kernel: update to 3.10.12.
authorArne Fitzenreiter <arne_f@ipfire.org>
Sat, 21 Sep 2013 09:40:57 +0000 (11:40 +0200)
committerArne Fitzenreiter <arne_f@ipfire.org>
Sat, 21 Sep 2013 09:40:57 +0000 (11:40 +0200)
lfs/linux
src/patches/grsecurity-2.9.1-3.10.10-201308292131.patch [deleted file]

index e85cf5315dafceea37242402b7e34b31b7121453..b7df06b6f283e9fb55f5fef8209d8e5d576005b6 100644 (file)
--- a/lfs/linux
+++ b/lfs/linux
 
 include Config
 
-VER        = 3.10.11
+VER        = 3.10.12
 
 RPI_PATCHES = linux-3.10.10-c1af7c6
+GRS_PATCHES = grsecurity-2.9.1-3.10.12-ipfire1.patch.xz
 
 THISAPP    = linux-$(VER)
 DL_FILE    = linux-$(VER).tar.xz
@@ -65,15 +66,17 @@ endif
 # Top-level Rules
 ###############################################################################
 objects =$(DL_FILE) \
-       rpi-patches-$(RPI_PATCHES).patch.xz
+       rpi-patches-$(RPI_PATCHES).patch.xz \
+       $(GRS_PATCHES)
 
 
 $(DL_FILE)                             = $(URL_IPFIRE)/$(DL_FILE)
 rpi-patches-$(RPI_PATCHES).patch.xz    = $(URL_IPFIRE)/rpi-patches-$(RPI_PATCHES).patch.xz
+$(GRS_PATCHES)                         = $(URL_IPFIRE)/$(GRS_PATCHES)
 
-$(DL_FILE)_MD5                         = 79e33380a4a74f35aabb6ae4713adab1
+$(DL_FILE)_MD5                         = 16e43b3c9957cf5af44863d6809efe38
 rpi-patches-$(RPI_PATCHES).patch.xz_MD5        = ef9274b3ff5d05daaaa4bdbe86ad00fc
-
+$(GRS_PATCHES)_MD5                     = 563b6ff05687289cfebc07f2a66ded92
 
 install : $(TARGET)
 
@@ -120,7 +123,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        # Grsecurity-patches
 ifneq "$(KCFG)" "-headers"
 ifneq "$(KCFG)" "-rpi"
-       cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/grsecurity-2.9.1-3.10.10-201308292131.patch
+       cd $(DIR_APP) && xz -c -d $(DIR_DL)/$(GRS_PATCHES) | patch -Np1
        cd $(DIR_APP) && rm localversion-grsec
        cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.7-disable-compat_vdso.patch
 endif
diff --git a/src/patches/grsecurity-2.9.1-3.10.10-201308292131.patch b/src/patches/grsecurity-2.9.1-3.10.10-201308292131.patch
deleted file mode 100644 (file)
index ec95bfd..0000000
+++ /dev/null
@@ -1,110781 +0,0 @@
-diff --git a/Documentation/dontdiff b/Documentation/dontdiff
-index b89a739..79768fb 100644
---- a/Documentation/dontdiff
-+++ b/Documentation/dontdiff
-@@ -2,9 +2,11 @@
- *.aux
- *.bin
- *.bz2
-+*.c.[012]*.*
- *.cis
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
-@@ -14,6 +16,7 @@
- *.gcov
- *.gen.S
- *.gif
-+*.gmo
- *.grep
- *.grp
- *.gz
-@@ -48,14 +51,17 @@
- *.tab.h
- *.tex
- *.ver
-+*.vim
- *.xml
- *.xz
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- \#*#
- *.9
--.*
-+.[^g]*
-+.gen*
- .*.d
- .mm
- 53c700_d.h
-@@ -69,9 +75,11 @@ Image
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-+TRACEEVENT-CFLAGS
- aconf
- af_names.h
- aic7*reg.h*
-@@ -80,6 +88,7 @@ aic7*seq.h*
- aicasm
- aicdb.h*
- altivec*.c
-+ashldi3.S
- asm-offsets.h
- asm_offsets.h
- autoconf.h*
-@@ -92,19 +101,24 @@ bounds.h
- bsetup
- btfixupprep
- build
-+builtin-policy.h
- bvmlinux
- bzImage*
- capability_names.h
- capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
- config
- config-*
- config_data.h*
-+config.c
- config.mak
- config.mak.autogen
-+config.tmp
- conmakehash
- consolemap_deftbl.c*
- cpustr.h
-@@ -115,9 +129,11 @@ devlist.h*
- dnotify_test
- docproc
- dslm
-+dtc-lexer.lex.c
- elf2ecoff
- elfconfig.h*
- evergreen_reg_safe.h
-+exception_policy.conf
- fixdep
- flask.h
- fore200e_mkfirm
-@@ -125,12 +141,15 @@ fore200e_pca_fw.c*
- gconf
- gconf.glade.h
- gen-devlist
-+gen-kdb_cmds.c
- gen_crc32table
- gen_init_cpio
- generated
- genheaders
- genksyms
- *_gray256.c
-+hash
-+hid-example
- hpet_example
- hugepage-mmap
- hugepage-shm
-@@ -145,14 +164,14 @@ int32.c
- int4.c
- int8.c
- kallsyms
--kconfig
-+kern_constants.h
- keywords.c
- ksym.c*
- ksym.h*
- kxgettext
- lex.c
- lex.*.c
--linux
-+lib1funcs.S
- logo_*.c
- logo_*_clut224.c
- logo_*_mono.c
-@@ -162,14 +181,15 @@ mach-types.h
- machtypes.h
- map
- map_hugetlb
--media
- mconf
-+mdp
- miboot*
- mk_elfconfig
- mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
- mkregtable
- mktables
-@@ -185,6 +205,8 @@ oui.c*
- page-types
- parse.c
- parse.h
-+parse-events*
-+pasyms.h
- patches*
- pca200e.bin
- pca200e_ecd.bin2
-@@ -194,6 +216,7 @@ perf-archive
- piggyback
- piggy.gzip
- piggy.S
-+pmu-*
- pnmtologo
- ppc_defs.h*
- pss_boot.h
-@@ -203,7 +226,10 @@ r200_reg_safe.h
- r300_reg_safe.h
- r420_reg_safe.h
- r600_reg_safe.h
-+realmode.lds
-+realmode.relocs
- recordmcount
-+regdb.c
- relocs
- rlim_names.h
- rn50_reg_safe.h
-@@ -213,8 +239,12 @@ series
- setup
- setup.bin
- setup.elf
-+signing_key*
-+size_overflow_hash.h
- sImage
-+slabinfo
- sm_tbl*
-+sortextable
- split-include
- syscalltab.h
- tables.c
-@@ -224,6 +254,7 @@ tftpboot.img
- timeconst.h
- times.h*
- trix_boot.h
-+user_constants.h
- utsrelease.h*
- vdso-syms.lds
- vdso.lds
-@@ -235,13 +266,17 @@ vdso32.lds
- vdso32.so.dbg
- vdso64.lds
- vdso64.so.dbg
-+vdsox32.lds
-+vdsox32-syms.lds
- version.h*
- vmImage
- vmlinux
- vmlinux-*
- vmlinux.aout
- vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
- vmlinuz
- voffset.h
- vsyscall.lds
-@@ -249,9 +284,12 @@ vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
-+x509*
- zImage*
- zconf.hash.c
-+zconf.lex.c
- zoffset.h
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 2fe6e76..889ee23 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -976,6 +976,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
-                       Format: <unsigned int> such that (rxsize & ~0x1fffc0) == 0.
-                       Default: 1024
-+      grsec_proc_gid= [GRKERNSEC_PROC_USERGROUP] Chooses GID to
-+                      ignore grsecurity's /proc restrictions
-+
-+
-       hashdist=       [KNL,NUMA] Large hashes allocated during boot
-                       are distributed across NUMA nodes.  Defaults on
-                       for 64-bit NUMA, off otherwise.
-@@ -1928,6 +1932,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
-                       noexec=on: enable non-executable mappings (default)
-                       noexec=off: disable non-executable mappings
-+      nopcid          [X86-64]
-+                      Disable PCID (Process-Context IDentifier) even if it
-+                      is supported by the processor.
-+
-       nosmap          [X86]
-                       Disable SMAP (Supervisor Mode Access Prevention)
-                       even if it is supported by processor.
-@@ -2195,6 +2203,25 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
-                       the specified number of seconds.  This is to be used if
-                       your oopses keep scrolling off the screen.
-+      pax_nouderef    [X86] disables UDEREF.  Most likely needed under certain
-+                      virtualization environments that don't cope well with the
-+                      expand down segment used by UDEREF on X86-32 or the frequent
-+                      page table updates on X86-64.
-+
-+      pax_sanitize_slab=
-+                      0/1 to disable/enable slab object sanitization (enabled by
-+                      default).
-+
-+      pax_softmode=   0/1 to disable/enable PaX softmode on boot already.
-+
-+      pax_extra_latent_entropy
-+                      Enable a very simple form of latent entropy extraction
-+                      from the first 4GB of memory as the bootmem allocator
-+                      passes the memory pages to the buddy allocator.
-+
-+      pax_weakuderef  [X86-64] enables the weaker but faster form of UDEREF
-+                      when the processor supports PCID.
-+
-       pcbit=          [HW,ISDN]
-       pcd.            [PARIDE]
-diff --git a/Makefile b/Makefile
-index b119684..13ac256 100644
---- a/Makefile
-+++ b/Makefile
-@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
- HOSTCC       = gcc
- HOSTCXX      = g++
--HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCFLAGS  += $(call cc-option, -Wno-empty-body)
-+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -414,8 +415,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
- # Rules shared between *config targets and build targets
- # Basic helpers built in scripts/
--PHONY += scripts_basic
--scripts_basic:
-+PHONY += scripts_basic gcc-plugins
-+scripts_basic: gcc-plugins
-       $(Q)$(MAKE) $(build)=scripts/basic
-       $(Q)rm -f .tmp_quiet_recordmcount
-@@ -576,6 +577,65 @@ else
- KBUILD_CFLAGS += -O2
- endif
-+ifndef DISABLE_PAX_PLUGINS
-+ifeq ($(call cc-ifversion, -ge, 0408, y), y)
-+PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCXX)" "$(HOSTCXX)" "$(CC)")
-+else
-+PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)")
-+endif
-+ifneq ($(PLUGINCC),)
-+ifdef CONFIG_PAX_CONSTIFY_PLUGIN
-+CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
-+endif
-+ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
-+STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
-+endif
-+ifdef CONFIG_KALLOCSTAT_PLUGIN
-+KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
-+endif
-+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
-+KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
-+endif
-+ifdef CONFIG_CHECKER_PLUGIN
-+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
-+CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
-+endif
-+endif
-+COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
-+ifdef CONFIG_PAX_SIZE_OVERFLOW
-+SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
-+endif
-+ifdef CONFIG_PAX_LATENT_ENTROPY
-+LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
-+endif
-+ifdef CONFIG_PAX_MEMORY_STRUCTLEAK
-+STRUCTLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/structleak_plugin.so -DSTRUCTLEAK_PLUGIN
-+endif
-+GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS) $(STRUCTLEAK_PLUGIN_CFLAGS)
-+GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
-+export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS CONSTIFY_PLUGIN
-+ifeq ($(KBUILD_EXTMOD),)
-+gcc-plugins:
-+      $(Q)$(MAKE) $(build)=tools/gcc
-+else
-+gcc-plugins: ;
-+endif
-+else
-+gcc-plugins:
-+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
-+      $(error Your gcc installation does not support plugins.  If the necessary headers for plugin support are missing, they should be installed.  On Debian, apt-get install gcc-<ver>-plugin-dev.  If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
-+else
-+      $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
-+endif
-+      $(Q)echo "PAX_MEMORY_STACKLEAK, constification, PAX_LATENT_ENTROPY and other features will be less secure.  PAX_SIZE_OVERFLOW will not be active."
-+endif
-+endif
-+
- include $(srctree)/arch/$(SRCARCH)/Makefile
- ifdef CONFIG_READABLE_ASM
-@@ -733,7 +793,7 @@ export mod_sign_cmd
- ifeq ($(KBUILD_EXTMOD),)
--core-y                += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y                += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- vmlinux-dirs  := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
-                    $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -782,6 +842,8 @@ endif
- # The actual objects are generated when descending, 
- # make sure no implicit rule kicks in
-+$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
- # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -791,7 +853,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
- # Error messages still appears in the original language
- PHONY += $(vmlinux-dirs)
--$(vmlinux-dirs): prepare scripts
-+$(vmlinux-dirs): gcc-plugins prepare scripts
-       $(Q)$(MAKE) $(build)=$@
- # Store (new) KERNELRELASE string in include/config/kernel.release
-@@ -835,6 +897,7 @@ prepare0: archprepare FORCE
-       $(Q)$(MAKE) $(build)=.
- # All the preparing..
-+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
- prepare: prepare0
- # Generate some files
-@@ -942,6 +1005,8 @@ all: modules
- #     using awk while concatenating to the final file.
- PHONY += modules
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
-       $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
-       @$(kecho) '  Building modules, stage 2.';
-@@ -957,7 +1022,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
- # Target to prepare building external modules
- PHONY += modules_prepare
--modules_prepare: prepare scripts
-+modules_prepare: gcc-plugins prepare scripts
- # Target to install modules
- PHONY += modules_install
-@@ -1023,7 +1088,7 @@ MRPROPER_FILES += .config .config.old .version .old_version $(version_h) \
-                 Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
-                 signing_key.priv signing_key.x509 x509.genkey         \
-                 extra_certificates signing_key.x509.keyid             \
--                signing_key.x509.signer
-+                signing_key.x509.signer tools/gcc/size_overflow_hash.h
- # clean - Delete most, but leave enough to build external modules
- #
-@@ -1063,6 +1128,7 @@ distclean: mrproper
-               \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
-               -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
-               -o -name '.*.rej' \
-+              -o -name '.*.rej' -o -name '*.so' \
-               -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
-               -type f -print | xargs rm -f
-@@ -1223,6 +1289,8 @@ PHONY += $(module-dirs) modules
- $(module-dirs): crmodverdir $(objtree)/Module.symvers
-       $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(module-dirs)
-       @$(kecho) '  Building modules, stage 2.';
-       $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1359,17 +1427,21 @@ else
-         target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
- endif
--%.s: %.c prepare scripts FORCE
-+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.s: %.c gcc-plugins prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.i: %.c prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.c prepare scripts FORCE
-+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.o: %.c gcc-plugins prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.lst: %.c prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.s: %.S prepare scripts FORCE
-+%.s: %.S gcc-plugins prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.S prepare scripts FORCE
-+%.o: %.S gcc-plugins prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.symtypes: %.c prepare scripts FORCE
-       $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1379,11 +1451,15 @@ endif
-       $(cmd_crmodverdir)
-       $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
-       $(build)=$(build-dir)
--%/: prepare scripts FORCE
-+%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%/: gcc-plugins prepare scripts FORCE
-       $(cmd_crmodverdir)
-       $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
-       $(build)=$(build-dir)
--%.ko: prepare scripts FORCE
-+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.ko: gcc-plugins prepare scripts FORCE
-       $(cmd_crmodverdir)
-       $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1)   \
-       $(build)=$(build-dir) $(@:.ko=.o)
-diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
-index c2cbe4f..f7264b4 100644
---- a/arch/alpha/include/asm/atomic.h
-+++ b/arch/alpha/include/asm/atomic.h
-@@ -250,6 +250,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
- #define atomic_dec(v) atomic_sub(1,(v))
- #define atomic64_dec(v) atomic64_sub(1,(v))
-+#define atomic64_read_unchecked(v)            atomic64_read(v)
-+#define atomic64_set_unchecked(v, i)          atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v)          atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v)   atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v)          atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v)             atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v)      atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v)             atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n)   atomic64_cmpxchg((v), (o), (n))
-+
- #define smp_mb__before_atomic_dec()   smp_mb()
- #define smp_mb__after_atomic_dec()    smp_mb()
- #define smp_mb__before_atomic_inc()   smp_mb()
-diff --git a/arch/alpha/include/asm/cache.h b/arch/alpha/include/asm/cache.h
-index ad368a9..fbe0f25 100644
---- a/arch/alpha/include/asm/cache.h
-+++ b/arch/alpha/include/asm/cache.h
-@@ -4,19 +4,19 @@
- #ifndef __ARCH_ALPHA_CACHE_H
- #define __ARCH_ALPHA_CACHE_H
-+#include <linux/const.h>
- /* Bytes per L1 (data) cache line. */
- #if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_EV6)
--# define L1_CACHE_BYTES     64
- # define L1_CACHE_SHIFT     6
- #else
- /* Both EV4 and EV5 are write-through, read-allocate,
-    direct-mapped, physical.
- */
--# define L1_CACHE_BYTES     32
- # define L1_CACHE_SHIFT     5
- #endif
-+#define L1_CACHE_BYTES     (_AC(1,UL) << L1_CACHE_SHIFT)
- #define SMP_CACHE_BYTES    L1_CACHE_BYTES
- #endif
-diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
-index 968d999..d36b2df 100644
---- a/arch/alpha/include/asm/elf.h
-+++ b/arch/alpha/include/asm/elf.h
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #define ELF_ET_DYN_BASE               (TASK_UNMAPPED_BASE + 0x1000000)
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN    (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN   (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be 
-    registered using atexit.  This provides a mean for the dynamic
-    linker to call DT_FINI functions for shared libraries that have
-diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
-index bc2a0da..8ad11ee 100644
---- a/arch/alpha/include/asm/pgalloc.h
-+++ b/arch/alpha/include/asm/pgalloc.h
-@@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-       pgd_set(pgd, pmd);
- }
-+static inline void
-+pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-+{
-+      pgd_populate(mm, pgd, pmd);
-+}
-+
- extern pgd_t *pgd_alloc(struct mm_struct *mm);
- static inline void
-diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
-index 81a4342..348b927 100644
---- a/arch/alpha/include/asm/pgtable.h
-+++ b/arch/alpha/include/asm/pgtable.h
-@@ -102,6 +102,17 @@ struct vm_area_struct;
- #define PAGE_SHARED   __pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY     __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC   __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC     __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC   PAGE_SHARED
-+# define PAGE_COPY_NOEXEC     PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL   __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
-index 2fd00b7..cfd5069 100644
---- a/arch/alpha/kernel/module.c
-+++ b/arch/alpha/kernel/module.c
-@@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
-       /* The small sections were sorted to the end of the segment.
-          The following should definitely cover them.  */
--      gp = (u64)me->module_core + me->core_size - 0x8000;
-+      gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
-       got = sechdrs[me->arch.gotsecindex].sh_addr;
-       for (i = 0; i < n; i++) {
-diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
-index b9e37ad..44c24e7 100644
---- a/arch/alpha/kernel/osf_sys.c
-+++ b/arch/alpha/kernel/osf_sys.c
-@@ -1297,10 +1297,11 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
-    generic version except that we know how to honor ADDR_LIMIT_32BIT.  */
- static unsigned long
--arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
--                       unsigned long limit)
-+arch_get_unmapped_area_1(struct file *filp, unsigned long addr, unsigned long len,
-+                       unsigned long limit, unsigned long flags)
- {
-       struct vm_unmapped_area_info info;
-+      unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-       info.flags = 0;
-       info.length = len;
-@@ -1308,6 +1309,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
-       info.high_limit = limit;
-       info.align_mask = 0;
-       info.align_offset = 0;
-+      info.threadstack_offset = offset;
-       return vm_unmapped_area(&info);
- }
-@@ -1340,20 +1342,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
-          merely specific addresses, but regions of memory -- perhaps
-          this feature should be incorporated into all ports?  */
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       if (addr) {
--              addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
-+              addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(addr), len, limit, flags);
-               if (addr != (unsigned long) -ENOMEM)
-                       return addr;
-       }
-       /* Next, try allocating at TASK_UNMAPPED_BASE.  */
--      addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
--                                       len, limit);
-+      addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(current->mm->mmap_base), len, limit, flags);
-+
-       if (addr != (unsigned long) -ENOMEM)
-               return addr;
-       /* Finally, try allocating in low memory.  */
--      addr = arch_get_unmapped_area_1 (PAGE_SIZE, len, limit);
-+      addr = arch_get_unmapped_area_1 (filp, PAGE_SIZE, len, limit, flags);
-       return addr;
- }
-diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
-index 0c4132d..88f0d53 100644
---- a/arch/alpha/mm/fault.c
-+++ b/arch/alpha/mm/fault.c
-@@ -53,6 +53,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
-       __reload_thread(pcb);
- }
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+      int err;
-+
-+      do { /* PaX: patched PLT emulation #1 */
-+              unsigned int ldah, ldq, jmp;
-+
-+              err = get_user(ldah, (unsigned int *)regs->pc);
-+              err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+              err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+              if (err)
-+                      break;
-+
-+              if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+                  (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+                  jmp == 0x6BFB0000U)
-+              {
-+                      unsigned long r27, addr;
-+                      unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+                      unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+                      addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+                      err = get_user(r27, (unsigned long *)addr);
-+                      if (err)
-+                              break;
-+
-+                      regs->r27 = r27;
-+                      regs->pc = r27;
-+                      return 2;
-+              }
-+      } while (0);
-+
-+      do { /* PaX: patched PLT emulation #2 */
-+              unsigned int ldah, lda, br;
-+
-+              err = get_user(ldah, (unsigned int *)regs->pc);
-+              err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+              err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+              if (err)
-+                      break;
-+
-+              if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+                  (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+                  (br & 0xFFE00000U) == 0xC3E00000U)
-+              {
-+                      unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+                      unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+                      unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+                      regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+                      regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+                      return 2;
-+              }
-+      } while (0);
-+
-+      do { /* PaX: unpatched PLT emulation */
-+              unsigned int br;
-+
-+              err = get_user(br, (unsigned int *)regs->pc);
-+
-+              if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+                      unsigned int br2, ldq, nop, jmp;
-+                      unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+                      addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+                      err = get_user(br2, (unsigned int *)addr);
-+                      err |= get_user(ldq, (unsigned int *)(addr+4));
-+                      err |= get_user(nop, (unsigned int *)(addr+8));
-+                      err |= get_user(jmp, (unsigned int *)(addr+12));
-+                      err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+                      if (err)
-+                              break;
-+
-+                      if (br2 == 0xC3600000U &&
-+                          ldq == 0xA77B000CU &&
-+                          nop == 0x47FF041FU &&
-+                          jmp == 0x6B7B0000U)
-+                      {
-+                              regs->r28 = regs->pc+4;
-+                              regs->r27 = addr+16;
-+                              regs->pc = resolver;
-+                              return 3;
-+                      }
-+              }
-+      } while (0);
-+#endif
-+
-+      return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      unsigned long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 5; i++) {
-+              unsigned int c;
-+              if (get_user(c, (unsigned int *)pc+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%08x ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
- /*
-  * This routine handles page faults.  It determines the address,
-@@ -133,8 +251,29 @@ retry:
-  good_area:
-       si_code = SEGV_ACCERR;
-       if (cause < 0) {
--              if (!(vma->vm_flags & VM_EXEC))
-+              if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+                      if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+                              goto bad_area;
-+
-+                      up_read(&mm->mmap_sem);
-+                      switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+                      case 2:
-+                      case 3:
-+                              return;
-+#endif
-+
-+                      }
-+                      pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+                      do_group_exit(SIGKILL);
-+#else
-                       goto bad_area;
-+#endif
-+
-+              }
-       } else if (!cause) {
-               /* Allow reads even for write-only mappings */
-               if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 18a9f5e..ca910b7 100644
---- a/arch/arm/Kconfig
-+++ b/arch/arm/Kconfig
-@@ -1766,7 +1766,7 @@ config ALIGNMENT_TRAP
- config UACCESS_WITH_MEMCPY
-       bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
--      depends on MMU
-+      depends on MMU && !PAX_MEMORY_UDEREF
-       default y if CPU_FEROCEON
-       help
-         Implement faster copy_to_user and clear_user methods for CPU
-diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index da1c77d..2ee6056 100644
---- a/arch/arm/include/asm/atomic.h
-+++ b/arch/arm/include/asm/atomic.h
-@@ -17,17 +17,35 @@
- #include <asm/barrier.h>
- #include <asm/cmpxchg.h>
-+#ifdef CONFIG_GENERIC_ATOMIC64
-+#include <asm-generic/atomic64.h>
-+#endif
-+
- #define ATOMIC_INIT(i)        { (i) }
- #ifdef __KERNEL__
-+#define _ASM_EXTABLE(from, to)                \
-+"     .pushsection __ex_table,\"a\"\n"\
-+"     .align  3\n"                    \
-+"     .long   " #from ", " #to"\n"    \
-+"     .popsection"
-+
- /*
-  * On ARM, ordinary assignment (str instruction) doesn't clear the local
-  * strex/ldrex monitor on some implementations. The reason we can use it for
-  * atomic_set() is the clrex or dummy strex done on every exception return.
