core/flow.c 2011-05-22 19:36:34.000000000 -0400
8308f9c9
MT		 75839@@ -60,7 +60,7 @@ struct flow_cache {
75840 struct timer_list rnd_timer;
75841 };
75842
75843-atomic_t flow_cache_genid = ATOMIC_INIT(0);
75844+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
75845 EXPORT_SYMBOL(flow_cache_genid);
75846 static struct flow_cache flow_cache_global;
75847 static struct kmem_cache *flow_cachep __read_mostly;
75848@@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
75849
75850 static int flow_entry_valid(struct flow_cache_entry *fle)
75851 {
75852- if (atomic_read(&flow_cache_genid) != fle->genid)
75853+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
75854 return 0;
75855 if (fle->object && !fle->object->ops->check(fle->object))
75856 return 0;
66a7e928 75857@@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const
8308f9c9
MT		 75858 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
75859 fcp->hash_count++;
75860 }
75861- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
75862+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
75863 flo = fle->object;
75864 if (!flo)
75865 goto ret_object;
75866@@ -274,7 +274,7 @@ nocache:
75867 }
75868 flo = resolver(net, key, family, dir, flo, ctx);
75869 if (fle) {
75870- fle->genid = atomic_read(&flow_cache_genid);
75871+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
75872 if (!IS_ERR(flo))
75873 fle->object = flo;
75874 else
66a7e928
MT		 75875diff -urNp linux-2.6.39/net/core/skbuff.c linux-2.6.39/net/core/skbuff.c
75876--- linux-2.6.39/net/core/skbuff.c 2011-05-19 00:06:34.000000000 -0400
75877+++ linux-2.6.39/net/core/skbuff.c 2011-05-22 19:36:34.000000000 -0400
75878@@ -1542,6 +1542,8 @@ int skb_splice_bits(struct sk_buff *skb,
75879 struct sock *sk = skb->sk;
75880 int ret = 0;
75881
75882+ pax_track_stack();
75883+
75884 if (splice_grow_spd(pipe, &spd))
75885 return -ENOMEM;
75886
75887diff -urNp linux-2.6.39/net/core/sock.c linux-2.6.39/net/core/sock.c
75888--- linux-2.6.39/net/core/sock.c 2011-05-19 00:06:34.000000000 -0400
75889+++ linux-2.6.39/net/core/sock.c 2011-05-22 19:36:34.000000000 -0400
8308f9c9
MT		 75890@@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
75891 */
75892 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
75893 (unsigned)sk->sk_rcvbuf) {
75894- atomic_inc(&sk->sk_drops);
75895+ atomic_inc_unchecked(&sk->sk_drops);
75896 return -ENOMEM;
75897 }
75898
75899@@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
75900 return err;
75901
75902 if (!sk_rmem_schedule(sk, skb->truesize)) {
75903- atomic_inc(&sk->sk_drops);
75904+ atomic_inc_unchecked(&sk->sk_drops);
75905 return -ENOBUFS;
75906 }
75907
75908@@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
75909 skb_dst_force(skb);
75910
75911 spin_lock_irqsave(&list->lock, flags);
75912- skb->dropcount = atomic_read(&sk->sk_drops);
75913+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
75914 __skb_queue_tail(list, skb);
75915 spin_unlock_irqrestore(&list->lock, flags);
75916
75917@@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
75918 skb->dev = NULL;
75919
75920 if (sk_rcvqueues_full(sk, skb)) {
75921- atomic_inc(&sk->sk_drops);
75922+ atomic_inc_unchecked(&sk->sk_drops);
75923 goto discard_and_relse;
75924 }
75925 if (nested)
75926@@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
75927 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
75928 } else if (sk_add_backlog(sk, skb)) {
75929 bh_unlock_sock(sk);
75930- atomic_inc(&sk->sk_drops);
75931+ atomic_inc_unchecked(&sk->sk_drops);
75932 goto discard_and_relse;
75933 }
75934
6892158b 75935@@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
ae4e228f
MT		 75936 return -ENOTCONN;
75937 if (lv < len)
75938 return -EINVAL;
75939- if (copy_to_user(optval, address, len))
75940+ if (len > sizeof(address) || copy_to_user(optval, address, len))
75941 return -EFAULT;
75942 goto lenout;
75943 }
6892158b 75944@@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
ae4e228f
MT		 75945
75946 if (len > lv)
75947 len = lv;
75948- if (copy_to_user(optval, &v, len))
75949+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
75950 return -EFAULT;
75951 lenout:
75952 if (put_user(len, optlen))
8308f9c9
MT		 75953@@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
75954 */
75955 smp_wmb();
75956 atomic_set(&sk->sk_refcnt, 1);
75957- atomic_set(&sk->sk_drops, 0);
75958+ atomic_set_unchecked(&sk->sk_drops, 0);
75959 }
75960 EXPORT_SYMBOL(sock_init_data);
75961
66a7e928
MT		 75962diff -urNp linux-2.6.39/net/decnet/sysctl_net_decnet.c linux-2.6.39/net/decnet/sysctl_net_decnet.c
75963--- linux-2.6.39/net/decnet/sysctl_net_decnet.c 2011-05-19 00:06:34.000000000 -0400
75964+++ linux-2.6.39/net/decnet/sysctl_net_decnet.c 2011-05-22 19:36:34.000000000 -0400
ae4e228f
MT		 75965@@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
75966
75967 if (len > *lenp) len = *lenp;
75968
75969- if (copy_to_user(buffer, addr, len))
bc901d79 75970+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
ae4e228f
MT		 75971 return -EFAULT;
75972
75973 *lenp = len;
75974@@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
75975
75976 if (len > *lenp) len = *lenp;
75977
75978- if (copy_to_user(buffer, devname, len))
bc901d79 75979+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
ae4e228f
MT		 75980 return -EFAULT;
75981
75982 *lenp = len;
66a7e928
MT		 75983diff -urNp linux-2.6.39/net/econet/Kconfig linux-2.6.39/net/econet/Kconfig
75984--- linux-2.6.39/net/econet/Kconfig 2011-05-19 00:06:34.000000000 -0400
75985+++ linux-2.6.39/net/econet/Kconfig 2011-05-22 19:41:42.000000000 -0400
bc901d79
MT		 75986@@ -4,7 +4,7 @@
75987
75988 config ECONET
75989 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
75990- depends on EXPERIMENTAL && INET
75991+ depends on EXPERIMENTAL && INET && BROKEN
75992 ---help---
75993 Econet is a fairly old and slow networking protocol mainly used by
75994 Acorn computers to access file and print servers. It uses native
66a7e928
MT		 75995diff -urNp linux-2.6.39/net/ipv4/fib_frontend.c linux-2.6.39/net/ipv4/fib_frontend.c
75996--- linux-2.6.39/net/ipv4/fib_frontend.c 2011-05-19 00:06:34.000000000 -0400
75997+++ linux-2.6.39/net/ipv4/fib_frontend.c 2011-05-22 19:36:34.000000000 -0400
75998@@ -968,12 +968,12 @@ static int fib_inetaddr_event(struct not
75999 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76000 fib_sync_up(dev);
76001 #endif
76002- atomic_inc(&net->ipv4.dev_addr_genid);
76003+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76004 rt_cache_flush(dev_net(dev), -1);
76005 break;
76006 case NETDEV_DOWN:
76007 fib_del_ifaddr(ifa, NULL);
76008- atomic_inc(&net->ipv4.dev_addr_genid);
76009+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76010 if (ifa->ifa_dev->ifa_list == NULL) {
76011 /* Last address was deleted from this interface.
76012 * Disable IP.