-  */
- #define atomic_read(v)        (*(volatile int *)&(v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+      return v->counter;
-+}
- #define atomic_set(v,i)       (((v)->counter) = (i))
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+      v->counter = i;
-+}
- #if __LINUX_ARM_ARCH__ >= 6
-@@ -42,6 +60,35 @@ static inline void atomic_add(int i, atomic_t *v)
-       int result;
-       __asm__ __volatile__("@ atomic_add\n"
-+"1:   ldrex   %1, [%3]\n"
-+"     adds    %0, %1, %4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
-+"     strex   %1, %0, [%3]\n"
-+"     teq     %1, #0\n"
-+"     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+      : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+      : "r" (&v->counter), "Ir" (i)
-+      : "cc");
-+}
-+
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      unsigned long tmp;
-+      int result;
-+
-+      __asm__ __volatile__("@ atomic_add_unchecked\n"
- "1:   ldrex   %0, [%3]\n"
- "     add     %0, %0, %4\n"
- "     strex   %1, %0, [%3]\n"
-@@ -60,6 +107,42 @@ static inline int atomic_add_return(int i, atomic_t *v)
-       smp_mb();
-       __asm__ __volatile__("@ atomic_add_return\n"
-+"1:   ldrex   %1, [%3]\n"
-+"     adds    %0, %1, %4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"     mov     %0, %1\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
-+"     strex   %1, %0, [%3]\n"
-+"     teq     %1, #0\n"
-+"     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+      : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+      : "r" (&v->counter), "Ir" (i)
-+      : "cc");
-+
-+      smp_mb();
-+
-+      return result;
-+}
-+
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      unsigned long tmp;
-+      int result;
-+
-+      smp_mb();
-+
-+      __asm__ __volatile__("@ atomic_add_return_unchecked\n"
- "1:   ldrex   %0, [%3]\n"
- "     add     %0, %0, %4\n"
- "     strex   %1, %0, [%3]\n"
-@@ -80,6 +163,35 @@ static inline void atomic_sub(int i, atomic_t *v)
-       int result;
-       __asm__ __volatile__("@ atomic_sub\n"
-+"1:   ldrex   %1, [%3]\n"
-+"     subs    %0, %1, %4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
-+"     strex   %1, %0, [%3]\n"
-+"     teq     %1, #0\n"
-+"     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+      : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+      : "r" (&v->counter), "Ir" (i)
-+      : "cc");
-+}
-+
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      unsigned long tmp;
-+      int result;
-+
-+      __asm__ __volatile__("@ atomic_sub_unchecked\n"
- "1:   ldrex   %0, [%3]\n"
- "     sub     %0, %0, %4\n"
- "     strex   %1, %0, [%3]\n"
-@@ -98,11 +210,25 @@ static inline int atomic_sub_return(int i, atomic_t *v)
-       smp_mb();
-       __asm__ __volatile__("@ atomic_sub_return\n"
--"1:   ldrex   %0, [%3]\n"
--"     sub     %0, %0, %4\n"
-+"1:   ldrex   %1, [%3]\n"
-+"     subs    %0, %1, %4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"     mov     %0, %1\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
- "     strex   %1, %0, [%3]\n"
- "     teq     %1, #0\n"
- "     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-       : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-       : "r" (&v->counter), "Ir" (i)
-       : "cc");
-@@ -134,6 +260,28 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
-       return oldval;
- }
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *ptr, int old, int new)
-+{
-+      unsigned long oldval, res;
-+
-+      smp_mb();
-+
-+      do {
-+              __asm__ __volatile__("@ atomic_cmpxchg_unchecked\n"
-+              "ldrex  %1, [%3]\n"
-+              "mov    %0, #0\n"
-+              "teq    %1, %4\n"
-+              "strexeq %0, %5, [%3]\n"
-+                  : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
-+                  : "r" (&ptr->counter), "Ir" (old), "r" (new)
-+                  : "cc");
-+      } while (res);
-+
-+      smp_mb();
-+
-+      return oldval;
-+}
-+
- static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- {
-       unsigned long tmp, tmp2;
-@@ -167,7 +315,17 @@ static inline int atomic_add_return(int i, atomic_t *v)
-       return val;
- }
-+
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      return atomic_add_return(i, v);
-+}
-+
- #define atomic_add(i, v)      (void) atomic_add_return(i, v)
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      (void) atomic_add_return(i, v);
-+}
- static inline int atomic_sub_return(int i, atomic_t *v)
- {
-@@ -182,6 +340,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
-       return val;
- }
- #define atomic_sub(i, v)      (void) atomic_sub_return(i, v)
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      (void) atomic_sub_return(i, v);
-+}
- static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- {
-@@ -197,6 +359,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
-       return ret;
- }
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+      return atomic_cmpxchg(v, old, new);
-+}
-+
- static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- {
-       unsigned long flags;
-@@ -209,6 +376,10 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- #endif /* __LINUX_ARM_ARCH__ */
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+      return xchg(&v->counter, new);
-+}
- static inline int __atomic_add_unless(atomic_t *v, int a, int u)
- {
-@@ -221,11 +392,27 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
- }
- #define atomic_inc(v)         atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+      atomic_add_unchecked(1, v);
-+}
- #define atomic_dec(v)         atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+      atomic_sub_unchecked(1, v);
-+}
- #define atomic_inc_and_test(v)        (atomic_add_return(1, v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+      return atomic_add_return_unchecked(1, v) == 0;
-+}
- #define atomic_dec_and_test(v)        (atomic_sub_return(1, v) == 0)
- #define atomic_inc_return(v)    (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+      return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v)    (atomic_sub_return(1, v))
- #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-@@ -241,6 +428,14 @@ typedef struct {
-       u64 __aligned(8) counter;
- } atomic64_t;
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+      u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(i) { (i) }
- #ifdef CONFIG_ARM_LPAE
-@@ -257,6 +452,19 @@ static inline u64 atomic64_read(const atomic64_t *v)
-       return result;
- }
-+static inline u64 atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+      u64 result;
-+
-+      __asm__ __volatile__("@ atomic64_read_unchecked\n"
-+"     ldrd    %0, %H0, [%1]"
-+      : "=&r" (result)
-+      : "r" (&v->counter), "Qo" (v->counter)
-+      );
-+
-+      return result;
-+}
-+
- static inline void atomic64_set(atomic64_t *v, u64 i)
- {
-       __asm__ __volatile__("@ atomic64_set\n"
-@@ -265,6 +473,15 @@ static inline void atomic64_set(atomic64_t *v, u64 i)
-       : "r" (&v->counter), "r" (i)
-       );
- }
-+
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, u64 i)
-+{
-+      __asm__ __volatile__("@ atomic64_set_unchecked\n"
-+"     strd    %2, %H2, [%1]"
-+      : "=Qo" (v->counter)
-+      : "r" (&v->counter), "r" (i)
-+      );
-+}
- #else
- static inline u64 atomic64_read(const atomic64_t *v)
- {
-@@ -279,6 +496,19 @@ static inline u64 atomic64_read(const atomic64_t *v)
-       return result;
- }
-+static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *v)
-+{
-+      u64 result;
-+
-+      __asm__ __volatile__("@ atomic64_read_unchecked\n"
-+"     ldrexd  %0, %H0, [%1]"
-+      : "=&r" (result)
-+      : "r" (&v->counter), "Qo" (v->counter)
-+      );
-+
-+      return result;
-+}
-+
- static inline void atomic64_set(atomic64_t *v, u64 i)
- {
-       u64 tmp;
-@@ -292,6 +522,21 @@ static inline void atomic64_set(atomic64_t *v, u64 i)
-       : "r" (&v->counter), "r" (i)
-       : "cc");
- }
-+
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, u64 i)
-+{
-+      u64 tmp;
-+
-+      __asm__ __volatile__("@ atomic64_set_unchecked\n"
-+"1:   ldrexd  %0, %H0, [%2]\n"
-+"     strexd  %0, %3, %H3, [%2]\n"
-+"     teq     %0, #0\n"
-+"     bne     1b"
-+      : "=&r" (tmp), "=Qo" (v->counter)
-+      : "r" (&v->counter), "r" (i)
-+      : "cc");
-+}
-+
- #endif
- static inline void atomic64_add(u64 i, atomic64_t *v)
-@@ -302,6 +547,36 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
-       __asm__ __volatile__("@ atomic64_add\n"
- "1:   ldrexd  %0, %H0, [%3]\n"
- "     adds    %0, %0, %4\n"
-+"     adcs    %H0, %H0, %H4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
-+"     strexd  %1, %0, %H0, [%3]\n"
-+"     teq     %1, #0\n"
-+"     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+      : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+      : "r" (&v->counter), "r" (i)
-+      : "cc");
-+}
-+
-+static inline void atomic64_add_unchecked(u64 i, atomic64_unchecked_t *v)
-+{
-+      u64 result;
-+      unsigned long tmp;
-+
-+      __asm__ __volatile__("@ atomic64_add_unchecked\n"
-+"1:   ldrexd  %0, %H0, [%3]\n"
-+"     adds    %0, %0, %4\n"
- "     adc     %H0, %H0, %H4\n"
- "     strexd  %1, %0, %H0, [%3]\n"
- "     teq     %1, #0\n"
-@@ -313,12 +588,49 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
- static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
- {
--      u64 result;
--      unsigned long tmp;
-+      u64 result, tmp;
-       smp_mb();
-       __asm__ __volatile__("@ atomic64_add_return\n"
-+"1:   ldrexd  %1, %H1, [%3]\n"
-+"     adds    %0, %1, %4\n"
-+"     adcs    %H0, %H1, %H4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"     mov     %0, %1\n"
-+"     mov     %H0, %H1\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
-+"     strexd  %1, %0, %H0, [%3]\n"
-+"     teq     %1, #0\n"
-+"     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+      : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+      : "r" (&v->counter), "r" (i)
-+      : "cc");
-+
-+      smp_mb();
-+
-+      return result;
-+}
-+
-+static inline u64 atomic64_add_return_unchecked(u64 i, atomic64_unchecked_t *v)
-+{
-+      u64 result;
-+      unsigned long tmp;
-+
-+      smp_mb();
-+
-+      __asm__ __volatile__("@ atomic64_add_return_unchecked\n"
- "1:   ldrexd  %0, %H0, [%3]\n"
- "     adds    %0, %0, %4\n"
- "     adc     %H0, %H0, %H4\n"
-@@ -342,6 +654,36 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
-       __asm__ __volatile__("@ atomic64_sub\n"
- "1:   ldrexd  %0, %H0, [%3]\n"
- "     subs    %0, %0, %4\n"
-+"     sbcs    %H0, %H0, %H4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
-+"     strexd  %1, %0, %H0, [%3]\n"
-+"     teq     %1, #0\n"
-+"     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+      : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+      : "r" (&v->counter), "r" (i)
-+      : "cc");
-+}
-+
-+static inline void atomic64_sub_unchecked(u64 i, atomic64_unchecked_t *v)
-+{
-+      u64 result;
-+      unsigned long tmp;
-+
-+      __asm__ __volatile__("@ atomic64_sub_unchecked\n"
-+"1:   ldrexd  %0, %H0, [%3]\n"
-+"     subs    %0, %0, %4\n"
- "     sbc     %H0, %H0, %H4\n"
- "     strexd  %1, %0, %H0, [%3]\n"
- "     teq     %1, #0\n"
-@@ -353,18 +695,32 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
- static inline u64 atomic64_sub_return(u64 i, atomic64_t *v)
- {
--      u64 result;
--      unsigned long tmp;
-+      u64 result, tmp;
-       smp_mb();
-       __asm__ __volatile__("@ atomic64_sub_return\n"
--"1:   ldrexd  %0, %H0, [%3]\n"
--"     subs    %0, %0, %4\n"
--"     sbc     %H0, %H0, %H4\n"
-+"1:   ldrexd  %1, %H1, [%3]\n"
-+"     subs    %0, %1, %4\n"
-+"     sbcs    %H0, %H1, %H4\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"     mov     %0, %1\n"
-+"     mov     %H0, %H1\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
- "     strexd  %1, %0, %H0, [%3]\n"
- "     teq     %1, #0\n"
- "     bne     1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-       : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-       : "r" (&v->counter), "r" (i)
-       : "cc");
-@@ -398,6 +754,30 @@ static inline u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old, u64 new)
-       return oldval;
- }
-+static inline u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old, u64 new)
-+{
-+      u64 oldval;
-+      unsigned long res;
-+
-+      smp_mb();
-+
-+      do {
-+              __asm__ __volatile__("@ atomic64_cmpxchg_unchecked\n"
-+              "ldrexd         %1, %H1, [%3]\n"
-+              "mov            %0, #0\n"
-+              "teq            %1, %4\n"
-+              "teqeq          %H1, %H4\n"
-+              "strexdeq       %0, %5, %H5, [%3]"
-+              : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
-+              : "r" (&ptr->counter), "r" (old), "r" (new)
-+              : "cc");
-+      } while (res);
-+
-+      smp_mb();
-+
-+      return oldval;
-+}
-+
- static inline u64 atomic64_xchg(atomic64_t *ptr, u64 new)
- {
-       u64 result;
-@@ -421,21 +801,34 @@ static inline u64 atomic64_xchg(atomic64_t *ptr, u64 new)
- static inline u64 atomic64_dec_if_positive(atomic64_t *v)
- {
--      u64 result;
--      unsigned long tmp;
-+      u64 result, tmp;
-       smp_mb();
-       __asm__ __volatile__("@ atomic64_dec_if_positive\n"
--"1:   ldrexd  %0, %H0, [%3]\n"
--"     subs    %0, %0, #1\n"
--"     sbc     %H0, %H0, #0\n"
-+"1:   ldrexd  %1, %H1, [%3]\n"
-+"     subs    %0, %1, #1\n"
-+"     sbcs    %H0, %H1, #0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"     mov     %0, %1\n"
-+"     mov     %H0, %H1\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
- "     teq     %H0, #0\n"
--"     bmi     2f\n"
-+"     bmi     4f\n"
- "     strexd  %1, %0, %H0, [%3]\n"
- "     teq     %1, #0\n"
- "     bne     1b\n"
--"2:"
-+"4:\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-       : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-       : "r" (&v->counter)
-       : "cc");
-@@ -458,13 +851,25 @@ static inline int atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
- "     teq     %0, %5\n"
- "     teqeq   %H0, %H5\n"
- "     moveq   %1, #0\n"
--"     beq     2f\n"
-+"     beq     4f\n"
- "     adds    %0, %0, %6\n"
--"     adc     %H0, %H0, %H6\n"
-+"     adcs    %H0, %H0, %H6\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"     bvc     3f\n"
-+"2:   bkpt    0xf103\n"
-+"3:\n"
-+#endif
-+
- "     strexd  %2, %0, %H0, [%4]\n"
- "     teq     %2, #0\n"
- "     bne     1b\n"
--"2:"
-+"4:\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+      _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-       : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
-       : "r" (&v->counter), "r" (u), "r" (a)
-       : "cc");
-@@ -477,10 +882,13 @@ static inline int atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
- #define atomic64_add_negative(a, v)   (atomic64_add_return((a), (v)) < 0)
- #define atomic64_inc(v)                       atomic64_add(1LL, (v))
-+#define atomic64_inc_unchecked(v)     atomic64_add_unchecked(1LL, (v))
- #define atomic64_inc_return(v)                atomic64_add_return(1LL, (v))
-+#define atomic64_inc_return_unchecked(v)      atomic64_add_return_unchecked(1LL, (v))
- #define atomic64_inc_and_test(v)      (atomic64_inc_return(v) == 0)
- #define atomic64_sub_and_test(a, v)   (atomic64_sub_return((a), (v)) == 0)
- #define atomic64_dec(v)                       atomic64_sub(1LL, (v))
-+#define atomic64_dec_unchecked(v)     atomic64_sub_unchecked(1LL, (v))
- #define atomic64_dec_return(v)                atomic64_sub_return(1LL, (v))
- #define atomic64_dec_and_test(v)      (atomic64_dec_return((v)) == 0)
- #define atomic64_inc_not_zero(v)      atomic64_add_unless((v), 1LL, 0LL)
-diff --git a/arch/arm/include/asm/cache.h b/arch/arm/include/asm/cache.h
-index 75fe66b..ba3dee4 100644
---- a/arch/arm/include/asm/cache.h
-+++ b/arch/arm/include/asm/cache.h
-@@ -4,8 +4,10 @@
- #ifndef __ASMARM_CACHE_H
- #define __ASMARM_CACHE_H
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT                CONFIG_ARM_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- /*
-  * Memory returned by kmalloc() may be used for DMA, so we must make
-@@ -24,5 +26,6 @@
- #endif
- #define __read_mostly __attribute__((__section__(".data..read_mostly")))
-+#define __read_only __attribute__ ((__section__(".data..read_only")))
- #endif
-diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index 17d0ae8..014e350 100644
---- a/arch/arm/include/asm/cacheflush.h
-+++ b/arch/arm/include/asm/cacheflush.h
-@@ -116,7 +116,7 @@ struct cpu_cache_fns {
-       void (*dma_unmap_area)(const void *, size_t, int);
-       void (*dma_flush_range)(const void *, const void *);
--};
-+} __no_const;
- /*
-  * Select the calling method
-diff --git a/arch/arm/include/asm/checksum.h b/arch/arm/include/asm/checksum.h
-index 6dcc164..b14d917 100644
---- a/arch/arm/include/asm/checksum.h
-+++ b/arch/arm/include/asm/checksum.h
-@@ -37,7 +37,19 @@ __wsum
- csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum);
- __wsum
--csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr);
-+__csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr);
-+
-+static inline __wsum
-+csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr)
-+{
-+      __wsum ret;
-+      pax_open_userland();
-+      ret = __csum_partial_copy_from_user(src, dst, len, sum, err_ptr);
-+      pax_close_userland();
-+      return ret;
-+}
-+
-+
- /*
-  *    Fold a partial checksum without adding pseudo headers
-diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h
-index 4f009c1..466c59b 100644
---- a/arch/arm/include/asm/cmpxchg.h
-+++ b/arch/arm/include/asm/cmpxchg.h
-@@ -102,6 +102,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
- #define xchg(ptr,x) \
-       ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
-+#define xchg_unchecked(ptr,x) \
-+      ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
- #include <asm-generic/cmpxchg-local.h>
-diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
-index 6ddbe44..b5e38b1 100644
---- a/arch/arm/include/asm/domain.h
-+++ b/arch/arm/include/asm/domain.h
-@@ -48,18 +48,37 @@
-  * Domain types
-  */
- #define DOMAIN_NOACCESS       0
--#define DOMAIN_CLIENT 1
- #ifdef CONFIG_CPU_USE_DOMAINS
-+#define DOMAIN_USERCLIENT     1
-+#define DOMAIN_KERNELCLIENT   1
- #define DOMAIN_MANAGER        3
-+#define DOMAIN_VECTORS                DOMAIN_USER
- #else
-+
-+#ifdef CONFIG_PAX_KERNEXEC
- #define DOMAIN_MANAGER        1
-+#define DOMAIN_KERNEXEC       3
-+#else
-+#define DOMAIN_MANAGER        1
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define DOMAIN_USERCLIENT     0
-+#define DOMAIN_UDEREF         1
-+#define DOMAIN_VECTORS                DOMAIN_KERNEL
-+#else
-+#define DOMAIN_USERCLIENT     1
-+#define DOMAIN_VECTORS                DOMAIN_USER
-+#endif
-+#define DOMAIN_KERNELCLIENT   1
-+
- #endif
- #define domain_val(dom,type)  ((type) << (2*(dom)))
- #ifndef __ASSEMBLY__
--#ifdef CONFIG_CPU_USE_DOMAINS
-+#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
- static inline void set_domain(unsigned val)
- {
-       asm volatile(
-@@ -68,15 +87,7 @@ static inline void set_domain(unsigned val)
-       isb();
- }
--#define modify_domain(dom,type)                                       \
--      do {                                                    \
--      struct thread_info *thread = current_thread_info();     \
--      unsigned int domain = thread->cpu_domain;               \
--      domain &= ~domain_val(dom, DOMAIN_MANAGER);             \
--      thread->cpu_domain = domain | domain_val(dom, type);    \
--      set_domain(thread->cpu_domain);                         \
--      } while (0)
--
-+extern void modify_domain(unsigned int dom, unsigned int type);
- #else
- static inline void set_domain(unsigned val) { }
- static inline void modify_domain(unsigned dom, unsigned type) { }
-diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 56211f2..17e8a25 100644
---- a/arch/arm/include/asm/elf.h
-+++ b/arch/arm/include/asm/elf.h
-@@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
--#define ELF_ET_DYN_BASE       (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE               (TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN    ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN   ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
- /* When the program starts, a1 contains a pointer to a function to be 
-    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
-@@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
- extern void elf_set_personality(const struct elf32_hdr *);
- #define SET_PERSONALITY(ex)   elf_set_personality(&(ex))
--struct mm_struct;
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #ifdef CONFIG_MMU
- #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
- struct linux_binprm;
-diff --git a/arch/arm/include/asm/fncpy.h b/arch/arm/include/asm/fncpy.h
-index de53547..52b9a28 100644
---- a/arch/arm/include/asm/fncpy.h
-+++ b/arch/arm/include/asm/fncpy.h
-@@ -81,7 +81,9 @@
-       BUG_ON((uintptr_t)(dest_buf) & (FNCPY_ALIGN - 1) ||             \
-               (__funcp_address & ~(uintptr_t)1 & (FNCPY_ALIGN - 1))); \
-                                                                       \
-+      pax_open_kernel();                                              \
-       memcpy(dest_buf, (void const *)(__funcp_address & ~1), size);   \
-+      pax_close_kernel();                                             \
-       flush_icache_range((unsigned long)(dest_buf),                   \
-               (unsigned long)(dest_buf) + (size));                    \
-                                                                       \
-diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
-index e42cf59..7b94b8f 100644
---- a/arch/arm/include/asm/futex.h
-+++ b/arch/arm/include/asm/futex.h
-@@ -50,6 +50,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
-       if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
-               return -EFAULT;
-+      pax_open_userland();
-+
-       smp_mb();
-       __asm__ __volatile__("@futex_atomic_cmpxchg_inatomic\n"
-       "1:     ldrex   %1, [%4]\n"
-@@ -65,6 +67,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
-       : "cc", "memory");
-       smp_mb();
-+      pax_close_userland();
-+
-       *uval = val;
-       return ret;
- }
-@@ -95,6 +99,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
-       if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
-               return -EFAULT;
-+      pax_open_userland();
-+
-       __asm__ __volatile__("@futex_atomic_cmpxchg_inatomic\n"
-       "1:     " TUSER(ldr) "  %1, [%4]\n"
-       "       teq     %1, %2\n"
-@@ -105,6 +111,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
-       : "r" (oldval), "r" (newval), "r" (uaddr), "Ir" (-EFAULT)
-       : "cc", "memory");
-+      pax_close_userland();
-+
-       *uval = val;
-       return ret;
- }
-@@ -127,6 +135,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
-               return -EFAULT;
-       pagefault_disable();    /* implies preempt_disable() */
-+      pax_open_userland();
-       switch (op) {
-       case FUTEX_OP_SET:
-@@ -148,6 +157,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
-               ret = -ENOSYS;
-       }
-+      pax_close_userland();
-       pagefault_enable();     /* subsumes preempt_enable() */
-       if (!ret) {
-diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
-index 83eb2f7..ed77159 100644
---- a/arch/arm/include/asm/kmap_types.h
-+++ b/arch/arm/include/asm/kmap_types.h
-@@ -4,6 +4,6 @@
- /*
-  * This is the "bare minimum".  AIO seems to require this.
-  */
--#define KM_TYPE_NR 16
-+#define KM_TYPE_NR 17
- #endif
-diff --git a/arch/arm/include/asm/mach/dma.h b/arch/arm/include/asm/mach/dma.h
-index 9e614a1..3302cca 100644
---- a/arch/arm/include/asm/mach/dma.h
-+++ b/arch/arm/include/asm/mach/dma.h
-@@ -22,7 +22,7 @@ struct dma_ops {
-       int     (*residue)(unsigned int, dma_t *);              /* optional */
-       int     (*setspeed)(unsigned int, dma_t *, int);        /* optional */
-       const char *type;
--};
-+} __do_const;
- struct dma_struct {
-       void            *addr;          /* single DMA address           */
-diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h
-index 2fe141f..192dc01 100644
---- a/arch/arm/include/asm/mach/map.h
-+++ b/arch/arm/include/asm/mach/map.h
-@@ -27,13 +27,16 @@ struct map_desc {
- #define MT_MINICLEAN          6
- #define MT_LOW_VECTORS                7
- #define MT_HIGH_VECTORS               8
--#define MT_MEMORY             9
-+#define MT_MEMORY_RWX         9
- #define MT_ROM                        10
--#define MT_MEMORY_NONCACHED   11
-+#define MT_MEMORY_NONCACHED_RX        11
- #define MT_MEMORY_DTCM                12
- #define MT_MEMORY_ITCM                13
- #define MT_MEMORY_SO          14
- #define MT_MEMORY_DMA_READY   15
-+#define MT_MEMORY_RW          16
-+#define MT_MEMORY_RX          17
-+#define MT_MEMORY_NONCACHED_RW        18
- #ifdef CONFIG_MMU
- extern void iotable_init(struct map_desc *, int);
-diff --git a/arch/arm/include/asm/outercache.h b/arch/arm/include/asm/outercache.h
-index 12f71a1..04e063c 100644
---- a/arch/arm/include/asm/outercache.h
-+++ b/arch/arm/include/asm/outercache.h
-@@ -35,7 +35,7 @@ struct outer_cache_fns {
- #endif
-       void (*set_debug)(unsigned long);
-       void (*resume)(void);
--};
-+} __no_const;
- #ifdef CONFIG_OUTER_CACHE
-diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
-index cbdc7a2..32f44fe 100644
---- a/arch/arm/include/asm/page.h
-+++ b/arch/arm/include/asm/page.h
-@@ -114,7 +114,7 @@ struct cpu_user_fns {
-       void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr);
-       void (*cpu_copy_user_highpage)(struct page *to, struct page *from,
-                       unsigned long vaddr, struct vm_area_struct *vma);
--};
-+} __no_const;
- #ifdef MULTI_USER
- extern struct cpu_user_fns cpu_user;
-diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
-index 943504f..c37a730 100644
---- a/arch/arm/include/asm/pgalloc.h
-+++ b/arch/arm/include/asm/pgalloc.h
-@@ -17,6 +17,7 @@
- #include <asm/processor.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/system_info.h>
- #define check_pgt_cache()             do { } while (0)
-@@ -43,6 +44,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-       set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
- }
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+      pud_populate(mm, pud, pmd);
-+}
-+
- #else /* !CONFIG_ARM_LPAE */
- /*
-@@ -51,6 +57,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- #define pmd_alloc_one(mm,addr)                ({ BUG(); ((pmd_t *)2); })
- #define pmd_free(mm, pmd)             do { } while (0)
- #define pud_populate(mm,pmd,pte)      BUG()
-+#define pud_populate_kernel(mm,pmd,pte)       BUG()
- #endif        /* CONFIG_ARM_LPAE */
-@@ -126,6 +133,19 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
-       __free_page(pte);
- }
-+static inline void __section_update(pmd_t *pmdp, unsigned long addr, pmdval_t prot)
-+{
-+#ifdef CONFIG_ARM_LPAE
-+      pmdp[0] = __pmd(pmd_val(pmdp[0]) | prot);
-+#else
-+      if (addr & SECTION_SIZE)
-+              pmdp[1] = __pmd(pmd_val(pmdp[1]) | prot);
-+      else
-+              pmdp[0] = __pmd(pmd_val(pmdp[0]) | prot);
-+#endif
-+      flush_pmd_entry(pmdp);
-+}
-+
- static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
-                                 pmdval_t prot)
- {
-@@ -155,7 +175,7 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)
- static inline void
- pmd_populate(struct mm_struct *mm, pmd_t *pmdp, pgtable_t ptep)
- {
--      __pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE);
-+      __pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE | __supported_pmd_mask);
- }
- #define pmd_pgtable(pmd) pmd_page(pmd)
-diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
-index 5cfba15..f415e1a 100644
---- a/arch/arm/include/asm/pgtable-2level-hwdef.h
-+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
-@@ -20,12 +20,15 @@
- #define PMD_TYPE_FAULT                (_AT(pmdval_t, 0) << 0)
- #define PMD_TYPE_TABLE                (_AT(pmdval_t, 1) << 0)
- #define PMD_TYPE_SECT         (_AT(pmdval_t, 2) << 0)
-+#define PMD_PXNTABLE          (_AT(pmdval_t, 1) << 2)         /* v7 */
- #define PMD_BIT4              (_AT(pmdval_t, 1) << 4)
- #define PMD_DOMAIN(x)         (_AT(pmdval_t, (x)) << 5)
- #define PMD_PROTECTION                (_AT(pmdval_t, 1) << 9)         /* v5 */
-+
- /*
-  *   - section
-  */
-+#define PMD_SECT_PXN          (_AT(pmdval_t, 1) << 0)         /* v7 */
- #define PMD_SECT_BUFFERABLE   (_AT(pmdval_t, 1) << 2)
- #define PMD_SECT_CACHEABLE    (_AT(pmdval_t, 1) << 3)
- #define PMD_SECT_XN           (_AT(pmdval_t, 1) << 4)         /* v6 */
-@@ -37,6 +40,7 @@
- #define PMD_SECT_nG           (_AT(pmdval_t, 1) << 17)        /* v6 */
- #define PMD_SECT_SUPER                (_AT(pmdval_t, 1) << 18)        /* v6 */
- #define PMD_SECT_AF           (_AT(pmdval_t, 0))
-+#define PMD_SECT_RDONLY               (_AT(pmdval_t, 0))
- #define PMD_SECT_UNCACHED     (_AT(pmdval_t, 0))
- #define PMD_SECT_BUFFERED     (PMD_SECT_BUFFERABLE)
-@@ -66,6 +70,7 @@
-  *   - extended small page/tiny page
-  */
- #define PTE_EXT_XN            (_AT(pteval_t, 1) << 0)         /* v6 */
-+#define PTE_EXT_PXN           (_AT(pteval_t, 1) << 2)         /* v7 */
- #define PTE_EXT_AP_MASK               (_AT(pteval_t, 3) << 4)
- #define PTE_EXT_AP0           (_AT(pteval_t, 1) << 4)
- #define PTE_EXT_AP1           (_AT(pteval_t, 2) << 4)
-diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
-index f97ee02..cc9fe9e 100644
---- a/arch/arm/include/asm/pgtable-2level.h
-+++ b/arch/arm/include/asm/pgtable-2level.h
-@@ -126,6 +126,9 @@
- #define L_PTE_SHARED          (_AT(pteval_t, 1) << 10)        /* shared(v6), coherent(xsc3) */
- #define L_PTE_NONE            (_AT(pteval_t, 1) << 11)
-+/* Two-level page tables only have PXN in the PGD, not in the PTE. */
-+#define L_PTE_PXN             (_AT(pteval_t, 0))
-+
- /*
-  * These are the memory types, defined to be compatible with
-  * pre-ARMv6 CPUs cacheable and bufferable bits:   XXCB
-diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
-index 18f5cef..25b8f43 100644
---- a/arch/arm/include/asm/pgtable-3level-hwdef.h
-+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
-@@ -41,6 +41,7 @@
-  */
- #define PMD_SECT_BUFFERABLE   (_AT(pmdval_t, 1) << 2)
- #define PMD_SECT_CACHEABLE    (_AT(pmdval_t, 1) << 3)
-+#define PMD_SECT_RDONLY               (_AT(pmdval_t, 1) << 7)
- #define PMD_SECT_S            (_AT(pmdval_t, 3) << 8)
- #define PMD_SECT_AF           (_AT(pmdval_t, 1) << 10)
- #define PMD_SECT_nG           (_AT(pmdval_t, 1) << 11)
-@@ -71,6 +72,7 @@
- #define PTE_EXT_SHARED                (_AT(pteval_t, 3) << 8)         /* SH[1:0], inner shareable */
- #define PTE_EXT_AF            (_AT(pteval_t, 1) << 10)        /* Access Flag */
- #define PTE_EXT_NG            (_AT(pteval_t, 1) << 11)        /* nG */
-+#define PTE_EXT_PXN           (_AT(pteval_t, 1) << 53)        /* PXN */
- #define PTE_EXT_XN            (_AT(pteval_t, 1) << 54)        /* XN */
- /*
-diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
-index 86b8fe3..e25f975 100644
---- a/arch/arm/include/asm/pgtable-3level.h
-+++ b/arch/arm/include/asm/pgtable-3level.h
-@@ -74,6 +74,7 @@
- #define L_PTE_RDONLY          (_AT(pteval_t, 1) << 7)         /* AP[2] */
- #define L_PTE_SHARED          (_AT(pteval_t, 3) << 8)         /* SH[1:0], inner shareable */
- #define L_PTE_YOUNG           (_AT(pteval_t, 1) << 10)        /* AF */
-+#define L_PTE_PXN             (_AT(pteval_t, 1) << 53)        /* PXN */
- #define L_PTE_XN              (_AT(pteval_t, 1) << 54)        /* XN */
- #define L_PTE_DIRTY           (_AT(pteval_t, 1) << 55)        /* unused */
- #define L_PTE_SPECIAL         (_AT(pteval_t, 1) << 56)        /* unused */
-@@ -82,6 +83,7 @@
- /*
-  * To be used in assembly code with the upper page attributes.
-  */
-+#define L_PTE_PXN_HIGH                (1 << (53 - 32))
- #define L_PTE_XN_HIGH         (1 << (54 - 32))
- #define L_PTE_DIRTY_HIGH      (1 << (55 - 32))
-diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
-index 9bcd262..1ff999b 100644
---- a/arch/arm/include/asm/pgtable.h
-+++ b/arch/arm/include/asm/pgtable.h
-@@ -30,6 +30,9 @@
- #include <asm/pgtable-2level.h>
- #endif
-+#define ktla_ktva(addr)               (addr)
-+#define ktva_ktla(addr)               (addr)
-+
- /*
-  * Just any arbitrary offset to the start of the vmalloc VM area: the
-  * current 8MB value just means that there will be a 8MB "hole" after the
-@@ -45,6 +48,9 @@
- #define LIBRARY_TEXT_START    0x0c000000
- #ifndef __ASSEMBLY__
-+extern pteval_t __supported_pte_mask;
-+extern pmdval_t __supported_pmd_mask;
-+
- extern void __pte_error(const char *file, int line, pte_t);
- extern void __pmd_error(const char *file, int line, pmd_t);
- extern void __pgd_error(const char *file, int line, pgd_t);
-@@ -53,6 +59,48 @@ extern void __pgd_error(const char *file, int line, pgd_t);
- #define pmd_ERROR(pmd)                __pmd_error(__FILE__, __LINE__, pmd)
- #define pgd_ERROR(pgd)                __pgd_error(__FILE__, __LINE__, pgd)
-+#define  __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/domain.h>
-+#include <linux/thread_info.h>
-+#include <linux/preempt.h>
-+
-+static inline int test_domain(int domain, int domaintype)
-+{
-+      return ((current_thread_info()->cpu_domain) & domain_val(domain, 3)) == domain_val(domain, domaintype);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void) {
-+#ifdef CONFIG_ARM_LPAE
-+      /* TODO */
-+#else
-+      preempt_disable();
-+      BUG_ON(test_domain(DOMAIN_KERNEL, DOMAIN_KERNEXEC));
-+      modify_domain(DOMAIN_KERNEL, DOMAIN_KERNEXEC);
-+#endif
-+      return 0;
-+}
-+
-+static inline unsigned long pax_close_kernel(void) {
-+#ifdef CONFIG_ARM_LPAE
-+      /* TODO */
-+#else
-+      BUG_ON(test_domain(DOMAIN_KERNEL, DOMAIN_MANAGER));
-+      /* DOMAIN_MANAGER = "client" under KERNEXEC */
-+      modify_domain(DOMAIN_KERNEL, DOMAIN_MANAGER);
-+      preempt_enable_no_resched();
-+#endif
-+      return 0;
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
-  * This is the lowest virtual address we can permit any user space
-  * mapping to be mapped at.  This is particularly important for
-@@ -72,8 +120,8 @@ extern void __pgd_error(const char *file, int line, pgd_t);
- /*
-  * The pgprot_* and protection_map entries will be fixed up in runtime
-  * to include the cachable and bufferable bits based on memory policy,
-- * as well as any architecture dependent bits like global/ASID and SMP
-- * shared mapping bits.
-+ * as well as any architecture dependent bits like global/ASID, PXN,
-+ * and SMP shared mapping bits.