76013@@ -1009,7 +1009,7 @@ static int fib_netdev_event(struct notif
76014 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76015 fib_sync_up(dev);
76016 #endif
76017- atomic_inc(&net->ipv4.dev_addr_genid);
76018+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76019 rt_cache_flush(dev_net(dev), -1);
76020 break;
76021 case NETDEV_DOWN:
76022diff -urNp linux-2.6.39/net/ipv4/fib_semantics.c linux-2.6.39/net/ipv4/fib_semantics.c
76023--- linux-2.6.39/net/ipv4/fib_semantics.c 2011-05-19 00:06:34.000000000 -0400
76024+++ linux-2.6.39/net/ipv4/fib_semantics.c 2011-05-22 19:36:34.000000000 -0400
76025@@ -701,7 +701,7 @@ __be32 fib_info_update_nh_saddr(struct n
76026 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76027 nh->nh_gw,
76028 nh->nh_parent->fib_scope);
76029- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76030+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76031
76032 return nh->nh_saddr;
76033 }
76034diff -urNp linux-2.6.39/net/ipv4/inet_diag.c linux-2.6.39/net/ipv4/inet_diag.c
76035--- linux-2.6.39/net/ipv4/inet_diag.c 2011-05-19 00:06:34.000000000 -0400
76036+++ linux-2.6.39/net/ipv4/inet_diag.c 2011-05-22 19:41:42.000000000 -0400
bc901d79
MT		 76037@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
76038 r->idiag_retrans = 0;
76039
76040 r->id.idiag_if = sk->sk_bound_dev_if;
76041+
76042+#ifdef CONFIG_GRKERNSEC_HIDESYM
76043+ r->id.idiag_cookie[0] = 0;
76044+ r->id.idiag_cookie[1] = 0;
76045+#else
76046 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
76047 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76048+#endif
76049
76050 r->id.idiag_sport = inet->inet_sport;
76051 r->id.idiag_dport = inet->inet_dport;
76052@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
76053 r->idiag_family = tw->tw_family;
76054 r->idiag_retrans = 0;
76055 r->id.idiag_if = tw->tw_bound_dev_if;
76056+
76057+#ifdef CONFIG_GRKERNSEC_HIDESYM
76058+ r->id.idiag_cookie[0] = 0;
76059+ r->id.idiag_cookie[1] = 0;
76060+#else
76061 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
76062 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
76063+#endif
76064+
76065 r->id.idiag_sport = tw->tw_sport;
76066 r->id.idiag_dport = tw->tw_dport;
76067 r->id.idiag_src[0] = tw->tw_rcv_saddr;
76068@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
76069 if (sk == NULL)
76070 goto unlock;
76071
76072+#ifndef CONFIG_GRKERNSEC_HIDESYM
76073 err = -ESTALE;
76074 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76075 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76076 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76077 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76078 goto out;
76079+#endif
76080
76081 err = -ENOMEM;
76082 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76083@@ -582,8 +597,14 @@ static int inet_diag_fill_req(struct sk_
76084 r->idiag_retrans = req->retrans;
76085
76086 r->id.idiag_if = sk->sk_bound_dev_if;
76087+
76088+#ifdef CONFIG_GRKERNSEC_HIDESYM
76089+ r->id.idiag_cookie[0] = 0;
76090+ r->id.idiag_cookie[1] = 0;
76091+#else
76092 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76093 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76094+#endif
76095
76096 tmo = req->expires - jiffies;
76097 if (tmo < 0)
66a7e928
MT		 76098diff -urNp linux-2.6.39/net/ipv4/inet_hashtables.c linux-2.6.39/net/ipv4/inet_hashtables.c
76099--- linux-2.6.39/net/ipv4/inet_hashtables.c 2011-05-19 00:06:34.000000000 -0400
76100+++ linux-2.6.39/net/ipv4/inet_hashtables.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 76101@@ -18,11 +18,14 @@
76102 #include <linux/sched.h>
76103 #include <linux/slab.h>
76104 #include <linux/wait.h>
76105+#include <linux/security.h>
76106
76107 #include <net/inet_connection_sock.h>
76108 #include <net/inet_hashtables.h>
76109 #include <net/ip.h>
76110
76111+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76112+
76113 /*
76114 * Allocate and initialize a new local port bind bucket.
76115 * The bindhash mutex for snum's hash chain must be held here.
bc901d79 76116@@ -529,6 +532,8 @@ ok:
ae4e228f 76117 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
58c5fc13
MT		 76118 spin_unlock(&head->lock);
76119
76120+ gr_update_task_in_ip_table(current, inet_sk(sk));
76121+
76122 if (tw) {
76123 inet_twsk_deschedule(tw, death_row);
ae4e228f 76124 while (twrefcnt) {
66a7e928
MT		 76125diff -urNp linux-2.6.39/net/ipv4/inetpeer.c linux-2.6.39/net/ipv4/inetpeer.c
76126--- linux-2.6.39/net/ipv4/inetpeer.c 2011-05-19 00:06:34.000000000 -0400
76127+++ linux-2.6.39/net/ipv4/inetpeer.c 2011-05-22 19:36:34.000000000 -0400
76128@@ -467,6 +467,8 @@ struct inet_peer *inet_getpeer(struct in
76129 unsigned int sequence;
76130 int invalidated;
76131
76132+ pax_track_stack();
76133+
76134 /* Look up for the address quickly, lockless.
76135 * Because of a concurrent writer, we might not find an existing entry.
76136 */
76137@@ -504,8 +506,8 @@ struct inet_peer *inet_getpeer(struct in
6892158b 76138 if (p) {
16454cff 76139 p->daddr = *daddr;
6892158b
MT		 76140 atomic_set(&p->refcnt, 1);
76141- atomic_set(&p->rid, 0);
66a7e928 76142- atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
6892158b 76143+ atomic_set_unchecked(&p->rid, 0);
66a7e928 76144+ atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
6892158b 76145 p->tcp_ts_stamp = 0;
66a7e928
MT		 76146 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
76147 p->rate_tokens = 0;
76148diff -urNp linux-2.6.39/net/ipv4/ip_fragment.c linux-2.6.39/net/ipv4/ip_fragment.c
76149--- linux-2.6.39/net/ipv4/ip_fragment.c 2011-05-19 00:06:34.000000000 -0400
76150+++ linux-2.6.39/net/ipv4/ip_fragment.c 2011-05-22 19:36:34.000000000 -0400
76151@@ -297,7 +297,7 @@ static inline int ip_frag_too_far(struct
6892158b
MT		 76152 return 0;
76153
76154 start = qp->rid;
76155- end = atomic_inc_return(&peer->rid);
76156+ end = atomic_inc_return_unchecked(&peer->rid);
76157 qp->rid = end;
76158
76159 rc = qp->q.fragments && (end - start) > max;
66a7e928
MT		 76160diff -urNp linux-2.6.39/net/ipv4/ip_sockglue.c linux-2.6.39/net/ipv4/ip_sockglue.c
76161--- linux-2.6.39/net/ipv4/ip_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76162+++ linux-2.6.39/net/ipv4/ip_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76163@@ -1064,6 +1064,8 @@ static int do_ip_getsockopt(struct sock
76164 int val;
76165 int len;
76166
76167+ pax_track_stack();
76168+
76169 if (level != SOL_IP)
76170 return -EOPNOTSUPP;
76171
76172diff -urNp linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c
76173--- linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-19 00:06:34.000000000 -0400
76174+++ linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-22 19:36:34.000000000 -0400
76175@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
58c5fc13
MT		 76176
76177 *len = 0;
76178
76179- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76180+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76181 if (*octets == NULL) {
76182 if (net_ratelimit())
57199397 76183 pr_notice("OOM in bsalg (%d)\n", __LINE__);
66a7e928
MT		 76184diff -urNp linux-2.6.39/net/ipv4/raw.c linux-2.6.39/net/ipv4/raw.c
76185--- linux-2.6.39/net/ipv4/raw.c 2011-05-19 00:06:34.000000000 -0400
76186+++ linux-2.6.39/net/ipv4/raw.c 2011-05-22 19:41:42.000000000 -0400
8308f9c9
MT		 76187@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
76188 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76189 {
76190 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76191- atomic_inc(&sk->sk_drops);
76192+ atomic_inc_unchecked(&sk->sk_drops);
76193 kfree_skb(skb);
76194 return NET_RX_DROP;
76195 }
66a7e928 76196@@ -730,15 +730,19 @@ static int raw_init(struct sock *sk)
71d190be
MT		 76197
76198 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76199 {
76200+ struct icmp_filter filter;
76201+
76202 if (optlen > sizeof(struct icmp_filter))
76203 optlen = sizeof(struct icmp_filter);
76204- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76205+ if (copy_from_user(&filter, optval, optlen))
76206 return -EFAULT;
76207+ memcpy(&raw_sk(sk)->filter, &filter, sizeof(filter));
76208 return 0;
76209 }
76210
76211 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76212 {
76213+ struct icmp_filter filter;
76214 int len, ret = -EFAULT;
76215
76216 if (get_user(len, optlen))
66a7e928 76217@@ -749,8 +753,9 @@ static int raw_geticmpfilter(struct sock
71d190be
MT		 76218 if (len > sizeof(struct icmp_filter))
76219 len = sizeof(struct icmp_filter);
76220 ret = -EFAULT;
76221+ memcpy(&filter, &raw_sk(sk)->filter, len);
76222 if (put_user(len, optlen) ||
76223- copy_to_user(optval, &raw_sk(sk)->filter, len))
76224+ copy_to_user(optval, &filter, len))
76225 goto out;
76226 ret = 0;
76227 out: return ret;
66a7e928 76228@@ -978,7 +983,13 @@ static void raw_sock_seq_show(struct seq
8308f9c9
MT		 76229 sk_wmem_alloc_get(sp),
76230 sk_rmem_alloc_get(sp),
76231 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76232- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
66a7e928
MT		 76233+ atomic_read(&sp->sk_refcnt),
76234+#ifdef CONFIG_GRKERNSEC_HIDESYM
76235+ NULL,
76236+#else
76237+ sp,
76238+#endif
76239+ atomic_read_unchecked(&sp->sk_drops));
8308f9c9
MT		 76240 }
76241
76242 static int raw_seq_show(struct seq_file *seq, void *v)
66a7e928
MT		 76243diff -urNp linux-2.6.39/net/ipv4/route.c linux-2.6.39/net/ipv4/route.c
76244--- linux-2.6.39/net/ipv4/route.c 2011-05-19 00:06:34.000000000 -0400
76245+++ linux-2.6.39/net/ipv4/route.c 2011-05-22 19:36:34.000000000 -0400
76246@@ -303,7 +303,7 @@ static inline unsigned int rt_hash(__be3
8308f9c9
MT		 76247
76248 static inline int rt_genid(struct net *net)
76249 {
76250- return atomic_read(&net->ipv4.rt_genid);
76251+ return atomic_read_unchecked(&net->ipv4.rt_genid);
76252 }
76253
76254 #ifdef CONFIG_PROC_FS
66a7e928 76255@@ -831,7 +831,7 @@ static void rt_cache_invalidate(struct n
8308f9c9
MT		 76256 unsigned char shuffle;
76257
76258 get_random_bytes(&shuffle, sizeof(shuffle));
76259- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76260+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76261 }
76262
76263 /*
66a7e928
MT		 76264@@ -2835,7 +2835,7 @@ static int rt_fill_info(struct net *net,
76265 rt->peer->pmtu_expires - jiffies : 0;
6892158b
MT		 76266 if (rt->peer) {
76267 inet_peer_refcheck(rt->peer);
76268- id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
76269+ id = atomic_read_unchecked(&rt->peer->ip_id_count) & 0xffff;
76270 if (rt->peer->tcp_ts_stamp) {
76271 ts = rt->peer->tcp_ts;
76272 tsage = get_seconds() - rt->peer->tcp_ts_stamp;
66a7e928
MT		 76273diff -urNp linux-2.6.39/net/ipv4/tcp.c linux-2.6.39/net/ipv4/tcp.c
76274--- linux-2.6.39/net/ipv4/tcp.c 2011-05-19 00:06:34.000000000 -0400
76275+++ linux-2.6.39/net/ipv4/tcp.c 2011-05-22 19:36:34.000000000 -0400
76276@@ -2121,6 +2121,8 @@ static int do_tcp_setsockopt(struct sock
76277 int val;
76278 int err = 0;
76279
76280+ pax_track_stack();
76281+
76282 /* These are data/string values, all the others are ints */
76283 switch (optname) {
76284 case TCP_CONGESTION: {
76285@@ -2500,6 +2502,8 @@ static int do_tcp_getsockopt(struct sock
76286 struct tcp_sock *tp = tcp_sk(sk);
76287 int val, len;
76288
76289+ pax_track_stack();
76290+
76291 if (get_user(len, optlen))
76292 return -EFAULT;
76293
76294diff -urNp linux-2.6.39/net/ipv4/tcp_ipv4.c linux-2.6.39/net/ipv4/tcp_ipv4.c
76295--- linux-2.6.39/net/ipv4/tcp_ipv4.c 2011-05-19 00:06:34.000000000 -0400
76296+++ linux-2.6.39/net/ipv4/tcp_ipv4.c 2011-05-22 19:41:42.000000000 -0400
6892158b 76297@@ -86,6 +86,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
ae4e228f 76298 int sysctl_tcp_low_latency __read_mostly;
6892158b 76299 EXPORT_SYMBOL(sysctl_tcp_low_latency);
58c5fc13 76300
58c5fc13 76301+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
ae4e228f 76302+extern int grsec_enable_blackhole;
58c5fc13 76303+#endif
ae4e228f
MT		 76304
76305 #ifdef CONFIG_TCP_MD5SIG
76306 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
66a7e928 76307@@ -1594,6 +1597,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
57199397
MT		 76308 return 0;
76309
76310 reset:
76311+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76312+ if (!grsec_enable_blackhole)
76313+#endif
76314 tcp_v4_send_reset(rsk, skb);
76315 discard:
76316 kfree_skb(skb);
66a7e928 76317@@ -1656,12 +1662,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
ae4e228f
MT		 76318 TCP_SKB_CB(skb)->sacked = 0;
76319
76320 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76321- if (!sk)
76322+ if (!sk) {
76323+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76324+ ret = 1;
76325+#endif
76326 goto no_tcp_socket;
df50ba0c 76327-
ae4e228f 76328+ }
ae4e228f
MT		 76329 process:
76330- if (sk->sk_state == TCP_TIME_WAIT)
76331+ if (sk->sk_state == TCP_TIME_WAIT) {
76332+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76333+ ret = 2;
76334+#endif
76335 goto do_time_wait;
76336+ }
76337
df50ba0c
MT		 76338 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76339 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
66a7e928 76340@@ -1711,6 +1724,10 @@ no_tcp_socket:
58c5fc13
MT		 76341 bad_packet:
76342 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76343 } else {
76344+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
ae4e228f
MT		 76345+ if (!grsec_enable_blackhole || (ret == 1 &&
76346+ (skb->dev->flags & IFF_LOOPBACK)))
58c5fc13
MT		 76347+#endif
76348 tcp_v4_send_reset(NULL, skb);
76349 }
76350
66a7e928 76351@@ -2374,7 +2391,11 @@ static void get_openreq4(struct sock *sk
57199397
MT		 76352 0, /* non standard timer */
76353 0, /* open_requests have no inode */
76354 atomic_read(&sk->sk_refcnt),
76355+#ifdef CONFIG_GRKERNSEC_HIDESYM
76356+ NULL,
76357+#else
76358 req,
76359+#endif
76360 len);
76361 }
76362
66a7e928 76363@@ -2424,7 +2445,12 @@ static void get_tcp4_sock(struct sock *s
57199397
MT		 76364 sock_i_uid(sk),
76365 icsk->icsk_probes_out,
76366 sock_i_ino(sk),
76367- atomic_read(&sk->sk_refcnt), sk,
76368+ atomic_read(&sk->sk_refcnt),
76369+#ifdef CONFIG_GRKERNSEC_HIDESYM
76370+ NULL,
76371+#else
76372+ sk,
76373+#endif
76374 jiffies_to_clock_t(icsk->icsk_rto),
76375 jiffies_to_clock_t(icsk->icsk_ack.ato),
76376 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
66a7e928 76377@@ -2452,7 +2478,13 @@ static void get_timewait4_sock(struct in
57199397
MT		 76378 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
76379 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76380 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76381- atomic_read(&tw->tw_refcnt), tw, len);
76382+ atomic_read(&tw->tw_refcnt),
76383+#ifdef CONFIG_GRKERNSEC_HIDESYM
76384+ NULL,
76385+#else
76386+ tw,
76387+#endif
76388+ len);
76389 }
76390
76391 #define TMPSZ 150
66a7e928
MT		 76392diff -urNp linux-2.6.39/net/ipv4/tcp_minisocks.c linux-2.6.39/net/ipv4/tcp_minisocks.c
76393--- linux-2.6.39/net/ipv4/tcp_minisocks.c 2011-05-19 00:06:34.000000000 -0400
76394+++ linux-2.6.39/net/ipv4/tcp_minisocks.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c 76395@@ -27,6 +27,10 @@
ae4e228f
MT		 76396 #include <net/inet_common.h>
76397 #include <net/xfrm.h>
76398
76399+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76400+extern int grsec_enable_blackhole;
76401+#endif
76402+
76403 int sysctl_tcp_syncookies __read_mostly = 1;
76404 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76405
16454cff 76406@@ -745,6 +749,10 @@ listen_overflow:
58c5fc13
MT		 76407
76408 embryonic_reset:
76409 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76410+
df50ba0c
MT		 76411+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76412+ if (!grsec_enable_blackhole)
58c5fc13 76413+#endif
df50ba0c
MT		 76414 if (!(flg & TCP_FLAG_RST))
76415 req->rsk_ops->send_reset(sk, skb);
58c5fc13 76416
66a7e928
MT		 76417diff -urNp linux-2.6.39/net/ipv4/tcp_output.c linux-2.6.39/net/ipv4/tcp_output.c
76418--- linux-2.6.39/net/ipv4/tcp_output.c 2011-05-19 00:06:34.000000000 -0400
76419+++ linux-2.6.39/net/ipv4/tcp_output.c 2011-05-22 19:36:34.000000000 -0400
76420@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
76421 int mss;
76422 int s_data_desired = 0;
76423
76424+ pax_track_stack();
76425+
76426 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
76427 s_data_desired = cvp->s_data_desired;
76428 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
76429diff -urNp linux-2.6.39/net/ipv4/tcp_probe.c linux-2.6.39/net/ipv4/tcp_probe.c
76430--- linux-2.6.39/net/ipv4/tcp_probe.c 2011-05-19 00:06:34.000000000 -0400
76431+++ linux-2.6.39/net/ipv4/tcp_probe.c 2011-05-22 19:36:34.000000000 -0400
df50ba0c 76432@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
ae4e228f
MT		 76433 if (cnt + width >= len)
76434 break;
76435
76436- if (copy_to_user(buf + cnt, tbuf, width))
bc901d79 76437+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
ae4e228f
MT		 76438 return -EFAULT;
76439 cnt += width;
76440 }
66a7e928
MT		 76441diff -urNp linux-2.6.39/net/ipv4/tcp_timer.c linux-2.6.39/net/ipv4/tcp_timer.c
76442--- linux-2.6.39/net/ipv4/tcp_timer.c 2011-05-19 00:06:34.000000000 -0400
76443+++ linux-2.6.39/net/ipv4/tcp_timer.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c
MT		 76444@@ -22,6 +22,10 @@
76445 #include <linux/gfp.h>
ae4e228f
MT		 76446 #include <net/tcp.h>
76447
76448+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76449+extern int grsec_lastack_retries;
76450+#endif
76451+
76452 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76453 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76454 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
bc901d79 76455@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
ae4e228f
MT		 76456 }
76457 }
76458
76459+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76460+ if ((sk->sk_state == TCP_LAST_ACK) &&
76461+ (grsec_lastack_retries > 0) &&
76462+ (grsec_lastack_retries < retry_until))
76463+ retry_until = grsec_lastack_retries;
76464+#endif
76465+
bc901d79
MT		 76466 if (retransmits_timed_out(sk, retry_until,
76467 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
ae4e228f 76468 /* Has it gone just too far? */
66a7e928
MT		 76469diff -urNp linux-2.6.39/net/ipv4/udp.c linux-2.6.39/net/ipv4/udp.c
76470--- linux-2.6.39/net/ipv4/udp.c 2011-05-19 00:06:34.000000000 -0400
76471+++ linux-2.6.39/net/ipv4/udp.c 2011-05-22 19:41:42.000000000 -0400
58c5fc13
MT		 76472@@ -86,6 +86,7 @@
76473 #include <linux/types.h>
76474 #include <linux/fcntl.h>
76475 #include <linux/module.h>
76476+#include <linux/security.h>
76477 #include <linux/socket.h>
76478 #include <linux/sockios.h>
76479 #include <linux/igmp.h>
df50ba0c 76480@@ -107,6 +108,10 @@
ae4e228f
MT		 76481 #include <net/xfrm.h>
76482 #include "udp_impl.h"
76483
76484+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76485+extern int grsec_enable_blackhole;
76486+#endif
76487+
76488 struct udp_table udp_table __read_mostly;
76489 EXPORT_SYMBOL(udp_table);
76490
57199397 76491@@ -564,6 +569,9 @@ found:
58c5fc13
MT		 76492 return s;
76493 }
76494
76495+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76496+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76497+
76498 /*
76499 * This routine is called by the ICMP module when it gets some
76500 * sort of error condition. If err < 0 then the socket should
66a7e928 76501@@ -853,9 +861,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
58c5fc13
MT		 76502 dport = usin->sin_port;
76503 if (dport == 0)
76504 return -EINVAL;
76505+
76506+ err = gr_search_udp_sendmsg(sk, usin);
76507+ if (err)
76508+ return err;
76509 } else {
76510 if (sk->sk_state != TCP_ESTABLISHED)
76511 return -EDESTADDRREQ;
76512+
76513+ err = gr_search_udp_sendmsg(sk, NULL);
76514+ if (err)
76515+ return err;
76516+
ae4e228f
MT		 76517 daddr = inet->inet_daddr;
76518 dport = inet->inet_dport;
58c5fc13 76519 /* Open fast path for connected socket.