-  */
- #define _L_PTE_DEFAULT        L_PTE_PRESENT | L_PTE_YOUNG
-@@ -257,7 +305,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
- static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
- {
-       const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
--              L_PTE_NONE | L_PTE_VALID;
-+              L_PTE_NONE | L_PTE_VALID | __supported_pte_mask;
-       pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
-       return pte;
- }
-diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
-index f3628fb..a0672dd 100644
---- a/arch/arm/include/asm/proc-fns.h
-+++ b/arch/arm/include/asm/proc-fns.h
-@@ -75,7 +75,7 @@ extern struct processor {
-       unsigned int suspend_size;
-       void (*do_suspend)(void *);
-       void (*do_resume)(void *);
--} processor;
-+} __do_const processor;
- #ifndef MULTI_CPU
- extern void cpu_proc_init(void);
-diff --git a/arch/arm/include/asm/psci.h b/arch/arm/include/asm/psci.h
-index ce0dbe7..c085b6f 100644
---- a/arch/arm/include/asm/psci.h
-+++ b/arch/arm/include/asm/psci.h
-@@ -29,7 +29,7 @@ struct psci_operations {
-       int (*cpu_off)(struct psci_power_state state);
-       int (*cpu_on)(unsigned long cpuid, unsigned long entry_point);
-       int (*migrate)(unsigned long cpuid);
--};
-+} __no_const;
- extern struct psci_operations psci_ops;
-diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
-index d3a22be..3a69ad5 100644
---- a/arch/arm/include/asm/smp.h
-+++ b/arch/arm/include/asm/smp.h
-@@ -107,7 +107,7 @@ struct smp_operations {
-       int  (*cpu_disable)(unsigned int cpu);
- #endif
- #endif
--};
-+} __no_const;
- /*
-  * set platform specific SMP operations
-diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
-index f00b569..aa5bb41 100644
---- a/arch/arm/include/asm/thread_info.h
-+++ b/arch/arm/include/asm/thread_info.h
-@@ -77,9 +77,9 @@ struct thread_info {
-       .flags          = 0,                                            \
-       .preempt_count  = INIT_PREEMPT_COUNT,                           \
-       .addr_limit     = KERNEL_DS,                                    \
--      .cpu_domain     = domain_val(DOMAIN_USER, DOMAIN_MANAGER) |     \
--                        domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) |   \
--                        domain_val(DOMAIN_IO, DOMAIN_CLIENT),         \
-+      .cpu_domain     = domain_val(DOMAIN_USER, DOMAIN_USERCLIENT) |  \
-+                        domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT) |      \
-+                        domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT),   \
-       .restart_block  = {                                             \
-               .fn     = do_no_restart_syscall,                        \
-       },                                                              \
-@@ -152,7 +152,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
- #define TIF_SYSCALL_AUDIT     9
- #define TIF_SYSCALL_TRACEPOINT        10
- #define TIF_SECCOMP           11      /* seccomp syscall filtering active */
--#define TIF_NOHZ              12      /* in adaptive nohz mode */
-+/* within 8 bits of TIF_SYSCALL_TRACE
-+ *  to meet flexible second operand requirements
-+ */
-+#define TIF_GRSEC_SETXID      12
-+#define TIF_NOHZ              13      /* in adaptive nohz mode */
- #define TIF_USING_IWMMXT      17
- #define TIF_MEMDIE            18      /* is terminating due to OOM killer */
- #define TIF_RESTORE_SIGMASK   20
-@@ -165,10 +169,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
- #define _TIF_SYSCALL_TRACEPOINT       (1 << TIF_SYSCALL_TRACEPOINT)
- #define _TIF_SECCOMP          (1 << TIF_SECCOMP)
- #define _TIF_USING_IWMMXT     (1 << TIF_USING_IWMMXT)
-+#define _TIF_GRSEC_SETXID     (1 << TIF_GRSEC_SETXID)
- /* Checks for any syscall work in entry-common.S */
- #define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
--                         _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP)
-+                         _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | _TIF_GRSEC_SETXID)
- /*
-  * Change these and you break ASM code in entry-common.S
-diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 7e1f760..de33b13 100644
---- a/arch/arm/include/asm/uaccess.h
-+++ b/arch/arm/include/asm/uaccess.h
-@@ -18,6 +18,7 @@
- #include <asm/domain.h>
- #include <asm/unified.h>
- #include <asm/compiler.h>
-+#include <asm/pgtable.h>
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-@@ -63,11 +64,38 @@ extern int __put_user_bad(void);
- static inline void set_fs(mm_segment_t fs)
- {
-       current_thread_info()->addr_limit = fs;
--      modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
-+      modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_KERNELCLIENT : DOMAIN_MANAGER);
- }
- #define segment_eq(a,b)       ((a) == (b))
-+#define __HAVE_ARCH_PAX_OPEN_USERLAND
-+#define __HAVE_ARCH_PAX_CLOSE_USERLAND
-+
-+static inline void pax_open_userland(void)
-+{
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      if (segment_eq(get_fs(), USER_DS)) {
-+              BUG_ON(test_domain(DOMAIN_USER, DOMAIN_UDEREF));
-+              modify_domain(DOMAIN_USER, DOMAIN_UDEREF);
-+      }
-+#endif
-+
-+}
-+
-+static inline void pax_close_userland(void)
-+{
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      if (segment_eq(get_fs(), USER_DS)) {
-+              BUG_ON(test_domain(DOMAIN_USER, DOMAIN_NOACCESS));
-+              modify_domain(DOMAIN_USER, DOMAIN_NOACCESS);
-+      }
-+#endif
-+
-+}
-+
- #define __addr_ok(addr) ({ \
-       unsigned long flag; \
-       __asm__("cmp %2, %0; movlo %0, #0" \
-@@ -143,8 +171,12 @@ extern int __get_user_4(void *);
- #define get_user(x,p)                                                 \
-       ({                                                              \
-+              int __e;                                                \
-               might_fault();                                          \
--              __get_user_check(x,p);                                  \
-+              pax_open_userland();                                    \
-+              __e = __get_user_check(x,p);                            \
-+              pax_close_userland();                                   \
-+              __e;                                                    \
-        })
- extern int __put_user_1(void *, unsigned int);
-@@ -188,8 +220,12 @@ extern int __put_user_8(void *, unsigned long long);
- #define put_user(x,p)                                                 \
-       ({                                                              \
-+              int __e;                                                \
-               might_fault();                                          \
--              __put_user_check(x,p);                                  \
-+              pax_open_userland();                                    \
-+              __e = __put_user_check(x,p);                            \
-+              pax_close_userland();                                   \
-+              __e;                                                    \
-        })
- #else /* CONFIG_MMU */
-@@ -230,13 +266,17 @@ static inline void set_fs(mm_segment_t fs)
- #define __get_user(x,ptr)                                             \
- ({                                                                    \
-       long __gu_err = 0;                                              \
-+      pax_open_userland();                                            \
-       __get_user_err((x),(ptr),__gu_err);                             \
-+      pax_close_userland();                                           \
-       __gu_err;                                                       \
- })
- #define __get_user_error(x,ptr,err)                                   \
- ({                                                                    \
-+      pax_open_userland();                                            \
-       __get_user_err((x),(ptr),err);                                  \
-+      pax_close_userland();                                           \
-       (void) 0;                                                       \
- })
-@@ -312,13 +352,17 @@ do {                                                                     \
- #define __put_user(x,ptr)                                             \
- ({                                                                    \
-       long __pu_err = 0;                                              \
-+      pax_open_userland();                                            \
-       __put_user_err((x),(ptr),__pu_err);                             \
-+      pax_close_userland();                                           \
-       __pu_err;                                                       \
- })
- #define __put_user_error(x,ptr,err)                                   \
- ({                                                                    \
-+      pax_open_userland();                                            \
-       __put_user_err((x),(ptr),err);                                  \
-+      pax_close_userland();                                           \
-       (void) 0;                                                       \
- })
-@@ -418,11 +462,44 @@ do {                                                                     \
- #ifdef CONFIG_MMU
--extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
--extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
-+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
-+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
-+
-+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+      unsigned long ret;
-+
-+      check_object_size(to, n, false);
-+      pax_open_userland();
-+      ret = ___copy_from_user(to, from, n);
-+      pax_close_userland();
-+      return ret;
-+}
-+
-+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+      unsigned long ret;
-+
-+      check_object_size(from, n, true);
-+      pax_open_userland();
-+      ret = ___copy_to_user(to, from, n);
-+      pax_close_userland();
-+      return ret;
-+}
-+
- extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
--extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
-+extern unsigned long __must_check ___clear_user(void __user *addr, unsigned long n);
- extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
-+
-+static inline unsigned long __must_check __clear_user(void __user *addr, unsigned long n)
-+{
-+      unsigned long ret;
-+      pax_open_userland();
-+      ret = ___clear_user(addr, n);
-+      pax_close_userland();
-+      return ret;
-+}
-+
- #else
- #define __copy_from_user(to,from,n)   (memcpy(to, (void __force *)from, n), 0)
- #define __copy_to_user(to,from,n)     (memcpy((void __force *)to, from, n), 0)
-@@ -431,6 +508,9 @@ extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned l
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+      if ((long)n < 0)
-+              return n;
-+
-       if (access_ok(VERIFY_READ, from, n))
-               n = __copy_from_user(to, from, n);
-       else /* security hole - plug it */
-@@ -440,6 +520,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+      if ((long)n < 0)
-+              return n;
-+
-       if (access_ok(VERIFY_WRITE, to, n))
-               n = __copy_to_user(to, from, n);
-       return n;
-diff --git a/arch/arm/include/uapi/asm/ptrace.h b/arch/arm/include/uapi/asm/ptrace.h
-index 96ee092..37f1844 100644
---- a/arch/arm/include/uapi/asm/ptrace.h
-+++ b/arch/arm/include/uapi/asm/ptrace.h
-@@ -73,7 +73,7 @@
-  * ARMv7 groups of PSR bits
-  */
- #define APSR_MASK     0xf80f0000      /* N, Z, C, V, Q and GE flags */
--#define PSR_ISET_MASK 0x01000010      /* ISA state (J, T) mask */
-+#define PSR_ISET_MASK 0x01000020      /* ISA state (J, T) mask */
- #define PSR_IT_MASK   0x0600fc00      /* If-Then execution state mask */
- #define PSR_ENDIAN_MASK       0x00000200      /* Endianness state mask */
-diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
-index 60d3b73..e5a0f22 100644
---- a/arch/arm/kernel/armksyms.c
-+++ b/arch/arm/kernel/armksyms.c
-@@ -53,7 +53,7 @@ EXPORT_SYMBOL(arm_delay_ops);
-       /* networking */
- EXPORT_SYMBOL(csum_partial);
--EXPORT_SYMBOL(csum_partial_copy_from_user);
-+EXPORT_SYMBOL(__csum_partial_copy_from_user);
- EXPORT_SYMBOL(csum_partial_copy_nocheck);
- EXPORT_SYMBOL(__csum_ipv6_magic);
-@@ -89,9 +89,9 @@ EXPORT_SYMBOL(__memzero);
- #ifdef CONFIG_MMU
- EXPORT_SYMBOL(copy_page);
--EXPORT_SYMBOL(__copy_from_user);
--EXPORT_SYMBOL(__copy_to_user);
--EXPORT_SYMBOL(__clear_user);
-+EXPORT_SYMBOL(___copy_from_user);
-+EXPORT_SYMBOL(___copy_to_user);
-+EXPORT_SYMBOL(___clear_user);
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
-index d43c7e5..257c050 100644
---- a/arch/arm/kernel/entry-armv.S
-+++ b/arch/arm/kernel/entry-armv.S
-@@ -47,6 +47,87 @@
- 9997:
-       .endm
-+      .macro  pax_enter_kernel
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+      @ make aligned space for saved DACR
-+      sub     sp, sp, #8
-+      @ save regs
-+      stmdb   sp!, {r1, r2}
-+      @ read DACR from cpu_domain into r1
-+      mov     r2, sp
-+      @ assume 8K pages, since we have to split the immediate in two
-+      bic     r2, r2, #(0x1fc0)
-+      bic     r2, r2, #(0x3f)
-+      ldr     r1, [r2, #TI_CPU_DOMAIN]
-+      @ store old DACR on stack 
-+      str     r1, [sp, #8]
-+#ifdef CONFIG_PAX_KERNEXEC
-+      @ set type of DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
-+      bic     r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
-+      orr     r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
-+#endif
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      @ set current DOMAIN_USER to DOMAIN_NOACCESS
-+      bic     r1, r1, #(domain_val(DOMAIN_USER, 3))
-+#endif
-+      @ write r1 to current_thread_info()->cpu_domain
-+      str     r1, [r2, #TI_CPU_DOMAIN]
-+      @ write r1 to DACR
-+      mcr     p15, 0, r1, c3, c0, 0
-+      @ instruction sync
-+      instr_sync
-+      @ restore regs
-+      ldmia   sp!, {r1, r2}
-+#endif
-+      .endm
-+
-+      .macro  pax_open_userland
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      @ save regs
-+      stmdb   sp!, {r0, r1}
-+      @ read DACR from cpu_domain into r1
-+      mov     r0, sp
-+      @ assume 8K pages, since we have to split the immediate in two
-+      bic     r0, r0, #(0x1fc0)
-+      bic     r0, r0, #(0x3f)
-+      ldr     r1, [r0, #TI_CPU_DOMAIN]
-+      @ set current DOMAIN_USER to DOMAIN_CLIENT
-+      bic     r1, r1, #(domain_val(DOMAIN_USER, 3))
-+      orr     r1, r1, #(domain_val(DOMAIN_USER, DOMAIN_UDEREF))
-+      @ write r1 to current_thread_info()->cpu_domain
-+      str     r1, [r0, #TI_CPU_DOMAIN]
-+      @ write r1 to DACR
-+      mcr     p15, 0, r1, c3, c0, 0
-+      @ instruction sync
-+      instr_sync
-+      @ restore regs
-+      ldmia   sp!, {r0, r1}
-+#endif
-+      .endm
-+
-+      .macro  pax_close_userland
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      @ save regs
-+      stmdb   sp!, {r0, r1}
-+      @ read DACR from cpu_domain into r1
-+      mov     r0, sp
-+      @ assume 8K pages, since we have to split the immediate in two
-+      bic     r0, r0, #(0x1fc0)
-+      bic     r0, r0, #(0x3f)
-+      ldr     r1, [r0, #TI_CPU_DOMAIN]
-+      @ set current DOMAIN_USER to DOMAIN_NOACCESS
-+      bic     r1, r1, #(domain_val(DOMAIN_USER, 3))
-+      @ write r1 to current_thread_info()->cpu_domain
-+      str     r1, [r0, #TI_CPU_DOMAIN]
-+      @ write r1 to DACR
-+      mcr     p15, 0, r1, c3, c0, 0
-+      @ instruction sync
-+      instr_sync
-+      @ restore regs
-+      ldmia   sp!, {r0, r1}
-+#endif
-+      .endm
-+
-       .macro  pabt_helper
-       @ PABORT handler takes pt_regs in r2, fault address in r4 and psr in r5
- #ifdef MULTI_PABORT
-@@ -89,11 +170,15 @@
-  * Invalid mode handlers
-  */
-       .macro  inv_entry, reason
-+
-+      pax_enter_kernel
-+
-       sub     sp, sp, #S_FRAME_SIZE
-  ARM( stmib   sp, {r1 - lr}           )
-  THUMB(       stmia   sp, {r0 - r12}          )
-  THUMB(       str     sp, [sp, #S_SP]         )
-  THUMB(       str     lr, [sp, #S_LR]         )
-+
-       mov     r1, #\reason
-       .endm
-@@ -149,7 +234,11 @@ ENDPROC(__und_invalid)
-       .macro  svc_entry, stack_hole=0
-  UNWIND(.fnstart              )
-  UNWIND(.save {r0 - pc}               )
-+
-+      pax_enter_kernel
-+
-       sub     sp, sp, #(S_FRAME_SIZE + \stack_hole - 4)
-+
- #ifdef CONFIG_THUMB2_KERNEL
-  SPFIX(       str     r0, [sp]        )       @ temporarily saved
-  SPFIX(       mov     r0, sp          )
-@@ -164,7 +253,12 @@ ENDPROC(__und_invalid)
-       ldmia   r0, {r3 - r5}
-       add     r7, sp, #S_SP - 4       @ here for interlock avoidance
-       mov     r6, #-1                 @  ""  ""      ""       ""
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+      @ offset sp by 8 as done in pax_enter_kernel
-+      add     r2, sp, #(S_FRAME_SIZE + \stack_hole + 4)
-+#else
-       add     r2, sp, #(S_FRAME_SIZE + \stack_hole - 4)
-+#endif
-  SPFIX(       addeq   r2, r2, #4      )
-       str     r3, [sp, #-4]!          @ save the "real" r0 copied
-                                       @ from the exception stack
-@@ -316,6 +410,9 @@ ENDPROC(__pabt_svc)
-       .macro  usr_entry
-  UNWIND(.fnstart      )
-  UNWIND(.cantunwind   )       @ don't unwind the user space
-+
-+      pax_enter_kernel_user
-+
-       sub     sp, sp, #S_FRAME_SIZE
-  ARM( stmib   sp, {r1 - r12}  )
-  THUMB(       stmia   sp, {r0 - r12}  )
-@@ -357,7 +454,8 @@ ENDPROC(__pabt_svc)
-       .endm
-       .macro  kuser_cmpxchg_check
--#if !defined(CONFIG_CPU_32v6K) && !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
-+#if !defined(CONFIG_CPU_32v6K) && defined(CONFIG_KUSER_HELPERS) && \
-+    !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
- #ifndef CONFIG_MMU
- #warning "NPTL on non MMU needs fixing"
- #else
-@@ -414,7 +512,9 @@ __und_usr:
-       tst     r3, #PSR_T_BIT                  @ Thumb mode?
-       bne     __und_usr_thumb
-       sub     r4, r2, #4                      @ ARM instr at LR - 4
-+      pax_open_userland
- 1:    ldrt    r0, [r4]
-+      pax_close_userland
- #ifdef CONFIG_CPU_ENDIAN_BE8
-       rev     r0, r0                          @ little endian instruction
- #endif
-@@ -449,10 +549,14 @@ __und_usr_thumb:
-  */
-       .arch   armv6t2
- #endif
-+      pax_open_userland
- 2:    ldrht   r5, [r4]
-+      pax_close_userland
-       cmp     r5, #0xe800                     @ 32bit instruction if xx != 0
-       blo     __und_usr_fault_16              @ 16bit undefined instruction
-+      pax_open_userland
- 3:    ldrht   r0, [r2]
-+      pax_close_userland
-       add     r2, r2, #2                      @ r2 is PC + 2, make it PC + 4
-       str     r2, [sp, #S_PC]                 @ it's a 2x16bit instr, update
-       orr     r0, r0, r5, lsl #16
-@@ -481,7 +585,8 @@ ENDPROC(__und_usr)
-  */
-       .pushsection .fixup, "ax"
-       .align  2
--4:    mov     pc, r9
-+4:    pax_close_userland
-+      mov     pc, r9
-       .popsection
-       .pushsection __ex_table,"a"
-       .long   1b, 4b
-@@ -690,7 +795,7 @@ ENTRY(__switch_to)
-  THUMB(       stmia   ip!, {r4 - sl, fp}         )    @ Store most regs on stack
-  THUMB(       str     sp, [ip], #4               )
-  THUMB(       str     lr, [ip], #4               )
--#ifdef CONFIG_CPU_USE_DOMAINS
-+#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-       ldr     r6, [r2, #TI_CPU_DOMAIN]
- #endif
-       set_tls r3, r4, r5
-@@ -699,7 +804,7 @@ ENTRY(__switch_to)
-       ldr     r8, =__stack_chk_guard
-       ldr     r7, [r7, #TSK_STACK_CANARY]
- #endif
--#ifdef CONFIG_CPU_USE_DOMAINS
-+#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-       mcr     p15, 0, r6, c3, c0, 0           @ Set domain register
- #endif
-       mov     r5, r0
-diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
-index bc5bc0a..d0998ca 100644
---- a/arch/arm/kernel/entry-common.S
-+++ b/arch/arm/kernel/entry-common.S
-@@ -10,18 +10,46 @@
- #include <asm/unistd.h>
- #include <asm/ftrace.h>
-+#include <asm/domain.h>
- #include <asm/unwind.h>
-+#include "entry-header.S"
-+
- #ifdef CONFIG_NEED_RET_TO_USER
- #include <mach/entry-macro.S>
- #else
-       .macro  arch_ret_to_user, tmp1, tmp2
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+      @ save regs
-+      stmdb   sp!, {r1, r2}
-+        @ read DACR from cpu_domain into r1
-+        mov     r2, sp
-+        @ assume 8K pages, since we have to split the immediate in two
-+        bic     r2, r2, #(0x1fc0)
-+        bic     r2, r2, #(0x3f)
-+        ldr     r1, [r2, #TI_CPU_DOMAIN]
-+#ifdef CONFIG_PAX_KERNEXEC
-+        @ set type of DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
-+        bic     r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
-+        orr     r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
-+#endif
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+        @ set current DOMAIN_USER to DOMAIN_UDEREF
-+        bic     r1, r1, #(domain_val(DOMAIN_USER, 3))
-+        orr     r1, r1, #(domain_val(DOMAIN_USER, DOMAIN_UDEREF))
-+#endif
-+        @ write r1 to current_thread_info()->cpu_domain
-+        str     r1, [r2, #TI_CPU_DOMAIN]
-+        @ write r1 to DACR
-+        mcr     p15, 0, r1, c3, c0, 0
-+        @ instruction sync
-+        instr_sync
-+      @ restore regs
-+      ldmia   sp!, {r1, r2}
-+#endif
-       .endm
- #endif
--#include "entry-header.S"
--
--
-       .align  5
- /*
-  * This is the fast syscall return path.  We do as little as
-@@ -350,6 +378,7 @@ ENDPROC(ftrace_stub)
-       .align  5
- ENTRY(vector_swi)
-+
-       sub     sp, sp, #S_FRAME_SIZE
-       stmia   sp, {r0 - r12}                  @ Calling r0 - r12
-  ARM( add     r8, sp, #S_PC           )
-@@ -399,6 +428,12 @@ ENTRY(vector_swi)
-       ldr     scno, [lr, #-4]                 @ get SWI instruction
- #endif
-+      /*
-+       * do this here to avoid a performance hit of wrapping the code above
-+       * that directly dereferences userland to parse the SWI instruction
-+       */
-+      pax_enter_kernel_user
-+
- #ifdef CONFIG_ALIGNMENT_TRAP
-       ldr     ip, __cr_alignment
-       ldr     ip, [ip]
-diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
-index 160f337..db67ee4 100644
---- a/arch/arm/kernel/entry-header.S
-+++ b/arch/arm/kernel/entry-header.S
-@@ -73,6 +73,60 @@
-       msr     cpsr_c, \rtemp                  @ switch back to the SVC mode
-       .endm
-+      .macro  pax_enter_kernel_user
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+      @ save regs
-+      stmdb   sp!, {r0, r1}
-+      @ read DACR from cpu_domain into r1
-+      mov     r0, sp
-+      @ assume 8K pages, since we have to split the immediate in two
-+      bic     r0, r0, #(0x1fc0)
-+      bic     r0, r0, #(0x3f)
-+      ldr     r1, [r0, #TI_CPU_DOMAIN]
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      @ set current DOMAIN_USER to DOMAIN_NOACCESS
-+      bic     r1, r1, #(domain_val(DOMAIN_USER, 3))
-+#endif
-+#ifdef CONFIG_PAX_KERNEXEC
-+      @ set current DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
-+      bic     r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
-+      orr     r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
-+#endif
-+      @ write r1 to current_thread_info()->cpu_domain
-+      str     r1, [r0, #TI_CPU_DOMAIN]
-+      @ write r1 to DACR
-+      mcr     p15, 0, r1, c3, c0, 0
-+      @ instruction sync
-+      instr_sync
-+      @ restore regs
-+      ldmia   sp!, {r0, r1}
-+#endif
-+      .endm
-+
-+      .macro  pax_exit_kernel
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+      @ save regs
-+      stmdb   sp!, {r0, r1}
-+      @ read old DACR from stack into r1
-+      ldr     r1, [sp, #(8 + S_SP)]
-+      sub     r1, r1, #8
-+      ldr     r1, [r1]
-+
-+      @ write r1 to current_thread_info()->cpu_domain
-+      mov     r0, sp
-+      @ assume 8K pages, since we have to split the immediate in two
-+      bic     r0, r0, #(0x1fc0)
-+      bic     r0, r0, #(0x3f)
-+      str     r1, [r0, #TI_CPU_DOMAIN]
-+      @ write r1 to DACR
-+      mcr     p15, 0, r1, c3, c0, 0
-+      @ instruction sync
-+      instr_sync
-+      @ restore regs
-+      ldmia   sp!, {r0, r1}
-+#endif
-+      .endm
-+
- #ifndef CONFIG_THUMB2_KERNEL
-       .macro  svc_exit, rpsr, irq = 0
-       .if     \irq != 0
-@@ -92,6 +146,9 @@
-       blne    trace_hardirqs_off
- #endif
-       .endif
-+
-+      pax_exit_kernel
-+
-       msr     spsr_cxsf, \rpsr
- #if defined(CONFIG_CPU_V6)
-       ldr     r0, [sp]
-@@ -155,6 +212,9 @@
-       blne    trace_hardirqs_off
- #endif
-       .endif
-+
-+      pax_exit_kernel
-+
-       ldr     lr, [sp, #S_SP]                 @ top of the stack
-       ldrd    r0, r1, [sp, #S_LR]             @ calling lr and pc
-       clrex                                   @ clear the exclusive monitor
-diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
-index 25442f4..d4948fc 100644
---- a/arch/arm/kernel/fiq.c
-+++ b/arch/arm/kernel/fiq.c
-@@ -84,17 +84,16 @@ int show_fiq_list(struct seq_file *p, int prec)
- void set_fiq_handler(void *start, unsigned int length)
- {
--#if defined(CONFIG_CPU_USE_DOMAINS)
--      void *base = (void *)0xffff0000;
--#else
-       void *base = vectors_page;
--#endif
-       unsigned offset = FIQ_OFFSET;
-+      pax_open_kernel();
-       memcpy(base + offset, start, length);
-+      pax_close_kernel();
-+
-+      if (!cache_is_vipt_nonaliasing())
-+              flush_icache_range(base + offset, offset + length);
-       flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
--      if (!vectors_high())
--              flush_icache_range(offset, offset + length);
- }
- int claim_fiq(struct fiq_handler *f)
-diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
-index 8bac553..caee108 100644
---- a/arch/arm/kernel/head.S
-+++ b/arch/arm/kernel/head.S
-@@ -52,7 +52,9 @@
-       .equ    swapper_pg_dir, KERNEL_RAM_VADDR - PG_DIR_SIZE
-       .macro  pgtbl, rd, phys
--      add     \rd, \phys, #TEXT_OFFSET - PG_DIR_SIZE
-+      mov     \rd, #TEXT_OFFSET
-+      sub     \rd, #PG_DIR_SIZE
-+      add     \rd, \rd, \phys
-       .endm
- /*
-@@ -434,7 +436,7 @@ __enable_mmu:
-       mov     r5, #(domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \
-                     domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \
-                     domain_val(DOMAIN_TABLE, DOMAIN_MANAGER) | \
--                    domain_val(DOMAIN_IO, DOMAIN_CLIENT))
-+                    domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT))
-       mcr     p15, 0, r5, c3, c0, 0           @ load domain access register
-       mcr     p15, 0, r4, c2, c0, 0           @ load page table pointer
- #endif
-diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
-index 1fd749e..47adb08 100644
---- a/arch/arm/kernel/hw_breakpoint.c
-+++ b/arch/arm/kernel/hw_breakpoint.c
-@@ -1029,7 +1029,7 @@ static int __cpuinit dbg_reset_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata dbg_reset_nb = {
-+static struct notifier_block dbg_reset_nb = {
-       .notifier_call = dbg_reset_notify,
- };
-diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
-index 1e9be5d..03edbc2 100644
---- a/arch/arm/kernel/module.c
-+++ b/arch/arm/kernel/module.c
-@@ -37,12 +37,37 @@
- #endif
- #ifdef CONFIG_MMU
--void *module_alloc(unsigned long size)
-+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
- {
-+      if (!size || PAGE_ALIGN(size) > MODULES_END - MODULES_VADDR)
-+              return NULL;
-       return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
--                              GFP_KERNEL, PAGE_KERNEL_EXEC, -1,
-+                              GFP_KERNEL, prot, -1,
-                               __builtin_return_address(0));
- }
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+      return __module_alloc(size, PAGE_KERNEL);
-+#else
-+      return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
-+}
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+      module_free(mod, module_region);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+      return __module_alloc(size, PAGE_KERNEL_EXEC);
-+}
-+#endif
- #endif
- int
-diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
-index 07314af..c46655c 100644
---- a/arch/arm/kernel/patch.c
-+++ b/arch/arm/kernel/patch.c
-@@ -18,6 +18,7 @@ void __kprobes __patch_text(void *addr, unsigned int insn)
-       bool thumb2 = IS_ENABLED(CONFIG_THUMB2_KERNEL);
-       int size;
-+      pax_open_kernel();
-       if (thumb2 && __opcode_is_thumb16(insn)) {
-               *(u16 *)addr = __opcode_to_mem_thumb16(insn);
-               size = sizeof(u16);
-@@ -39,6 +40,7 @@ void __kprobes __patch_text(void *addr, unsigned int insn)
-               *(u32 *)addr = insn;
-               size = sizeof(u32);
-       }
-+      pax_close_kernel();
-       flush_icache_range((uintptr_t)(addr),
-                          (uintptr_t)(addr) + size);
-diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
-index e19edc6..e186ee1 100644
---- a/arch/arm/kernel/perf_event.c
-+++ b/arch/arm/kernel/perf_event.c
-@@ -56,7 +56,7 @@ armpmu_map_hw_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
-       int mapping;
-       if (config >= PERF_COUNT_HW_MAX)
--              return -ENOENT;
-+              return -EINVAL;
-       mapping = (*event_map)[config];
-       return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
-diff --git a/arch/arm/kernel/perf_event_cpu.c b/arch/arm/kernel/perf_event_cpu.c
-index 1f2740e..b36e225 100644
---- a/arch/arm/kernel/perf_event_cpu.c
-+++ b/arch/arm/kernel/perf_event_cpu.c
-@@ -171,7 +171,7 @@ static int __cpuinit cpu_pmu_notify(struct notifier_block *b,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata cpu_pmu_hotplug_notifier = {
-+static struct notifier_block cpu_pmu_hotplug_notifier = {
-       .notifier_call = cpu_pmu_notify,
- };
-diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 5bc2615..dcd439f 100644
---- a/arch/arm/kernel/process.c
-+++ b/arch/arm/kernel/process.c
-@@ -223,6 +223,7 @@ void machine_power_off(void)
-       if (pm_power_off)
-               pm_power_off();
-+      BUG();
- }
- /*
-@@ -236,7 +237,7 @@ void machine_power_off(void)
-  * executing pre-reset code, and using RAM that the primary CPU's code wishes
-  * to use. Implementing such co-ordination would be essentially impossible.
-  */
--void machine_restart(char *cmd)
-+__noreturn void machine_restart(char *cmd)
- {
-       smp_send_stop();
-@@ -258,8 +259,8 @@ void __show_regs(struct pt_regs *regs)
-       show_regs_print_info(KERN_DEFAULT);
--      print_symbol("PC is at %s\n", instruction_pointer(regs));
--      print_symbol("LR is at %s\n", regs->ARM_lr);
-+      printk("PC is at %pA\n", (void *)instruction_pointer(regs));
-+      printk("LR is at %pA\n", (void *)regs->ARM_lr);
-       printk("pc : [<%08lx>]    lr : [<%08lx>]    psr: %08lx\n"
-              "sp : %08lx  ip : %08lx  fp : %08lx\n",
-               regs->ARM_pc, regs->ARM_lr, regs->ARM_cpsr,
-@@ -426,12 +427,6 @@ unsigned long get_wchan(struct task_struct *p)
-       return 0;
- }
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--      unsigned long range_end = mm->brk + 0x02000000;
--      return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
--}
--
- #ifdef CONFIG_MMU
- #ifdef CONFIG_KUSER_HELPERS
- /*
-@@ -447,7 +442,7 @@ static struct vm_area_struct gate_vma = {
- static int __init gate_vma_init(void)
- {
--      gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
-+      gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
-       return 0;
- }
- arch_initcall(gate_vma_init);
-@@ -466,48 +461,23 @@ int in_gate_area_no_mm(unsigned long addr)
- {
-       return in_gate_area(NULL, addr);
- }
--#define is_gate_vma(vma)      ((vma) = &gate_vma)
-+#define is_gate_vma(vma)      ((vma) == &gate_vma)
- #else
- #define is_gate_vma(vma)      0
- #endif
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--      return is_gate_vma(vma) ? "[vectors]" :
--              (vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
--               "[sigpage]" : NULL;
-+      return is_gate_vma(vma) ? "[vectors]" : NULL;
- }
--static struct page *signal_page;
--extern struct page *get_signal_page(void);
--
- int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- {
-       struct mm_struct *mm = current->mm;
--      unsigned long addr;
--      int ret;
--
--      if (!signal_page)
--              signal_page = get_signal_page();
--      if (!signal_page)
--              return -ENOMEM;
-       down_write(&mm->mmap_sem);
--      addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
--      if (IS_ERR_VALUE(addr)) {
--              ret = addr;
--              goto up_fail;
--      }
--
--      ret = install_special_mapping(mm, addr, PAGE_SIZE,
--              VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
--              &signal_page);
--
--      if (ret == 0)
--              mm->context.sigpage = addr;
--
-- up_fail:
-+      mm->context.sigpage = (PAGE_OFFSET + (get_random_int() % 0x3FFEFFE0)) & 0xFFFFFFFC;
-       up_write(&mm->mmap_sem);
--      return ret;
-+      return 0;
- }
- #endif
-diff --git a/arch/arm/kernel/psci.c b/arch/arm/kernel/psci.c
-index 3653164..d83e55d 100644
---- a/arch/arm/kernel/psci.c
-+++ b/arch/arm/kernel/psci.c
-@@ -24,7 +24,7 @@
- #include <asm/opcodes-virt.h>
- #include <asm/psci.h>
--struct psci_operations psci_ops;
-+struct psci_operations psci_ops __read_only;
- static int (*invoke_psci_fn)(u32, u32, u32, u32);
-diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index 03deeff..741ce88 100644
---- a/arch/arm/kernel/ptrace.c
-+++ b/arch/arm/kernel/ptrace.c
-@@ -937,10 +937,19 @@ static int tracehook_report_syscall(struct pt_regs *regs,
-       return current_thread_info()->syscall;
- }
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
- {
-       current_thread_info()->syscall = scno;
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+      if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+              gr_delayed_cred_worker();
-+#endif
-+
-       /* Do the secure computing check first; failures should be fast. */
-       if (secure_computing(scno) == -1)
-               return -1;
-diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index b4b1d39..efdc9be 100644
---- a/arch/arm/kernel/setup.c
-+++ b/arch/arm/kernel/setup.c
-@@ -97,21 +97,23 @@ EXPORT_SYMBOL(system_serial_high);
- unsigned int elf_hwcap __read_mostly;
- EXPORT_SYMBOL(elf_hwcap);
-+pteval_t __supported_pte_mask __read_only;
-+pmdval_t __supported_pmd_mask __read_only;
- #ifdef MULTI_CPU
--struct processor processor __read_mostly;
-+struct processor processor;
- #endif
- #ifdef MULTI_TLB
--struct cpu_tlb_fns cpu_tlb __read_mostly;
-+struct cpu_tlb_fns cpu_tlb __read_only;
- #endif
- #ifdef MULTI_USER
--struct cpu_user_fns cpu_user __read_mostly;
-+struct cpu_user_fns cpu_user __read_only;
- #endif
- #ifdef MULTI_CACHE
--struct cpu_cache_fns cpu_cache __read_mostly;
-+struct cpu_cache_fns cpu_cache __read_only;
- #endif
- #ifdef CONFIG_OUTER_CACHE
--struct outer_cache_fns outer_cache __read_mostly;
-+struct outer_cache_fns outer_cache __read_only;
- EXPORT_SYMBOL(outer_cache);
- #endif
-@@ -236,9 +238,13 @@ static int __get_cpu_architecture(void)
-               asm("mrc        p15, 0, %0, c0, c1, 4"
-                   : "=r" (mmfr0));
-               if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
--                  (mmfr0 & 0x000000f0) >= 0x00000030)
-+                  (mmfr0 & 0x000000f0) >= 0x00000030) {
-                       cpu_arch = CPU_ARCH_ARMv7;
--              else if ((mmfr0 & 0x0000000f) == 0x00000002 ||
-+                      if ((mmfr0 & 0x0000000f) == 0x00000005 || (mmfr0 & 0x0000000f) == 0x00000004) {
-+                              __supported_pte_mask |= L_PTE_PXN;
-+                              __supported_pmd_mask |= PMD_PXNTABLE;
-+                      }
-+              } else if ((mmfr0 & 0x0000000f) == 0x00000002 ||
-                        (mmfr0 & 0x000000f0) == 0x00000020)
-                       cpu_arch = CPU_ARCH_ARMv6;
-               else
-@@ -479,7 +485,7 @@ static void __init setup_processor(void)
-       __cpu_architecture = __get_cpu_architecture();
- #ifdef MULTI_CPU
--      processor = *list->proc;
-+      memcpy((void *)&processor, list->proc, sizeof processor);
- #endif
- #ifdef MULTI_TLB
-       cpu_tlb = *list->tlb;
-diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
-index 5a42c12..a2bb7c6 100644
---- a/arch/arm/kernel/signal.c
-+++ b/arch/arm/kernel/signal.c
-@@ -45,8 +45,6 @@ static const unsigned long sigreturn_codes[7] = {
-       MOV_R7_NR_RT_SIGRETURN, SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN,
- };
--static unsigned long signal_return_offset;
--
- #ifdef CONFIG_CRUNCH
- static int preserve_crunch_context(struct crunch_sigframe __user *frame)
- {
-@@ -406,8 +404,7 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
-                        * except when the MPU has protected the vectors
-                        * page from PL0
-                        */
--                      retcode = mm->context.sigpage + signal_return_offset +
--                                (idx << 2) + thumb;
-+                      retcode = mm->context.sigpage + (idx << 2) + thumb;
-               } else
- #endif
-               {
-@@ -611,33 +608,3 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
-       } while (thread_flags & _TIF_WORK_MASK);
-       return 0;
- }
--
--struct page *get_signal_page(void)
--{
--      unsigned long ptr;
--      unsigned offset;
--      struct page *page;
--      void *addr;
--
--      page = alloc_pages(GFP_KERNEL, 0);
--
--      if (!page)
--              return NULL;
--
--      addr = page_address(page);
--
--      /* Give the signal return code some randomness */
--      offset = 0x200 + (get_random_int() & 0x7fc);
--      signal_return_offset = offset;
--
--      /*
--       * Copy signal return handlers into the vector page, and
--       * set sigreturn to be a pointer to these.
--       */
--      memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
--
--      ptr = (unsigned long)addr + offset;
--      flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
--
--      return page;
--}
-diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index 5919eb4..b5d6dfe 100644
---- a/arch/arm/kernel/smp.c
-+++ b/arch/arm/kernel/smp.c
-@@ -70,7 +70,7 @@ enum ipi_msg_type {
- static DECLARE_COMPLETION(cpu_running);
--static struct smp_operations smp_ops;
-+static struct smp_operations smp_ops __read_only;
- void __init smp_set_ops(struct smp_operations *ops)
- {
-diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index 6b9567e..b8af2d6 100644
---- a/arch/arm/kernel/traps.c
-+++ b/arch/arm/kernel/traps.c
-@@ -55,7 +55,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
- void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
- {
- #ifdef CONFIG_KALLSYMS
--      printk("[<%08lx>] (%pS) from [<%08lx>] (%pS)\n", where, (void *)where, from, (void *)from);
-+      printk("[<%08lx>] (%pA) from [<%08lx>] (%pA)\n", where, (void *)where, from, (void *)from);
- #else
-       printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
- #endif
-@@ -257,6 +257,8 @@ static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
- static int die_owner = -1;
- static unsigned int die_nest_count;
-+extern void gr_handle_kernel_exploit(void);
-+
- static unsigned long oops_begin(void)
- {
-       int cpu;
-@@ -299,6 +301,9 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
-               panic("Fatal exception in interrupt");
-       if (panic_on_oops)
-               panic("Fatal exception");
-+
-+      gr_handle_kernel_exploit();
-+
-       if (signr)
-               do_exit(signr);
- }
-@@ -592,7 +597,9 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
-                        * The user helper at 0xffff0fe0 must be used instead.