66a7e928 76520@@ -1090,7 +1107,7 @@ static unsigned int first_packet_length(
8308f9c9
MT		 76521 udp_lib_checksum_complete(skb)) {
76522 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76523 IS_UDPLITE(sk));
76524- atomic_inc(&sk->sk_drops);
76525+ atomic_inc_unchecked(&sk->sk_drops);
76526 __skb_unlink(skb, rcvq);
76527 __skb_queue_tail(&list_kill, skb);
76528 }
66a7e928 76529@@ -1176,6 +1193,10 @@ try_again:
58c5fc13
MT		 76530 if (!skb)
76531 goto out;
76532
76533+ err = gr_search_udp_recvmsg(sk, skb);
76534+ if (err)
76535+ goto out_free;
76536+
76537 ulen = skb->len - sizeof(struct udphdr);
df50ba0c
MT		 76538 if (len > ulen)
76539 len = ulen;
66a7e928 76540@@ -1472,7 +1493,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
8308f9c9
MT		 76541
76542 drop:
76543 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76544- atomic_inc(&sk->sk_drops);
76545+ atomic_inc_unchecked(&sk->sk_drops);
76546 kfree_skb(skb);
76547 return -1;
76548 }
66a7e928 76549@@ -1491,7 +1512,7 @@ static void flush_stack(struct sock **st
8308f9c9
MT		 76550 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
76551
76552 if (!skb1) {
76553- atomic_inc(&sk->sk_drops);
76554+ atomic_inc_unchecked(&sk->sk_drops);
76555 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76556 IS_UDPLITE(sk));
76557 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
66a7e928 76558@@ -1660,6 +1681,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
58c5fc13
MT		 76559 goto csum_error;
76560
76561 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76562+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
ae4e228f 76563+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
58c5fc13
MT		 76564+#endif
76565 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76566
76567 /*
66a7e928 76568@@ -2087,8 +2111,13 @@ static void udp4_format_sock(struct sock
57199397
MT		 76569 sk_wmem_alloc_get(sp),
76570 sk_rmem_alloc_get(sp),
76571 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76572- atomic_read(&sp->sk_refcnt), sp,
8308f9c9 76573- atomic_read(&sp->sk_drops), len);
57199397
MT		 76574+ atomic_read(&sp->sk_refcnt),
76575+#ifdef CONFIG_GRKERNSEC_HIDESYM
76576+ NULL,
76577+#else
76578+ sp,
76579+#endif
8308f9c9 76580+ atomic_read_unchecked(&sp->sk_drops), len);
57199397
MT		 76581 }
76582
8308f9c9 76583 int udp4_seq_show(struct seq_file *seq, void *v)
66a7e928
MT		 76584diff -urNp linux-2.6.39/net/ipv6/inet6_connection_sock.c linux-2.6.39/net/ipv6/inet6_connection_sock.c
76585--- linux-2.6.39/net/ipv6/inet6_connection_sock.c 2011-05-19 00:06:34.000000000 -0400
76586+++ linux-2.6.39/net/ipv6/inet6_connection_sock.c 2011-05-22 19:36:34.000000000 -0400
76587@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
8308f9c9
MT		 76588 #ifdef CONFIG_XFRM
76589 {
76590 struct rt6_info *rt = (struct rt6_info *)dst;
76591- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76592+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76593 }
76594 #endif
76595 }
66a7e928 76596@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
8308f9c9
MT		 76597 #ifdef CONFIG_XFRM
76598 if (dst) {
76599 struct rt6_info *rt = (struct rt6_info *)dst;
76600- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76601+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76602 __sk_dst_reset(sk);
76603 dst = NULL;
76604 }
66a7e928
MT		 76605diff -urNp linux-2.6.39/net/ipv6/ipv6_sockglue.c linux-2.6.39/net/ipv6/ipv6_sockglue.c
76606--- linux-2.6.39/net/ipv6/ipv6_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76607+++ linux-2.6.39/net/ipv6/ipv6_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76608@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
76609 int val, valbool;
76610 int retv = -ENOPROTOOPT;
76611
76612+ pax_track_stack();
76613+
76614 if (optval == NULL)
76615 val=0;
76616 else {
76617@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
76618 int len;
76619 int val;
76620
76621+ pax_track_stack();
76622+
76623 if (ip6_mroute_opt(optname))
76624 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
76625
76626diff -urNp linux-2.6.39/net/ipv6/raw.c linux-2.6.39/net/ipv6/raw.c
76627--- linux-2.6.39/net/ipv6/raw.c 2011-05-19 00:06:34.000000000 -0400
76628+++ linux-2.6.39/net/ipv6/raw.c 2011-05-22 19:41:42.000000000 -0400
8308f9c9
MT		 76629@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
76630 {
76631 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
76632 skb_checksum_complete(skb)) {
76633- atomic_inc(&sk->sk_drops);
76634+ atomic_inc_unchecked(&sk->sk_drops);
76635 kfree_skb(skb);
76636 return NET_RX_DROP;
76637 }
76638@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76639 struct raw6_sock *rp = raw6_sk(sk);
76640
76641 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76642- atomic_inc(&sk->sk_drops);
76643+ atomic_inc_unchecked(&sk->sk_drops);
76644 kfree_skb(skb);
76645 return NET_RX_DROP;
76646 }
76647@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76648
76649 if (inet->hdrincl) {
76650 if (skb_checksum_complete(skb)) {
76651- atomic_inc(&sk->sk_drops);
76652+ atomic_inc_unchecked(&sk->sk_drops);
76653 kfree_skb(skb);
76654 return NET_RX_DROP;
76655 }
66a7e928 76656@@ -601,7 +601,7 @@ out:
58c5fc13
MT		 76657 return err;
76658 }
76659
76660-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76661+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
66a7e928 76662 struct flowi6 *fl6, struct dst_entry **dstp,
58c5fc13
MT		 76663 unsigned int flags)
76664 {
66a7e928
MT		 76665@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
76666 u16 proto;
76667 int err;
76668
76669+ pax_track_stack();
76670+
76671 /* Rough check on arithmetic overflow,
76672 better check is made in ip6_append_data().
76673 */
76674@@ -909,12 +911,15 @@ do_confirm:
71d190be
MT		 76675 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76676 char __user *optval, int optlen)
76677 {
76678+ struct icmp6_filter filter;
76679+
76680 switch (optname) {
76681 case ICMPV6_FILTER:
76682 if (optlen > sizeof(struct icmp6_filter))
76683 optlen = sizeof(struct icmp6_filter);
76684- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76685+ if (copy_from_user(&filter, optval, optlen))
76686 return -EFAULT;
76687+ memcpy(&raw6_sk(sk)->filter, &filter, optlen);
76688 return 0;
76689 default:
76690 return -ENOPROTOOPT;
66a7e928 76691@@ -926,6 +931,7 @@ static int rawv6_seticmpfilter(struct so
71d190be
MT		 76692 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76693 char __user *optval, int __user *optlen)
76694 {
76695+ struct icmp6_filter filter;
76696 int len;
76697
76698 switch (optname) {
66a7e928 76699@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
71d190be
MT		 76700 len = sizeof(struct icmp6_filter);
76701 if (put_user(len, optlen))
76702 return -EFAULT;
76703- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76704+ memcpy(&filter, &raw6_sk(sk)->filter, len);
76705+ if (copy_to_user(optval, &filter, len))
76706 return -EFAULT;
76707 return 0;
76708 default:
66a7e928 76709@@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
6892158b
MT		 76710 0, 0L, 0,
76711 sock_i_uid(sp), 0,
76712 sock_i_ino(sp),
76713- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76714+ atomic_read(&sp->sk_refcnt),
76715+#ifdef CONFIG_GRKERNSEC_HIDESYM
76716+ NULL,
76717+#else
76718+ sp,
76719+#endif
8308f9c9 76720+ atomic_read_unchecked(&sp->sk_drops));
6892158b
MT		 76721 }
76722
76723 static int raw6_seq_show(struct seq_file *seq, void *v)
66a7e928
MT		 76724diff -urNp linux-2.6.39/net/ipv6/tcp_ipv6.c linux-2.6.39/net/ipv6/tcp_ipv6.c
76725--- linux-2.6.39/net/ipv6/tcp_ipv6.c 2011-05-19 00:06:34.000000000 -0400
76726+++ linux-2.6.39/net/ipv6/tcp_ipv6.c 2011-05-22 19:41:42.000000000 -0400
57199397 76727@@ -92,6 +92,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
df50ba0c
MT		 76728 }
76729 #endif
76730
76731+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76732+extern int grsec_enable_blackhole;
76733+#endif
76734+
76735 static void tcp_v6_hash(struct sock *sk)
76736 {
76737 if (sk->sk_state != TCP_CLOSE) {
66a7e928 76738@@ -1660,6 +1664,9 @@ static int tcp_v6_do_rcv(struct sock *sk
57199397
MT		 76739 return 0;
76740
76741 reset:
76742+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76743+ if (!grsec_enable_blackhole)
76744+#endif
76745 tcp_v6_send_reset(sk, skb);
76746 discard:
76747 if (opt_skb)
66a7e928 76748@@ -1739,12 +1746,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
df50ba0c 76749 TCP_SKB_CB(skb)->sacked = 0;
58c5fc13 76750
df50ba0c
MT		 76751 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76752- if (!sk)
76753+ if (!sk) {
76754+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76755+ ret = 1;
76756+#endif
76757 goto no_tcp_socket;
76758+ }
76759
76760 process:
76761- if (sk->sk_state == TCP_TIME_WAIT)
76762+ if (sk->sk_state == TCP_TIME_WAIT) {
58c5fc13 76763+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
df50ba0c 76764+ ret = 2;
58c5fc13 76765+#endif
df50ba0c
MT		 76766 goto do_time_wait;
76767+ }
76768
57199397
MT		 76769 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
76770 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
66a7e928 76771@@ -1792,6 +1807,10 @@ no_tcp_socket:
58c5fc13
MT		 76772 bad_packet:
76773 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76774 } else {
76775+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
df50ba0c
MT		 76776+ if (!grsec_enable_blackhole || (ret == 1 &&
76777+ (skb->dev->flags & IFF_LOOPBACK)))
58c5fc13
MT		 76778+#endif
76779 tcp_v6_send_reset(NULL, skb);
76780 }
76781
66a7e928 76782@@ -2052,7 +2071,13 @@ static void get_openreq6(struct seq_file
6892158b
MT		 76783 uid,
76784 0, /* non standard timer */
76785 0, /* open_requests have no inode */
76786- 0, req);
76787+ 0,
76788+#ifdef CONFIG_GRKERNSEC_HIDESYM
76789+ NULL
76790+#else
76791+ req
76792+#endif
76793+ );
76794 }
76795
76796 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
66a7e928 76797@@ -2102,7 +2127,12 @@ static void get_tcp6_sock(struct seq_fil
6892158b
MT		 76798 sock_i_uid(sp),
76799 icsk->icsk_probes_out,
76800 sock_i_ino(sp),
76801- atomic_read(&sp->sk_refcnt), sp,
76802+ atomic_read(&sp->sk_refcnt),
76803+#ifdef CONFIG_GRKERNSEC_HIDESYM
76804+ NULL,
76805+#else
76806+ sp,
76807+#endif
76808 jiffies_to_clock_t(icsk->icsk_rto),
76809 jiffies_to_clock_t(icsk->icsk_ack.ato),
76810 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
66a7e928 76811@@ -2137,7 +2167,13 @@ static void get_timewait6_sock(struct se
6892158b
MT		 76812 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76813 tw->tw_substate, 0, 0,
76814 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76815- atomic_read(&tw->tw_refcnt), tw);
76816+ atomic_read(&tw->tw_refcnt),
76817+#ifdef CONFIG_GRKERNSEC_HIDESYM
76818+ NULL
76819+#else
76820+ tw
76821+#endif
76822+ );
76823 }
76824
76825 static int tcp6_seq_show(struct seq_file *seq, void *v)
66a7e928
MT		 76826diff -urNp linux-2.6.39/net/ipv6/udp.c linux-2.6.39/net/ipv6/udp.c
76827--- linux-2.6.39/net/ipv6/udp.c 2011-05-19 00:06:34.000000000 -0400
76828+++ linux-2.6.39/net/ipv6/udp.c 2011-05-22 19:41:42.000000000 -0400
df50ba0c
MT		 76829@@ -50,6 +50,10 @@
76830 #include <linux/seq_file.h>
76831 #include "udp_impl.h"
76832
76833+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76834+extern int grsec_enable_blackhole;
76835+#endif
76836+
76837 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76838 {
76839 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
66a7e928 76840@@ -545,7 +549,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
8308f9c9
MT		 76841
76842 return 0;
76843 drop:
76844- atomic_inc(&sk->sk_drops);
76845+ atomic_inc_unchecked(&sk->sk_drops);
76846 drop_no_sk_drops_inc:
76847 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76848 kfree_skb(skb);
66a7e928 76849@@ -621,7 +625,7 @@ static void flush_stack(struct sock **st
8308f9c9
MT		 76850 continue;
76851 }
76852 drop:
76853- atomic_inc(&sk->sk_drops);
76854+ atomic_inc_unchecked(&sk->sk_drops);
76855 UDP6_INC_STATS_BH(sock_net(sk),
76856 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
76857 UDP6_INC_STATS_BH(sock_net(sk),
66a7e928 76858@@ -776,6 +780,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
58c5fc13
MT		 76859 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76860 proto == IPPROTO_UDPLITE);
76861
76862+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
df50ba0c 76863+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
58c5fc13 76864+#endif
df50ba0c 76865 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
58c5fc13
MT		 76866
76867 kfree_skb(skb);
66a7e928 76868@@ -792,7 +799,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
8308f9c9
MT		 76869 if (!sock_owned_by_user(sk))
76870 udpv6_queue_rcv_skb(sk, skb);
76871 else if (sk_add_backlog(sk, skb)) {
76872- atomic_inc(&sk->sk_drops);
76873+ atomic_inc_unchecked(&sk->sk_drops);
76874 bh_unlock_sock(sk);
76875 sock_put(sk);
76876 goto discard;
66a7e928 76877@@ -1403,8 +1410,13 @@ static void udp6_sock_seq_show(struct se
6892158b
MT		 76878 0, 0L, 0,
76879 sock_i_uid(sp), 0,
76880 sock_i_ino(sp),
76881- atomic_read(&sp->sk_refcnt), sp,
8308f9c9 76882- atomic_read(&sp->sk_drops));
6892158b
MT		 76883+ atomic_read(&sp->sk_refcnt),
76884+#ifdef CONFIG_GRKERNSEC_HIDESYM
76885+ NULL,
76886+#else
76887+ sp,
76888+#endif
8308f9c9 76889+ atomic_read_unchecked(&sp->sk_drops));
6892158b
MT		 76890 }
76891
8308f9c9 76892 int udp6_seq_show(struct seq_file *seq, void *v)
66a7e928
MT		 76893diff -urNp linux-2.6.39/net/irda/ircomm/ircomm_tty.c linux-2.6.39/net/irda/ircomm/ircomm_tty.c
76894--- linux-2.6.39/net/irda/ircomm/ircomm_tty.c 2011-05-19 00:06:34.000000000 -0400
76895+++ linux-2.6.39/net/irda/ircomm/ircomm_tty.c 2011-05-22 19:36:34.000000000 -0400
df50ba0c 76896@@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
58c5fc13
MT		 76897 add_wait_queue(&self->open_wait, &wait);
76898
76899 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
76900- __FILE__,__LINE__, tty->driver->name, self->open_count );
c52201e0 76901+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
58c5fc13
MT		 76902
76903 /* As far as I can see, we protect open_count - Jean II */
76904 spin_lock_irqsave(&self->spinlock, flags);
76905 if (!tty_hung_up_p(filp)) {
76906 extra_count = 1;
76907- self->open_count--;
c52201e0 76908+ local_dec(&self->open_count);
58c5fc13
MT		 76909 }
76910 spin_unlock_irqrestore(&self->spinlock, flags);
76911- self->blocked_open++;
c52201e0 76912+ local_inc(&self->blocked_open);
58c5fc13
MT		 76913
76914 while (1) {
76915 if (tty->termios->c_cflag & CBAUD) {
df50ba0c 76916@@ -330,7 +330,7 @@ static int ircomm_tty_block_til_ready(st
58c5fc13
MT		 76917 }
76918
76919 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
76920- __FILE__,__LINE__, tty->driver->name, self->open_count );