-                        * (see entry-armv.S for details)
-                        */
-+                      pax_open_kernel();
-                       *((unsigned int *)0xffff0ff0) = regs->ARM_r0;
-+                      pax_close_kernel();
-               }
-               return 0;
-@@ -848,5 +855,9 @@ void __init early_trap_init(void *vectors_base)
-       kuser_init(vectors_base);
-       flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
--      modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
-+
-+#ifndef CONFIG_PAX_MEMORY_UDEREF
-+      modify_domain(DOMAIN_USER, DOMAIN_USERCLIENT);
-+#endif
-+
- }
-diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
-index 33f2ea3..0b91824 100644
---- a/arch/arm/kernel/vmlinux.lds.S
-+++ b/arch/arm/kernel/vmlinux.lds.S
-@@ -8,7 +8,11 @@
- #include <asm/thread_info.h>
- #include <asm/memory.h>
- #include <asm/page.h>
--      
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#include <asm/pgtable.h>
-+#endif
-+
- #define PROC_INFO                                                     \
-       . = ALIGN(4);                                                   \
-       VMLINUX_SYMBOL(__proc_info_begin) = .;                          \
-@@ -94,6 +98,11 @@ SECTIONS
-               _text = .;
-               HEAD_TEXT
-       }
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+      . = ALIGN(1<<SECTION_SHIFT);
-+#endif
-+
-       .text : {                       /* Real text segment            */
-               _stext = .;             /* Text and read-only data      */
-                       __exception_text_start = .;
-@@ -116,6 +125,8 @@ SECTIONS
-                       ARM_CPU_KEEP(PROC_INFO)
-       }
-+      _etext = .;                     /* End of text section */
-+
-       RO_DATA(PAGE_SIZE)
-       . = ALIGN(4);
-@@ -146,7 +157,9 @@ SECTIONS
-       NOTES
--      _etext = .;                     /* End of text and rodata section */
-+#ifdef CONFIG_PAX_KERNEXEC
-+      . = ALIGN(1<<SECTION_SHIFT);
-+#endif
- #ifndef CONFIG_XIP_KERNEL
-       . = ALIGN(PAGE_SIZE);
-@@ -224,6 +237,11 @@ SECTIONS
-       . = PAGE_OFFSET + TEXT_OFFSET;
- #else
-       __init_end = .;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+      . = ALIGN(1<<SECTION_SHIFT);
-+#endif
-+
-       . = ALIGN(THREAD_SIZE);
-       __data_loc = .;
- #endif
-diff --git a/arch/arm/lib/clear_user.S b/arch/arm/lib/clear_user.S
-index 14a0d98..7771a7d 100644
---- a/arch/arm/lib/clear_user.S
-+++ b/arch/arm/lib/clear_user.S
-@@ -12,14 +12,14 @@
-               .text
--/* Prototype: int __clear_user(void *addr, size_t sz)
-+/* Prototype: int ___clear_user(void *addr, size_t sz)
-  * Purpose  : clear some user memory
-  * Params   : addr - user memory address to clear
-  *          : sz   - number of bytes to clear
-  * Returns  : number of bytes NOT cleared
-  */
- ENTRY(__clear_user_std)
--WEAK(__clear_user)
-+WEAK(___clear_user)
-               stmfd   sp!, {r1, lr}
-               mov     r2, #0
-               cmp     r1, #4
-@@ -44,7 +44,7 @@ WEAK(__clear_user)
- USER(         strnebt r2, [r0])
-               mov     r0, #0
-               ldmfd   sp!, {r1, pc}
--ENDPROC(__clear_user)
-+ENDPROC(___clear_user)
- ENDPROC(__clear_user_std)
-               .pushsection .fixup,"ax"
-diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
-index 66a477a..bee61d3 100644
---- a/arch/arm/lib/copy_from_user.S
-+++ b/arch/arm/lib/copy_from_user.S
-@@ -16,7 +16,7 @@
- /*
-  * Prototype:
-  *
-- *    size_t __copy_from_user(void *to, const void *from, size_t n)
-+ *    size_t ___copy_from_user(void *to, const void *from, size_t n)
-  *
-  * Purpose:
-  *
-@@ -84,11 +84,11 @@
-       .text
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
- #include "copy_template.S"
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-       .pushsection .fixup,"ax"
-       .align 0
-diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
-index 6ee2f67..d1cce76 100644
---- a/arch/arm/lib/copy_page.S
-+++ b/arch/arm/lib/copy_page.S
-@@ -10,6 +10,7 @@
-  *  ASM optimised string functions
-  */
- #include <linux/linkage.h>
-+#include <linux/const.h>
- #include <asm/assembler.h>
- #include <asm/asm-offsets.h>
- #include <asm/cache.h>
-diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
-index d066df6..df28194 100644
---- a/arch/arm/lib/copy_to_user.S
-+++ b/arch/arm/lib/copy_to_user.S
-@@ -16,7 +16,7 @@
- /*
-  * Prototype:
-  *
-- *    size_t __copy_to_user(void *to, const void *from, size_t n)
-+ *    size_t ___copy_to_user(void *to, const void *from, size_t n)
-  *
-  * Purpose:
-  *
-@@ -88,11 +88,11 @@
-       .text
- ENTRY(__copy_to_user_std)
--WEAK(__copy_to_user)
-+WEAK(___copy_to_user)
- #include "copy_template.S"
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
- ENDPROC(__copy_to_user_std)
-       .pushsection .fixup,"ax"
-diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
-index 7d08b43..f7ca7ea 100644
---- a/arch/arm/lib/csumpartialcopyuser.S
-+++ b/arch/arm/lib/csumpartialcopyuser.S
-@@ -57,8 +57,8 @@
-  *  Returns : r0 = checksum, [[sp, #0], #0] = 0 or -EFAULT
-  */
--#define FN_ENTRY      ENTRY(csum_partial_copy_from_user)
--#define FN_EXIT               ENDPROC(csum_partial_copy_from_user)
-+#define FN_ENTRY      ENTRY(__csum_partial_copy_from_user)
-+#define FN_EXIT               ENDPROC(__csum_partial_copy_from_user)
- #include "csumpartialcopygeneric.S"
-diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
-index 64dbfa5..84a3fd9 100644
---- a/arch/arm/lib/delay.c
-+++ b/arch/arm/lib/delay.c
-@@ -28,7 +28,7 @@
- /*
-  * Default to the loop-based delay implementation.
-  */
--struct arm_delay_ops arm_delay_ops = {
-+struct arm_delay_ops arm_delay_ops __read_only = {
-       .delay          = __loop_delay,
-       .const_udelay   = __loop_const_udelay,
-       .udelay         = __loop_udelay,
-diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
-index 025f742..8432b08 100644
---- a/arch/arm/lib/uaccess_with_memcpy.c
-+++ b/arch/arm/lib/uaccess_with_memcpy.c
-@@ -104,7 +104,7 @@ out:
- }
- unsigned long
--__copy_to_user(void __user *to, const void *from, unsigned long n)
-+___copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-       /*
-        * This test is stubbed out of the main function above to keep
-diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
-index f389228..592ef66 100644
---- a/arch/arm/mach-kirkwood/common.c
-+++ b/arch/arm/mach-kirkwood/common.c
-@@ -149,7 +149,16 @@ static void clk_gate_fn_disable(struct clk_hw *hw)
-       clk_gate_ops.disable(hw);
- }
--static struct clk_ops clk_gate_fn_ops;
-+static int clk_gate_fn_is_enabled(struct clk_hw *hw)
-+{
-+      return clk_gate_ops.is_enabled(hw);
-+}
-+
-+static struct clk_ops clk_gate_fn_ops = {
-+      .enable = clk_gate_fn_enable,
-+      .disable = clk_gate_fn_disable,
-+      .is_enabled = clk_gate_fn_is_enabled,
-+};
- static struct clk __init *clk_register_gate_fn(struct device *dev,
-               const char *name,
-@@ -183,14 +192,6 @@ static struct clk __init *clk_register_gate_fn(struct device *dev,
-       gate_fn->fn_en = fn_en;
-       gate_fn->fn_dis = fn_dis;
--      /* ops is the gate ops, but with our enable/disable functions */
--      if (clk_gate_fn_ops.enable != clk_gate_fn_enable ||
--          clk_gate_fn_ops.disable != clk_gate_fn_disable) {
--              clk_gate_fn_ops = clk_gate_ops;
--              clk_gate_fn_ops.enable = clk_gate_fn_enable;
--              clk_gate_fn_ops.disable = clk_gate_fn_disable;
--      }
--
-       clk = clk_register(dev, &gate_fn->gate.hw);
-       if (IS_ERR(clk))
-diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
-index f6eeb87..cc90868 100644
---- a/arch/arm/mach-omap2/board-n8x0.c
-+++ b/arch/arm/mach-omap2/board-n8x0.c
-@@ -631,7 +631,7 @@ static int n8x0_menelaus_late_init(struct device *dev)
- }
- #endif
--static struct menelaus_platform_data n8x0_menelaus_platform_data __initdata = {
-+static struct menelaus_platform_data n8x0_menelaus_platform_data __initconst = {
-       .late_init = n8x0_menelaus_late_init,
- };
-diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
-index 6c4da12..d9ca72d 100644
---- a/arch/arm/mach-omap2/gpmc.c
-+++ b/arch/arm/mach-omap2/gpmc.c
-@@ -147,7 +147,6 @@ struct omap3_gpmc_regs {
- };
- static struct gpmc_client_irq gpmc_client_irq[GPMC_NR_IRQ];
--static struct irq_chip gpmc_irq_chip;
- static unsigned gpmc_irq_start;
- static struct resource        gpmc_mem_root;
-@@ -711,6 +710,18 @@ static void gpmc_irq_noop(struct irq_data *data) { }
- static unsigned int gpmc_irq_noop_ret(struct irq_data *data) { return 0; }
-+static struct irq_chip gpmc_irq_chip = {
-+      .name = "gpmc",
-+      .irq_startup = gpmc_irq_noop_ret,
-+      .irq_enable = gpmc_irq_enable,
-+      .irq_disable = gpmc_irq_disable,
-+      .irq_shutdown = gpmc_irq_noop,
-+      .irq_ack = gpmc_irq_noop,
-+      .irq_mask = gpmc_irq_noop,
-+      .irq_unmask = gpmc_irq_noop,
-+
-+};
-+
- static int gpmc_setup_irq(void)
- {
-       int i;
-@@ -725,15 +736,6 @@ static int gpmc_setup_irq(void)
-               return gpmc_irq_start;
-       }
--      gpmc_irq_chip.name = "gpmc";
--      gpmc_irq_chip.irq_startup = gpmc_irq_noop_ret;
--      gpmc_irq_chip.irq_enable = gpmc_irq_enable;
--      gpmc_irq_chip.irq_disable = gpmc_irq_disable;
--      gpmc_irq_chip.irq_shutdown = gpmc_irq_noop;
--      gpmc_irq_chip.irq_ack = gpmc_irq_noop;
--      gpmc_irq_chip.irq_mask = gpmc_irq_noop;
--      gpmc_irq_chip.irq_unmask = gpmc_irq_noop;
--
-       gpmc_client_irq[0].bitmask = GPMC_IRQ_FIFOEVENTENABLE;
-       gpmc_client_irq[1].bitmask = GPMC_IRQ_COUNT_EVENT;
-diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
-index f8bb3b9..831e7b8 100644
---- a/arch/arm/mach-omap2/omap-wakeupgen.c
-+++ b/arch/arm/mach-omap2/omap-wakeupgen.c
-@@ -339,7 +339,7 @@ static int __cpuinit irq_cpu_hotplug_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __refdata irq_hotplug_notifier = {
-+static struct notifier_block irq_hotplug_notifier = {
-       .notifier_call = irq_cpu_hotplug_notify,
- };
-diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
-index e6d2307..d057195 100644
---- a/arch/arm/mach-omap2/omap_device.c
-+++ b/arch/arm/mach-omap2/omap_device.c
-@@ -499,7 +499,7 @@ void omap_device_delete(struct omap_device *od)
- struct platform_device __init *omap_device_build(const char *pdev_name,
-                                                int pdev_id,
-                                                struct omap_hwmod *oh,
--                                               void *pdata, int pdata_len)
-+                                               const void *pdata, int pdata_len)
- {
-       struct omap_hwmod *ohs[] = { oh };
-@@ -527,7 +527,7 @@ struct platform_device __init *omap_device_build(const char *pdev_name,
- struct platform_device __init *omap_device_build_ss(const char *pdev_name,
-                                                   int pdev_id,
-                                                   struct omap_hwmod **ohs,
--                                                  int oh_cnt, void *pdata,
-+                                                  int oh_cnt, const void *pdata,
-                                                   int pdata_len)
- {
-       int ret = -ENOMEM;
-diff --git a/arch/arm/mach-omap2/omap_device.h b/arch/arm/mach-omap2/omap_device.h
-index 044c31d..2ee0861 100644
---- a/arch/arm/mach-omap2/omap_device.h
-+++ b/arch/arm/mach-omap2/omap_device.h
-@@ -72,12 +72,12 @@ int omap_device_idle(struct platform_device *pdev);
- /* Core code interface */
- struct platform_device *omap_device_build(const char *pdev_name, int pdev_id,
--                                        struct omap_hwmod *oh, void *pdata,
-+                                        struct omap_hwmod *oh, const void *pdata,
-                                         int pdata_len);
- struct platform_device *omap_device_build_ss(const char *pdev_name, int pdev_id,
-                                        struct omap_hwmod **oh, int oh_cnt,
--                                       void *pdata, int pdata_len);
-+                                       const void *pdata, int pdata_len);
- struct omap_device *omap_device_alloc(struct platform_device *pdev,
-                                     struct omap_hwmod **ohs, int oh_cnt);
-diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
-index 7341eff..fd75e34 100644
---- a/arch/arm/mach-omap2/omap_hwmod.c
-+++ b/arch/arm/mach-omap2/omap_hwmod.c
-@@ -194,10 +194,10 @@ struct omap_hwmod_soc_ops {
-       int (*init_clkdm)(struct omap_hwmod *oh);
-       void (*update_context_lost)(struct omap_hwmod *oh);
-       int (*get_context_lost)(struct omap_hwmod *oh);
--};
-+} __no_const;
- /* soc_ops: adapts the omap_hwmod code to the currently-booted SoC */
--static struct omap_hwmod_soc_ops soc_ops;
-+static struct omap_hwmod_soc_ops soc_ops __read_only;
- /* omap_hwmod_list contains all registered struct omap_hwmods */
- static LIST_HEAD(omap_hwmod_list);
-diff --git a/arch/arm/mach-omap2/wd_timer.c b/arch/arm/mach-omap2/wd_timer.c
-index d15c7bb..b2d1f0c 100644
---- a/arch/arm/mach-omap2/wd_timer.c
-+++ b/arch/arm/mach-omap2/wd_timer.c
-@@ -110,7 +110,9 @@ static int __init omap_init_wdt(void)
-       struct omap_hwmod *oh;
-       char *oh_name = "wd_timer2";
-       char *dev_name = "omap_wdt";
--      struct omap_wd_timer_platform_data pdata;
-+      static struct omap_wd_timer_platform_data pdata = {
-+              .read_reset_sources = prm_read_reset_sources
-+      };
-       if (!cpu_class_is_omap2() || of_have_populated_dt())
-               return 0;
-@@ -121,8 +123,6 @@ static int __init omap_init_wdt(void)
-               return -EINVAL;
-       }
--      pdata.read_reset_sources = prm_read_reset_sources;
--
-       pdev = omap_device_build(dev_name, id, oh, &pdata,
-                                sizeof(struct omap_wd_timer_platform_data));
-       WARN(IS_ERR(pdev), "Can't build omap_device for %s:%s.\n",
-diff --git a/arch/arm/mach-tegra/cpuidle-tegra20.c b/arch/arm/mach-tegra/cpuidle-tegra20.c
-index 0cdba8d..297993e 100644
---- a/arch/arm/mach-tegra/cpuidle-tegra20.c
-+++ b/arch/arm/mach-tegra/cpuidle-tegra20.c
-@@ -181,7 +181,7 @@ static int tegra20_idle_lp2_coupled(struct cpuidle_device *dev,
-       bool entered_lp2 = false;
-       if (tegra_pending_sgi())
--              ACCESS_ONCE(abort_flag) = true;
-+              ACCESS_ONCE_RW(abort_flag) = true;
-       cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
-diff --git a/arch/arm/mach-ux500/setup.h b/arch/arm/mach-ux500/setup.h
-index cad3ca86..1d79e0f 100644
---- a/arch/arm/mach-ux500/setup.h
-+++ b/arch/arm/mach-ux500/setup.h
-@@ -37,13 +37,6 @@ extern void ux500_timer_init(void);
-       .type           = MT_DEVICE,            \
- }
--#define __MEM_DEV_DESC(x, sz) {               \
--      .virtual        = IO_ADDRESS(x),        \
--      .pfn            = __phys_to_pfn(x),     \
--      .length         = sz,                   \
--      .type           = MT_MEMORY,            \
--}
--
- extern struct smp_operations ux500_smp_ops;
- extern void ux500_cpu_die(unsigned int cpu);
-diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
-index 08c9fe9..191320c 100644
---- a/arch/arm/mm/Kconfig
-+++ b/arch/arm/mm/Kconfig
-@@ -436,7 +436,7 @@ config CPU_32v5
- config CPU_32v6
-       bool
--      select CPU_USE_DOMAINS if CPU_V6 && MMU
-+      select CPU_USE_DOMAINS if CPU_V6 && MMU && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
-       select TLS_REG_EMUL if !CPU_32v6K && !MMU
- config CPU_32v6K
-@@ -585,6 +585,7 @@ config CPU_CP15_MPU
- config CPU_USE_DOMAINS
-       bool
-+      depends on !ARM_LPAE && !PAX_KERNEXEC
-       help
-         This option enables or disables the use of domain switching
-         via the set_fs() function.
-@@ -780,6 +781,7 @@ config NEED_KUSER_HELPERS
- config KUSER_HELPERS
-       bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
-       default y
-+      depends on !(CPU_V6 || CPU_V6K || CPU_V7)
-       help
-         Warning: disabling this option may break user programs.
-@@ -792,7 +794,7 @@ config KUSER_HELPERS
-         See Documentation/arm/kernel_user_helpers.txt for details.
-         However, the fixed address nature of these helpers can be used
--        by ROP (return orientated programming) authors when creating
-+        by ROP (Return Oriented Programming) authors when creating
-         exploits.
-         If all of the binaries and libraries which run on your platform
-diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
-index 6f4585b..7b6f52b 100644
---- a/arch/arm/mm/alignment.c
-+++ b/arch/arm/mm/alignment.c
-@@ -211,10 +211,12 @@ union offset_union {
- #define __get16_unaligned_check(ins,val,addr)                 \
-       do {                                                    \
-               unsigned int err = 0, v, a = addr;              \
-+              pax_open_userland();                            \
-               __get8_unaligned_check(ins,v,a,err);            \
-               val =  v << ((BE) ? 8 : 0);                     \
-               __get8_unaligned_check(ins,v,a,err);            \
-               val |= v << ((BE) ? 0 : 8);                     \
-+              pax_close_userland();                           \
-               if (err)                                        \
-                       goto fault;                             \
-       } while (0)
-@@ -228,6 +230,7 @@ union offset_union {
- #define __get32_unaligned_check(ins,val,addr)                 \
-       do {                                                    \
-               unsigned int err = 0, v, a = addr;              \
-+              pax_open_userland();                            \
-               __get8_unaligned_check(ins,v,a,err);            \
-               val =  v << ((BE) ? 24 :  0);                   \
-               __get8_unaligned_check(ins,v,a,err);            \
-@@ -236,6 +239,7 @@ union offset_union {
-               val |= v << ((BE) ?  8 : 16);                   \
-               __get8_unaligned_check(ins,v,a,err);            \
-               val |= v << ((BE) ?  0 : 24);                   \
-+              pax_close_userland();                           \
-               if (err)                                        \
-                       goto fault;                             \
-       } while (0)
-@@ -249,6 +253,7 @@ union offset_union {
- #define __put16_unaligned_check(ins,val,addr)                 \
-       do {                                                    \
-               unsigned int err = 0, v = val, a = addr;        \
-+              pax_open_userland();                            \
-               __asm__( FIRST_BYTE_16                          \
-        ARM(   "1:     "ins"   %1, [%2], #1\n" )               \
-        THUMB( "1:     "ins"   %1, [%2]\n"     )               \
-@@ -268,6 +273,7 @@ union offset_union {
-               "       .popsection\n"                          \
-               : "=r" (err), "=&r" (v), "=&r" (a)              \
-               : "0" (err), "1" (v), "2" (a));                 \
-+              pax_close_userland();                           \
-               if (err)                                        \
-                       goto fault;                             \
-       } while (0)
-@@ -281,6 +287,7 @@ union offset_union {
- #define __put32_unaligned_check(ins,val,addr)                 \
-       do {                                                    \
-               unsigned int err = 0, v = val, a = addr;        \
-+              pax_open_userland();                            \
-               __asm__( FIRST_BYTE_32                          \
-        ARM(   "1:     "ins"   %1, [%2], #1\n" )               \
-        THUMB( "1:     "ins"   %1, [%2]\n"     )               \
-@@ -310,6 +317,7 @@ union offset_union {
-               "       .popsection\n"                          \
-               : "=r" (err), "=&r" (v), "=&r" (a)              \
-               : "0" (err), "1" (v), "2" (a));                 \
-+              pax_close_userland();                           \
-               if (err)                                        \
-                       goto fault;                             \
-       } while (0)
-diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 5dbf13f..a2d1876 100644
---- a/arch/arm/mm/fault.c
-+++ b/arch/arm/mm/fault.c
-@@ -25,6 +25,7 @@
- #include <asm/system_misc.h>
- #include <asm/system_info.h>
- #include <asm/tlbflush.h>
-+#include <asm/sections.h>
- #include "fault.h"
-@@ -138,6 +139,20 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
-       if (fixup_exception(regs))
-               return;
-+#ifdef CONFIG_PAX_KERNEXEC
-+      if ((fsr & FSR_WRITE) &&
-+          (((unsigned long)_stext <= addr && addr < init_mm.end_code) ||
-+           (MODULES_VADDR <= addr && addr < MODULES_END)))
-+      {
-+              if (current->signal->curr_ip)
-+                      printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
-+                                      from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
-+              else
-+                      printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", current->comm, task_pid_nr(current),
-+                                      from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
-+      }
-+#endif
-+
-       /*
-        * No handler, we'll have to terminate things with extreme prejudice.
-        */
-@@ -174,6 +189,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
-       }
- #endif
-+#ifdef CONFIG_PAX_PAGEEXEC
-+      if (fsr & FSR_LNX_PF) {
-+              pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
-+              do_group_exit(SIGKILL);
-+      }
-+#endif
-+
-       tsk->thread.address = addr;
-       tsk->thread.error_code = fsr;
-       tsk->thread.trap_no = 14;
-@@ -398,6 +420,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
- }
- #endif                                        /* CONFIG_MMU */
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 20; i++) {
-+              unsigned char c;
-+              if (get_user(c, (__force unsigned char __user *)pc+i))
-+                      printk(KERN_CONT "?? ");
-+              else
-+                      printk(KERN_CONT "%02x ", c);
-+      }
-+      printk("\n");
-+
-+      printk(KERN_ERR "PAX: bytes at SP-4: ");
-+      for (i = -1; i < 20; i++) {
-+              unsigned long c;
-+              if (get_user(c, (__force unsigned long __user *)sp+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%08lx ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
-+
- /*
-  * First Level Translation Fault Handler
-  *
-@@ -543,9 +592,22 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
-       const struct fsr_info *inf = fsr_info + fsr_fs(fsr);
-       struct siginfo info;
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+      if (addr < TASK_SIZE && is_domain_fault(fsr)) {
-+              if (current->signal->curr_ip)
-+                      printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
-+                                      from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
-+              else
-+                      printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", current->comm, task_pid_nr(current),
-+                                      from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
-+              goto die;
-+      }
-+#endif
-+
-       if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
-               return;
-+die:
-       printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
-               inf->name, fsr, addr);
-@@ -569,15 +631,68 @@ hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *
-       ifsr_info[nr].name = name;
- }
-+asmlinkage int sys_sigreturn(struct pt_regs *regs);
-+asmlinkage int sys_rt_sigreturn(struct pt_regs *regs);
-+
- asmlinkage void __exception
- do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
- {
-       const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
-       struct siginfo info;
-+      unsigned long pc = instruction_pointer(regs);
-+
-+      if (user_mode(regs)) {
-+              unsigned long sigpage = current->mm->context.sigpage;
-+
-+              if (sigpage <= pc && pc < sigpage + 7*4) {
-+                      if (pc < sigpage + 3*4)
-+                              sys_sigreturn(regs);
-+                      else
-+                              sys_rt_sigreturn(regs);
-+                      return;
-+              }
-+              if (pc == 0xffff0fe0UL) {
-+                      /*
-+                       * PaX: __kuser_get_tls emulation
-+                       */
-+                      regs->ARM_r0 = current_thread_info()->tp_value;
-+                      regs->ARM_pc = regs->ARM_lr;
-+                      return;
-+              }
-+      }
-+
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+      else if (is_domain_fault(ifsr) || is_xn_fault(ifsr)) {
-+              if (current->signal->curr_ip)
-+                      printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to execute %s memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
-+                                      from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()),
-+                                      pc >= TASK_SIZE ? "non-executable kernel" : "userland", pc);
-+              else
-+                      printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to execute %s memory at %08lx\n", current->comm, task_pid_nr(current),
-+                                      from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()),
-+                                      pc >= TASK_SIZE ? "non-executable kernel" : "userland", pc);
-+              goto die;
-+      }
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+      if (fsr_fs(ifsr) == FAULT_CODE_DEBUG) {
-+              unsigned int bkpt;
-+
-+              if (!probe_kernel_address((unsigned int *)pc, bkpt) && cpu_to_le32(bkpt) == 0xe12f1073) {
-+                      current->thread.error_code = ifsr;
-+                      current->thread.trap_no = 0;
-+                      pax_report_refcount_overflow(regs);
-+                      fixup_exception(regs);
-+                      return;
-+              }
-+      }
-+#endif
-       if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
-               return;
-+die:
-       printk(KERN_ALERT "Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
-               inf->name, ifsr, addr);
-diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
-index cf08bdf..772656c 100644
---- a/arch/arm/mm/fault.h
-+++ b/arch/arm/mm/fault.h
-@@ -3,6 +3,7 @@
- /*
-  * Fault status register encodings.  We steal bit 31 for our own purposes.
-+ * Set when the FSR value is from an instruction fault.
-  */
- #define FSR_LNX_PF            (1 << 31)
- #define FSR_WRITE             (1 << 11)
-@@ -22,6 +23,17 @@ static inline int fsr_fs(unsigned int fsr)
- }
- #endif
-+/* valid for LPAE and !LPAE */
-+static inline int is_xn_fault(unsigned int fsr)
-+{
-+      return ((fsr_fs(fsr) & 0x3c) == 0xc);
-+}
-+
-+static inline int is_domain_fault(unsigned int fsr)
-+{
-+      return ((fsr_fs(fsr) & 0xD) == 0x9);
-+}
-+
- void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
- unsigned long search_exception_table(unsigned long addr);
-diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
-index 0ecc43f..190b956 100644
---- a/arch/arm/mm/init.c
-+++ b/arch/arm/mm/init.c
-@@ -30,6 +30,8 @@
- #include <asm/setup.h>
- #include <asm/tlb.h>
- #include <asm/fixmap.h>
-+#include <asm/system_info.h>
-+#include <asm/cp15.h>
- #include <asm/mach/arch.h>
- #include <asm/mach/map.h>
-@@ -726,7 +728,46 @@ void free_initmem(void)
- {
- #ifdef CONFIG_HAVE_TCM
-       extern char __tcm_start, __tcm_end;
-+#endif
-+#ifdef CONFIG_PAX_KERNEXEC
-+      unsigned long addr;
-+      pgd_t *pgd;
-+      pud_t *pud;
-+      pmd_t *pmd;
-+      int cpu_arch = cpu_architecture();
-+      unsigned int cr = get_cr();
-+
-+      if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {
-+              /* make pages tables, etc before .text NX */
-+              for (addr = PAGE_OFFSET; addr < (unsigned long)_stext; addr += SECTION_SIZE) {
-+                      pgd = pgd_offset_k(addr);
-+                      pud = pud_offset(pgd, addr);
-+                      pmd = pmd_offset(pud, addr);
-+                      __section_update(pmd, addr, PMD_SECT_XN);
-+              }
-+              /* make init NX */
-+              for (addr = (unsigned long)__init_begin; addr < (unsigned long)_sdata; addr += SECTION_SIZE) {
-+                      pgd = pgd_offset_k(addr);
-+                      pud = pud_offset(pgd, addr);
-+                      pmd = pmd_offset(pud, addr);
-+                      __section_update(pmd, addr, PMD_SECT_XN);
-+              }
-+              /* make kernel code/rodata RX */
-+              for (addr = (unsigned long)_stext; addr < (unsigned long)__init_begin; addr += SECTION_SIZE) {
-+                      pgd = pgd_offset_k(addr);
-+                      pud = pud_offset(pgd, addr);
-+                      pmd = pmd_offset(pud, addr);
-+#ifdef CONFIG_ARM_LPAE
-+                      __section_update(pmd, addr, PMD_SECT_RDONLY);
-+#else
-+                      __section_update(pmd, addr, PMD_SECT_APX|PMD_SECT_AP_WRITE);
-+#endif
-+              }
-+      }
-+#endif
-+
-+#ifdef CONFIG_HAVE_TCM
-       poison_init_mem(&__tcm_start, &__tcm_end - &__tcm_start);
-       free_reserved_area(&__tcm_start, &__tcm_end, 0, "TCM link");
- #endif
-diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
-index 04d9006..c547d85 100644
---- a/arch/arm/mm/ioremap.c
-+++ b/arch/arm/mm/ioremap.c
-@@ -392,9 +392,9 @@ __arm_ioremap_exec(unsigned long phys_addr, size_t size, bool cached)
-       unsigned int mtype;
-       if (cached)
--              mtype = MT_MEMORY;
-+              mtype = MT_MEMORY_RX;
-       else
--              mtype = MT_MEMORY_NONCACHED;
-+              mtype = MT_MEMORY_NONCACHED_RX;
-       return __arm_ioremap_caller(phys_addr, size, mtype,
-                       __builtin_return_address(0));
-diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
-index 10062ce..8695745 100644
---- a/arch/arm/mm/mmap.c
-+++ b/arch/arm/mm/mmap.c
-@@ -59,6 +59,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
-       struct vm_area_struct *vma;
-       int do_align = 0;
-       int aliasing = cache_is_vipt_aliasing();
-+      unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-       struct vm_unmapped_area_info info;
-       /*
-@@ -81,6 +82,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
-       if (len > TASK_SIZE)
-               return -ENOMEM;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       if (addr) {
-               if (do_align)
-                       addr = COLOUR_ALIGN(addr, pgoff);
-@@ -88,8 +93,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
-                       addr = PAGE_ALIGN(addr);
-               vma = find_vma(mm, addr);
--              if (TASK_SIZE - len >= addr &&
--                  (!vma || addr + len <= vma->vm_start))
-+              if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
-                       return addr;
-       }
-@@ -99,6 +103,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
-       info.high_limit = TASK_SIZE;
-       info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
-       info.align_offset = pgoff << PAGE_SHIFT;
-+      info.threadstack_offset = offset;
-       return vm_unmapped_area(&info);
- }
-@@ -112,6 +117,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-       unsigned long addr = addr0;
-       int do_align = 0;
-       int aliasing = cache_is_vipt_aliasing();
-+      unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-       struct vm_unmapped_area_info info;
-       /*
-@@ -132,6 +138,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-               return addr;
-       }
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       /* requesting a specific address */
-       if (addr) {
-               if (do_align)
-@@ -139,8 +149,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-               else
-                       addr = PAGE_ALIGN(addr);
-               vma = find_vma(mm, addr);
--              if (TASK_SIZE - len >= addr &&
--                              (!vma || addr + len <= vma->vm_start))
-+              if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
-                       return addr;
-       }
-@@ -150,6 +159,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-       info.high_limit = mm->mmap_base;
-       info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
-       info.align_offset = pgoff << PAGE_SHIFT;
-+      info.threadstack_offset = offset;
-       addr = vm_unmapped_area(&info);
-       /*
-@@ -173,6 +183,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- {
-       unsigned long random_factor = 0UL;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       /* 8 bits of randomness in 20 address space bits */
-       if ((current->flags & PF_RANDOMIZE) &&
-           !(current->personality & ADDR_NO_RANDOMIZE))
-@@ -180,10 +194,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
-       if (mmap_is_legacy()) {
-               mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area;
-               mm->unmap_area = arch_unmap_area;
-       } else {
-               mm->mmap_base = mmap_base(random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area_topdown;
-               mm->unmap_area = arch_unmap_area_topdown;
-       }
-diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
-index daf336f..4e6392c 100644
---- a/arch/arm/mm/mmu.c
-+++ b/arch/arm/mm/mmu.c
-@@ -36,6 +36,22 @@
- #include "mm.h"
- #include "tcm.h"
-+#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+void modify_domain(unsigned int dom, unsigned int type)
-+{
-+      struct thread_info *thread = current_thread_info();
-+      unsigned int domain = thread->cpu_domain;
-+      /*
-+       * DOMAIN_MANAGER might be defined to some other value,
-+       * use the arch-defined constant
-+       */
-+      domain &= ~domain_val(dom, 3);
-+      thread->cpu_domain = domain | domain_val(dom, type);
-+      set_domain(thread->cpu_domain);
-+}
-+EXPORT_SYMBOL(modify_domain);
-+#endif
-+
- /*
-  * empty_zero_page is a special page that is used for
-  * zero-initialized data and COW.