c52201e0 76921+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
58c5fc13
MT		 76922
76923 schedule();
76924 }
df50ba0c 76925@@ -341,13 +341,13 @@ static int ircomm_tty_block_til_ready(st
58c5fc13
MT		 76926 if (extra_count) {
76927 /* ++ is not atomic, so this should be protected - Jean II */
76928 spin_lock_irqsave(&self->spinlock, flags);
76929- self->open_count++;
c52201e0 76930+ local_inc(&self->open_count);
58c5fc13
MT		 76931 spin_unlock_irqrestore(&self->spinlock, flags);
76932 }
76933- self->blocked_open--;
c52201e0 76934+ local_dec(&self->blocked_open);
58c5fc13
MT		 76935
76936 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
76937- __FILE__,__LINE__, tty->driver->name, self->open_count);
c52201e0 76938+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
58c5fc13
MT		 76939
76940 if (!retval)
76941 self->flags |= ASYNC_NORMAL_ACTIVE;
df50ba0c 76942@@ -416,14 +416,14 @@ static int ircomm_tty_open(struct tty_st
58c5fc13
MT		 76943 }
76944 /* ++ is not atomic, so this should be protected - Jean II */
76945 spin_lock_irqsave(&self->spinlock, flags);
76946- self->open_count++;
c52201e0 76947+ local_inc(&self->open_count);
58c5fc13
MT		 76948
76949 tty->driver_data = self;
76950 self->tty = tty;
76951 spin_unlock_irqrestore(&self->spinlock, flags);
76952
76953 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
76954- self->line, self->open_count);
c52201e0 76955+ self->line, local_read(&self->open_count));
58c5fc13
MT		 76956
76957 /* Not really used by us, but lets do it anyway */
76958 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
df50ba0c 76959@@ -509,7 +509,7 @@ static void ircomm_tty_close(struct tty_
58c5fc13
MT		 76960 return;
76961 }
76962
76963- if ((tty->count == 1) && (self->open_count != 1)) {
c52201e0 76964+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
58c5fc13
MT		 76965 /*
76966 * Uh, oh. tty->count is 1, which means that the tty
76967 * structure will be freed. state->count should always
df50ba0c 76968@@ -519,16 +519,16 @@ static void ircomm_tty_close(struct tty_
58c5fc13
MT		 76969 */
76970 IRDA_DEBUG(0, "%s(), bad serial port count; "
76971 "tty->count is 1, state->count is %d\n", __func__ ,
76972- self->open_count);
76973- self->open_count = 1;
c52201e0
MT		 76974+ local_read(&self->open_count));
76975+ local_set(&self->open_count, 1);
58c5fc13
MT		 76976 }
76977
76978- if (--self->open_count < 0) {
c52201e0 76979+ if (local_dec_return(&self->open_count) < 0) {
58c5fc13
MT		 76980 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
76981- __func__, self->line, self->open_count);
76982- self->open_count = 0;
c52201e0
MT		 76983+ __func__, self->line, local_read(&self->open_count));
76984+ local_set(&self->open_count, 0);
58c5fc13
MT		 76985 }
76986- if (self->open_count) {
c52201e0 76987+ if (local_read(&self->open_count)) {
58c5fc13
MT		 76988 spin_unlock_irqrestore(&self->spinlock, flags);
76989
76990 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
df50ba0c 76991@@ -560,7 +560,7 @@ static void ircomm_tty_close(struct tty_
58c5fc13
MT		 76992 tty->closing = 0;
76993 self->tty = NULL;
76994
76995- if (self->blocked_open) {
c52201e0 76996+ if (local_read(&self->blocked_open)) {
58c5fc13
MT		 76997 if (self->close_delay)
76998 schedule_timeout_interruptible(self->close_delay);
76999 wake_up_interruptible(&self->open_wait);
df50ba0c 77000@@ -1012,7 +1012,7 @@ static void ircomm_tty_hangup(struct tty
58c5fc13
MT		 77001 spin_lock_irqsave(&self->spinlock, flags);
77002 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77003 self->tty = NULL;
77004- self->open_count = 0;
c52201e0 77005+ local_set(&self->open_count, 0);
58c5fc13
MT		 77006 spin_unlock_irqrestore(&self->spinlock, flags);
77007
77008 wake_up_interruptible(&self->open_wait);
df50ba0c 77009@@ -1364,7 +1364,7 @@ static void ircomm_tty_line_info(struct
58c5fc13
MT		 77010 seq_putc(m, '\n');
77011
77012 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77013- seq_printf(m, "Open count: %d\n", self->open_count);
c52201e0 77014+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
58c5fc13
MT		 77015 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77016 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77017
66a7e928
MT		 77018diff -urNp linux-2.6.39/net/iucv/af_iucv.c linux-2.6.39/net/iucv/af_iucv.c
77019--- linux-2.6.39/net/iucv/af_iucv.c 2011-05-19 00:06:34.000000000 -0400
77020+++ linux-2.6.39/net/iucv/af_iucv.c 2011-05-22 19:36:34.000000000 -0400
8308f9c9
MT		 77021@@ -653,10 +653,10 @@ static int iucv_sock_autobind(struct soc
77022
77023 write_lock_bh(&iucv_sk_list.lock);
77024
77025- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77026+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77027 while (__iucv_get_sock_by_name(name)) {
77028 sprintf(name, "%08x",
77029- atomic_inc_return(&iucv_sk_list.autobind_name));
77030+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77031 }
77032
77033 write_unlock_bh(&iucv_sk_list.lock);
66a7e928
MT		 77034diff -urNp linux-2.6.39/net/key/af_key.c linux-2.6.39/net/key/af_key.c
77035--- linux-2.6.39/net/key/af_key.c 2011-05-19 00:06:34.000000000 -0400
77036+++ linux-2.6.39/net/key/af_key.c 2011-05-22 19:41:42.000000000 -0400
77037@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
77038 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77039 struct xfrm_kmaddress k;
77040
77041+ pax_track_stack();
77042+
77043 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77044 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77045 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77046@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
8308f9c9
MT		 77047 static u32 get_acqseq(void)
77048 {
77049 u32 res;
77050- static atomic_t acqseq;
77051+ static atomic_unchecked_t acqseq;
77052
77053 do {
77054- res = atomic_inc_return(&acqseq);
77055+ res = atomic_inc_return_unchecked(&acqseq);
77056 } while (!res);
77057 return res;
77058 }
66a7e928 77059@@ -3657,7 +3659,11 @@ static int pfkey_seq_show(struct seq_fil
57199397
MT		 77060 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
77061 else
77062 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
77063+#ifdef CONFIG_GRKERNSEC_HIDESYM
77064+ NULL,
77065+#else
77066 s,
77067+#endif
77068 atomic_read(&s->sk_refcnt),
77069 sk_rmem_alloc_get(s),
77070 sk_wmem_alloc_get(s),
66a7e928
MT		 77071diff -urNp linux-2.6.39/net/l2tp/l2tp_ip.c linux-2.6.39/net/l2tp/l2tp_ip.c
77072--- linux-2.6.39/net/l2tp/l2tp_ip.c 2011-05-19 00:06:34.000000000 -0400
77073+++ linux-2.6.39/net/l2tp/l2tp_ip.c 2011-05-22 19:36:34.000000000 -0400
77074@@ -625,7 +625,7 @@ static struct inet_protosw l2tp_ip_proto
77075 .no_check = 0,
77076 };
77077
77078-static struct net_protocol l2tp_ip_protocol __read_mostly = {
77079+static const struct net_protocol l2tp_ip_protocol = {
77080 .handler = l2tp_ip_recv,
77081 };
77082
77083diff -urNp linux-2.6.39/net/lapb/lapb_iface.c linux-2.6.39/net/lapb/lapb_iface.c
77084--- linux-2.6.39/net/lapb/lapb_iface.c 2011-05-19 00:06:34.000000000 -0400
77085+++ linux-2.6.39/net/lapb/lapb_iface.c 2011-05-22 19:36:34.000000000 -0400
77086@@ -138,8 +138,7 @@ static struct lapb_cb *lapb_create_cb(vo
77087 out:
77088 return lapb;
77089 }
77090-
77091-int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks)
77092+int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks)
77093 {
77094 struct lapb_cb *lapb;
77095 int rc = LAPB_BADTOKEN;
77096diff -urNp linux-2.6.39/net/mac80211/cfg.c linux-2.6.39/net/mac80211/cfg.c
77097--- linux-2.6.39/net/mac80211/cfg.c 2011-05-19 00:06:34.000000000 -0400
77098+++ linux-2.6.39/net/mac80211/cfg.c 2011-05-22 19:36:34.000000000 -0400
77099@@ -2029,7 +2029,7 @@ static void ieee80211_get_ringparam(stru
77100 drv_get_ringparam(local, tx, tx_max, rx, rx_max);
71d190be
MT		 77101 }
77102
77103-struct cfg80211_ops mac80211_config_ops = {
77104+const struct cfg80211_ops mac80211_config_ops = {
77105 .add_virtual_intf = ieee80211_add_iface,
77106 .del_virtual_intf = ieee80211_del_iface,
77107 .change_virtual_intf = ieee80211_change_iface,
66a7e928
MT		 77108diff -urNp linux-2.6.39/net/mac80211/cfg.h linux-2.6.39/net/mac80211/cfg.h
77109--- linux-2.6.39/net/mac80211/cfg.h 2011-05-19 00:06:34.000000000 -0400
77110+++ linux-2.6.39/net/mac80211/cfg.h 2011-05-22 19:36:34.000000000 -0400
71d190be
MT		 77111@@ -4,6 +4,6 @@
77112 #ifndef __CFG_H
77113 #define __CFG_H
77114
77115-extern struct cfg80211_ops mac80211_config_ops;
77116+extern const struct cfg80211_ops mac80211_config_ops;
77117
77118 #endif /* __CFG_H */
66a7e928
MT		 77119diff -urNp linux-2.6.39/net/mac80211/debugfs_sta.c linux-2.6.39/net/mac80211/debugfs_sta.c
77120--- linux-2.6.39/net/mac80211/debugfs_sta.c 2011-05-19 00:06:34.000000000 -0400
77121+++ linux-2.6.39/net/mac80211/debugfs_sta.c 2011-05-22 19:36:34.000000000 -0400
77122@@ -115,6 +115,8 @@ static ssize_t sta_agg_status_read(struc
77123 struct tid_ampdu_rx *tid_rx;
77124 struct tid_ampdu_tx *tid_tx;
77125
77126+ pax_track_stack();
77127+
77128 rcu_read_lock();
77129
77130 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
77131@@ -215,6 +217,8 @@ static ssize_t sta_ht_capa_read(struct f
77132 struct sta_info *sta = file->private_data;
77133 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
77134
77135+ pax_track_stack();
77136+
77137 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
77138 htc->ht_supported ? "" : "not ");
77139 if (htc->ht_supported) {
77140diff -urNp linux-2.6.39/net/mac80211/ieee80211_i.h linux-2.6.39/net/mac80211/ieee80211_i.h
77141--- linux-2.6.39/net/mac80211/ieee80211_i.h 2011-05-19 00:06:34.000000000 -0400
77142+++ linux-2.6.39/net/mac80211/ieee80211_i.h 2011-05-22 19:36:34.000000000 -0400
16454cff 77143@@ -27,6 +27,7 @@
c52201e0
MT		 77144 #include <net/ieee80211_radiotap.h>
77145 #include <net/cfg80211.h>
77146 #include <net/mac80211.h>
77147+#include <asm/local.h>
77148 #include "key.h"
77149 #include "sta_info.h"
77150
66a7e928 77151@@ -714,7 +715,7 @@ struct ieee80211_local {
ae4e228f 77152 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
58c5fc13
MT		 77153 spinlock_t queue_stop_reason_lock;
77154
58c5fc13 77155- int open_count;
c52201e0 77156+ local_t open_count;
58c5fc13
MT		 77157 int monitors, cooked_mntrs;
77158 /* number of interfaces with corresponding FIF_ flags */
bc901d79 77159 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
66a7e928
MT		 77160diff -urNp linux-2.6.39/net/mac80211/iface.c linux-2.6.39/net/mac80211/iface.c
77161--- linux-2.6.39/net/mac80211/iface.c 2011-05-19 00:06:34.000000000 -0400
77162+++ linux-2.6.39/net/mac80211/iface.c 2011-05-22 19:36:34.000000000 -0400
16454cff 77163@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
58c5fc13
MT		 77164 break;
77165 }
77166
77167- if (local->open_count == 0) {
c52201e0 77168+ if (local_read(&local->open_count) == 0) {
58c5fc13
MT		 77169 res = drv_start(local);
77170 if (res)
77171 goto err_del_bss;
16454cff 77172@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
bc901d79
MT		 77173 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
77174
77175 if (!is_valid_ether_addr(dev->dev_addr)) {
77176- if (!local->open_count)
c52201e0 77177+ if (!local_read(&local->open_count))
bc901d79
MT		 77178 drv_stop(local);
77179 return -EADDRNOTAVAIL;
77180 }
16454cff 77181@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
bc901d79 77182 mutex_unlock(&local->mtx);
58c5fc13 77183
bc901d79
MT		 77184 if (coming_up)
77185- local->open_count++;
c52201e0 77186+ local_inc(&local->open_count);
58c5fc13 77187
58c5fc13
MT		 77188 if (hw_reconf_flags) {
77189 ieee80211_hw_config(local, hw_reconf_flags);
16454cff 77190@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
58c5fc13 77191 err_del_interface:
df50ba0c 77192 drv_remove_interface(local, &sdata->vif);
58c5fc13
MT		 77193 err_stop:
77194- if (!local->open_count)
c52201e0 77195+ if (!local_read(&local->open_count))
58c5fc13
MT		 77196 drv_stop(local);
77197 err_del_bss:
77198 sdata->bss = NULL;
66a7e928 77199@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct iee
58c5fc13
MT		 77200 }
77201
bc901d79
MT		 77202 if (going_down)
77203- local->open_count--;
c52201e0 77204+ local_dec(&local->open_count);
58c5fc13
MT		 77205
77206 switch (sdata->vif.type) {
77207 case NL80211_IFTYPE_AP_VLAN:
66a7e928 77208@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct iee
58c5fc13
MT		 77209
77210 ieee80211_recalc_ps(local, -1);
77211
77212- if (local->open_count == 0) {
c52201e0 77213+ if (local_read(&local->open_count) == 0) {
bc901d79
MT		 77214 if (local->ops->napi_poll)
77215 napi_disable(&local->napi);
ae4e228f 77216 ieee80211_clear_tx_pending(local);
66a7e928
MT		 77217diff -urNp linux-2.6.39/net/mac80211/main.c linux-2.6.39/net/mac80211/main.c
77218--- linux-2.6.39/net/mac80211/main.c 2011-05-19 00:06:34.000000000 -0400
77219+++ linux-2.6.39/net/mac80211/main.c 2011-05-22 19:36:34.000000000 -0400
77220@@ -215,7 +215,7 @@ int ieee80211_hw_config(struct ieee80211
58c5fc13
MT		 77221 local->hw.conf.power_level = power;
77222 }
77223
77224- if (changed && local->open_count) {
c52201e0 77225+ if (changed && local_read(&local->open_count)) {
58c5fc13
MT		 77226 ret = drv_config(local, changed);
77227 /*
77228 * Goal:
66a7e928
MT		 77229diff -urNp linux-2.6.39/net/mac80211/mlme.c linux-2.6.39/net/mac80211/mlme.c
77230--- linux-2.6.39/net/mac80211/mlme.c 2011-05-19 00:06:34.000000000 -0400
77231+++ linux-2.6.39/net/mac80211/mlme.c 2011-05-22 19:36:34.000000000 -0400
77232@@ -1431,6 +1431,8 @@ static bool ieee80211_assoc_success(stru
77233 bool have_higher_than_11mbit = false;
77234 u16 ap_ht_cap_flags;
77235
77236+ pax_track_stack();
77237+
77238 /* AssocResp and ReassocResp have identical structure */
77239
77240 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
77241diff -urNp linux-2.6.39/net/mac80211/pm.c linux-2.6.39/net/mac80211/pm.c
77242--- linux-2.6.39/net/mac80211/pm.c 2011-05-19 00:06:34.000000000 -0400
77243+++ linux-2.6.39/net/mac80211/pm.c 2011-05-22 19:36:34.000000000 -0400
6892158b 77244@@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
58c5fc13
MT		 77245 }
77246
77247 /* stop hardware - this must stop RX */
ae4e228f 77248- if (local->open_count)
c52201e0 77249+ if (local_read(&local->open_count))
ae4e228f
MT		 77250 ieee80211_stop_device(local);
77251
77252 local->suspended = true;
66a7e928
MT		 77253diff -urNp linux-2.6.39/net/mac80211/rate.c linux-2.6.39/net/mac80211/rate.c
77254--- linux-2.6.39/net/mac80211/rate.c 2011-05-19 00:06:34.000000000 -0400
77255+++ linux-2.6.39/net/mac80211/rate.c 2011-05-22 19:36:34.000000000 -0400
16454cff 77256@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
58c5fc13
MT		 77257
77258 ASSERT_RTNL();
ae4e228f
MT		 77259
77260- if (local->open_count)
c52201e0 77261+ if (local_read(&local->open_count))
58c5fc13
MT		 77262 return -EBUSY;
77263
ae4e228f 77264 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
66a7e928
MT		 77265diff -urNp linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c
77266--- linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c 2011-05-19 00:06:34.000000000 -0400
77267+++ linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c 2011-05-22 19:36:34.000000000 -0400
df50ba0c 77268@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
58c5fc13 77269
ae4e228f 77270 spin_unlock_irqrestore(&events->lock, status);
58c5fc13 77271
ae4e228f
MT		 77272- if (copy_to_user(buf, pb, p))
77273+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77274 return -EFAULT;
58c5fc13 77275
ae4e228f 77276 return p;
66a7e928
MT		 77277diff -urNp linux-2.6.39/net/mac80211/util.c linux-2.6.39/net/mac80211/util.c
77278--- linux-2.6.39/net/mac80211/util.c 2011-05-19 00:06:34.000000000 -0400
77279+++ linux-2.6.39/net/mac80211/util.c 2011-05-22 19:36:34.000000000 -0400
77280@@ -1129,7 +1129,7 @@ int ieee80211_reconfig(struct ieee80211_
ae4e228f 77281 local->resuming = true;
58c5fc13
MT		 77282
77283 /* restart hardware */
77284- if (local->open_count) {
c52201e0 77285+ if (local_read(&local->open_count)) {
ae4e228f
MT		 77286 /*
77287 * Upon resume hardware can sometimes be goofy due to
77288 * various platform / driver / bus issues, so restarting
66a7e928
MT		 77289diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c
77290--- linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c 2011-05-19 00:06:34.000000000 -0400
77291+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c 2011-05-22 19:36:34.000000000 -0400
77292@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
8308f9c9
MT		 77293 /* Increase the refcnt counter of the dest */
77294 atomic_inc(&dest->refcnt);
77295
77296- conn_flags = atomic_read(&dest->conn_flags);
77297+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
77298 if (cp->protocol != IPPROTO_UDP)
77299 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77300 /* Bind with the destination and its corresponding transmitter */
66a7e928 77301@@ -861,7 +861,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
8308f9c9
MT		 77302 atomic_set(&cp->refcnt, 1);
77303
77304 atomic_set(&cp->n_control, 0);
77305- atomic_set(&cp->in_pkts, 0);
77306+ atomic_set_unchecked(&cp->in_pkts, 0);
77307
66a7e928 77308 atomic_inc(&ipvs->conn_count);
8308f9c9 77309 if (flags & IP_VS_CONN_F_NO_CPORT)
66a7e928 77310@@ -1141,7 +1141,7 @@ static inline int todrop_entry(struct ip
8308f9c9
MT		 77311
77312 /* Don't drop the entry if its number of incoming packets is not
77313 located in [0, 8] */
77314- i = atomic_read(&cp->in_pkts);
77315+ i = atomic_read_unchecked(&cp->in_pkts);
77316 if (i > 8 || i < 0) return 0;
77317
77318 if (!todrop_rate[i]) return 0;
66a7e928
MT		 77319diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c
77320--- linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c 2011-05-19 00:06:34.000000000 -0400
77321+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c 2011-05-22 19:36:34.000000000 -0400
77322@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
77323 ret = cp->packet_xmit(skb, cp, pd->pp);
8308f9c9
MT		 77324 /* do not touch skb anymore */
77325
77326- atomic_inc(&cp->in_pkts);
77327+ atomic_inc_unchecked(&cp->in_pkts);
77328 ip_vs_conn_put(cp);
77329 return ret;
77330 }
66a7e928
MT		 77331@@ -1633,7 +1633,7 @@ ip_vs_in(unsigned int hooknum, struct sk