-@@ -228,10 +244,18 @@ __setup("noalign", noalign_setup);
- #endif /* ifdef CONFIG_CPU_CP15 / else */
--#define PROT_PTE_DEVICE               L_PTE_PRESENT|L_PTE_YOUNG|L_PTE_DIRTY|L_PTE_XN
-+#define PROT_PTE_DEVICE               L_PTE_PRESENT|L_PTE_YOUNG|L_PTE_DIRTY
- #define PROT_SECT_DEVICE      PMD_TYPE_SECT|PMD_SECT_AP_WRITE
--static struct mem_type mem_types[] = {
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define L_PTE_KERNEXEC                L_PTE_RDONLY
-+#define PMD_SECT_KERNEXEC     PMD_SECT_RDONLY
-+#else
-+#define L_PTE_KERNEXEC                L_PTE_DIRTY
-+#define PMD_SECT_KERNEXEC     PMD_SECT_AP_WRITE
-+#endif
-+
-+static struct mem_type mem_types[] __read_only = {
-       [MT_DEVICE] = {           /* Strongly ordered / ARMv6 shared device */
-               .prot_pte       = PROT_PTE_DEVICE | L_PTE_MT_DEV_SHARED |
-                                 L_PTE_SHARED,
-@@ -260,16 +284,16 @@ static struct mem_type mem_types[] = {
-       [MT_UNCACHED] = {
-               .prot_pte       = PROT_PTE_DEVICE,
-               .prot_l1        = PMD_TYPE_TABLE,
--              .prot_sect      = PMD_TYPE_SECT | PMD_SECT_XN,
-+              .prot_sect      = PROT_SECT_DEVICE,
-               .domain         = DOMAIN_IO,
-       },
-       [MT_CACHECLEAN] = {
--              .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_RDONLY,
-               .domain    = DOMAIN_KERNEL,
-       },
- #ifndef CONFIG_ARM_LPAE
-       [MT_MINICLEAN] = {
--              .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN | PMD_SECT_MINICACHE,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_MINICACHE | PMD_SECT_RDONLY,
-               .domain    = DOMAIN_KERNEL,
-       },
- #endif
-@@ -277,36 +301,54 @@ static struct mem_type mem_types[] = {
-               .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                               L_PTE_RDONLY,
-               .prot_l1   = PMD_TYPE_TABLE,
--              .domain    = DOMAIN_USER,
-+              .domain    = DOMAIN_VECTORS,
-       },
-       [MT_HIGH_VECTORS] = {
-               .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                               L_PTE_USER | L_PTE_RDONLY,
-               .prot_l1   = PMD_TYPE_TABLE,
--              .domain    = DOMAIN_USER,
-+              .domain    = DOMAIN_VECTORS,
-       },
--      [MT_MEMORY] = {
-+      [MT_MEMORY_RWX] = {
-               .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
-               .prot_l1   = PMD_TYPE_TABLE,
-               .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
-               .domain    = DOMAIN_KERNEL,
-       },
-+      [MT_MEMORY_RW] = {
-+              .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
-+              .prot_l1   = PMD_TYPE_TABLE,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
-+              .domain    = DOMAIN_KERNEL,
-+      },
-+      [MT_MEMORY_RX] = {
-+              .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC,
-+              .prot_l1   = PMD_TYPE_TABLE,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
-+              .domain    = DOMAIN_KERNEL,
-+      },
-       [MT_ROM] = {
--              .prot_sect = PMD_TYPE_SECT,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_RDONLY,
-               .domain    = DOMAIN_KERNEL,
-       },
--      [MT_MEMORY_NONCACHED] = {
-+      [MT_MEMORY_NONCACHED_RW] = {
-               .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                               L_PTE_MT_BUFFERABLE,
-               .prot_l1   = PMD_TYPE_TABLE,
-               .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
-               .domain    = DOMAIN_KERNEL,
-       },
-+      [MT_MEMORY_NONCACHED_RX] = {
-+              .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC |
-+                              L_PTE_MT_BUFFERABLE,
-+              .prot_l1   = PMD_TYPE_TABLE,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
-+              .domain    = DOMAIN_KERNEL,
-+      },
-       [MT_MEMORY_DTCM] = {
--              .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
--                              L_PTE_XN,
-+              .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
-               .prot_l1   = PMD_TYPE_TABLE,
--              .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
-+              .prot_sect = PMD_TYPE_SECT | PMD_SECT_RDONLY,
-               .domain    = DOMAIN_KERNEL,
-       },
-       [MT_MEMORY_ITCM] = {
-@@ -316,10 +358,10 @@ static struct mem_type mem_types[] = {
-       },
-       [MT_MEMORY_SO] = {
-               .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
--                              L_PTE_MT_UNCACHED | L_PTE_XN,
-+                              L_PTE_MT_UNCACHED,
-               .prot_l1   = PMD_TYPE_TABLE,
-               .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE | PMD_SECT_S |
--                              PMD_SECT_UNCACHED | PMD_SECT_XN,
-+                              PMD_SECT_UNCACHED,
-               .domain    = DOMAIN_KERNEL,
-       },
-       [MT_MEMORY_DMA_READY] = {
-@@ -405,9 +447,35 @@ static void __init build_mem_type_table(void)
-                        * to prevent speculative instruction fetches.
-                        */
-                       mem_types[MT_DEVICE].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_DEVICE].prot_pte |= L_PTE_XN;
-                       mem_types[MT_DEVICE_NONSHARED].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_DEVICE_NONSHARED].prot_pte |= L_PTE_XN;
-                       mem_types[MT_DEVICE_CACHED].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_DEVICE_CACHED].prot_pte |= L_PTE_XN;
-                       mem_types[MT_DEVICE_WC].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_DEVICE_WC].prot_pte |= L_PTE_XN;
-+
-+                      /* Mark other regions on ARMv6+ as execute-never */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+                      mem_types[MT_UNCACHED].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_UNCACHED].prot_pte |= L_PTE_XN;
-+                      mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_CACHECLEAN].prot_pte |= L_PTE_XN;
-+#ifndef CONFIG_ARM_LPAE
-+                      mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_MINICLEAN].prot_pte |= L_PTE_XN;
-+#endif
-+                      mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_MEMORY_RW].prot_pte |= L_PTE_XN;
-+                      mem_types[MT_MEMORY_NONCACHED_RW].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_MEMORY_NONCACHED_RW].prot_pte |= PMD_SECT_XN;
-+                      mem_types[MT_MEMORY_DTCM].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_MEMORY_DTCM].prot_pte |= L_PTE_XN;
-+#endif
-+
-+                      mem_types[MT_MEMORY_SO].prot_sect |= PMD_SECT_XN;
-+                      mem_types[MT_MEMORY_SO].prot_pte |= L_PTE_XN;
-               }
-               if (cpu_arch >= CPU_ARCH_ARMv7 && (cr & CR_TRE)) {
-                       /*
-@@ -468,6 +536,9 @@ static void __init build_mem_type_table(void)
-                * from SVC mode and no access from userspace.
-                */
-               mem_types[MT_ROM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
-+#ifdef CONFIG_PAX_KERNEXEC
-+              mem_types[MT_MEMORY_RX].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
-+#endif
-               mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
-               mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
- #endif
-@@ -485,11 +556,17 @@ static void __init build_mem_type_table(void)
-                       mem_types[MT_DEVICE_WC].prot_pte |= L_PTE_SHARED;
-                       mem_types[MT_DEVICE_CACHED].prot_sect |= PMD_SECT_S;
-                       mem_types[MT_DEVICE_CACHED].prot_pte |= L_PTE_SHARED;
--                      mem_types[MT_MEMORY].prot_sect |= PMD_SECT_S;
--                      mem_types[MT_MEMORY].prot_pte |= L_PTE_SHARED;
-+                      mem_types[MT_MEMORY_RWX].prot_sect |= PMD_SECT_S;
-+                      mem_types[MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED;
-+                      mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_S;
-+                      mem_types[MT_MEMORY_RW].prot_pte |= L_PTE_SHARED;
-+                      mem_types[MT_MEMORY_RX].prot_sect |= PMD_SECT_S;
-+                      mem_types[MT_MEMORY_RX].prot_pte |= L_PTE_SHARED;
-                       mem_types[MT_MEMORY_DMA_READY].prot_pte |= L_PTE_SHARED;
--                      mem_types[MT_MEMORY_NONCACHED].prot_sect |= PMD_SECT_S;
--                      mem_types[MT_MEMORY_NONCACHED].prot_pte |= L_PTE_SHARED;
-+                      mem_types[MT_MEMORY_NONCACHED_RW].prot_sect |= PMD_SECT_S;
-+                      mem_types[MT_MEMORY_NONCACHED_RW].prot_pte |= L_PTE_SHARED;
-+                      mem_types[MT_MEMORY_NONCACHED_RX].prot_sect |= PMD_SECT_S;
-+                      mem_types[MT_MEMORY_NONCACHED_RX].prot_pte |= L_PTE_SHARED;
-               }
-       }
-@@ -500,15 +577,20 @@ static void __init build_mem_type_table(void)
-       if (cpu_arch >= CPU_ARCH_ARMv6) {
-               if (cpu_arch >= CPU_ARCH_ARMv7 && (cr & CR_TRE)) {
-                       /* Non-cacheable Normal is XCB = 001 */
--                      mem_types[MT_MEMORY_NONCACHED].prot_sect |=
-+                      mem_types[MT_MEMORY_NONCACHED_RW].prot_sect |=
-+                              PMD_SECT_BUFFERED;
-+                      mem_types[MT_MEMORY_NONCACHED_RX].prot_sect |=
-                               PMD_SECT_BUFFERED;
-               } else {
-                       /* For both ARMv6 and non-TEX-remapping ARMv7 */
--                      mem_types[MT_MEMORY_NONCACHED].prot_sect |=
-+                      mem_types[MT_MEMORY_NONCACHED_RW].prot_sect |=
-+                              PMD_SECT_TEX(1);
-+                      mem_types[MT_MEMORY_NONCACHED_RX].prot_sect |=
-                               PMD_SECT_TEX(1);
-               }
-       } else {
--              mem_types[MT_MEMORY_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
-+              mem_types[MT_MEMORY_NONCACHED_RW].prot_sect |= PMD_SECT_BUFFERABLE;
-+              mem_types[MT_MEMORY_NONCACHED_RX].prot_sect |= PMD_SECT_BUFFERABLE;
-       }
- #ifdef CONFIG_ARM_LPAE
-@@ -524,6 +606,8 @@ static void __init build_mem_type_table(void)
-       vecs_pgprot |= PTE_EXT_AF;
- #endif
-+      user_pgprot |= __supported_pte_mask;
-+
-       for (i = 0; i < 16; i++) {
-               pteval_t v = pgprot_val(protection_map[i]);
-               protection_map[i] = __pgprot(v | user_pgprot);
-@@ -541,10 +625,15 @@ static void __init build_mem_type_table(void)
-       mem_types[MT_LOW_VECTORS].prot_l1 |= ecc_mask;
-       mem_types[MT_HIGH_VECTORS].prot_l1 |= ecc_mask;
--      mem_types[MT_MEMORY].prot_sect |= ecc_mask | cp->pmd;
--      mem_types[MT_MEMORY].prot_pte |= kern_pgprot;
-+      mem_types[MT_MEMORY_RWX].prot_sect |= ecc_mask | cp->pmd;
-+      mem_types[MT_MEMORY_RWX].prot_pte |= kern_pgprot;
-+      mem_types[MT_MEMORY_RW].prot_sect |= ecc_mask | cp->pmd;
-+      mem_types[MT_MEMORY_RW].prot_pte |= kern_pgprot;
-+      mem_types[MT_MEMORY_RX].prot_sect |= ecc_mask | cp->pmd;
-+      mem_types[MT_MEMORY_RX].prot_pte |= kern_pgprot;
-       mem_types[MT_MEMORY_DMA_READY].prot_pte |= kern_pgprot;
--      mem_types[MT_MEMORY_NONCACHED].prot_sect |= ecc_mask;
-+      mem_types[MT_MEMORY_NONCACHED_RW].prot_sect |= ecc_mask;
-+      mem_types[MT_MEMORY_NONCACHED_RX].prot_sect |= ecc_mask;
-       mem_types[MT_ROM].prot_sect |= cp->pmd;
-       switch (cp->pmd) {
-@@ -1166,18 +1255,15 @@ void __init arm_mm_memblock_reserve(void)
-  * called function.  This means you can't use any function or debugging
-  * method which may touch any device, otherwise the kernel _will_ crash.
-  */
-+
-+static char vectors[PAGE_SIZE * 2] __read_only __aligned(PAGE_SIZE);
-+
- static void __init devicemaps_init(struct machine_desc *mdesc)
- {
-       struct map_desc map;
-       unsigned long addr;
--      void *vectors;
--      /*
--       * Allocate the vector page early.
--       */
--      vectors = early_alloc(PAGE_SIZE * 2);
--
--      early_trap_init(vectors);
-+      early_trap_init(&vectors);
-       for (addr = VMALLOC_START; addr; addr += PMD_SIZE)
-               pmd_clear(pmd_off_k(addr));
-@@ -1217,7 +1303,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
-        * location (0xffff0000).  If we aren't using high-vectors, also
-        * create a mapping at the low-vectors virtual address.
-        */
--      map.pfn = __phys_to_pfn(virt_to_phys(vectors));
-+      map.pfn = __phys_to_pfn(virt_to_phys(&vectors));
-       map.virtual = 0xffff0000;
-       map.length = PAGE_SIZE;
- #ifdef CONFIG_KUSER_HELPERS
-@@ -1287,8 +1373,39 @@ static void __init map_lowmem(void)
-               map.pfn = __phys_to_pfn(start);
-               map.virtual = __phys_to_virt(start);
-               map.length = end - start;
--              map.type = MT_MEMORY;
-+#ifdef CONFIG_PAX_KERNEXEC
-+              if (map.virtual <= (unsigned long)_stext && ((unsigned long)_end < (map.virtual + map.length))) {
-+                      struct map_desc kernel;
-+                      struct map_desc initmap;
-+
-+                      /* when freeing initmem we will make this RW */
-+                      initmap.pfn = __phys_to_pfn(__pa(__init_begin));
-+                      initmap.virtual = (unsigned long)__init_begin;
-+                      initmap.length = _sdata - __init_begin;
-+                      initmap.type = MT_MEMORY_RWX;
-+                      create_mapping(&initmap);
-+
-+                      /* when freeing initmem we will make this RX */
-+                      kernel.pfn = __phys_to_pfn(__pa(_stext));
-+                      kernel.virtual = (unsigned long)_stext;
-+                      kernel.length = __init_begin - _stext;
-+                      kernel.type = MT_MEMORY_RWX;
-+                      create_mapping(&kernel);
-+
-+                      if (map.virtual < (unsigned long)_stext) {
-+                              map.length = (unsigned long)_stext - map.virtual;
-+                              map.type = MT_MEMORY_RWX;
-+                              create_mapping(&map);
-+                      }
-+
-+                      map.pfn = __phys_to_pfn(__pa(_sdata));
-+                      map.virtual = (unsigned long)_sdata;
-+                      map.length = end - __pa(_sdata);
-+              }
-+#endif
-+
-+              map.type = MT_MEMORY_RW;
-               create_mapping(&map);
-       }
- }
-diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
-index a5bc92d..0bb4730 100644
---- a/arch/arm/plat-omap/sram.c
-+++ b/arch/arm/plat-omap/sram.c
-@@ -93,6 +93,8 @@ void __init omap_map_sram(unsigned long start, unsigned long size,
-        * Looks like we need to preserve some bootloader code at the
-        * beginning of SRAM for jumping to flash for reboot to work...
-        */
-+      pax_open_kernel();
-       memset_io(omap_sram_base + omap_sram_skip, 0,
-                 omap_sram_size - omap_sram_skip);
-+      pax_close_kernel();
- }
-diff --git a/arch/arm/plat-samsung/include/plat/dma-ops.h b/arch/arm/plat-samsung/include/plat/dma-ops.h
-index ce6d763..cfea917 100644
---- a/arch/arm/plat-samsung/include/plat/dma-ops.h
-+++ b/arch/arm/plat-samsung/include/plat/dma-ops.h
-@@ -47,7 +47,7 @@ struct samsung_dma_ops {
-       int (*started)(unsigned ch);
-       int (*flush)(unsigned ch);
-       int (*stop)(unsigned ch);
--};
-+} __no_const;
- extern void *samsung_dmadev_get_ops(void);
- extern void *s3c_dma_get_ops(void);
-diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
-index f4726dc..39ed646 100644
---- a/arch/arm64/kernel/debug-monitors.c
-+++ b/arch/arm64/kernel/debug-monitors.c
-@@ -149,7 +149,7 @@ static int __cpuinit os_lock_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata os_lock_nb = {
-+static struct notifier_block os_lock_nb = {
-       .notifier_call = os_lock_notify,
- };
-diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
-index 5ab825c..96aaec8 100644
---- a/arch/arm64/kernel/hw_breakpoint.c
-+++ b/arch/arm64/kernel/hw_breakpoint.c
-@@ -831,7 +831,7 @@ static int __cpuinit hw_breakpoint_reset_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata hw_breakpoint_reset_nb = {
-+static struct notifier_block hw_breakpoint_reset_nb = {
-       .notifier_call = hw_breakpoint_reset_notify,
- };
-diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
-index c3a58a1..78fbf54 100644
---- a/arch/avr32/include/asm/cache.h
-+++ b/arch/avr32/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef __ASM_AVR32_CACHE_H
- #define __ASM_AVR32_CACHE_H
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- /*
-  * Memory returned by kmalloc() may be used for DMA, so we must make
-diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
-index d232888..87c8df1 100644
---- a/arch/avr32/include/asm/elf.h
-+++ b/arch/avr32/include/asm/elf.h
-@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
--#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE               (TASK_SIZE / 3 * 2)
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN    15
-+#define PAX_DELTA_STACK_LEN   15
-+#endif
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
-index 479330b..53717a8 100644
---- a/arch/avr32/include/asm/kmap_types.h
-+++ b/arch/avr32/include/asm/kmap_types.h
-@@ -2,9 +2,9 @@
- #define __ASM_AVR32_KMAP_TYPES_H
- #ifdef CONFIG_DEBUG_HIGHMEM
--# define KM_TYPE_NR 29
-+# define KM_TYPE_NR 30
- #else
--# define KM_TYPE_NR 14
-+# define KM_TYPE_NR 15
- #endif
- #endif /* __ASM_AVR32_KMAP_TYPES_H */
-diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
-index b2f2d2d..d1c85cb 100644
---- a/arch/avr32/mm/fault.c
-+++ b/arch/avr32/mm/fault.c
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
- int exception_trace = 1;
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      unsigned long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 20; i++) {
-+              unsigned char c;
-+              if (get_user(c, (unsigned char *)pc+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%02x ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults. It determines the address and the
-  * problem, and then passes it off to one of the appropriate routines.
-@@ -174,6 +191,16 @@ bad_area:
-       up_read(&mm->mmap_sem);
-       if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+              if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+                      if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+                              pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+                              do_group_exit(SIGKILL);
-+                      }
-+              }
-+#endif
-+
-               if (exception_trace && printk_ratelimit())
-                       printk("%s%s[%d]: segfault at %08lx pc %08lx "
-                              "sp %08lx ecr %lu\n",
-diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
-index 568885a..f8008df 100644
---- a/arch/blackfin/include/asm/cache.h
-+++ b/arch/blackfin/include/asm/cache.h
-@@ -7,6 +7,7 @@
- #ifndef __ARCH_BLACKFIN_CACHE_H
- #define __ARCH_BLACKFIN_CACHE_H
-+#include <linux/const.h>
- #include <linux/linkage.h>    /* for asmlinkage */
- /*
-@@ -14,7 +15,7 @@
-  * Blackfin loads 32 bytes for cache
-  */
- #define L1_CACHE_SHIFT        5
--#define L1_CACHE_BYTES        (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES        (_AC(1,UL) << L1_CACHE_SHIFT)
- #define SMP_CACHE_BYTES       L1_CACHE_BYTES
- #define ARCH_DMA_MINALIGN     L1_CACHE_BYTES
-diff --git a/arch/cris/include/arch-v10/arch/cache.h b/arch/cris/include/arch-v10/arch/cache.h
-index aea2718..3639a60 100644
---- a/arch/cris/include/arch-v10/arch/cache.h
-+++ b/arch/cris/include/arch-v10/arch/cache.h
-@@ -1,8 +1,9 @@
- #ifndef _ASM_ARCH_CACHE_H
- #define _ASM_ARCH_CACHE_H
-+#include <linux/const.h>
- /* Etrax 100LX have 32-byte cache-lines. */
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #endif /* _ASM_ARCH_CACHE_H */
-diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h
-index 7caf25d..ee65ac5 100644
---- a/arch/cris/include/arch-v32/arch/cache.h
-+++ b/arch/cris/include/arch-v32/arch/cache.h
-@@ -1,11 +1,12 @@
- #ifndef _ASM_CRIS_ARCH_CACHE_H
- #define _ASM_CRIS_ARCH_CACHE_H
-+#include <linux/const.h>
- #include <arch/hwregs/dma.h>
- /* A cache-line is 32 bytes. */
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #define __read_mostly __attribute__((__section__(".data..read_mostly")))
-diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
-index b86329d..6709906 100644
---- a/arch/frv/include/asm/atomic.h
-+++ b/arch/frv/include/asm/atomic.h
-@@ -186,6 +186,16 @@ static inline void atomic64_dec(atomic64_t *v)
- #define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
- #define atomic64_xchg(v, new)         (__xchg_64(new, &(v)->counter))
-+#define atomic64_read_unchecked(v)            atomic64_read(v)
-+#define atomic64_set_unchecked(v, i)          atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v)          atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v)   atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v)          atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v)             atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v)      atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v)             atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n)   atomic64_cmpxchg((v), (o), (n))
-+
- static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
- {
-       int c, old;
-diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
-index 2797163..c2a401d 100644
---- a/arch/frv/include/asm/cache.h
-+++ b/arch/frv/include/asm/cache.h
-@@ -12,10 +12,11 @@
- #ifndef __ASM_CACHE_H
- #define __ASM_CACHE_H
-+#include <linux/const.h>
- /* bytes per L1 cache line */
- #define L1_CACHE_SHIFT                (CONFIG_FRV_L1_CACHE_SHIFT)
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #define __cacheline_aligned   __attribute__((aligned(L1_CACHE_BYTES)))
- #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
-diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
-index 43901f2..0d8b865 100644
---- a/arch/frv/include/asm/kmap_types.h
-+++ b/arch/frv/include/asm/kmap_types.h
-@@ -2,6 +2,6 @@
- #ifndef _ASM_KMAP_TYPES_H
- #define _ASM_KMAP_TYPES_H
--#define KM_TYPE_NR 17
-+#define KM_TYPE_NR 18
- #endif
-diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
-index 836f147..4cf23f5 100644
---- a/arch/frv/mm/elf-fdpic.c
-+++ b/arch/frv/mm/elf-fdpic.c
-@@ -61,6 +61,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- {
-       struct vm_area_struct *vma;
-       struct vm_unmapped_area_info info;
-+      unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-       if (len > TASK_SIZE)
-               return -ENOMEM;
-@@ -73,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
-       if (addr) {
-               addr = PAGE_ALIGN(addr);
-               vma = find_vma(current->mm, addr);
--              if (TASK_SIZE - len >= addr &&
--                  (!vma || addr + len <= vma->vm_start))
-+              if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
-                       goto success;
-       }
-@@ -85,6 +85,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
-       info.high_limit = (current->mm->start_stack - 0x00200000);
-       info.align_mask = 0;
-       info.align_offset = 0;
-+      info.threadstack_offset = offset;
-       addr = vm_unmapped_area(&info);
-       if (!(addr & ~PAGE_MASK))
-               goto success;
-diff --git a/arch/hexagon/include/asm/cache.h b/arch/hexagon/include/asm/cache.h
-index f4ca594..adc72fd6 100644
---- a/arch/hexagon/include/asm/cache.h
-+++ b/arch/hexagon/include/asm/cache.h
-@@ -21,9 +21,11 @@
- #ifndef __ASM_CACHE_H
- #define __ASM_CACHE_H
-+#include <linux/const.h>
-+
- /* Bytes per L1 cache line */
--#define L1_CACHE_SHIFT                (5)
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_SHIFT                5
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #define __cacheline_aligned   __aligned(L1_CACHE_BYTES)
- #define ____cacheline_aligned __aligned(L1_CACHE_BYTES)
-diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
-index 6e6fe18..a6ae668 100644
---- a/arch/ia64/include/asm/atomic.h
-+++ b/arch/ia64/include/asm/atomic.h
-@@ -208,6 +208,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
- #define atomic64_inc(v)                       atomic64_add(1, (v))
- #define atomic64_dec(v)                       atomic64_sub(1, (v))
-+#define atomic64_read_unchecked(v)            atomic64_read(v)
-+#define atomic64_set_unchecked(v, i)          atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v)          atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v)   atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v)          atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v)             atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v)      atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v)             atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n)   atomic64_cmpxchg((v), (o), (n))
-+
- /* Atomic operations are already serializing */
- #define smp_mb__before_atomic_dec()   barrier()
- #define smp_mb__after_atomic_dec()    barrier()
-diff --git a/arch/ia64/include/asm/cache.h b/arch/ia64/include/asm/cache.h
-index 988254a..e1ee885 100644
---- a/arch/ia64/include/asm/cache.h
-+++ b/arch/ia64/include/asm/cache.h
-@@ -1,6 +1,7 @@
- #ifndef _ASM_IA64_CACHE_H
- #define _ASM_IA64_CACHE_H
-+#include <linux/const.h>
- /*
-  * Copyright (C) 1998-2000 Hewlett-Packard Co
-@@ -9,7 +10,7 @@
- /* Bytes per L1 (data) cache line.  */
- #define L1_CACHE_SHIFT                CONFIG_IA64_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #ifdef CONFIG_SMP
- # define SMP_CACHE_SHIFT      L1_CACHE_SHIFT
-diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
-index 5a83c5c..4d7f553 100644
---- a/arch/ia64/include/asm/elf.h
-+++ b/arch/ia64/include/asm/elf.h
-@@ -42,6 +42,13 @@
-  */
- #define ELF_ET_DYN_BASE               (TASK_UNMAPPED_BASE + 0x800000000UL)
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN    (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN   (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND               0x70000001
- /* IA-64 relocations: */
-diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
-index 96a8d92..617a1cf 100644
---- a/arch/ia64/include/asm/pgalloc.h
-+++ b/arch/ia64/include/asm/pgalloc.h
-@@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
-       pgd_val(*pgd_entry) = __pa(pud);
- }
-+static inline void
-+pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
-+{
-+      pgd_populate(mm, pgd_entry, pud);
-+}
-+
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-       return quicklist_alloc(0, GFP_KERNEL, NULL);
-@@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
-       pud_val(*pud_entry) = __pa(pmd);
- }
-+static inline void
-+pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
-+{
-+      pud_populate(mm, pud_entry, pmd);
-+}
-+
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-       return quicklist_alloc(0, GFP_KERNEL, NULL);
-diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
-index 815810c..d60bd4c 100644
---- a/arch/ia64/include/asm/pgtable.h
-+++ b/arch/ia64/include/asm/pgtable.h
-@@ -12,7 +12,7 @@
-  *    David Mosberger-Tang <davidm@hpl.hp.com>
-  */
--
-+#include <linux/const.h>
- #include <asm/mman.h>
- #include <asm/page.h>
- #include <asm/processor.h>
-@@ -142,6 +142,17 @@
- #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY     __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC        __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC   __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC     __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC   PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+# define PAGE_COPY_NOEXEC     PAGE_COPY
-+#endif
-+
- #define PAGE_GATE     __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL   __pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
-index 54ff557..70c88b7 100644
---- a/arch/ia64/include/asm/spinlock.h
-+++ b/arch/ia64/include/asm/spinlock.h
-@@ -71,7 +71,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
-       unsigned short  *p = (unsigned short *)&lock->lock + 1, tmp;
-       asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
--      ACCESS_ONCE(*p) = (tmp + 2) & ~1;
-+      ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
- }
- static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
-diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..18965fb 100644
---- a/arch/ia64/include/asm/uaccess.h
-+++ b/arch/ia64/include/asm/uaccess.h
-@@ -240,12 +240,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
- static inline unsigned long
- __copy_to_user (void __user *to, const void *from, unsigned long count)
- {
-+      if (count > INT_MAX)
-+              return count;
-+
-+      if (!__builtin_constant_p(count))
-+              check_object_size(from, count, true);
-+
-       return __copy_user(to, (__force void __user *) from, count);
- }
- static inline unsigned long
- __copy_from_user (void *to, const void __user *from, unsigned long count)
- {
-+      if (count > INT_MAX)
-+              return count;
-+
-+      if (!__builtin_constant_p(count))
-+              check_object_size(to, count, false);
-+
-       return __copy_user((__force void __user *) to, from, count);
- }
-@@ -255,10 +267,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({                                                                                    \
-       void __user *__cu_to = (to);                                                    \
-       const void *__cu_from = (from);                                                 \
--      long __cu_len = (n);                                                            \
-+      unsigned long __cu_len = (n);                                                   \
-                                                                                       \
--      if (__access_ok(__cu_to, __cu_len, get_fs()))                                   \
-+      if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) {          \
-+              if (!__builtin_constant_p(n))                                           \
-+                      check_object_size(__cu_from, __cu_len, true);                   \
-               __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);   \
-+      }                                                                               \
-       __cu_len;                                                                       \
- })
-@@ -266,11 +281,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({                                                                                    \
-       void *__cu_to = (to);                                                           \
-       const void __user *__cu_from = (from);                                          \
--      long __cu_len = (n);                                                            \
-+      unsigned long __cu_len = (n);                                                   \
-                                                                                       \
-       __chk_user_ptr(__cu_from);                                                      \
--      if (__access_ok(__cu_from, __cu_len, get_fs()))                                 \
-+      if (__cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs())) {       \
-+              if (!__builtin_constant_p(n))                                           \
-+                      check_object_size(__cu_to, __cu_len, false);                    \
-               __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
-+      }                                                                               \
-       __cu_len;                                                                       \
- })
-diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c
-index 2d67317..07d8bfa 100644
---- a/arch/ia64/kernel/err_inject.c
-+++ b/arch/ia64/kernel/err_inject.c
-@@ -256,7 +256,7 @@ static int __cpuinit err_inject_cpu_callback(struct notifier_block *nfb,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata err_inject_cpu_notifier =
-+static struct notifier_block err_inject_cpu_notifier =
- {
-       .notifier_call = err_inject_cpu_callback,
- };
-diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
-index d7396db..b33e873 100644
---- a/arch/ia64/kernel/mca.c
-+++ b/arch/ia64/kernel/mca.c
-@@ -1922,7 +1922,7 @@ static int __cpuinit mca_cpu_callback(struct notifier_block *nfb,
-       return NOTIFY_OK;
- }
--static struct notifier_block mca_cpu_notifier __cpuinitdata = {
-+static struct notifier_block mca_cpu_notifier = {
-       .notifier_call = mca_cpu_callback
- };
-diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
-index 24603be..948052d 100644
---- a/arch/ia64/kernel/module.c
-+++ b/arch/ia64/kernel/module.c
-@@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
- void
- module_free (struct module *mod, void *module_region)
- {
--      if (mod && mod->arch.init_unw_table &&
--          module_region == mod->module_init) {
-+      if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
-               unw_remove_unwind_table(mod->arch.init_unw_table);
-               mod->arch.init_unw_table = NULL;
-       }
-@@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
- }
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+      return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+      return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
--      return addr - (uint64_t) mod->module_init < mod->init_size;
-+      return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+      return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+      return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
--      return addr - (uint64_t) mod->module_core < mod->core_size;
-+      return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
- static inline int
-@@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
-               break;
-             case RV_BDREL:
--              val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+              if (in_init_rx(mod, val))
-+                      val -= (uint64_t) mod->module_init_rx;
-+              else if (in_init_rw(mod, val))
-+                      val -= (uint64_t) mod->module_init_rw;
-+              else if (in_core_rx(mod, val))
-+                      val -= (uint64_t) mod->module_core_rx;
-+              else if (in_core_rw(mod, val))
-+                      val -= (uint64_t) mod->module_core_rw;
-               break;
-             case RV_LTV:
-@@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
-                *     addresses have been selected...
-                */
-               uint64_t gp;
--              if (mod->core_size > MAX_LTOFF)
-+              if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
-                       /*
-                        * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
-                        * at the end of the module.
-                        */
--                      gp = mod->core_size - MAX_LTOFF / 2;
-+                      gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
-               else
--                      gp = mod->core_size / 2;
--              gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+                      gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+              gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
-               mod->arch.gp = gp;
-               DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
-       }
-diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
-index 2b3c2d7..a318d84 100644
---- a/arch/ia64/kernel/palinfo.c
-+++ b/arch/ia64/kernel/palinfo.c
-@@ -980,7 +980,7 @@ static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
-       return NOTIFY_OK;
- }
--static struct notifier_block __refdata palinfo_cpu_notifier =
-+static struct notifier_block palinfo_cpu_notifier =
- {
-       .notifier_call = palinfo_cpu_callback,
-       .priority = 0,
-diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
-index 4bc580a..7767f24 100644
---- a/arch/ia64/kernel/salinfo.c
-+++ b/arch/ia64/kernel/salinfo.c
-@@ -609,7 +609,7 @@ salinfo_cpu_callback(struct notifier_block *nb, unsigned long action, void *hcpu
-       return NOTIFY_OK;
- }
--static struct notifier_block salinfo_cpu_notifier __cpuinitdata =
-+static struct notifier_block salinfo_cpu_notifier =
- {
-       .notifier_call = salinfo_cpu_callback,
-       .priority = 0,
-diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
-index 41e33f8..65180b2 100644
---- a/arch/ia64/kernel/sys_ia64.c
-+++ b/arch/ia64/kernel/sys_ia64.c
-@@ -28,6 +28,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
-       unsigned long align_mask = 0;
-       struct mm_struct *mm = current->mm;
-       struct vm_unmapped_area_info info;
-+      unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-       if (len > RGN_MAP_LIMIT)
-               return -ENOMEM;
-@@ -43,6 +44,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
-       if (REGION_NUMBER(addr) == RGN_HPAGE)
-               addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (mm->pax_flags & MF_PAX_RANDMMAP)
-+              addr = mm->free_area_cache;
-+      else
-+#endif
-+
-       if (!addr)
-               addr = TASK_UNMAPPED_BASE;
-@@ -61,6 +69,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
-       info.high_limit = TASK_SIZE;
-       info.align_mask = align_mask;
-       info.align_offset = 0;
-+      info.threadstack_offset = offset;
-       return vm_unmapped_area(&info);
- }
-diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
-index dc00b2c..cce53c2 100644
---- a/arch/ia64/kernel/topology.c
-+++ b/arch/ia64/kernel/topology.c
-@@ -445,7 +445,7 @@ static int __cpuinit cache_cpu_callback(struct notifier_block *nfb,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata cache_cpu_notifier =
-+static struct notifier_block cache_cpu_notifier =
- {
-       .notifier_call = cache_cpu_callback
- };
-diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
-index 0ccb28f..8992469 100644
---- a/arch/ia64/kernel/vmlinux.lds.S
-+++ b/arch/ia64/kernel/vmlinux.lds.S
-@@ -198,7 +198,7 @@ SECTIONS {
-       /* Per-cpu data: */
-       . = ALIGN(PERCPU_PAGE_SIZE);
-       PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
--      __phys_per_cpu_start = __per_cpu_load;
-+      __phys_per_cpu_start = per_cpu_load;
-       /*
-        * ensure percpu data fits
-        * into percpu page size
-diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
-index 6cf0341..d352594 100644
---- a/arch/ia64/mm/fault.c
-+++ b/arch/ia64/mm/fault.c
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
-       return pte_present(pte);
- }
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      unsigned long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 8; i++) {
-+              unsigned int c;
-+              if (get_user(c, (unsigned int *)pc+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%08x ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
-+
- #     define VM_READ_BIT      0
- #     define VM_WRITE_BIT     1
- #     define VM_EXEC_BIT      2
-@@ -149,8 +166,21 @@ retry:
-       if (((isr >> IA64_ISR_R_BIT) & 1UL) && (!(vma->vm_flags & (VM_READ | VM_WRITE))))
-               goto bad_area;
--      if ((vma->vm_flags & mask) != mask)
-+      if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+              if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+                      if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+                              goto bad_area;
-+
-+                      up_read(&mm->mmap_sem);
-+                      pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+                      do_group_exit(SIGKILL);
-+              }
-+#endif
-+
-               goto bad_area;
-+      }
-       /*
-        * If for any reason at all we couldn't handle the fault, make
-diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
-index 76069c1..c2aa816 100644
---- a/arch/ia64/mm/hugetlbpage.c
-+++ b/arch/ia64/mm/hugetlbpage.c
-@@ -149,6 +149,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
-               unsigned long pgoff, unsigned long flags)
- {
-       struct vm_unmapped_area_info info;
-+      unsigned long offset = gr_rand_threadstack_offset(current->mm, file, flags);
-       if (len > RGN_MAP_LIMIT)
-               return -ENOMEM;
-@@ -172,6 +173,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
-       info.high_limit = HPAGE_REGION_BASE + RGN_MAP_LIMIT;
-       info.align_mask = PAGE_MASK & (HPAGE_SIZE - 1);
-       info.align_offset = 0;
-+      info.threadstack_offset = offset;
-       return vm_unmapped_area(&info);
- }
-diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
-index d1fe4b4..2628f37 100644
---- a/arch/ia64/mm/init.c
-+++ b/arch/ia64/mm/init.c
-@@ -120,6 +120,19 @@ ia64_init_addr_space (void)
-               vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
-               vma->vm_end = vma->vm_start + PAGE_SIZE;
-               vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+              if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+                      vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+                      if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+                              vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+              }
-+#endif
-+
-               vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-               down_write(&current->mm->mmap_sem);
-               if (insert_vm_struct(current->mm, vma)) {
-diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
-index 40b3ee9..8c2c112 100644
---- a/arch/m32r/include/asm/cache.h
-+++ b/arch/m32r/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef _ASM_M32R_CACHE_H
- #define _ASM_M32R_CACHE_H
-+#include <linux/const.h>
-+
- /* L1 cache line size */
- #define L1_CACHE_SHIFT                4
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #endif  /* _ASM_M32R_CACHE_H */
-diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
-index 82abd15..d95ae5d 100644
---- a/arch/m32r/lib/usercopy.c
-+++ b/arch/m32r/lib/usercopy.c
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+      if ((long)n < 0)
-+              return n;
-+
-       prefetch(from);
-       if (access_ok(VERIFY_WRITE, to, n))
-               __copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+      if ((long)n < 0)
-+              return n;
-+
-       prefetchw(to);
-       if (access_ok(VERIFY_READ, from, n))
-               __copy_user_zeroing(to,from,n);
-diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
-index 0395c51..5f26031 100644
---- a/arch/m68k/include/asm/cache.h
-+++ b/arch/m68k/include/asm/cache.h
-@@ -4,9 +4,11 @@
- #ifndef __ARCH_M68K_CACHE_H
- #define __ARCH_M68K_CACHE_H
-+#include <linux/const.h>
-+
- /* bytes per L1 cache line */
- #define        L1_CACHE_SHIFT  4
--#define        L1_CACHE_BYTES  (1<< L1_CACHE_SHIFT)
-+#define        L1_CACHE_BYTES  (_AC(1,UL) << L1_CACHE_SHIFT)
- #define ARCH_DMA_MINALIGN     L1_CACHE_BYTES
-diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
-index 3c52fa6..11b2ad8 100644
---- a/arch/metag/mm/hugetlbpage.c
-+++ b/arch/metag/mm/hugetlbpage.c
-@@ -200,6 +200,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len)
-       info.high_limit = TASK_SIZE;
-       info.align_mask = PAGE_MASK & HUGEPT_MASK;
-       info.align_offset = 0;
-+      info.threadstack_offset = 0;
-       return vm_unmapped_area(&info);
- }
-diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
-index 4efe96a..60e8699 100644
---- a/arch/microblaze/include/asm/cache.h
-+++ b/arch/microblaze/include/asm/cache.h
-@@ -13,11 +13,12 @@
- #ifndef _ASM_MICROBLAZE_CACHE_H
- #define _ASM_MICROBLAZE_CACHE_H
-+#include <linux/const.h>
- #include <asm/registers.h>
- #define L1_CACHE_SHIFT 5
- /* word-granular cache in microblaze */
--#define L1_CACHE_BYTES        (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES        (_AC(1,UL) << L1_CACHE_SHIFT)
- #define SMP_CACHE_BYTES       L1_CACHE_BYTES
-diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
-index 08b6079..e94e6da 100644
---- a/arch/mips/include/asm/atomic.h
-+++ b/arch/mips/include/asm/atomic.h
-@@ -21,15 +21,39 @@
- #include <asm/cmpxchg.h>
- #include <asm/war.h>
-+#ifdef CONFIG_GENERIC_ATOMIC64
-+#include <asm-generic/atomic64.h>
-+#endif
-+
- #define ATOMIC_INIT(i)          { (i) }
-+#ifdef CONFIG_64BIT
-+#define _ASM_EXTABLE(from, to)                \
-+"     .section __ex_table,\"a\"\n"    \
-+"     .dword  " #from ", " #to"\n"    \
-+"     .previous\n"
-+#else
-+#define _ASM_EXTABLE(from, to)                \
-+"     .section __ex_table,\"a\"\n"    \
-+"     .word   " #from ", " #to"\n"    \
-+"     .previous\n"
-+#endif
-+
- /*
-  * atomic_read - read atomic variable
-  * @v: pointer of type atomic_t
-  *
-  * Atomically reads the value of @v.
-  */
--#define atomic_read(v)                (*(volatile int *)&(v)->counter)
-+static inline int atomic_read(const atomic_t *v)
-+{
-+      return (*(volatile const int *) &v->counter);
-+}
-+
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+      return (*(volatile const int *) &v->counter);
-+}
- /*
-  * atomic_set - set atomic variable
-@@ -38,7 +62,15 @@
-  *
-  * Atomically sets the value of @v to @i.
-  */
--#define atomic_set(v, i)              ((v)->counter = (i))
-+static inline void atomic_set(atomic_t *v, int i)
-+{
-+      v->counter = i;
-+}
-+
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+      v->counter = i;
-+}
- /*
-  * atomic_add - add integer to atomic variable
-@@ -47,7 +79,67 @@
-  *
-  * Atomically adds @i to @v.
-  */
--static __inline__ void atomic_add(int i, atomic_t * v)
-+static __inline__ void atomic_add(int i, atomic_t *v)
-+{
-+      int temp;
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %0, %1          # atomic_add            \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "2:     add     %0, %2                                  \n"
-+#else
-+              "       addu    %0, %2                                  \n"
-+#endif
-+              "       sc      %0, %1                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %0, %1          # atomic_add            \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Exception on overflow. */
-+              "2:     add     %0, %2                                  \n"
-+#else
-+              "       addu    %0, %2                                  \n"
-+#endif
-+              "       sc      %0, %1                                  \n"
-+              "       beqz    %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     add     %0, %1                                  \n"
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#else
-+              "       addu    %0, %1                                  \n"
-+#endif
-+              : "+r" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+}
-+
-+static __inline__ void atomic_add_unchecked(int i, atomic_unchecked_t *v)
- {
-       if (kernel_uses_llsc && R10000_LLSC_WAR) {
-               int temp;
-@@ -90,7 +182,67 @@ static __inline__ void atomic_add(int i, atomic_t * v)
-  *
-  * Atomically subtracts @i from @v.
-  */
--static __inline__ void atomic_sub(int i, atomic_t * v)
-+static __inline__ void atomic_sub(int i, atomic_t *v)
-+{
-+      int temp;
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %0, %1          # atomic64_sub          \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Exception on overflow. */
-+              "2:     sub     %0, %2                                  \n"
-+#else
-+              "       subu    %0, %2                                  \n"
-+#endif
-+              "       sc      %0, %1                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %0, %1          # atomic64_sub          \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Exception on overflow. */
-+              "2:     sub     %0, %2                                  \n"
-+#else
-+              "       subu    %0, %2                                  \n"
-+#endif
-+              "       sc      %0, %1                                  \n"
-+              "       beqz    %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     sub     %0, %1                                  \n"
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#else
-+              "       subu    %0, %1                                  \n"
-+#endif
-+              : "+r" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+}
-+
-+static __inline__ void atomic_sub_unchecked(long i, atomic_unchecked_t *v)
- {
-       if (kernel_uses_llsc && R10000_LLSC_WAR) {
-               int temp;
-@@ -129,7 +281,93 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
- /*
-  * Same as above, but return the result value
-  */
--static __inline__ int atomic_add_return(int i, atomic_t * v)
-+static __inline__ int atomic_add_return(int i, atomic_t *v)
-+{
-+      int result;
-+      int temp;
-+
-+      smp_mb__before_llsc();
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %1, %2          # atomic_add_return     \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     add     %0, %1, %3                              \n"
-+#else
-+              "       addu    %0, %1, %3                              \n"
-+#endif
-+              "       sc      %0, %2                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       b       4f                                      \n"
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     addu    %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %1, %2  # atomic_add_return             \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     add     %0, %1, %3                              \n"
-+#else
-+              "       addu    %0, %1, %3                              \n"
-+#endif
-+              "       sc      %0, %2                                  \n"
-+              "       bnez    %0, 4f                                  \n"
-+              "       b       1b                                      \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     addu    %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+              "       lw      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     add     %0, %2                                  \n"
-+#else
-+              "       addu    %0, %2                                  \n"
-+#endif
-+              "       sw      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Note: Dest reg is not modified on overflow */
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#endif
-+              : "=&r" (result), "+m" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+
-+      smp_llsc_mb();
-+
-+      return result;
-+}
-+
-+static __inline__ int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
- {
-       int result;
-@@ -178,7 +416,93 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
-       return result;
- }
--static __inline__ int atomic_sub_return(int i, atomic_t * v)
-+static __inline__ int atomic_sub_return(int i, atomic_t *v)
-+{
-+      int result;
-+      int temp;
-+
-+      smp_mb__before_llsc();
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %1, %2          # atomic_sub_return     \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     sub     %0, %1, %3                              \n"
-+#else
-+              "       subu    %0, %1, %3                              \n"
-+#endif
-+              "       sc      %0, %2                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       b       4f                                      \n"
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     subu    %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "=m" (v->counter)
-+              : "Ir" (i), "m" (v->counter)
-+              : "memory");
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     ll      %1, %2  # atomic_sub_return             \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     sub     %0, %1, %3                              \n"
-+#else
-+              "       subu    %0, %1, %3                              \n"
-+#endif
-+              "       sc      %0, %2                                  \n"
-+              "       bnez    %0, 4f                                  \n"
-+              "       b       1b                                      \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     subu    %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+              "       lw      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     sub     %0, %2                                  \n"
-+#else
-+              "       subu    %0, %2                                  \n"
-+#endif
-+              "       sw      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Note: Dest reg is not modified on overflow */
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#endif
-+              : "=&r" (result), "+m" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+
-+      smp_llsc_mb();
-+
-+      return result;
-+}
-+static __inline__ int atomic_sub_return_unchecked(int i, atomic_unchecked_t *v)
- {
-       int result;
-@@ -238,7 +562,7 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
-  * Atomically test @v and subtract @i if @v is greater or equal than @i.
-  * The function returns the old value of @v minus @i.
-  */
--static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
-+static __inline__ int atomic_sub_if_positive(int i, atomic_t *v)
- {
-       int result;
-@@ -295,8 +619,26 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
-       return result;
- }
--#define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
--#define atomic_xchg(v, new) (xchg(&((v)->counter), (new)))
-+static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
-+{
-+      return cmpxchg(&v->counter, old, new);
-+}
-+
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old,
-+                                         int new)
-+{
-+      return cmpxchg(&(v->counter), old, new);
-+}
-+
-+static inline int atomic_xchg(atomic_t *v, int new)
-+{
-+      return xchg(&v->counter, new);
-+}
-+
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+      return xchg(&(v->counter), new);
-+}
- /**
-  * __atomic_add_unless - add unless the number is a given value
-@@ -324,6 +666,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
- #define atomic_dec_return(v) atomic_sub_return(1, (v))
- #define atomic_inc_return(v) atomic_add_return(1, (v))
-+#define atomic_inc_return_unchecked(v) atomic_add_return_unchecked(1, (v))
- /*
-  * atomic_sub_and_test - subtract value from variable and test result
-@@ -345,6 +688,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-  * other cases.
-  */
- #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-+#define atomic_inc_and_test_unchecked(v) (atomic_add_return_unchecked(1, (v)) == 0)
- /*
-  * atomic_dec_and_test - decrement by 1 and test
-@@ -369,6 +713,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-  * Atomically increments @v by 1.
-  */
- #define atomic_inc(v) atomic_add(1, (v))
-+#define atomic_inc_unchecked(v) atomic_add_unchecked(1, (v))
- /*
-  * atomic_dec - decrement and test
-@@ -377,6 +722,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-  * Atomically decrements @v by 1.
-  */
- #define atomic_dec(v) atomic_sub(1, (v))
-+#define atomic_dec_unchecked(v) atomic_sub_return_unchecked(1, (v))
- /*
-  * atomic_add_negative - add and test if negative
-@@ -398,14 +744,30 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-  * @v: pointer of type atomic64_t
-  *
-  */
--#define atomic64_read(v)      (*(volatile long *)&(v)->counter)
-+static inline long atomic64_read(const atomic64_t *v)
-+{
-+      return (*(volatile const long *) &v->counter);
-+}
-+
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+      return (*(volatile const long *) &v->counter);
-+}
- /*
-  * atomic64_set - set atomic variable
-  * @v: pointer of type atomic64_t
-  * @i: required value
-  */
--#define atomic64_set(v, i)    ((v)->counter = (i))
-+static inline void atomic64_set(atomic64_t *v, long i)
-+{
-+      v->counter = i;
-+}
-+
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+      v->counter = i;
-+}
- /*
-  * atomic64_add - add integer to atomic variable
-@@ -414,7 +776,66 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-  *
-  * Atomically adds @i to @v.
-  */
--static __inline__ void atomic64_add(long i, atomic64_t * v)
-+static __inline__ void atomic64_add(long i, atomic64_t *v)
-+{
-+      long temp;
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %0, %1          # atomic64_add          \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "2:     dadd    %0, %2                                  \n"
-+#else
-+              "       daddu   %0, %2                                  \n"
-+#endif
-+              "       scd     %0, %1                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %0, %1          # atomic64_add          \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "2:     dadd    %0, %2                                  \n"
-+#else
-+              "       daddu   %0, %2                                  \n"
-+#endif
-+              "       scd     %0, %1                                  \n"
-+              "       beqz    %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     dadd    %0, %1                                  \n"
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#else
-+              "       daddu   %0, %1                                  \n"
-+#endif
-+              : "+r" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+}
-+static __inline__ void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
- {
-       if (kernel_uses_llsc && R10000_LLSC_WAR) {
-               long temp;
-@@ -457,7 +878,67 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
-  *
-  * Atomically subtracts @i from @v.
-  */
--static __inline__ void atomic64_sub(long i, atomic64_t * v)
-+static __inline__ void atomic64_sub(long i, atomic64_t *v)
-+{
-+      long temp;
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %0, %1          # atomic64_sub          \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Exception on overflow. */
-+              "2:     dsub    %0, %2                                  \n"
-+#else
-+              "       dsubu   %0, %2                                  \n"
-+#endif
-+              "       scd     %0, %1                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %0, %1          # atomic64_sub          \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Exception on overflow. */
-+              "2:     dsub    %0, %2                                  \n"
-+#else
-+              "       dsubu   %0, %2                                  \n"
-+#endif
-+              "       scd     %0, %1                                  \n"
-+              "       beqz    %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "3:                                                     \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     dsub    %0, %1                                  \n"
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#else
-+              "       dsubu   %0, %1                                  \n"
-+#endif
-+              : "+r" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+}
-+
-+static __inline__ void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
- {
-       if (kernel_uses_llsc && R10000_LLSC_WAR) {
-               long temp;
-@@ -496,7 +977,93 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
- /*
-  * Same as above, but return the result value
-  */
--static __inline__ long atomic64_add_return(long i, atomic64_t * v)
-+static __inline__ long atomic64_add_return(long i, atomic64_t *v)
-+{
-+      long result;
-+      long temp;
-+
-+      smp_mb__before_llsc();
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %1, %2          # atomic64_add_return   \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     dadd    %0, %1, %3                              \n"
-+#else
-+              "       daddu   %0, %1, %3                              \n"
-+#endif
-+              "       scd     %0, %2                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       b       4f                                      \n"
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     daddu   %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "+m" (v->counter)
-+              : "Ir" (i));
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %1, %2  # atomic64_add_return           \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     dadd    %0, %1, %3                              \n"
-+#else
-+              "       daddu   %0, %1, %3                              \n"
-+#endif
-+              "       scd     %0, %2                                  \n"
-+              "       bnez    %0, 4f                                  \n"
-+              "       b       1b                                      \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     daddu   %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "=m" (v->counter)
-+              : "Ir" (i), "m" (v->counter)
-+              : "memory");
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+              "       ld      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     dadd    %0, %2                                  \n"
-+#else
-+              "       daddu   %0, %2                                  \n"
-+#endif
-+              "       sd      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Note: Dest reg is not modified on overflow */
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#endif
-+              : "=&r" (result), "+m" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+
-+      smp_llsc_mb();
-+
-+      return result;
-+}
-+static __inline__ long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
- {
-       long result;
-@@ -546,7 +1113,97 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
-       return result;
- }
--static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
-+static __inline__ long atomic64_sub_return(long i, atomic64_t *v)
-+{
-+      long result;
-+      long temp;
-+
-+      smp_mb__before_llsc();
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              long temp;
-+
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %1, %2          # atomic64_sub_return   \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     dsub    %0, %1, %3                              \n"
-+#else
-+              "       dsubu   %0, %1, %3                              \n"
-+#endif
-+              "       scd     %0, %2                                  \n"
-+              "       beqzl   %0, 1b                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       b       4f                                      \n"
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     dsubu   %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "=m" (v->counter)
-+              : "Ir" (i), "m" (v->counter)
-+              : "memory");
-+      } else if (kernel_uses_llsc) {
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:     lld     %1, %2  # atomic64_sub_return           \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "2:     dsub    %0, %1, %3                              \n"
-+#else
-+              "       dsubu   %0, %1, %3                              \n"
-+#endif
-+              "       scd     %0, %2                                  \n"
-+              "       bnez    %0, 4f                                  \n"
-+              "       b       1b                                      \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "       .set    noreorder                               \n"
-+              "3:     b       5f                                      \n"
-+              "       move    %0, %1                                  \n"
-+              "       .set    reorder                                 \n"
-+              _ASM_EXTABLE(2b, 3b)
-+#endif
-+              "4:     dsubu   %0, %1, %3                              \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              "5:                                                     \n"
-+#endif
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "=m" (v->counter)
-+              : "Ir" (i), "m" (v->counter)
-+              : "memory");
-+      } else {
-+              unsigned long flags;
-+
-+              raw_local_irq_save(flags);
-+              __asm__ __volatile__(
-+              "       ld      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+                      /* Exception on overflow. */
-+              "1:     dsub    %0, %2                                  \n"
-+#else
-+              "       dsubu   %0, %2                                  \n"
-+#endif
-+              "       sd      %0, %1                                  \n"
-+#ifdef CONFIG_PAX_REFCOUNT
-+              /* Note: Dest reg is not modified on overflow */
-+              "2:                                                     \n"
-+              _ASM_EXTABLE(1b, 2b)
-+#endif
-+              : "=&r" (result), "+m" (v->counter) : "Ir" (i));
-+              raw_local_irq_restore(flags);
-+      }
-+
-+      smp_llsc_mb();
-+
-+      return result;
-+}
-+
-+static __inline__ long atomic64_sub_return_unchecked(long i, atomic64_unchecked_t *v)
- {
-       long result;
-@@ -605,7 +1262,7 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
-  * Atomically test @v and subtract @i if @v is greater or equal than @i.
-  * The function returns the old value of @v minus @i.
-  */
--static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
-+static __inline__ long atomic64_sub_if_positive(long i, atomic64_t *v)
- {
-       long result;
-@@ -662,9 +1319,26 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
-       return result;
- }
--#define atomic64_cmpxchg(v, o, n) \
--      ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
--#define atomic64_xchg(v, new) (xchg(&((v)->counter), (new)))
-+static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-+{
-+      return cmpxchg(&v->counter, old, new);
-+}
-+
-+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old,
-+                                            long new)
-+{
-+      return cmpxchg(&(v->counter), old, new);
-+}
-+
-+static inline long atomic64_xchg(atomic64_t *v, long new)
-+{
-+      return xchg(&v->counter, new);
-+}
-+
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+      return xchg(&(v->counter), new);
-+}
- /**
-  * atomic64_add_unless - add unless the number is a given value
-@@ -694,6 +1368,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
- #define atomic64_dec_return(v) atomic64_sub_return(1, (v))
- #define atomic64_inc_return(v) atomic64_add_return(1, (v))
-+#define atomic64_inc_return_unchecked(v) atomic64_add_return_unchecked(1, (v))
- /*
-  * atomic64_sub_and_test - subtract value from variable and test result
-@@ -715,6 +1390,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-  * other cases.
-  */
- #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-+#define atomic64_inc_and_test_unchecked(v) atomic64_add_return_unchecked(1, (v)) == 0)
- /*
-  * atomic64_dec_and_test - decrement by 1 and test
-@@ -739,6 +1415,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-  * Atomically increments @v by 1.
-  */
- #define atomic64_inc(v) atomic64_add(1, (v))
-+#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1, (v))
- /*
-  * atomic64_dec - decrement and test
-@@ -747,6 +1424,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-  * Atomically decrements @v by 1.
-  */
- #define atomic64_dec(v) atomic64_sub(1, (v))
-+#define atomic64_dec_unchecked(v) atomic64_sub_unchecked(1, (v))
- /*
-  * atomic64_add_negative - add and test if negative
-diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
-index b4db69f..8f3b093 100644
---- a/arch/mips/include/asm/cache.h
-+++ b/arch/mips/include/asm/cache.h
-@@ -9,10 +9,11 @@
- #ifndef _ASM_CACHE_H
- #define _ASM_CACHE_H
-+#include <linux/const.h>
- #include <kmalloc.h>
- #define L1_CACHE_SHIFT                CONFIG_MIPS_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #define SMP_CACHE_SHIFT               L1_CACHE_SHIFT
- #define SMP_CACHE_BYTES               L1_CACHE_BYTES
-diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
-index cf3ae24..238d22f 100644
---- a/arch/mips/include/asm/elf.h
-+++ b/arch/mips/include/asm/elf.h
-@@ -372,13 +372,16 @@ extern const char *__elf_platform;
- #define ELF_ET_DYN_BASE               (TASK_SIZE / 3 * 2)
- #endif
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN    (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN   (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
- struct linux_binprm;
- extern int arch_setup_additional_pages(struct linux_binprm *bprm,
-                                      int uses_interp);
--struct mm_struct;
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_ELF_H */
-diff --git a/arch/mips/include/asm/exec.h b/arch/mips/include/asm/exec.h
-index c1f6afa..38cc6e9 100644
---- a/arch/mips/include/asm/exec.h
-+++ b/arch/mips/include/asm/exec.h
-@@ -12,6 +12,6 @@
- #ifndef _ASM_EXEC_H
- #define _ASM_EXEC_H
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- #endif /* _ASM_EXEC_H */
-diff --git a/arch/mips/include/asm/local.h b/arch/mips/include/asm/local.h
-index d44622c..64990d2 100644
---- a/arch/mips/include/asm/local.h
-+++ b/arch/mips/include/asm/local.h
-@@ -12,15 +12,25 @@ typedef struct
-       atomic_long_t a;
- } local_t;
-+typedef struct {
-+      atomic_long_unchecked_t a;
-+} local_unchecked_t;
-+
- #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
- #define local_read(l) atomic_long_read(&(l)->a)
-+#define local_read_unchecked(l)       atomic_long_read_unchecked(&(l)->a)
- #define local_set(l, i) atomic_long_set(&(l)->a, (i))
-+#define local_set_unchecked(l, i)     atomic_long_set_unchecked(&(l)->a, (i))
- #define local_add(i, l) atomic_long_add((i), (&(l)->a))
-+#define local_add_unchecked(i, l) atomic_long_add_unchecked((i), (&(l)->a))
- #define local_sub(i, l) atomic_long_sub((i), (&(l)->a))
-+#define local_sub_unchecked(i, l) atomic_long_sub_unchecked((i), (&(l)->a))
- #define local_inc(l)  atomic_long_inc(&(l)->a)
-+#define local_inc_unchecked(l)        atomic_long_inc_unchecked(&(l)->a)
- #define local_dec(l)  atomic_long_dec(&(l)->a)
-+#define local_dec_unchecked(l)        atomic_long_dec_unchecked(&(l)->a)
- /*
-  * Same as above, but return the result value
-@@ -70,6 +80,51 @@ static __inline__ long local_add_return(long i, local_t * l)
-       return result;
- }
-+static __inline__ long local_add_return_unchecked(long i, local_unchecked_t * l)
-+{
-+      unsigned long result;
-+
-+      if (kernel_uses_llsc && R10000_LLSC_WAR) {
-+              unsigned long temp;
-+
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:"    __LL    "%1, %2         # local_add_return      \n"
-+              "       addu    %0, %1, %3                              \n"
-+                      __SC    "%0, %2                                 \n"
-+              "       beqzl   %0, 1b                                  \n"
-+              "       addu    %0, %1, %3                              \n"
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "=m" (l->a.counter)
-+              : "Ir" (i), "m" (l->a.counter)
-+              : "memory");
-+      } else if (kernel_uses_llsc) {
-+              unsigned long temp;
-+
-+              __asm__ __volatile__(
-+              "       .set    mips3                                   \n"
-+              "1:"    __LL    "%1, %2         # local_add_return      \n"
-+              "       addu    %0, %1, %3                              \n"
-+                      __SC    "%0, %2                                 \n"
-+              "       beqz    %0, 1b                                  \n"
-+              "       addu    %0, %1, %3                              \n"
-+              "       .set    mips0                                   \n"
-+              : "=&r" (result), "=&r" (temp), "=m" (l->a.counter)
-+              : "Ir" (i), "m" (l->a.counter)
-+              : "memory");
-+      } else {
-+              unsigned long flags;
-+
-+              local_irq_save(flags);
-+              result = l->a.counter;
-+              result += i;
-+              l->a.counter = result;
-+              local_irq_restore(flags);
-+      }
-+
-+      return result;
-+}
-+
- static __inline__ long local_sub_return(long i, local_t * l)
- {
-       unsigned long result;
-@@ -117,6 +172,8 @@ static __inline__ long local_sub_return(long i, local_t * l)
- #define local_cmpxchg(l, o, n) \
-       ((long)cmpxchg_local(&((l)->a.counter), (o), (n)))
-+#define local_cmpxchg_unchecked(l, o, n) \
-+      ((long)cmpxchg_local(&((l)->a.counter), (o), (n)))
- #define local_xchg(l, n) (atomic_long_xchg((&(l)->a), (n)))
- /**
-diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
-index f59552f..3abe9b9 100644
---- a/arch/mips/include/asm/page.h
-+++ b/arch/mips/include/asm/page.h
-@@ -95,7 +95,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
-   #ifdef CONFIG_CPU_MIPS32
-     typedef struct { unsigned long pte_low, pte_high; } pte_t;
-     #define pte_val(x)          ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
--    #define __pte(x)    ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+    #define __pte(x)    ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
-   #else
-      typedef struct { unsigned long long pte; } pte_t;
-      #define pte_val(x) ((x).pte)
-diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
-index 881d18b..cea38bc 100644
---- a/arch/mips/include/asm/pgalloc.h
-+++ b/arch/mips/include/asm/pgalloc.h
-@@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- {
-       set_pud(pud, __pud((unsigned long)pmd));
- }
-+
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+      pud_populate(mm, pud, pmd);
-+}
- #endif
- /*
-diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
-index 895320e..bf63e10 100644
---- a/arch/mips/include/asm/thread_info.h
-+++ b/arch/mips/include/asm/thread_info.h
-@@ -115,6 +115,8 @@ static inline struct thread_info *current_thread_info(void)
- #define TIF_32BIT_ADDR                23      /* 32-bit address space (o32/n32) */
- #define TIF_FPUBOUND          24      /* thread bound to FPU-full CPU set */
- #define TIF_LOAD_WATCH                25      /* If set, load watch registers */
-+/* li takes a 32bit immediate */
-+#define TIF_GRSEC_SETXID      29      /* update credentials on syscall entry/exit */
- #define TIF_SYSCALL_TRACE     31      /* syscall trace active */
- #define _TIF_SYSCALL_TRACE    (1<<TIF_SYSCALL_TRACE)
-@@ -130,15 +132,18 @@ static inline struct thread_info *current_thread_info(void)
- #define _TIF_32BIT_ADDR               (1<<TIF_32BIT_ADDR)
- #define _TIF_FPUBOUND         (1<<TIF_FPUBOUND)
- #define _TIF_LOAD_WATCH               (1<<TIF_LOAD_WATCH)
-+#define _TIF_GRSEC_SETXID     (1<<TIF_GRSEC_SETXID)
-+
-+#define _TIF_SYSCALL_WORK     (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_GRSEC_SETXID)
- /* work to do in syscall_trace_leave() */
--#define _TIF_WORK_SYSCALL_EXIT        (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT)
-+#define _TIF_WORK_SYSCALL_EXIT        (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_GRSEC_SETXID)
- /* work to do on interrupt/exception return */
- #define _TIF_WORK_MASK                \
-       (_TIF_SIGPENDING | _TIF_NEED_RESCHED | _TIF_NOTIFY_RESUME)
- /* work to do on any return to u-space */
--#define _TIF_ALLWORK_MASK     (_TIF_WORK_MASK | _TIF_WORK_SYSCALL_EXIT)
-+#define _TIF_ALLWORK_MASK     (_TIF_WORK_MASK | _TIF_WORK_SYSCALL_EXIT | _TIF_GRSEC_SETXID)
- #endif /* __KERNEL__ */
-diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
-index 1188e00..41cf144 100644
---- a/arch/mips/kernel/binfmt_elfn32.c
-+++ b/arch/mips/kernel/binfmt_elfn32.c
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE               (TASK32_SIZE / 3 * 2)
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN    (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN   (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
-index 202e581..689ca79 100644
---- a/arch/mips/kernel/binfmt_elfo32.c
-+++ b/arch/mips/kernel/binfmt_elfo32.c
-@@ -56,6 +56,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE               (TASK32_SIZE / 3 * 2)
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN    (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN   (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- /*
-diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index c6a041d..b3e7318 100644
---- a/arch/mips/kernel/process.c
-+++ b/arch/mips/kernel/process.c
-@@ -563,15 +563,3 @@ unsigned long get_wchan(struct task_struct *task)
- out:
-       return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
--      if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--              sp -= get_random_int() & ~PAGE_MASK;
--
--      return sp & ALMASK;
--}
-diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
-index 9c6299c..2fb4c22 100644
---- a/arch/mips/kernel/ptrace.c
-+++ b/arch/mips/kernel/ptrace.c
-@@ -528,6 +528,10 @@ static inline int audit_arch(void)
-       return arch;
- }
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
-  * Notification of system call entry/exit
-  * - triggered by current->work.syscall_trace
-@@ -537,6 +541,11 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
-       /* do the secure computing check first */
-       secure_computing_strict(regs->regs[2]);
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+      if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+              gr_delayed_cred_worker();
-+#endif
-+
-       if (!(current->ptrace & PT_PTRACED))
-               goto out;
-diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
-index 9b36424..e7f4154 100644
---- a/arch/mips/kernel/scall32-o32.S
-+++ b/arch/mips/kernel/scall32-o32.S
-@@ -52,7 +52,7 @@ NESTED(handle_sys, PT_SIZE, sp)
- stack_done:
-       lw      t0, TI_FLAGS($28)       # syscall tracing enabled?