77332 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77333 pkts = sysctl_sync_threshold(ipvs);
77334 else
77335- pkts = atomic_add_return(1, &cp->in_pkts);
77336+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77337
77338 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
8308f9c9 77339 cp->protocol == IPPROTO_SCTP) {
66a7e928
MT		 77340diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c
77341--- linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-19 00:06:34.000000000 -0400
77342+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-22 19:36:34.000000000 -0400
77343@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
77344 ip_vs_rs_hash(ipvs, dest);
77345 write_unlock_bh(&ipvs->rs_lock);
8308f9c9
MT		 77346 }
77347- atomic_set(&dest->conn_flags, conn_flags);
77348+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
77349
77350 /* bind the service */
77351 if (!dest->svc) {
66a7e928 77352@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
8308f9c9
MT		 77353 " %-7s %-6d %-10d %-10d\n",
77354 &dest->addr.in6,
77355 ntohs(dest->port),
77356- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77357+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77358 atomic_read(&dest->weight),
77359 atomic_read(&dest->activeconns),
77360 atomic_read(&dest->inactconns));
66a7e928 77361@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
8308f9c9
MT		 77362 "%-7s %-6d %-10d %-10d\n",
77363 ntohl(dest->addr.ip),
77364 ntohs(dest->port),
77365- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77366+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77367 atomic_read(&dest->weight),
77368 atomic_read(&dest->activeconns),
77369 atomic_read(&dest->inactconns));
66a7e928
MT		 77370@@ -2287,6 +2287,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
77371 struct ip_vs_dest_user *udest_compat;
77372 struct ip_vs_dest_user_kern udest;
77373
77374+ pax_track_stack();
77375+
77376 if (!capable(CAP_NET_ADMIN))
77377 return -EPERM;
77378
77379@@ -2501,7 +2503,7 @@ __ip_vs_get_dest_entries(struct net *net
8308f9c9
MT		 77380
77381 entry.addr = dest->addr.ip;
77382 entry.port = dest->port;
77383- entry.conn_flags = atomic_read(&dest->conn_flags);
77384+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77385 entry.weight = atomic_read(&dest->weight);
77386 entry.u_threshold = dest->u_threshold;
77387 entry.l_threshold = dest->l_threshold;
66a7e928 77388@@ -3029,7 +3031,7 @@ static int ip_vs_genl_fill_dest(struct s
8308f9c9
MT		 77389 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77390
77391 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77392- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77393+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77394 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77395 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77396 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
66a7e928
MT		 77397diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c
77398--- linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c 2011-05-19 00:06:34.000000000 -0400
77399+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c 2011-05-22 19:36:34.000000000 -0400
77400@@ -648,7 +648,7 @@ control:
77401 * i.e only increment in_pkts for Templates.
77402 */
77403 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
77404- int pkts = atomic_add_return(1, &cp->in_pkts);
77405+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77406
77407 if (pkts % sysctl_sync_period(ipvs) != 1)
77408 return;
77409@@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
77410
77411 if (opt)
77412 memcpy(&cp->in_seq, opt, sizeof(*opt));
77413- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77414+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77415 cp->state = state;
77416 cp->old_state = cp->state;
77417 /*
77418diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c
77419--- linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-19 00:06:34.000000000 -0400
77420+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-22 19:36:34.000000000 -0400
77421@@ -1127,7 +1127,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
8308f9c9
MT		 77422 else
77423 rc = NF_ACCEPT;
77424 /* do not touch skb anymore */
77425- atomic_inc(&cp->in_pkts);
77426+ atomic_inc_unchecked(&cp->in_pkts);
77427 goto out;
77428 }
77429
66a7e928 77430@@ -1245,7 +1245,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
8308f9c9
MT		 77431 else
77432 rc = NF_ACCEPT;
77433 /* do not touch skb anymore */
77434- atomic_inc(&cp->in_pkts);
77435+ atomic_inc_unchecked(&cp->in_pkts);
77436 goto out;
77437 }
77438
66a7e928
MT		 77439diff -urNp linux-2.6.39/net/netfilter/Kconfig linux-2.6.39/net/netfilter/Kconfig
77440--- linux-2.6.39/net/netfilter/Kconfig 2011-05-19 00:06:34.000000000 -0400
77441+++ linux-2.6.39/net/netfilter/Kconfig 2011-05-22 19:41:42.000000000 -0400
77442@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
6892158b
MT		 77443
77444 To compile it as a module, choose M here. If unsure, say N.
77445
77446+config NETFILTER_XT_MATCH_GRADM
77447+ tristate '"gradm" match support'
77448+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77449+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77450+ ---help---
77451+ The gradm match allows to match on grsecurity RBAC being enabled.
77452+ It is useful when iptables rules are applied early on bootup to
77453+ prevent connections to the machine (except from a trusted host)
77454+ while the RBAC system is disabled.
77455+
77456 config NETFILTER_XT_MATCH_HASHLIMIT
77457 tristate '"hashlimit" match support'
77458 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
66a7e928
MT		 77459diff -urNp linux-2.6.39/net/netfilter/Makefile linux-2.6.39/net/netfilter/Makefile
77460--- linux-2.6.39/net/netfilter/Makefile 2011-05-19 00:06:34.000000000 -0400
77461+++ linux-2.6.39/net/netfilter/Makefile 2011-05-22 20:40:16.000000000 -0400
77462@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
77463 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
6892158b
MT		 77464 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77465 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77466+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77467 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77468 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77469 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
66a7e928
MT		 77470diff -urNp linux-2.6.39/net/netfilter/nfnetlink_log.c linux-2.6.39/net/netfilter/nfnetlink_log.c
77471--- linux-2.6.39/net/netfilter/nfnetlink_log.c 2011-05-19 00:06:34.000000000 -0400
77472+++ linux-2.6.39/net/netfilter/nfnetlink_log.c 2011-05-22 19:36:35.000000000 -0400
8308f9c9
MT		 77473@@ -70,7 +70,7 @@ struct nfulnl_instance {
77474 };
77475
77476 static DEFINE_SPINLOCK(instances_lock);
77477-static atomic_t global_seq;
77478+static atomic_unchecked_t global_seq;
77479
77480 #define INSTANCE_BUCKETS 16
77481 static struct hlist_head instance_table[INSTANCE_BUCKETS];
66a7e928 77482@@ -506,7 +506,7 @@ __build_packet_message(struct nfulnl_ins
8308f9c9
MT		 77483 /* global sequence number */
77484 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77485 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77486- htonl(atomic_inc_return(&global_seq)));
77487+ htonl(atomic_inc_return_unchecked(&global_seq)));
77488
77489 if (data_len) {
77490 struct nlattr *nla;
66a7e928
MT		 77491diff -urNp linux-2.6.39/net/netfilter/nfnetlink_queue.c linux-2.6.39/net/netfilter/nfnetlink_queue.c
77492--- linux-2.6.39/net/netfilter/nfnetlink_queue.c 2011-05-19 00:06:34.000000000 -0400
77493+++ linux-2.6.39/net/netfilter/nfnetlink_queue.c 2011-05-22 19:36:35.000000000 -0400
8308f9c9
MT		 77494@@ -58,7 +58,7 @@ struct nfqnl_instance {
77495 */
77496 spinlock_t lock;
77497 unsigned int queue_total;
77498- atomic_t id_sequence; /* 'sequence' of pkt ids */
77499+ atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
77500 struct list_head queue_list; /* packets in queue */
77501 };
77502
77503@@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
77504 nfmsg->version = NFNETLINK_V0;
77505 nfmsg->res_id = htons(queue->queue_num);
77506
77507- entry->id = atomic_inc_return(&queue->id_sequence);
77508+ entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
77509 pmsg.packet_id = htonl(entry->id);
77510 pmsg.hw_protocol = entskb->protocol;
77511 pmsg.hook = entry->hook;
66a7e928 77512@@ -869,7 +869,7 @@ static int seq_show(struct seq_file *s,
8308f9c9
MT		 77513 inst->peer_pid, inst->queue_total,
77514 inst->copy_mode, inst->copy_range,
77515 inst->queue_dropped, inst->queue_user_dropped,
77516- atomic_read(&inst->id_sequence), 1);
77517+ atomic_read_unchecked(&inst->id_sequence), 1);
77518 }
77519
77520 static const struct seq_operations nfqnl_seq_ops = {
66a7e928
MT		 77521diff -urNp linux-2.6.39/net/netfilter/xt_gradm.c linux-2.6.39/net/netfilter/xt_gradm.c
77522--- linux-2.6.39/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
77523+++ linux-2.6.39/net/netfilter/xt_gradm.c 2011-05-22 19:41:42.000000000 -0400
6892158b
MT		 77524@@ -0,0 +1,51 @@
77525+/*
77526+ * gradm match for netfilter
77527