--      li      t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+      li      t1, _TIF_SYSCALL_WORK
-       and     t0, t1
-       bnez    t0, syscall_trace_entry # -> yes
-diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
-index 97a5909..59622f8 100644
---- a/arch/mips/kernel/scall64-64.S
-+++ b/arch/mips/kernel/scall64-64.S
-@@ -54,7 +54,7 @@ NESTED(handle_sys64, PT_SIZE, sp)
-       sd      a3, PT_R26(sp)          # save a3 for syscall restarting
--      li      t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+      li      t1, _TIF_SYSCALL_WORK
-       LONG_L  t0, TI_FLAGS($28)       # syscall tracing enabled?
-       and     t0, t1, t0
-       bnez    t0, syscall_trace_entry
-diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
-index edcb659..fb2ab09 100644
---- a/arch/mips/kernel/scall64-n32.S
-+++ b/arch/mips/kernel/scall64-n32.S
-@@ -47,7 +47,7 @@ NESTED(handle_sysn32, PT_SIZE, sp)
-       sd      a3, PT_R26(sp)          # save a3 for syscall restarting
--      li      t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+      li      t1, _TIF_SYSCALL_WORK
-       LONG_L  t0, TI_FLAGS($28)       # syscall tracing enabled?
-       and     t0, t1, t0
-       bnez    t0, n32_syscall_trace_entry
-diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
-index 74f485d..47d2c38 100644
---- a/arch/mips/kernel/scall64-o32.S
-+++ b/arch/mips/kernel/scall64-o32.S
-@@ -81,7 +81,7 @@ NESTED(handle_sys, PT_SIZE, sp)
-       PTR     4b, bad_stack
-       .previous
--      li      t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+      li      t1, _TIF_SYSCALL_WORK
-       LONG_L  t0, TI_FLAGS($28)       # syscall tracing enabled?
-       and     t0, t1, t0
-       bnez    t0, trace_a_syscall
-diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
-index a75ae40..0d0f56a 100644
---- a/arch/mips/kernel/traps.c
-+++ b/arch/mips/kernel/traps.c
-@@ -675,7 +675,17 @@ asmlinkage void do_ov(struct pt_regs *regs)
- {
-       siginfo_t info;
--      die_if_kernel("Integer overflow", regs);
-+      if (unlikely(!user_mode(regs))) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+              if (fixup_exception(regs)) {
-+                      pax_report_refcount_overflow(regs);
-+                      return;
-+              }
-+#endif
-+
-+              die("Integer overflow", regs);
-+      }
-       info.si_code = FPE_INTOVF;
-       info.si_signo = SIGFPE;
-diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
-index 0fead53..eeb00a6 100644
---- a/arch/mips/mm/fault.c
-+++ b/arch/mips/mm/fault.c
-@@ -27,6 +27,23 @@
- #include <asm/highmem.h>              /* For VMALLOC_END */
- #include <linux/kdebug.h>
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      unsigned long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 5; i++) {
-+              unsigned int c;
-+              if (get_user(c, (unsigned int *)pc+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%08x ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults.  It determines the address,
-  * and the problem, and then passes it off to one of the appropriate
-@@ -196,6 +213,14 @@ bad_area:
- bad_area_nosemaphore:
-       /* User mode accesses just cause a SIGSEGV */
-       if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+              if (cpu_has_rixi && (mm->pax_flags & MF_PAX_PAGEEXEC) && !write && address == instruction_pointer(regs)) {
-+                      pax_report_fault(regs, (void *)address, (void *)user_stack_pointer(regs));
-+                      do_group_exit(SIGKILL);
-+              }
-+#endif
-+
-               tsk->thread.cp0_badvaddr = address;
-               tsk->thread.error_code = write;
- #if 0
-diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
-index 7e5fe27..9656513 100644
---- a/arch/mips/mm/mmap.c
-+++ b/arch/mips/mm/mmap.c
-@@ -59,6 +59,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
-       struct vm_area_struct *vma;
-       unsigned long addr = addr0;
-       int do_color_align;
-+      unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-       struct vm_unmapped_area_info info;
-       if (unlikely(len > TASK_SIZE))
-@@ -84,6 +85,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
-               do_color_align = 1;
-       /* requesting a specific address */
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       if (addr) {
-               if (do_color_align)
-                       addr = COLOUR_ALIGN(addr, pgoff);
-@@ -91,14 +97,14 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
-                       addr = PAGE_ALIGN(addr);
-               vma = find_vma(mm, addr);
--              if (TASK_SIZE - len >= addr &&
--                  (!vma || addr + len <= vma->vm_start))
-+              if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len, offset))
-                       return addr;
-       }
-       info.length = len;
-       info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
-       info.align_offset = pgoff << PAGE_SHIFT;
-+      info.threadstack_offset = offset;
-       if (dir == DOWN) {
-               info.flags = VM_UNMAPPED_AREA_TOPDOWN;
-@@ -146,6 +152,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- {
-       unsigned long random_factor = 0UL;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       if (current->flags & PF_RANDOMIZE) {
-               random_factor = get_random_int();
-               random_factor = random_factor << PAGE_SHIFT;
-@@ -157,42 +167,27 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
-       if (mmap_is_legacy()) {
-               mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area;
-               mm->unmap_area = arch_unmap_area;
-       } else {
-               mm->mmap_base = mmap_base(random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area_topdown;
-               mm->unmap_area = arch_unmap_area_topdown;
-       }
- }
--static inline unsigned long brk_rnd(void)
--{
--      unsigned long rnd = get_random_int();
--
--      rnd = rnd << PAGE_SHIFT;
--      /* 8MB for 32bit, 256MB for 64bit */
--      if (TASK_IS_32BIT_ADDR)
--              rnd = rnd & 0x7ffffful;
--      else
--              rnd = rnd & 0xffffffful;
--
--      return rnd;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--      unsigned long base = mm->brk;
--      unsigned long ret;
--
--      ret = PAGE_ALIGN(base + brk_rnd());
--
--      if (ret < mm->brk)
--              return mm->brk;
--
--      return ret;
--}
--
- int __virt_addr_valid(const volatile void *kaddr)
- {
-       return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
-diff --git a/arch/mn10300/proc-mn103e010/include/proc/cache.h b/arch/mn10300/proc-mn103e010/include/proc/cache.h
-index 967d144..db12197 100644
---- a/arch/mn10300/proc-mn103e010/include/proc/cache.h
-+++ b/arch/mn10300/proc-mn103e010/include/proc/cache.h
-@@ -11,12 +11,14 @@
- #ifndef _ASM_PROC_CACHE_H
- #define _ASM_PROC_CACHE_H
-+#include <linux/const.h>
-+
- /* L1 cache */
- #define L1_CACHE_NWAYS                4       /* number of ways in caches */
- #define L1_CACHE_NENTRIES     256     /* number of entries in each way */
--#define L1_CACHE_BYTES                16      /* bytes per entry */
- #define L1_CACHE_SHIFT                4       /* shift for bytes per entry */
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)   /* bytes per entry */
- #define L1_CACHE_WAYDISP      0x1000  /* displacement of one way from the next */
- #define L1_CACHE_TAG_VALID    0x00000001      /* cache tag valid bit */
-diff --git a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
-index bcb5df2..84fabd2 100644
---- a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
-+++ b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
-@@ -16,13 +16,15 @@
- #ifndef _ASM_PROC_CACHE_H
- #define _ASM_PROC_CACHE_H
-+#include <linux/const.h>
-+
- /*
-  * L1 cache
-  */
- #define L1_CACHE_NWAYS                4               /* number of ways in caches */
- #define L1_CACHE_NENTRIES     128             /* number of entries in each way */
--#define L1_CACHE_BYTES                32              /* bytes per entry */
- #define L1_CACHE_SHIFT                5               /* shift for bytes per entry */
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)   /* bytes per entry */
- #define L1_CACHE_WAYDISP      0x1000          /* distance from one way to the next */
- #define L1_CACHE_TAG_VALID    0x00000001      /* cache tag valid bit */
-diff --git a/arch/openrisc/include/asm/cache.h b/arch/openrisc/include/asm/cache.h
-index 4ce7a01..449202a 100644
---- a/arch/openrisc/include/asm/cache.h
-+++ b/arch/openrisc/include/asm/cache.h
-@@ -19,11 +19,13 @@
- #ifndef __ASM_OPENRISC_CACHE_H
- #define __ASM_OPENRISC_CACHE_H
-+#include <linux/const.h>
-+
- /* FIXME: How can we replace these with values from the CPU...
-  * they shouldn't be hard-coded!
-  */
--#define L1_CACHE_BYTES 16
- #define L1_CACHE_SHIFT 4
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #endif /* __ASM_OPENRISC_CACHE_H */
-diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 472886c..00e7df9 100644
---- a/arch/parisc/include/asm/atomic.h
-+++ b/arch/parisc/include/asm/atomic.h
-@@ -252,6 +252,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
-       return dec;
- }
-+#define atomic64_read_unchecked(v)            atomic64_read(v)
-+#define atomic64_set_unchecked(v, i)          atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v)          atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v)   atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v)          atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v)             atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v)      atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v)             atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n)   atomic64_cmpxchg((v), (o), (n))
-+
- #endif /* !CONFIG_64BIT */
-diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
-index 47f11c7..3420df2 100644
---- a/arch/parisc/include/asm/cache.h
-+++ b/arch/parisc/include/asm/cache.h
-@@ -5,6 +5,7 @@
- #ifndef __ARCH_PARISC_CACHE_H
- #define __ARCH_PARISC_CACHE_H
-+#include <linux/const.h>
- /*
-  * PA 2.0 processors have 64-byte cachelines; PA 1.1 processors have
-@@ -15,13 +16,13 @@
-  * just ruin performance.
-  */
- #ifdef CONFIG_PA20
--#define L1_CACHE_BYTES 64
- #define L1_CACHE_SHIFT 6
- #else
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
- #endif
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-+
- #ifndef __ASSEMBLY__
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
-index ad2b503..bdf1651 100644
---- a/arch/parisc/include/asm/elf.h
-+++ b/arch/parisc/include/asm/elf.h
-@@ -342,6 +342,13 @@ struct pt_regs;   /* forward declaration... */
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN    16
-+#define PAX_DELTA_STACK_LEN   16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-    but it's not easy, and we've already done it here.  */
-diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
-index fc987a1..6e068ef 100644
---- a/arch/parisc/include/asm/pgalloc.h
-+++ b/arch/parisc/include/asm/pgalloc.h
-@@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-                       (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
- }
-+static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-+{
-+      pgd_populate(mm, pgd, pmd);
-+}
-+
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
- {
-       pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
-@@ -93,6 +98,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- #define pmd_alloc_one(mm, addr)               ({ BUG(); ((pmd_t *)2); })
- #define pmd_free(mm, x)                       do { } while (0)
- #define pgd_populate(mm, pmd, pte)    BUG()
-+#define pgd_populate_kernel(mm, pmd, pte)     BUG()
- #endif
-diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 1e40d7f..a3eb445 100644
---- a/arch/parisc/include/asm/pgtable.h
-+++ b/arch/parisc/include/asm/pgtable.h
-@@ -223,6 +223,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
- #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY       PAGE_EXECREAD
- #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC     __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC   PAGE_SHARED
-+# define PAGE_COPY_NOEXEC     PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL   __pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_EXEC      __pgprot(_PAGE_KERNEL_EXEC)
- #define PAGE_KERNEL_RWX       __pgprot(_PAGE_KERNEL_RWX)
-diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index e0a8235..ce2f1e1 100644
---- a/arch/parisc/include/asm/uaccess.h
-+++ b/arch/parisc/include/asm/uaccess.h
-@@ -245,10 +245,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
-                                           const void __user *from,
-                                           unsigned long n)
- {
--        int sz = __compiletime_object_size(to);
-+        size_t sz = __compiletime_object_size(to);
-         int ret = -EFAULT;
--        if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
-+        if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
-                 ret = __copy_from_user(to, from, n);
-         else
-                 copy_from_user_overflow();
-diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
-index 2a625fb..9908930 100644
---- a/arch/parisc/kernel/module.c
-+++ b/arch/parisc/kernel/module.c
-@@ -98,16 +98,38 @@
- /* three functions to determine where in the module core
-  * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+      return (loc >= me->module_init_rx &&
-+              loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+      return (loc >= me->module_init_rw &&
-+              loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
--      return (loc >= me->module_init &&
--              loc <= (me->module_init + me->init_size));
-+      return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+      return (loc >= me->module_core_rx &&
-+              loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+      return (loc >= me->module_core_rw &&
-+              loc < (me->module_core_rw + me->core_size_rw));
- }
- static inline int in_core(struct module *me, void *loc)
- {
--      return (loc >= me->module_core &&
--              loc <= (me->module_core + me->core_size));
-+      return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
- static inline int in_local(struct module *me, void *loc)
-@@ -371,13 +393,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
-       }
-       /* align things a bit */
--      me->core_size = ALIGN(me->core_size, 16);
--      me->arch.got_offset = me->core_size;
--      me->core_size += gots * sizeof(struct got_entry);
-+      me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+      me->arch.got_offset = me->core_size_rw;
-+      me->core_size_rw += gots * sizeof(struct got_entry);
--      me->core_size = ALIGN(me->core_size, 16);
--      me->arch.fdesc_offset = me->core_size;
--      me->core_size += fdescs * sizeof(Elf_Fdesc);
-+      me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+      me->arch.fdesc_offset = me->core_size_rw;
-+      me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
-       me->arch.got_max = gots;
-       me->arch.fdesc_max = fdescs;
-@@ -395,7 +417,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
-       BUG_ON(value == 0);
--      got = me->module_core + me->arch.got_offset;
-+      got = me->module_core_rw + me->arch.got_offset;
-       for (i = 0; got[i].addr; i++)
-               if (got[i].addr == value)
-                       goto out;
-@@ -413,7 +435,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
--      Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+      Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
-       if (!value) {
-               printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -431,7 +453,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
-       /* Create new one */
-       fdesc->addr = value;
--      fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+      fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
-       return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -843,7 +865,7 @@ register_unwind_table(struct module *me,
-       table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
-       end = table + sechdrs[me->arch.unwind_section].sh_size;
--      gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+      gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
-       DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
-              me->arch.unwind_section, table, end, gp);
-diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
-index 5dfd248..64914ac 100644
---- a/arch/parisc/kernel/sys_parisc.c
-+++ b/arch/parisc/kernel/sys_parisc.c
-@@ -33,9 +33,11 @@
- #include <linux/utsname.h>
- #include <linux/personality.h>
--static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
-+static unsigned long get_unshared_area(struct file *filp, unsigned long addr, unsigned long len,
-+                                      unsigned long flags)
- {
-       struct vm_unmapped_area_info info;
-+      unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-       info.flags = 0;
-       info.length = len;
-@@ -43,6 +45,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
-       info.high_limit = TASK_SIZE;
-       info.align_mask = 0;
-       info.align_offset = 0;
-+      info.threadstack_offset = offset;
-       return vm_unmapped_area(&info);
- }
-@@ -61,10 +64,11 @@ static int get_offset(struct address_space *mapping)
-       return (unsigned long) mapping >> 8;
- }
--static unsigned long get_shared_area(struct address_space *mapping,
--              unsigned long addr, unsigned long len, unsigned long pgoff)
-+static unsigned long get_shared_area(struct file *filp, struct address_space *mapping,
-+              unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
- {
-       struct vm_unmapped_area_info info;
-+      unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-       info.flags = 0;
-       info.length = len;
-@@ -72,6 +76,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
-       info.high_limit = TASK_SIZE;
-       info.align_mask = PAGE_MASK & (SHMLBA - 1);
-       info.align_offset = (get_offset(mapping) + pgoff) << PAGE_SHIFT;
-+      info.threadstack_offset = offset;
-       return vm_unmapped_area(&info);
- }
-@@ -86,15 +91,22 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
-                       return -EINVAL;
-               return addr;
-       }
--      if (!addr)
-+      if (!addr) {
-               addr = TASK_UNMAPPED_BASE;
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+                      addr += current->mm->delta_mmap;
-+#endif
-+
-+      }
-+
-       if (filp) {
--              addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-+              addr = get_shared_area(filp, filp->f_mapping, addr, len, pgoff, flags);
-       } else if(flags & MAP_SHARED) {
--              addr = get_shared_area(NULL, addr, len, pgoff);
-+              addr = get_shared_area(filp, NULL, addr, len, pgoff, flags);
-       } else {
--              addr = get_unshared_area(addr, len);
-+              addr = get_unshared_area(filp, addr, len, flags);
-       }
-       return addr;
- }
-diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 04e47c6..7a8faf6 100644
---- a/arch/parisc/kernel/traps.c
-+++ b/arch/parisc/kernel/traps.c
-@@ -727,9 +727,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
-                       down_read(&current->mm->mmap_sem);
-                       vma = find_vma(current->mm,regs->iaoq[0]);
--                      if (vma && (regs->iaoq[0] >= vma->vm_start)
--                              && (vma->vm_flags & VM_EXEC)) {
--
-+                      if (vma && (regs->iaoq[0] >= vma->vm_start)) {
-                               fault_address = regs->iaoq[0];
-                               fault_space = regs->iasq[0];
-diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index f247a34..dc0f219 100644
---- a/arch/parisc/mm/fault.c
-+++ b/arch/parisc/mm/fault.c
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
--      if (code == 6 || code == 16)
-+      if (code == 6 || code == 7 || code == 16)
-           return VM_EXEC;
-       switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
-                       }
- #endif
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when rt_sigreturn trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+      int err;
-+
-+      do { /* PaX: unpatched PLT emulation */
-+              unsigned int bl, depwi;
-+
-+              err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+              err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+              if (err)
-+                      break;
-+
-+              if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+                      unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+                      err = get_user(ldw, (unsigned int *)addr);
-+                      err |= get_user(bv, (unsigned int *)(addr+4));
-+                      err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+                      if (err)
-+                              break;
-+
-+                      if (ldw == 0x0E801096U &&
-+                          bv == 0xEAC0C000U &&
-+                          ldw2 == 0x0E881095U)
-+                      {
-+                              unsigned int resolver, map;
-+
-+                              err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+                              err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+                              if (err)
-+                                      break;
-+
-+                              regs->gr[20] = instruction_pointer(regs)+8;
-+                              regs->gr[21] = map;
-+                              regs->gr[22] = resolver;
-+                              regs->iaoq[0] = resolver | 3UL;
-+                              regs->iaoq[1] = regs->iaoq[0] + 4;
-+                              return 3;
-+                      }
-+              }
-+      } while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+      if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+              return 1;
-+#endif
-+
-+      do { /* PaX: rt_sigreturn emulation */
-+              unsigned int ldi1, ldi2, bel, nop;
-+
-+              err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+              err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+              err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+              err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+              if (err)
-+                      break;
-+
-+              if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+                  ldi2 == 0x3414015AU &&
-+                  bel == 0xE4008200U &&
-+                  nop == 0x08000240U)
-+              {
-+                      regs->gr[25] = (ldi1 & 2) >> 1;
-+                      regs->gr[20] = __NR_rt_sigreturn;
-+                      regs->gr[31] = regs->iaoq[1] + 16;
-+                      regs->sr[0] = regs->iasq[1];
-+                      regs->iaoq[0] = 0x100UL;
-+                      regs->iaoq[1] = regs->iaoq[0] + 4;
-+                      regs->iasq[0] = regs->sr[2];
-+                      regs->iasq[1] = regs->sr[2];
-+                      return 2;
-+              }
-+      } while (0);
-+#endif
-+
-+      return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      unsigned long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 5; i++) {
-+              unsigned int c;
-+              if (get_user(c, (unsigned int *)pc+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%08x ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
-       const struct exception_table_entry *fix;
-@@ -194,8 +305,33 @@ good_area:
-       acc_type = parisc_acctyp(code,regs->iir);
--      if ((vma->vm_flags & acc_type) != acc_type)
-+      if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+              if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+                  (address & ~3UL) == instruction_pointer(regs))
-+              {
-+                      up_read(&mm->mmap_sem);
-+                      switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+                      case 3:
-+                              return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+                      case 2:
-+                              return;
-+#endif
-+
-+                      }
-+                      pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+                      do_group_exit(SIGKILL);
-+              }
-+#endif
-+
-               goto bad_area;
-+      }
-       /*
-        * If for any reason at all we couldn't handle the fault, make
-diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
-index e3b1d41..8e81edf 100644
---- a/arch/powerpc/include/asm/atomic.h
-+++ b/arch/powerpc/include/asm/atomic.h
-@@ -523,6 +523,16 @@ static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
-       return t1;
- }
-+#define atomic64_read_unchecked(v)            atomic64_read(v)
-+#define atomic64_set_unchecked(v, i)          atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v)          atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v)   atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v)          atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v)             atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v)      atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v)             atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n)   atomic64_cmpxchg((v), (o), (n))
-+
- #endif /* __powerpc64__ */
- #endif /* __KERNEL__ */
-diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
-index 9e495c9..b6878e5 100644
---- a/arch/powerpc/include/asm/cache.h
-+++ b/arch/powerpc/include/asm/cache.h
-@@ -3,6 +3,7 @@
- #ifdef __KERNEL__
-+#include <linux/const.h>
- /* bytes per L1 cache line */
- #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
-@@ -22,7 +23,7 @@
- #define L1_CACHE_SHIFT                7
- #endif
--#define       L1_CACHE_BYTES          (1 << L1_CACHE_SHIFT)
-+#define       L1_CACHE_BYTES          (_AC(1,UL) << L1_CACHE_SHIFT)
- #define       SMP_CACHE_BYTES         L1_CACHE_BYTES
-diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
-index cc0655a..13eac2e 100644
---- a/arch/powerpc/include/asm/elf.h
-+++ b/arch/powerpc/include/asm/elf.h
-@@ -28,8 +28,19 @@
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE               (randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE               (0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN    (is_32bit_task() ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN   (is_32bit_task() ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN    15
-+#define PAX_DELTA_STACK_LEN   15
-+#endif
-+#endif
- /*
-  * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -123,10 +134,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
-       (0x7ff >> (PAGE_SHIFT - 12)) : \
-       (0x3ffff >> (PAGE_SHIFT - 12)))
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
--
- #ifdef CONFIG_SPU_BASE
- /* Notes used in ET_CORE. Note name is "SPU/<fd>/<filename>". */
- #define NT_SPU                1
-diff --git a/arch/powerpc/include/asm/exec.h b/arch/powerpc/include/asm/exec.h
-index 8196e9c..d83a9f3 100644
---- a/arch/powerpc/include/asm/exec.h
-+++ b/arch/powerpc/include/asm/exec.h
-@@ -4,6 +4,6 @@
- #ifndef _ASM_POWERPC_EXEC_H
- #define _ASM_POWERPC_EXEC_H
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- #endif /* _ASM_POWERPC_EXEC_H */
-diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
-index 5acabbd..7ea14fa 100644
---- a/arch/powerpc/include/asm/kmap_types.h
-+++ b/arch/powerpc/include/asm/kmap_types.h
-@@ -10,7 +10,7 @@
-  * 2 of the License, or (at your option) any later version.
-  */
--#define KM_TYPE_NR 16
-+#define KM_TYPE_NR 17
- #endif        /* __KERNEL__ */
- #endif        /* _ASM_POWERPC_KMAP_TYPES_H */
-diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
-index 8565c25..2865190 100644
---- a/arch/powerpc/include/asm/mman.h
-+++ b/arch/powerpc/include/asm/mman.h
-@@ -24,7 +24,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
- }
- #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
--static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
-+static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
- {
-       return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
- }
-diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
-index 988c812..63c7d70 100644
---- a/arch/powerpc/include/asm/page.h
-+++ b/arch/powerpc/include/asm/page.h
-@@ -220,8 +220,9 @@ extern long long virt_phys_offset;
-  * and needs to be executable.  This means the whole heap ends
-  * up being executable.
-  */
--#define VM_DATA_DEFAULT_FLAGS32       (VM_READ | VM_WRITE | VM_EXEC | \
--                               VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+      (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+       VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- #define VM_DATA_DEFAULT_FLAGS64       (VM_READ | VM_WRITE | \
-                                VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -249,6 +250,9 @@ extern long long virt_phys_offset;
- #define is_kernel_addr(x)     ((x) >= PAGE_OFFSET)
- #endif
-+#define ktla_ktva(addr)               (addr)
-+#define ktva_ktla(addr)               (addr)
-+
- #ifndef CONFIG_PPC_BOOK3S_64
- /*
-  * Use the top bit of the higher-level page table entries to indicate whether
-diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
-index 88693ce..ac6f9ab 100644
---- a/arch/powerpc/include/asm/page_64.h
-+++ b/arch/powerpc/include/asm/page_64.h
-@@ -153,15 +153,18 @@ do {                                             \
-  * stack by default, so in the absence of a PT_GNU_STACK program header
-  * we turn execute permission off.
-  */
--#define VM_STACK_DEFAULT_FLAGS32      (VM_READ | VM_WRITE | VM_EXEC | \
--                                       VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+      (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+       VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- #define VM_STACK_DEFAULT_FLAGS64      (VM_READ | VM_WRITE | \
-                                        VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
-       (is_32bit_task() ? \
-        VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
- #include <asm-generic/getorder.h>
-diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
-index b66ae72..4a378cd 100644
---- a/arch/powerpc/include/asm/pgalloc-64.h
-+++ b/arch/powerpc/include/asm/pgalloc-64.h
-@@ -53,6 +53,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- #ifndef CONFIG_PPC_64K_PAGES
- #define pgd_populate(MM, PGD, PUD)    pgd_set(PGD, PUD)
-+#define pgd_populate_kernel(MM, PGD, PUD)     pgd_populate((MM), (PGD), (PUD))
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-@@ -70,6 +71,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-       pud_set(pud, (unsigned long)pmd);
- }
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+      pud_populate(mm, pud, pmd);
-+}
-+
- #define pmd_populate(mm, pmd, pte_page) \
-       pmd_populate_kernel(mm, pmd, page_address(pte_page))
- #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
-@@ -171,6 +177,7 @@ extern void __tlb_remove_table(void *_table);
- #endif
- #define pud_populate(mm, pud, pmd)    pud_set(pud, (unsigned long)pmd)
-+#define pud_populate_kernel(mm, pud, pmd)     pud_populate((mm), (pud), (pmd))
- static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
-                                      pte_t *pte)
-diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
-index 7aeb955..19f748e 100644
---- a/arch/powerpc/include/asm/pgtable.h
-+++ b/arch/powerpc/include/asm/pgtable.h
-@@ -2,6 +2,7 @@
- #define _ASM_POWERPC_PGTABLE_H
- #ifdef __KERNEL__
-+#include <linux/const.h>
- #ifndef __ASSEMBLY__
- #include <asm/processor.h>            /* For TASK_SIZE */
- #include <asm/mmu.h>
-diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
-index 4aad413..85d86bf 100644
---- a/arch/powerpc/include/asm/pte-hash32.h
-+++ b/arch/powerpc/include/asm/pte-hash32.h
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE    0x004   /* when !present: nonlinear file mapping */
- #define _PAGE_USER    0x004   /* usermode access allowed */
- #define _PAGE_GUARDED 0x008   /* G: prohibit speculative access */
-+#define _PAGE_EXEC    _PAGE_GUARDED
- #define _PAGE_COHERENT        0x010   /* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE        0x020   /* I: cache inhibit */
- #define _PAGE_WRITETHRU       0x040   /* W: cache write-through */
-diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index e1fb161..2290d1d 100644
---- a/arch/powerpc/include/asm/reg.h
-+++ b/arch/powerpc/include/asm/reg.h
-@@ -234,6 +234,7 @@
- #define SPRN_DBCR     0x136   /* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR    0x012   /* Data Storage Interrupt Status Register */
- #define   DSISR_NOHPTE                0x40000000      /* no translation found */
-+#define   DSISR_GUARDED               0x10000000      /* fetch from guarded storage */
- #define   DSISR_PROTFAULT     0x08000000      /* protection fault */
- #define   DSISR_ISSTORE               0x02000000      /* access was a store */
- #define   DSISR_DABRMATCH     0x00400000      /* hit data breakpoint */
-diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
-index 48cfc85..891382f 100644
---- a/arch/powerpc/include/asm/smp.h
-+++ b/arch/powerpc/include/asm/smp.h
-@@ -50,7 +50,7 @@ struct smp_ops_t {
-       int   (*cpu_disable)(void);
-       void  (*cpu_die)(unsigned int nr);
-       int   (*cpu_bootable)(unsigned int nr);
--};
-+} __no_const;
- extern void smp_send_debugger_break(void);
- extern void start_secondary_resume(void);
-diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
-index ba7b197..d292e26 100644
---- a/arch/powerpc/include/asm/thread_info.h
-+++ b/arch/powerpc/include/asm/thread_info.h
-@@ -93,7 +93,6 @@ static inline struct thread_info *current_thread_info(void)
- #define TIF_POLLING_NRFLAG    3       /* true if poll_idle() is polling
-                                          TIF_NEED_RESCHED */
- #define TIF_32BIT             4       /* 32 bit binary */
--#define TIF_PERFMON_WORK      5       /* work for pfm_handle_work() */
- #define TIF_PERFMON_CTXSW     6       /* perfmon needs ctxsw calls */
- #define TIF_SYSCALL_AUDIT     7       /* syscall auditing active */
- #define TIF_SINGLESTEP                8       /* singlestepping active */
-@@ -107,6 +106,9 @@ static inline struct thread_info *current_thread_info(void)
- #define TIF_EMULATE_STACK_STORE       16      /* Is an instruction emulation
-                                               for stack store? */
- #define TIF_MEMDIE            17      /* is terminating due to OOM killer */
-+#define TIF_PERFMON_WORK      18      /* work for pfm_handle_work() */
-+/* mask must be expressable within 16 bits to satisfy 'andi' instruction reqs */
-+#define TIF_GRSEC_SETXID      5       /* update credentials on syscall entry/exit */
- /* as above, but as bit values */
- #define _TIF_SYSCALL_TRACE    (1<<TIF_SYSCALL_TRACE)
-@@ -126,9 +128,10 @@ static inline struct thread_info *current_thread_info(void)
- #define _TIF_SYSCALL_TRACEPOINT       (1<<TIF_SYSCALL_TRACEPOINT)
- #define _TIF_EMULATE_STACK_STORE      (1<<TIF_EMULATE_STACK_STORE)
- #define _TIF_NOHZ             (1<<TIF_NOHZ)
-+#define _TIF_GRSEC_SETXID     (1<<TIF_GRSEC_SETXID)
- #define _TIF_SYSCALL_T_OR_A   (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
-                                _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \
--                               _TIF_NOHZ)
-+                               _TIF_NOHZ | _TIF_GRSEC_SETXID)
- #define _TIF_USER_WORK_MASK   (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
-                                _TIF_NOTIFY_RESUME | _TIF_UPROBE)
-diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index 4db4959..aba5c41 100644
---- a/arch/powerpc/include/asm/uaccess.h
-+++ b/arch/powerpc/include/asm/uaccess.h
-@@ -318,52 +318,6 @@ do {                                                              \
- extern unsigned long __copy_tofrom_user(void __user *to,
-               const void __user *from, unsigned long size);
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
--              const void __user *from, unsigned long n)
--{
--      unsigned long over;
--
--      if (access_ok(VERIFY_READ, from, n))
--              return __copy_tofrom_user((__force void __user *)to, from, n);
--      if ((unsigned long)from < TASK_SIZE) {
--              over = (unsigned long)from + n - TASK_SIZE;
--              return __copy_tofrom_user((__force void __user *)to, from,
--                              n - over) + over;
--      }
--      return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
--              const void *from, unsigned long n)
--{
--      unsigned long over;
--
--      if (access_ok(VERIFY_WRITE, to, n))
--              return __copy_tofrom_user(to, (__force void __user *)from, n);
--      if ((unsigned long)to < TASK_SIZE) {
--              over = (unsigned long)to + n - TASK_SIZE;
--              return __copy_tofrom_user(to, (__force void __user *)from,
--                              n - over) + over;
--      }
--      return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
--      __copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
--                                  unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
--                                unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
--                                unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
-               const void __user *from, unsigned long n)
- {
-@@ -387,6 +341,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
-               if (ret == 0)
-                       return 0;
-       }
-+
-+      if (!__builtin_constant_p(n))
-+              check_object_size(to, n, false);
-+
-       return __copy_tofrom_user((__force void __user *)to, from, n);
- }
-@@ -413,6 +371,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
-               if (ret == 0)
-                       return 0;
-       }
-+
-+      if (!__builtin_constant_p(n))
-+              check_object_size(from, n, true);
-+
-       return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
-@@ -430,6 +392,92 @@ static inline unsigned long __copy_to_user(void __user *to,
-       return __copy_to_user_inatomic(to, from, size);
- }
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+              const void __user *from, unsigned long n)
-+{
-+      unsigned long over;
-+
-+      if ((long)n < 0)
-+              return n;
-+
-+      if (access_ok(VERIFY_READ, from, n)) {
-+              if (!__builtin_constant_p(n))
-+                      check_object_size(to, n, false);
-+              return __copy_tofrom_user((__force void __user *)to, from, n);
-+      }
-+      if ((unsigned long)from < TASK_SIZE) {
-+              over = (unsigned long)from + n - TASK_SIZE;
-+              if (!__builtin_constant_p(n - over))
-+                      check_object_size(to, n - over, false);
-+              return __copy_tofrom_user((__force void __user *)to, from,
-+                              n - over) + over;
-+      }
-+      return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+              const void *from, unsigned long n)
-+{
-+      unsigned long over;
-+
-+      if ((long)n < 0)
-+              return n;
-+
-+      if (access_ok(VERIFY_WRITE, to, n)) {
-+              if (!__builtin_constant_p(n))
-+                      check_object_size(from, n, true);
-+              return __copy_tofrom_user(to, (__force void __user *)from, n);
-+      }
-+      if ((unsigned long)to < TASK_SIZE) {
-+              over = (unsigned long)to + n - TASK_SIZE;
-+              if (!__builtin_constant_p(n))
-+                      check_object_size(from, n - over, true);
-+              return __copy_tofrom_user(to, (__force void __user *)from,
-+                              n - over) + over;
-+      }
-+      return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+      __copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+      if ((long)n < 0 || n > INT_MAX)
-+              return n;
-+
-+      if (!__builtin_constant_p(n))
-+              check_object_size(to, n, false);
-+
-+      if (likely(access_ok(VERIFY_READ, from, n)))
-+              n = __copy_from_user(to, from, n);
-+      else
-+              memset(to, 0, n);
-+      return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+      if ((long)n < 0 || n > INT_MAX)
-+              return n;
-+
-+      if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+              if (!__builtin_constant_p(n))
-+                      check_object_size(from, n, true);
-+              n = __copy_to_user(to, from, n);
-+      }
-+      return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+                                unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
-index 645170a..6cf0271 100644
---- a/arch/powerpc/kernel/exceptions-64e.S
-+++ b/arch/powerpc/kernel/exceptions-64e.S
-@@ -757,6 +757,7 @@ storage_fault_common:
-       std     r14,_DAR(r1)
-       std     r15,_DSISR(r1)
-       addi    r3,r1,STACK_FRAME_OVERHEAD
-+      bl      .save_nvgprs
-       mr      r4,r14
-       mr      r5,r15
-       ld      r14,PACA_EXGEN+EX_R14(r13)
-@@ -765,8 +766,7 @@ storage_fault_common:
-       cmpdi   r3,0
-       bne-    1f
-       b       .ret_from_except_lite
--1:    bl      .save_nvgprs
--      mr      r5,r3
-+1:    mr      r5,r3
-       addi    r3,r1,STACK_FRAME_OVERHEAD
-       ld      r4,_DAR(r1)
-       bl      .bad_page_fault
-diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 902ca3c..e942155 100644
---- a/arch/powerpc/kernel/exceptions-64s.S
-+++ b/arch/powerpc/kernel/exceptions-64s.S
-@@ -1357,10 +1357,10 @@ handle_page_fault:
- 11:   ld      r4,_DAR(r1)
-       ld      r5,_DSISR(r1)
-       addi    r3,r1,STACK_FRAME_OVERHEAD
-+      bl      .save_nvgprs
-       bl      .do_page_fault
-       cmpdi   r3,0
-       beq+    12f
--      bl      .save_nvgprs
-       mr      r5,r3
-       addi    r3,r1,STACK_FRAME_OVERHEAD
-       lwz     r4,_DAR(r1)
-diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
-index 2e3200c..72095ce 100644
---- a/arch/powerpc/kernel/module_32.c
-+++ b/arch/powerpc/kernel/module_32.c
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
-                       me->arch.core_plt_section = i;
-       }
-       if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
--              printk("Module doesn't contain .plt or .init.plt sections.\n");
-+              printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
-               return -ENOEXEC;
-       }
-@@ -192,11 +192,16 @@ static uint32_t do_plt_call(void *location,
-       DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
-       /* Init, or core PLT? */
--      if (location >= mod->module_core
--          && location < mod->module_core + mod->core_size)
-+      if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+          (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
-               entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
--      else
-+      else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+               (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
-               entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+      else {
-+              printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+              return ~0UL;
-+      }
-       /* Find this entry, or if that fails, the next avail. entry */
-       while (entry->jump[0]) {
-diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 7baa27b..f6b394a 100644
---- a/arch/powerpc/kernel/process.c
-+++ b/arch/powerpc/kernel/process.c
-@@ -884,8 +884,8 @@ void show_regs(struct pt_regs * regs)
-        * Lookup NIP late so we have the best change of getting the
-        * above info out without failing
-        */
--      printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
--      printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
-+      printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
-+      printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
- #endif
- #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-       printk("PACATMSCRATCH [%llx]\n", get_paca()->tm_scratch);
-@@ -1345,10 +1345,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
-               newsp = stack[0];
-               ip = stack[STACK_FRAME_LR_SAVE];
-               if (!firstframe || ip != lr) {
--                      printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
-+                      printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-                       if ((ip == rth || ip == mrth) && curr_frame >= 0) {
--                              printk(" (%pS)",
-+                              printk(" (%pA)",
-                                      (void *)current->ret_stack[curr_frame].ret);
-                               curr_frame--;
-                       }
-@@ -1368,7 +1368,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
-                       struct pt_regs *regs = (struct pt_regs *)
-                               (sp + STACK_FRAME_OVERHEAD);
-                       lr = regs->link;
--                      printk("--- Exception: %lx at %pS\n    LR = %pS\n",
-+                      printk("--- Exception: %lx at %pA\n    LR = %pA\n",
-                              regs->trap, (void *)regs->nip, (void *)lr);
-                       firstframe = 1;
-               }
-@@ -1404,58 +1404,3 @@ void notrace __ppc64_runlatch_off(void)
-       mtspr(SPRN_CTRLT, ctrl);
- }
- #endif /* CONFIG_PPC64 */
--
--unsigned long arch_align_stack(unsigned long sp)
--{
--      if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--              sp -= get_random_int() & ~PAGE_MASK;
--      return sp & ~0xf;
--}
--
--static inline unsigned long brk_rnd(void)
--{
--        unsigned long rnd = 0;
--
--      /* 8MB for 32bit, 1GB for 64bit */
--      if (is_32bit_task())
--              rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
--      else
--              rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
--      return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--      unsigned long base = mm->brk;
--      unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
--      /*
--       * If we are using 1TB segments and we are allowed to randomise
--       * the heap, we can put it above 1TB so it is backed by a 1TB
--       * segment. Otherwise the heap will be in the bottom 1TB
--       * which always uses 256MB segments and this may result in a
--       * performance penalty.
--       */
--      if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
--              base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
--      ret = PAGE_ALIGN(base + brk_rnd());
--
--      if (ret < mm->brk)
--              return mm->brk;
--
--      return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
--      unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
--      if (ret < base)
--              return base;
--
--      return ret;
--}
-diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
-index 64f7bd5..8dd550f 100644
---- a/arch/powerpc/kernel/ptrace.c
-+++ b/arch/powerpc/kernel/ptrace.c
-@@ -1783,6 +1783,10 @@ long arch_ptrace(struct task_struct *child, long request,
-       return ret;
- }
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
-  * We must return the syscall number to actually look up in the table.
-  * This can be -1L to skip running any syscall at all.
-@@ -1795,6 +1799,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
-       secure_computing_strict(regs->gpr[0]);
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+      if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+              gr_delayed_cred_worker();
-+#endif
-+
-       if (test_thread_flag(TIF_SYSCALL_TRACE) &&
-           tracehook_report_syscall_entry(regs))
-               /*
-@@ -1829,6 +1838,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
- {
-       int step;
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+      if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+              gr_delayed_cred_worker();
-+#endif
-+
-       audit_syscall_exit(regs);
-       if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
-diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
-index 0f83122..c0aca6a 100644
---- a/arch/powerpc/kernel/signal_32.c
-+++ b/arch/powerpc/kernel/signal_32.c
-@@ -987,7 +987,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
-       /* Save user registers on the stack */
-       frame = &rt_sf->uc.uc_mcontext;
-       addr = frame;
--      if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+      if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
-               sigret = 0;
-               tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-       } else {
-diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index 887e99d..310bc11 100644
---- a/arch/powerpc/kernel/signal_64.c
-+++ b/arch/powerpc/kernel/signal_64.c
-@@ -751,7 +751,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
- #endif
-       /* Set up to return from userspace. */
--      if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+      if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
-               regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
-       } else {
-               err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
-index e68a845..8b140e6 100644
---- a/arch/powerpc/kernel/sysfs.c
-+++ b/arch/powerpc/kernel/sysfs.c
-@@ -522,7 +522,7 @@ static int __cpuinit sysfs_cpu_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata sysfs_cpu_nb = {
-+static struct notifier_block sysfs_cpu_nb = {
-       .notifier_call  = sysfs_cpu_notify,
- };
-diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
-index 88929b1..bece8f8 100644
---- a/arch/powerpc/kernel/traps.c
-+++ b/arch/powerpc/kernel/traps.c
-@@ -141,6 +141,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
-       return flags;
- }
-+extern void gr_handle_kernel_exploit(void);
-+
- static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
-                              int signr)
- {
-@@ -190,6 +192,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
-               panic("Fatal exception in interrupt");
-       if (panic_on_oops)
-               panic("Fatal exception");
-+
-+      gr_handle_kernel_exploit();
-+
-       do_exit(signr);
- }
-diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
-index d4f463a..8fb7431 100644
---- a/arch/powerpc/kernel/vdso.c
-+++ b/arch/powerpc/kernel/vdso.c
-@@ -34,6 +34,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
- #include "setup.h"
-@@ -222,7 +223,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
-       vdso_base = VDSO32_MBASE;
- #endif
--      current->mm->context.vdso_base = 0;
-+      current->mm->context.vdso_base = ~0UL;
-       /* vDSO has a problem and was disabled, just don't "enable" it for the
-        * process
-@@ -242,7 +243,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
-       vdso_base = get_unmapped_area(NULL, vdso_base,
-                                     (vdso_pages << PAGE_SHIFT) +
-                                     ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
--                                    0, 0);
-+                                    0, MAP_PRIVATE | MAP_EXECUTABLE);
-       if (IS_ERR_VALUE(vdso_base)) {
-               rc = vdso_base;
-               goto fail_mmapsem;
-diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
-index 5eea6f3..5d10396 100644
---- a/arch/powerpc/lib/usercopy_64.c
-+++ b/arch/powerpc/lib/usercopy_64.c
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
--      if (likely(access_ok(VERIFY_READ, from, n)))
--              n = __copy_from_user(to, from, n);
--      else
--              memset(to, 0, n);
--      return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
--      if (likely(access_ok(VERIFY_WRITE, to, n)))
--              n = __copy_to_user(to, from, n);
--      return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
-                          unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
-       return n;
- }
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
-diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
-index 8726779..a33c512 100644
---- a/arch/powerpc/mm/fault.c
-+++ b/arch/powerpc/mm/fault.c
-@@ -33,6 +33,10 @@
- #include <linux/magic.h>
- #include <linux/ratelimit.h>
- #include <linux/context_tracking.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -69,6 +73,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
- }
- #endif
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+      return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+      unsigned long i;
-+
-+      printk(KERN_ERR "PAX: bytes at PC: ");
-+      for (i = 0; i < 5; i++) {
-+              unsigned int c;
-+              if (get_user(c, (unsigned int __user *)pc+i))
-+                      printk(KERN_CONT "???????? ");
-+              else
-+                      printk(KERN_CONT "%08x ", c);
-+      }
-+      printk("\n");
-+}
-+#endif
-+
- /*
-  * Check whether the instruction at regs->nip is a store using
-  * an update addressing form which will update r1.
-@@ -216,7 +247,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
-        * indicate errors in DSISR but can validly be set in SRR1.
-        */
-       if (trap == 0x400)
--              error_code &= 0x48200000;
-+              error_code &= 0x58200000;
-       else
-               is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -371,7 +402,7 @@ good_area:
-          * "undefined".  Of those that can be set, this is the only
-          * one which seems bad.
-          */
--      if (error_code & 0x10000000)
-+      if (error_code & DSISR_GUARDED)
-                 /* Guarded storage error. */
-               goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -386,7 +417,7 @@ good_area:
-                * processors use the same I/D cache coherency mechanism
-                * as embedded.
-                */
--              if (error_code & DSISR_PROTFAULT)
-+              if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
-                       goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
-@@ -471,6 +502,23 @@ bad_area:
- bad_area_nosemaphore:
-       /* User mode accesses cause a SIGSEGV */
-       if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+              if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+                      if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+                      if (is_exec && regs->nip == address) {
-+#endif
-+                              switch (pax_handle_fetch_fault(regs)) {
-+                              }
-+
-+                              pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+                              do_group_exit(SIGKILL);
-+                      }
-+              }
-+#endif
-+
-               _exception(SIGSEGV, regs, code, address);
-               goto bail;
-       }
-diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 67a42ed..cd463e0 100644
---- a/arch/powerpc/mm/mmap_64.c
-+++ b/arch/powerpc/mm/mmap_64.c
-@@ -57,6 +57,10 @@ static unsigned long mmap_rnd(void)
- {
-       unsigned long rnd = 0;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       if (current->flags & PF_RANDOMIZE) {
-               /* 8MB for 32bit, 1GB for 64bit */
-               if (is_32bit_task())
-@@ -91,10 +95,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
-        */
-       if (mmap_is_legacy()) {
-               mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area;
-               mm->unmap_area = arch_unmap_area;
-       } else {
-               mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area_topdown;
-               mm->unmap_area = arch_unmap_area_topdown;
-       }
-diff --git a/arch/powerpc/mm/mmu_context_nohash.c b/arch/powerpc/mm/mmu_context_nohash.c
-index e779642..e5bb889 100644
---- a/arch/powerpc/mm/mmu_context_nohash.c
-+++ b/arch/powerpc/mm/mmu_context_nohash.c
-@@ -363,7 +363,7 @@ static int __cpuinit mmu_context_cpu_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata mmu_context_cpu_nb = {
-+static struct notifier_block mmu_context_cpu_nb = {
-       .notifier_call  = mmu_context_cpu_notify,
- };
-diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
-index cafad40..9cbc0fc 100644
---- a/arch/powerpc/mm/numa.c
-+++ b/arch/powerpc/mm/numa.c
-@@ -920,7 +920,7 @@ static void __init *careful_zallocation(int nid, unsigned long size,
-       return ret;
- }
--static struct notifier_block __cpuinitdata ppc64_numa_nb = {
-+static struct notifier_block ppc64_numa_nb = {
-       .notifier_call = cpu_numa_callback,
-       .priority = 1 /* Must run before sched domains notifier. */
- };
-diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
-index 3e99c14..f00953c 100644
---- a/arch/powerpc/mm/slice.c
-+++ b/arch/powerpc/mm/slice.c
-@@ -103,7 +103,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
-       if ((mm->task_size - len) < addr)
-               return 0;
-       vma = find_vma(mm, addr);
--      return (!vma || (addr + len) <= vma->vm_start);
-+      return check_heap_stack_gap(vma, addr, len, 0);
- }
- static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
-@@ -277,6 +277,12 @@ static unsigned long slice_find_area_bottomup(struct mm_struct *mm,
-       info.align_offset = 0;
-       addr = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (mm->pax_flags & MF_PAX_RANDMMAP)
-+              addr += mm->delta_mmap;
-+#endif
-+
-       while (addr < TASK_SIZE) {
-               info.low_limit = addr;
-               if (!slice_scan_available(addr, available, 1, &addr))
-@@ -410,6 +416,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
-       if (fixed && addr > (mm->task_size - len))
-               return -EINVAL;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+              addr = 0;
-+#endif
-+
-       /* If hint, make sure it matches our alignment restrictions */
-       if (!fixed && addr) {
-               addr = _ALIGN_UP(addr, 1ul << pshift);
-diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
-index 9098692..3d54cd1 100644
---- a/arch/powerpc/platforms/cell/spufs/file.c
-+++ b/arch/powerpc/platforms/cell/spufs/file.c
-@@ -280,9 +280,9 @@ spufs_mem_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-       return VM_FAULT_NOPAGE;
- }
--static int spufs_mem_mmap_access(struct vm_area_struct *vma,
-+static ssize_t spufs_mem_mmap_access(struct vm_area_struct *vma,
-                               unsigned long address,
--                              void *buf, int len, int write)
-+                              void *buf, size_t len, int write)
- {
-       struct spu_context *ctx = vma->vm_file->private_data;
-       unsigned long offset = address - vma->vm_start;
-diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
-index bdb738a..49c9f95 100644
---- a/arch/powerpc/platforms/powermac/smp.c
-+++ b/arch/powerpc/platforms/powermac/smp.c
-@@ -885,7 +885,7 @@ static int smp_core99_cpu_notify(struct notifier_block *self,
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata smp_core99_cpu_nb = {
-+static struct notifier_block smp_core99_cpu_nb = {
-       .notifier_call  = smp_core99_cpu_notify,
- };
- #endif /* CONFIG_HOTPLUG_CPU */
-diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
-index c797832..ce575c8 100644
---- a/arch/s390/include/asm/atomic.h
-+++ b/arch/s390/include/asm/atomic.h
-@@ -326,6 +326,16 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
- #define atomic64_dec_and_test(_v)     (atomic64_sub_return(1, _v) == 0)
- #define atomic64_inc_not_zero(v)      atomic64_add_unless((v), 1, 0)
-+#define atomic64_read_unchecked(v)            atomic64_read(v)
-+#define atomic64_set_unchecked(v, i)          atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v)          atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v)   atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v)          atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v)             atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v)      atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v)             atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n)   atomic64_cmpxchg((v), (o), (n))
-+
- #define smp_mb__before_atomic_dec()   smp_mb()
- #define smp_mb__after_atomic_dec()    smp_mb()
- #define smp_mb__before_atomic_inc()   smp_mb()
-diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
-index 4d7ccac..d03d0ad 100644
---- a/arch/s390/include/asm/cache.h
-+++ b/arch/s390/include/asm/cache.h
-@@ -9,8 +9,10 @@
- #ifndef __ARCH_S390_CACHE_H
- #define __ARCH_S390_CACHE_H
--#define L1_CACHE_BYTES     256
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT     8
-+#define L1_CACHE_BYTES     (_AC(1,UL) << L1_CACHE_SHIFT)
- #define NET_SKB_PAD      32
- #define __read_mostly __attribute__((__section__(".data..read_mostly")))
-diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
-index 78f4f87..598ce39 100644
---- a/arch/s390/include/asm/elf.h
-+++ b/arch/s390/include/asm/elf.h
-@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE               (randomize_et_dyn(STACK_TOP / 3 * 2))
-+#define ELF_ET_DYN_BASE               (STACK_TOP / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE   (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN    (test_thread_flag(TIF_31BIT) ? 15 : 26)
-+#define PAX_DELTA_STACK_LEN   (test_thread_flag(TIF_31BIT) ? 15 : 26)
-+#endif
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports. */
-@@ -222,9 +228,6 @@ struct linux_binprm;
- #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
- int arch_setup_additional_pages(struct linux_binprm *, int);
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- void *fill_cpu_elf_notes(void *ptr, struct save_area *sa);
- #endif
-diff --git a/arch/s390/include/asm/exec.h b/arch/s390/include/asm/exec.h
-index c4a93d6..4d2a9b4 100644
---- a/arch/s390/include/asm/exec.h
-+++ b/arch/s390/include/asm/exec.h
-@@ -7,6 +7,6 @@
- #ifndef __ASM_EXEC_H
- #define __ASM_EXEC_H
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- #endif /* __ASM_EXEC_H */
-diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
-index 9c33ed4..e40cbef 100644
---- a/arch/s390/include/asm/uaccess.h
-+++ b/arch/s390/include/asm/uaccess.h
-@@ -252,6 +252,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-       might_fault();
-+
-+      if ((long)n < 0)
-+              return n;
-+
-       return __copy_to_user(to, from, n);
- }
-@@ -275,6 +279,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+      if ((long)n < 0)
-+              return n;
-+
-       if (__builtin_constant_p(n) && (n <= 256))
-               return uaccess.copy_from_user_small(n, from, to);
-       else
-@@ -306,10 +313,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct")
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
--      unsigned int sz = __compiletime_object_size(to);
-+      size_t sz = __compiletime_object_size(to);
-       might_fault();
--      if (unlikely(sz != -1 && sz < n)) {
-+
-+      if ((long)n < 0)
-+              return n;
-+
-+      if (unlikely(sz != (size_t)-1 && sz < n)) {
-               copy_from_user_overflow();
-               return n;
-       }
-diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
-index 7845e15..59c4353 100644
---- a/arch/s390/kernel/module.c
-+++ b/arch/s390/kernel/module.c
-@@ -169,11 +169,11 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
-       /* Increase core size by size of got & plt and set start
-          offsets for got and plt. */
--      me->core_size = ALIGN(me->core_size, 4);
--      me->arch.got_offset = me->core_size;
--      me->core_size += me->arch.got_size;
--      me->arch.plt_offset = me->core_size;
--      me->core_size += me->arch.plt_size;
-+      me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+      me->arch.got_offset = me->core_size_rw;
-+      me->core_size_rw += me->arch.got_size;
-+      me->arch.plt_offset = me->core_size_rx;
-+      me->core_size_rx += me->arch.plt_size;
-       return 0;
- }
-@@ -289,7 +289,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
-               if (info->got_initialized == 0) {
-                       Elf_Addr *gotent;
--                      gotent = me->module_core + me->arch.got_offset +
-+                      gotent = me->module_core_rw + me->arch.got_offset +
-                               info->got_offset;
-                       *gotent = val;
-                       info->got_initialized = 1;
-@@ -312,7 +312,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
-                       rc = apply_rela_bits(loc, val, 0, 64, 0);
-               else if (r_type == R_390_GOTENT ||
-                        r_type == R_390_GOTPLTENT) {
--                      val += (Elf_Addr) me->module_core - loc;
-+                      val += (Elf_Addr) me->module_core_rw - loc;
-                       rc = apply_rela_bits(loc, val, 1, 32, 1);
-               }
-               break;
-@@ -325,7 +325,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
-       case R_390_PLTOFF64:    /* 16 bit offset from GOT to PLT. */
-               if (info->plt_initialized == 0) {
-                       unsigned int *ip;
--                      ip = me->module_core + me->arch.plt_offset +
-+                      ip = me->module_core_rx + me->arch.plt_offset +
-                               info->plt_offset;
- #ifndef CONFIG_64BIT
-                       ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -350,7 +350,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
-                              val - loc + 0xffffUL < 0x1ffffeUL) ||
-                             (r_type == R_390_PLT32DBL &&
-                              val - loc + 0xffffffffULL < 0x1fffffffeULL)))
--                              val = (Elf_Addr) me->module_core +
-+                              val = (Elf_Addr) me->module_core_rx +
-                                       me->arch.plt_offset +
-                                       info->plt_offset;
-                       val += rela->r_addend - loc;
-@@ -372,7 +372,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
-       case R_390_GOTOFF32:    /* 32 bit offset to GOT.  */
-       case R_390_GOTOFF64:    /* 64 bit offset to GOT. */
-               val = val + rela->r_addend -
--                      ((Elf_Addr) me->module_core + me->arch.got_offset);
-+                      ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
-               if (r_type == R_390_GOTOFF16)
-                       rc = apply_rela_bits(loc, val, 0, 16, 0);
-               else if (r_type == R_390_GOTOFF32)
-@@ -382,7 +382,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
-               break;
-       case R_390_GOTPC:       /* 32 bit PC relative offset to GOT. */
-       case R_390_GOTPCDBL:    /* 32 bit PC rel. off. to GOT shifted by 1. */
--              val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+              val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
-                       rela->r_addend - loc;
-               if (r_type == R_390_GOTPC)
-                       rc = apply_rela_bits(loc, val, 1, 32, 0);
-diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
-index 2bc3edd..ab9d598 100644
---- a/arch/s390/kernel/process.c
-+++ b/arch/s390/kernel/process.c
-@@ -236,39 +236,3 @@ unsigned long get_wchan(struct task_struct *p)
-       }
-       return 0;
- }
--
--unsigned long arch_align_stack(unsigned long sp)
--{
--      if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--              sp -= get_random_int() & ~PAGE_MASK;
--      return sp & ~0xf;
--}
--
--static inline unsigned long brk_rnd(void)
--{
--      /* 8MB for 32bit, 1GB for 64bit */
--      if (is_32bit_task())
--              return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
--      else
--              return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--      unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
--
--      if (ret < mm->brk)
--              return mm->brk;
--      return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
--      unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
--      if (!(current->flags & PF_RANDOMIZE))
--              return base;
--      if (ret < base)
--              return base;
--      return ret;
--}
-diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
-index 06bafec..2bca531 100644
---- a/arch/s390/mm/mmap.c
-+++ b/arch/s390/mm/mmap.c
-@@ -90,10 +90,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
-        */
-       if (mmap_is_legacy()) {
-               mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area;
-               mm->unmap_area = arch_unmap_area;
-       } else {
-               mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
-               mm->get_unmapped_area = arch_get_unmapped_area_topdown;
-               mm->unmap_area = arch_unmap_area_topdown;
-       }
-@@ -175,10 +187,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
-        */
-       if (mmap_is_legacy()) {
-               mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-               mm->get_unmapped_area = s390_get_unmapped_area;
-               mm->unmap_area = arch_unmap_area;
-       } else {
-               mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
-               mm->get_unmapped_area = s390_get_unmapped_area_topdown;
-               mm->unmap_area = arch_unmap_area_topdown;
-       }
-diff --git a/arch/score/include/asm/cache.h b/arch/score/include/asm/cache.h
-index ae3d59f..f65f075 100644
---- a/arch/score/include/asm/cache.h
-+++ b/arch/score/include/asm/cache.h
-@@ -1,7 +1,9 @@
- #ifndef _ASM_SCORE_CACHE_H
- #define _ASM_SCORE_CACHE_H
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT                4
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #endif /* _ASM_SCORE_CACHE_H */
-diff --git a/arch/score/include/asm/exec.h b/arch/score/include/asm/exec.h
-index f9f3cd5..58ff438 100644
---- a/arch/score/include/asm/exec.h
-+++ b/arch/score/include/asm/exec.h
-@@ -1,6 +1,6 @@
- #ifndef _ASM_SCORE_EXEC_H
- #define _ASM_SCORE_EXEC_H
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) (x)
- #endif /* _ASM_SCORE_EXEC_H */
-diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
-index f4c6d02..e9355c3 100644
---- a/arch/score/kernel/process.c
-+++ b/arch/score/kernel/process.c
-@@ -116,8 +116,3 @@ unsigned long get_wchan(struct task_struct *task)
-       return task_pt_regs(task)->cp0_epc;
- }
--
--unsigned long arch_align_stack(unsigned long sp)
--{
--      return sp;
--}
-diff --git a/arch/sh/include/asm/cache.h b/arch/sh/include/asm/cache.h
-index ef9e555..331bd29 100644
---- a/arch/sh/include/asm/cache.h
-+++ b/arch/sh/include/asm/cache.h
-@@ -9,10 +9,11 @@
- #define __ASM_SH_CACHE_H
- #ifdef __KERNEL__
-+#include <linux/const.h>
- #include <linux/init.h>
- #include <cpu/cache.h>
--#define L1_CACHE_BYTES                (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES                (_AC(1,UL) << L1_CACHE_SHIFT)
- #define __read_mostly __attribute__((__section__(".data..read_mostly")))
-diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
-index 03f2b55..b0270327 100644
---- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c
-+++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
-@@ -143,7 +143,7 @@ shx3_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
-       return NOTIFY_OK;
- }
--static struct notifier_block __cpuinitdata shx3_cpu_notifier = {
-+static struct notifier_block shx3_cpu_notifier = {
-       .notifier_call          = shx3_cpu_callback,
- };
-diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
-index 6777177..cb5e44f 100644
---- a/arch/sh/mm/mmap.c
-+++ b/arch/sh/mm/mmap.c
-@@ -36,6 +36,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
-       struct mm_struct *mm = current->mm;
-       struct vm_area_struct *vma;
-       int do_colour_align;
-+      unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-       struct vm_unmapped_area_info info;
-       if (flags & MAP_FIXED) {
-@@ -55,6 +56,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
-       if (filp || (flags & MAP_SHARED))
-               do_colour_align = 1;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       if (addr) {
-               if (do_colour_align)
-                       addr = COLOUR_ALIGN(addr, pgoff);
-@@ -62,14 +67,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
-                       addr = PAGE_ALIGN(addr);
-               vma = find_vma(mm, addr);
--              if (TASK_SIZE - len >= addr &&
--                  (!vma || addr + len <= vma->vm_start))
-+              if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
-                       return addr;
-       }
-       info.flags = 0;
-       info.length = len;
--      info.low_limit = TASK_UNMAPPED_BASE;
-+      info.low_limit = mm->mmap_base;
-       info.high_limit = TASK_SIZE;
-       info.align_mask = do_colour_align ? (PAGE_MASK & shm_align_mask) : 0;
-       info.align_offset = pgoff << PAGE_SHIFT;
-@@ -85,6 +89,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-       struct mm_struct *mm = current->mm;
-       unsigned long addr = addr0;
-       int do_colour_align;
-+      unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-       struct vm_unmapped_area_info info;
-       if (flags & MAP_FIXED) {
-@@ -104,6 +109,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-       if (filp || (flags & MAP_SHARED))
-               do_colour_align = 1;
-+#ifdef CONFIG_PAX_RANDMMAP
-+      if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-       /* requesting a specific address */
-       if (addr) {
-               if (do_colour_align)
-@@ -112,8 +121,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-                       addr = PAGE_ALIGN(addr);
-               vma = find_vma(mm, addr);
--              if (TASK_SIZE - len >= addr &&
--                  (!vma || addr + len <= vma->vm_start))
-+              if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
-                       return addr;
-       }
-@@ -135,6 +143,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-               VM_BUG_ON(addr != -ENOMEM);
-               info.flags = 0;
-               info.low_limit = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+              if (mm->pax_flags & MF_PAX_RANDMMAP)
-+                      info.low_limit += mm->delta_mmap;
-+#endif
-+
-               info.high_limit = TASK_SIZE;
-               addr = vm_unmapped_area(&info);
-       }
-diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
-index be56a24..443328f 100644
---- a/arch/sparc/include/asm/atomic_64.h
-+++ b/arch/sparc/include/asm/atomic_64.h
-@@ -14,18 +14,40 @@
- #define ATOMIC64_INIT(i)      { (i) }
- #define atomic_read(v)                (*(volatile int *)&(v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+      return v->counter;
-+}
- #define atomic64_read(v)      (*(volatile long *)&(v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+      return v->counter;
-+}
- #define atomic_set(v, i)      (((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+      v->counter = i;
-+}
- #define atomic64_set(v, i)    (((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+      v->counter = i;
-+}
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(long, atomic64_t *);
-+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(long, atomic64_t *);
-+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
- extern int atomic_add_ret(int, atomic_t *);
-+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
- extern long atomic64_add_ret(long, atomic64_t *);
-+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern long atomic64_sub_ret(long, atomic64_t *);
-@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
- #define atomic_inc_return(v) atomic_add_ret(1, v)
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+      return atomic_add_ret_unchecked(1, v);
-+}
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+      return atomic64_add_ret_unchecked(1, v);
-+}
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
- #define atomic_add_return(i, v) atomic_add_ret(i, v)
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+      return atomic_add_ret_unchecked(i, v);
-+}
- #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+      return atomic64_add_ret_unchecked(i, v);
-+}
- /*
-  * atomic_inc_and_test - increment and test
-@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
-  * other cases.
-  */
- #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+      return atomic_inc_return_unchecked(v) == 0;
-+}
- #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
- #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
-@@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+      atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+      atomic64_add_unchecked(1, v);
-+}
- #define atomic_dec(v) atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+      atomic_sub_unchecked(1, v);
-+}
- #define atomic64_dec(v) atomic64_sub(1, v)
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+      atomic64_sub_unchecked(1, v);
-+}
- #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
- #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
- #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+      return cmpxchg(&v->counter, old, new);
-+}
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+      return xchg(&v->counter, new);
-+}
- static inline int __atomic_add_unless(atomic_t *v, int a, int u)
- {
--      int c, old;
-+      int c, old, new;
-       c = atomic_read(v);
-       for (;;) {
--              if (unlikely(c == (u)))
-+              if (unlikely(c == u))
-                       break;
--              old = atomic_cmpxchg((v), c, c + (a));
-+
-+              asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+                           "tvs %%icc, 6\n"
-+#endif
-+
-+                           : "=r" (new)
-+                           : "0" (c), "ir" (a)
-+                           : "cc");
-+
-+              old = atomic_cmpxchg(v, c, new);
-               if (likely(old == c))
-                       break;
-               c = old;
-@@ -88,20 +165,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
- #define atomic64_cmpxchg(v, o, n) \
-       ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
- #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+      return xchg(&v->counter, new);
-+}
- static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--      long c, old;
-+      long c, old, new;
-       c = atomic64_read(v);
-       for (;;) {
--              if (unlikely(c == (u)))
-+              if (unlikely(c == u))
-                       break;
--              old = atomic64_cmpxchg((v), c, c + (a));
-+
-+              asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+                           "tvs %%xcc, 6\n"
-+#endif
-+
-+                           : "=r" (new)
-+                           : "0" (c), "ir" (a)
-+                           : "cc");
-+
-+              old = atomic64_cmpxchg(v, c, new);
-               if (likely(old == c))
-                       break;
-               c = old;
-       }
--      return c != (u);
-+      return c != u;
- }
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
-index 5bb6991..5c2132e 100644
---- a/arch/sparc/include/asm/cache.h
-+++ b/arch/sparc/include/asm/cache.h